On-path Attacks - CompTIA Security+ SY0-701 - 2.4

Understanding On-Path Attacks

Overview of On-Path Attacks

• An on-path attack, also known as a man-in-the-middle attack, allows an attacker to intercept and observe traffic between two devices.

• The attacker can monitor and potentially modify the information being transmitted without the knowledge of the victim devices, making it an invisible threat.

ARP Poisoning Explained

• One common type of on-path attack is ARP poisoning, which occurs within a local IP subnet where the attacker must be present.

• In ARP poisoning, an attacker sends false ARP responses to associate their MAC address with the IP address of another device (e.g., a router), allowing them to intercept traffic.

Process of ARP Communication

• When a laptop connects to a network, it broadcasts an ARP request to discover the MAC address corresponding to its gateway's IP address (e.g., 192.168.1.1).

• The router responds with its MAC address, which is then cached by the laptop for future communications.

Attack Execution

• An attacker on the same subnet can send a spoofed ARP response claiming to be the router, thus overwriting the legitimate MAC address in the laptop's cache.

• This manipulation causes all communication between the laptop and router to pass through the attacker's device, enabling monitoring or modification of data.

On-Path Browser Attacks

Definition and Mechanism

• An on-path browser attack involves malware that acts as a proxy on a victim's device, redirecting traffic before it reaches its destination.

Impact of Encryption

• Even if network traffic is encrypted, this type of malware can still capture sensitive information since it operates directly on the victim’s device.

Data Capture During Transactions