mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-01-25 23:11:02 +08:00
已翻译 by 小眼儿
This commit is contained in:
tinyeyeser
GitHub
parent
25a151b514
commit
b6944f93a7
@ -1,94 +0,0 @@
|
||||
[#]: collector: (lujun9972)
|
||||
[#]: translator: (tinyeyeser )
|
||||
[#]: reviewer: ( )
|
||||
[#]: publisher: ( )
|
||||
[#]: url: ( )
|
||||
[#]: subject: (How to avoid man-in-the-middle cyber attacks)
|
||||
[#]: via: (https://opensource.com/article/20/4/mitm-attacks)
|
||||
[#]: author: (Jackie Lam https://opensource.com/users/beenverified)
|
||||
|
||||
How to avoid man-in-the-middle cyber attacks
|
||||
======
|
||||
Understanding MITM attacks is the first step in not being a victim of
|
||||
this high-tech style of eavesdropping.
|
||||
![Security monster][1]
|
||||
|
||||
Whether you're sending data on your computer or talking to someone online, you want to assume some level of security and privacy.
|
||||
|
||||
But what if a third party is eavesdropping online, unbeknownst to you? And worse, what if they're impersonating someone from a business you trust in order to gain damaging information? This could put your personal data into the hands of dangerous, would-be thieves.
|
||||
|
||||
Welcome to what's called a man-in-the-middle (MITM) attack.
|
||||
|
||||
### What are man-in-the-middle attacks?
|
||||
|
||||
A man-in-the-middle attack occurs when a cybercriminal inserts themselves into communications between you, the targeted victim, and a device in order to steal sensitive information that can be used for a variety of criminal purposes—most notably identity theft, says Steve J. J. Weisman, founder of Scamicide.
|
||||
|
||||
"A man-in-the-middle-attack can also occur when the victim believes he or she is communicating with a legitimate app or website," says Weisman, "when the truth is that the victim is communicating with a phony website or app and thereby providing sensitive information to the criminal."
|
||||
|
||||
One of the oldest forms of cyberattacks, MITM attacks have been around since the 1980s. What's more, they're quite common. As Weisman explains, there are a handful of ways a MITM attack can happen:
|
||||
|
||||
* **Attacking a WiFi router that is not properly secured:** This typically occurs when someone is using public WiFi. "While home routers might be vulnerable, it's more common for criminals to attack public WiFi networks," says Weisman. The goal is to spy on unsuspecting people who are handling sensitive information, such as their online bank accounts, he adds.
|
||||
* **Hacking email accounts of banks, financial advisers, and other companies:** "Once [the criminals] have hacked these email systems, they send out emails that appear to come from the legitimate bank or other company," Weisman says. "[They ask] for personal information, such as usernames and passwords, under the guise of an emergency. The targeted victim is lured into providing that information."
|
||||
* **Sending phishing emails:** Thieves might also send emails pretending to be legitimate companies that the targeted victim does business with, asking the recipient for their personal information. "In many instances, the spear-phishing emails will direct the victim to a counterfeit website that appears to be that of a legitimate company with which the victim does business," says Weisman.
|
||||
* **Using malicious code in legitimate websites:** Attackers can also place malicious code—usually JavaScript—into a legitimate website by way of a web application. "When the victim loads the legitimate page, the malicious code just sits in the background until the user enters sensitive information, such as account login or credit card details, which the malicious code then copies and sends to the attackers' servers," says Nicholas McBride, a cybersecurity consultant.
|
||||
|
||||
|
||||
|
||||
### What is an example of an MITM attack?
|
||||
|
||||
The Lenovo case is a well-known example of an MITM attack. In 2014 and 2015, the major computer manufacturer sold consumer laptops with preinstalled software that meddled with how a user's browser communicated with websites. Whenever the user's cursor hovered over a product, this software, called VisualDiscovery, sent pop-up ads from retail partners that sold similar products.
|
||||
|
||||
Here's the kicker: This MITM attack allowed VisualDiscovery to access all of the user's personal data, including social security numbers, info about financial transactions, medical info, and logins and passwords. All without the user knowing or granting permission beforehand. The FTC deemed this a deceptive and unfair online scam. Lenovo agreed to pay $8.3 million in a class-action settlement in 2019.
