🕵️‍♂️ Man-in-the-Middle Attacks: When Someone Is Quietly in the Conversation

In the previous post, we looked at ARP poisoning - how attackers can mask the physical identity of a device and quietly redirect traffic inside a local network.

But ARP poisoning on its own doesn’t steal data.  What it does is something more subtle and more dangerous:  it puts the attacker in the middle, and that’s exactly where Man-in-the-Middle (MITM) attacks begin.

🪑 The Core Idea: Being in the Middle Is the Attack

A Man-in-the-Middle attack isn’t a single tool or technique.  It is all about clever positioning.  It is when two parties - for example, a client and a server (or router) - believe they are communicating directly with each other, but in reality, their traffic is passing through someone else first.

Nothing appears broken, so both sides keep talking.   And that’s exactly why MITM attacks are so effective.

🎭 How MITM Builds on ARP Poisoning

• ARP poisoning answers the first question: “How does the attacker get into the path of traffic?”

• MITM answers the next, which is: “What happens once the attacker is inside the path?”

Once an attacker is quietly settled inside the network path, they can do a number of things, which brings us to the next paragraph.... 👇

🔍 What the Attacker Can Do in the Middle

Well, it all depends on the situation... :) Essentially, the Man-in-the-Middle attacker has several options to consider. They can:

• Eavesdrop on unencrypted traffic ( ie read credentials, session data, or sensitive content)

• Downgrade or manipulate connections (responses can be altered, compromising intgrity of data)

• Hijack sessions (Take over authenticated connections without needing passwords).

• Remain invisible (forwarding traffic cleanly so neither side realises anything is wrong).

  
  

So essentially, the power of MITM attacker isn’t noise - it’s all about silence and being invisible.

🔐 Where Encryption Helps (and Where It Doesn’t)

Encryption is one of the strongest mitigations against MITM attacks, but it’s important to be precise about what it does. Strong encryption can protect the contents of traffic (privacy and confidentiality of data remains intact), and it can limit what an attacker can read or modify (confidentiality and integrity of data is not compromised).

What encryption cannot do is stop an attacker from being in the middle, and it cannot prevent traffic from being intercepted or relayed. This is why MITM attacks still matter even in encrypted environments, and why network-level trust is just as important as application-level security.

🧠 The ST3MTech takeaway

Man-in-the-Middle attacks work because systems assume:

• the path is trustworthy

• the intermediary is legitimate

• the conversation is private

When those assumptions are wrong, security fails quietly.

🔜 What’s next

Being “in the middle” doesn’t always require access to a wired network.

In the next post, we’ll look at Evil Twin and rogue Wi-Fi attacks, where attackers don’t just intercept traffic - they impersonate the network itself.