After this lesson you can explain what a Man-in-the-Middle attack achieves, describe ARP spoofing and how it enables local network interception, explain SSL stripping and how it downgrades secure connections, describe rogue access point attacks, explain how TLS, certificate validation, HSTS, and certificate pinning defend against MitM, and identify the specific MitM risks in maritime satellite and port Wi-Fi environments.
Imagine two people exchanging sealed letters through a courier. A Man-in-the-Middle attack is the equivalent of that courier secretly opening every letter, reading it, potentially modifying the contents, resealing it, and delivering it as if nothing happened. Neither sender nor recipient knows the interception is occurring.
In digital communications, a Man-in-the-Middle (MitM) attack positions the attacker between two communicating parties — a client and a server, two internal systems, or a vessel and a shore-based management platform — in a way that intercepts, reads, and potentially modifies the traffic passing between them. The communicating parties continue to believe they are communicating directly with each other.
MitM attacks can target Confidentiality (reading credentials and data), Integrity (modifying data in transit — for example, changing an invoice's bank account number), and even Availability (if the attacker drops packets rather than forwarding them). They are particularly relevant in shared network environments — hotel Wi-Fi, port facilities, coffee shops — where multiple users share the same network segment.
For maritime professionals, the attack surface includes port Wi-Fi networks used by crew members with company laptops, VSAT satellite links, and shore-to-ship communication channels used for operational data exchange. This lesson examines the technical mechanisms and the defences — primarily TLS — that make modern MitM attacks much harder to execute than they once were.
1. ARP Spoofing — Intercepting Local Network Traffic
ARP (Address Resolution Protocol) is used on local networks to map IP addresses to MAC (hardware) addresses. When Device A wants to send data to Device B on the same local network, it broadcasts an ARP request: "Who has IP address 192.168.1.10?" Device B responds with its MAC address. ARP is stateless and unauthenticated — any device can send an unsolicited ARP reply claiming any IP address.
ARP Spoofing (ARP Poisoning) exploits this: the attacker sends forged ARP replies to both the victim and the network gateway, claiming that the attacker's MAC address corresponds to the IP address of the other party. Both devices update their ARP cache with the false mapping and begin sending traffic to the attacker, who forwards it to the real destination. Neither party knows the traffic is being routed through a third machine.
Countermeasures: Dynamic ARP Inspection (DAI) on managed switches validates ARP packets against a trusted DHCP database — preventing spoofed ARP replies from being accepted. Static ARP entries for critical systems, and network segmentation that limits the shared broadcast domain, also reduce ARP spoofing risk.
2. SSL Stripping and Rogue Access Points
🔓 SSL Stripping
SSL Stripping (Moxie Marlinspike, 2009) is a technique that downgrades a secure HTTPS connection to an unencrypted HTTP connection without the victim noticing. When a positioned MitM intercepts a victim's HTTP request that would redirect to HTTPS, it fetches the HTTPS version from the real server itself, but serves the plain HTTP version to the victim. The victim sees no security indicator because the browser's address bar shows HTTP — but thinks the connection is working.
This allows the attacker to read all traffic in cleartext even though the real server is using TLS.
📶 Rogue Access Point (Evil Twin)
An attacker sets up a wireless access point with the same SSID (network name) as a legitimate network — a port facility's "PortWiFi_Free" or a ship's crew Wi-Fi. Devices may automatically connect to the stronger signal. All traffic through the rogue AP passes through the attacker's device before reaching the internet.
This is trivially accomplished with a laptop and a wireless adapter running hostapd. No hacking tools required — the attack creates a standard Wi-Fi hotspot.
3. TLS and Modern MitM Defences
TLS (Transport Layer Security) is the primary defence against MitM on internet communications. TLS provides: (1) encryption — all data in transit is encrypted, so even if intercepted, it cannot be read without the session keys; (2) authentication — the server presents a digital certificate signed by a trusted Certificate Authority (CA), allowing the client to verify it is communicating with the real server, not an impostor; (3) integrity — MAC (Message Authentication Code) values detect any tampering with data in transit.
- MitM attacks intercept communications between two parties without either knowing — targeting confidentiality, integrity, and potentially availability.
- ARP Spoofing positions the attacker as the gateway on a local network, allowing interception of all unencrypted traffic.
- SSL Stripping downgrades HTTPS to HTTP so the attacker can read cleartext traffic even when the server supports TLS.
- Rogue Access Points (Evil Twin Wi-Fi) allow attackers to intercept all traffic from devices that connect — trivially deployed in port environments.
- TLS 1.3, HSTS, certificate validation, and certificate pinning are the primary technical defences against MitM.
- Never click through browser certificate warnings — they indicate a potential MitM attack or a serious misconfiguration.
- Always-on VPN on company devices is the most effective single policy for maritime crew using external networks at ports.
Lesson 10 — SQL Injection introduces one of the most persistent and well-documented web application vulnerabilities. We examine how improperly handled database queries allow attackers to extract, modify, or delete data by embedding malicious SQL code in user input — and how parameterised queries and input validation eliminate this vulnerability class.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment