Man-in-the-middle attack

A man-in-the-middle attack, catalogued by MITRE ATT&CK as T1557 Adversary-in-the-Middle, requires the attacker to occupy a position on the communication path. Classic techniques for gaining that position operate at different network layers: ARP cache poisoning on a local Ethernet segment convinces two hosts to send traffic via the attacker; rogue DHCP or a spoofed default gateway redirects a subnet; DNS spoofing returns forged answers so a name resolves to attacker infrastructure; and a rogue wireless access point (an "evil twin") lures clients onto an attacker-controlled link. On the wider internet, route hijacking via forged BGP announcements can pull traffic for whole prefixes through an unintended path. What unites them is that the endpoints are unaware the path has changed.

The primary defence is authenticated encryption that binds the channel to a verified identity. TLS (RFC 8446 for version 1.3) does this by having the server present an X.509 certificate whose chain the client validates against a trusted certificate authority, then performing an authenticated key exchange so that an interposed party cannot read or alter the ciphertext without detection. A MitM against TLS therefore usually reduces to defeating identity verification - presenting a fraudulent or mis-issued certificate, or persuading the user to click through a warning. Certificate Transparency logs (RFC 6962), HSTS to prevent protocol downgrade, and DANE/DNSSEC each close specific gaps in that trust chain. SSL-stripping, where an attacker keeps the victim on plaintext HTTP while talking HTTPS to the server, is defeated by HSTS preloading and browsers defaulting to HTTPS.

Several variants deserve distinction. An on-path attacker sits inline and can modify traffic; an off-path attacker must inject or race packets without seeing them all. Downgrade attacks (such as those exploiting export-grade cipher suites or forcing TLS fallback) coerce peers onto weaker cryptography that is then broken. Adversary-in-the-middle phishing kits (Evilginx-style reverse proxies) are the modern high-impact form: they relay a real login in real time, capturing not only the password but the resulting session cookie, which is why MitM is a common precursor to session hijacking and why phishing-resistant authentication matters.

A key nuance is that MitM largely defeats knowledge- and possession-based MFA but not origin-bound credentials. FIDO2/WebAuthn (W3C) signs a challenge that is cryptographically bound to the origin, so a relayed request from a phishing proxy carries the wrong origin and the assertion fails - this is what "phishing-resistant" means in practice. A common misconception is that "we use HTTPS, so MitM is impossible": HTTPS protects transport, but a MitM upstream of TLS termination (a compromised load balancer, a corporate inspection proxy, a malicious root certificate installed on the device) sits inside the trust boundary and sees plaintext. MitM differs from eavesdropping in that the attacker can alter as well as observe, and from spoofing in that it maintains two live sessions rather than merely impersonating one endpoint.