Man-in-the-middle attacks in plain English
The name says it all: the attacker secretly taps into a connection and sits right in the middle of it – hence “man in the middle,” or MitM for short. Both sides believe they are communicating directly with each other. In reality, every message passes through the attacker.
Imagine a mail carrier who secretly opens your letters, reads them, and seals them again – or swaps the contents before delivering them. Neither sender nor recipient notices a thing. That’s exactly how a man-in-the-middle attack works, just with data packets instead of letters.
The danger is greatest where data travels unencrypted or where warnings are ignored. Properly implemented encryption, on the other hand, makes intercepted data unreadable.
How a man-in-the-middle attack works
Such an attack usually unfolds in three steps:
- Getting in between: The attacker reroutes network traffic through their own device. On a corporate network, this can be done with ARP spoofing (“spoofing” means faking): the attacker sends out forged address information and thereby poses to other computers as the router – the device through which traffic flows to the internet. On Wi-Fi, they set up a fake access point known as an evil twin.
- Intercepting: The attacker can read unencrypted data directly. Another popular trick exploits LLMNR and NBT-NS, two older Windows protocols for name resolution: if a computer can’t find a device name in the network’s regular name directory (DNS), it broadcasts the question to all devices. The attacker answers “That’s me” – and the computer tries to sign in to the attacker’s machine. It doesn’t send the password itself, but it does send a response derived from it.
- Exploiting: The attacker tries to crack these credentials offline – that is, to work out the password on their own computer by trying huge numbers of candidates. Or they forward the login in real time to another server (a relay attack) and sign in there on the victim’s behalf.
A modern variant targets online accounts: in what is known as adversary-in-the-middle phishing, the attacker places a deceptively realistic login page between users and the real service. They intercept the password, the verification code, and the session cookie – the digital pass that keeps you signed in after logging in. This lets them get around basic multi-factor authentication as well.
A practical example
A tax advisory firm has its internal network tested. The testing team plugs a laptop into an unused network port in the conference room. Before long, it has intercepted the credentials of several employees via LLMNR – their computers had been searching for a misspelled server name for a network drive. One of the passwords is weak and can be cracked.
In addition, the file server doesn’t enforce SMB signing. SMB is the protocol Windows uses to access file shares; signing works like a digital seal. Without this seal, a real attacker could have relayed intercepted logins to the server and thus accessed client data.
The fix is straightforward: disable LLMNR and NBT-NS, enforce SMB signing, and deactivate unused network ports or secure them with network access control.
Why does this matter for businesses?
A man-in-the-middle attack is rarely the end goal; it’s usually a stepping stone. With intercepted credentials, the attacker moves further through the network (lateral movement) – all the way to servers, email mailboxes, or the accounting department.
The insidious part is that the attack leaves hardly any traces. No malware is installed on the victims’ computers, and they usually notice nothing. The root causes are often default settings that have remained active, unchanged, in many networks for years.
If personal data is affected – such as client, patient, or employee data – an incident like this can also trigger notification obligations under the GDPR.
How to protect your organization
- Encrypt everywhere: Use encrypted connections (HTTPS or TLS) for websites, email, and internal services, and make sure certificates – the servers’ digital ID cards – are properly validated.
- Take warnings seriously: Certificate warnings in the browser are a red flag. Your team should report them instead of clicking past them.
- Disable insecure protocols: LLMNR and NBT-NS aren’t needed in most networks and can be disabled centrally.
- Enforce signing: SMB signing for file servers and LDAP signing for Active Directory – the central user management system in Windows networks – prevent logins from being relayed or tampered with.
- Control network access: Network access control (for example, based on the IEEE 802.1X standard) lets only known devices onto the network. Proper network segmentation – dividing the network into separate zones – further limits what a rogue device can reach.
- Secure Wi-Fi and connections on the go: Run corporate Wi-Fi with WPA2- or WPA3-Enterprise, the business version of Wi-Fi encryption, including certificate validation. On untrusted networks, a VPN – an encrypted tunnel into the corporate network – protects you.
- Phishing-resistant MFA: Methods such as FIDO2 security keys or passkeys also protect against adversary-in-the-middle phishing.
How Rootsektor can help
In a network penetration test, we check whether an attacker could insert themselves into the communication on your corporate network – and how far they would get with intercepted data. We perform internal tests either on-site or remotely. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. You can get your fixed-price quote after scoping via our Pentest Quote page.