Take the 2-minute tour ×

How likely are "Man in the Middle" attacks in internet security?

What actual machines, apart from ISP servers, are going to be "in the middle" of internet communications?

What are the actual risks associated with MITM attacks, as opposed to the theoretical risks?

EDIT: I am not interested in wireless access points in this question. They need to be secured of course but this is obvious. Wireless access points are unique in that communications are broadcast for everyone to hear. Normal wired internet communications are routed to their destination - only machines in the route will see the traffic.

share|improve this question
Theoretical risks and real risks are generally the same thing when you're talking about IT security –  Mark Henderson Jun 20 '10 at 10:31
Farseeker x2, it's theoretical today, tomorrow it's real. That's the difference. –  Chris S Jun 20 '10 at 15:01
@Farseeker: the difference is that the theoretical risk involves a scenario that may be highly unlikely in the real world. While it is possible that a machine in the middle can decrypt internet packets, one must ask: when is there ever going to be a machine in the middle that would do this? –  CJ7 Jun 21 '10 at 0:34
@Zephyr: Even small numbers of hackers focused intently on small numbers of targets can do significant damage. I'm looking at you Chi...er..."Fred". It's not necessarily the numbers that make the difference, it's the motivation. –  Dennis Williamson Jun 21 '10 at 2:24

7 Answers 7

First, let's talk Border Gateway Protocol. The internet is composed of thousands of endpoints known as ASes (Autonomous Systems), and they route data with a protocol known as BGP (Border Gateway Protocol). In recent years the size of the BGP routing table has been exponentially increasing in size, breaking well over one 100,000 entries. Even with routing hardware increasing in power, it is barely able to keep the pace with the ever-expanding size of the BGP routing table.

The tricky part in our MITM scenario is that BGP implicitly trusts routes that other autonomous systems provide it, which means that, with enough spamming from an AS, any route can lead to any autonomous system. It is the most obvious way to MITM traffic, and it's not just theoretical - Defcon security convention's site was redirected to a security researcher's website in 2007 to demonstrate the attack. Youtube was down in several Asian countries when Pakistan censored the site and mistakenly declared its own (dead) route the best for several ASes outside of Pakistan.

A handful of academic groups collect BGP routing information from cooperating ASes to monitor BGP updates that change traffic paths. But without context, it can be difficult to distinguish a legitimate change from a malicious hijacking. Traffic paths change all the time to cope with natural disasters, company mergers, etc.

Next to discuss on the 'Global MITM attack vectors' list is Domain Name System (DNS).

Although ISC's Fine DNS server BIND has stood the test of time and come out relatively unscathed (as have Microsoft and Cisco's DNS offerings), a few notable vulnerabilities have been found that could potentially jeopardize all traffic using canonicalized names on the internet (i.e. practically all traffic).

I won't even bother discussing Dan Kaminsky's research into the DNS cache poisoning attack, as it has been beaten to death elsewhere, only to be awarded 'most overhyped bug ever' by Blackhat - Las Vegas. However, several other DNS bugs exist that have severely compromised internet security.

The Dynamic Update Zone Bug crashed DNS servers and had the potential to remotely compromise machines and DNS caches.

The Transaction Signatures Bug allowed for full remote root compromise of any server running BIND at the time the vulnerability was announced, obviously allowing DNS entries to be compromised.

Finally, we must discuss ARP Poisoning, 802.11q Retracing, STP-Trunk Hijacking, RIPv1 routing information injection and the slew of attacks for OSPF networks.

These attacks are the 'familiars' to a network admin for an independent company (rightfully so, considering these may be the only ones they have control over). Discussing the technical details of each of these attacks is slightly boring at this stage, as everyone who is familiar with basic information security or TCP has learned ARP Poisoning. The other attacks are likely a familiar face to many network admins or server security aficionados. If these are your concern, there are plenty of very good network defense utilities that exist, ranging from Free and Open Source utilities like Snort to the enterprise level software from Cisco and HP. Alternatively, many informative books cover these topics, too numerous to discuss, but several I've found helpful in the pursuit of network security include The Tao of Network Security Monitoring, Network Security Architectures, and the classic Network Warrior

In any case, I find it somewhat disturbing that people assume that these sort of attacks require ISP or Government level access. They require no more than the average CCIE has in networking knowledge and the appropriate tools (i.e. HPING and Netcat, not exactly theoretical tools). Stay vigilant if you want to stay secure.

