Imagine having a one-on-one email conversation but the person responding is not who you think it is. Are you discussing something private? Personal? Are you sharing information with the wrong person? This is an alarming example of a MITM attack, one of the oldest forms of cyberattacks. So what exactly is a MITM attack?
MITM – a malicious interception
A MITM attack is an interception of communication between two parties for duplicitous reasons. It requires three players: the victim, the person/entity the victim is trying to communicate with, and the imposter (the man-in-the-middle or the hacker). Think of it as a type of eavesdropping with a possibly dire outcome where the victim rarely knows that this has happened or is happening. A hacker executes a MITM attack in two phases: the interception and the decryption. Interception is through: 1) Physical proximity – access gained through an unsecured Wi-Fi router (e.g., a public hotspot) such as in Wi-Fi eavesdropping or a rogue access point Or 2) Malicious software or malware (i.e., man-in-the-browser (MITB) attack) – access gained through the introduction of malware via:
And once a cybercriminal intercepts a conversation, the threat actor can then decrypt and steal data through harvesting or recording, depending on the desired outcome.
What is the goal of MITM?
The end game of MITM is to compromise or steal personally identifiable information or login credentials, modify internet traffic, spy for personal use or espionage, sabotage, or gain financially. In other words, a hacker can use MITM for a variety of reasons to cause different levels of damage. In 2019, a phishing email was sent from mobile healthcare app Evergreen Life’s clinical director Dr. Brian Fisher to everyone in his account in a MITM attack. The hijacked email asked receivers to open an attachment, visit a phony website, and register their credentials. Evergreen believes that the goal was to install ransomware and steal login details, but the organization spotted the problem in time, taking immediate action. Evergreen Life then segmented its system, putting patient records and email accounts on different systems, and sent an email to the first receivers urging caution.
How can you protect yourself?
Obviously, Evergreen Life took immediate steps to stop a MITM breach from happening on an organizational and personal level. And the best method of protection, in fact, is a comprehensive, layered security that blocks breaches from occurring. Such solutions should include:
- An up-to-date and secure Wi-Fi network
- A VPN and segmented networks
- Offline backup
- Strong encryption
In 2017, the Department of Health and Human Services Office for Civil Rights advised healthcare organizations about rising MITM attacks and why HIPAA compliancy is important. At Paubox, we work tirelessly to ensure you are protected from all types of MITM attacks through secure HIPAA compliant email and inbound security with Paubox Email Suite Plus. Such strong security features along with up-to-date employee awareness training are always necessary to keep you secure now and in the future.
Try Paubox Email Suite for FREE today.
Kapua Iao
