Man-in-the-Middle Attack (MITM)

A man-in-the-middle attack, often shortened to MITM, is a cyberattack in which someone places themselves between two parties who are communicating, such as a customer and a bank's website, and secretly reads, captures or changes the messages passing between them. Each party believes it is talking directly to the other. The attacker may steal login details or card numbers, redirect payments, or alter transaction details before passing them on.

MITM attacks target the gaps in how data travels across networks rather than the devices at either end, although malware on a device can create a similar position, an approach sometimes called man-in-the-browser. The main defence is strong encryption combined with reliable ways to check who is on the other end of a connection.

Imagine two people passing notes in class through a classmate who sits between them. The classmate can read every note, copy it, or rewrite it before handing it on. If one note says "pay 50 to Sam", the classmate can change it to "pay 50 to Alex", and neither of the original writers will know.

On the internet, the "classmate" might be a fake Wi-Fi hotspot in a café, a hacked router or a forged website. The defence is like sealing each note in an envelope that only the intended reader can open, and checking the seal is genuine before trusting what is inside.

Attacks have two stages: getting into the path of the traffic, and then exploiting that position. Common ways to get into the path include:

• Rogue Wi-Fi. Setting up a free hotspot with a convincing name so that nearby devices connect to it.
• Local network tricks. On a shared network, falsifying address information so that traffic for the router passes through the attacker's machine.
• DNS manipulation. Poisoning or hijacking the system that turns website names into IP addresses, sending users to a server the attacker controls.
• Routing hijacks. Announcing false internet routes so that traffic for a block of addresses flows to the attacker.
• Compromised email. Reading a business's email and inserting false payment instructions into a genuine conversation.

Once in position, the attacker may try to strip or bypass encryption, present a forged security certificate, or simply copy unencrypted data. Some attacks work only if the user ignores a browser warning.

In payments, a frequent outcome of MITM-style attacks is invoice redirection, where an attacker who has gained access to email changes bank details on a real invoice. This overlaps with the business email compromise scam and with email spoofing. Banks have also faced man-in-the-browser malware that altered the recipient of a transfer on screen while showing the customer the details they expected.

In crypto, attackers have hijacked internet routing and DNS to send users of wallet and exchange websites to fake copies. In April 2018, a routing hijack redirected some users of the MyEtherWallet website to a fraudulent server that stole funds from those who ignored a certificate warning. Attackers have also taken over the domain records of decentralised finance front ends and replaced them with pages that drain wallets. Because blockchain transfers cannot be reversed, a single intercepted transaction can mean a permanent loss.

• Encryption in transit. Transport Layer Security (TLS), the successor to SSL, encrypts traffic and lets browsers verify a site's certificate. Users should never click through certificate warnings on financial sites.
• Strict security settings. Websites can tell browsers to refuse unencrypted connections, and apps can "pin" the certificates they expect, making forged ones useless.
• End-to-end encryption. Messages encrypted on the sender's device and decrypted only on the recipient's cannot be read by anyone in between.
• Strong authentication. Multi-factor authentication using hardware keys tied to the genuine website resists credential theft through fake sites.
• Out-of-band checks. Confirming changed bank details by phoning a known number, rather than replying to the email, defeats invoice redirection.
• Device confirmation. A hardware wallet shows the real destination address on its own screen, so a tampered address on a computer can be spotted before signing.
• Cautious network use. Avoiding unknown public Wi-Fi for financial tasks, or using a trusted mobile connection, reduces exposure.

Intercepting communications without permission is an offence under wiretapping and computer-misuse laws in most countries, and using intercepted data to take money adds fraud charges. Regulators also expect banks and payment firms to protect customers with secure channels and authentication; in Europe, for example, strong customer authentication rules require transaction details to be bound to the authentication so that altered payments are rejected.