# Topic 5: Man-in-the-Middle (MitM) Attacks A **Man-in-the-Middle (MitM)** attack occurs when a threat actor secretly intercepts, relays, and potentially alters the communication between two parties who believe they are communicating directly with each other. ![[image-6 2.png|400]] --- ## How MitM Attacks Work In a development environment, MitM attacks typically exploit unencrypted channels or weak network security: ### 1. Packet Sniffing / Eavesdropping * **The Attack**: Attackers use software (like Wireshark) on a shared network to capture data packets traveling through the air or cables. * **The Risk**: If the traffic is unencrypted (e.g., HTTP, FTP, Telnet), the attacker can read usernames, passwords, API keys, and database queries in cleartext. ![[image-7 1.png|271]] ### 2. Session Hijacking * **The Attack**: Once an attacker intercepts an authentication token or session cookie, they copy it and insert it into their own browser. * **The Risk**: The attacker can impersonate the developer and gain full access to the cloud environment or code repository without knowing the password. ![[image-8 1.png|251]] ### 3. DNS Spoofing / Cache Poisoning * **The Attack**: The attacker alters DNS records so that when a developer types `github.com` or their company's API domain, they are redirected to a fake website controlled by the attacker. * **The Risk**: The developer unknowingly uploads code or logs in to a malicious server, leaking credentials. --- ## ⚠️ Risks to Developers & Staging Environments Developers are highly vulnerable to MitM attacks because: * **Testing with HTTP**: To save the effort of setting up SSL certificates in local/staging environments, developers often test APIs and database connections over unencrypted **HTTP** instead of secure **HTTPS**. * **Remote Work**: Developers working from cafes, airports, or hotels on unencrypted public Wi-Fi networks expose their web traffic to local interceptors. * **Unverified Package Downloads**: If dependencies are downloaded over unsecure connections, a MitM attacker can swap out a legitimate library with a malicious one (Trojan). --- ## Real-World Case Scenario > [!EXAMPLE] > **The Coffee Shop Intercept**: A mobile app developer is sitting in a cafe, working on an update. They connect to "Free Cafe Wi-Fi". > > To test the login feature, the developer logs in to the staging server. Because it is a test server, the developer has configured the app to use `http://staging.myapp.com` (unencrypted) rather than `https://`. > > An attacker sitting nearby runs a packet sniffer. Because the traffic is unencrypted, the attacker intercepts the developer's session token and database password in cleartext, subsequently downloading the entire user database from the staging server. --- ## Mitigation Strategies & Controls Protecting data in transit requires strict adherence to encryption protocols: ### Software Controls (Technical) * **Transport Layer Security (TLS/HTTPS)**: Enforce HTTPS for *all* environments (including local development and staging). Never transmit data in cleartext. * **Virtual Private Networks (VPNs)**: Mandate that developers connect to a secure corporate VPN whenever they work remotely. The VPN encrypts all internet traffic from the device to the company network. * **HTTP Strict Transport Security (HSTS)**: Configure web servers to instruct browsers to *only* interact with the site using secure HTTPS connections. * **Certificate Pinning**: Hardcode the destination server's digital certificate within a mobile app so it rejects any connection attempting to use a spoofed certificate. ### Administrative Controls (Organisational) * **Remote Work Policy**: Prohibit developers from working on public Wi-Fi without a running corporate VPN. * **Network Security Audits**: Regularly audit office Wi-Fi routers, ensuring strong WPA3 encryption is enforced. --- ## VCE Exam Practice ### Scenario An administrator at *SecurApp* notices that test database credentials have been compromised. Investigation reveals that a remote developer was testing database API queries from a hotel Wi-Fi network. The developer had disabled TLS certificate checks in their testing tool to bypass a "certificate expired" warning on the staging API server. ### Questions 1. **Identify** the type of cyber attack that occurred in this scenario. *(1 mark)* 2. **Explain** how disabling TLS certificate checks allowed the attacker to capture the database credentials. *(2 marks)* 3. **Propose and justify** one software control that could prevent this specific attack for remote workers. *(3 marks)* --- > [!NOTE] > **Suggested Answers:** > 1. *Man-in-the-Middle (MitM) attack.* > 2. *TLS certificate checks verify that the server is who it claims to be. By disabling this verification, the developer's client app accepted any connection, allowing an attacker to intercept the connection, pretend to be the staging server, and capture the credentials in cleartext.* > 3. *Implement a Corporate VPN. A VPN creates a secure, encrypted tunnel for all traffic from the developer's laptop to the corporate network. Even if an attacker intercepts the traffic on the hotel Wi-Fi, they will only see encrypted data, rendering the MitM attempt useless.*