share|improve this answer
Sure it is. You think that you're going to bank.example.com, and instead you're going to some other site that is proxying or masquerading as your intended destination. If you don't think that is a MITM attack, you don't understand what MITM is. –  duffbeer703 Jun 21 '10 at 1:55
Well, As far as DNS is concerned, semi-obviously you could just send the packets to the ACTUAL IP of the site you are attempting to reach. And it is possible to do things like rapidly switch between the connect and active states for BGP whilst sending out the REAL BGP routes. Or, if like most of the internet, There exists an alternate route to your host besides the route you poisoned, you could specify that as a routing parameter. However, Its great that you are interested in this Craig, Security is quite a field, when you think you've got something sorted, something else pops up. –  zv_ Jun 21 '10 at 4:30
To answer your other question about DNS issues, I think you might be missing how the steps work. The attacker knows the proper destination and acts as a proxy for you. You think you're talking to C, when in reality traffic flows A<->B<->C, not the A<->C you think it is. YOUR routing information is compromised. The attacker has the correct data, or is using a DNS server that isn't compromised. –  Bart Silverstrim Jun 21 '10 at 9:55
@Craig-You're missing the picture. MITM involves inserting an agent between your target and their destination. Whether it's routing or DNS or whatever else you want; these attacks aren't like movies where you tap a button marked MITM and crack the code. It's a means to an end, and is part of a blended attack. –  Bart Silverstrim Jun 21 '10 at 11:35
And I answered your question about packets getting to the proper destination. The attacker system knows the proper route. It's telling your system that it's the "correct" site, then forwards them like a proxy, sending your requests on your behalf, then replies back. That's the whole "in the middle" part. YOUR machine is duped and doesn't know what's going on. It's like an in-joke that your system is left out of the loop on. –  Bart Silverstrim Jun 21 '10 at 11:37

Here's one MITM scenario that concerns me:

Let's say there's a big convention at a hotel. ACME Anvils and Terrific TNT are major competitors in the cartoon danger industry. Someone with a vested interest in their products, especially new ones in development, would seriously love to get his paws on their plans. We'll call him WC to protect his privacy.

WC checks in at Famous Hotel early in order to give him some time to set up. He discovers that the hotel has wifi access points called FamousHotel-1 through FamousHotel-5. So he sets up an access point and calls it FamousHotel-6 so it blends in to the landscape and bridges it to one of the other APs.

Now, the conventioneers start to check in. It just so happens that one of the biggest customers of both companies, we'll call him RR, checks in and gets a room near WC's. He sets up his laptop and starts exchanging emails with his suppliers.

WC is cackling maniacally! "My devious plan is working!", he exclaims. BOOM! CRASH! Simultaneously, he's hit by an anvil and a bundle of TNT. It seems the security teams of ACME Anvils, Terrific TNT, RR and Famous Hotel were working together anticipating this very attack.

Beep beep!


How timely*: Travel tip: Beware of airport wi-fi "honeypots"

* Well, it was timely that it just showed up in my RSS feed.

share|improve this answer
OK, but isn't wireless a whole different ball game? Perhaps I should have confined my question to wired connections. –  CJ7 Jun 20 '10 at 14:53
@Craig: The point is the same. It's most likely that someone is on your local network listening, wireless or wired. Finding a MitM on the Internet basically isn't going to happen. –  Chris S Jun 20 '10 at 14:59
+1 for ACME Anvils and Terrific TNT –  fahadsadah Jun 20 '10 at 16:05
@Chris: How is someone going to be on my local network if there is no wireless access point? Malware on one of the machines? If so, how is the data going to be sent out of the network to the hacker? –  CJ7 Jun 20 '10 at 23:44
@Craig: You're absolutely right, MITM attacks don't exist. Don't worry about it, we're just a bunch of paranoid nerds hiding from the NSA. –  duffbeer703 Jun 21 '10 at 18:11

It's entirely dependent on the situation. How much do you trust your ISP? How much do you know about your ISP's configuration? And how secure is your own setup?

Most "attacks" like this now are very likely with trojan malware intercepting keystrokes and passwords from files. Happens all the time, just that it doesn't get noticed or reported so much.

And how often does information get leaked inside the ISP level? When I worked for a small ISP, we were reselling another higher tier of access. So a person that dialed into us came into our network, and if you weren't talking to our web server or mail server, traffic went to a higher tier provider, and we have no idea who did what with your data in their network, or how trustworthy their admins were.

If you want to know how many spots someone could "potentially" see your traffic do a traceroute and you'll see as much as will respond at each routing point. That's assuming cloaked devices aren't in between some of those. And that those devices are each actually routers and not something masquerading as routers.

The thing is that you can't know how prevalent the attacks are. There aren't any regulations saying companies have to disclose attacks that are discovered unless your credit information is compromised. Most companies don't because it's embarrassing (or too much work). With the amount of malware floating out there, it's probably far more prevalent than you'd think, and even then the key is to have discovered the attack. When the malware works properly, most users wouldn't know when it happens. And the actual person-who-gets-miffed-and-snoops-traffic-at-a-provider scenario are the ones that companies don't report unless they have to.

