There are typically two stages to a Man In The Middle: interception and decryption. Your vulnerability at each step will depend on what security measures you have in place.
The first step in setting up a man in the middle attack is to intercept data passing between a victim and their network. The easiest and by far the most common way of doing this is to set up an unsecured Wi-Fi hotspot and name it according to its location. Unsuspecting users will then connect to the network, thinking it is legitimate, and the attacker gains access to all the data passing through the router.
There are also many more sophisticated methods for intercepting network traffic, such as IP, ARP, or DNS spoofing. See below for details on these types of attack.
Once an attacker has intercepted network traffic, the next stage is to decrypt the two-way SSL traffic. This is done using a variety of methods.
Using HTTPS spoofing, an attacker may send a fake security certificate to a victim's device. This makes it appear that any sites the victim visits are secure, whereas, in reality, the attacker is collecting any information entered into them.
A more direct approach is to use SSL stripping. An attacker will downgrade a victim's connection from HTTPS to HTTP, and send an unencrypted version of any site they visit while maintaining a secure connection themselves. As a result, a user's entire session is visible to the attacker.
The way that man in middle attacks work can be explained using a simple example. Let’s imagine that there are two users, Alice and Bob, who want to communicate securely with each other. At the same time, Mallory wants to intercept this data.
First, Alice will ask Bob for his public key. If Mallory can intercept this request, she can start to implement a man in the middle attack. She will send a message to Alice that looks like it comes from Bob, but will-, in fact, contain Mallory's public key. At the same time, she will forward Alice's request to Bob, who will send his public key, and Mallory will keep this as well.
Alice thinks that the public key she has received is Bob's, so she will encrypt her message using this key, and send the message to Bob. Mallory will again intercept this message, and decrypt it using her private key. She can now read the message and even change its contents
Mallory will then re-encrypt the message using the public key she got from Bob, and send it on to Bob. When Bob receives this message, he will think it came from Alice, because it is encrypted using her key, and will not know it has been read (and maybe altered) by Mallory.
This is a simple example that illustrates the basics of a man in the middle attack. In the real world, there are many variants on this basic scheme. Let's take a look at some of them.
An attacker can make use of a number of vulnerabilities to intercept and read data as part of a Man In The Middle. Because of this, man in the middle attacks can be classified according to which piece of software has been compromised.
The typical man-in-the-middle also makes use of many techniques to intercept data and to decrypt it. The most common methods are:
DNS Spoofing is a method that takes advantage of weaknesses in the Domain Name Server (DNS) system. This is the way that your browser finds the websites you request, and it does this by looking up their IP address in a list that sits on your Wi-Fi router. By altering this list, an attacker can re-direct you to a website that looks legitimate but is controlled by them. Any information you enter into the spoof website will then be collected for future use.
ARP spoofing is a similar technique. Using this method, an attacker will disguise themselves as an application by altering the packet headers that come with an IP address. This means that when a user attempts to access a web application, they will be re-directed to a fake version of it that is controlled by the attacker.
Perhaps the simplest way to implement a man-in-the-middle is to make use of Rogue Access Points. These are routers (called access points in the industry) that look like they provide legitimate networks, but are "fake," unsecured networks controlled by an attacker, who can then listen in on them. In recent years, a popular way of setting up these networks has been to use a Wi-Fi Pineapple: this is a small device that operates as a standard Wi-Fi router but has a much broader range.
An Evil Twin attack is also seen quite often. In this form of attack, a fraudulent server is set up, and users are invited to log in to it using details that can then be stolen by the owner of the server. This type of attack is essentially the Wi-Fi version of a standard phishing scam, a technique for intercepting computer communications. The name of this kind of attack comes from the fact that the user believes that the server they are accessing is legitimate, when in fact they are connecting to its ‘evil twin'.
Man In The Middle attacks are a relatively common, dangerous type of attack. Because of this, you might think they have only been used with malicious intent. Though the majority of MITM attacks are used to steal data and compromise a victim's system, there have been times when a MITM "attack" has been used for more innocent ends.
