Man-in-the-middle attacks in Computer Networks - Step-by-Step Execution

Concept Flow - Man-in-the-middle attacks

User sends message

↓

Attacker intercepts message

↓

Attacker reads or alters message

↓

Attacker forwards message to receiver

↓

Receiver gets altered message

↓

Receiver replies

↓

Attacker intercepts reply

↓

Attacker reads or alters reply

↓

Attacker forwards reply to user

This flow shows how an attacker secretly intercepts and changes messages between two parties without their knowledge.

Execution Sample

Computer Networks

User -> Attacker -> Receiver
Receiver -> Attacker -> User

Shows the message path being intercepted and forwarded by the attacker.

Analysis Table

Step	Action	Message Content	Who Has It	Effect
1	User sends message	Hello	User -> Attacker	Message intercepted
2	Attacker reads message	Hello	Attacker	Attacker sees original message
3	Attacker alters message	Hello, please send money	Attacker	Message changed
4	Attacker forwards message	Hello, please send money	Attacker -> Receiver	Receiver gets fake message
5	Receiver replies	Okay, sending money	Receiver -> Attacker	Reply intercepted
6	Attacker reads reply	Okay, sending money	Attacker	Attacker sees reply
7	Attacker alters reply	Okay, sending money tomorrow	Attacker	Reply changed
8	Attacker forwards reply	Okay, sending money tomorrow	Attacker -> User	User gets fake reply
9	End	N/A	N/A	Communication compromised

💡 Attack ends when attacker finishes intercepting and forwarding messages without detection.

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6	After Step 7	Final
Message Content	Hello	Hello	Hello, please send money	Hello, please send money	Okay, sending money	Okay, sending money tomorrow	Okay, sending money tomorrow
Holder	User	Attacker	Attacker	Receiver	Attacker	Attacker	User

Key Insights - 3 Insights

Why does the receiver not know the message was altered?

Because the attacker forwards the changed message as if it came directly from the user, hiding their presence (see execution_table step 4).

How can the attacker read the messages if they are supposed to be private?

The attacker intercepts the messages before they reach the receiver, so they see the message in transit (see execution_table step 2 and 6).

Why does the user trust the altered reply from the attacker?

Because the attacker forwards the reply pretending to be the receiver, so the user thinks it is genuine (see execution_table step 8).

Visual Quiz - 3 Questions

Look at the execution table, what is the message content after step 3?

A "Okay, sending money"

B "Hello"

C "Hello, please send money"

D "Okay, sending money tomorrow"

💡 Hint

Check the 'Message Content' column at step 3 in the execution_table.

At which step does the attacker first alter a message?

A Step 2

B Step 3

C Step 5

D Step 7

💡 Hint

Look for the first 'Action' mentioning altering message in the execution_table.

If the attacker did not forward the altered message at step 4, what would happen?

A Receiver would get no message

B User would get the reply early

C Receiver would get the original message

D Attacker would lose the message

💡 Hint

Consider the flow in concept_flow and what happens if forwarding stops.

Concept Snapshot

Man-in-the-middle attack:
- Attacker secretly intercepts communication
- Reads or changes messages before forwarding
- Both parties think they communicate directly
- Leads to data theft or misinformation
- Protection needs encryption and authentication

Full Transcript

A man-in-the-middle attack happens when an attacker secretly intercepts messages between two people communicating. The attacker reads or changes the messages and then forwards them, so both people think they are talking directly. This can cause stolen information or false messages. The attacker acts like a hidden middleman. The attack ends when the attacker stops intercepting messages. To prevent this, secure methods like encryption and verifying identities are needed.

Practice

1. What is the main goal of a man-in-the-middle attack?

easy

A. To block all incoming network traffic

B. To physically damage network hardware

C. To speed up internet connection

D. To secretly intercept and possibly alter communication between two parties

Solution

1. Step 1: Understand the definition of man-in-the-middle attack

   A man-in-the-middle attack involves an attacker secretly intercepting communication between two parties.

