A Network Forensics System Bypassing Web Local Encryption Businesses

Abstract:

Sniffer and MITM attack can do nothing to local encryption, which is a new technology, because the plaintext is merely encrypted in user’s browser. Therefore, this paper proposed a clever way to bypass local encryption to achieve the goal of network forensics, based on the idea of MITM attack. A middle device is added to the key point of the network in which the forensics is realized through hijacking and tampering with HTML pages. The system redirects the IP packet to another computer in LAN by hijacking the real IP of the server. That computer fakes the real web server, and then by inserting some code in HTML page, the unencrypted plaintext is got before the code of local encryption been executed. The results show that the object is not aware of the existence of the forensics system, but the system has logged all the information of a HTTP request, including the plaintext bypassed local encryption.

• Periodical: Key Engineering Materials (Volumes 426-427)
• Pages: 494-498
• DOI: https://doi.org/10.4028/www.scientific.net/KEM.426-427.494
• Online since: January 2010
• Authors: P. Li, R.Z. Wang, Y.Z. Zhang, D.W. Chen
• Keywords: IP Hijack, JS Script, Local Encryption, MITM Attack, Network Forensics System

References

[1] H.J. Guo and Z.G. Jin: Electronic Measurement Technology Vol. 29(2006), p.75.

[2] P.J. Salzman, M. Burian and O. Pomerantz: The Linux Kernel Module Programming Guide (Machinery Industry Press, China 2001).

[3] W.T. Liu: �etwork Security Detailed Development Kit (Electronics Industry Press, China 2005).

[4] B. Molay: Unix/Linux Programming Practice Guide (Tsinghua University Press, China 2004).

[5] A. David. Rusling: Linux Programming White Paper (Machinery Industry Press, China 2000).