Full Disclosure: Re: Python ssl handling could be better...

[Tim <tim-security () sentinelchicken org>]

> The list does go on. However, I completely disagree with your
> assertion that "O(MitM) = O(sniff)"
>
> Yes there are many vectors to MITM at many levels, but they are
> (perhaps not ALL) not only detectable but also preventable in many scenarios.
>
> >  * DNS cache poisoning   =>    Don't fail at DNS
> >  * ARP poisoning  =>  use static ARP tables (and before you say "who on earth does that"- I do)
> >  * routing protocol poisoning (many kinds)  =>  (many solutions)
> >  * ICMP router redirects    =>    Get filtered by firewall before they ever reach me
> >  * NETBIOS name poisoning    =>    Don't ever use netbios for anything
> That should be fairly self-evident.
Ok great, but by comparing MitM with sniffing, we're already assuming
the attacker has access to the traffic.  Think about it.  There aren't
any networks in common use today which in their physical
implementation make alteration of packets harder than observation of
packets.  This is why the big-Os are the same.

I've had this conversation at many different times with different
people over the years.  I don't really have the time to continue this
one.  I think if you take the time to think about it from a
theoretical perspective, you'll come to understand the solid arguments
several of us are making.

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/