Man-in-the-Middle Attack

Definitions

1. Man-in-the-Middle Attack (MITM) is a cyberattack where an attacker secretly intercepts and potentially alters the communication between two parties who believe they are communicating directly with each other. The attacker positions themselves between the sender and receiver, relaying messages between them while having the ability to read, modify, or inject content. On local networks, ARP spoofing tricks devices into sending traffic through the attacker's machine. On public Wi-Fi, attackers can set up rogue access points that appear legitimate. DNS spoofing redirects traffic to attacker-controlled servers. SSL stripping downgrades HTTPS connections to HTTP. MITM attacks can capture login credentials, session tokens, personal data, and financial information. The primary defense is end-to-end encryption: HTTPS (TLS) ensures that even if traffic is intercepted, it cannot be read or modified without detection. Certificate pinning, HSTS (HTTP Strict Transport Security), and mutual TLS provide additional protection. VPNs encrypt all traffic between the user and the VPN server, protecting against local network MITM attacks.

   In plain English: Someone secretly sitting between you and the website you're talking to, reading or changing the messages as they pass through.

Related Terms

• Encryption
• DNS
• TLS
• VPN
• BGP
• TLS handshake
• BGP hijacking
• Cold Storage
• Dead Drop
• Detection Signature
• Feature Abuse
• Identity Resolution
• Initial Access
• MITM
• OpenSSL Security
• Operator Security
• Peer Certificate
• Poison Pill
• Profile Analysis
• Rich Text Attack