Man-in-the-Middle Attack

Definition

A man-in-the-middle attack is any situation where a third party inserts itself between two parties who believe they are communicating directly, and is able to read or modify what passes between them. This is the general category; the entries in this family describe its concrete forms — a fake access point, spoofing on the local network, hijacked name resolution — and this page does not redefine any of them.

How it works

The principle is always the same: get your traffic to pass through a controlled point, then extract something from it. What varies is how that passage is obtained. The third party can provide the network itself, by publishing an access point that resembles the one you expect. On a network you have already joined, it can impersonate the gateway to your device. It can act on the translation of site names into addresses, so that a correct address leads to the wrong server. What it then obtains depends entirely on encryption. Faced with an end-to-end encrypted connection, it sees destinations and volumes, not content — which is already information, but not your credentials. Without encryption, it sees everything, and can modify what passes through: inject content into a page, replace a file being downloaded, redirect to a copy of a site. This is why verifying the secure connection is not a formality here: it is the only thing that distinguishes the two situations.

Warning signs

• Certificate, site identity, or non-private connection warning, on a site that's usually fine
• A familiar site displaying as an unsecured connection when it previously wasn't
• Closed sessions, connections you have to redo, forms that fail for no reason, on a given network
• Wi-Fi login page reappearing and asking for more than usual
• No sign at all — the most common case when traffic is encrypted and simply observed

How to verify

Never bypass a certificate warning: on a public network, it is the only reliable signal in this family, and it doesn't happen without reason. Check that the site's address is the one you expect, over a secure connection. If in doubt, switch networks — your phone's mobile hotspot is enough — and see whether the behavior disappears: that's the most conclusive comparison available to you.

What to do

On a network you don't control, stick to services that use an encrypted connection, which today is the case for nearly all serious sites, and don't ignore any security warning. Keep your system and browser up to date: protections against this kind of interception live mostly in the software, not in your attention.

If it already happened

From another network, change the passwords of the services used during the period concerned and close open sessions. Check the recent activity of your main accounts. If a download happened on that network, don't run it and redownload it from a trusted connection — replacing a file mid-transfer is one use of this technique. Report the incident to the relevant authority.

Frequently asked questions

Does the padlock in the address bar protect me?

It indicates the connection is encrypted, which stops an intermediary from reading its content — that's precisely the useful protection here. It says nothing, however, about the honesty of the site itself: a fraudulent site can perfectly well show a secure connection. The padlock answers "who can read this?", not "who am I talking to?".

Does a VPN solve the problem?

It shifts the trust. Your traffic is encrypted up to the provider's server, which neutralizes an interceptor on the local network — useful on public Wi-Fi. But the provider then sees what that interceptor saw, and you grant it what you refused the other party. A VPN is a tool, not a guarantee.

Related attacks

• Evil Twin Wi-Fi Hotspot
• ARP Spoofing
• DNS Poisoning
• Network Traffic Interception
• Malicious Captive Portal
• Fake website
• Session hijacking
• Wi-Fi Deauthentication Attack

Official sources

• Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)