Some attacks do not break into a device at all — they quietly listen in on the conversation between two of them.
What is it?
A man-in-the-middle (MITM) attack is when an attacker secretly positions themselves between you and the service you are talking to. They can read, and even change, the information passing back and forth — while both sides believe they are talking directly.
Select any component in the diagram to read what it does.
Text description of this diagram
An attacker secretly sits between you and the service, reading or changing what you send.
Why is it important?
If an attacker can sit in the middle, they can steal passwords, read private messages, or alter a payment’s destination — all without either side noticing. It directly attacks confidentiality and integrity from the CIA Triad.
How does it work?
A common setup is a fake public Wi-Fi hotspot. You connect to “Free Airport WiFi”, but it is run by an attacker. Everything you send now passes through their equipment first. Other versions intercept traffic on a network the attacker has already compromised.
Your defence
- Look for HTTPS and the padlock — it means the connection is encrypted, so a middleman only sees scrambled data.
- Avoid sensitive tasks (like banking) on untrusted public Wi-Fi.
- Use a VPN on public networks to encrypt everything you send.
A real-world example
At a café, someone sets up a hotspot named almost exactly like the real one. A customer connects and logs in to a website that uses plain, unencrypted HTTP — and the attacker captures the password in clear text. Had the site used HTTPS, the attacker would have seen only unreadable data.
Check what you learned
What happens in a man-in-the-middle attack?
An attacker secretly sits between two parties and can read or change the information passing between them, while both think they are talking directly.
How does HTTPS help against MITM attacks?
It encrypts the connection, so an attacker in the middle sees only scrambled, unreadable data.
Key takeaways
- A man-in-the-middle secretly intercepts a conversation.
- Fake public Wi-Fi is a common way to set one up.
- HTTPS and a VPN on untrusted networks keep your data unreadable.