News for hackers. Stuff that matters.
Re:Second Factor SMS: Worse Than Its Reputation by somehelpdeskguy on Thursday July 11, 2024 @10:22AM (#40937138)
"...with a replay attack in the background."

Wouldn't this be MITM?

Re:Second Factor SMS: Worse Than Its Reputation by leni536 on Thursday July 11, 2024 @11:52AM (#40937977)
I'm not familiar with the nuances of terminology, but I would expect MITM to only apply when you (and your computer) actually attempt to connect to service A, and a malicious actor X intercepts that communication. Phishing is different in the sense that you connect to the phishing page directly, and it may or may not replay some of your inputs to the actual service it is phishing.
Re:Second Factor SMS: Worse Than Its Reputation by ReK_ on Thursday July 11, 2024 @12:22PM (#40938215)
I guess theoretically phishing could be considered MiTM, but the latter term generally implies the attack is fully transparent to the user, whereas phishing convinces the user to insert the malicious party themselves.
Re:Second Factor SMS: Worse Than Its Reputation by dools on Thursday July 11, 2024 @10:42PM (#40942375)
I called this a "replay attack" because it sounds more like this:

"A replay attack in a network communications setting involves intercepting a successful authentication process—often using a valid session token that gives a particular user access to the network—and replaying that authentication to the network to gain access"

Even though this wasn't a session token, it was an authentication process and token, gathered from a fraudlent source and replayed to a valid source.

MITM is:

"A man in the middle (MITM) attack is a general term for when a perpetrator positions himself in a conversation between a user and an application—either to eavesdrop or to impersonate one of the parties, making it appear as if a normal exchange of information is underway."

So to me a MITM would be more like using a wifi access point to access the correct banking URL, but the service carrying the data was acting maliciously.