In a man in the middle attack, an attacker secretly places themselves between two communicating parties.
They can read along, change data or pose to each side as the other.
Types of Man in the Middle Attacks
The attacker has to route the traffic through themselves.
There are several ways to do this, such as fake Wi-Fi hotspots, ARP spoofing in the local network or manipulated name resolution.
IP Spoofing
In IP spoofing, the attacker forges the sender address of packets to pose as a trusted system.
In local networks this is often combined with ARP spoofing, which routes the traffic through the attacker’s machine.
DNS Spoofing
In DNS spoofing, the victim receives a false answer to the question of which IP address belongs to a domain name.
They end up on the attacker’s server even though the correct address is shown in the browser.
Prevention and Mitigation of Man in the Middle Attacks
The most important defence is encryption with verified certificates, complemented by attentive users.
Secure Communication Protocols
HTTPS with TLS, HSTS, DNSSEC, VPNs and end-to-end encryption make reading and altering traffic practically impossible.
Servers should disable outdated protocols and only allow current encryption.
User Education
Users should never click away certificate warnings, use public Wi-Fi only with a VPN and pay attention to the correct address.
A second factor adds protection for logins.
Impact of Man in the Middle Attacks
If the attack succeeds, credentials, payments and confidential content are at risk.
Financial Impact
Attackers can redirect transfers, capture card details and take over accounts.
Companies face additional costs for investigation and remediation.
Reputational Impact
If customer data is intercepted, trust in the provider suffers.
Data protection breaches can also lead to reporting duties and fines under the GDPR.
Case Studies of Man in the Middle Attacks
Two well-known cases show that large organisations are affected too.
Belgacom Attack
In 2013 it became known that an intelligence agency had infiltrated the network of the Belgian telecommunications provider Belgacom.
Staff were redirected to prepared servers through manipulated web requests and their computers were infected.
iCloud Attack
In 2014 observers reported an attack on iCloud users in China in which connections were redirected using a forged certificate.
Anyone who ignored the browser warning handed their credentials to the attackers.
Conclusion
Man in the middle attacks are invisible but easy to prevent.
Consistent encryption, properly verified certificates and attentive users remove the attackers’ basis.