{"id":47125,"date":"2023-02-14T06:02:16","date_gmt":"2023-02-14T11:02:16","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=47125"},"modified":"2023-03-06T08:04:15","modified_gmt":"2023-03-06T13:04:15","slug":"man-on-the-side","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/man-on-the-side\/47125\/","title":{"rendered":"Man-on-the-side \u2013 peculiar attack"},"content":{"rendered":"

There are attacks that everyone\u2019s heard of, like distributed denial-of-service<\/a> (DDoS) attacks; there are those that mostly only professionals know about, such as man-in-the-middle<\/a> (MitM) attacks; and then there are the rarer, more exotic ones, like man-on-the-side<\/a> (MotS) attacks. In this post, we talk about the latter in more detail, and discuss how they differ from man-in-the-middle attacks.<\/p>\n

A who-on-the-where attack?!<\/h2>\n

So, how does a man-on-the-side attack work? Basically, a client sends a request to a server via a compromised data-transfer channel. This channel isn\u2019t controlled by the cybercriminals, but it is \u201clistened to\u201d by them. In most cases such an attack requires access<\/a> to the Internet provider\u2019s hardware, and this is a very rare thing \u2013 and that\u2019s why man-on-the-side attacks are in turn rare. These types of attacks monitor the client\u2019s requests and generate their own malicious responses.<\/p>\n

A man-in-the-middle attack works in a similar way. The attackers also tap into the data-transfer process between the client and the server. The main difference between these two types of attacks is that the man-on-the-side client\u2019s request reaches the recipient (the server). Therefore, the goal of the attackers is to respond to the client\u2019s request faster.<\/p>\n

As for man-in-the-middle, the attackers has a greater level of control over the data transfer channel. They intercept the request, and can modify or delete data sent by other users on the network. Thus, they have no need to outrun the server\u2019s response.<\/p>\n

However, a man-in-the-middle is a much more invasive attack than a man-on-the-side one. And that means it\u2019s easier to spot. We described in more detail how a man-in-the-middle attack works, based on an example with\u2026 Little Red Riding Hood in this post<\/a>!<\/p>\n

OK, but how does a man-on-the-side attack work?<\/h2>\n

A successful man-on-the-side attack makes it possible to send fake responses to various types of requests to the victim\u2019s computer, and in this way to:<\/p>\n