With new data breaches happening all the time, like the now infamous Fappening, it is becoming more and more important to protect your online activity. Since so much of our lives are now on social media, steps should be taken to defend against even the most basic of hacks.
This article will look at the Man in the Middle Attack (MITM) from how it works, to how you can defend against it. Learn a little, protect yourself a lot!
The man in the middle attack basics
You should click over and read how easy it is, step by step, to do a MITM hack, but I’ll give you the basics on what they are and what they do if you’re feeling lazy:
- A hacker can either create a wireless access point (WAP) that you connect to, or use SSL strip and Ettercap, to gain access to the place between you and the server you’re contacting.
- Once in the place between these two points, hence the ‘man in the middle’ moniker, hackers are able to see your login details: email, password, etc.
- This information can then be taken to other websites and used to attempt sign-ins. Think about your eBay, Apple store, Amazon, and other online purchasing locations as potential targets. If your login details are the same on them you will be hacked.
The author of the article goes into further depth on this basic hack, but that should give you an idea of the danger, and the ease at which this can be done.
How to defend against a Man in the Middle attack
A man in the middle attack is just as easy to defend against as it is easy to accomplish. Hackers are depending on your ignorance of this tactic to do them easily. Here’s what you can do to defend your information:
- Enforce HTTPS: The author says to make sure that all transactions take place over HTTPS servers. This is correct, but what can you do to make sure that you’re always using it? Try out HTTPS Everywhere, a plugin that always directs you to an HTTPS encrypted server when one is available.
- Do not connect to unknown wi-fi: A man in the middle attack is easiest to carry out when you unknowingly connect to a hackers “free” wifi. If you’re out in public, be sure to ask the store/coffee shop you’re at for the correct WAP name to connect with.
- Turn off your auto-connect: Many MITM attacks start out with the hacker using a tool to make their fake WAP the most powerful one in the area. Devices then auto-connect to these strong signals and their owners never know the difference – sometimes even assuming that they’re on a secure connection they’ve used before.
- Have unique passwords: The main point of a MITM attack is to take your login details and use them all over. If your passwords are different across platforms you’ll have fewer worries. Try a password generator tool to keep track of your passwords.
- Encrypt your data with a VPN: The entire point of a VPN is to protect your privacy, data, and identity. They really come into their own during a MITM attack as they encrypt all of your data to the point that a hacker can not crack it. It will take much more time than it’s worth to steal from you, if any actually can crack good 256-encryption that most reliable VPN providers use.
- Use WPA encryption:WEP encryption has been out of date for nearly 10 years now. Be sure that your router uses WPA, and make it that extra step harder to crack.
- Be aware of odd behavior: A way of knowing you’re using a fake WAP during a MITM attack is that it won’t let you use your VPN. This is rare behavior from an actual WAP, but a hacker who wants to steal your data needs that VPN turned off.
- A disconnect followed by a new WAP: That new WAP was almost certainly created by the person trying to get your data. They used a deauthentication program to shut down the legitimate WAP, and are trying to entice you with a new free one of their own that is all set and ready to go.
Many people see online security as something that goes way over their head. That is not the case at all as nearly anyone can do the eight steps above with minimal knowledge. Even something as simple as the HTTPS Everywhere plugin can help you against ordinary security breaches. A VPN can take care of nearly everything at a reasonable monthly rate, and it doesn’t cost anything at all to connect to the right WAP and not trust the lure of “Free WiFi.”