How To Protect Your SMB From a MitM Attack

How To Protect Your SMB From a MitM Attack

Table of Contents

There were around 35 billion known data breaches last year. Amongst the methods used to steal data is a technique known as a "Man-in-the-Middle (MitM) attack. A MitM attack is silent but deadly: Intercepted communications provide a data goldmine to the MitM hacker, who uses the stolen data to carry out further harmful attacks. MitM is now sometimes called machine-in-the-middle, adversary-in-the-middle (AITM), or manipulator-in-the-middle.

What is a Man-in-the-Middle (MitM) Attack?

What is a Man-in-the-Middle (MitM) Attack?

A MitM attack is designed to exploit data using various techniques. The "man-in-the-middle" intercepts data as it flows between entities, like an employee and a web app. Inserting themselves between private and sensitive communications allows a MitM attacker to access various types of data, including login credentials and financial information. The attacker then uses this data to carry out further attacks, such as Business Email Compromise (BEC) scams. Attackers may also target a specific company to steal company secrets or proprietary information like Intellectual Property (IP) or customer and partner data.

How Does a MitM Attack Work?

MitM attackers rely on various vectors to carry out an attack. Software vulnerabilities, human behavior, and insecure security protocols are often used, either alone or combined, to propagate a successful MitM attack.

Whatever method and vector a cyber attacker uses to execute a MitM attack, the same basic steps occur:

  1. Communication occurs between two individuals, e.g., an employee sends an email to an executive.
  2. The MitM attacker uses an established attack tactic and technique to intercept the communication.
  3. The attacker can then perform various nefarious actions on the communication, such as changing something in the email, like invoice bank details, before sending it to the original recipient.

In all scenarios, the victims are unaware that their communications have been intercepted.

How a MitM Attack Impacts an SMB

How a MitM Attack Impacts an SMB

MitM attacks are often a component of a multi-part attack, leading to a variety of negatively impactful events on a small to medium-sized business (SMB). Some of the following are typical outcomes of a MitM attack:

  • Login credentials are an attractive target for MitM attackers. If an attacker can gain access to a device or network, they can then carry out further cyberattacks. Stolen login credentials can lead to ransomware, other malware infections, and Business Email Compromise (BEC). Stolen login credentials can also lead to much larger data breaches that leave a business in noncompliance with data protection regulations.
  • Interception of private communications can leave a business open to a variety of risks. One such risk is the theft of IP or customer data by competitors or cybercriminals who plan to sell the IP or data on a dark web marketplace. Another is the exposure of company secrets or the threat of exposure and subsequent ransom.
  • Data is gathered to perform spear phishing attacks. Spear phishing attacks specifically target key members of staff to manipulate them into performing actions that benefit the cybercriminals. For example, a spear phishing email may target an administrator, allowing the cybercriminal to get high-level access to sensitive areas of a company network. Spear phishing emails are created using intelligence gathered on the target. MitM attacks can provide personal information.
  • Interception of invoices and other financial information to help perform BEC attacks. MitM attacks may target emails sent by executives and employees in accounts payable. The attackers intercept these emails, choosing those that contain invoices or financial details, like bank account information. The attackers then change the invoice and bank details so that money is sent to the hacker's bank account.
  • Account Takeover (ATO) and fraud are potential outcomes of a MitM attack. Once a cybercriminal has access to an account, they can hijack it and use it to perform fraudulent transactions. MitM attacks provide a cybercriminal with a means to gain that access, usually by intercepting login credential exchanges.

Types of Data Stolen During a MitM Attack

Types of Data Stolen During a MitM Attack

Cybercriminals love data because it gives them the means to exploit a company and an individual. Data is valuable to cybercriminals; they can sell it on the dark web or use it directly to carry out secondary attacks, like BEC.

The types of data that MitM attacks target include the following:

  • Login credentials
  • Sensitive and proprietary company information
  • Financial data
  • Customer information
  • Sales information
  • Private communications to gather intelligence on employees. This is then used in spear phishing and other social engineering scams.

Data may end up for sale on the dark web to carry out further attacks on your company.

The Cost to an SMB from a MitM Attack

The costs of a MitM attack reflect the follow-on attacks initiated by the data stolen in the original interception.

The Cost to an SMB from a MitM Attack

Business Email Compromise (BEC)

The FBI calls BEC "The $55 Billion Scam." The FBI states that "the BEC scam continues to target small local businesses to larger corporations." In total, 158,436 US victims have lost almost $21 billion. That averages around $132,000 in losses per incident. This amount concurs closely with research from the Anti-Phishing Working Group (APWG), which found that the average amount requested in a wire transfer during a BEC attack is $128,980.

Data Breach and Noncompliance Fines

MitM attacks are about stealing data in all its forms. They can often be a prelude to much larger data breaches. Attackers use stolen login credentials to gain access to databases and other data repositories. The resulting noncompliance fines can be large. For example, PCI-DSS noncompliance fines can range from $5000 to $100,000 per month, depending on the violation.

Reputation Damage

MitM and follow-on cyberattacks can cause reputational damage as trust in the company is impacted. This can cause major financial damage, with 75% of consumers refusing to deal with a business that has suffered from a security breach.

Fraud

Account Takeover and fraud cost an SMB over $16,000, and over half of businesses (54%) never recover their losses.

