172.3k views
Show
A man in the middle (MITM) attack is a general term for when a perpetrator positions himself in a conversation between a user and an application—either to eavesdrop or to impersonate one of the parties, making it appear as if a normal exchange of information is underway. The goal of an attack is to steal personal information, such as login credentials, account details and credit card numbers. Targets are typically the users of financial applications, SaaS businesses, e-commerce sites and other websites where logging in is required. Information obtained during an attack could be used for many purposes, including identity theft, unapproved fund transfers or an illicit password change. Additionally, it can be used to gain a foothold inside a secured perimeter during the infiltration stage of an advanced persistent threat (APT) assault. Broadly speaking, a MITM attack is the equivalent of a mailman opening your bank statement, writing down your account details and then resealing the envelope and delivering it to your door. Man in the middle attack example MITM attack progressionSuccessful MITM execution has two distinct phases: interception and decryption. InterceptionThe first step intercepts user traffic through the attacker’s network before it reaches its intended destination. The most common (and simplest) way of doing this is a passive attack in which an attacker makes free, malicious WiFi hotspots available to the public. Typically named in a way that corresponds to their location, they aren’t password protected. Once a victim connects to such a hotspot, the attacker gains full visibility to any online data exchange. Attackers wishing to take a more active approach to interception may launch one of the following attacks:
DecryptionAfter interception, any two-way SSL traffic needs to be decrypted without alerting the user or application. A number of methods exist to achieve this:
Blocking MITM attacks requires several practical steps on the part of users, as well as a combination of encryption and verification methods for applications. For users, this means:
For website operators, secure communication protocols, including TLS and HTTPS, help mitigate spoofing attacks by robustly encrypting and authenticating transmitted data. Doing so prevents the interception of site traffic and blocks the decryption of sensitive data, such as authentication tokens. It is considered best practice for applications to use SSL/TLS to secure every page of their site and not just the pages that require users to log in. Doing so helps decreases the chance of an attacker stealing session cookies from a user browsing on an unsecured section of a website while logged in.’ Using Imperva to protect against MITMMITM attacks often occur due to suboptimal SSL/TLS implementations, like the ones that enable the SSL BEAST exploit or supporting the use of outdated and under-secured ciphers. To counter these, Imperva provides its customer with an optimized end-to-end SSL/TLS encryption, as part of its suite of security services. Hosted on Imperva content delivery network (CDN), the certificates are optimally implemented to prevent SSL/TLS compromising attacks, such as downgrade attacks (e.g. SSL stripping), and to ensure compliancy with latest PCI DSS demands. Offered as a managed service, SSL/TLS configuration is kept up to date maintained by a professional security, both to keep up with compliency demands and to counter emerging threats (e.g. Heartbleed). Finally, with the Imperva cloud dashboard, customer can also configure HTTP Strict Transport Security (HSTS) policies to enforce the use SSL/TLS security across multiple subdomains. This helps further secure website and web application from protocol downgrade attacks and cookie hijacking attempts.
A man-in-the-middle (MITM) attack is a type of cyberattack where attackers intercept an existing conversation or data transfer, either by eavesdropping or by pretending to be a legitimate participant. To the victim, it will appear as though a standard exchange of information is underway — but by inserting themselves into the “middle” of the conversation or data transfer, the attacker can quietly hijack information. The goal of a MITM attack is to retrieve confidential data such as bank account details, credit card numbers, or login credentials, which may be used to carry out further crimes like identity theft or illegal fund transfers. Because MITM attacks are carried out in real time, they often go undetected until it’s too late. The Two Phases of a Man-in-the-Middle AttackA successful MITM attack involves two specific phases: interception and decryption. 1. InterceptionInterception involves the attacker interfering with a victim’s legitimate network by intercepting it with a fake network before it can reach its intended destination. The interception phase is essentially how the attacker inserts themselves as the “man in the middle.” Attackers frequently do this by creating a fake Wi-Fi hotspot in a public space that doesn’t require a password. If a victim connects to the hotspot, the attacker gains access to any online data exchanges they perform. Once an attacker successfully inserts themselves between the victim and the desired destination, they may employ a variety of techniques to continue the attack:
2. DecryptionA MITM attack doesn’t stop at interception. After the attacker gains access to the victim’s encrypted data, it must be decrypted in order for the attacker to be able to read and use it. A number of methods might be used to decrypt the victim’s data without alerting the user or application:
Real-World Examples of a MITM AttackThere have been a number of well-known MITM attacks over the last few decades.
How to Detect a MITM AttackIf you’re not actively searching for signs that your online communications have been intercepted or compromised, detecting a man-in-the-middle attack can be difficult. While it’s easy for them to go unnoticed, there are certain things you should pay attention to when you’re browsing the web — mainly the URL in your address bar. The sign of a secure website is denoted by “HTTPS” in a site’s URL. If a URL is missing the “S” and reads as “HTTP,” it’s an immediate red flag that your connection is not secure. You should also look for an SSL lock icon to the left of the URL, which also denotes a secure website. Additionally, be wary of connecting to public Wi-Fi networks. As discussed above, cybercriminals often spy on public Wi-Fi networks and use them to perform a man-in-the-middle attack. It’s best to never assume a public Wi-Fi network is legitimate and avoid connecting to unrecognized Wi-Fi networks in general. Prevention and How to PrepareWhile being aware of how to detect a potential MITM attack is important, the best way to protect against them is by preventing them in the first place. Be sure to follow these best practices:
As our digitally connected world continues to evolve, so does the complexity of cybercrime and the exploitation of security vulnerabilities. Taking care to educate yourself on cybersecurity best practices is critical to the defense of man-in-the-middle attacks and other types of cybercrime. At the very least, being equipped with a strong antivirus software goes a long way in keeping your data safe and secure. |