Man-in-the-middle attacks in Cybersecurity - Step-by-Step Execution

Concept Flow - Man-in-the-middle attacks

User sends message

↓

Attacker intercepts message

↓

Attacker reads or alters message

↓

Attacker forwards message to receiver

↓

Receiver gets message, unaware of attack

The flow shows how an attacker secretly intercepts and possibly changes messages between two parties without their knowledge.

Execution Sample

Cybersecurity

User -> Attacker -> Receiver
Attacker intercepts and modifies message
Receiver receives altered message

This shows the path of a message being intercepted and changed by an attacker before reaching the receiver.

Analysis Table

Step	Action	Message Content	Attacker's Role	Receiver's View
1	User sends message	"Hello"	No action yet	No message received
2	Attacker intercepts message	Hello	Intercepts original message	No message received
3	Attacker modifies message	"Hello, friend"	Changes message content	No message received
4	Attacker forwards message	"Hello, friend"	Sends altered message	Receives "Hello, friend"
5	Receiver replies	"Hi!"	No action	No reply sent to user yet
6	Attacker reads reply	"Hi!"	Reads reply	No reply sent to user yet
7	Attacker forwards reply	"Hi!"	Sends reply to user	Message delivered
8	User receives reply	"Hi!"	No action	Receives reply

💡 Communication ends with both parties unaware of the attacker’s presence.

State Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 7	Final
Message Content	Hello	Hello	Hello, friend	Hello, friend	Hi!	Hi!
Attacker Role	null	Intercepts	Modifies	Forwards	Forwards	null
Receiver View	No message	No message	No message	Hello, friend	Hello, friend	Hi!

Key Insights - 3 Insights

Why does the receiver not know the message was changed?

Because the attacker forwards the altered message as if it came directly from the user, shown in step 4 of the execution_table.

How can the attacker read the reply without the user noticing?

The attacker intercepts and reads the reply before forwarding it to the user, as shown in steps 5 to 7 in the execution_table.

Is the user aware of the attacker’s presence during communication?

No, the user receives messages normally without knowing they were intercepted, as shown in step 8.

Visual Quiz - 3 Questions

Look at the execution_table, what message content does the receiver get at step 4?

A "Hello"

B "Hello, friend"

C "Hi!"

D "Hello, attacker"

💡 Hint

Check the 'Receiver's View' column at step 4 in the execution_table.

At which step does the attacker modify the message?

A Step 2

B Step 5

C Step 3

D Step 7

💡 Hint

Look at the 'Attacker's Role' and 'Action' columns in the execution_table.

If the attacker did not forward the reply to the user, what would happen?

A User would not get any reply

B User would receive the reply anyway

C Receiver would get the reply twice

D Attacker would be detected immediately

💡 Hint

Refer to the flow of messages in the execution_table steps 5 to 8.

Concept Snapshot

Man-in-the-middle attack:
- Attacker secretly intercepts communication
- Can read or change messages
- Both parties unaware of attacker
- Messages pass through attacker
- Common in unsecured networks

Full Transcript

A man-in-the-middle attack happens when an attacker secretly intercepts messages between two people communicating. The attacker can read or change the messages before sending them on. The user and receiver think they are talking directly, but the attacker is in the middle. This attack works because the attacker forwards messages so both sides do not notice anything wrong. The attacker can also intercept replies and forward them. This makes the communication unsafe without either party knowing.

Practice

1. What is a man-in-the-middle attack in cybersecurity?

easy

A. An attack where someone secretly intercepts and possibly alters communication between two parties

B. An attack that deletes all data on a computer remotely

C. An attack that floods a website with traffic to make it unavailable

D. An attack that steals passwords by guessing them repeatedly

Solution

1. Step 1: Understand the definition of man-in-the-middle attack

   This attack involves an attacker secretly intercepting communication between two parties without their knowledge.

2. Step 2: Compare options with the definition

   Only An attack where someone secretly intercepts and possibly alters communication between two parties describes interception and possible alteration of communication, matching the definition.

