Intercepting messeges in attacks on authentication protocols

Question

I've recently read about Diffie-Hellman Man-in-the-Middle attack when a third party can intercept messages and thus construt two different symetric keys with both sides. However I still don't understand how the intercepting how the messages works. Does the third party can "catch" messages and throw them away? perhaps this is a general networking question, rather than security, but I hope I could find the answer here.

To be technical: if A sends some message M to B, I understand how he can read it, maybe alter and to send M' to B, but how does he prevent from he original M to be sent to B?

Answer 1

Lets look at a client server example like a website. The client (browser) communicates with a server (web site). The "Man-in-the-Middle" (MitM) in this case convinces the client that he is the server, so the client thinks it is talking to the website. The "MitM" also convinces the website he is the client. Communication is then completely controlled by the "Man-in-the-Middle".

For a low tech example think about a King communicating with a General centuries ago, by having a messenger carry letters between them. It is not just that the messenger can read the messages, but lets say the messenger can forge the King and General's handwriting. The messenger can then pretend to be the King to the General, and the General to the King. Controlling all communication.

This can happen in many ways (in fact any non-in-person communication should have some measures to prevent MitM attacks), so it is not a "general" networking question.

But for one simplified real example that includes networking: if we are both at a coffee shop, I (armed with some software and a wifi adapter) can pretend to be a wifi access point (AP), and display it as "Cafe X - Guest Wifi (Free)", in hopes someone will connect. If you take the bait, then I can act as the MitM for all your communication -- intercepting and injecting packets.