How to Protect Against Man-In-The-Middle Attacks

This article was contributed to us by TechWarn. This article may not necessarily reflect the views of CGS Investments, LLC.

---

As the name indicates, a man-in-the-middle attack refers to a cyber attack where the hacker intercepts communications between two systems.

Consider sending a letter via mail. However, before the letter arrives at its intended location, a nosy neighbor picks it up and proceeds to read it. The neighbor, now in possession of the letter, could reply to it without the knowledge of the intended recipient, change its content and deliver it or even pretend like the letter never existed. The final decision lies with the nosy neighbor, and unless the sender and intended recipient come together to discuss the letter, the actions of the nosy neighbor could go unnoticed. Such is the case with man-in-the-middle attacks.

However, unlike the example above, it is possible to prevent such occurrences from happening altogether as explained in this article. For the sake of simplification, the solutions are grouped with the types of man-in-the-middle attacks that they are most effective against.

Email Hijacking

Email hijacking is the man-in-the-middle attack that is closest to the example given. It involves the interception, manipulations, and redirection of emails by hackers.

Depending on the motives of the hacker, such an attack could target individuals and organizations with similar ease. Some of the solutions to prevent against email hijacking include:

Implement End-to-End Encryption

End-to-end encryption encrypts all the mail data using a key that is unavailable to the email server.

In email hijacking, hackers usually target either the sender’s or recipient’s email server and intercept the message before it is sent or delivered. In such a case, standard encryption where the encryption key is also accessible to the email server is ineffective.

End-to-end encryption, on the other hand, encrypts the data but provides a separate key unaffiliated with the server. As such, every client/recipient obtains a different encryption key which makes it impossible for large scale mail intercepts.

Protect Administrator Accounts

Having end-to-end encryption is futile if the admin account is compromised since the hacker could get the encryption key using admin access.

Protecting the admin account, therefore, is akin to securing the encryption key. The steps necessary for safeguarding an admin account include employing the use of two-factor authentication, device encryption, limiting the number of admin accounts to 1 per network device, among others.

HTTP Interception

HTTP interception is a man-in-the-middle attack where the hacker intercepts all communication through a particular website.

Such an attack allows the hacker to intercept a large amount of information since they have access to the entire website. Some of the solutions to prevent against HTTP interception include:

Install SSL/TLS Certificates

HTTP interception is made possible by the fact that the HTTP protocol is unprotected and therefore, vulnerable.

To protect websites using the HTTP protocol, you should install an SSL/TLS certificate, which secures the site by activating the secure HTTPS protocol. A TLS certificate encrypts the connection between the site’s server and the client’s computer, thereby protecting against hacking and interception.

Use HSTS

Despite your intention to connect to a site using the secure HTTPS protocol, a hacker could still force your browser to link to a website using the unsecured HTTP protocol.

HTTP Strict Transport Security (HSTS) is a security mechanism which ensures that all connections must run through an HTTPS encrypted server, disregarding all unencrypted connections.

Server and System Configuration

Even with HTTPS and HSTS, you still need to do a complete overhaul of your system for more comprehensive security against man-in-the-middle attacks.

Proper configuration is what guarantees the adequate utilization of both HTTPS and HSTS. You should look out for mixed content – content that is still configured for HTTP on an HTTPS configured server – since it could lead to the creation of a backdoor. Other things you should check include the link formats, login forms, and proper server configurations.

Must-Have Security Options

The security solutions mentioned above all serve to protect against specific vulnerabilities associated with some man-in-the-middle types of attack and not others. Although you need specific security solutions, you also need security options that provide protection regardless of the attack. Such include:

Tor Over VPN

VPNs are optimized for privacy and security, which is why data is hidden behind layers of encryption and assigned a different IP address.

Tor is designed to enable anonymous communication. Merging the two while using Tor over VPN provides you with an overlay of their functions, fortifies their strengths and covers their shortcomings.

An Antivirus

Hackers rely on malware to execute their attacks, and man-in-the-middle attacks are no exception. Therefore, having an antivirus, which is designed to protect against malware, gives you the upper hand.

Aside from device protection, the ideal antivirus should also provide network security, which coupled with VPN and Tor further strengthens your network security.

The Upshot

What you need most to protect against man-in-the-middle attacks are knowledge and information. That is precisely why this article is an invaluable resource.

Even so, this article still only covers a small scope of the entire subject matter. You need more research into the types of man-in-the-middle attacks, vulnerabilities that make such attacks possible, techniques used, the security options available to you and how to make the best use of them.