Man-in-the-Middle Attack (MITM)

A man-in-the-middle (MITM) attack is an attack where someone secretly relays, and possibly changes, communication between two parties who think they are talking directly to each other. On the web it usually means intercepting a connection between a browser and a server.

Why it matters

Plain HTTP offers no protection: anyone on the path, such as a hostile Wi-Fi hotspot or a compromised router, can read passwords and inject scripts. HTTPS defends against this with two things working together: encryption, and certificate validation that proves the server is who it claims to be. If either is missing, the attack works. Encryption without authentication only moves the attacker into the middle of two separate encrypted sessions.

Example

A visitor joins a cafe network and types http://example.com. A rogue access point answers, serves a copy of the site over HTTP, and forwards requests onward. Because the browser never upgraded to HTTPS, nothing warns the visitor. HSTS prevents this on repeat visits, because the browser refuses to speak HTTP to that domain at all.

Common mistakes

• Telling users to click through certificate warnings. That warning is exactly how a MITM attempt appears.
• Serving login pages over HTTPS but loading scripts over HTTP, which lets an attacker rewrite the page.
• Forgetting that corporate TLS inspection proxies are deliberate MITM devices trusted through an installed root certificate.

Related

• SSL stripping
• HSTS
• Certificate pinning
• Mixed content

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.