|
||||
|
||||
### How can I protect myself from an online attack?
|
||||
|
||||
* **Avoid using public WiFi:** Weisman recommends never using public WiFi for financial transactions unless you've installed a reliable virtual private network (VPN) client on your device and have a VPN host you can use and trust. Over a VPN connection, your communications are encrypted, so your information can't be stolen.
|
||||
|
||||
* **Be on the lookout:** Be wary of emails or text messages that ask you to update your password or provide your username or personal information. These methods can be used to steal your identity.
|
||||
|
||||
If you are unsure of the actual identity of the party sending you the email, you can use tools such as a reverse phone or email search. With a reverse phone number lookup, you may be able to find out more about the identity of an unknown texter. And with a reverse email lookup, you can try to determine who might have sent you a message.
|
||||
|
||||
Generally, if something's actually a problem, you'll hear from someone you know and trust within your company, or from someone you can also go and meet, in person, at your bank or school or other organization. Important account information is never the purview of an unknown technician.
|
||||
|
||||
* **Don't click on links contained in emails:** If someone sends you an email telling you that you need to sign into an account, don't click on the link provided in the email. Instead, navigate to the site yourself, log in as you normally would, and look for an alert there. If you don't see an alert message in your account settings, contact a representative by phone using contact information on the site and _not_ from the email.
|
||||
|
||||
* **Install reliable security software:** If you're on Windows, install good open source antivirus like [ClamAV][2]. On all platforms, keep your software up to date with the latest security patches.
|
||||
|
||||
* **Take alerts seriously:** If you're visiting a site that starts with HTTPS, your browser might alert you to an issue, says McBride. For instance, if the domain name on the site's certificate doesn't match the one you're trying to visit. Don't ignore the alert. Heed it and navigate away from the site for now. Verify that you haven't [mistyped it][3], and if the problem persists, contact the site owner if you can.
|
||||
|
||||
* **Use an ad blocker:** Pop-up ads (also known as _adware attacks_) can be used to intercept your personal information, so use an ad blocker. "The truth is, as an individual user, it's hard to protect against a MITM attack," says McBride, "as it is designed to leave the victim in the dark and to prevent them from noticing that there is anything wrong."
|
||||
|
||||
A good open source ad blocker (or "wide-spectrum blocker," in the developer's words) is [uBlock origin][4]. It's available for both Firefox and Chromium (and all Chromium-based browsers, such as Chrome, Brave, Vivaldi, Edge, and so on), and even Safari.
|
||||
|
||||
|
||||
|
||||
|
||||
### Stay alert
|
||||
|
||||
Remember, you don't have to click anything online right away, and you don't have to follow random people's instructions, no matter how urgent they may seem. The internet will still be there after you step away from the computer and verify the identity of a person or site demanding your attention.
|
||||
|
||||
While MITM attacks can happen to anyone, understanding what they are, knowing how they happen, and actively taking steps to prevent them can safeguard you from being a victim.
