46

As I understand it in order to commit a successful MiTM attack you need to be "sitting" somewhere along the traffic path. I assume this means being hooked up to one of the nodes inbetween the end points, physically splicing the wire connecting them, or intercepting air waves.

  • Are my assumptions correct?
  • Does an adversary's terminal need to be directly connected to the wire, node, within wifi range, or can someone in Kansas use an outside path to gain access to a path from LA to San Francisco?
    • Maybe it's more correct to ask if someone needs to be in proximity to the target path. Conversely, can he "use the internet" to mitm the path: isn't every node on the internet essentially connected to each other?
  • 24
    Answer to title Q: When your best friend has been together with your sister for awhile, these things can happen. – Iszi Apr 7 '16 at 23:06
  • 8
    @iszi maybe I should have posted to relationships.stack – user5948022 Apr 8 '16 at 7:21
37

There are many, many ways you can become a MITM, virtually at all layers of the networking stack - not only the physical one. Being physically close to your target can help, but is by no means a necessity.


At the physical layer, the attacks you can get are very overt: splice a ethernet cable, use a optical tap, or capture radio signals.

A passive optical network,  tap - photo by Roens

A passive optical network, tap - photo by Roens

Some active attacks can have physical access as a precondition - many others do not.


At the data link layer, passive attacks are incredibly easy: just put your network card into promiscuous mode and you can see all traffic on your network segment. Even on a modern (switched) cabled network, MAC flooding will ensure you can see more than you ought to.

For active attacks on local networks, ARP spoofing is quite popular and easy to perform - it basically makes your computer pretend it's someone else - usually a gateway, so that you trick other devices to send traffic to you instead.

ARP spoofing - diagram by 0x55534C ARP spoofing - diagram by 0x55534C

Data link attacks work as long as you are connect to the same local network as your target.


Attacking the network layer is easy if you have physical access - you can just impersonate a router using any modern linux machine.

If you don't have physical access, ICMP redirect attacks are kind of obscure, but sometimes usable.

Of course, if you have enough money on your pocket you can do it NSA-style and intercept routers when they are shipped to their destination by (snail) mail - just tweak the firmware a bit and you're good to go.

Attacks at the network layer can be performed from any point in the (internet) network route between the two participants - although in practice these networks are usually well defended.


I'm not personally aware of any attacks at the transport layer.


At the application layer, attacks can be a bit more subtle.

DNS is a common target - you have DNS hijacking and DNS spoofing. Cache poisoning attacks against BIND in particular were very popular a couple of years back.

DHCP spoofing (pretending to be a DHCP server) is quite easy to perform. The end result is similar ARP spoofing, but less "noisy" on the network and possibly more reliable.

The broadest application layer attacks can be performed from anywhere in the internet.

  • "Attacks at the network layer can be performed from any point in the (internet) network route between the two participants" Or most anywhere else if you're capable of BGP hijacking. – Matt Nordhoff Apr 9 '16 at 21:19
  • At the transport layer, UDP is subject to IP spoofing just like IP, whereas TCP is much more resistant but still theoretically vulnerable. More info here. – edmz Apr 10 '16 at 15:51
  • @black That's a good point. AFAIK, there's no way to get a MITM attack with just source spoofing, right? (as the responses don't get routed to you) – goncalopp Apr 10 '16 at 16:46
34

TL;DR: Get the traffic routed through a system under your control and have MITM whereever you, the victim or the destination are.

A: Not quite.

First off, the internet is packet switched, so there might not be a single actual wire all packets go through.

To establish a MITM, that MITM must make sure the requests from the user get routed to him instead of the correct destination. There are several ways this can be done, for example:

  • In the local network by ARP spoofing of the gateway and/or DNS server,
  • In all networks on the route,
  • By returning his IP instead of the correct one from the victims DNS server

After that is established, the MITM interacts with the actual destination on the victims behalf, modifying data in between as the MITM likes.

The easiest way to establish this is in fact within the local network because those are usually less well monitored and/or governed. Also, they regularly have more consumer devices with more security risks that can after being compromised be used to redirect DNS requests to a server under MITM-control.

Yet, as you can see from above: If you manage to set the DNS server of the victim to one under your control, you may very well do MITM from whereever you like.

The same is true for routing nodes/ISPs: You may advertise cheap routes to the destination using the BGP to get all traffic routed through your system. Yet this is usually not feasible and/or possible for consumer connections.

