What is an on-path attack?
Definition
An on-path attack is when an attacker secretly positions themselves between two parties who are communicating, such as you and a website, so they can read or change the data passing between you. It is also called a man-in-the-middle attack.
- Category
- Attacks
- Also called
- man-in-the-middle attack, MitM attack, adversary-in-the-middle
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: csrc.nist.gov, cisa.gov
Last verified against the official page:
NIST defines the attack as one in which an attacker is positioned between two communicating parties in order to intercept and/or alter data traveling between them. "On-path" and "man-in-the-middle" are two names for the same idea: the attacker sits on the path your data takes.
How it works
You usually never see the attacker. Your phone or laptop thinks it is talking to your bank, your email provider or a shop. The attacker relays the messages in both directions, and can copy them or change them on the way.
Public Wi-Fi is the classic setting. CISA warns that many public access points are not secured and that the traffic they carry is not encrypted, which puts sensitive communications and transactions at risk. A related trick is a fake hotspot with a believable name, such as the cafe's name with a small change. CISA's advice is to confirm the name and password of a public hotspot before you use it.
A typical case: you join a hotel Wi-Fi network, sign in to a shopping site that only encrypts its login page, and the attacker on the same network picks up your session. CISA notes that if any part of your session is not encrypted, your entire account could be vulnerable.
Why it matters
What the attacker captures can include passwords, card numbers, session logins and the content of messages. Those feed account takeover and identity theft. The attack also works quietly, so there is often no warning at the time.
On-path attack vs. related terms
- Phishing tricks you into handing over details yourself, usually through a fake message or site. An on-path attack intercepts the traffic you send to the real service.
- A data breach is data taken from a company's systems. An on-path attack targets the connection between you and that company.
For more on this attack under its older name, see our man-in-the-middle attack post.
How to protect yourself
- 1
Check for https on every page
CISA advises looking for "https" at the start of the web address. Some sites encrypt only the sign-in page, so check each page of the session, not just the login.
- 2
Avoid sensitive activity on public Wi-Fi
CISA recommends not doing online banking, shopping or sensitive work on a public wireless network. If you must, use a VPN, or avoid typing passwords or card numbers.
- 3
Confirm the network before you join
Ask the venue for the exact network name and password. Fake hotspots can copy a real name.
- 4
Use cellular data or the website for banking
Apps don't show an https indicator, and CISA notes many mobile apps do not encrypt information properly. On unsecured Wi-Fi, CISA suggests the company's mobile website or your cellular connection instead.
- 5
Use secured networks at home
CISA recommends access points that use at least WPA2 encryption, and that includes your home router.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is an on-path attack the same as a man-in-the-middle attack?
Yes. NIST lists the attack as man-in-the-middle (MitM). On-path attack describes the same thing: an attacker sitting between you and the service you are talking to.
Can an on-path attack happen on my home Wi-Fi?
It is much harder on a network you control and secure, which is why CISA recommends at least WPA2 encryption on your access point. Risk is highest on open public networks.
How can I tell if someone is intercepting my connection?
Often you can't. That is why the guidance focuses on prevention: https on every page, trusted networks, and a VPN or cellular data for sensitive tasks.
Sources
Something wrong or out of date? Tell us and we'll re-check it.