Types of MitM Attacks

MitM attackers use various techniques to intercept internet traffic, i.e., sensitive and secret communications. Some of the most common techniques include the following:

Rogue Wi-Fi Hotspots

Rogue Wi-Fi Hotspots

Cybercriminals create spoof Wi-Fi hotspots to trick people into communicating through rogue Wi-Fi. Often, these malicious Wi-Fi networks have legitimate-sounding names, similar to popular networks. If the user connects to the rogue Wi-Fi, any communications they perform using this network, like sending an email, will be intercepted. As long as the person is using the spoofed Wi-Fi, the attacker will be able to monitor activity and steal data. Some rogue Wi-Fi attacks allow attackers to install malware on the device.

ARP Spoofing

The communication protocol, Address Resolution Protocol (ARP), translates the link-layer address (e.g., MAC address) to the Internet Protocol (IP) address on the local network.

A MitM attack that uses the ARP tricks a victim's computer into believing the hacker's computer is the network gateway. This allows the attacker to intercept all traffic between the victim's computer and the network, providing them with the data they need to carry out a cyberattack.

DNS Spoofing

Domain Name Servers (DNS) are an essential part of the modern internet. A DNS maps memorable domain names to IP addresses. Attackers can intercept internet traffic, redirecting legitimate traffic to phishing websites. These websites are branded to look like well-known brands such as Microsoft 365. The attackers use these spoof sites to steal login credentials and other data.

Cookie Hijacking

A web browser may store website information in a session cookie to help with a better user experience. If a MitM attacker can gain access to the session cookies in a user's web browser, they can use them to impersonate that user or steal the information inside the cookie. This information can include passwords, financial information, etc.

Secure Sockets Layer (SSL) Hijacking

SSL is an earlier form of the Transport Layer Security (TLS) protocol, which is essential for online security. Websites that have HTTPS at the beginning of their URL use SSL or TLS to encrypt internet traffic. MitM attackers can hijack SSL connections because this older protocol has security vulnerabilities. As the more secure TLS protocol replaces SSL, this type of MitM is becoming less prevalent.

IP Spoofing

Like DNS spoofing, IP spoofing diverts internet traffic to a spoof website by modifying the fraudulent site's IP address to make it look like the IP address of a legitimate website.

Email Hijacking

Email hijacking describes the takeover of critical accounts, such as email or application accounts. Once an attacker has control of the account, they can use it to carry out fraudulent activities, including phishing other users. This form of MitM replies to social engineering and the manipulation of behavior.

How To Protect Your Small Business From MitM Attacks

Hackers use a variety of techniques to intercept private and sensitive data. As such, an SMB must retaliate by using multiple layers of security to close off any security gaps. The following are a series of best practice cybersecurity measures that help to protect your business from MitM attacks:

Dark Web Monitoring

Dark Web Monitoring

Protection begins with understanding what you are up against and the security risk to your business. Dark web monitoring tools dig deeply into the dark web to find evidence that attackers are targeting your company and brand. They also locate any company data available on the dark web that may be used to target your company in MitM attacks.

Robust Passwords

Enforce the use of strong passwords that make it difficult for hackers to brute force user passwords.

Passwordless Authentication

Passwordless authentication avoids using a password to log in to an account. Instead, various other methods, like a fingerprint or facial biometric, are used. This helps to prevent specific MitM attacks that hijack email accounts.

Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) is a standard best practice where additional login credentials are requested during login, such as a code received on a mobile device. However, hackers are increasingly finding novel ways to bypass MFA; instead, MFA should be used to reduce risk.

Virtual Private Network (VPN)

A VPN encrypts internet traffic; if a hacker intercepts traffic during a MitM attack, the data will be unreadable and unusable.

HTTPS

HTTPS at the front of a URL, e.g., https//www.mycompany.com, shows that the site is secured using digital certificates. These certificates encrypt traffic and demonstrate that the certificate issuer has checked a company. However, these checks are not always comprehensive. Increasingly, spoof websites appear legitimate, with over three-quarters of phishing websites using HTTPS.

Encrypted Communications

Any exchange of sensitive or proprietary data over the internet should be encrypted. VPNs and HTTPS can help secure data, but other methods like end-to-end email encryption reduce the chance of a successful MitM attack.

WEP/WAP Encryption on Access Points

Encrypting wireless access points helps to prevent brute force and interception of internet traffic.

Security Awareness Training

Employees should be educated about the risks of MitM attacks and how to stay safe, especially when working remotely. Training employees to identify phishing attempts can help reduce the likelihood of MitM attacks. Cyber hygiene training, such as logging out of apps, secure Wi-Fi use, and robust password creation, is a must for developing a culture of security that protects your business and its employees.

Real-World Examples of MitM Attacks

Tesla (Rogue Wi-Fi)

Man-in-the-Middle (MiTM) phishing attacks are used to compromise Tesla accounts, unlock cars, and start them. The attack is based on a rogue Wi-Fi that spoofs the legitimate Tesla Wi-FI name "Tesla Guest". If a user attempts to log into this spoofed network, they are asked to enter their Tesla account credentials. If they submit these credentials, they can be stolen by the attackers and used to access the real Tesla account.

Fox-IT (NCC Group) - DNS Spoofing

A MitM attack against security vendor Fox-IT allowed hackers to intercept the company's customer data and steal login credentials. The MitM attack used DNS Spoofing to intercept and redirect inbound traffic to the company's ClientPortal and emails going to the Fox-IT domain. Fox-IT used security tools to quickly mitigate the attack and contain the impact.

Various Banks (Wi-Fi and Flaw Exploit)

Customers at HSBC, NatWest, Co-op, Santander, and Allied Irish Bank were impacted by a MitM attack. The attackers exploited a vulnerability in a banking app that allowed criminals to steal personal information and credentials, including passwords and pin codes.

Table of Contents