What is a man-in-the-middle attack and how to prevent it

· Category: Cybersecurity

What is a man-in-the-middle attack and how to prevent it

What Is a MITM Attack?

A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and potentially alters communication between two parties. Common vectors include unencrypted Wi-Fi, compromised routers, and DNS spoofing.

Attack Vectors

  • ARP Spoofing: Poisoning ARP tables to redirect traffic.
  • DNS Hijacking: Redirecting domain resolution to attacker-controlled servers.
  • SSL Stripping: Downgrading HTTPS connections to HTTP.

Prevention

  1. Enforce TLS everywhere: See how to set up SSL/TLS certificates for a web server. Disable weak cipher suites.
  2. HSTS: Instructs browsers to always use HTTPS.
  3. Certificate Pinning: Hardcode expected certificates in mobile apps.
  4. VPNs: Encrypt traffic on untrusted networks; learn more in what is a VPN and how does it work.

Detection

Monitor for unexpected certificate changes and use DNSSEC to validate DNS responses. Defense in depth is essential because a single control may fail.