Understanding and Preventing Man-in-the-Middle Attacks in the Digital Age

By: KUKUTLA TEJONATH REDDY, International Center for AI and Cyber Security Research and Innovations (CCRI), Asia University, Taiwan, tejonath45@gmail.com

Abstract

Man-in-the-Middle (MitM) attack is the most common cyber security threat in this modern digital world. MitM takes the advantage of the trust we have on communication system. MitM focuses on the data traveling between end points of the devices. And it tires to mess with our confidentiality and integrity. This happens when someone secretly intercept the messages you sent and messages you receive in online, without knowing to the sender and the receiver. This article describes types of MitM attacks, how to prevent against them.

Introduction

In this modern world where we are using digital communication all the time, we have to be more careful. It is important to make sure that the data which we are sending or receiving are in private and they are not tampered. MitM attack is tricky cyber threat that can mess with our online messages. In this attack, an attacker will secretly listen the conversation between the two persons and he can even tamper the message without knowing to each other. This article describes types of MitM attacks, how to prevent against them.

Some of MitM Attacks

ARP Spoofing: Address Resolution Protocol (ARP) spoofing is an cyber-attack where an attacker will send a fake ARP message to connect their MAC address with the IP address of a authorized device on a local network. By that attacker can able to grab the network data which was meant for authorized device, and acting as an intermediary

DNS Spoofing: In Domain Name Server (DNS) Spoofing attacker will trick user device to force to visit fake website rather than a legitimate site. User may think he is using a legitimate site and giving login credentials but attacker will capture the login credentials form the fake website.

IP Spoofing: IP Spoofing is trick where attacker will pretend like someone else on the internet by using a fake IP address. It is like hiding the attacker identity by putting a fake return address on an envelope. This can used in so many purposes like in cyberattacks and hiding online history of someone

Stealing browser cookies: In this attack attacker will collect the information from your web browser. Web browser will store some information like login credentials, preferences and which websites you visited. Attacker can steal that information and can get access for the online accounts without your permission.

Email hijacking: Attacker will target on hacking into email accounts of banks and other financial organization. When attacker get access of these accounts, they will analyse the communication between the organization and clients. After analysing attacker will send a email from banks email address and start pretending like legitimate one and send their own instruction to the client. Clients will gets convince and they will follow the instructions which is given by attacker.

Preventions of MitM attack

Encryption: Use encryption method like end-to-end encryption to protecting our data. Encryption method will make difficult for attacker to intercept and decrypt our data.

Strong Authentication: Use multi-factor authentication methods for accessing online accounts and don’t save the login credentials in the system or in your browser.

Email Security: Use SPF, DKIM, and DMARC email authentication mechanisms to protect from email-based MitM attack.

Monitoring and Logging: Monitor the network traffic and maintain logs for malicious activities. If any suspicious happens check it out and take action

IDS/IPS: implement Intrusion Detection system/Intrusion Prevention system to monitor the network traffic for malicious behaviour of MitM attack.

VPN: Use vpn when your connecting a public Wi-fi network. Vpn encrypt your internet traffic it will be difficult for attacker to intercept the connection.

Conclusion

Man-in-the-middle attack is a major threat in cybersecurity. Day by day hackers are getting smarter and using new techniques. It is important to know how these attack works, and how hackers will use them. The prevent we have maintained in the article will protect our communication in the online world. We have to take all preventions to keep our data safe in this modern digital world.

References

1. Riadi, Imam & Umar, Rusydi & Busthomi, Iqbal & Wirawan Muhammad, Arif. (2021). Block-hash of blockchain framework against man-in-the-middle attacks. Register: Jurnal Ilmiah Teknologi Sistem Informasi. 8. 1. .
2. B. Pingle, A. Mairaj and A. Y. Javaid, “Real-World Man-in-the-Middle (MITM) Attack Implementation Using Open Source Tools for Instructional Use,” 2018 IEEE International Conference on Electro/Information Technology (EIT), Rochester, MI, USA, 2018, pp. 0192- 0197, doi: 10.1109/EIT.2018.8500082.
3. M. Conti, N. Dragoni and V. Lesyk, “A Survey of Man In The Middle Attacks,” in IEEE Communications Surveys & Tutorials, vol. 18, no. 3, pp. 2027-2051, thirdquarter 2016, doi: 10.1109/COMST.2016.2548426.
4. B. Bhushan, G. Sahoo and A. K. Rai, “Man-in-the-middle attack in wireless and computer networking — A review,” 2017 3rd International Conference on Advances in Computing,Communication & Automation (ICACCA) (Fall), Dehradun, India, 2017, pp. 1-6, doi: 10.1109/ICACCAF.2017.8344724.
5. G. Nath Nayak and S. Ghosh Samaddar, “Different flavours of Man-In-The-Middle attack, consequences and feasible solutions,” 2010 3rd International Conference on Computer Science and Information Technology, Chengdu, China, 2010, pp. 491-495, doi: 10.1109/ICCSIT.2010.5563900.
6. Yadav, K., Gupta, B. B., Chui, K. T., & Psannis, K. (2020). Differential privacy approach to solve gradient leakage attack in a federated machine learning environment. In Computational Data and Social Networks: 9th International Conference, CSoNet 2020, Dallas, TX, USA, December 11–13, 2020, Proceedings 9 (pp. 378-385). Springer International Publishing.
7. Tripathi, S., Gupta, B., Almomani, A., Mishra, A., & Veluru, S. (2013). Hadoop based defense solution to handle distributed denial of service (ddos) attacks.
8. Gupta, B. B., Joshi, R. C., & Misra, M. (2012). ANN based scheme to predict number of zombies in a DDoS attack. Int. J. Netw. Secur., 14(2), 61-70.
9. Singh, A., & Gupta, B. B. (2022). Distributed Denial-of-Service (DDoS) Attacks and Defense Mechanisms in Various Web-Enabled Computing Platforms: Issues, Challenges, and Future Research Directions. International Journal on Semantic Web and Information Systems (IJSWIS), 18(1), 1-43.
10. Mishra, A., Gupta, N., & Gupta, B. B. (2021). Defense mechanisms against DDoS attack based on entropy in SDN-cloud using POX controller. Telecommunication systems, 77(1), 47-62.

Cite As

REDDY K.T (2023) Understanding and Preventing Man-in-the-Middle Attacks in the Digital Age, Insights2Techinfo, pp.1

536610cookie-checkUnderstanding and Preventing Man-in-the-Middle Attacks in the Digital Ageyes