What Are Man-in-the-Middle Attacks?
A man-in-the-middle (MITM) attack places an attacker secretly between two parties, relaying their messages while each believes it is talking directly to the other. From that vantage, the attacker can read, alter, or inject traffic. It is one of the most fundamental network attack shapes — and the reason authenticated encryption exists.
How do attackers get in the middle?#
By controlling a point the traffic passes through, or by tricking devices into routing through them:
| Technique | Layer |
|---|---|
| ARP spoofing | Link (local network) |
| DNS spoofing | Redirect to attacker’s server |
| Rogue Wi-Fi / access point | Physical/link |
| BGP hijacking | Internet routing |
| SSL stripping | Downgrade HTTPS to HTTP |
Each achieves the same position by a different route. Once there, the attacker’s power depends entirely on whether the traffic is protected.
Why does authenticated encryption defeat MITM?#
Because it removes both of the attacker’s abilities: reading (traffic is ciphertext) and impersonating (the endpoints authenticate each other). Properly validated TLS is the everyday example — an interceptor without a valid certificate cannot pose as the server, and the encrypted payload is useless to them.
Man-in-the-middle is the umbrella over many network attacks. More at the Network Security hub.
Frequently asked questions#
What is a man-in-the-middle attack?
A man-in-the-middle (MITM) attack is one where an attacker secretly positions themselves between two communicating parties, relaying and possibly altering messages while each side believes it is talking directly to the other. From that position the attacker can read, modify, or inject traffic. Common on shared networks and enabled by ARP or DNS spoofing.
How does encryption prevent MITM?
End-to-end encryption with authentication — like properly validated TLS — means an interceptor sees only ciphertext and cannot impersonate the endpoints without a valid certificate. The certificate check is essential: encryption without verifying who you are talking to can still be defeated by an attacker presenting their own keys.