Man-in-the-middle attack
Someone secretly sits between you and a site, reading or changing what you send.
In a man-in-the-middle attack (MITM), an attacker places themselves on the path between two parties that think they are talking directly. You believe you are talking to your bank; the bank believes it is talking to you. In fact every message goes through the attacker, who can read it, keep a copy, or change it before passing it on. Security people increasingly call it an on-path attack.
The classic setting is public Wi-Fi. An attacker in a café sets up a hotspot named like the café's network, or tricks the other devices on the real network into sending their traffic through their laptop. Other routes in: a malicious proxy, a compromised home router, or fake DNS answers that send you to the attacker's server instead of the real one.
Encryption is what makes this attack mostly fail today. With HTTPS, the traffic is scrambled and the site has to show a TLS certificate signed by an authority your browser trusts, which the attacker cannot forge. That is why a browser warning about an invalid certificate on a public network deserves to be taken seriously: clicking through it can let the person in the middle read everything. Some attacks therefore aim at what encryption does not cover, such as stealing a session cookie after you log in.
Keep in mind
- The attacker relays the conversation, so both sides think everything is normal.
- Fake or compromised Wi-Fi networks are the textbook way in.
- HTTPS and valid certificates block most of it; never click through certificate warnings.
- Also called an on-path attack or adversary-in-the-middle.
