so last month was pretty wild. found out we had someone sitting between our remote workers and cloud servers for WEEKS. the kicker? our expensive security stack missed it completely started when a few employees mentioned cert warnings on vpn connections. you know how it is - users just click through warnings. but something felt off so i dug into the packet captures turns out someone was being super selective, only intercepting:
- vpn auth sequences
- emails with project keywords
- database queries from analytics team
they kept bandwidth low to avoid detection. smart bastards, what really got me was they used fake wifi APs at airports. not just any airports they mapped out where our sales team traveled. chicago ohare, LAX, you name it, since then ive been documenting everything about mitm attacks and prevention. main things that saved us:
- arp table monitoring (finally!)
- certificate pinning
- teaching users that cert warnings = stop everything
curious what detection methods you all use? were looking at arpon and better siem rules but always open to suggestions. been writing up the whole technical breakdown if anyones interested in the details. whats the sneakiest mitm youve dealt with?
For anyone dealing with similar issues, I documented the technical details and our response plan here: https://ncse.info/man-in-the-middle-attacks/ Would love to hear what tools you guys recommend for MITM detection?
[link] [comments]