{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/man-in-the-middle","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/man-in-the-middle/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/man-in-the-middle/"},"term":{"en":"Man-in-the-middle attack","da":"Man-in-the-middle-angreb"},"aka":{"en":["MITM","on-path attack","adversary-in-the-middle"],"da":["MITM","mellemmandsangreb"]},"domain":["security"],"cluster":"fundamentals","layer":"network","status":"current","summary":{"en":"An attacker secretly placed between two parties who reads or changes their messages while each believes they talk directly.","da":"En angriber, der i det skjulte sidder mellem to parter og læser eller ændrer deres beskeder, mens begge tror, de taler direkte sammen."},"body":{"formal":{"en":"An attack in which the attacker takes a position on the network path between two parties, so that their traffic passes through the attacker and can be read, recorded or altered before it is passed on.","da":"Et angreb, hvor angriberen placerer sig på netværksvejen mellem to parter, så deres trafik passerer gennem angriberen og kan læses, gemmes eller ændres, før den sendes videre."},"plain":{"en":"Like a postman who steams open your letters, reads them, maybe changes a line, and seals them again before delivery - neither you nor your friend notice.","da":"Som et postbud, der damper dine breve op, læser dem, måske ændrer en linje og lukker dem igen, før de bliver leveret - hverken du eller din ven opdager noget."},"inPractice":{"en":"A consultant from a Danish municipality working in a station café joins a free wifi network named after the café; it belongs to an attacker whose laptop passes on all her traffic and picks out any login not protected by HTTPS.","da":"En konsulent fra en kommune, der arbejder på en café på banegården, kobler sig på et gratis wifi med caféens navn; det tilhører en angriber, hvis bærbare sender al hendes trafik videre og fisker ethvert login ud, der ikke er beskyttet af HTTPS."},"whyItMatters":{"en":"Data sent in the clear can be stolen or quietly changed on the way, which is why checking who is at the other end and locking the connection matters.","da":"Data, der sendes ubeskyttet, kan stjæles eller ændres i det stille undervejs; derfor er det vigtigt at kontrollere, hvem der er i den anden ende, og at kryptere forbindelsen."}},"deepDive":{"en":"A man-in-the-middle attack, catalogued by MITRE ATT&CK as T1557 Adversary-in-the-Middle, requires the attacker to occupy a position on the communication path. Classic techniques for gaining that position operate at different network layers: ARP cache poisoning on a local Ethernet segment convinces two hosts to send traffic via the attacker; rogue DHCP or a spoofed default gateway redirects a subnet; DNS spoofing returns forged answers so a name resolves to attacker infrastructure; and a rogue wireless access point (an \"evil twin\") lures clients onto an attacker-controlled link. On the wider internet, route hijacking via forged BGP announcements can pull traffic for whole prefixes through an unintended path. What unites them is that the endpoints are unaware the path has changed.\n\nThe primary defence is authenticated encryption that binds the channel to a verified identity. TLS (RFC 8446 for version 1.3) does this by having the server present an X.509 certificate whose chain the client validates against a trusted certificate authority, then performing an authenticated key exchange so that an interposed party cannot read or alter the ciphertext without detection. A MitM against TLS therefore usually reduces to defeating identity verification - presenting a fraudulent or mis-issued certificate, or persuading the user to click through a warning. Certificate Transparency logs (RFC 6962), HSTS to prevent protocol downgrade, and DANE/DNSSEC each close specific gaps in that trust chain. SSL-stripping, where an attacker keeps the victim on plaintext HTTP while talking HTTPS to the server, is defeated by HSTS preloading and browsers defaulting to HTTPS.\n\nSeveral variants deserve distinction. An on-path attacker sits inline and can modify traffic; an off-path attacker must inject or race packets without seeing them all. Downgrade attacks (such as those exploiting export-grade cipher suites or forcing TLS fallback) coerce peers onto weaker cryptography that is then broken. Adversary-in-the-middle phishing kits (Evilginx-style reverse proxies) are the modern high-impact form: they relay a real login in real time, capturing not only the password but the resulting session cookie, which is why MitM is a common precursor to session hijacking and why phishing-resistant authentication matters.