- Secure Sockets Layer (SSL) hijacking happens when an attacker provides fake authentication keys during a TCP handshake.
- MITM attacks include cybercriminals intercepting data or internet communications.
In this article, we will dive deeper into understanding what a man-in-the-middle (MITM) attack is and how it works.
What is the Man in the Middle Attack?Â
A man-in-the-middle (MITM) attack occurs when a perpetrator initiates a discussion between a user and an application to listen in on the conversation or to pretend to be one of the parties and create the impression that regular information flow is taking place.
The purpose of an attack is to steal personal data, including credit card numbers, account information, and login passwords. Users of banking apps, SaaS companies, e-commerce websites, and other websites that require signing in are often the targets.
The use of information gathered during an attack may include identity theft, unauthorized financial transfers, or unauthorized password changes. The infiltration phase of an advanced persistent threat (APT) attack may also employ it to obtain access to a guarded perimeter.
Similar to having your mailman look at your bank statement, make a note of your account information, and then reseal the box before delivering it to your home, an MITM attack involves the use of intermediaries.
Working on MITM AttackÂ
Cybercriminals place themselves in the midst of data transfers or online conversations during MiTM attacks. The attacker easily acquires access to the user’s web browser and the data it transmits and receives during transactions via the dissemination of malware. Online banking and e-commerce websites are the primary targets of MiTM attacks since they need secure authentication using a public key and a private key, making it easy for attackers to steal login credentials and other sensitive data.
Data interception and decryption, a two-step procedure, are often used to carry out these attacks.
- InterceptionÂ
Before it reaches its target, the initial stage involves intercepting user traffic that is traveling across the attacker’s network.
By distributing free, malicious WiFi hotspots to the general population, an attacker may carry out a passive attack, which is the most typical method of achieving this. They usually don’t have password protection, and their names usually match where they are. The attacker gets full access to any online data transmission when a victim connects to one of these hotspots.
- Ways of Interception:Â
- IP spoofing
It includes changing packet headers in an IP address to make an attacker seem to be an application.Â
- ARP spoofing
This technique utilizes phony ARP packets to connect an attacker’s MAC address with a valid user’s IP address on a local area network. As a consequence, information that the user intended to send to the host IP address is instead delivered to the attacker.
DNS spoofing: Also referred to as DNS cache poisoning, is hacking a DNS server and changing the address record of a website.
- DecryptionÂ
Any two-way SSL communication must be decrypted after being intercepted without notifying the user or application. There are several methods for doing this:
- SSL Hijacking
When an attacker gives the user and application fake authentication keys during a TCP handshake, SSL hijacking happens. As a result, what seems to be a secure connection is really controlled by the guy in the middle.
- HTTPS spoofing
As soon as a connection request to a secure site is initiated, HTTPS spoofing delivers a fake certificate to the victim’s browser. The hijacked application’s digital fingerprint is stored in it, and the browser may verify it by comparing it to a list of recognized websites. Any information submitted by the victim before it is delivered to the program is then accessible to the attacker.
