Man-in-the-Middle Attacks: How Hackers Intercept Communications

Positioned Between Sender and Receiver

When two parties communicate over a network, they generally assume they are talking directly to each other. A man-in-the-middle (MITM) attack violates this assumption by inserting an attacker invisibly between the two parties. Both participants believe the connection is direct and secure; in reality, every message passes through the attacker, who can read, alter, or inject data in real time. The attack is named for its positioning — the attacker stands in the middle, relaying (and often manipulating) traffic between victims who remain unaware.

MITM attacks are not theoretical. The 2011 DigiNotar certificate authority breach allowed attackers to issue fraudulent SSL certificates, enabling MITM attacks against Iranian users of Gmail, Facebook, and other services. In 2015, Lenovo shipped laptops with pre-installed Superfish adware that used MITM techniques to intercept HTTPS connections and inject advertisements. These attacks demonstrate that MITM threats operate at every level of the network stack.

Common MITM Techniques

MITM attacks can be executed through a variety of technical methods, each exploiting a different vulnerability in network protocols or infrastructure.

ARP Poisoning: The Classic Local Network Attack

The Address Resolution Protocol (ARP) maps IP addresses to MAC (hardware) addresses on local area networks. ARP is inherently trustless — it accepts replies without verifying whether a request was ever sent, and cached mappings are overwritten by subsequent replies. Attackers exploit this by continuously broadcasting fake ARP replies claiming that their MAC address corresponds to the gateway's IP address.

Once the victim's ARP cache is poisoned, all traffic destined for the gateway passes through the attacker's machine first. The attacker can then forward it on (transparent interception) while reading, logging, or modifying it. Tools like Ettercap and Arpspoof make ARP poisoning straightforward on unsecured local networks — a major reason why open Wi-Fi networks are significant security risks.

SSL Stripping: Defeating HTTPS

SSL stripping, demonstrated by researcher Moxie Marlinspike at Black Hat DC 2009, exploits the way HTTPS sessions are typically initiated. When a user types a domain without specifying "https://", their browser first makes an HTTP request. The server responds with a redirect to HTTPS. An MITM attacker intercepts this initial HTTP request and never forwards the HTTPS redirect to the victim, instead maintaining:

• An encrypted HTTPS connection between the attacker and the legitimate server (attacker receives the real content)
• An unencrypted HTTP connection between the attacker and the victim (victim sees content but no encryption)

From the victim's perspective, the site loads normally — they just don't see the padlock icon or "https://" prefix in the address bar, something many users ignore. HTTP Strict Transport Security (HSTS) was developed specifically to counter SSL stripping by instructing browsers to always use HTTPS for a given domain, refusing HTTP connections regardless of what the server says.

Detection: Signs of MITM Activity

• Unexpected SSL certificate warnings or certificate changes for a known site
• ARP cache inconsistencies — multiple IP addresses mapping to the same MAC address
• Latency spikes unexplained by server load or network congestion
• Unusual DNS resolution results — resolving to different IPs than expected
• Security software alerts for ARP spoofing or SSL certificate anomalies

Defenses and Mitigations

Defending against MITM attacks requires measures at multiple layers of the network stack.

Certificate Transparency, a project pioneered by Google and now an industry standard, requires all certificate authorities to log every issued certificate in public, auditable logs. This makes it much harder for a rogue CA or compromised CA to issue fraudulent certificates without detection — the core vulnerability exploited in the DigiNotar breach.

The Public Wi-Fi Risk

Public Wi-Fi networks — coffee shops, airports, hotels — remain the most accessible environment for MITM attacks. An attacker with a laptop and free software can execute ARP poisoning or set up an evil twin access point in minutes. The practical mitigation for users is straightforward: use a VPN on any untrusted network, verify site certificates, and watch for HTTP warnings. Treating any unencrypted public network as potentially hostile is the correct security posture.