Sort attacks that cut into communication by where they cut in: partway along the network path, or inside the user's browser.
For abuse of mail relaying (third-party relay, also called open relay), explain the act of abuse and the server configuration that allows it as two sides of the same thing.
Distinguish spoofing and hijacking techniques by the information they fake or steal: the source IP address, name-resolution information, or a session ID.
A man-in-the-middle attack (中間者攻撃) is one in which an attacker secretly places themselves between two communicating parties and eavesdrops (盗聴) on or tampers (改ざん) with the data they exchange.
← Scroll the figure sideways →
The attacker poses as the server to the user and as the user to the server, passing data in both directions through their own hands. Because each side believes it is talking directly to the other, neither is likely to notice when the contents are read or altered on the way. Unencrypted traffic and connections made without checking whether the other side is genuine are easy targets, and the defenses are encrypting the traffic and confirming the other party is authentic, for instance by validating its server certificate.
AnalogyIt is like a messenger carrying letters between two people who quietly opens each one, reads it, adds a few lines, and then delivers it. The recipient has no idea the messenger tampered with it along the way.
How to rememberThe Japanese name is a direct rendering of "man-in-the-middle", shortened to MITM from its initials.
Exam points
Mix-upA man-in-the-middle attack (中間者攻撃) goes beyond eavesdropping (盗聴), which only reads the data: the attacker can also rewrite it while passing it on.
A man-in-the-browser (MITB) attack (MITB攻撃) is one in which malware (マルウェア, malicious software) that has got into the user's device takes over the browser and rewrites what the screen shows and what gets sent, from inside the browser.
Malware hides in the browser
The user enters the transaction
The content is altered before sending
It reaches the bank over the genuine connection
The altered request arrives over the genuine encrypted connection, and the bank processes it as the customer's own.
4 / 4
The main target is online banking: the site the user opens is the real one, and the user logs in correctly themselves. The malware may even keep showing the details exactly as the user typed them, so the user is unlikely to notice anything wrong.
AnalogyIt is like a fake clerk standing beside you at the counter who swaps your completed application form for a different one just as it leaves your hand. The counter accepts the form it receives as yours.
How to rememberThe name swaps the "middle" in man-in-the-middle for "browser": the man in the middle has moved into the browser.
Exam points
ExamIn a man-in-the-browser attack (MITB攻撃), malware (マルウェア) that has hijacked the browser quietly alters online banking (インターネットバンキング) transactions without the user noticing, leading to fraudulent transfers and the like.
Mix-upA man-in-the-browser attack (MITB攻撃) alters data on the device before it is encrypted, so encrypting (暗号化) the connection does not stop it. What helps is protection against malware (マルウェア) on the device and a way to confirm the transaction through a separate channel.
Third-party relay (第三者中継) is the act of an outsider with no connection to a mail server getting that server to relay (中継, forward a received message on to another server) their mail, using it to send messages.
An outside attacker asks it to send mail
An unrestricted mail server accepts
Relayed to outside recipients
The server is seen as the sender
To the recipients, the relaying server looks like the sender, and the attacker stays hidden.
4 / 4
Attackers typically look for servers that accept mail from outside addressed to outside, route mail through them, and send spam in bulk. A device used as a pass-through for abuse like this is called a stepping stone (踏み台); because the recipients see the stepping-stone server as the sender, the attacker can hide their own identity.
AnalogyIt is like a company reception desk taking a stack of letters from a passer-by who is neither staff nor a visitor and mailing them out under the company's name. The complaints go to the company, not the passer-by.
Exam points
Mix-upThird-party relay (第三者中継) does not only harm the people who receive the spam (迷惑メール). The owner of the mail server it passes through is also taken for the sender and loses trust.
An open relay (オープンリレー) is a mail server configuration that relays mail from anyone to anyone without restriction, never checking the sender or the recipient; it is also called third-party relay (第三者中継).
Mail flow
Proper configuration
Open relay
From the organization's users to outside
Relayed
Relayed
From outside to the organization's users
Accepted
Accepted
From outside to outside
Rejected
Relayed anyway
Once attackers find an open relay, they use it as a stepping stone for third-party relay. The fix is to configure the server to relay only mail sent by the organization's own users and to reject mail from outside addressed to outside. This setting still lets the organization's users send mail and still accepts mail from outside addressed to the organization.
AnalogyIt is like a parcel depot that sends out anything brought to it without looking at either the address or the sender.
