Category Archives: man-in-the-middle

Why is the "intermediate" challenge needed in Bluetooth ECDH since the "real" verification is performed at the end with code comparison?

Posted on by

Why is step 4 needed? What does it protect in terms of security? Doesn’t the protection arrives from the last step so when Va and Vb (so called TK, Temporary Keys) are compared?
Other thing: I read somewhere that Cb is sent immediately an… Continue reading Why is the "intermediate" challenge needed in Bluetooth ECDH since the "real" verification is performed at the end with code comparison?→

What kinds of attacks are eliminated in WPA2-PSK if for each device there’s a different (secret) PSK?

Posted on by

With regular WPA2-PSK there’s the fact that every device shares the same PSK, hence it’s possible to impersonate the AP by setting up an Evil Twin and watching the traffic. This isn’t possible without knowing the PSK, so for a setup where … Continue reading What kinds of attacks are eliminated in WPA2-PSK if for each device there’s a different (secret) PSK?→

In TLS, how are the Diffie-Hellman exchange parameters protected from a MITM attack? [duplicate]

Posted on by

Authentication alone will not stop a MITHM from intercepting and modifying plaintext exchanges, since he can let the authentication occur, then begin modifying the exchange data and neither end will sense anything wrong.
What am I missing … Continue reading In TLS, how are the Diffie-Hellman exchange parameters protected from a MITM attack? [duplicate]→

Can a VPN company perform a MiTM attack if SSL Pinning is in place?

Posted on by

Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users’ traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they have executed the same attack if Snapcha… Continue reading Can a VPN company perform a MiTM attack if SSL Pinning is in place?→