Preventing an Adversary-in-the-Middle attack
For clients connected to corporate networks, intra-network communications are critical to the basic functionality of systems. This could be connectivity to the local intranet, printers, file servers, or accessing the internet. For attackers that have gained access to the internal network, several tools and techniques can be used to listen for and intercept these communications. If the attacker can place themselves in the middle of the communications path, they can gather information, manipulate, and modify traffic, and force users to unknowingly authenticate to them. If they're successful in their efforts, passwords can be captured, cracked, and forwarded to other systems in relay attacks to authenticate them against other systems. This technique is known as an Adversary-in-the-Middle (AiTM) or Man-in-the-Middle (MiTM) attack.
In the next few sections, we are going to review different network protocols that adversaries can use to...