Meet Mary, Queen of Scots.
The year is 1568, and Mary has just been put in prison.
The reasons for this are fairly overlong and complicated,
but let’s just say it’s because
her cousin, Elizabeth - the first -
really doesn’t like her.
Understandably, Mary’s supporters aren’t too happy about her incarceration,
so 19 years into her sentence, some of them write to her
asking permission to assassinate Elizabeth.
Mary’s exact response has been lost, but what we do know
is that her reply is intercepted by Elizabeth’s spies, who alter her letter
asking for the identities of everyone involved in the plot.
The conspirators, apparently finding nothing at all suspicious about this,
happily oblige and long story short,
six months later Mary and all of her pen-pals have been put to death.
So where did Mary go wrong?
Well, aside from plotting to assassinate a monarch
- which is more than a little risky -
Mary’s problem was insecure lines of communication.
By intercepting her messages,
Elizabeth’s spies were able to se nd falsified messages on her behalf,
whilst also feeding false information back to her.
This is called a “man-in-the-middle” attack,
and it’s actually even more relevant today than it was 400 years ago.
The modern version happens when an individual is able to
read or write data transmitted between you and the website you’re browsing.
The “man in the middle” achieves this by
convincing the website you’re browsing that he is you,
whilst also convincing you that he is the website,
therefore gaining access to
any information you choose to share with that site.
One of the dangerous things about this technique
is that it can be tailored for specific targets,
which can make it much harder to spot.
In 2015, forty nine suspects across Europe were arrested
after they gained access to various companies’ networks
and used this access to execute multiple, large scale, Man in the Middle attacks.
They used malware which monitored the company's communications
to sniff out payment requests.
When one was spotted,
they were able to swap out the real request for a fraudulent version,
and the client was then directed
to a convincing duplicate of a genuine company’s website,
The resulting payment was then deposited into the scammers' account.
Using this method, they were able to steal around 6 million euros
in a very short period of time.
The crucial thing about this kind of attack
is that it relies on flaws in security.
But the good news is that there are some simple steps
that can be taken to address those flaws.
For websites, this can be as simple as using HTTPS.
You'll know that first bit already,
but it's the S on the end here which is important.
It stands for Secure, and this security is achieved
by encrypting information exchanged between you and the website,
and authenticating both
the integrity of the message itself and the identity of the website providing it.
Think of it like this - you’re sat in a dark bar, chatting with a friend.
Anyone nearby who wants to listen in
can both hear and understand your conversation.
And with the light this bad, it’s even possible
that the person you’re chatting with
might just be someone pretending to be your friend. You can’t be sure.
This is HTTP. But with HTTPS, it’s the same friend in the same bar, except
a) the two of you are speaking a language that only you understand, and
b) you’re shining a light on their face just to be sure they’re your friend.
Not only are you now confident about who you’re talking to,
but even if people can hear you, they definitely won’t be able to understand,
or relay the content of your conversation.
In this analogy, the “light” you’re shining on them is a system called
TLS - Transport Layer Security.
And what this does is
establish the authenticity of the website you’re visiting
by using a certificate issued by a Certificate Authority:
a verified third party.
There aren’t that many Certificate Authorities online,
with almost 98% of certificates being issued by the top five authorities.
The largest of these is IdenTrust,
a bank consortium affiliated with "Let's Encrypt".
“Let’s Encrypt” is a non profit Certificate Authority run by
the Internet Security Research Group
as part of an effort to increase overall online security
by moving more of the web over to HTTPS.
And that effort is working -
These days HTTPS is actually a lot more common than HTTP.
And since late 2018 the Google Chrome browser displays
“Not Secure” next to the URL of any website not using HTTPS.
in order to force websites to confront the issue,
make the switch,
and avoid being labelled as insecure.
But what can you do on a personal level?
That is exactly what we’re going to talk about in my next video
on Man in the Middle attacks.