What is a Man in the Middle Attack?
Today it is easy to feel like you’re constantly being watched – surveillance cameras sit on every corner and every online service makes us sign away our privacy rights first. However, nefarious actors have gotten in on the game of surveillance too – and they are using what they find to steal identities, empty bank accounts, and create havoc.
A man-in-the-middle attack is just such a scheme – where an attacker positions themselves in between your digital device and the server or person you are communicating with and monitors your every word.
Learning more about the man-in-the-middle (MitM) attack is the first step in avoiding this sort of malicious attack. This article will provide a brief overview of how these cyber attacks work, look at notable MitMs from the past, and discuss ways to avoid MitM attacks and increase your personal cybersecurity.
How Man-in-the-Middle Attacks Work
A Man-in-the-Middle attack is a cyberthreat where a hacker secretly intercepts and possibly alters the communication between two unsuspecting parties. The attacker positions themselves “in the middle,” becoming an invisible relay for the messages being sent between the victims.
This can compromise confidentiality and integrity of sensitive data, such as login credentials, credit card numbers, and personal messages.
Interception
The first stage of a MitM attack is the interception phase. During this phase, the attacker identifies a weak point in the network or communication process where they can eavesdrop on the data being exchanged between parties.
They might exploit vulnerabilities in the network infrastructure, use malware to compromise a device, or even set up rogue Wi-Fi hotspots to trick users into connecting to an insecure network.
Decryption
With the intercepted data in hand, the next challenge for the hacker is to make sense of it. If the data is encrypted, as is the case with HTTPS websites, then they must decrypt it to read or alter the contents. This usually involves breaking the encryption algorithm or exploiting vulnerabilities in the encryption process itself.
For encryption like SSL/TLS (used in HTTPS), there are various ways to break in, such as presenting fake SSL certificates or using weaknesses in outdated encryption algorithms to decrypt data. Some attackers employ techniques like SSL stripping to downgrade an encrypted session to an unencrypted one, making the data easier to read.
Common Types of Man-in-the-Middle Attacks.
IP Spoofing
In this attack, the attacker manipulates the Internet Protocol (IP) address to impersonate a trusted device on your network. This can trick users or servers into thinking they are interacting with a known entity, making it easier for the attacker to intercept communications or data.
DNS Spoofing
Here, the attacker tampers with the Domain Name System (DNS) records to reroute traffic to a different IP address, usually a server controlled by the attacker. This can lead the victim to a fraudulent website that looks like a genuine site, often an online banking institution, enabling the attacker to collect login credentials.
ARP Spoofing
Address Resolution Protocol (ARP) Spoofing targets local area networks (LANs). The attacker sends fake ARP messages to associate their own MAC address (the hardcoded identification number that all devices have) with the IP address of a genuine network device.
This allows them to receive data intended for the original device, effectively placing them in the middle of the data exchange.
HTTPS Spoofing
In an HTTPS spoofing attack, the attacker presents a fake website which presents a counterfeit SSL certificate to the victim, tricking them into thinking they’re visiting a secure website.
Once the victim trusts the bogus certificate and the fraudulent site, the attacker can decrypt, read, and manipulate the data being sent over the supposedly secure connection.
Session Hijacking
Also known as session fixation, this type of attack occurs when the attacker intercepts a user’s browser session token. With this token, the attacker can impersonate the user and gain unauthorized access to a web application or service, often without needing login credentials.
SSL Stripping
SSL stripping downgrades an encrypted HTTPS session to an insecure HTTP session. This allows the attacker to easily intercept and read the data being transmitted, as it’s no longer encrypted.
Email Hijacking
This variant of a MitM attack is a type of phishing attack, and differs from normal MitM’s in that the cybercriminals rely on social engineering more than advanced programming techniques.
In email hijacking, attackers compromise an email account and use it to send fraudulent messages. This is often done for financial scams, or to gain further access into an organization by tricking employees into revealing confidential information.
More recently this attack variant has expanded beyond email to social media. In a few cases high-profile ‘X’ accounts (the service formerly known as Twitter) were hacked and began promoting cryptocurrency scams.
Wi-Fi Eavesdropping
Wi-Fi eavesdropping involves intercepting data over unsecured or poorly secured public Wi-Fi networks. This type of MitM attack is common in public places like coffee shops or airports, where users may unknowingly connect to compromised Wi-Fi networks.
These attacks may involve rogue networks which are set up by the attackers themselves, or the attackers may simply connect to public networks and monitor the information that other users are sending over the network. For rogue networks, it’s common to see the “evil-twin” Wi-Fi networks with the same name as a common public access point, like Starbucks or free airport connections.
