Man-in-the-Middle Attack (MITM)

Overview

A man-in-the-middle attack occurs when an attacker secretly intercepts and may alter communications between parties that believe they are communicating directly.

Man-in-the-Middle Attack (MITM) is closely connected to Man-in-the-Browser Attack, HTTP Request Smuggling, and Hardware Security Key. It differs from passive eavesdropping because the attacker can actively relay, downgrade, redirect, or modify messages, and it differs from a man-in-the-browser attack by focusing on the communication path rather than the endpoint application.

Operational implementation should use modern TLS, validate certificates and hostnames, protect DNS, apply mutual authentication where appropriate, pin trust selectively, secure local networks, and alert on protocol downgrade or certificate anomalies.

The principal failure modes include rogue access points, compromised proxies, DNS poisoning, certificate misuse, downgrade attacks, session theft, and operational interception devices with excessive trust.

Useful measures include TLS validation failures, certificate anomalies, downgrade attempts, untrusted-network detections, and communications protected by mutual authentication.

Operationally, teams should use modern TLS, validate certificates and hostnames, protect DNS, and apply mutual authentication where appropriate. Key risks include rogue access points, compromised proxies, DNS poisoning, and certificate misuse.

Assessment of Man-in-the-Middle Attack (MITM) should trace man-in-the-middle attack occurs when an attacker secretly intercepts and may alter communications between parties that believe they are communicating directly from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving man-in-the-middle attack occurs when an attacker should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Man-in-the-Middle attack path should be tested against the architecture associated with man-in-the-middle attack occurs when an attacker.