Editing Man-in-the-middle attack (section)

== Notable instances ==
A [[Stingray phone tracker]] is a [[cellular phone]] surveillance device that mimics a wireless carrier cell tower in order to force all nearby mobile phones and other cellular data devices to connect to it. The tracker relays all communications back and forth between cellular phones and cell towers.<ref name=wired-sting>{{cite magazine|url=https://www.wired.com/2014/03/stingray/|title=Florida Cops' Secret Weapon: Warrantless Cellphone Tracking|last=Zetter|first=Kim|magazine=[[Wired.com]]|date=2014-03-03|access-date=2014-06-23}}</ref> 

In 2011, a security breach of the Dutch certificate authority [[DigiNotar]] resulted in the fraudulent issuing of [[Public key certificate|certificates]]. Subsequently, the fraudulent certificates were used to perform MITM attacks.<ref>{{Cite magazine|url=https://www.wired.com/2011/09/diginotar-bankruptcy/|title=DigiNotar Files for Bankruptcy in Wake of Devastating Hack|last=Zetter|first=Kim|date=2011-09-20|magazine=Wired|access-date=2019-03-22|issn=1059-1028}}</ref>

In 2013, [[Nokia]]'s [[Xpress Browser]] was revealed to be decrypting HTTPS traffic on Nokia's [[proxy server]]s, giving the company [[clear text]] access to its customers' encrypted browser traffic. Nokia responded by saying that the content was not stored permanently, and that the company had organizational and technical measures to prevent access to private information.<ref>{{cite web|last1=Meyer|first1=David|title=Nokia: Yes, we decrypt your HTTPS data, but don't worry about it|url=http://gigaom.com/2013/01/10/nokia-yes-we-decrypt-your-https-data-but-dont-worry-about-it/|publisher=Gigaom, Inc.|access-date=2014-06-13|date=2013-01-10|archive-date=April 8, 2019|archive-url=https://web.archive.org/web/20190408102924/https://gigaom.com/2013/01/10/nokia-yes-we-decrypt-your-https-data-but-dont-worry-about-it/|url-status=dead}}</ref>

In 2017, [[Equifax#2017 withdrawal of vulnerable mobile apps|Equifax]] withdrew its mobile phone apps following concern about MITM vulnerabilities.<ref>{{Cite web|url=https://www.fastcompany.com/40468811/heres-why-equifax-yanked-its-apps-from-apple-and-google-last-week|title=Here's Why Equifax Yanked Its Apps From Apple And Google Last Week|first=Cale Guthrie|last=Weissman|date=2017-09-15|website=Fast Company}}</ref>

[[Bluetooth]], a wireless communication protocol, has also been susceptible to man-in-the-middle attacks due to its wireless transmission of data.<ref>{{Cite book |last1=Sandhya |first1=S |last2=Devi |first2=K A Sumithra |chapter=Analysis of Bluetooth threats and v4.0 security features |date=February 2012 |pages=1–4 |title=2012 International Conference on Computing, Communication and Applications |chapter-url=http://dx.doi.org/10.1109/iccca.2012.6179149 |publisher=IEEE |doi=10.1109/iccca.2012.6179149|isbn=978-1-4673-0273-9 }}</ref>

Other notable real-life implementations include the following:
* [[DSniff]]{{snd}} the first public implementation of MITM attacks against SSL and SSHv1
* [[Fiddler (software)|Fiddler2]] HTTP(S) diagnostic tool
* [[NSA]] impersonation of [[Google]]<ref>{{cite web |last=Moyer |first=Edward |date=2013-09-12 |title=NSA disguised itself as Google to spy, say reports |url=https://www.cnet.com/tech/tech-industry/nsa-disguised-itself-as-google-to-spy-say-reports/ |url-status=live |archive-url=https://web.archive.org/web/20130915043654/http://news.cnet.com/8301-13578_3-57602701-38/nsa-disguised-itself-as-google-to-spy-say-reports/ |archive-date=2013-09-15 |access-date=2024-05-08 |website=[[CNET]]}}</ref>
* [[Superfish]] malware
* [[Forcepoint]] Content Gateway{{snd}} used to perform inspection of SSL traffic at the [[Proxy server|proxy]]
* [[Comcast]] uses MITM attacks to inject JavaScript code to 3rd party web pages, showing their own ads and messages on top of the pages<ref>{{Cite web|url=https://www.techspot.com/news/62887-comcast-using-man-middle-attack-warn-subscribers-potential.html|title=Comcast using man-in-the-middle attack to warn subscribers of potential copyright infringement|website=TechSpot|date=November 23, 2015 }}</ref><ref name=":2">{{cite web|url=https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/|title=Comcast still uses MITM javascript injection to serve unwanted ads and messages|date=2016-12-28}}</ref><ref name=":0">{{cite web|url=https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/|title=Comcast continues to inject its own code into websites you visit|date=2017-12-11}}</ref>
* 2015 [[Kazakhstan man-in-the-middle attack]]