Also, MITM attacks are adversary-in-the-middle, machine-in-the-middle, meddler-in-the-middle, and person-in-the-middle.
Definition
A man-in-the-middle attack (MITM) is a cyberattack in which a malicious actor hijacks and potentially alters a conversation between two parties. The attacker ‘sits in the middle’ of the communication to eavesdrop, steal sensitive data, impersonate, or inject malicious content.
Man-in-the-Middle Attack Examples
- DigiNotar Breach (2011): Hackers stole 500 website certificates from DigiNotar to create fake versions of legitimate sites and tricked users into sharing sensitive information.
- Equifax App Vulnerability (2017): Hackers exploited a vulnerability in the Equifax app to intercept user data.
Common Types of MITM Attacks
- IP spoofing: Hackers alter or spoof an IP address to make traffic look like it originates from a legitimate website.
- HTTPS spoofing: The attacker deceives the browser into thinking it’s accessing a secure HTTPS site while redirecting it to an unprotected website.
- DNS Spoofing: The attacker replaces the DNS records, redirecting traffic to a malicious or fraudulent site where they can capture the user’s login credentials.
- SSL Hijacking: The attacker intercepts the communication between the server and the victim’s computer.
- Email Hijacking: Hackers compromise email accounts to monitor communications and collect personal data.
- Wi-Fi eavesdropping: Attackers create fake public Wi-Fi networks and hotspots in popular places like restaurants and airports. They use these networks to collect sensitive data when unsuspecting users log on.
- Session hijacking: MITM attackers could access session cookies to impersonate a user or steal their contents, including passwords, credit card numbers, and other account information.
Stages of MITM Attacks
- Interception: The attacker intercepts the data travelling between two targets. They then relay the diverted information as if normal communication is underway to eliminate suspicion.
- Decryption: Since most internet communications are encrypted, the MITM attacker needs to decrypt any data they intercept before using it. They can do so by stealing encryption keys or executing brute-force attacks.
Man-in-the-Middle Attack Techniques
- IP Spoofing: Internet Protocol (IP) addresses and labels online entities like websites, email addresses, and devices. MITM attackers alter (spoof) their IP addresses to make the user seem like they are communicating with a genuine host.
- ARP cache poisoning: An Address Resolution Protocol (ARP) links an IP address with the correct Media Access Control (MAC) address within a Local Area Network (LAN). An attacker can alter the ARP address to redirect the connection to their own MAC address to extract information.
- DNS Spoofing: An MITM attacker can change the domain name in the DNS records to redirect users to a malicious website.
- HTTPS Spoofing: An MITM attacker can redirect users to a non-encrypted HTTP page so they can access unprotected data.
- SSL Hijacking: An MITM attacker can use a fake Secure Sockets Layer (SSL) certificate to intercept data before it is encrypted.
- SSL Stripping: MITM attackers can intercept the process of directing HTTP traffic to secure HHTPS connections to access unencrypted data.
Preventing Man-in-the-Middle Attacks
- HTTPS: Always access websites with a secure HTTPS connection and use applications that employ SSL protocol.
- Endpoint Security: Employ sufficient security measures on endpoint devices like laptops, smartphones, and servers to prevent malware installation.
- Virtual private networks (VPNs): A VPN encrypts your internet traffic, protecting you against MITM attacks. Even if hackers successfully intercept your connections, they cannot read your sensitive data.
- Multifactor Authentication (MFA): Implement MFA to prevent MITM attackers from taking over your accounts even if they obtain your login credentials.
- Encryption: Implement robust end-to-end encryption on all network traffic and resources to protect them against MITM attacks.
- Public Wi-Fi networks: Avoid public Wi-Fi networks, especially when making sensitive data transactions.