Man-in-the-Middle (MITM)

A Man-in-the-Middle attack places the attacker between two communicating parties, intercepting and possibly modifying their traffic while each side believes it is communicating directly with the other. Telecom-specific MITM scenarios include IMSI catchers on the radio interface and SS7 redirection in the core. Mutual authentication and end-to-end encryption are the principal defences.

Categories: Radio Access NetworkCore NetworkSignaling

Man-in-the-Middle (MITM) in context

The radio access network is where mobile devices attach to the operator's infrastructure. Attacks in this layer include IMSI catching, rogue base stations and downgrade attacks; defenses rest on mutual authentication, integrity-protected signaling and Open RAN supply-chain hygiene.

The mobile core carries subscriber sessions, mobility and policy. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF.

To place Man-in-the-Middle (MITM) in the wider telecom-security picture, review MVNO, IPsec, User Plane Security, SBA, S1AP and GTP-U: each entry cross-references back to this page so you can walk the topic in either direction.

Related terms

Related topic hubs

  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • IMSI Catcher Rogue base stations, IMSI capture and detection.
  • SS7 Security SS7/MAP/CAP/SCCP attacks and defenses across 2G/3G interconnect.
  • SS7 Firewall GSMA FS.11 category 1/2/3 SS7 message screening at the STP edge.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.