mallory

If Alice sees that cat photo, Mallory can now manipulate Alice's Twitter account to the maximum extent permitted Bob.

An identity misbinding attack happens when it becomes possible for Mallory to present Alice's public key to Bob instead of her own, and have Bob reply with a message encrypted to Mallory-seeming-Alice.

SSL Split also supports more NAT mechanisms than Mallory and most other tools (which just tend to be iptables/Linux aware).

After receiving the message from Mallory who is impersonating Bob, Alice simply sends Bob a nonce encrypted under Bob's public key.

If Mallory can install an arbitrary root certificate on Alice’s client, M can do nearly whatever she wants with A’s client.

Except Mallory intercepted the traffic and swapped out a self signed certificate.

Where indirect access attacks include Mallory asking Alice if she can run her calibration program on the laptop or facility device before Eve strolls by.

Turning Eve into Mallory gives theoretical attackers much more work.

Another thing I've gleaned is that Mallory spends incredible amounts of money to undermine the stability and security of our internet & hardware.

Seems like Mallory can get away with anything.

Mallory carefully crafts a URL that theoretically exists on Bob's domain but redirects to a server Mallory controls (which displays a cute cat photo and exfiltrates the OAuth token) and then posts it, as one does with cat photos, somewhere where Alice can see it.

(Probably, yes.) Or Mallory playing really dirty and rooting Alice or Bob's machine, which is always, possibly short of the $5 wrench/rubber-hose attack, the easiest route.

You also have Mallory's "Le Morte d'Arthur" (no talking skull involved in this one).

Mallory was trying to tell the world, "Yes, I'm doing this for me, and nothing else".

As with many things I'm reminded of the west wing: "Mallory, education is the silver bullet.

I don't even remember why we did it, I think it was just a Mallory "because it's there" kind of thing.

Mallory intercepts the connection, connects to Bob, and responds to Alice with a self-signed cert.

Others have commented that evidence of Mallory's wrong doings would not be permitted in trial.

Mallory can't decrypt the message, but because it's encrypted to a key Alice has, Alice might act based on the message contents.