Threat Description

A Man-in-the-Middle attack is a sophisticated network-based exploit that is specifically designed to intercept and/or manipulate otherwise encrypted data without the end user’s knowledge. It may be carried out on WiFi or Cellular networks.

Wandera offers patent-pending MitM detection technology that reliably detects if SSL/TLS network connections are being compromised while using any WiFi or Cellular network. Such compromises are evidence of a MitM attack, which may or may not be of malicious intent.

MitM attacks are typically carried out in the following ways:

• Creating an open WiFi hotspot promising free Internet access. The attacker natively routes traffic through the MitM service and may or may not actually provide Internet access.
• Impersonating common open SSIDs, namely those found at airports, hotels, and coffee shops. This tricks the user into joining the malicious network, enabling the MitM access to all network traffic.
• Socially engineering the user to install a malicious profile that proxies network data to a MitM on the connected network.
• Compromising wired or wireless network infrastructure to route traffic through a MitM service without the users knowledge.
• Nation states or ISPs that intercept data to enforce censorship or otherwise monitor digital communications.

It is important to note that there are some cases in which a MitM will be detected but is not representative of malicious intent. However, even in these cases, the SSL/TLS connection chain-of-trust is still being broken, enabling encrypted data with the expectation of secrecy to be potentially accessed by an unauthorized 3rd party.Specific examples of this situation include:

• Public WiFi hotspots with captive portals, like those commonly found at airports, hotels, and other public locations. Many hotspots will spoof SSL certificates such that requests to HTTPS sites may be re-directed to a pay-wall for Internet access. In the process of doing so, the user may inadvertently grant the gateway access to other SSL/TLS traffic, such as Exchange ActiveSync. Though usually not exploited, this allows a network operator to potentially access encrypted communications, including credentials.
• Corporate network traffic inspection. Some organizations use proxy servers or other network equipment designed to operate as a “controlled” MitM to assist with data loss protection, web content filtering, or other acceptable usage policy enforcement. Usually corporate devices that are authorized to use these networks are loaded with a 3rd Party Trusted Root Certificate Authority such that the device automatically trusts connections to that network, even though the certificate isn’t genuine from the requested endpoint.

Wandera flags MitM threats based upon whether or not the device inherently trusts the invalid SSL connection. Specifically, if the device trusts a certificate that is known to be forged, Wandera raises a maximum security event as this is indicative of a significant device compromise. However, if the device doesn’t automatically trust a forged certificate, a lower-rated threat is raised since acceptance of the connection generally requires manual user approval to proceed.