A man-in-the-middle attack is a method in which the attacker inserts themselves between the server and the client in order to intercept users' information, steal passwords, and gain access to users' accounts on the local network.
This type of fraud mostly takes place in public internet environments.
The common target of MITM attacks is MONEY. The most common targets of MITM attacks are;
- online shopping sites,
- online banking sites,
- other sites that require you to log in before accessing account and credit card details.
Unsurprisingly, criminals go where the money is, to places where illicit financial gain can be made.
What are the types of MitM attacks?
Rogue Access Point
A rogue access point is a wireless access point that has been installed on a secure network without explicit authorization from a local network administrator, either by a well-meaning employee or by a malicious attacker.
Devices generally try to automatically connect to the access point broadcasting the strongest signal. Attackers configure their own wireless access points so that devices connect to them instead. This gives them the opportunity to capture the information of users who connect to their network. To prevent this, it is necessary to access the internet and carry out transactions only over secure networks.
ARP (Address Resolution Protocol) Spoofing
ARP spoofing is a type of attack in which a malicious actor sends fake ARP (Address Resolution Protocol) messages over a local area network. This causes the attacker's MAC address to be linked to the IP address of a legitimate computer or server on the network.
mDNS (Multicast DNS) Spoofing
In computer networks, the mDNS protocol resolves host names to IP addresses on small networks that do not have a local name server.
Although mDNS is similar to DNS, it operates on the local area network (LAN) using broadcasts, like ARP. For this reason, it also appears as a technique used for spoofing attacks.
DNS Spoofing
Similar to the way ARP resolves IP addresses to MAC addresses on a LAN, DNS resolves domain names to IP addresses. In a DNS spoofing attack, the attacker attempts to supply corrupted DNS cache information in order to access a different host using a domain name such as www.abc.com. This results in the victim sending sensitive information to a malicious server while believing they are sending it to a trusted source. It is one of the most common types of spoofing. For this reason, when entering sensitive information online, you should always check whether the website is secure, and verify that the web address you intended to enter matches the one shown on the screen.
In light of the methods described above, MitM attacks can be summarized as follows:
While a user browses the internet over a shared (public) network, the attacker listens to the information transmitted over that network (the sniffing method). The attacker cuts the connection between the user and the website and redirects it to a fake html page, resembling the real site, which has been embedded inside the real site's html document. Without realizing anything, the user believes they are entering the bank's page, when in fact they have entered a fake page, redirected by the attacker, that is a copy of the bank's page. Through this method, the One-Time Password sent by banks to customers for logging into internet banking also falls into the attacker's hands.
Hypertext Transfer Protocol Secure (HTTPS) is used to prevent network traffic from being easily redirected to the attacker through MitM. However, if an attacker has been tracking the user and has inserted themselves via MitM, they can also mimic SSL connections. When a secure connection is attempted, the browser will indicate that the site has a certification problem.
Many users approve the fake certificate, wanting their task to continue, without even understanding what a certificate error means. The moment the fake certificate is accepted as trusted by the user, even if the connection made is SSL, Facebook and Messenger passwords and all correspondence can reach the attacker.
As a result, when the browser gives a certificate warning on connections made in publicly accessible areas, disconnecting and not proceeding will be the safest course of action.
