Man-in-the-middle attack

As explained in Software Security for Developers

A man-in-the-middle attack is an attack in which an adversary intercepts and potentially alters communication between two parties while impersonating each party to the other.

A man-in-the-middle attack places an adversary between two communicating parties. The attacker intercepts traffic, reads it, and may alter it while each side believes it is communicating directly with the other. Unsecured public Wi-Fi, compromised routers, and manipulated DNS paths create practical opportunities for this attack. section 10.2.1 section 10.4

Impersonating the router

An attacker can make devices on a local network treat the attacker’s computer as the router, forwarding traffic normally to avoid suspicion while reading messages, websites, and downloads. Without TLS, the traffic may be plain text; the attacker can also inject fake pages, pop-ups, or malware. section 10.2.1

Figure 10.9 A MITM attack using Cain & Abel. By impersonating the router, an attacker silently intercepts messages between users and the internet. The traffic is forwarded normally to prevent suspicion, but the attacker can read all data in and out.

Trace how silently rerouted traffic passes through the attacker before reaching the internet. section 10.2.1

TLS counters the attack by combining:

• Encryption, which makes intercepted messages unreadable. section 10.2.1
• Cryptographic signatures, which expose message tampering. section 10.4
• Digital certificates, which help browsers verify the real website. section 10.4

How Software Security for Developers covers it

How deep it goes

Explains interception, router impersonation, encryption, signatures, and certificate checks, but does not detail attack implementation.

Examples

Uses public Wi-Fi, compromised routers, DNS paths, and Cain & Abel impersonating a classroom router.

What you can do after

Evaluate whether TLS prevents intercepted traffic from being read, modified, or redirected to an impostor.

How it connects

Connects MITM attacks with TLS, eavesdropping, tampering, impersonation, and digital certificates.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographyA man-in-the-middle attack is an active attack in which an adversary intercepts and alters communication between two parties while impersonating each party to the other.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityA man-in-the-middle attack is an attack in which an attacker secretly intercepts and relays communications between two parties, potentially altering the exchanged data.
• 

  liveBookmanning.com
  Grokking Web Application SecurityA monster-in-the-middle attack is an attack in which an adversary positions itself between communicating parties to observe or manipulate their traffic.

Compare how 4 books explain man-in-the-middle attack →

Related concepts

• HTTPSaddressed by · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.