Also, while 1 is arguably a case of "physical access", I don't think 3 is. If you have a tap in an ISP, you don't have "physical access" to any of the endpoints of the HTTP connection. Otherwise, you could say you have "physical access" to literally every machine on the internet, since there is some physical path between you and that machine.
For another example, Kubernetes started as IPv4-only, and there are still plenty of plugins that have IPv4-only features.
“Passive eavesdropper” is often used to describe what you talk about. Someone on an unencrypted WiFi network sniffing your traffic isn’t really “in the middle” at all, after all.
"Active MITM" would be how you describe someone who does modify traffic.
And an attacker in each of the scenarios GP mentioned can modify traffic. (For ISP/attacker-controlled networks it's trivial; for other networks you just need to ARP spoof)
Spoofing the two endpoints to decrypt and re-encrypt, just so that you can evesdrop without modifying the data (other than the encryption) is certainly still "mitm". Yet all the man in the middle did was evesdrop. Becoming two endpoints in the middle was only an implimentetion detail required because of the encryption.
If you are admin of one of the mail servers along the way between sender and recipient and and can read all the plain smtp messages that pass through your hands like postcards without having to decrypt or spoof endpoints, that is still mitm.
So listening to wifi is no less. There is nothing substantive that makes it any different.
For endpoint-spoofing to be required for mitm, you would have to say that mitm only applies to modifying the data, which I don't think is so. Several purely evesdropping applications are still called mitm.
The monkey in the middle doesn't get to "relay" anything either, but he can sure see it going over his head.
The "eavesdropping" attack happens when you capture unecrypted packets. From there, you could either try to hijack the session by inserting yourself into the local conversation (effectively launching a "MITM" attack) or completely independently of the local conversation attempt to impersonate the login session (effectively launching an "impersonation" attack).
(Yes, I am indeed being pedantic on purpose to prove a point. I offer this parenthetical to you in place of an apology)
They may have chosen this wording ("it's not MITM") to get the team into action rather than dismissing the risk
Edit: another legitimate-sounding question downvoted in this thread without further comment (since I'm the only comment still after it got downvoted). Can people maybe just explain what's wrong with a post when it's not a personal attack, not off topic, not answered in the article, or any other obvious downvote reason? Everyone would appreciate the author learning from the problem if there is one
That's sniffing. The other two are MITM. The sniffer isn't in the middle of anything; you never speak to him.
So, mere evesdropping is mitm. So, how is evesdropping on unencrypted traffic or wifi traffic meaningfully different than evesdropping by decrypt & reencrypt?
I don't think the term mitm includes a requirement that you aren't talking to who you thought you were talking to, because generally you do still talk to who you thought you were, just not directly.
The traffic may be modified along the way rather than merely copied, or one or the other endpoint may be wholly faked rather than merely relayed, but they also may not be, the attacker may simply relay everything verbatim in both directions, IE pure evesdropping, and the attack would still be called mitm.
Then again, I guess a keylogger is evesdropping and not called mitm.
OK but we're talking about evesdropping HTTP, which is unencrypted.
One of us has not understood the others purpose, because I don't understand the point of your response to my first comment. Nothing is making sense after that.
My initial point was to show that mere evesdropping on an encrypted link is still mitm, and so the full interposition is merely an implimentation detail, required by the encryption.
If mere evesdropping is still mitm, then as far as I'm concerned any other evesdropping is also mitm.
But then I also add that a keylogger is an evesdropper and I wouldn't call that mitm so maybe the argument is missing something.
Maybe the way I should think of it is "Yeah. It's an implimentation detail. An implimentation detail called man in the middle. Evesdropping on an encrypted link requires mitm, but not all evesdropping is mitm the way all beef is meat but not all meat is beef."
IE the fact that you chose not to do anything with the mitm but merely evesdrop isn't really significant the way I argued at first. That particular example of "mere evesdropping" is still called mitm not because "therefor evesdropping is a form of mitm", but because that instance of evesdropping required mitm to do it.
