 |
| Man in the middle attack |
The Man-in-the-Middle Attack (MITM) is where the attacker intercepts conversations between the two parties to spy on the targets, capture sensitive information or credential, or possibly alter the communication in any way.
Types And Techniques Of MITM:
Here are some of the popular techniques and types that attackers use to become man-in-the-middle.
- ARP Cache Poisoning:
ARP Cache Poisoning
Address Resolution Protocol (ARP) is a low-level mechanism that converts the system address (MAC) to the IP address of the local network.
Attackers insert fake information into the system to deceive the computer into believing that the attacker's computer is a gateway to the network. When you connect to the network, the intruder collects all of the network traffic (instead of your actual network gateway) and transfers the traffic to its actual destination. From your point of view, everything is natural. The intruder will be able to see all of the packets.
- DNS Cache Poisoning:
DNS Cache Poisoning
DNS cache poisoning is when an attacker sends you a bogus DNS entry leading to a different website. It may look like Google, but it's not Google, and the perpetrator collects any data – username and password, for example – you access a fake website.
- HTTPS Spoofing:
 |
| HTTPS Spoofing |
HTTPS is one of the ways users know that their data is "safe." S stands for "safe." At least that's what an intruder wants you to think about. Attackers set up HTTPS websites that look like official sites with valid authentication certificates, but the URL is only a little different.
For example, they'll register a website with a Unicode character that looks like 'a a' but it's not. Continuing with the "example.com" example, the URL may look like https://www.example.com, except the "a" in the "example" is a Cyrillic "a," which is a genuine Unicode character that looks exactly like an Arabic "a" with a different Unicode meaning.
Wi-Fi Eavesdropping: Attackers monitor traffic on public or unsecured Wi-Fi networks or build Wi-Fi networks with generic names to trick people into joining so that they can steal credit or credit card numbers, or other details users send to the network.
Session Hijacking: Many web apps employ a login feature that creates a temporary session token for future requests to avoid asking the user to enter a password on each page. An intruder can sniff sensitive traffic to recognize the user's session token and use it to make requests as a user. The intruder does not need to fake because he has a session token.
Preventions From MITM:
 |
| Prevention from Man in the middle attack |
- Just link to secured Wi-Fi routers or use the encrypted communication of your wireless provider. Link to routers that use the encryption of WPA2. It's not completely secure, but it's still better than zero.
- VPNs may be used to create a protected network for confidential information on the local area network. They use key-based encryption to establish a protected communication subnet. This way, even though an intruder appears to be on a public network, the VPN would not be able to decrypt the traffic.
- Using a strong encryption feature for wireless access points prohibits malicious people from accessing the network only by being close. A weak encryption system will allow an attacker to brute-force his way into a network and start a man-in-the-middle attack. The better the application of cryptography, the secure it is.
- Using end-to-end encryption for your emails, chat, and video communication (Zoom, Teams, etc.) is also the best way to secure yourself from a MITM attack.
- Only log in to HTTPS connections, install a browser plugin to implement this rule.
- The most successful way to avoid e-mail hijacking is to allow two-factor authentication. That means that, in addition to your password, you need to have another authentication vector.
- a new technology, DNS over HTTPS, prevents you from DNS hijacking by encrypting your DNS requests.
Author: Faazla Usman & Bushra Yaqoob
){kind=link}
0 Comments