|
||||
|
||||
* * *
|
||||
|
||||
_This article was originally published on [BeenVerified.com][5] under a [CC BY-SA 2.0][6] license._
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/mitm-attacks
|
||||
|
||||
作者：[Jackie Lam][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/beenverified
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/security_password_chaos_engineer_monster.png?itok=J31aRccu (Security monster)
|
||||
[2]: https://www.clamav.net
|
||||
[3]: https://opensource.com/article/20/1/stop-typosquatting-attacks
|
||||
[4]: https://github.com/gorhill/uBlock
|
||||
[5]: https://www.beenverified.com/crime/what-is-a-man-in-the-middle-attack/
|
||||
[6]: https://creativecommons.org/licenses/by-sa/2.0/
|
||||
@ -0,0 +1,84 @@
|
||||
[#]: collector: "lujun9972"
|
||||
[#]: translator: " "
|
||||
[#]: reviewer: " "
|
||||
[#]: publisher: " "
|
||||
[#]: url: " "
|
||||
[#]: subject: "How to avoid man-in-the-middle cyber attacks"
|
||||
[#]: via: "https://opensource.com/article/20/4/mitm-attacks"
|
||||
[#]: author: "Jackie Lam https://opensource.com/users/beenverified"
|
||||
|
||||
如何避免中间人攻击
|
||||
======
|
||||
|
||||
首先搞明白到底什么是中间人攻击，才能避免成为此类高科技窃听的受害者。
|
||||
|
||||
![Security monster][1]
|
||||
|
||||
当你使用电脑发送数据或与某人在线通话的时候，你一定采取了某种程度的安全隐私手段。
|
||||
|
||||
但如果有第三方在你不知情的情况下窃听，甚至冒充某个你信任的商业伙伴窃取破坏性的信息呢？你的私人数据就这样被放在了危险分子的手中。
|
||||
|
||||
这就是臭名昭著的中间人攻击。
|
||||
|
||||
### 到底什么是中间人攻击？
|
||||
|
||||
黑客潜入到你与受害者或是某个设备间的通信过程中，窃取敏感信息——多数是身份信息——进而从事各种违法行为的过程，就是一次中间人攻击。Scamicide公司创始人Steve J. J. Weisman介绍说：
|
||||
|
||||
“中间人攻击也可以发生在受害者与某个合法app或网页中间。当受害者以为自己面对的是正常app或网页时，其实Ta 正在与一个仿冒的app或网页互动，将自己的敏感信息透露给不法分子。”
|
||||
|
||||
中间人攻击诞生于1980年代，是最古老的网络攻击形式之一。但它却更为常见。Weisman解释道，发生中间人攻击的场景有很多种：
|
||||
|
||||
* **攻陷一个未有效加密的WiFi路由器**：该场景多见于人们使用公共WiFi的时候。“虽然家用路由器也很脆弱，但黑客攻击公共WiFi网络的情况更为常见。”Weisman说，“黑客的目标就是从毫无戒心的人们那里窃取在线银行账户这样的敏感信息。”
|
||||
* **攻陷银行、金融顾问等机构的电子邮件账户**：“一旦黑客攻陷了这些电子邮件系统，他们就会冒充银行或此类公司给受害者发邮件”，Weisman说，”他们以紧急情况的名义索要个人信息，诸如用户名和密码。受害者很容易被诱骗交出这些信息。“
|
||||
* **发送钓鱼邮件**：窃贼们还可能冒充成与受害者有合作关系的公司，向其索要个人信息。”在多个案例中，钓鱼邮件会引导受害者访问一个伪造的网页，这个伪造的网页看起来就和受害者常常访问的合法公司网页一模一样。“Weisman说道。
|
||||
* **在合法网页中嵌入恶意代码**：攻击者还会把恶意代码——通常是JavaScript——嵌入到一个合法的网页中。”当受害者加载这个合法网页时，恶意代码首先按兵不动，直到用户输入账户登录或是信用卡信息时，恶意代码就会复制这些信息并将其发送至攻击者的服务器。“网络安全专家Nicholas McBride介绍说。
|
||||
|
||||
### 有哪些中间人攻击的著名案例？
|
||||
|
||||
联想作为主流的计算机制造厂商，在2014到2015年售卖的消费级笔记本电脑中预装了一款叫做 VisualDiscovery 的软件，拦截用户的网页浏览行为。当用户的鼠标在某个产品页面经过时，这款软件就会弹出一个来自合作伙伴的类似产品的广告。
|
||||
|
||||
