Glossary · simply explained

Man-in-the-middle attack (MitM)

In a MitM attack the attacker sits unnoticed between two parties — reading along or manipulating the communication.

In a man-in-the-middle attack (MitM, also on-path attack) the attacker inserts themselves unnoticed between two communication partners: both believe they are talking directly, while everything actually flows through the attacker — who can read, record or deliberately alter it.

Entry points are manifold: manipulated Wi-Fi, poisoned name resolution (ARP or DNS spoofing), compromised routers — or forged certificates when users click warnings away.

How MitM attacks work

On the local network ARP spoofing often suffices: the attacker poses as the gateway and all traffic flows through their device. In open Wi-Fi a malicious hotspot takes the same role. At internet level, DNS manipulation leads victims to look-alike servers without the address bar looking suspicious.

The defence is primarily cryptographic: end-to-end TLS makes eavesdropping worthless and manipulation detectable — provided certificate warnings are taken seriously. DNSSEC secures name resolution, encrypted DNS (DoH/DoT) the path to it; Zero Trust access replaces trust in the local network altogether.

Typical MitM scenarios

Evil twin: fake Wi-Fi hotspot with a familiar name.
ARP spoofing in the LAN: attacker plays gateway.
DNS spoofing: manipulated resolution leads to look-alike services.
TLS downgrade and certificate tricks against careless clients.

Frequently asked questions about Man-in-the-middle attack (MitM)

Does HTTPS reliably protect against MitM?

Largely yes — as long as certificate validation stays intact: the attacker can redirect traffic but cannot present a valid certificate for the real domain. It gets critical when users click away warnings or devices have foreign root certificates installed.

How risky is public Wi-Fi today?

Considerably defused, because almost all traffic is TLS-encrypted — eavesdropping yields hardly any plaintext. Residual risks are fake portals and downgrade tricks. For sensitive work, use ZTNA or VPN in addition and avoid logins via unknown captive portals.

What is ARP spoofing?

An attack on the local network: the attacker answers address queries with their own hardware address and thus poses as the gateway — all victims’ traffic flows through them. Countermeasures are switch protection features and the principle of not trusting the LAN blindly.

Does Zero Trust help against MitM?

Yes, structurally: Zero Trust treats every network as insecure — access runs via authenticated, end-to-end encrypted tunnels with device checks. Whether someone is listening along the way becomes largely irrelevant; the local network loses its trust bonus.

What does DNSSEC have to do with MitM?

Manipulated name resolution is a main entry: whoever forges the answer steers victims to their own servers. DNSSEC makes such forgeries cryptographically detectable; encrypted DNS additionally protects the transport of the queries.