Man-in-the-middle attack
MitM · AitM · adversary-in-the-middle · on-path attack · evil twin · rogue Wi-Fi hotspot · attaque de l’homme du milieu
An attack in which someone secretly places themselves between two communicating parties to read, steal or alter what they exchange without either side noticing.
In practice
Attackers can sit on a rogue public Wi-Fi network (a fake hotspot named after the hotel), on the local network, or behind a relay page that mimics a legitimate site. TLS encryption, checked through certificates, makes interception very hard, provided nobody clicks through certificate warnings. So-called AitM phishing kits relay the real login and steal the session cookie, which defeats ordinary multi-factor codes.
Fictional case: at the airport, a consultant joins the “Airport-Free” Wi-Fi set up by an attacker. Her browser warns of an invalid certificate; in a hurry, she clicks “Continue”. The attacker captures her email credentials.
How to protect yourself
- HTTPS everywhere, with HSTS enabled on your own sites.
- Never ignore a certificate warning; on public networks, use your phone’s hotspot or the company VPN.
- Adopt passkeys or FIDO2 keys: bound to the genuine domain, they do not work on a relay site.
- Segment the internal network and watch for anomalies (ARP spoofing, rogue DHCP servers).
