ManInTheMiddle

Man-in-the-middle (MITM) is a term used in cybersecurity to describe a situation in which an attacker secretly intercepts and possibly alters the communications between two parties who believe they are directly communicating with each other. The attacker positions themselves on the communication path, enabling eavesdropping, data modification, or impersonation.

MITM can occur in various environments. In local networks, techniques such as ARP spoofing or poisoned DNS responses can place the attacker between a user’s device and the intended server. In wireless networks, a rogue access point or “evil twin” can lure victims into routing traffic through the attacker’s device. In wired networks, compromised routers or network devices can similarly intercept traffic. In modern systems, TLS/SSL interception by a proxy or firewall, or the use of fraudulent certificates, can enable MITM-like capabilities even on encrypted connections. Legitimate MITM-like activity is also used in controlled security testing with explicit authorization.

Impact from MITM attacks ranges from eavesdropping on credentials and private data to altering messages or injecting malware, potentially leading to financial loss or reputational damage. The risk is higher for unencrypted connections or poorly implemented encryption and authentication.

Defenses focus on preventing interception and ensuring trust. User-facing defenses include careful attention to certificate warnings and avoiding insecure networks. Technical defenses include strong TLS practices (certificate pinning, HSTS, mutual TLS), use of VPNs, DNSSEC or DNS over TLS, and secure Wi‑Fi (WPA3) with network protections like dynamic ARP inspection. Regular security testing and monitoring help detect and mitigate MITM activity. Related topics include ARP poisoning, DNS spoofing, TLS interception, and network segmentation.