# Man-in-the-middle attack

> Someone secretly sits between you and a site, reading or changing what you send.

- Level: Intermediate
- Topics: Security, Networks
- URL: https://tidbit.legios.com.ar/man-in-the-middle-attack/
- In Spanish: [Ataque de intermediario](https://tidbit.legios.com.ar/es/man-in-the-middle-attack/)

In a **man-in-the-middle attack** (MITM), an attacker places themselves on the path between two parties that think they are talking directly. You believe you are talking to your bank; the bank believes it is talking to you. In fact every message goes through the attacker, who can read it, keep a copy, or change it before passing it on. Security people increasingly call it an **on-path attack**.

The classic setting is public Wi-Fi. An attacker in a café sets up a hotspot named like the café's network, or tricks the other devices on the real network into sending their traffic through their laptop. Other routes in: a malicious proxy, a compromised home router, or fake DNS answers that send you to the attacker's server instead of the real one.

Encryption is what makes this attack mostly fail today. With HTTPS, the traffic is scrambled and the site has to show a TLS certificate signed by an authority your browser trusts, which the attacker cannot forge. That is why a browser warning about an invalid certificate on a public network deserves to be taken seriously: clicking through it can let the person in the middle read everything. Some attacks therefore aim at what encryption does not cover, such as stealing a session cookie after you log in.

## An analogy

A mail carrier who opens your letters, reads them, sometimes rewrites a line, reseals them and delivers them as if nothing happened. Encryption is a seal they cannot reproduce.

## Keep in mind

- The attacker relays the conversation, so both sides think everything is normal.
- Fake or compromised Wi-Fi networks are the textbook way in.
- HTTPS and valid certificates block most of it; never click through certificate warnings.
- Also called an on-path attack or adversary-in-the-middle.

## Go deeper

- [Man-in-the-middle attack on Wikipedia](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)
- [Manipulator-in-the-middle attack (OWASP)](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack)

## Related terms

- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.
- [Mobile hotspot](https://tidbit.legios.com.ar/mobile-hotspot/): Your phone turned into a small Wi-Fi router that shares its mobile data.
- [Laptop](https://tidbit.legios.com.ar/laptop/): A whole computer folded into one portable case that runs on a battery.
- [Proxy](https://tidbit.legios.com.ar/proxy/): A middleman computer that makes requests on someone else's behalf.
- [Router](https://tidbit.legios.com.ar/router/): The box that connects your devices to each other and to the internet.
- [DNS](https://tidbit.legios.com.ar/dns/): The internet's phone book: it turns names like wikipedia.org into IP addresses.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.