2. Step 2: Identify the attacker's goal

   The attacker aims to listen to or change the communication without the parties knowing.

3. Final Answer:

   To secretly intercept and possibly alter communication between two parties -> Option D

4. Quick Check:

   Man-in-the-middle = intercept communication [OK]

Hint: Think 'middle' means attacker is between two communicators [OK]

Common Mistakes:

• Confusing with physical damage to hardware
• Thinking it speeds up connection
• Assuming it blocks all traffic

2. Which of the following is a common way attackers perform a man-in-the-middle attack?

easy

A. Using a secure VPN connection

B. Installing antivirus software

C. Intercepting data on an unsecured public Wi-Fi network

D. Encrypting all communication

Solution

1. Step 1: Identify typical environments for man-in-the-middle attacks

   Attackers often exploit unsecured public Wi-Fi networks to intercept data.

2. Step 2: Evaluate each option

   Using VPN or encryption protects against attacks, antivirus does not cause them.

3. Final Answer:

   Intercepting data on an unsecured public Wi-Fi network -> Option C

4. Quick Check:

   Unsecured Wi-Fi = common attack spot [OK]

Hint: Unsecured Wi-Fi is a hotspot for interception attacks [OK]

Common Mistakes:

• Thinking VPN causes attacks
• Confusing encryption as attack method
• Assuming antivirus causes interception

3. Consider this scenario: Alice sends a message to Bob over an unsecured network. Eve intercepts and changes the message before it reaches Bob. What type of attack is this?

medium

A. Man-in-the-middle attack

B. Phishing attack

C. Denial of Service attack

D. Brute force attack

Solution

1. Step 1: Analyze the scenario details

   Alice's message is intercepted and altered by Eve before reaching Bob.

2. Step 2: Match the scenario to attack types

   Only a man-in-the-middle attack involves intercepting and changing communication secretly.

3. Final Answer:

   Man-in-the-middle attack -> Option A

4. Quick Check:

   Intercept + change message = Man-in-the-middle [OK]

Hint: Intercept + alter message = Man-in-the-middle attack [OK]

Common Mistakes:

• Confusing with denial of service which blocks access
• Mixing with phishing which tricks users
• Thinking brute force guesses passwords

4. A user connects to a public Wi-Fi without using a VPN. They notice strange behavior like altered messages and unexpected login prompts. What is the most likely cause?

medium

A. Man-in-the-middle attack

B. Hardware failure

C. Normal network delay

D. Software update

Solution

1. Step 1: Identify symptoms of the problem

   Altered messages and unexpected login prompts suggest interference in communication.

2. Step 2: Match symptoms to causes

   These signs are typical of a man-in-the-middle attack on unsecured networks.

3. Final Answer:

   Man-in-the-middle attack -> Option A

4. Quick Check:

   Altered messages + public Wi-Fi = Man-in-the-middle [OK]

Hint: Altered messages on public Wi-Fi usually mean interception [OK]

Common Mistakes:

• Blaming hardware failure without evidence
• Thinking normal delay causes message changes
• Assuming software update causes login prompts

5. Which of the following is the best way to protect yourself from man-in-the-middle attacks when using public Wi-Fi?

hard

A. Share your Wi-Fi password with others

B. Use a Virtual Private Network (VPN) to encrypt your connection

C. Disable your device's firewall

D. Turn off automatic software updates

Solution

1. Step 1: Understand protection methods against interception

   Encrypting your connection prevents attackers from reading or changing your data.

2. Step 2: Evaluate each option's effect on security

   Using a VPN encrypts traffic; disabling firewall or sharing passwords weakens security; turning off updates is unrelated.

3. Final Answer:

   Use a Virtual Private Network (VPN) to encrypt your connection -> Option B

4. Quick Check:

   VPN encrypts data = protection [OK]

Hint: VPN encrypts data, blocking interception [OK]

Common Mistakes:

• Disabling firewall reduces protection
• Sharing Wi-Fi password increases risk
• Ignoring software updates does not help