Man In the middle attack

Complicated malware will use a MitM attack; this activates attackers to attack many banks, and assures more return. A MitM attack uses a malicious server which sits between the customer and the bank (the financial organization) .i.e. client and server. Even though the whole thing will give the ordinary impression to the user, once the customer is demanded to authorize a transaction, customer is in fact authorizing a transaction made by the cyber criminal.

The principal of MitM attack initially involves the fake coercing the bank customer to visit a fake banking website. This is generally accomplished by distributing an e-mail, impersonating a bank, requesting the customer to click on a given link, allegedly of the bank website. Another possible approach is tapping with the customer’s internet connection in order that when they attempt to visit the correct website, they in fact are redirected to the fake website.

To the customer, the website will looks the same as the usual bank website. It is even encrypted, so the customer will witness the anticipated lock symbol in their web browser. On the other hand, important information went in will move to the phony bank website and not to the real website. While this information is obtained, particularly written software will hook up to the bank’s real website, impersonate the customer and make fraudulent transactions.


Considering the fact that the fake website has all the information the customer would usually provide, it is not possible for the bank to identify difference between the real customer and the fake. For the reason that the connection to the bank happens right away as soon as the customer enters their account details, any time-dependent one-time password (OTP) will even now be valid. If the bank has carried out shared authentication, the fake website will receive the correct reply from the bank, for example pictures or answers to secret questions, and forward it back to the customer. The customer will see the anticipated reply and as a result send the account details the fraudster requests. At the same time as both the bank and the customer think they are communicating straight, in actual fact the fraudster is free to view and change some of the transmitted information.

Diligent bank customers possibly will be able to recognize fake sites, in view of the fact that their address may be wrong. At the same time as some are encrypted, watchfully inspecting the website certificate might show that the site do not actually belong to whom it claims to. Moreover, as fraudsters might try to connect to the bank website from a computer in the same country as the customer, bank fraud recognition systems might observe doubtful characteristics.


A classical MtiM attack is briefly explained below:


Normally the attacker places himself between two communicating parties’ .i.e. between the customer and the bank, and collects all the information from the bank customer. The data given for the genuine website are passed to the attacker instead, who saves this information, gives this information to the legitimate site, and passes the responses again back to the customer. A schematically illustrated in figure

MitM attacks in the context of crime -based information theft include:

a) A session hijacking attack, in which data is obtained from a customer and passed through to the genuine website until the preferred authentication has been executed, whereupon the session is hijacked.
b) A hostname lookup attack typically called as pharming, in which a website at the anticipated host name, but with the incorrect IP address, passes data from the customer to the genuine website and vice-versa, to provide genuineness and delay finding.
c) A web proxy attack, in which a malicious web proxy obtains all web traffic from a compromised computer and passes it to a genuine website, taking credentials and other confidential information.

Generally MitM is very difficult to detect, because the genuine website still looks to work correctly and there is no warning to give if something is wrong.