Contemporary technical writing also uses “on-path attacker” as a more descriptive term.
An adversary may gain this position through compromised network infrastructure, traffic redirection, name- or address-resolution manipulation, a deceptive access point, an unauthorized proxy, or interference with connection establishment. Effective protection combines peer authentication, message integrity, and confidentiality, with correct certificate or key validation and secure failure behavior.
Key points
Possible effectsThe intermediary may capture secrets, substitute content, alter transactions, downgrade protection, redirect a session, or impersonate each endpoint to the other.
EvidenceUnexpected certificate or key changes, altered resolution or routing, duplicate sessions, and protocol downgrades may justify investigation but are not conclusive alone.
Defensive prioritiesUse authenticated encryption, validate peer identities and trust chains, secure naming and local networks, remove obsolete fallbacks, and monitor route, certificate, and proxy changes.
Important limitationEncryption without reliable peer authentication can still leave a connection open to an active intermediary. Correctly configured transport protection also cannot prevent an already compromised endpoint or trusted intermediary from accessing plaintext available there.