What Is a Man-in-the-Middle Attack? Eavesdropping on Your Connection

A Man-in-the-Middle (MITM) attack is a cyberattack where the attacker secretly intercepts and potentially alters communication between two parties who believe they’re communicating directly with each other. The attacker positions themselves between you and the server (or between you and another person) and can read, modify, inject, or redirect the data flowing through. It’s like someone secretly opening your mail, reading it, possibly changing the contents, resealing it, and delivering it to the recipient who has no idea it was tampered with.

How MITM Attacks Work

On Public Wi-Fi

The classic scenario. An attacker on the same Wi-Fi network (coffee shop, hotel, airport) uses techniques like ARP spoofing to redirect other users’ traffic through their device:

1. Attacker sends fake ARP messages to your device: “I’m the router”
2. Attacker sends fake ARP messages to the router: “I’m user’s device”
3. All your traffic now flows through the attacker’s machine
4. Attacker reads/modifies unencrypted traffic and forwards it along
5. Neither you nor the router realizes there’s an intermediary

This is why public Wi-Fi without a VPN is risky for any unencrypted traffic.

SSL Stripping

The attacker downgrades your HTTPS connection to HTTP. You type yourbank.com, the attacker intercepts the redirect from HTTP to HTTPS, communicates with the bank over HTTPS, and serves you the content over HTTP.

Your browser shows an HTTP connection (no padlock) while the attacker has full access to your traffic. HSTS headers and browser preload lists defend against this (they refuse to connect over HTTP entirely), which is why HSTS configuration matters.

Rogue Access Points

Set up a Wi-Fi network named “Starbucks Free WiFi” near a Starbucks. People connect thinking it’s the cafe’s network. All their traffic now passes through your device. This is trivially easy to set up and surprisingly effective.

DNS Spoofing

Redirect DNS queries to resolve yourbank.com to the attacker’s server instead of the real one. Combined with a convincing fake website, users enter credentials without realizing they’re on the wrong server.

Defenses

• Always use HTTPS (and watch for warnings about invalid certificates)
• Enable HSTS on your websites (prevents SSL stripping)
• Use a VPN on untrusted networks
• Verify certificates when you get browser security warnings (don’t click through them)
• Use DNS over HTTPS to prevent DNS spoofing
• Certificate pinning in apps (stores expected certificates, rejects substitutes)

Test It Yourself

Frequently Asked Questions