Man-in-the-Middle (MITM) Attacks Explained
About 2 min read
A man-in-the-middle attack (MITM) is an attack technique in which an attacker inserts themselves between two parties who are communicating, eavesdropping on and tampering with the contents of their communication. Because the attacker impersonates a legitimate communication partner to both sides, the victims find it difficult to notice that they are under attack. It is abused to steal passwords and session information, and communication that is not encrypted is especially dangerous.
Real-World Use Cases
"An employee checked email on a hotel Wi-Fi while on a business trip without connecting to the corporate VPN, and a session cookie was stolen via a man-in-the-middle attack. The attacker accessed the company groupware with that session, so we invalidated the session in question and forced a password reset."
Normal Communication Compared with a Man-in-the-Middle Attack
| How the attacker cuts in | What the attacker gains | Defense that works |
|---|---|---|
| Getting the user to connect to a fake Wi-Fi access point with the same name | All traffic that passes through that path | Use a VPN on public Wi-Fi |
| ARP spoofing and DNS spoofing | The position to redirect the destination of the traffic to itself | Do not ignore the certificate warnings in the browser |
| SSL stripping (downgrading HTTPS to HTTP) | Login information in plaintext | Always verify that the connection is HTTPS |
| Stealing the session cookie | Hijacking of an already logged-in session | Connect through the corporate VPN and invalidate suspicious sessions |
| Interception of the password | An attempt at unauthorized login | Set up two-factor authentication in advance |
Attack Methods
Representative methods include ARP spoofing on public Wi-Fi, DNS spoofing, and setting up fake Wi-Fi access points. On communication that does not use HTTPS, there is a risk that login information is intercepted in plaintext. In an SSL stripping attack, an HTTPS connection is downgraded to HTTP in order to intercept the communication.
Concrete Damage Scenarios
A common misconception is that "a man-in-the-middle attack is impossible on an HTTPS site." In reality, "SSL inspection," in which a corporate proxy server decrypts and examines SSL/TLS communication, is a legitimate form of man-in-the-middle attack. Also, when you connect to free Wi-Fi at a café, if an attacker has set up a fake access point with the same name, you connect to the fake Wi-Fi without noticing, and all of your communication is intercepted. In cases where online banking login information was intercepted, there have been reports of fraudulent transfers being executed within minutes.
Defensive Measures
The basic measures are to always verify the HTTPS connection and to use a VPN on public Wi-Fi. In addition to a strong random password, if you set up two-factor authentication, you can prevent unauthorized logins even if your password is intercepted. It is also important not to ignore the browser's certificate warnings.
Was this article helpful?