Detecting "man-in-the-middle' attacks

A system for detecting a man-in-the-middle attack against communications between a client device and a specific remote end point over a network, the system comprising:

• probe software installed on the client device;
• and
• a trusted source accessible from the client device over a secure network connection;
• wherein the probe software is configured to:
• retrieve from the trusted source, over the secure network connection, expected encryption credentials with expected encryption credentials for the remote end point;
• send a connection initiation request from the client device over the network, directed to the remote end point, to at least partially initiate a secure network connection between the remote end point and the client device;
• receive encryption credentials sent to the client device in response to the connection initiation request;
• compare the received encryption credentials with the expected encryption credentials for the remote end point;
• and
• determine that a man-in-the-middle attack is present if the received encryption credentials do no match the expected encryption credentials.