Yes it would really hard to avoid MITM attacks without any pre-shared information which essentially helps us establish the identity of the parties involved. However, I feel it is still possible to come up with a secure protocol which can avoid MITM attacks(both passive and active).
There is a lot of research being done to perform Zero human interaction authentication, which specifically address this issue of not having a pre-shared secret information.
Please have a look at the following paper.
The idea is usually to use a fuzzy commitment scheme, with some context. Now the catch here is that there exists some information which is uniquely know to both parties but never pre-shared. (for e.g. ambient context - luminosity).
- MITM attack - Since there is no PKI infrastructure/Digital Certicates being used it may be vulnerable to MITM attack. However, it can be overcome if key exchange is designed in a secure fashion and would work in certain use-cases, such as below.[here RS -> reed solomon code, FP -> fingerprint]
Ex. Lets assume A and B wan't to communicate, so
1. A selects a random key K and performs an operation FPa XOR RSencode(K) [Can pass Hash of K for future verification at B]
2. sends the resultant to B.
3. At B, we would perform FPb XOR FPa XOR RSencode(K)
4. Since FPb would be similar to FPa , it might introduce some error in RS(K)
5. However since it is a fuzzy commitment scheme, it is able to tolerate error and thus we are able to reproduce the symmetric key K by performing RSdecode. [Verify K using Hash]
Now, in this scenario, lets assume there is an active eavesdropper E . Even if he/she is able to sniff the data , he won't be able to derive the key, unless he also has a similar fingerprint. So now this brings us to the question, can E sniff/eavesdrop on sensor data too. If the sensors are chosen in a manner that eavesdropping is not feasable/extremely hard then this could be avoided too.
Secondly, if we consider active MITM, the attacker would need to know the FP to even perform an active attack. With the data E has acquired, it should be practically infeasable for E to deduce FP.
Also they use a key-evolution approach to further strenghten there security properties.[details in the paper]
So overall, yes pre-shared information makes it quie easy to do away with MITM attacks, however recent research have shown potential methods achieve a certain sense of security without using any pre-shared information .
For completness, E could definitely corrupt/modify packets sent from A to B and thereby prevent A from authenticating to B (Denial of Service).
Hope this answer was useful and provided some points to ponder about :)