How to remember"Open" means open to anyone, and "relay" is the same word as in a relay race, where the baton is handed on to the next runner.
Exam points
Mix-upOpen relay (オープンリレー) and third-party relay (第三者中継) are often used to mean the same thing. The first names it from the side of the server's configuration weakness, the second from the side of whoever exploits that weakness to send mail through someone else's server.
Third-Party Relay vs. Open Relay
Aspect
Third-Party Relay
Open Relay
Key differenceMain focus
The act of sending mail through someone else's server
A server configuration that relays without restriction
IP spoofing (IPスプーフィング) is a technique that forges the source IP address (IPアドレス) of the packets (パケット, the small units data is split into for sending) so they look as if they came from another device.
The source field is rewritten to a permitted device's address
A device that judges senders by IP address alone
Lets it through as permitted traffic
Each packet carries a source IP address alongside its destination, and the receiving device normally trusts that value to decide who sent it. Because the sender can rewrite the source value, a system that permits traffic on IP address alone can be breached by packets posing as an approved device, and the countermeasure is authentication that does not depend only on the IP address. The technique is also used to hide where an attack comes from.
AnalogyIt is like writing a trusted business partner's address in the return-address corner of an envelope. If the recipient opens it based on the return address alone, they are fooled.
How to rememberThe English word "spoof" means to trick someone or to mimic something in fun.
Exam points
ExamIP spoofing (IPスプーフィング) is a means of unauthorized access that sends packets (パケット) with a forged source IP address (IPアドレス).
ExamIP spoofing (IPスプーフィング) is a technical disguise aimed at machines. It is not social engineering (ソーシャルエンジニアリング), which extracts information by playing on people's psychology and carelessness.
DNS cache poisoning (DNSキャッシュポイズニング) is an attack that slips false entries into the name-resolution information a DNS server (DNSサーバ) keeps temporarily, so that users are sent to a fake site.
The attacker injects a false mapping
It stays in the DNS server's cache
The user queries the correct domain name
A false IP address comes back and leads to the fake site
The false IP address in the cache is returned, and the user's browser connects to the fake site.
4 / 4
DNS is the name-resolution system that looks up a device's IP address from its domain name, and a DNS server keeps the results it has looked up as a cache (キャッシュ, temporary storage for reuse). While the cache is poisoned, every user who asks that DNS server about the domain name is affected. This can lead to login details and other information being entered on the fake site and stolen, and DNSSEC, which uses digital signatures to verify that DNS responses are genuine, is one countermeasure.
AnalogyIt is like someone writing a fake shop's address onto the map at a town information desk as the location of a real shop. The people who ask for the shop by its correct name are exactly the ones sent straight to the fake one.
How to remember"Poisoning" pictures slipping poison into the cache, the pool where name-resolution information collects.
Exam points
ExamDNS cache poisoning (DNSキャッシュポイズニング) rewrites, on a server, the information used to look up an IP address (IPアドレス) from a domain name (ドメイン名), so that users land on a fake site.
Mix-upPhishing (フィッシング) tricks people with fake emails and the like into visiting a fake site. DNS cache poisoning (DNSキャッシュポイズニング) corrupts name-resolution information instead, so users reach the fake site even when they type the correct domain name.
Session hijacking (セッションハイジャック) is an attack in which the attacker steals the information that identifies the continuing exchange after login, the session (セッション), and takes over that communication by posing as the user.
A session ID is issued at login
The attacker obtains the session ID
The attacker sends requests with that ID
The server treats them as the user's own
The server does not ask for the password again and accepts the attacker's requests as the user's.
4 / 4
A web service issues each logged-in user an identifying value called a session ID (セッションID) and passes it back and forth in a cookie (a small piece of data a site has the browser store) or similar, to confirm the user is logged in. If an attacker obtains this value by eavesdropping, guessing, or extracting it with a script, they can act as the user without knowing the password.
AnalogyIt is like stealing the wristband an amusement park puts on you at the gate: with it, someone can ride the attractions as you without buying a ticket. The staff let people through by looking at the wristband alone.
How to remember"Hijack" is the same word used for seizing a plane or a car; here the thing seized is the session.
Exam points
ExamIf a cookie holding session-identifying information leaks through cross-site scripting (クロスサイトスクリプティング) or a similar attack, the attacker may be treated as the user and misuse that user's account.
Mix-upUnlike attacks that steal passwords, session hijacking (セッションハイジャック) seizes the state that exists after login is complete. The attacker gets into the user's communication without passing authentication.