Man-in-the-Middle Attack
A cyberattack where the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
In-Depth Explanation
A man-in-the-middle (MitM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and potentially modifying the data exchanged. The victims believe they are communicating directly with each other, unaware that an attacker is relaying and possibly altering their messages.
Types of MitM attacks:
- Wi-Fi eavesdropping: Intercepting traffic on unsecured wireless networks
- SSL/TLS stripping: Downgrading encrypted HTTPS connections to unencrypted HTTP
- ARP spoofing: Manipulating ARP tables to redirect local network traffic
- DNS spoofing: Redirecting DNS queries to malicious servers
- Email hijacking: Intercepting email communications to alter payment details
- Session hijacking: Stealing session tokens to impersonate authenticated users
Attack scenarios:
- Attacker on public Wi-Fi captures login credentials sent over unencrypted connections
- Compromised router redirects banking traffic to a fake website
- Attacker intercepts business email to change invoice payment details
- Rogue access point mimics a legitimate Wi-Fi network to capture traffic
Prevention measures:
- Use HTTPS everywhere (enforce with HSTS)
- Implement VPN for remote access and untrusted networks
- Use encrypted DNS (DoH/DoT)
- Verify SSL/TLS certificates and watch for warnings
- Avoid sensitive transactions on public Wi-Fi without VPN
- Implement certificate pinning for critical applications
- Use email encryption for sensitive communications
- Deploy network monitoring to detect ARP spoofing
Business Context
MitM attacks are particularly dangerous for businesses with remote workers using public Wi-Fi, organisations handling financial transactions via email, and companies that have not fully implemented encryption across their communications.
How Clever Ops Uses This
Clever Ops protects Australian businesses from MitM attacks by implementing VPN solutions for remote workers, enforcing HTTPS across all web properties, deploying email encryption for sensitive communications, and configuring network monitoring to detect interception attempts.
Example Use Case
"A remote employee connects to a café Wi-Fi network that is actually a rogue access point. The company VPN encrypts all traffic, preventing the attacker from intercepting any data, and the employee is alerted that certificate validation failed for one site."