This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.
The attacker probes to determine the nature and mechanism of communication between two components looking for opportunities to exploit.
The attacker inserts himself into the communication channel initially acting as a routing proxy between the two targeted components. The attacker may or may not have to use cryptography.
The attacker observes, filters or alters passed data of its choosing to gain access to sensitive information or to manipulate the actions of the two target components for his own purposes.
There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
An attacker can eavesdrop on the communication between the target components.
Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.
Typical Likelihood of Exploit
Likelihood: Very High
Methods of Attack
Modification of Resources
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Medium
This attack can get sophisticated since the attack may use cryptography.
The attacker can try to get the public-keys of the victims.
There are free software tool to perform man in the middle attack (packet analysis, etc.)
Solutions and Mitigations
Get your Public Key signed by a Certificate Authority
Encrypt your communication using cryptography (SSL,...)
Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
Exchange public keys using a secure channel
Modify application data
Gain privileges / assume identity
Read application data
The captured or modified data in transit
The new value of the data or the replay of the same data (e.g. credential)
The messages exchanged between the two target hosts.
Payload Activation Impact
Privilege escalation. modification of resource, information leakage, etc.
Symantec Scan Engine 126.96.36.199, and possibly other versions before 188.8.131.52, uses the same private DSA key for each installation, which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.
More information is available — Please select a different filter.
Page Last Updated or Reviewed:
July 31, 2017
Use of the Common Attack Pattern Enumeration and Classification dictionary and classification taxonomy, and the associated references from this website, are subject to the