Notable Man-in-the-Middle Incidents
Equifax’s Mobile Application
Equifax, one of the largest credit reporting agencies in the U.S., had a vulnerability in its mobile application that made it susceptible to Man-in-the-Middle attacks. This vulnerability was exploited in 2017 and nearly 150 million Americans’ personal information was stolen.
The security flaw was linked to inadequate verification of SSL certificates, allowing attackers to intercept sensitive data exchanged between the user and the app. Given the nature of Equifax’s business – handling extensive financial and personal information – this left nearly half of all Americans exposed to fraud and identity theft.
Superfish
In 2015, it was discovered that Lenovo, a major computer manufacturer, had pre-installed adware known as Superfish on many of its laptops. Superfish not only injected intrusive ads into Google and Amazon search results but also installed a self-signed root certificate in users’ browsers.
While the ads were bad enough, the self-signed root certificate was the element of Superfish which drew the most ire of network administrators and cybersecurity experts. This certificate essentially created a Man-in-the-Middle scenario where Superfish (along with anyone who was using the right software and was connected to your network) could intercept encrypted HTTPS traffic such as banking data, passwords, and credit card numbers.
Lenovo’s inclusion of Superfish in its systems drew widespread criticism, led to several lawsuits, and prompted Lenovo and Microsoft to offer a removal tool for affected users.
DigiNotar
DigiNotar was a Dutch certificate authority that fell victim to a devastating cyberattack in 2011. The attacker was able to compromise the company’s infrastructure and issue fraudulent SSL certificates for several domains, including Google, Yahoo, and Microsoft.
These fake certificates were used in Man-in-the-Middle attacks, most notably against Iranian Gmail users, potentially compromising the email communications of around 300,000 individuals. The incident severely damaged trust in DigiNotar and led to its bankruptcy.
How to Protect Yourself from Man-in-the-Middle Attacks
Using Encrypted Connections
One of the best ways to secure your data is to use encrypted connections whenever possible. This means looking for websites that use HTTPS rather than HTTP, indicated by a padlock symbol in your web browser’s address bar.
Additionally, using a Virtual Private Network (VPN) can encrypt all the traffic between your device and the network, offering another layer of protection.
Avoiding Public Wi-Fi for Sensitive Transactions
Public Wi-Fi networks, like those found in coffee shops or airports, are notoriously insecure and are common staging grounds for Man-in-the-Middle attacks. Always avoid performing sensitive transactions, such as logging into your bank account or making online purchases, when using a public Wi-Fi connection.
If you must use a public network, using a VPN is strongly recommended.
Regularly Updating Software
Many Man-in-the-Middle attacks exploit vulnerabilities in outdated software. Ensuring that your operating system (including on your phone!) and applications are up-to-date is crucial.
Most software comes with an auto-update feature; we recommend keeping this feature turned on! If you prefer to update your software manually, be sure to check for updates regularly.
Two-Factor Authentication
Two-Factor Authentication (2FA), sometimes referred to as Multi-Factor Authentication, adds an extra layer of security to your accounts. Even if an attacker manages to intercept your password, 2FA requires a second form of identification, often a temporary code sent to your phone or generated by an app.
Enabling 2FA for all services that offer it will significantly reduce the chances of your sensitive information being compromised..
Avoid Phishing Emails
Phishing emails are often the starting point for Man-in-the-Middle attacks. These deceptive messages may look like they’re from a trusted source and commonly ask you to verify account information. Always be cautious with unsolicited communications. Never click on links or download attachments from unknown or suspicious emails, and double-check URLs to ensure they’re correct and use HTTPS.
If you receive a message that purports to be from one of your financial institutions, instead of using an embedded link, simply navigate to the website directly. Any notifications you receive via email should be accessible via the secure messaging service provided by your bank or credit card provider.
Attack Prevention Requires Safe Browsing Practices
While a simple anti-virus is capable of keeping many types of threats at bay, man-in-the-middle attacks operate on different principles and require users to remain vigilant. While public Wi-Fi is often very convenient, remember that all of the network traffic flowing through these public routers may be subject to interception.
Whenever possible, avoid accessing your financial institutions or buying products while using a public network, or if you must do so, connect with a VPN. Your home network is slightly safer – but keep an eye out for the padlock that signifies you are using an encrypted HTTPS connection whenever you are submitting personal information and always enable two factor authentication when it is available.
Ultimately, staying safe online requires a multifaceted approach to cybersecurity, and you may want to consider enlisting the help of a residential digital security expert. From anti-viruses to network protection to data backups, your information will be kept safe and secure.