这起中间人攻击事件的关键在于：VisualDiscovery 拥有访问用户所有私人数据的权限，包括身份证号、金融交易信息、医疗信息、登录名和密码等等。所有这些访问行为都是在用户不知情和未获得授权的情况下进行的。联邦交易委员会（FTC）认定此次事件为欺诈与不公平竞争。2019年，联想同意为此支付8300万美元的集体诉讼罚款。
|
||||
|
||||
### 我如何才能避免遭受中间人攻击？
|
||||
|
||||
* **避免使用公共WiFi：**Weisman建议，从来都不要使用公开的WiFi进行金融交易，除非你安装了可靠的VPN客户端并连接至可信任的VPN服务器。通过VPN连接，你的通信是加密的，信息也就不会失窃。
|
||||
* **时刻注意：**对要求你更新密码或是提供用户名等私人信息的邮件或文本消息要时刻保持警惕。这些手段很可能被用来窃取你的身份信息。
|
||||
|
||||
如果不确定收到的邮件来自于确切哪一方，你可以使用诸如电话反查或是邮件反查等工具。通过电话反查，你可以找出未知发件人的更多身份信息。通过邮件反查，你可以尝试确定谁给你发来了这条消息。
|
||||
|
||||
通常来讲，如果发现某些方面确实有问题，你可以听从公司中某个你认识或是信任的人的意见。或者，你也可以去你的银行、学校或其他某个组织，当面寻求他们的帮助。总之，重要的账户信息绝对不要透露给不认识的“技术人员”。
|
||||
|
||||
* **不要点击邮件中的链接：**如果有人给你发了一封邮件，说你需要登录某个账户，不要点击邮件中的链接。相反，要通过平常习惯的方式自行去访问，并留意是否有告警信息。如果在账户设置中没有看到告警信息，给客服打电话的时候也_不要_联系邮件中留的电话，而是站点页面中的联系人信息。
|
||||
* **安装可靠的安全软件：**如果你使用的是Windows操作系统，安装开源的杀毒软件，如[ClamAV][2]。如果使用的是其他平台，要保持你的软件安装有最新的安全补丁。
|
||||
* **认真对待告警信息：**如果你正在访问的页面以HTTPS开头，浏览器可能会出现一则告警信息。例如，站点证书的域名与你尝试访问的站点域名不相匹配。千万不要忽视此类告警信息。听从告警建议，迅速关掉页面。确认域名没有输入错误的情况下，如果情况依旧，要立刻联系站点所有者。
|
||||
* **使用广告屏蔽软件：**弹窗广告（也叫广告软件攻击）可被用于窃取个人信息，因此你还可以使用广告屏蔽类软件。对个人用户来说，中间人攻击其实是很难防范的，因为它被设计出来的时候，就是为了让受害者始终蒙在鼓里，意识不到任何异常。有一款不错的开源广告屏蔽软件叫 [uBlock origin][4]。可以同时支持Firefox和Chromium（以及所有基于Chromium的浏览器，例如Chrome、Brave、Vivaldi、Edge等），甚至还支持Safari。
|
||||
|
||||
### 保持警惕
|
||||
|
||||
要时刻记住，你并不需要立刻就点击某些链接，你也并不需要跟随某个陌生人的建议，无论这些信息看起来有多么紧急。互联网始终都在。你大可以先离开电脑，去证实一下这些人的真实身份，看看这些”无比紧急“的页面到底是真是假。
|
||||
|
||||
尽管任何人都可能遭遇中间人攻击，只要弄明白何为中间人攻击，理解中间人攻击如何发生，并采取有效的防范措施，就可以保护自己避免成为其受害者。
|
||||
|
||||
* * *
|
||||
|
||||
_This article was originally published on [BeenVerified.com][5] under a [CC BY-SA 2.0][6] license._
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://opensource.com/article/20/4/mitm-attacks
|
||||
|
||||
作者：[Jackie Lam][a]
|
||||
选题：[lujun9972][b]
|
||||
译者：[tinyeyeser](https://github.com/tinyeyeser)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]: https://opensource.com/users/beenverified
|
||||
[b]: https://github.com/lujun9972
|
||||
[1]: https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/security_password_chaos_engineer_monster.png?itok=J31aRccu "Security monster"
|
||||
[2]: https://www.clamav.net
|
||||
[3]: https://opensource.com/article/20/1/stop-typosquatting-attacks
|
||||
[4]: https://github.com/gorhill/uBlock
|
||||
[5]: https://www.beenverified.com/crime/what-is-a-man-in-the-middle-attack/
|
||||
[6]: https://creativecommons.org/licenses/by-sa/2.0/
|
||||
Loading…
Reference in New Issue
Block a user