I'm interested in understand the mechanism of man-in-the-middle attack. I know that, in a LAN scenario, in order to do an MitM attack, an attacker usually changes the routing table of the targeted devices (ARP poisoning). But in an internet context, is possible to perform a man-in-the-middle attack?


This is indeed possible, and called "{BGP|IP|route|prefix} hijacking".

These attacks are however more complicated than a lan mitm, but not very stealth.

On April 8th, 2010, a chinese ISP announced A LOT of prefixes, and this was seen by bgp probes all over the world.

Wired has a good article describing it, and you can also read the wikipedia entry.


There are many types of MITM attacks. Each of them depends on the protocol the attacker wants to abuse or his position in relation to your topology/traffic. As you mentioned there are LAN based MITM attacks (ARP cache poisoning or DHCP spoofing). MITM attacks to the routing infrastructure (prefix injection on an RIP/EIGRP/OSPF enabled WAN). And attacks to the infrastructure outside your organization but which you depend on, i.e. BGP prefix hijacking, DNS spoofing, etc.

One classic example is the case when an attacker [ISP/Government/Bad Guy] modifies your DNS responses and makes all your HTTP/email traffic pass through one of his rogue proxies without you knowing.


Is it possible? Yes. Someone sitting in an ISP somewhere could place something near a router carrying your traffic and tap the data to intercept it.

There are government agencies that do this, supposedly, all the time. All you need is a cooperative carrier and/or access to a device somewhere between points A and B and Bob's your uncle...

I'd also add that it's possible...possible...for traffic to be intercepted somewhere by a black-hat hacker sniffing/redirecting traffic after gaining access to a particular equipment. I've not really heard of it, but then again it's not the kind of thing a company would advertise happening if they didn't have to. And it's also possible for employees to abuse their access privileges.

Unless you're a black-hat standing to gain financially or personally from doing this, though, or you're a particularly public target for being hacked, chances are you don't need to worry about it.

  • Actually, gov agencies have legal backdoors in SP gear. This is called "lawful interception" features. – petrus Mar 29 '11 at 21:36
  • 1
    And somehow not so sure they are always used in a lawful manner... – Bart Silverstrim Mar 29 '11 at 22:00
  • It's what SSL and similar encryption protocols try to prevent. They have mechanisms that also prevent playback. i.e. if you capture all the encrypted data and repeated it to the server say, the server would balk at it and probably throw it away. – hookenz Mar 29 '11 at 22:43
  • As long as the certs aren't compromised, sure. All most of those protocols do are outsource your trust to a third party, and even then most users don't pay attention to who signed them. Self-signed certs are so common that users just click through them like any other pop up "do you agree" stuff...it's just noise for them. – Bart Silverstrim Mar 30 '11 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.