Man-in-the-middle attacks in Computer Networks - Step-by-Step Execution

Concept Flow - Man-in-the-middle attacks

User sends message

↓

Attacker intercepts message

↓

Attacker reads or alters message

↓

Attacker forwards message to receiver

↓

Receiver gets altered message

↓

Receiver replies

↓

Attacker intercepts reply

↓

Attacker reads or alters reply

↓

Attacker forwards reply to user

This flow shows how an attacker secretly intercepts and changes messages between two parties without their knowledge.

Execution Sample

Computer Networks

User -> Attacker -> Receiver
Receiver -> Attacker -> User

Shows the message path being intercepted and forwarded by the attacker.

Analysis Table

Step	Action	Message Content	Who Has It	Effect
1	User sends message	Hello	User -> Attacker	Message intercepted
2	Attacker reads message	Hello	Attacker	Attacker sees original message
3	Attacker alters message	Hello, please send money	Attacker	Message changed
4	Attacker forwards message	Hello, please send money	Attacker -> Receiver	Receiver gets fake message
5	Receiver replies	Okay, sending money	Receiver -> Attacker	Reply intercepted
6	Attacker reads reply	Okay, sending money	Attacker	Attacker sees reply
7	Attacker alters reply	Okay, sending money tomorrow	Attacker	Reply changed
8	Attacker forwards reply	Okay, sending money tomorrow	Attacker -> User	User gets fake reply
9	End	N/A	N/A	Communication compromised

💡 Attack ends when attacker finishes intercepting and forwarding messages without detection.

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6	After Step 7	Final
Message Content	Hello	Hello	Hello, please send money	Hello, please send money	Okay, sending money	Okay, sending money tomorrow	Okay, sending money tomorrow
Holder	User	Attacker	Attacker	Receiver	Attacker	Attacker	User

Key Insights - 3 Insights

Why does the receiver not know the message was altered?

Because the attacker forwards the changed message as if it came directly from the user, hiding their presence (see execution_table step 4).

How can the attacker read the messages if they are supposed to be private?

The attacker intercepts the messages before they reach the receiver, so they see the message in transit (see execution_table step 2 and 6).

Why does the user trust the altered reply from the attacker?

Because the attacker forwards the reply pretending to be the receiver, so the user thinks it is genuine (see execution_table step 8).

Visual Quiz - 3 Questions

Look at the execution table, what is the message content after step 3?

A "Okay, sending money"

B "Hello"

C "Hello, please send money"

D "Okay, sending money tomorrow"

💡 Hint

Check the 'Message Content' column at step 3 in the execution_table.

At which step does the attacker first alter a message?

A Step 2

B Step 3

C Step 5

D Step 7

💡 Hint

Look for the first 'Action' mentioning altering message in the execution_table.

If the attacker did not forward the altered message at step 4, what would happen?

A Receiver would get no message

B User would get the reply early

C Receiver would get the original message

D Attacker would lose the message

💡 Hint

Consider the flow in concept_flow and what happens if forwarding stops.

Concept Snapshot

Man-in-the-middle attack:
- Attacker secretly intercepts communication
- Reads or changes messages before forwarding
- Both parties think they communicate directly
- Leads to data theft or misinformation
- Protection needs encryption and authentication

Full Transcript

A man-in-the-middle attack happens when an attacker secretly intercepts messages between two people communicating. The attacker reads or changes the messages and then forwards them, so both people think they are talking directly. This can cause stolen information or false messages. The attacker acts like a hidden middleman. The attack ends when the attacker stops intercepting messages. To prevent this, secure methods like encryption and verifying identities are needed.