Man-in-the-Middle (MitM)
Jump to:
Summary
Man-in-the-Middle (MitM) is a cyberattack where an attacker secretly intercepts and potentially alters communication between two parties without their knowledge, aiming to steal information, inject malicious content, or impersonate one of the parties.
Key Characteristics
- Interception of communication between two entities
- Ability to eavesdrop, modify, or inject data in real-time
- Exploitation of insecure networks, such as public Wi-Fi
- Use of techniques like ARP spoofing, DNS spoofing, or session hijacking
- Often targets sensitive information like credentials, financial data, or confidential messages
Defensive Controls
- Use of strong encryption protocols (e.g., TLS/SSL) to secure communications
- Implementation of mutual authentication mechanisms
- Regular monitoring and detection of abnormal network activity
- Employing Virtual Private Networks (VPNs) to protect data transmission
- Ensuring software and firmware are up to date to patch vulnerabilities
Related Security Solutions
MitM attacks are mitigated through solutions such as Secure Socket Layer (SSL)/Transport Layer Security (TLS) certificates, intrusion detection and prevention systems (IDPS), endpoint security software, VPNs, and network segmentation technologies.
More in Network Attacks