Use case

Adversary-in-the-Middle (AiTM) protection that keeps phone traffic private on any network

Almost every corporate app on a phone relies on Transport Layer Security (TLS) to keep data private, but weak implementations, rogue hotspots, and fake certificates give attackers ways to intercept or redirect that traffic. Reflex, Corrata’s on-device threat engine, checks the encryption behind each connection on the phone itself and stops sensitive data being sent when it could be intercepted.

Public networks, including cellular, Wi-Fi, and broadband, are all open to interception, and poor TLS implementations mean encryption alone isn’t always enough.

Attackers can monitor communications and redirect traffic to servers they control, so the only coherent approach to AiTM protection is one based on zero trust.

How Reflex protects against adversary-in-the-middle attacks

Reflex inspects network traffic on the phone itself and examines indicators such as cipher suites, protocol versions, and SSL certificate metadata. This lets it identify rogue hotspots and other situations where communications are open to attack, and make sure sensitive data isn’t sent while it’s at risk of interception. Because the decision is made on the device, the protection goes with the employee to every network they connect to.

Advanced network protection for mobile communications

Countering adversary-in-the-middle attacks

A set of measures that stop bad actors intercepting sensitive communications.

Corrata starts from the assumption that the safety of network infrastructure, including cell towers and Wi-Fi hotspots, can never be accurately assessed. Reflex monitors the quality and integrity of Transport Layer Security instead, and prevents data being sent wherever it finds a vulnerability.

Checking the quality of encryption

Out-of-date cipher suites leave traffic open to snooping and Wi-Fi eavesdropping.

Reflex continuously checks the quality of encryption offered by apps and websites to make sure it can’t be compromised by Wi-Fi attacks. Traffic to apps or websites offering poor encryption can be blocked automatically.

Enforcing certificate pinning for sensitive apps

Attackers can trick employees into trusting servers they control using fake certificates.

Certificate pinning stops devices being misled into trusting malicious websites, apps, or APIs. Corrata can extend certificate pinning to any sensitive domain, whether it’s reached through an app or a browser.

Preventing data being sent in the clear

Sending data to a server without encryption should never be allowed.

Reflex identifies attempts to send data “in the clear” for storage and stops that data being captured in transit. It also helps identify activity that may indicate a malware infection, which ties into Corrata’s mobile spyware detection.

AiTM protection FAQs

What is an adversary-in-the-middle (AiTM) attack?

An adversary-in-the-middle attack is one where an attacker positions themselves between a device and the service it is talking to, so they can intercept or alter the traffic, for example through a rogue Wi-Fi hotspot or a fake certificate. The same term is also used for phishing kits that proxy a real login page to steal session cookies, which our page on mobile phishing protection covers.

How is network traffic on phones vulnerable to attack?

Phones are used mainly over public networks, whether cellular, Wi-Fi, or fixed. Because these networks are public, bad actors can use a range of techniques to intercept and manipulate traffic on them. Employees rely on TLS and SSL certificates to secure their communications, but poor implementation by third parties can leave that protection open to compromise.

Is it just Wi-Fi networks that are vulnerable?

Several features of Wi-Fi make it easier to attack: traffic can be observed as it travels over the air, and hotspots can be faked or compromised. However, many of the techniques used to interfere with traffic on Wi-Fi can also be used on fixed and cellular networks.

How does Reflex protect against AiTM attacks?

Reflex sits between the apps on a phone and the network, so it can examine the quality of encryption on each connection, or spot when there is none. It checks TLS implementation details and SSL certificates for weaknesses and prevents sensitive data being sent where it could be intercepted. Our page on on-device network traffic inspection explains how this works.

Does AiTM protection work on personal phones?

Yes. Corrata protects company-owned and personal iOS and Android devices, and employees can enrol by email or SMS. Because Corrata does not track location, read messages, scan files, or record browsing history, employees can keep their traffic safe on any network without giving up their privacy, an approach we call privacy by architecture.

Detect and stop mobile spyware on employee phones

Exploits like Pegasus are no longer limited to nation states. Corrata spots suspicious activity even when nothing shows…
Device trust that checks every phone at the moment of login

Phones can access the same corporate data as laptops. Corrata ensures only devices known to be secure can…
Govern Shadow AI and enforce DLP on employee phones

Unsanctioned AI tools are a new route out for company data. Corrata lets you monitor their use and…

See Corrata on your own devices

A short call, a live look at the product, and a straight answer on whether it fits your estate.

Request a demo