• Home
  • Categories
    • Protection
    • Hostile Environment
    • Industry News
    • Intel
    • Career Advice
    • Surveillance
    • Cybersecurity
    • Maritime
    • Risk Management
    • Fitness
    • Medical
    • Training
    • Equipment
    • Reviews
  • Daily Briefing
  • Subscription
  • The Magazine
  • Podcast
  • Contribute
  • Advertise
  • Contact Us

Circuit Magazine

For Security & Protection Specialists

Get free circuit subscription with BBA membership
You are here: Home / Cybersecurity / The Man in the Middle – Intro to Cybersecurity

The Man in the Middle – Intro to Cybersecurity

Welcome to a third article in the series looking at introductions to cyber security. We’ll be looking at a type of attack which most people will be familiar with in principle, if not in technical practice.

The basic idea is simple – an attacker sits between two trusting parties, intercepting their communication and impersonating each to the other. Obviously this is somewhat harder in practice where people are, for example, sitting in a room together, but even a phone call gives potential for an eavesdropper or impersonator.

Becoming the man in the middle is harder with some technologies than others and hinges on somehow sitting in the middle of the connection. With computers talking over a network a technique called ARP spoofing makes this relatively easy, where the two sides of the conversation are fooled into sending their messages to the attacker’s computer rather than each other. Even when encryption is used each computer believes they are talking to a trusted recipient, so all passwords and keys are assumed to be trusted.

The restrictions are that the attacker must somehow have access to the network between two people, and be able to successfully impersonate them. Where they need to, for example, access an office and plug a computer in there are obvious physical security methods that will help to prevent this (though not guarantee it). Sadly, more and more technology relies on wireless networks instead, where an attacker simply needs to have a malicious node within range, and even where wireless networking isn’t used the tools needed to perform a man in the middle attack are easily and cheaply available.


Tools

The WiFi Pineapple is probably the most famous of these, particularly after its alleged use by GRU intelligence units to break into the networks of the World Anti Doping Agency, a nuclear energy company in Pennsylvania, and the Organisation for the Prohibition of Chemical Weapons. You can get hold of the cheaper, smaller WiFi Pineapple shown here for around $100. With a mobile phone and an appropriate USB cable it’s perfectly possible to then sit in Starbucks and intercept the network traffic of everyone around you.

Another popular tool, more for cabled networks, is the LAN Turtle shown here. Essentially it’s plugged into the back of a computer USB port, a network cable plugged in, and unless it’s discovered an attacker then has their own hostile computer on the network – almost invisible unless detection keys are used. Available on Amazon for about $50.

Of course neither of these will help with mobile phone networks – for that a Stingray device, for years a top secret, is more effective. A professional Stingray device comes with all sorts of restrictions, and high pricing. Building your own involves some knowledge, a laptop, about $20 of parts (available on Amazon), and a half hour of time.


Finding and Beating the Man in the Middle

There are ways to beat the man in the middle, of course. Website certificates are becoming more and more common every day and go a long way towards at least warning users – though it’s far too common for people to simply click through and ignore the security warnings now built in to most browsers. Since the attacker can put up their own false certificates, or simply strip certificates out of the equation entirely, it’s important that training on how website certificates work, what to look for, and what errors mean, is made available. In theory at least a certificate is only issued to people who can prove that they own the website it’s used for, and mostly this theory holds true.

A first check is to make sure the certificate is valid – normally you will be warned if it isn’t

You can see that the certificate was issued to the site it’s being used for – it’s now down to whether or not you trust that the issuer checked who they were granting it to, and that no one has managed to steal their signing certificate

Certificates aren’t so helpful if you’re concerned about a phone call or text message being intercepted though. Luckily there are a lot of solutions to provide encrypted calls, chats, and text messages, varying in price and trustworthiness. WhatsApp is one of the more popular ones, though there are some serious security concerns being raised around it.

My personal preference for both price (free) and effectiveness is a system called Signal (https://signal.org/), which works on Android and iPhone as well as desktop, provides end-to-end encryption for text messaging, and covers phone calls. One important feature provided is so-called ‘Safety Numbers’, essentially a password you can exchange in person or through some other mechanism to confirm that the phone at the other end is the one you’re expecting – anyone attempting to hijack the communication after a number has been verified will alert you that the number is being changed. Of course, many others are also available.

Hopefully you’ve found this useful. Next time we’ll be looking at the supposed Internet of Things, smart devices, and how they can be turned against their owners.

 


The Man in the Middle – Intro to Cybersecurity Part 3
By: 
James Bore

James Bore is a cybersecurity ‘Jack of all trades’ by vocation and choice. In over a decade he has gathered experience meandering across a range of industry sectors, organizations, and disciplines in IT, always with a focus on championing and improving security. Currently, he works for an entertainment and hospitality company, and in rare spare time runs a blog on cybersecurity https://coffeefueled.org

Buy The Latest Issue

Sign Up For News and Updates

We respect your privacy and will not share your information with anyone.
We will only message you when we have something relevant and of value to share with you.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Latest Issue

Circuit magazine cover issue 55

Issue 55

Buy Now

Latest Industry News

Industry News October 2020

We cast our eye over the main stories impacting the security industry. Here’s what’s appeared on the radar since the last issue.

