Man-in-the-Middle Attack
An attack where a threat actor secretly intercepts and potentially alters communication between two parties who believe they are communicating directly.
A man-in-the-middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties, intercepting and potentially modifying the data exchanged without either party's knowledge. The attacker effectively impersonates each party to the other, relaying messages between them while capturing sensitive information such as login credentials, financial data, or personal communications in transit.
MITM attacks can be executed through various methods. On local networks, ARP spoofing allows attackers to redirect traffic through their device. On public Wi-Fi networks, attackers can create rogue access points that mimic legitimate hotspots. At a broader level, BGP hijacking and DNS spoofing can redirect internet traffic through attacker-controlled infrastructure. SSL stripping is another common MITM technique that downgrades HTTPS connections to unencrypted HTTP, allowing the attacker to read data that should be encrypted.
The consequences of a successful MITM attack range from credential theft and financial fraud to complete surveillance of private communications. In business contexts, MITM attacks can intercept proprietary data, modify transaction details (such as changing payment account numbers in invoices), or inject malware into legitimate downloads. Proper use of encryption (TLS/SSL), certificate pinning, VPNs on untrusted networks, and HTTP Strict Transport Security (HSTS) headers are critical defenses against MITM attacks.
MITM attacks can be executed through various methods. On local networks, ARP spoofing allows attackers to redirect traffic through their device. On public Wi-Fi networks, attackers can create rogue access points that mimic legitimate hotspots. At a broader level, BGP hijacking and DNS spoofing can redirect internet traffic through attacker-controlled infrastructure. SSL stripping is another common MITM technique that downgrades HTTPS connections to unencrypted HTTP, allowing the attacker to read data that should be encrypted.
The consequences of a successful MITM attack range from credential theft and financial fraud to complete surveillance of private communications. In business contexts, MITM attacks can intercept proprietary data, modify transaction details (such as changing payment account numbers in invoices), or inject malware into legitimate downloads. Proper use of encryption (TLS/SSL), certificate pinning, VPNs on untrusted networks, and HTTP Strict Transport Security (HSTS) headers are critical defenses against MITM attacks.
Examples
- An attacker on a coffee shop Wi-Fi network intercepts login credentials by creating a fake access point with the same name.
- An attacker uses ARP spoofing on a corporate LAN to capture unencrypted internal communications between employees.
- A threat actor modifies wire transfer instructions in an intercepted email between a company and its vendor.
Prevention
- Use HTTPS everywhere and implement HSTS headers to prevent SSL downgrade attacks.
- Avoid transmitting sensitive data over public or untrusted Wi-Fi networks without a VPN.
- Implement certificate pinning in applications to detect fraudulent SSL certificates.
- Use encrypted communication protocols for all sensitive business communications.