Man-in-the-Middle (MITM) Attack
Home /
Glossary Index /
Alphabet M
You connect to a public WiFi network at an airport. You log into your email. Unknowingly, an attacker is watching everything you type. They capture your credentials, session cookies, and private messages. You believe you are communicating directly with your mail server. In reality, every packet passes through the attacker’s machine. This is a Man-in-the-Middle (MITM) attack, and it turns your trust into a weapon against you.
What Is a Man-in-the-Middle (MITM) Attack?
A Man-in-the-Middle (MITM) attack occurs when an adversary secretly intercepts and potentially alters communications between two parties who believe they are communicating directly. The attacker positions themselves between the victim and the destination, such as a server, router, or another user. All traffic flows through the attacker, who can eavesdrop, modify data in transit, or inject malicious content. MITM attacks work because network communications are not inherently secure. Without proper encryption, anyone on the same network can theoretically intercept your traffic.
How MITM Attacks Work
The attacker must first insert themselves into the communication path. This requires access to the network or the ability to manipulate routing. Once positioned, they can perform a range of malicious actions. They capture credentials sent in plaintext, including usernames and passwords. They steal session cookies to hijack authenticated sessions. They inject malicious scripts into HTTP responses to install malware. They modify financial transactions, changing payment details or amounts. They intercept two-factor authentication codes sent via SMS. The victim never realizes their communication has been compromised.
6 Common MITM Techniques
ARP Spoofing
Address Resolution Protocol (ARP) spoofing poisons the local network’s ARP tables. The attacker links their MAC address to the IP address of the default gateway. All traffic destined for the gateway goes to the attacker instead.
DNS Spoofing
The attacker returns false DNS responses to redirect victims to malicious websites. You type your bank’s URL into your browser. DNS spoofing sends you to a fake site that looks identical to the real one.
Rogue WiFi Access Points
Attackers set up fake access points with legitimate-sounding names like “Free Airport WiFi.” When you connect, they capture all your traffic. Evil twin attacks use this technique to harvest credentials and inject malware.
SSL Stripping
The attacker downgrades HTTPS connections to plain HTTP. You think you are secure, but your traffic is fully exposed. SSL stripping works when websites do not enforce HTTP Strict Transport Security (HSTS).
BGP Hijacking
Border Gateway Protocol (BGP) hijacking redirects internet routing at the backbone level. An attacker announces ownership of IP blocks that belong to someone else. This technique can redirect massive amounts of traffic.
Session Hijacking
The attacker captures your session cookie after you authenticate. They reuse that cookie to impersonate you on the target website. No password required.
The Encryption Solution
Encryption is your best defense against MITM attacks. TLS/HTTPS protects against passive eavesdropping and modification. When you connect to a website over HTTPS, an attacker cannot read or modify the traffic without breaking encryption. However, attackers have workarounds. They may use SSL stripping to downgrade connections. They may present fraudulent certificates if a certificate authority is compromised. They may exploit certificate validation flaws in client software. To protect yourself, use HTTPS everywhere and enable HSTS. Verify certificate validity before entering sensitive information. Implement certificate pinning for mobile applications. Use VPNs on untrusted networks, especially public WiFi.
Prevention Strategies for Organizations
Require multi-factor authentication for all remote sessions. MFA prevents attackers from using captured credentials alone. Deploy endpoint protection that detects ARP spoofing and rogue access points. Use secure protocols exclusively, disabling HTTP and other plaintext protocols. Implement network access control to prevent unauthorized devices from joining your network. Train employees to avoid public WiFi for sensitive transactions.
MITM attacks exploit the fundamental trust built into network protocols. You cannot eliminate this risk entirely, but you can render it ineffective. Encrypt everything. Verify identities continuously. Never trust a network implicitly.
