Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude sniffing on the local network (a pretty major exclusion I know, but indulge me), surely the attacker would need to have access to your ISP's servers, the server of the site you're connecting to, or one of the peering networks in between?

Has there ever been any research done on the incidence of this kind of attack?

share|improve this question
2  
The job of SSL/TLS is also to authenticate the server. –  Giacomo Verticale Jan 3 '11 at 2:36
    
Is your question really just: "How likely is it that a packet you send will get sniffed somewhere other than your first hop?" They can sniff your packets whether you use SSL or not. –  rox0r Jan 4 '11 at 7:18
    
Firesheep in your local coffee shop springs to mind... –  Rushyo Jan 5 '11 at 16:15
add comment

4 Answers

up vote 5 down vote accepted

It depends on your threat model. If you're worried about big organizations who really really want to see your data, they're probably going to see it. The hardware and software to do this is generally available to ISPs since they're required by law to provide for "Lawful Intercept" in many jursidictions: http://en.wikipedia.org/wiki/Lawful_interception And unfortunately, the implementations by the router companies are pretty bad, as Forbes notes, so hackers may get access also.

Then there are all the other possible attacks, like DNS cache poisoning, phishing or routing (BGP) attacks, on connections that don't have the good endpoint authentication that SSL provides. See e.g. how the Dalai Lama's organization was hacked. Even security gurus figured they would be vulnerable to that kind of attack.

If no one (including insiders at your ISP or near your destinations) cares about you, you'll probably not be snooped on unless your local network is a convenient and easy target, like most wireless networks are. But if sufficiently savvy and persistent folks (even individuals) do care, beware.

share|improve this answer
add comment

Assuming you trust your connection, I'd imagine the chances of this happening are pretty tiny. Basically, it would need to happen either at your ISP (maybe a misconfguration there sends your traffic to all customers on the same 'node' as you) or the remote end (maybe a misconfigured switch broadcasts traffic to one server to all the ones on the same switch).

I can't really picture that any of the major tier 1 networks have any ability to sniff your traffic. At the speeds they are seeing, it would require some pretty beefy hardware.

share|improve this answer
1  
the ISP's do have the ability. What they don't want is the responsibility - if they admit to being able to check content, they will be forced to change from 'common carrier' to 'provider' in many jurisdictions - bad news for them from a cost and liability perspective. –  Rory Alsop Jan 3 '11 at 13:01
add comment

DNS spoofing/cache poisoning/etc. are also techniques to facilitate MiTM (especially when partnered with sslstrip). ARP spoofing/poisoning is of course popular (this a LAN based attack so maybe it’s excluded given your question).

"How likely" to me is the hard part of your question. If you have something of value it’s possible someone will spend the time to see if they can trick you for their advantage.

Opportunistic attackers seem to play more around wireless networks or other shared networks (unless they can easily commandeer your home router/modem, for example).

share|improve this answer
add comment

It is definitely possible to sniff traffic on a network. Not to mention the different methods presented by the answers already here I would like to write about all the different equipment you are passing through when your connecting to someone on the internet.

Every single equipment you connect too has to be secured against attack, including having to trust that there is no rough insider on the equipment you connect through.

  • If someone is able to login to your ISP's Cisco router and redirect all your traffic through a MITM your are vulnerable
  • If there is a rough insider he can also listen in on all your unencrypted traffic

Please see How to own an ISP in 10 minutes for a proof of concept.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.