Man-in-the-Middle Attack

A man-in-the-middle (MitM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and potentially modifying the data exchanged. The victims believe they are communicating directly with each other, unaware that an attacker is relaying and possibly altering their messages.

Types of MitM attacks:

• Wi-Fi eavesdropping: Intercepting traffic on unsecured wireless networks
• SSL/TLS stripping: Downgrading encrypted HTTPS connections to unencrypted HTTP
• ARP spoofing: Manipulating ARP tables to redirect local network traffic
• DNS spoofing: Redirecting DNS queries to malicious servers
• Email hijacking: Intercepting email communications to alter payment details
• Session hijacking: Stealing session tokens to impersonate authenticated users

Attack scenarios:

• Attacker on public Wi-Fi captures login credentials sent over unencrypted connections
• Compromised router redirects banking traffic to a fake website
• Attacker intercepts business email to change invoice payment details
• Rogue access point mimics a legitimate Wi-Fi network to capture traffic

Prevention measures:

• Use HTTPS everywhere (enforce with HSTS)
• Implement VPN for remote access and untrusted networks
• Use encrypted DNS (DoH/DoT)
• Verify SSL/TLS certificates and watch for warnings
• Avoid sensitive transactions on public Wi-Fi without VPN
• Implement certificate pinning for critical applications
• Use email encryption for sensitive communications
• Deploy network monitoring to detect ARP spoofing