In a man-in-the-middle (MitM), also called on-path, attack, an adversary positions themselves logically between two communicating parties. Both believe they are speaking directly. The attacker can observe, delay, redirect or alter traffic when the protocol does not effectively authenticate the peer and message integrity.
How does a MitM attack work?
The attacker routes packets through a controlled system and may maintain two separate connections: one to the client and one to the genuine server. Without end-to-end authentication, each side sees only its connection to the attacker. Passive capture alone is not an active MitM, but it can already expose data in unencrypted protocols.
How does an attacker enter the communication path?
| Method | Environment |
|---|---|
| ARP spoofing | Manipulates mappings on local Ethernet and routes traffic through the attacker's device. |
| Rogue Wi-Fi / evil twin | A deceptive access point becomes the network path for mobile devices. |
| DNS manipulation | A domain resolves to a false target, closely related to pharming. |
| Router or gateway compromise | Control of infrastructure provides visibility into forwarded traffic. |
| BGP or routing manipulation | Internet routes are misdirected, commonly involving larger networks and providers. |
| Explicit proxy | Legitimate corporate proxies may inspect TLS; compromise or misconfiguration creates similar risk. |
What does TLS protect?
TLS encrypts data, protects integrity and normally authenticates the server with a certificate. A network attacker can forward packets but cannot silently read or alter protected content. Protection fails when users bypass certificate warnings, clients do not validate certificates, an unwanted or compromised CA is trusted, or the application falls back to HTTP. mTLS additionally authenticates the client.
A public wireless network therefore cannot automatically decrypt correctly validated HTTPS. It can still see metadata such as destination IP, volume and timing and can block connections or modify unencrypted content.
What impact is possible?
- Read passwords, session cookies and confidential content from unprotected traffic.
- Modify downloads, DNS answers, payment information or software updates.
- Take over sessions or redirect users to false services.
- Selectively block, delay or replay communication.
- Downgrade protocols to weaker or unencrypted variants where permitted.
How are MitM attacks prevented?
- Require TLS for sensitive connections, validate certificates and hostnames fully and deploy HSTS carefully.
- Disable unsafe plaintext protocols; use SSH, VPN or mutually authenticated protocols for administration.
- Secure wireless networks with current encryption and enterprise authentication; treat unknown networks as untrusted.
- Segment local networks and use suitable switch protections against ARP and DHCP manipulation.
- DNSSEC validation, secure updates and signed artifacts reduce other manipulation paths.
- Protect private keys and trusted root certificates on endpoints especially carefully.
How are they detected and tested?
Certificate changes, new root CAs, changing ARP mappings, duplicate gateways, unexpected DNS answers and protocol downgrade are indicators. Some enterprise TLS proxies are intentional and must be checked against policy and device management. Authorized tests use controlled networks and accounts; capturing other people's traffic or deceiving production users without clear approval is unlawful and risky.
Thank you for your feedback! We will review it and optimize this content.