The most famous example of this concerns a Wi-Fi router sold by Belkin a few years back. The router would periodically intercept HTTP data being passed through it, and act as a man in the middle. Instead of passing on the traffic to the desired server, the router itself would pose as a server, and deliver an advert for another Belkin product. Belkin sending ads to their customers might sound pretty benign, but the idea of using MITM attack methods (if only to post annoying ads) led to an outcry among those who realized what the router was doing. The ‘feature' was then quickly removed in a firmware update.
A more severe example of a MITM attack was discovered in Nokia's Xpress Browser in 2013. Investigators found that the browser was decrypting HTTPS data, and storing this on proxy servers owned by Nokia. In principle, this gave Nokia access to its users' encrypted data, though Nokia later claimed that there were strict protocols in place to prevent staff accessing and using this data.
Perhaps the most significant MITM attack, though, was implemented by the US National Security Agency (NSA). The documents leaked by Edward Snowden back in 2013 suggested that the agency occasionally posed as Google to gather information on its targets. Though this was hardly the first time that the NSA had used controversial methods to collect data, and though this was not even the first time that an attacker had impersonated Google, the scale of the attack came as a surprise.
How can you avoid becoming the victim of a man-in-the-middle? Though this attack type is quite common, there are some simple steps you can take to reduce your vulnerability.
The encryption scheme you use fundamental part of your Wi-Fi security setup and provides a good level of protection against MITM attacks. As wireless technology has advanced over the years, ever stronger encryption protocols have been released, but not all Wi-Fi routers (called access points in the trade) have been upgraded to use them.
You should use a robust encryption protocol on any networks you are responsible: preferably WPA2 alongside AES, which provides the highest levels of protection. Strong encryption makes it much more difficult for an attacker to gain access to the network by just being nearby, and also limits the efficacy of brute-force attacks.
Besides encrypting the connection you have with your Wi-Fi router, you should also encrypt everything you do online. Using a Virtual Private Network (VPN) is an easy and effective way of doing this. A VPN client will sit on your browser or your OS and uses key-based encryption to create a subnet for secure communication. This means that, even if an attacker gains access to this data, they will not be able to read or alter it, and so they will not be able to start a MITM attack.
There are lots of different VPNs to chose from, but you should always go for the VPN that provides the best security and the most robust encryption. Choosing anything less, after all, is like wanting to open yourself up to MITM attacks.
HTTPS is a system for communicating securely over HTTP by using a private-public key exchange. This technology has been around for years now, and so every site should be using it, but this is not the case. Some companies even provide two versions of their main site, one secured with HTTPS and one left open with HTTP, allowing users to open themselves up to attack by accident.
Thankfully, there is a way around this problem. You can easily install a plugin for your browser that will force it to use HTTPS on any sites you visit, and give you plenty of warning if this is not available. This way, even if an attacker gains access to your network, they will not be able to decipher the data you exchange with it, and so will not be able to launch a MITM attack.
At a more technical level, it is also possible to use a public key pair based authentication system like RSA to authenticate the machines, servers, and applications you are connected to. Since the majority of MITM attacks are implemented by spoofing something, whether this is a redirect to a fake website or impersonating a web application, requiring all levels of a stack to authenticate using public keys can ensure that the only entities connected to your network are those that you want.
Man-in-the-middles are some of the most common forms of cyber attacks and can have significant consequences. By implementing this type of attack, an attacker can steal sensitive information, including authentication details, that can quickly compromise entire systems. Even worse, such attacks are typically persistent, allowing an attacker to collect data over a long period, and are often not detected until long after they have happened.
Limiting your vulnerability to MITM attacks can be done in some ways. Firstly, it is important to realize that the majority of attack vectors for MITM attacks rely on some form of spoofing, whether this is an attacker's machine pretending to be a server or a fake website that claims to be the real thing. On the most basic level, then, avoiding MITM attacks requires a high level of vigilance. In short, if a Wi-Fi network or website looks suspicious, trust your instincts and don't share any information!
Another effective way of limiting your risk to MITM attacks is by encrypting everything you do online. This means using the most robust security protocols on your home Wi-Fi router and should also include the use of a VPN with the highest level of encryption. Encrypting everything means that, even if an attacker can intercept your communications, they will not be able to read or alter them, and so will not be able to launch a MITM attack.
Take a look at our other guides to ensure you can spot other types of attack.