\n\nA key nuance is that MitM largely defeats knowledge- and possession-based MFA but not origin-bound credentials. FIDO2/WebAuthn (W3C) signs a challenge that is cryptographically bound to the origin, so a relayed request from a phishing proxy carries the wrong origin and the assertion fails - this is what \"phishing-resistant\" means in practice. A common misconception is that \"we use HTTPS, so MitM is impossible\": HTTPS protects transport, but a MitM upstream of TLS termination (a compromised load balancer, a corporate inspection proxy, a malicious root certificate installed on the device) sits inside the trust boundary and sees plaintext. MitM differs from eavesdropping in that the attacker can alter as well as observe, and from spoofing in that it maintains two live sessions rather than merely impersonating one endpoint.","da":"Et man-in-the-middle-angreb, som MITRE ATT&CK katalogiserer som T1557 Adversary-in-the-Middle, kræver, at angriberen indtager en position på kommunikationsvejen. Klassiske teknikker til at opnå den position virker på forskellige netværkslag: ARP-cacheforgiftning på et lokalt Ethernet-segment får to værter til at sende trafik via angriberen; en rogue DHCP eller en forfalsket default gateway omdirigerer et subnet; DNS-spoofing returnerer forfalskede svar, så et navn peger på angriberens infrastruktur; og et rogue trådløst accesspunkt (en \"evil twin\") lokker klienter over på et angriberkontrolleret link. På det bredere internet kan route hijacking via forfalskede BGP-annonceringer trække trafik for hele præfikser gennem en utilsigtet vej. Fælles for dem er, at endepunkterne ikke ved, at vejen er ændret.\n\nDet primære forsvar er autentificeret kryptering, der binder kanalen til en verificeret identitet. TLS (RFC 8446 for version 1.3) gør dette ved at lade serveren fremvise et X.509-certifikat, hvis kæde klienten validerer mod en betroet certifikatmyndighed, hvorefter der udføres en autentificeret nøgleudveksling, så en mellemliggende part ikke kan læse eller ændre chifferteksten uden at blive opdaget. Et MitM mod TLS reduceres derfor typisk til at bryde identitetsverifikationen - at fremvise et falsk eller fejludstedt certifikat eller at få brugeren til at klikke sig forbi en advarsel. Certificate Transparency-logs (RFC 6962), HSTS mod protokol-downgrade, efterfølgerne til HTTP Public Key Pinning samt DANE/DNSSEC lukker hver især bestemte huller i den tillidskæde. SSL-stripping, hvor angriberen holder offeret på ukrypteret HTTP, mens der tales HTTPS med serveren, modvirkes af HSTS-preloading og af, at browsere som standard vælger HTTPS.\n\nFlere varianter bør skelnes. En on-path-angriber sidder inline og kan ændre trafik; en off-path-angriber må injicere eller kapløbe pakker uden at se dem alle. Downgrade-angreb (fx dem, der udnytter export-grade cipher suites eller tvinger TLS-fallback) presser parterne over på svagere kryptografi, som derefter brydes. Adversary-in-the-middle-phishingkits (reverse-proxyer i Evilginx-stil) er den moderne, virkningsfulde form: de videresender et rigtigt login i realtid og opsnapper ikke kun adgangskoden, men også den resulterende sessionscookie - derfor er MitM et almindeligt forspil til sessionskapring, og derfor er phishing-resistent autentificering vigtig.\n\nEn vigtig nuance er, at MitM stort set slår viden- og besiddelsesbaseret MFA, men ikke origin-bundne loginoplysninger. FIDO2/WebAuthn (W3C) signerer en challenge, der kryptografisk er bundet til origin, så en videresendt forespørgsel fra en phishing-proxy bærer den forkerte origin, og signaturen fejler - det er dét, \"phishing-resistent\" betyder i praksis. En udbredt misforståelse er, at \"vi bruger HTTPS, så MitM er umuligt\": HTTPS beskytter transporten, men et MitM opstrøms for TLS-termineringen (en kompromitteret load balancer, en virksomheds inspektionsproxy, et ondsindet rodcertifikat installeret på enheden) sidder inden for tillidsgrænsen og ser klartekst. MitM adskiller sig fra aflytning ved, at angriberen kan ændre og ikke blot observere, og fra spoofing ved, at det opretholder to aktive sessioner frem for blot at efterligne ét endepunkt."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/protocol","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"causes","to":"security/session-hijacking","why":{"en":"A session cookie read in transit lets the attacker take over the victim's logged-in session.","da":"En sessionscookie, der opsnappes undervejs, lader angriberen overtage offerets indloggede session."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"NIST Glossary - Man-in-the-Middle Attack (MitM)","url":"https://csrc.nist.gov/glossary/term/man_in_the_middle_attack","tier":"standard","publisher":"NIST"},{"title":"MITRE ATT&CK - T1557 Adversary-in-the-Middle","url":"https://attack.mitre.org/techniques/T1557/","tier":"reference","publisher":"MITRE"}],"draft":true}