Man-in-the-Middle

Question 1

Man -in- the-middle

Answer 1

• How can a bad guy watch
without you knowing?
• Man-in-the-middle

• Redirects your traffic
  
  • Then passes it on to the destination
  • You never know your traffic was redirected
• ARP poisoning
  
  • ARP has no security

Question 2

Man-in-the-browser

Answer 2

• What if the middleman was on the same computer as the victim?
  
  • The calls are coming from inside the browser!
  • Malware/Trojan does all of the proxy work
• Huge advantages for the bad guys
  
  • Relatively easy to proxy encrypted traffic
  • Everything looks normal to the victim
• The man-in-the-browser waits for you to login to your bank
  
  • And cleans you out