3. Final Answer:

   An attack where someone secretly intercepts and possibly alters communication between two parties -> Option A

4. Quick Check:

   Man-in-the-middle = secret interception [OK]

Hint: Look for secret interception of communication [OK]

Common Mistakes:

• Confusing with denial-of-service attacks
• Thinking it only steals passwords
• Assuming it deletes data

2. Which of the following is a common way attackers perform man-in-the-middle attacks?

easy

A. Encrypting emails

B. Using a public Wi-Fi network without encryption

C. Using a strong password

D. Installing antivirus software

Solution

1. Step 1: Identify common environments for man-in-the-middle attacks

   Attackers often exploit unsecured public Wi-Fi networks where data is not encrypted.

2. Step 2: Evaluate options for vulnerability

   Only Using a public Wi-Fi network without encryption describes an insecure environment that attackers can exploit; others are protective measures.

3. Final Answer:

   Using a public Wi-Fi network without encryption -> Option B

4. Quick Check:

   Unsecured Wi-Fi = risk of man-in-the-middle [OK]

Hint: Unsecured public Wi-Fi is risky for interception [OK]

Common Mistakes:

• Thinking antivirus causes attacks
• Confusing strong passwords with attack methods
• Assuming encryption enables attacks

3. Consider this scenario: Alice sends a message to Bob over an unsecured Wi-Fi. Eve intercepts and changes the message before Bob receives it. What type of attack is this?

medium

A. Man-in-the-middle attack

B. Phishing attack

C. Ransomware attack

D. Brute force attack

Solution

1. Step 1: Analyze the scenario details

   Alice's message is intercepted and altered by Eve before reaching Bob, indicating secret interception and modification.

2. Step 2: Match the scenario to attack types

   Only a man-in-the-middle attack involves intercepting and changing communication between two parties.

3. Final Answer:

   Man-in-the-middle attack -> Option A

4. Quick Check:

   Intercept and alter message = man-in-the-middle [OK]

Hint: Intercepted and changed message means man-in-the-middle [OK]

Common Mistakes:

• Confusing with phishing which tricks users
• Thinking ransomware encrypts messages
• Mixing with brute force password guessing

4. A user connects to a public Wi-Fi and suspects a man-in-the-middle attack. Which of these actions would help fix or prevent the attack?

medium

A. Share the Wi-Fi password with others

B. Disable firewall on the device

C. Use a VPN to encrypt the connection

D. Turn off automatic software updates

Solution

1. Step 1: Identify protective measures against man-in-the-middle attacks

   Using a VPN encrypts data, preventing attackers from reading or altering communication.

2. Step 2: Evaluate each option's effect

   Only using a VPN (Use a VPN to encrypt the connection) helps prevent the attack; disabling firewall or sharing passwords increases risk.

3. Final Answer:

   Use a VPN to encrypt the connection -> Option C

4. Quick Check:

   VPN encrypts data = protection [OK]

Hint: VPN encrypts data, stopping interception [OK]

Common Mistakes:

• Disabling firewall weakens security
• Sharing passwords increases risk
• Ignoring software updates reduces protection

5. You are designing a secure messaging app. Which combination of features best protects users from man-in-the-middle attacks?

hard

A. Disable HTTPS to speed up connections

B. Allow messages to be stored unencrypted on the server for faster access

C. Use only password protection without encryption

D. Use end-to-end encryption and verify user identities with digital certificates

Solution

1. Step 1: Identify features that prevent man-in-the-middle attacks

   End-to-end encryption ensures only sender and receiver can read messages. Digital certificates verify identities to prevent impersonation.

2. Step 2: Evaluate options for security

   Use end-to-end encryption and verify user identities with digital certificates combines encryption and identity verification, effectively preventing interception and tampering.

3. Final Answer:

   Use end-to-end encryption and verify user identities with digital certificates -> Option D

4. Quick Check:

   Encryption + identity verification = strong defense [OK]

Hint: Encryption plus identity checks stops interception [OK]

Common Mistakes:

• Storing unencrypted messages risks exposure
• Passwords alone don't prevent interception
• Disabling HTTPS removes encryption