In my first video of Man in the Middle attacks,
we took a look at what they are, and how they work.
Put simply, someone gets between you
and the website you’re visiting
and leverages that position
to feed both you and the site misinformation
for their own personal gain.
Websites can make this much harder by upping their security,
utilising HTTPS to authenticate their identity
and encrypt all inbound and outbound traffic.
But what about you, on a personal level?
How can you best address any gaps in your security
to prevent becoming a victim of a man in the middle attack?
As I mentioned in part one, in late 2018,
Google introduced a feature to their browser which displays
a “Not Secure” message next to the URL of any website not using HTTPS.
This might seem like a small thing, but not only has it forced more websites to
confront the security issues associated with HTTP,
it’s also an incredibly useful tool in helping you ensure the security
of the websites you’re visiting.
For example, it’s reasonable to expect your bank’s website to be secure,
so if your banking site is displaying this “Not Secure” message,
it’s worth investigating to make sure you’re actually
on the website you think you’re on.
And if you are, then it’s worth contacting your bank to find out
why on earth their website isn’t using HTTPS... and then find a new bank.
This is a good example of how even a basic level of awareness
can be the first step to addressing security on an individual level.
The next thing you can do is
double-check the security of the wi-fi networks that you’re connecting to.
Say you're killing some time in Starbucks
You connect to the wifi, browse for a bit
do some online shopping finish your latte and leave.
Later, you find out that someone has accessed those same online shops
with your account, and spent huge amounts of your money.
How did that happen?
Well, it turns out the WiFi you connected to wasn’t actually Starbucks wifi -
one of your fellow coffee patrons had brought along a router of their own
and duplicated the network name and login page you’re used to seeing
when you connect to Starbucks internet.
This router still connected you to the web, so nothing seemed amiss,
but every bit of browsing you were doing was going via this man in the middle,
which means that they were able to take advantage
of any online store you used which hadn't fully implemented HTTPS.
This is because it's not enough to just process payments securely.
Even a single non HTTPS page can leave user data vulnerable.
A good way of addressing this,
as well as a whole host of other potential security issues,
is to use a VPN - a Virtual Private Network.
VPNs are like a direct tunnel between you and the internet.
When connecting with a VPN, no one –
not the Internet service provider, the business or network owner,
nor anyone else with nefarious intentions,
can see the information you send over the network.
And much the same as with HTTPS, even if they do intercept it,
it’s encrypted, and as such, useless.
If you’ve never used a VPN before, try taking a look at Freedome.
No, this isn’t sponsored content, but Freedome is my personal VPN of choice,
because I trust the company that provides it.
And when you're routing all your internet traffic through one conduit,
trust is the most important thing there is.
Freedome is a great example
of how easily you can incorporate a VPN into your online life:
encrypting your data, hiding your IP address
and blocking third parties from tracking your online movement,
all with minimum impact on your internet usage.
However it’s only one of many on the market,
so if you want to investigate which option is going to be
best for your specific needs, consider checking out vpnranks.com,
a site dedicated to reviewing and comparing different VPNs
across different platforms and for different uses.
As in most aspects of online security,
your first line of defence here is vigilance.
Being well informed is the first step on that journey,
but it’s important to use the tools available
to protect yourself
from the vulnerabilities in the systems you're using.
Combining all these efforts will allow you to develop an ongoing sense of awareness,
helping to ensure your security now, and in the future.