<p>The general description has been given before me.Here are technical details on the attack vector.</p>

<p>Assuming the following:</p>

<ul>
<li>The attacker got a certificate that the client will accept, via poor cert validation or other means.</li>
<li>The attacker knows the IP address of the server, and is in a position on the network to do things like ARP spoofing.</li>
</ul>

<p>Ettercap includes modules for ARP, DNS and DHCP "interventions", and supports direct SSL MITM </p>

CC BY-SA 3.0
2013-12-03T13:34:12.263Z
Do you have specific knowledge that the attackers got such a certificate, or are you speculating?
Nate Eldredge
CC BY-SA 3.0
2013-12-03T20:55:31.660Z
I'm just stating a possibility
Meterbuchus
CC BY-SA 3.0
2013-12-03T09:04:24.237Z
2013-12-03T09:04:24.237Z
Meterbuchus
<p>In cryptography and computer security Man in the Middle is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).</p>

<p>Bitcointalk uses SSL.How they got passed it, I don't know</p>

CC BY-SA 3.0
2013-12-03T06:46:50.650Z
Yeah, I know what Man in the Middle is. The question was about the specific details of this attack, especially SSL.
ripper234
CC BY-SA 3.0
2013-12-02T15:21:15.337Z
2013-12-02T15:21:15.337Z
Manna Kanuga 
<p>Sure.
They just hacked their cloudflare account, and set different IP address for the domain bitcointalk. Therefore, every visitor was actually logging into malicious form. </p>

CC BY-SA 3.0
2013-12-02T14:57:59.137Z
This doesn't address the SSL question.
Nate Eldredge
CC BY-SA 3.0
2013-12-02T14:43:29.263Z
2013-12-02T14:43:29.263Z
Maciej Mączko
<p>There was a <a href="http://www.reddit.com/r/Bitcoin/comments/1rvrrn/bitcointalkorg_man_in_the_middle_attack_change/">man-in-the-middle attack on bitcointalk</a> on Dec 2013.</p>

<blockquote>
  <p>News: If you used your password to login between 06:00 Dec 1 UTC and
  20:00 UTC, then your password may have been captured in a
  man-in-the-middle attack, and you should change your password here and
  wherever else you used it. If you were only logged in via the
  "remember me" feature, then you're OK.</p>
</blockquote>

<p>How was this executed? Didn't bitcointalk use SSL? Are there technical details on the attack vector?</p>

<bitcointalk>
How was bitcointalk attacked in Dec 2013?
ripper234
# How was bitcointalk attacked in Dec 2013?

(Asked by: username_0 on 2013-12-02)

There was a [man-in-the-middle attack on bitcointalk](http://www.reddit.com/r/Bitcoin/comments/1rvrrn/bitcointalkorg_man_in_the_middle_attack_change/) on Dec 2013.

> News: If you used your password to login between 06:00 Dec 1 UTC and
> 20:00 UTC, then your password may have been captured in a
> man-in-the-middle attack, and you should change your password here and
> wherever else you used it. If you were only logged in via the
> "remember me" feature, then you're OK.

How was this executed? Didn't bitcointalk use SSL? Are there technical details on the attack vector?

**Tags:** bitcointalk


---

## 3 answers

### Answer by username_1 on 2013-12-03. Score: 3

The general description has been given before me.Here are technical details on the attack vector.

Assuming the following:

* The attacker got a certificate that the client will accept, via poor cert validation or other means.
* The attacker knows the IP address of the server, and is in a position on the network to do things like ARP spoofing.

Ettercap includes modules for ARP, DNS and DHCP "interventions", and supports direct SSL MITM

> **Comments:**
> **username_2**: Do you have specific knowledge that the attackers got such a certificate, or are you speculating?  
> **username_1**: I'm just stating a possibility  

---

### Answer by username_3 on 2013-12-02. Score: -1

In cryptography and computer security Man in the Middle is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).

Bitcointalk uses SSL.How they got passed it, I don't know

> **Comments:**
> **username_0**: Yeah, I know what Man in the Middle is. The question was about the specific details of this attack, especially SSL.  

---

### Answer by username_4 on 2013-12-02. Score: -1

Sure.
They just hacked their cloudflare account, and set different IP address for the domain bitcointalk. Therefore, every visitor was actually logging into malicious form.

> **Comments:**
> **username_2**: This doesn't address the SSL question.  

---

