What is a Man-in-the-Middle Attack?

A Man-in-the-Middle Attack (MITM) is a form of cyber eavesdropping in which malicious actors insert themselves into a conversation between two parties and intercept data through a compromised but trusted system. The targets are often intellectual property or fiduciary information. MITM aggressors will also use malware to open the communications channel with the hopes of creating zombie machines or building vast networks of comprised systems. Man-in-the-Middle Attacks can be used as way into systems in order to execute an advanced persistent threat (APT).

In many cases organizations are unaware their session and/or data has been tampered with until it is much too late. If a MITM attack is successful, organizations experience negative brand perception, reduced customers’ confidence and ultimately a damaged bottom line.

MITM attacks can be executed in a number of different ways that exploit communications between other parties. Whether by passive or active means, an MITM attack finds a way between a user and an entity and attempts to conceal the breach and information theft. Below are common ways Man-in-the-Middle Attacks manipulate communication systems.

Email Hijacking – attackers gain access to a user’s email account and watch transactions to and from the account. When the time is right, for instance the user is exchanging funds with another party, the attacker takes advantage of the situation by attempting to intercept the funds by spoofing one or all members of the conversation.

Wi-Fi Eavesdropping – a passive way to deploy MITM attacks, Wi-Fi eavesdropping involves cyber hackers setting up public Wi-Fi connections, typically with an unsuspecting name, and gain access to their victims as soon as they connect to the malicious Wi-Fi.

Session Hijacking – session hijacking is when an attacker gains access to an online session via a stolen session key or stolen browser cookies.

DNS Spoofing – an attacker engages in DNS spoofing by altering a website’s address record within a DNS (domain name server) server. A victim unknowingly visits the fake site and the attacker will attempt to steal their information.

IP Spoofing – similar to DNS spoofing, IP Spoofing sees an attacker attempt to divert traffic to a fraudulent website with malicious intent. Instead of spoofing the website’s address record, the attacker disguises an IP (internet protocol) address.

Implement a comprehensive Email Security Solution – an email security solution is a vital tool in an organizations security architecture that will help minimize the risks associated with MITM. It secures email activity pro-actively while staff focuses efforts elsewhere.

Implement a Web Security Solution – a strong web security tool provides visibility to web traffic generated by both the system and end user at protocol and port layers. Similar to an email security tool, this implementation protects your organization’s web traffic so the security team can cover more ground.

Educate Employees – Making training relevant to the employee is key to training effectiveness. Prepare your workforce for these advanced attacks by educating them on the dynamics, patterns, samples and frequency of attack methods attempted on other organizations. Case studies are a valuable resource when putting together educational materials and awareness programs.

Keep credentials secure - Check your user credentials often. Make sure your passwords are secure, complex and updated every three months at a minimum. This will aid in your company’s protection by keeping credentials fresh and more difficult to crack.

Forcepoint can help you prevent and guard against Man-in-the-Middle attacks. Both Forcepoint’s Email Security and Web Security tools offer best-in-class protection. For more, visit Forcepoint’s product overview.