What Man-in-the-Middle Attacks Are and How to Prevent Them

A man-in-the-middle attack occurs when a bad actor secretly inserts themselves in the middle of two connected parties with the intent to read, steal, manipulate, or forward the data that is being exchanged. Also called “eavesdropping,” these attacks have the potential for a big payoff.

How man-in-the-middle works

During an attack, a hacker can monitor digital activities, conversations, and emails to steal account login information, credit card numbers, bank information, and more.

Popular targets are: 

• Insecure networks

• Unencrypted websites

• Smartphones

• Other smart devices 

Once the attacker finds an insecure access point, they can insert themselves between two parties, and everything the parties transmit goes through the attacker first in real time. 

EXAMPLE A

Abby is on her smartphone and thinks she is communicating privately with her brother, Abe, about their aging parents’ financial holdings. On the other end, Abe thinks his texts are only being seen by Abby. However, unbeknown to either of them, all of their texts are being secretly rerouted through a new connection the hacker has created. As the texts pass through this hidden path, the hacker sees every word the two of them type as well as any images, videos, or links shared. 

How to detect man-in-the-middle attacks

As mentioned above, many man-in-the-middle attacks go undetected. However, having awareness about the possible symptoms of an attack, and also taking precautions to avoid putting yourself at risk, are good first steps in protecting yourself online. Be on the lookout for any kind of abnormal state on any of your streaming services, systems, accounts, or devices (different balances, activity you don’t recognize, etc.). 

Always use an antivirus software to search for malware. Be sure to inspect your current WiFi connection to make sure it is secure and not open. Only visit https sites that you trust, and verify that the URL is correct (with no typos). 

Be wary when you experience:

• Suspicious certificates

• An address in your browser’s URL bar that you don’t recognize

• An address in your browser’s URL  that is a misspelled version of the website you think you’re visiting  

• Network connections that you don’t recognize