# Man-in-the-Middle (MitM) Attacks

1. Intercepts your letter before it reaches your friend
2. Opens and reads everything
3. Can modify the contents
4. Reseals it and sends it to your friend
5. Neither you nor your friend realizes someone read the letter

• Your passwords
• Credit card numbers
• Private messages
• Session cookies
• Any data you send or receive

Attacker creates fake WiFi networks or monitors unencrypted WiFi traffic

Public WiFi Network
↓
Attacker's laptop running packet sniffer
↓
Captures all unencrypted traffic from other users

Tricking devices on a local network to send data through the attacker's machine

ARP (Address Resolution Protocol) maps:
IP Address → MAC Address

Computer asks: "Who has IP 192.168.1.1?"
Router responds: "That's me, MAC address AA:BB:CC:DD:EE:FF"
Computer saves: 192.168.1.1 = AA:BB:CC:DD:EE:FF

Victim Computer: "Who has 192.168.1.1 (router)?"
Attacker: "That's me! MAC address 11:22:33:44:55:66" (lying)

Victim now sends all traffic to attacker instead of router
↓
Attacker forwards traffic to real router
↓
Victim doesn't notice, but attacker reads everything

Redirecting domain name lookups to attacker-controlled servers

# 4. SSL Stripping

Downgrading HTTPS connections to HTTP, removing encryption

1. User types: "http://bank.com"
2. Server redirects: "Use https://bank.com instead"
3. Browser connects via HTTPS (encrypted)

1. User types: "http://bank.com"
2. Attacker intercepts request
3. Attacker connects to bank via HTTPS (encrypted: Attacker ↔ Bank)
4. Attacker responds to user via HTTP (unencrypted: User ↔ Attacker)
5. User thinks they're on bank.com, doesn't notice missing lock icon
6. All data visible to attacker

User ←[HTTPS encrypted]→ Bank
(Attacker can't read)

User ←[HTTP unencrypted]→ Attacker ←[HTTPS encrypted]→ Bank
     ↑ visible to attacker

# 5. HTTPS Spoofing (Fake Certificates)

Using fake SSL certificates to impersonate secure websites

If attacker compromises a Certificate Authority:
- Can issue valid certificates for any domain
- Browser shows "Secure" with no warnings
- Perfect impersonation

Attacker tricks victim into installing fake root certificate:
"Install this certificate to access company WiFi"

After installation:
- Attacker can issue certificates for any site
- Browser trusts them (because root cert is trusted)
- No warnings shown

Stealing session cookies to impersonate logged-in users

1. User logs into website
2. Server sends session cookie: session_id=abc123xyz
3. Attacker intercepts cookie (via MitM)
4. Attacker uses stolen cookie
5. Server thinks attacker is the legitimate user

Pre-installed malware that performed MitM on HTTPS traffic

• Affected all Lenovo laptops sold in 2014-2015
• Hundreds of thousands of devices compromised
• $3.5 million settlement

1. Lenovo pre-installed "Superfish" adware on laptops
2. Superfish installed root certificate on system
3. Intercepted all HTTPS traffic
4. Decrypted, injected ads, re-encrypted
5. Users saw "secure" lock icon, but traffic was compromised

Normal HTTPS:
User ←[encrypted]→ Website

With Superfish:
User ←[encrypted]→ Superfish ←[encrypted]→ Website
                     ↑
               (can read everything)

Nation-state MitM on global internet traffic

• Unknown number of targets
• Compromise of secure communications
• Government surveillance on mass scale

User requests: download.example.com/update.exe
↓
NSA detects request
↓
NSA responds FASTER than real server with malicious update.exe
↓
User's computer executes NSA malware

Targeted MitM attacks on hotel WiFi networks

• CEOs, executives, government officials targeted
• Sensitive corporate and government data stolen
• Global espionage campaign

Executive connects to hotel WiFi
↓
Visits Adobe.com to download Flash update
↓
Attacker intercepts request
↓
Serves malware disguised as Flash update
↓
Executive installs malware
↓
Attacker gains access to laptop and corporate network

Force HTTPS on all pages and implement HSTS

Submit your domain: hstspreload.org

Requirements:
1. Serve valid HTTPS certificate
2. Redirect HTTP to HTTPS
3. Serve HSTS header on all subdomains
4. HSTS max-age of at least 1 year

Benefits:
- Browsers hardcode your domain as HTTPS-only
- Protection from first visit
- Used by Chrome, Firefox, Safari, Edge

Hardcode which certificates/CAs your app trusts

VPN encrypts all traffic, even HTTP, protecting against:

• WiFi eavesdropping
• ARP spoofing
• DNS spoofing
• SSL stripping (partially)

javascript// Programmatic DNS over HTTPS
const fetch = require('node-fetch');

async function lookupDNS(domain) {
    const response = await fetch(
        `https://cloudflare-dns.com/dns-query?name=${domain}&type=A`,
        {
            headers: {
                'Accept': 'application/dns-json'
            }
        }
    );

    const data = await response.json();
    return data.Answer.map(a => a.data);
}

// This request is encrypted (HTTPS), preventing DNS spoofing

WARNING SIGNS:

• Browser shows "Not Secure" or certificate warnings
• Certificate issuer is unknown or unexpected
• Certificate dates are invalid
• Domain name doesn't match certificate

Action: DO NOT PROCEED. Close the site immediately.

bash# Check ARP table for duplicates
arp -a

# Normal output:
192.168.1.1   AA:BB:CC:DD:EE:FF
192.168.1.100 11:22:33:44:55:66

# Suspicious (ARP spoofing):
192.168.1.1   AA:BB:CC:DD:EE:FF
192.168.1.1   11:22:33:44:55:66  ← Same IP, different MAC!

bash# Check DNS resolution
nslookup bank.com

# Compare with known good DNS
nslookup bank.com 8.8.8.8

# Different results = potential DNS spoofing