Of course these ignore the scenarios where companies are compelled to keep records of your traffic and disclose them to government agencies without telling you. If you're in the US, thanks to the Patriot Act, libraries and ISP's can be compelled to record your data travels and emails and browsing history without telling you that they're collecting information on you.

In other words, there is no hard data on how prevalent MITM and interception attacks are on users, but there's evidence that would suggest it's higher than would be comfortable, and most users don't care enough to get that information.

share|improve this answer

The real question is "how much of my limited resourcing should I devote to MITM attacks instead of elsewhere?"

This depends a lot of the nature of the communications involved, and has no single answer. In my experience it's not a big risk relative to other security risks, but it's usually a cheap one to minimize (e.g.: an SSL certificate and and use HTTPS is often enough) so it is cheaper to fix than spend the time evaluating how much of a risk it could be.

share|improve this answer

Do you have a wireless access point at home? A proxy server at work?

Either of those ingress/egress points can be compromised without some vast government/isp conspiracy. It's also possible for components of an ISPs infrastructure to be compromised.

Do you use a web browser? It's pretty trivial to configure a browser to direct traffic to a man in the middle. There has been browser malware that re-routed certain banking and brokerage transactions using this method, particularly for small businesses with wire privileges.

Security is about risk management... there are two basic attributes to how you approach dealing with a risk: probability of occurrence and impact. The actual probability of you getting into a serious car accident is very low, but the impact to your personal safety is high, so you buckle your seatbelt and put your infant in a car seat.

When people get lazy and/or cheap, disaster is often the result. In the Gulf of Mexico, BP ignored all sorts of risk factors because they believed that they transferred risk to contractors, and figured that they had drilled enough wells without incident, so the probability of an incident was very low.

share|improve this answer
Wish I could upvote this > 1. I have no problem with people taking these kinds of calculated risks with their own data, but disregarding things like MITM when others' data is on the line -- be it customers, patients, or whatever -- is lamentable (and far too common). You can't be expected to anticipate every attack vector or scenario, but a layered, defense-in-depth approach to mitigation and risk management is essential. –  nedm Jun 21 '10 at 6:29

MitM attacks are pretty much exclusively encountered in the local network. Tapping into a connection across the internet requires either ISP or Government level access - and it's very rare that anyone with that level of resources is going after your data.

Once someone gets into your network, then you've got serious problems, but outside of that, you're probably fine.

share|improve this answer
Not true. Look at zypher's post. –  duffbeer703 Jun 21 '10 at 1:57
@duffbeer: see my comments to zephyr's post –  CJ7 Jun 21 '10 at 3:12
MITM is anything inserted between the source and destination. It can be local network, or at the ISP, anywhere in between. How do you know that someone at your destination or at the transport doesn't want your information? There are police who have abused their information to stalk people. Common? No. But do you really know who has or hasn't abused their power and was never discovered? –  Bart Silverstrim Jun 21 '10 at 10:28

@Craig: In your edit you have some misinformation. Wireless networking is not broadcast based. The data being transmitted in a wireless communication session (between wireless client and wireless access point) is not "broadcast" for everyone to hear. The wireless client associates with the AP and communication occurs between said client and AP. If you meant that the data is being broadcast because it's encapsulated in a radio signal that is "broadcasted", then yes it can be sniffed with very specific wireless equipment (RMON capable wireless adapters) and software tools. Wireless clients that haven't associated with the same AP have no mechanism to intercept or "hear" the wireless traffic except with the aforementioned equipment. Wireless communications in TCP\IP networks works essentially the same as for wired networks except for the transmission media: radio waves as opposed to physical wires. If WiFi traffic was broadcast for everyone to eavesdrop on it would have never left the drawing board.

That being said, I think that wireless networks pose a greater risk to MITM attacks because physical access is not required to access the wireless network to "inject" a rogue system in order to intercept the traffic.

share|improve this answer
you said that wireless radio signals are broadcast and can be intercepted by equipment. How does my question contradict this? –  CJ7 Jun 21 '10 at 4:10
You said that wireless traffic was broadcast for everyone to hear, which is not technically correct. The radio signal is broadcast in the sense that it's radio wave based, but the communication is point to point between the wireless client and the wireless AP. The wireless client does not broadcast it's traffic for all to hear. The statement that the traffic is broadcast for all to hear may give someone the impression that wireless networking works in a way in which it doesn't. –  joeqwerty Jun 21 '10 at 10:54
The broadcast issue with respect to modern 802.11 wireless is somewhat moot in that the transport layer is protected by some form of WPA encryption in most cases. Your wired traffic is protected by its physical location and the lock on your wiring closet. In most environments that I have worked in, the client networks where switch and wiring infrastructure are easily available are treated as untrusted networks. –  duffbeer703 Jun 21 '10 at 18:24

Your Answer


