ITPEC FE Morning April 2020 Question 39
Man-in-The-Middle (MITM) attack means the attacker intercepts and alters the communication between the end-user (victim) and the server, which is shown below. In an MITM attack, when the victim sends packets to the server, the attacker receives the packets and then forwards them to the server while the server sends the packets to the victim via the attacker. In this communication channel, which of the following is the appropriate description concerning the MITM attack?
Explanation
The victim's IP toward the server, the server's IP toward the victim — the attacker impersonates each end to the other.
In the figure the attacker sits in the middle of the channel. For the relay to stay invisible, each side must believe it is talking directly to the other:
- •To the server, the attacker poses as the victim, so the requests it forwards carry the victim's IP
- •To the victim, the attacker poses as the server, so the responses it forwards carry the server's IP
Answer (c)
Why not others:
- •(a) — using the server's IP toward the server as well would make the server see itself as the client, and the forwarded requests would not look like the victim's
- •(b) — using the victim's IP toward the victim would make responses appear to come from the victim's own address, not from the server
- •(d) — swaps the directions: each side would see its own address as the peer, which exposes the relay
Key rule: A man-in-the-middle impersonates the other party to each side; authenticating the peer (for example with TLS certificates) is what breaks it.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.