10 Types of Man-in-the-Middle Attacks & How to Avoid Them

Man-in-the-middle (MiTM) attacks happen when malicious users intercept and spoof the communications between two endpoints. While not as common as phishing or ransomware, as much as 35% of attacks are related to exploitation via MiTM.

In a mobile application context, such an attack is usually the result of intercepting communications between the mobile app and a server, often by impersonating the server, or intercepting the requests to a server. Though MiTM attacks are well known and relatively easy to execute, they are also preventable with proper security best practices in place that focus on secure communications.

Mobile app developers can avoid these attacks by implementing code hardening, Runtime Application Self Protection (RASP) and other security measures we’ll detail later which deter insecure communication. For example, adding additional layers of protection to SSL pinning implementations can improve your security posture. While these measures cannot correct faulty SSL configuration, they ensure the certificate checks can’t be removed or tampered with, preventing bad actors from analyzing network traffic through MITM attacks.

Let’s explore a comprehensive list of MiTM attacks, and cover how mobile app developers can take the right precautions to prevent these attacks from occurring.

Exploring 10 Types of MiTM Attacks

MiTM attacks can happen in a number of ways. Typically, an attacker inserts themselves into the middle of an online communication or data transaction. By distributing malware, the attacker is able to gain easy access to a mobile application. Here’s how some common types of MiTM attacks are executed, and how they can impact users.

1. Wi-Fi Eavesdropping: Attackers set up unsecured Wi-Fi hotspots in public places. When a user connects their mobile device to this network, the attacker can intercept the data transmitted between the mobile app and its server. Additionally, attackers can also use these hotspots to distribute malware to connected devices. Users may unknowingly download harmful software, thinking it is a legitimate update or application.
2. SSL Stripping: In this attack, the attacker forces a connection to downgrade from a secure HTTPS connection to an unsecured HTTP connection. This allows them to intercept data transmitted between the mobile app and the server. This technique is particularly effective because many users do not notice the absence of the 'https' in their browser's address bar. This oversight allows attackers to easily capture sensitive information like login credentials.
3. ARP Spoofing: In a local network, attackers use Address Resolution Protocol (ARP) spoofing to link their MAC address with the IP address of the victim's device, allowing them to intercept data sent from mobile apps to the network. This attack can be used to modify or halt the data before it reaches its intended destination. It's especially dangerous in corporate environments where sensitive data is regularly transmitted.
4. DNS Spoofing: The attacker corrupts the DNS (Domain Name System) entry on the network, leading the mobile app to connect to a fraudulent server controlled by the attacker, instead of the legitimate server. Such attacks can redirect users to phishing websites, where attackers collect sensitive information like usernames and passwords. Users believe they are accessing legitimate sites because the URL appears correct.
5. Fake Cell Towers (IMSI Catchers): These devices mimic legitimate cell towers, tricking mobile phones into connecting to them. Once connected, the attacker can intercept mobile data and calls. While not an imminent mobile app security concern, these devices can also be used to track a user's location or eavesdrop on conversations and text messages, posing significant privacy and security threats.
6. Sidejacking (Session Hijacking): Here, the attacker intercepts the session cookies that mobile apps use for maintaining the session with the server. With access to these cookies, attackers can impersonate the user. The attacker gains access to protected areas of websites or mobile applications, posing a serious threat to online privacy and security, especially on unsecured Wi-Fi networks.
7. Man-in-the-Device (MitD) Attacks: In this scenario, malware installed on the device acts as the 'man in the middle,' intercepting data before it's encrypted (or after it's decrypted) by legitimate apps. This type of attack is particularly insidious. It can bypass many traditional security measures, and can be hard to detect since the malware operates within a trusted environment.
8. Proxy Apps (or Mobile App-in-the-Middle): These are malicious mobile applications that masquerade as legitimate apps but route all data through an attacker-controlled server. Often distributed through a phishing attack, these apps can also gather extensive personal data from the user’s device, including contacts, messages, and location, further compromising privacy and security.
9. SIM Swap Attacks: Here, the attacker tricks the mobile carrier into transferring the victim's phone number to a SIM card they control. This can intercept SMS messages and bypass SMS-based two-factor authentication. Attackers can also access the victim's online accounts, as they often receive password reset codes via SMS, enabling identity theft and financial fraud.
10. VPN Man-in-the-Middle: Compromised or malicious VPN apps on mobile devices can intercept all traffic routed through them. Such VPNs can also sell user data to third parties, including browsing habits and personal information, which can pose a significant risk to user privacy and security.

While there are other types of MiTM attacks, this comprehensive list is representative of the threats to mobile users. Many of these MiTM attacks can be mitigated by implementing strong security protections, which we’ll detail in the next section.

How developers can mitigate MiTM attacks on their apps

To effectively mitigate Man-in-the-Middle (MiTM) attacks on applications, developers should adopt a comprehensive and proactive approach to mobile application security, including the following measures:

• Regular Security Audits and Real-time Threat Monitoring: Implementing regular security audits helps in identifying vulnerabilities early. Real-time threat monitoring further ensures that any unusual activities are detected and addressed promptly, enhancing the app's resilience against MiTM attacks. These practices allow developers to stay ahead of evolving threats and adapt their security measures accordingly.
• Strong Encryption Use: Employing robust encryption protocols for data transmission is crucial. This not only secures data in transit but also makes it exceedingly difficult for attackers to intercept and decipher the information. Strong encryption acts as a fundamental barrier, deterring attackers by increasing the complexity and effort required for successful interception. To optimize effectiveness, encryption must be applied in various layers. Top encryption techniques include string encryption, class encryption, asset encryption and resource encryption.
• Code Obfuscation for SSL Pinning: Protecting SSL pinning implementations through code obfuscation adds an extra layer of security. This technique makes it harder for attackers to analyze and exploit the app's code, safeguarding against MiTM attacks. Obfuscation complicates the reverse engineering process, protecting against attackers who attempt to undermine SSL pinning mechanisms. More generally speaking, obfuscation techniques such as name obfuscation, control flow obfuscation, and arithmetic obfuscation can harden code and protect applications from bad actors.
• Addressing Library Code Issues: Regularly updating and auditing the libraries used in the app is essential. Developers should patch any known vulnerabilities in library code, as these can be exploited in MiTM attacks. Keeping libraries up-to-date minimizes the risk of using outdated code that may contain unpatched security flaws.
• RASP: Integrating RASP can effectively prevent hooking, jailbreaking, and other device tampering methods. This proactive defense mechanism can identify and mitigate real-time attacks, enhancing the app's security posture. RASP provides an active defense layer, reacting to attacks as they happen and protecting the application during runtime.
• User Education: Educating users about the risks associated with using public WiFi networks is critical. Encouraging them to use additional security measures like Multi-Factor Authentication (MFA) can significantly reduce the risk of MiTM attacks. Informed users are less likely to fall prey to common attack vectors, making them an integral part of the app's overall security strategy.

Technologies like Guardsquare’s DexGuard and iXGuard can help teams seamlessly build in security best-practices at the code level, including code obfuscation, encryption and RASP. As an added layer of protection, developers can implement threat monitoring via ThreatCast to mitigate MiTM and many other types of threats. These measures build upon one another, collectively fortifying your app's defenses against bad actors.