Man-in-the-Middle (MITM) Attack
An attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.
Detailed Explanation
MITM attacks can happen on public Wi-Fi or through compromised routers. The attacker sits between the user's browser and the server, intercepting data in real-time. The primary defense is using HTTPS with valid certificates, which ensures the connection is encrypted and the identity of the server is verified.
Quick Summary
In a man-in-the-middle attack, the attacker sits silently between client and server, reading or modifying traffic. HTTPS with valid certificates is the standard defense; without it, every public Wi-Fi is hostile territory.
Key Takeaways
- Common settings: open Wi-Fi, compromised routers, rogue DNS, malicious browser extensions, corporate TLS interception proxies.
- TLS prevents eavesdropping and tampering when the certificate chain is valid and clients verify it.
- HSTS (`Strict-Transport-Security`) prevents downgrade-to-HTTP attacks on subsequent visits.
- Certificate pinning (especially for mobile apps) defeats attackers who get fraudulent certificates.
- Don't ignore certificate warnings, they exist because the connection genuinely isn't safe.
When to use it
- Banking and payment apps requiring strong TLS + pinning to resist sophisticated attackers.
- Corporate environments where IT installs proxies that deliberately MITM internal traffic, controversial and risky.
- Threat modeling for any client connecting from untrusted networks (coffee shops, hotels, conferences).
- Penetration testing using tools like mitmproxy or Burp to observe and modify app traffic.
Common Mistakes
- Disabling certificate verification in libraries "to make it work", turns TLS into encrypted noise with no identity guarantee.
- No HSTS, first visit over HTTP is still hijackable.
- Mobile apps without pinning that trust any CA the device trusts; one malicious CA breaks everything.
- Mixing HTTP assets into an HTTPS page; modern browsers block this, but legacy code still tries.
Man-in-the-Middle (MITM) Attack, Frequently Asked
Is HTTPS enough to stop MITM?
For most threats, yes, properly validated TLS is very strong. Add HSTS, HSTS preload, and (for mobile/native) certificate pinning to defend against more sophisticated attackers with access to CAs or device trust stores.
Is corporate TLS inspection a MITM attack?
Technically yes, the company installs its own root CA on the device so it can decrypt traffic. It's authorized within the company's threat model, but it does break end-to-end TLS guarantees, which is why personal banking on corporate-managed devices is a privacy concern.