6

There was a man-in-the-middle attack on bitcointalk on Dec 2013.

News: If you used your password to login between 06:00 Dec 1 UTC and 20:00 UTC, then your password may have been captured in a man-in-the-middle attack, and you should change your password here and wherever else you used it. If you were only logged in via the "remember me" feature, then you're OK.

How was this executed? Didn't bitcointalk use SSL? Are there technical details on the attack vector?

3 Answers 3

3

The general description has been given before me.Here are technical details on the attack vector.

Assuming the following:

  • The attacker got a certificate that the client will accept, via poor cert validation or other means.
  • The attacker knows the IP address of the server, and is in a position on the network to do things like ARP spoofing.

Ettercap includes modules for ARP, DNS and DHCP "interventions", and supports direct SSL MITM

2
  • 1
    Do you have specific knowledge that the attackers got such a certificate, or are you speculating? Commented Dec 3, 2013 at 13:34
  • I'm just stating a possibility Commented Dec 3, 2013 at 20:55
-1

Sure. They just hacked their cloudflare account, and set different IP address for the domain bitcointalk. Therefore, every visitor was actually logging into malicious form.

1
  • 1
    This doesn't address the SSL question. Commented Dec 2, 2013 at 14:57
-1

In cryptography and computer security Man in the Middle is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).

Bitcointalk uses SSL.How they got passed it, I don't know

1
  • 3
    Yeah, I know what Man in the Middle is. The question was about the specific details of this attack, especially SSL.
    – ripper234
    Commented Dec 3, 2013 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.