Shopping at your favorite online boutique and laughing at the latest trends on your social media feed is all fun and games until someone hacks your information. One of the most common cybersecurity risks is man-in-the-middle (MITM) attacks, and the worst part is they can occur in every corner of the internet. With these seven steps, you can outsmart hackers and keep your information safe and secure.
What Are Man-in-the-Middle Attacks?
MITM attacks occur when a hacker comes between two people or systems communicating online. The attacks can happen during common online activities, such as:
- Checking your email
- Engaging on social media
- Shopping at an online store
- Signing in to your bank account
To get an idea of what happens during a MITM attack, think of it as eavesdropping on a conversation. Imagine signing in to your banking account under the impression that the information you’re providing will stay between you and your bank. The hacker virtually sits between you and your bank’s website or app to see and intercept everything you do. Hackers aim to access your login credentials or other sensitive information, such as your Social Security number.
|
Hacking History: One of the most publicized MITM attacks occurred in 2017 with Equifax, a credit score company. Equifax was the victim of a data breach. Researchers discovered that the app did not consistently use HTTPS, meaning attackers could intercept personal data from users to access their accounts. |
Strengthen Your Login Credentials
Your login credentials are the main pieces of information hackers seek. With your login credentials, they can tap into your personal data, including your Social Security number, address, and other identifying details. When hackers get that information, you are at risk of having your identity stolen.
It’s tempting to use the same login credentials for every website because, well, there are tons of them, but it puts you at risk. If a hacker obtains login credentials for your Instagram account and finds it’s the same as your banking login, that gives them access to sensitive information from multiple sources.
Take a day to review your accounts and refresh your login information, using different passwords for each. Use strong passwords that won’t be easy to guess, and avoid things such as common words or birth dates. Below are a few tips for creating and using strong passwords:
- Aim for at least 12 characters.
- Use a mix of uppercase and lowercase letters.
- Include numbers and symbols.
- Avoid using personal information such as names or birth dates.
- Consider a secure password manager, such as LastPass or Dashlane, to keep track of your passwords for you.
In addition to your online accounts, it’s also essential to change your router credentials. When you set up the internet in your home, your router comes with default credentials that are easy for hackers to guess. If hackers can get into your Wi-Fi network, they can infect it with malware or perform a man-in-the-middle attack to see and intercept everything you do on your home Wi-Fi network. Keep your wireless router secure by updating your login details immediately after installation.
Enable Two-Factor Authentication
Think of two-factor or multifactor authentication as login-credential insurance. When you set up two-factor authentication on your accounts, you can stay protected even if your login credentials become compromised.
Not all websites and apps provide two-factor authentication, but major companies, such as banks and e-commerce websites, typically offer it. Two-factor authentication works by requiring an extra step in the login process, in which you sign in on a different device or from a different location. Usually a personal identification number is required, or you have to authenticate the login via email or your phone.
Avoid Open Public Wi-Fi Hotspots
Using a public Wi-Fi hotspot that isn’t password protected is one of the easiest ways hackers can launch a man-in-the-middle attack. There are two significant risks when using public Wi-Fi: You don’t know who it belongs to and you don’t know who else is using it.
If you’re at a coffee shop and need Wi-Fi access, check with an employee to ensure you’re using the correct network. Be vigilant in your online activity while using it, and avoid logging in to any website with personal information, such as your bank account, or communicating any personal or sensitive information.
Another common way to put yourself at risk is by using Wi-Fi on your cell phone while in public. The same risks apply, but there are options on your phone that allow you to log in to public Wi-Fi networks automatically. Turn off this setting, because you could unknowingly log in to an unsecured Wi-Fi network that leaves you susceptible to a man-in-the-middle attack.
Use a Virtual Private Network
If you frequently use public Wi-Fi or have been a victim of a cyber-attack in the past, a virtual private network (VPN) can be your security BFF. Think of a VPN as your own private tunnel that allows you to send and receive data online securely so you can avoid being tracked by hackers.
VPNs keep you secure by encrypting any information you use to access your online accounts. Once encrypted, the information cannot be searched or read by outside parties (e.g., hackers) until it reaches its intended destination, such as your email account. Then the information is decrypted for authorized use by the intended recipient.
You can find VPN providers online, and you have the option of choosing a paid or free service. Ensure you do thorough research on any VPN you choose to stay vigilant in keeping your information secure. Here are a few trustworthy VPN providers:
- NordVPN
- Surfshark
- Private Internet Access
- Hotspot Shield
- ExpressVPN
Stay Alert for Unsecure HTTP Websites
Remember how Equifax became a victim of a data breach? The reason behind that breach was due to an unsecured HTTP website. Whenever you visit a website, you’ll notice the web address starts with either HTTP or HTTPS. HTTP stands for hypertext transfer protocol, while HTTPS stands for hypertext transfer protocol secure.
The letters at the beginning of the web address are called a protocol. Protocols communicate between your web browser and the back end of the internet. When you type in the website you want to visit, the protocol tells the web where you want to go and asks the web to send you there.
The difference between HTTP and HTTPS is that HTTPS is secure, while HTTP is not. Websites using HTTP are much easier to hack and could be attempting a phishing attack to gain your personal information. Web browsers such as Google Chrome make it easy to spot the difference by including a lock image to the left of the URL that indicates you can trust the protocol.
When browsing the internet, stay alert for any websites using HTTP and be wary of the information you provide to those sites.
Watch Out for Warning Signs Across the Web
In addition to checking unsecured sites for HTTPS, there are other red flags to look out for as you browse online.
- Fake websites: Watching out for HTTP can help, but it’s important to recognize any other suspicious indicators of a fake website, such as misspelled words. A common MITM attack on fake websites occurs when you are attempting to download free software, but it ends up being malware.
- Suspicious certificates: Legitimate websites are issued a certificate that verifies the website owner’s identity. Browsers will automatically check for this certificate, and you will get a warning if the certificate is missing, invalid, or expired. If you get this warning, it’s possible you’re on the verge of a MITM attack. Always avoid websites that provide this warning, even if you think it’s a legitimate website that overlooked their certificate renewal.
- Pop-up messages: Pop-up messages commonly found online feature advertisements, but sometimes it’s an attempted MITM attack. A sign of these MITM attacks is a pop-up claiming you have a virus or need to update a program that will then ask you to download something to fix it. The download is usually malware. These pop-ups can occur on legitimate websites, too, so be wary if you see one on your screen.
Educate Yourself on Cybersecurity Trends
New cybersecurity trends arise every day. Hackers work hard to do whatever they can to access your personal information. The best way to fight them is to educate yourself to stay keenly aware of anything suspicious online. To stay informed about common cybersecurity risks, you can visit the National Institute of Standards and Technology cybersecurity hub for the latest news and information. If you can stay ahead of what hackers are doing, you can remain vigilant in protecting your information.