Allll that said, I now actually think all those other examples of evesdropping like even a keylogger should be considered mitm. Because they are all examples of you're not talking to who you thought you were talking to. In the case of a passive observer like a wifi or keylogger or phone tap, you thought you were talking to a certain listener, but in fact you were talking to them plus other listeners.
It's perfectly logically arguable both ways.
You're right, my initial comment wasn't detailed enough to make the point I was trying to make. Let me try again; and just to be certain we're all on the same page, and not to patronise you - MITM here stands for 'Man In The Middle'.
Per your original comment:
> You have to mitm in order to evesdrop on an encrypted channel.
This is correct. The reason for this is important - the evesdropper has to decrypt the traffic, and the only way they can do that (assuming TLS or equivalent) is to get involved in the initial key exchange. If Alice and Bob are trying to communicate, and Eve wants to listen in, Eve has to spoof both Alice- and Bob's connections so that they (unwittingly) each negotiate an encrypted connection with Eve, instead of with each other. Then, Eve is 'in the middle' of the connection - all traffic explicitly travels through an endpoint controlled by Eve. The communication looks like Alice <-> Eve <-> Bob. Alice and Bob think they are communicating with each other, and as you point out, indirectly they are, but there is a Man (or Woman) In The Middle of the channel - Eve. Eve can do whatever she likes with the data - just store it, or modify it in some way. No matter what Eve chooses to do, the topology of the attack is, by definition, a MITM attack.
> If you do nothing but evesdrop, isn't it still mitm?
It depends on the topology of the connection. In the scenario above, then yes. However if Eve is just sniffing unencrypted wifi packets then no, because, again by definition, there is no third party in the middle of the communication channel. Wifi traffic is broadcast and therefore can be logged by anyone nearby without affecting the connection - just as you and I can both listen to the same radio station using different handsets (that's why busy wifi networks suffer congestion and have to use all kinds of tricks to deal with that - if every device is talking at once then the router can't easily pick them apart; they have to find ways to take turns).
In this situation it's more like Alice and Bob shouting at each other across a room, while Eve hides behind a curtain and listens in. Eve doesn't have to do anything to make this happen, apart from showing up - she is not involved in the communication channel in any way.
> If mere evesdropping is still mitm, then as far as I'm concerned any other evesdropping is also mitm.
Hopefully this is clearer now, but no, that's not true. The mechanism by which the evesdropping occurs defines whether or not the attack is a MITM attack. As an aside:
> Then again, I guess a keylogger is evesdropping and not called mitm.
Yes, a keylogger works as a kind of MITM - all communication between the keyboard and the applications travels through a third party of sorts.
Hopefully that's more useful?
...that's the requirement. The indirection of someone interposing themselves between you and the party you're trying to speak to is what is referred to by the phrase "man in the middle".
There is no phrase "man to the side". If you don't represent yourself as being the party they want to talk to, you aren't performing a man-in-the-middle attack.
MITM means that you need to be in the middle at the time of the attack and so is more limited than an attack that works on logs.
> Provider B: Reported on 2024-05-21 through their HackerOne program. Got a prompt triage response, stating that attacks requiring MITM (or physical access to a user's device) are outside the scope of the program. Sent back a response explaining that MITM or physical access was not required for sniffing. Awaiting response.
I think Provider B morally should require HTTPS, but it really surprises me that the author would say "MITM or physical access is not required for sniffing."
Is that true? Isn't HTTP sniffing an example of a MITM attack, by definition? Am I using the words "MITM" or "sniffing" differently from the author?
I'm familiar with the following attacks, all of which I'd call "MITM":
1. Public unencrypted (or weakly WEP encrypted) wifi, with clients connecting to HTTP websites. Other clients on the same wifi network can read the unencrypted HTTP packets over the air.
2. Public encrypted wifi, where the attacker controls the wifi network (or runs a proxy wifi with the same/similar SSID,) tricking the client into connecting to the attacker over non-TLS HTTP.
3. ISP-level attacks where the ISP reads the packets between you and the HTTP website.
Aren't all of these MITM attacks, or at the very least "physical access" attacks? How could anyone possibly perform HTTP sniffing without MITM or physical access??