AiTM Definition

What is an Adversary in the Middle (AitM) Attack?

An Adversary in the Middle (AitM) attack — also called a Man in the Middle (MitM) or on-path attack — allows an attacker to intercept communications en route to their destination. If network traffic is not properly protected, this could allow the attacker to read sensitive data or tamper with the communication.

How Does an AitM Attack Work?

The core of an AitM attack is the ability to intercept communications. Typically, this happens when a user is communicating with a web server or other online application.

To intercept communications, the attacker needs to be able to place themselves somewhere on the path between the user and the server hosting the website or application. Some of the ways that they can accomplish this include:

• Public Wi-Fi: Many people will connect to an open public Wi-Fi network without thinking about it, especially if it has a recognizable or logical name (like “Airport Free WiFi”). If an attacker sets up a malicious Wi-Fi hotspot, the communications of everyone who connects to it will pass through their computer.
• Malicious ISP: All of a user’s traffic will pass through the systems of their Internet Service Provider (ISP) and their virtual private network (VPN) provider if they are using one. If these entities are malicious or compromised, they can perform an AitM attack on their customer’s traffic.
• ARP Poisoning: An attacker on the target’s subnet can use ARP poisoning to redirect the user’s traffic to their device.
• Malware: If malware is installed on a user’s computer or within their browser — a threat known as a Man in the Browser (MitB) attack — the attacker can intercept their network traffic before it even leaves their computer.

What Can an AitM Attack Do?

If an attacker can intercept a user’s traffic en route to its destination, then they can take various malicious actions. However, the actions that are available depend on the security of the network connection. Some of the potential options include:

• Denial of Service (DoS): DoS attacks are always an option in an AitM attack. If a user’s traffic flows through an attacker’s systems, the attacker can simply drop the traffic so that it never reaches its intended destination.
• Eavesdropping: If the network traffic is not properly encrypted — i.e. using an insecure protocol like HTTP instead of HTTPS — then the attacker may be able to eavesdrop on the communications. Some protocols — like DNS — may be unencrypted by default and leak sensitive information.
• Tampering: If a user’s traffic doesn’t have integrity protections — such as digital signatures — in place, then the attacker may be able to tamper with its contents.
• Downgrade Attacks: If a user plans to use a secure protocol, an attacker may be able to trick them into using an insecure variant. For example, the attacker could intercept early traffic setting up an encrypted TLS session and falsify data so that the user believes that the server only supports older, insecure protocols.

How Do I Protect Against an AitM Attack?

Luckily, an AitM attack is a known threat, and many websites protect against it by default. A key part of this protection is using the HTTPS protocol for web browsing instead of unencrypted HTTP.

The HTTPS protocol uses the Transport Layer Security (TLS) protocol to create a secure channel over an untrusted network. TLS has a few important features, including:

• Authentication: A website using HTTPS will provide a digital certificate proving its identity. A web browser will verify that this digital certificate is valid and that the website is who it claims to be.
• Encryption: Using the digital certificate and asymmetric cryptography, the client and server will create a shared, secret encryption key. This key is used to secure the rest of their traffic, preventing eavesdropping.
• Integrity: The website’s digital certificate will include a public key that can be used to verify digital signatures created by that website. HTTPS traffic will be digitally signed, ensuring that it is authentic and hasn’t been tampered with en route.

Conclusion

AitM attacks can be a significant threat when using vulnerable protocols. Always use an encrypted connection — such as HTTPS or a VPN — when using an untrusted network.