Re: [saag] can an on-path attacker drop traffic?

[Dan Harkins <[e-mail]>]

   So what is an "active attacker" then? When people talk about protocol
security it is in the presence of a powerful attacker who can schedule
protocol sessions, and also view, modify, drop, and replay packets that
constitute the protocol. I always assumed a MITM was just an "active
attacker" in this sense.

   Seems we should be very careful when saying exactly what capabilities
this "on path attacker" has if it's not the same as a MITM/"active
attacker". And if these capabilities are a subset of the traditional
"active attacker" then what is the point of making the distinction?

   regards,

   Dan.

On 9/2/20 12:33 PM, Nico Williams wrote:
> On Wed, Sep 02, 2020 at 12:27:52PM -0400, Michael Richardson wrote:
>> A firewall or router is a potential on-path attacker, but it can also drop packets.
>> What do we call this?
>> This was historically called a MITM, and it implied all the attributes of
>> on-path.  But it is unclear to me if MITM > on-path, or MITM == on-path.
> To me on-path means physically or logically (e.g., after DNS spoofing or
> route take over) in the path.
>
> MITM is about being in the middle at some higher layer than IP.  For
> example, in TLS, which you can do if you can subvert a CA trusted by the
> client.
>
> You can have an on-path (physically) attacker who nonetheless cannot
> successfully mount an MITM attack on TLS traffic it gets to see and even
> alter.
>
> Nico