  • Is one of the benefits of routing the traffic to you that you receive all the packets? Does providing your own IP rather than from victim's DNS circumvent certificates? Providing your own IP seems like your actual attempt at 'impersonation' while the other methids I'm not so sure; is there a distiction? What exactly do you mean by 'In all networks on the route?' Thanks for the great answer – user5948022 Apr 7 '16 at 11:28
  • seems like *an actual attempt – user5948022 Apr 7 '16 at 11:30
  • 3
    The benefit of attacking at dns level is: you do not have to modify the routing of the traffic - you are the actual destination anyway. It does not fix the certificate problem, but if you MITM a CA, you can maybe get a valid cert. – Tobi Nary Apr 7 '16 at 11:35
10

The adversary doesn't necessarily need to be physically located on the network route that they're hacking. They may have previously compromised a network device that is on the route, and thus be able to login to it and conduct their attack from any location.

  • 1
    So is the attacker just opportunistically grabbing whatever traffic happens to go through that device rather than targeting a specific connection? Also does the actual compromising of the device happen by remote/tcp connection? – user5948022 Apr 7 '16 at 10:57
  • 1
    @user5948022 The only real answer to that is "It depends". There are many different possible scenarios. – Mike Scott Apr 7 '16 at 10:57
  • 1
    *CAN the actual compromising happen by.... – user5948022 Apr 7 '16 at 10:58
  • 2
    Yes, the original compromise can be a remote compromise over TCP/IP if the network device is inadequately protected and has an unpatched or zero-day vulnerability, or has been left with a default login enabled. – Mike Scott Apr 7 '16 at 11:00
8

Assume, you have a girlfriend, and you saved her number as GF in your phone. And in the same way, your girlfriend saved your number as BF in her phone.

Now an attacker X, manages to gain access to your phone, and change your GF number as his number. In the same way, he manages to gain access into her phone and changes your number as his number.

So the number saved as GF in your phone and number saved as BF in her phone is the phone number of X.

If you send a message to your GF, it will be received by X, he reads it and forwards it to your GF. Since X's number is saved as BF in her phone, she receives a message as From: BF, which is actually the attacker. She reads and reply, and he repeats the same.

Now X is the Man-In-The-Middle

  • 1
    This is how you explain network security to the masses. – YetAnotherRandomUser Apr 9 '16 at 1:43
  • 1
    @allanonmage I think for the question How does someone become a man in the middle?, this answer suits :) – Sibidharan Apr 9 '16 at 3:43
  • You don't have to impersonate the sender (BF) do you, because the return IP is included in the header of the intercepted packet. All you would need to worry about is the checksum, if you altered the message. – user5948022 Apr 11 '16 at 21:51
  • @user5948022 we also have to worry about the disclosure of the pocket – Sibidharan Apr 12 '16 at 2:56
  • @user5948022 And this is not about the technical thing. It is about the concept of MiTM - How it works!! If you want to explain it to an 8 year old, do you say IP address is included in the header of the packet being sent from the TCP ?? 😆 – Sibidharan Apr 12 '16 at 3:23
2

You seem to have some confusion about how communications take place in Internet. I suggest you to read:

But interesting to note, would be that the information you exchange over the network transit is small packets, through different nodes. The exact location of the nodes depends on many factors. But when Alice in LA use skype to chat with Bob in SF, her messages (in packet) may transit to Canada, Germany and back.

And more to your question, a MitM attack is achieved whenever Mallory managed to set herself as a relay between Alice and Bob. She receives Alice's message and send them further to Bob.

Mallory could be located anywhere in the world. Remember that packets travel to a lot of places. But she needs to make sure that all traffic from Alice to Bob would transit through her. For that she has to take control of a node through which either Alice or Bob's message has to transit. For example, directly Alice's computer, her ISP, or a public WiFi router.

You can get more details on the corresponding wikipedia article.

  • 1
    The LA to SF was a bad example, also I didn't know the individual packets took different routes. Is this still the case after a VPN is established? Conceptually I was thinking of an attack where malory silently observed the node's traffic without manipulating the route in front of and behind. Is it instead correct to say Mallory actively controls sending to Bob once she receives from Alice? – user5948022 Apr 7 '16 at 11:37
  • 2
    @user5948022: A man-in-the-middle attack is by definition an active attack, so yes, Mallory actively controls what Bob and Alice receive. If you are just listening to traffic, that's called "eavesdropping". MitM could be called "active eavesdropping". – sleske Apr 8 '16 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.