Security industry News Brought to you by the Circuit Magazine

Industry News

We cast our eye over the main stories impacting the security industry, including, Kanye West’s former bodyguard is calling the rapper a “bully” and is threatening to sue for damages after West accused him of breaking a confidentiality agreement.

Industry News

We cast our eye over the main stories impacting the security industry. Here’s what’s appeared on the radar since the last issue.

Security industry News Brought to you by the Circuit Magazine

Security Industry Association Announces New SIA Women in Security Scholarship Opportunity

“The SIA Women in Security Forum works to grow and retain leaders in the security industry,” said Gloria Salmeron, director of human resources at Brivo and co-chair of the scholarship committee. “With the addition of this new scholarship, we look forward to helping bring opportunities for further education and advancement to as wide a spectrum of people as possible and inviting individuals to participate in the Women in Security Forum.”

Product Review earHero

Product Review – Ear Hero

Designed by an audiologist, earHero’s speakers are so tiny they will never block your ear canal giving you the ability to literally talk on a separate phone without removing the earHero tactical earpiece from either ear.

You can literally hear whisper level sounds from yards away, while identifying the sounds’ precise location. The earHero tactical headsets have wires so thin and clear, they are virtually undetectable, and the design is so comfortable, you’ll barely know the earpiece is there.

Introduction to Cybersecurity Part 4

Insecure Smart Houses

They are only of limited relevance today, but as the technologies involved become more widespread and implemented into every facet of life they will only become more prevalent. While it sounds like the stuff of science fiction, these threats exist now and are not going to go away.

For simplicity, we’ll say that a ‘smart’ device is anything which connects to the internet (or a network) and is not intended to be a computer interface. Intended is the key word there, as many of these devices are insecure for the simple reason that they are a computer. The problem is that it is now cheaper and easier to put a general purpose computer into a device and run some software to, for example, turn lights on and off than it is to design a single-purpose lightbulb which also connects to a network.

Behavioral Analysis

Turning Habitual Habits into a Positive

Being an instructor for Tony Scotti’s Vehicle Dynamics Institute has forwarded the opportunity to observe how a large section of professionals interact and function from different niches of the industry. Military, transnational EP teams, US based teams, Federal LEO’s or with civilians this theme shows through. Even in the larger training arena the change can be seen as more of the schools are starting to focus on classes or blocks of instruction such as client management and behavioral analysis. The discussion forms are flooded with conversations relating to how to work in a team dynamic. It doesn’t matter if its a 28 day school or a three day school, they will be touching on and teaching these topics.

Global Risk

Global Situation report provided by Stratfor

Global Situation Report October, 2020

Having informed insight in today’s increasingly complex international environment is more important than ever. That’s why we’ve partnered with Stratfor, the worlds leading geopolitical intelligence platform, to bring readers regular analysis and accurate forecasting of global trends from someone you can trust.

Popular Tags

Afghanistan armed attack Bodyguard Bodyguarding Celebrity client Close Protection Close Protection Officer Elijah Shaw Executive Executive Protection fight firearm gun Intelligence Iraq Law Enforcement Medical military News online police Prevention professional protect protection PTSD Risk Risk Assessment Risk Management Safety Security Security Incidents Security Industry Authority SIA Social Media Surveillance terror Terrorism terrorist Threat train Training VIP

On The Frontline

Keeping Your Edge

Keeping Your Edge – Protectors & The Recording Process

An excerpt from the best-selling book, An Introduction to Celebrity Protection & Touring by Elijah Shaw & Dale … >>>

A Day in the Life: Assisting On a Protection Assignment

A Day in the Life:   Assisting On a Protection Assignment   You are at home getting some rest, and your cell phone … >>>

On the Ground in Iraq – A Medics Experience

How the industry has changed and evolved. The role of the medic working on the ground in hostile environments has … >>>

Follow us

  • Email
  • Facebook
  • Twitter

From The Archives

Search Tactics for Out of Work Security Professionals

Being out of work for a long time is every security professionals nightmare. 90% of men and women on the protection … >>>

Countering Snipers Part 2

Countering Sniper Operations The first step in countering snipers is for everyone to be aware of the threat. This is … >>>

Global Risk Roundup – August 2019

Our Global Risk partners, Drum Cussac, provide in-depth analysis of global risks via in-house experts, cutting edge … >>>

Jeff Bezos

Executive Protection Fail – Jeff Bezos

The National Enquirer said it had been investigating Bezos for four months, tracking the Amazon CEO "across five states … >>>

  • Terms And Conditions
  • Magazines
  • Privacy Policy
  • Archives

© 2021 Circuit Magazine · Rainmaker Platform

This website or its third-party tools use cookies which are necessary to its functioning and required to improve your experience. By clicking the consent button, you agree to allow the site to use, collect and/or store cookies.
I accept