In a man-in-the-middle (also called adversary-in-the-middle) attack, the attacker secretly relays traffic between two parties so they can read or alter it.
Techniques
- ARP spoofing on a local network to redirect traffic through the attacker.
- Rogue or “evil twin” Wi-Fi access points.
- DNS spoofing to send users to an attacker-controlled server.
- TLS stripping to downgrade HTTPS links to HTTP.
- Reverse-proxy phishing that relays real login pages to capture session cookies.
Detection
- Duplicate or changing MAC addresses for the gateway IP.
- Unexpected certificate warnings or certificates from unknown issuers.
- Sign-ins from infrastructure that does not match the user’s location.
Defence
- Use TLS everywhere with HSTS; never click through certificate warnings.
- Use a trusted VPN on public networks.
- Enable switch protections such as Dynamic ARP Inspection and 802.1X.
- Use phishing-resistant MFA, which binds the login to the real domain.