A man-in-the-middle attack (MITM) is a cyberattack in which a third party (the attacker) secretly inserts themselves into a communication between two parties, eavesdropping on or altering the data in transit. In a postal analogy, it is as if a mail carrier opens a letter, reads or rewrites the contents, and then delivers it.
A classic MITM technique exploits public Wi-Fi. The attacker sets up a rogue access point in a cafe or airport (e.g., "Free_Airport_WiFi"), then intercepts all traffic from anyone who connects. According to IBM, roughly 25% of public Wi-Fi networks are unencrypted and vulnerable to MITM attacks.
The connection between short URLs and MITM attacks centers on HTTP (unencrypted) short URLs. If the redirect is served over HTTP, an attacker can rewrite the Location header and redirect users to a phishing site. Reputable short URL services use HTTPS, which prevents this attack.
The most effective defense against MITM attacks is HTTPS (TLS/SSL). HTTPS encrypts the communication so that even if intercepted, the content cannot be read. Server certificates also verify the identity of the remote party, preventing connections to impersonating servers. Setting the HSTS (HTTP Strict Transport Security) header forces the browser to use HTTPS automatically, blocking HTTP downgrade attacks as well.
A VPN (Virtual Private Network) is another effective countermeasure. A VPN wraps all traffic in an encrypted tunnel, enabling safe communication even on public Wi-Fi. Related books are available on Amazon.