Cyber Security Man-in-the-Middle Attacks
A Man-in-the-Middle attack lets an attacker secretly intercept, and sometimes alter, communication between two parties who believe they are talking directly to each other.
What Is a Man-in-the-Middle Attack?
A Man-in-the-Middle (MITM) attack happens when an attacker secretly positions themselves between two parties who believe they are communicating directly with each other — such as a user and a website, or two coworkers exchanging messages. The attacker can silently read the traffic passing through, and in more advanced cases, alter it before passing it along, all without either legitimate party noticing anything unusual.
Common Ways Attackers Get in the Middle
- Rogue Wi-Fi access points: an attacker sets up a Wi-Fi network with a trustworthy-sounding name (e.g., 'Free_Airport_WiFi') and routes all connected devices' traffic through their own machine.
- ARP spoofing: on a local network, the attacker tricks devices into sending their traffic to the attacker's machine instead of the real router.
- DNS spoofing: the attacker corrupts the process that translates a website name into its address, redirecting victims to a malicious server instead of the real one.
- SSL stripping: the attacker downgrades a connection from encrypted HTTPS to plain HTTP so the traffic becomes readable.
- Compromised routers or network equipment: hardware that has itself been compromised can be used to intercept everything passing through it.
What an Attacker Can Do From the Middle
- Eavesdrop on login credentials, session tokens, or private messages.
- Inject malicious content, such as fake software update prompts or altered web pages.
- Alter transaction details in transit, such as swapping a bank account or payment destination in a request.
A Realistic Scenario
Imagine connecting to the free Wi-Fi at a coffee shop and logging into your email as usual. If an attacker in the same shop has set up a network with a similar name, or has compromised the shop's real router, your traffic could be routed through their device without any visible sign — no error message, no obvious slowdown. If your connection to the email provider isn't properly encrypted end-to-end, the attacker could capture your password the moment you type it in.
Defenses That Work
The underlying lesson of MITM attacks is to treat unfamiliar networks as untrusted by default — encryption and certificate verification exist precisely so two parties can trust each other even when they don't trust the network carrying their conversation.
