# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 3 Phishing Methods and Techniques
### Phishing Technical Approaches
#### 3.3.18 Man-in-the-Middle  
Man-in-the-middle attacks comprise two forms. In the standard man-in-the-middle (MITM) attack, a malicious user intercepts a direct communication between two parties, whereas a man-in-the-cloud (MITC) attack intercepts communication between the user and cloud services.  
In an MITM attack, a malicious user intercepts and reconfigures data used by a service provider and using party. The attacker then proceeds to contact the service provider pretending to be the using party. The attacker can then proceed to steal credentials, account information, and financial data, and use resources authorized for the user. Examples of tools used for conducting these attacks are Ettercap and the Metasploit Framework.  
In an MITC attack, the attackers exploit a vulnerability present in the cloud's synchronization token system. When a connection with the user and the cloud is established, a synchronization token is allotted to both parties to serve as a key to be used between them. Each connection made between the user and the cloud creates a new, unique synchronization token for that particular connection. If an attacker intercepts the connection between the user and the cloud, they can determine the synchronization token. After identifying the token, the malicious hacker can then impersonate the cloud service to establish a connection with the user and disconnect the previous authentic connection using the authentic synchronization token. If successful, the next time the user establishes a connection with the cloud, the token used will be one that the hackers send to the user. The user will unknowingly use this token to establish the connection. Once this connection is created, the attacker is granted access to the user and can proceed to perform malicious activities. Users in the cloud remain unaware they have been hacked because the attacker can always return the synchronization token to its original value at any time. An addition risk of this form of attack is that accounts that have been hacked are unable to be recovered.  
To detect if they have been attacked, a user has the following options: Users can analyze the geo-locational history of any data synchronizations that took place. A more straightforward approach is to check if any social engineering attacks have been carried out against a user or determining if any Switcher malware was installed in the system. This type of attack can also be detected by email anti-virus gateways or trusted anti-virus software.  
There are several methods a user can employ in order to mitigate such attacks, namely: When the user has detected an MITC attack, he can assess the impact of the attack and gather evidence that the attack happened. Experienced or skilled hackers will attempt to remove all traces that an attack occurred but, in some cases, may not be able to remove all the evidence; this can be because a clean-up process failed or was not undertaken. The user can then proceed to remove all malware files that exist in the system. The user should also delete and remove his current cloud account and create a new one, which ensures that the attacker will no longer be able to make use of the synchronization token.  
By completing these steps, a user can successfully prevent a man-in-the-cloud attack from happening and increase the security of his cloud infrastructure. An outline of this type of attack is shown in Figure 8[70].