Man-in-the-Middle Attacks: How Eavesdropping Works

What Is a Man-in-the-Middle Attack?

A man-in-the-middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties — typically you and a website, server, or another user — intercepting, reading, and potentially modifying traffic without either party realizing it.

The name captures the concept precisely: rather than attacking either endpoint directly, the attacker inserts themselves into the communication channel. From your perspective, you're talking to the bank. From the bank's perspective, they're talking to you. In reality, both conversations are with the attacker, who relays messages between you while reading everything.

MITM attacks can be used to:

• Steal credentials and session tokens
• Capture sensitive financial or personal information
• Modify data in transit (e.g., changing payment destination)
• Inject malicious content into web pages
• Perform session hijacking

How MITM Attacks Work

ARP Spoofing on Local Networks

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. ARP has no authentication — any device can send ARP replies claiming to be any IP address.

In an ARP spoofing attack:

1. The attacker broadcasts ARP replies claiming their MAC address corresponds to the gateway's IP (e.g., your router)
2. Victim devices update their ARP cache and start sending traffic to the attacker's machine
3. The attacker forwards traffic to the real gateway while reading everything in between
4. On unencrypted connections, full content is visible; on encrypted connections, metadata is visible

This attack works on any shared network — Wi-Fi or Ethernet — and is trivially executed with tools like Ettercap or Bettercap.

Rogue Access Points

An attacker sets up a Wi-Fi hotspot with a name that mimics a legitimate network — "Starbucks_WiFi" instead of "Starbucks WiFi". Devices configured to auto-connect to known networks may connect automatically. All traffic flows through the attacker's machine.

This is especially effective in airports, cafes, and hotels where people routinely connect to unknown networks.

SSL Stripping

SSL stripping is a technique that downgrades HTTPS connections to HTTP. When a user navigates to a site by typing just the domain name (without https://), the initial request is often HTTP. An attacker in the middle intercepts this HTTP request, establishes an HTTPS connection with the real server on the victim's behalf, then serves the victim the content over HTTP — downgrading the security without the user noticing (unless they check the address bar carefully).

This was a devastating attack before HSTS became widespread.

BGP Hijacking

At the internet routing level, BGP (Border Gateway Protocol) hijacking allows attackers (typically nation-state actors) to reroute large swaths of internet traffic through their infrastructure by announcing false routing information. This has occurred in documented incidents involving traffic for major cloud providers and cryptocurrency services.

What Defenses Actually Stop MITM Attacks

TLS / HTTPS

Proper TLS implementation is the primary defense. A correctly implemented TLS connection means:

• Traffic is encrypted and unreadable to the interceptor
• The server's identity is cryptographically verified via its certificate
• Any tampering with the encrypted data is detectable

However, TLS only works if the certificate is properly validated. An attacker with a fraudulently obtained certificate for the target domain, or one who can convince the victim to install a rogue CA certificate, can still perform MITM attacks on HTTPS traffic.

HSTS (HTTP Strict Transport Security)

HSTS tells browsers that a site should only be accessed over HTTPS. Once a browser receives an HSTS header:

• It will never make an HTTP connection to that domain
• SSL stripping attacks fail because the browser refuses to downgrade
• HSTS preloading allows browsers to ship with a built-in list of HSTS-only sites, protecting even first-time visits

Certificate Pinning

Mobile apps and some web services use certificate pinning — the application only trusts a specific certificate or public key, rejecting any other certificate even if it's CA-signed. This defeats attacks using fraudulent CA-issued certificates.

Network-Level Defenses

• Dynamic ARP Inspection (DAI) on enterprise switches validates ARP packets and drops spoofed replies
• 802.1X authentication on enterprise Wi-Fi prevents rogue access point attacks by requiring authentication before network access
• VPNs encrypt traffic before it leaves your device, making ARP spoofing and rogue AP attacks see only VPN-encrypted traffic

Practical Protection for Users

• Always verify HTTPS before entering credentials or payment information — look for the padlock and correct domain
• Avoid sensitive transactions on public Wi-Fi without a trusted VPN
• Be skeptical of certificate errors: A browser warning about an invalid certificate may indicate an active MITM attack — do not click through
• Keep software updated: MITM attack tools often exploit browser or OS vulnerabilities
• Use a VPN on untrusted networks: A VPN creates an encrypted tunnel from your device, preventing local network MITM attacks from reading your traffic
• Avoid networks with generic names like "Free WiFi" — verify network names with venue staff before connecting