Table of Contents
Introduction
Most people get excited when there is free Wi-Fi at the café or the airport. However, cybersecurity experts suggest it would be best if you have a healthy dose of skepticism for them. Sometimes a free Wi-Fi can lead to serious identity theft and corporate data leaks.
A hacker can easily set up a hotspot that provides free Wi-Fi in a busy café, railway terminal, or airport, knowing full well that people love to have anything free! The attacker quickly gains multiple users on his hotspots that go about surfing the net, logging into their social media accounts, transacting with their banks, and chatting with their friends.
If the above communication is not over an HTTPS protocol, the hacker can read through every bit of information passing between you and the concerned website. If it is an HTTP website, they will have access to your complete login credentials. If the login credentials are for a bank website, he can easily log into your account and transfer money to any account he sees fit.
This article explains what a man in the middle attack is and how it can steal your sensitive information. While this attack has been on the decline, small businesses must be aware of this threat and ensure that their entire website, especially the login and payment pages, use HTTPS. Failure to do so can lead to severe penalties and reputational damage.
What is Man In The Middle Attack (MiTM)?
Simply put, a man in the middle attack allows attackers to eavesdrop on the communication between two targets.
To first understand this attack technique, it is essential to know how communication over the internet works. All information you send and receive over the internet is broken into data packets that are transferred in various ways and assembled at the destination.
When these data packets travel over an HTTP protocol, they travel unencrypted. Therefore, with the help of network sniffer tools, anyone can intercept these data packets and compile them to access sensitive information.
The consequences of this attack can be devastating! Suppose a bank utilizes HTTP in their login page. In that case, an attacker can easily sit between the user and the website, capturing the data packets from each, modifying the packets, and then sending them back. Through this attack, the attacker can log in to the user’s bank account, make unjustified transfers, and then disappear without the user or the bank noticing until it’s too late.
Man in the middle attack is a brilliant example of an attack that does not rely on getting access to your computer but can happen to anyone, anywhere, by someone halfway around the world. We must remember that the internet is an inherently insecure technology. We have to endeavor, both as a user and as a business, to ensure that we adopt the highest security standards to make it safer!
Types of Man In The Middle Attacks
Rogue Access Points
Setting up a hotspot called “Free Wi-Fi” that people connect to allows the attacker to manipulate the victims’ traffic. Victims are most often never aware that somebody is eavesdropping and manipulating their internet communications. The hackers in these cases are rarely ever caught.
Address Resolution Protocol Spoofing
Address Resolution Protocol or ARP resolves the IP address to the physical MAC address in a LAN to ensure the communication is going to the right target. However, the hackers can manipulate this system and route the target to his computer rather than the user, sometimes allowing him full access to the victim’s account.
DNS Spoofing
This man in the middle attack is a little more technical. A hacker introduces corrupt DNS cache information to a DNS host in an attempt to access another host, thereby impersonating a legitimate website. The unaware victim will share sensitive information with the hacker, believing they are sending the information to a trusted source.
Hackers rely on this technique to alter an HTTPS request to an HTTP one, thereby downgrading the connection to an unencrypted one. By doing so, all the information shared between the two parties will be in plaintext, making it easy for hackers to access sensitive data. Users must be vigilant and ensure that their connection is HTTPS whenever sharing confidential data.
How to protect against a Man in The Middle attack?
As mentioned before, the internet is inherently insecure. However, we are lucky that we have security researchers working around the clock, even in these pandemic times, to ensure that we have the right tools to secure our online behavior.
As a small business, we must ensure that all our websites, especially the login and transaction pages, have implemented the HTTPS protocol. This basic implementation will protect your business and users from becoming a victim of a Man in the Middle attack!
An HTTPS connection shows that the website has an encrypted connection. The “S” stands for “Secure” and does exactly that. A legitimate certificate authority issues a security certificate to the website, verifying the website’s authenticity. Although it is far from perfect, HTTPS is still much more secure than HTTP.
The sure way to know that the website is secure against any kind of man in the middle attack, is by noticing the lock icon at the side of the address bar. Communication with this website is immune to eavesdrop, and only you and the website will know the communication content. If there is no lock, the site is insecure, and you should not enter any login or transaction details.
Furthermore, ensure that you have a strong WAP encryption password for your network connection, preventing any unwanted person from connecting to your network and implementing a man in the middle attack.
Conclusion
Man in the middle attacks are tough to detect, if not impossible. Therefore, individuals and organizations must ensure that they prevent such an attack to the best of their abilities. Ensuring that your website has an HTTPS connection is the surefire way to avoid this type of attack.
Furthermore, excellent cyber hygiene will protect you against most threats. Think twice before connecting to free Wi-Fi in a hotel, café, or airport. If you have to, ensure you have an excellent VPN solution to encrypt your internet communication. Please do not use any “Free” VPN as they have themselves been found to eavesdrop!
Be vigilant against phishing attempts as that is the most common method of initiating a man in the middle attack and ensure your browser and software are up to date.
As a small business, you must enforce a VPN connection for all your remote workers to connect to your private internal network. Implement Multi-Factor Authentication to protect a hacker from hijacking a session - the most common man in the middle attack