A man-in-the-middle (MITM) attack puts an attacker between a user agent and a web application so the attacker can intercept their messages. The immediate risk is traffic that was expected to travel directly to a site instead passing through someone else’s device. Unencrypted traffic can then be read; protecting the connection means protecting both requests and responses while they travel across the network. section 7.1 section 7.0
A common route into this position is ARP spoofing on a local network. ARP lets devices advertise which MAC address handles an IP address, and it trusts received advertisements. An attacker can send phony ARP packets claiming to be the network gateway. Victims then route outbound traffic to the attacker, who forwards it to the real gateway to keep the connection working while gaining visibility into the passing traffic. section 7.2
A hostile hotspot
Wi-Fi and corporate networks are attractive targets because an attacker may join a network and spoof ARP records. Alternatively, the attacker can operate a Wi-Fi hotspot and wait for devices or users to connect. In either case, forwarding traffic onward can make the interception inconspicuous. If the site uses plain, unencrypted traffic, the attacker can read it; encryption prevents that traffic from being intelligible to the interceptor. section 7.2
Use layered transport protections to make interception ineffective:
- Serve every connection to the web application over HTTPS. HTTPS makes traffic indecipherable and tamperproof to parties without the certificate’s private encryption key. section 7.2
- Acquire a certificate from a certificate authority and host its accompanying private encryption key on the web server; restrict access to systems and processes holding encryption material. section 7.2 section 7.13
- Implement HSTS so communication is consistently HTTPS, and require a minimum TLS version—TLS 1.3 as stated here—to resist downgrade attacks that try to stop a secure connection from being established. section 7.13
HTTPS addresses the interceptor’s ability to read or alter traffic, but it depends on secure connection setup and protected keys. Treat HTTPS as a required default rather than an optional feature, and pair it with operational care around certificates and private keys. section 7.2 section 7.13
