As a security consultant, you are advising a startup that is developing an IoT device for home security. The device communicates with a mobile app, allowing homeowners to monitor their homes in real…

Using CAPTCHA protects against automated login attempts and bots, but it does not secure the communication channel itself against interception and manipulation by a MitM attacker.

Man-in-the-Middle (MitM) attacks involve an attacker intercepting and potentially altering communication between two parties. Implementing SSL/TLS encryption for data transmission creates a secure, encrypted tunnel, ensuring confidentiality and integrity of the data exchanged between the IoT device and the mobile app. Crucially, SSL/TLS also uses digital certificates to authenticate both ends of the connection, preventing an attacker from impersonating either device and successfully executing a MitM attack.

Limiting the range of wireless signals primarily addresses physical security concerns like wardriving or unauthorized access from afar, but it does not prevent a MitM attack if the attacker is positioned within the operational range.

Frequently changing an IoT device's IP address offers no protection against MitM attacks, as these attacks target the communication channel and cryptographic protocols, not the specific IP address of the device.