DataTerminology.comNEW
Also known as: MITM
An attack where an adversary secretly intercepts and possibly alters communications between two parties who believe they are communicating directly.
DESCRIPTION
In a man-in-the-middle (MITM) attack, an adversary positions themselves between communicating parties to eavesdrop, inject content, or alter messages. Techniques include ARP poisoning, DNS spoofing, rogue Wi‑Fi access points, and SSL stripping. Strong transport security (TLS), certificate validation, HSTS, and certificate pinning help prevent interception. Mutual TLS and authenticated key exchange provide stronger identity assurances. Continuous monitoring and user awareness reduce exposure from untrusted networks.
ALTERNATIVE DEFINITIONS
Cloudflare Learning Center
A man-in-the-middle (MITM) attack is a general term for a cyberattack where a perpetrator positions themself in a conversation between a user and an application.
Highlights adversary positioning within a conversation to intercept communications.
CISA
Man-in-the-middle attacks occur when an attacker places themselves between a user and an application to intercept or manipulate communications.
Emphasizes interception and manipulation as primary goals.
RELATED TERMS
TLS ARP Spoofing DNS Spoofing SSL Stripping Certificate Pinning HSTS Public Key Infrastructure Session Hijacking Downgrade Attack
COMPETING TERMS
Mutual TLS End-to-End Encryption
KNOWLEDGE AREAS
Data Security Infrastructure Cloud Software Engineering
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Software Developer Cloud Architect IT Auditor IT Manager
EXTERNAL SOURCES
- Wikipedia - Man-in-the-middle attack
- OWASP - MITM overview and defenses
- IETF - HTTP Strict Transport Security (HSTS)
- NIST - TLS configuration guidelines
TOP QUESTIONS
How does a Man-in-the-Middle Attack work?
An attacker intercepts traffic between two parties, often via ARP or DNS spoofing, and can read or modify messages without detection if encryption or validation is weak.
Category: Overview
How does TLS help against MITM?
TLS authenticates servers with certificates and encrypts traffic. Proper certificate validation and HSTS prevent downgrade and interception.
Category: Best practices
What is certificate pinning in MITM defense?
Pinning restricts accepted certificates to known keys, reducing risk from rogue or misissued certificates used in interception.
Category: Definition
Are public Wi‑Fi networks safe from MITM?
Open Wi‑Fi is high-risk for MITM. Always use TLS and consider VPNs to protect traffic.
Category: Risk
Can mutual TLS stop MITM?
Yes, by authenticating both client and server, mTLS makes impersonation and interception significantly harder.
Category: Alternatives
What is SSL stripping?
An attacker downgrades HTTPS to HTTP by intercepting redirects; HSTS enforces HTTPS to prevent this.
Category: Example
How do I detect MITM in practice?
Monitor certificate changes, enable certificate transparency checks, and use network IDS/IPS for anomalies.
Category: Observability
Do CDNs increase MITM risk?
Properly configured CDNs terminate TLS securely. Risks arise from misconfiguration or trust in third-party certificates.
Category: Misunderstanding
What user behaviors reduce MITM exposure?
Avoid untrusted Wi‑Fi, verify HTTPS padlocks, and keep systems updated to maintain strong cryptography.
Category: Best practices