The Man-in-the-Middle Security Attack

A man-in-the-middle (MitM) attack is a form of cyberattack in which criminals exploiting weak web-based protocols insert themselves between entities in a communication channel to steal data.

None of the parties sending email, texting, or chatting on a video call are aware that an attacker has inserted their presence into the conversation and that the attacker is stealing their data.

While most cyberattacks are silent and carried out without the victims’ knowledge, some MitM attacks are the opposite. They might include a bot generating believable text messages, impersonating a person’s voice on a call, or spoofing an entire communications system to scrape data the attacker thinks is important from participants’ devices.

A MitM attack may target any business, organization, or person if there is a perceived chance of financial gain by cyber criminals. The larger the potential financial gain, the more likely the attack.

Sales of stolen personal financial or health information may sell for a few dollars per record on the dark web.

At first glance, that may not sound like much until one realizes that millions of records may be compromised in a single data breach.

Popular industries for MitM attacks include banks and their banking applications, financial companies, health care systems, and businesses that operate industrial networks of devices that connect using the Internet of Things (IoT). Millions of these vulnerable devices are subject to attack in manufacturing, industrial processes, power systems, critical infrastructure, and more.

SCORE and the SBA report that small and midsize business face greater risks, with 43% of all cyberattacks targeting SMBs due to their lack of robust security.

As its name implies, in this type of attack, cyber criminals take control of the email accounts of banks, financial institutions, or other trusted companies that have access to sensitive data—and money. Once inside, attackers can monitor transactions and correspondence between the bank and its customers.

In more malicious scenarios, attackers spoof, or fake, the bank’s email address and send customers emails instructing them to resend their credentials—or worse, send money—to an account controlled by the attackers. In this MitM attack version, social engineering, or building trust with victims, is key for success.

In Wi-Fi eavesdropping, cyber criminals get victims to connect to a nearby wireless network with a legitimate-sounding name. But in reality, the network is set up to engage in malicious activity. The wireless network might appear to be owned by a nearby business the user frequents or it could have a generic-sounding, seemingly harmless name, such as “Free Public Wi-Fi Network.” In some cases, the user does not even need to enter a password to connect.

Once victims are connected to the malicious Wi-Fi, the attacker has options: monitor the user’s online activity or scrape login credentials, credit or payment card information, and other sensitive data.

To guard against this attack, users should always check what network they are connected to. With mobile phones, they should shut off the Wi-Fi auto-connect feature when moving around locally to prevent their devices from automatically being connected to a malicious network.

Domain Name System (DNS) spoofing, or DNS cache poisoning, occurs when manipulated DNS records are used to divert legitimate online traffic to a fake or spoofed website built to resemble a website the user would most likely know and trust.

As with all spoofing techniques, attackers prompt users to log in unwittingly to the fake website and convince them that they need to take a specific action, such as pay a fee or transfer money to a specific account. The attackers steal as much data as they can from the victims in the process.

Session hijacking is a type of MitM attack in which the attacker waits for a victim to log in to an application, such as for banking or email, and then steals the session cookie. The attacker then uses the cookie to log in to the same account owned by the victim but instead from the attacker’s browser.

A session is a piece of data that identifies a temporary information exchange between two devices or between a computer and a user. Attackers exploit sessions because they are used to identify a user that has logged in to a website. However, attackers need to work quickly as sessions expire after a set amount of time, which could be as short as a few minutes.

Most websites today display that they are using a secure server. They have “HTTPS,” short for Hypertext Transfer Protocol Secure, instead of “HTTP” or Hypertext Transfer Protocol in the first portion of the Uniform Resource Locator (URL) that appears in the browser’s address bar. Even when users type in HTTP—or no HTTP at all—the HTTPS or secure version will render in the browser window. This is a standard security protocol, and all data shared with that secure server is protected.

SSL and its successor transport layer security (TLS) are protocols for establishing security between networked computers. In an SSL hijacking, the attacker intercepts all data passing between a server and the user’s computer. This is possible because SSL is an older, vulnerable security protocol that necessitated it to be replaced—version 3.0 was deprecated in June 2015—with the stronger TLS protocol.

The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address, such as a media access control (MAC) address, associated with a given internet layer address. The ARP is important because it translates the link layer address to the Internet Protocol (IP) address on the local network.

In this scheme, the victim’s computer is tricked with false information from the cyber criminal into thinking that the fraudster’s computer is the network gateway. As such, the victim’s computer, once connected to the network, essentially sends all of its network traffic to the malicious actor instead of through the real network gateway. The attacker then utilizes this diverted traffic to analyze and steal all the information they need, such as personally identifiable information (PII) stored in the browser.

IP spoofing is similar to DNS spoofing in that the attacker diverts internet traffic headed to a legitimate website to a fraudulent website. Instead of spoofing the website’s DNS record, the attacker modifies the malicious site’s IP address to make it appear as if it is the IP address of the legitimate website users intended to visit.

In computing, a cookie is a small, stored piece of information. A browser cookie, also known as an HTTP cookie, is data collected by a web browser and stored locally on a user’s computer. The browser cookie helps websites remember information to enhance the user’s browsing experience. For example, with cookies enabled, a user does not have to keep filling out the same items on a form, such as first name and last name.

Stealing browser cookies must be combined with another MitM attack technique, such as Wi-Fi eavesdropping or session hijacking, to be carried out. Cyber criminals can gain access to a user’s device using one of the other MitM techniques to steal browser cookies and exploit the full potential of a MitM attack. With access to browser cookies, attackers can gain access to passwords, credit card numbers, and other sensitive information that users regularly store in their browsers.