Man-in-the-Middle Attack (MitM)

The same attack is also called person-in-the-middle (PITM), and MITRE ATT&CK names it adversary-in-the-middle (AiTM). From that position an attacker can monitor communications, reroute traffic, alter information, deliver malware, and collect personal or other sensitive information. MITRE notes that the position is also used to intercept credentials, including access tokens and session cookies.

Attackers reach the position in several ways. On a local network they abuse protocols that decide where traffic flows, such as ARP, DNS, and LLMNR, so that a device sends its traffic through a system the attacker controls. Other routes include phishing, pharming, typo-squatting, and rogue Wi-Fi access points set up in public areas to look legitimate. A downgrade attack can also create the position by negotiating a weaker version of SSL/TLS or a weaker encryption algorithm.

MITRE's mitigations include encrypting all wired and wireless traffic, protecting web traffic that may carry credentials with SSL/TLS, disabling legacy network protocols that are not needed, network segmentation, and intrusion detection and prevention systems that recognize traffic patterns of this activity. Users should treat certificate errors with suspicion, because attackers may use their own certificates to intercept HTTPS traffic. Detection looks for DNS or ARP poisoning attempts, unauthorized changes to network configuration, and abnormal TLS downgrade activity.