Definition
A Man-in-the-Middle (MitM) attack is a cyberattack where an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
People Also Ask
Common questions about Man-in-the-Middle Attack answered by our security experts.
Man-in-the-Middle Attack in Practice
A man-in-the-middle attack places the attacker between two parties who believe they are communicating directly, able to read and modify what passes between them.
It describes a position rather than a technique. Reaching that position is done through ARP spoofing, DNS poisoning, a rogue wireless access point, or control of a network device along the path.
Encryption is the structural answer
Properly implemented transport encryption defeats it: the attacker can relay traffic and cannot read or alter it, because they cannot present a certificate the client will accept for that name.
Which relocates the attack. Instead of breaking encryption, attackers now target the moments around it — the initial unencrypted request, certificate validation failures the user clicks through, and clients that do not validate at all.
Where it still succeeds
Applications that do not validate certificates, which is a recurring finding in mobile applications and in machine-to-machine integrations where validation was disabled during development and never restored.
Users accepting certificate warnings. Downgrade to unencrypted protocols where the server permits it. And older protocols with no encryption at all, still present in operational technology and legacy internal services.
The inspection paradox
Many organisations deliberately perform this attack on their own traffic, terminating and re-encrypting it at a gateway so content can be inspected. It is a legitimate control and it is the same technique.
The consequences deserve acknowledging: the inspection point holds plaintext for every session, it becomes a high-value target, and certificate pinning in some applications will break. See secure web gateway.
Protocol-level protections
Strict transport security, which tells a browser never to connect unencrypted to a domain again, closing the initial-request window. Certificate pinning for high-value clients. Certificate transparency monitoring, which reveals certificates issued for your names without your knowledge.
For internal and machine-to-machine traffic, mutual authentication, so both ends verify each other rather than only the client verifying the server.
Detection
Certificate mismatches and unexpected issuers reported by clients. Duplicate address mappings on a local network. Unexpected route changes. Unexplained latency, since relaying adds a delay.
In practice most interception is discovered through certificate errors, which is an argument for treating those reports as security events rather than as a support nuisance.
Machine-to-machine traffic is where this is worst
Integrations, background jobs and device communications frequently fail to validate certificates, because there is no user to see a warning and no obvious symptom when validation is disabled. The code works either way.
Auditing your own integrations for disabled validation, and requiring mutual authentication for anything handling sensitive data, closes the gap. It is also worth testing: an intercepting proxy in a test environment reveals immediately which clients will accept any certificate.
Certificate lifecycle discipline is the quiet prerequisite. Expiring certificates train users and administrators to click through warnings, which is precisely the behaviour this attack needs. Automated renewal and expiry alerting are therefore security controls rather than availability housekeeping.
Where to start
Check whether any of your own applications or integrations disable certificate validation. It is a one-line setting, it is frequently left in place, and it is invisible from outside.
See TLS. GuardsArm delivers application penetration testing.
Related Terms
TLS/SSL
TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are cryptographic protocols that provide secure, encrypted communication over networks, most commonly used to protect web traffic via HTTPS.
ARP Spoofing
ARP Spoofing is a network attack where an attacker sends falsified ARP messages on a local network to link their MAC address with a legitimate IP address, intercepting or modifying network traffic.
DNS Poisoning
DNS Poisoning (also called DNS Spoofing) is an attack that corrupts DNS cache data so that domain name queries return incorrect IP addresses, redirecting users to malicious websites without their knowledge.
Encryption
Encryption is the process of converting plaintext data into an unreadable ciphertext format using a cryptographic algorithm and key. Only authorized parties with the correct decryption key can convert the data back to its original readable form.
Related Reading
Encryption Everywhere: PHI at Rest, in Transit, and in Use
Full-disk encryption protects against a stolen server. It does nothing about a compromised application account, which is the realistic threat. What…
Speak With an Expert
Book a free consultation to discuss man-in-the-middle attack for your organization.
Related Services
Need Help With Man-in-the-Middle Attack?
Our certified security professionals can help you implement the right man-in-the-middle attack strategy for your organization. Get a free assessment today.
Book a Free Consultation