Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in London, and an office in New York, we will use Site-to-Site VPN. We do that to encrypt communications, and also use the routing advantage of the VPN.

What are the chances, and how is it even possible, for outsiders to tap into communications that go unencrypted from my Firewall to my ISP's router and beyond? Is it possible to tap into that traffic in any part of path the packets take to my other office?

I can totally understand the reasons for a Client-to-Site VPN, impemented by SSL VPN or any other methods, because if some roaming user is connecting to his office from some WiFi hotspot, his traffic is being sent in cleartext.

share|improve this question
1  
You introduce your question by discussing VPN, but your question really is "Is there a possibility that an adversary may collect my unencrypted information in the cloud?". Or am I mistaken? If correct, I think this must be retagged, as the question really does not regard encryption or security controls at all. –  Henning Klevjer Dec 7 '12 at 8:38
    
I am discussing VPN as the solution for this challenge - But I am asking the question that appears in the title - Is it possible to tap into communication not encrypted by VPN. –  Franko Dec 7 '12 at 8:57

3 Answers 3

up vote 8 down vote accepted

The data bits which flow one machine to the other must travel in some way, over wires, optic fiber, radio waves or some other medium. At any point, information can be eavesdropped.

The very low-grade attackers will eavesdrop where it is easiest, i.e. close to either end. This is made easy with many WiFi hotspots; it can also be done with wired Ethernet by plugging into the same switch and "convincing" that switch to degrade to hub mode (i.e. broadcast all packets).

Somewhat higher-grade attackers will hijack one of the routers in the path. Each IP packet from machine A to machine B may have to hop through one or two dozens of routers. A router is nothing less than a computer in its own right (although most of them have a special packaging which makes them look like "network equipment"); as such, they have security holes (e.g. see this one, among many others). When an attacker gains complete access to the internal operating system of the router, he can spy on all the packets which go through the router, and also modify them arbitrarily.

Other attackers will plug in between routers. For radio links, this is as easy as having an antenna (some very directional high-frequency links can make that a bit more difficult). When the link is a simple Ethernet, this can be done even by amateurs. If you consider, for instance, a connection from Boston to Chicago, chances are that it will go through subterranean cables, long parts of which being just buried under a few feet of earth. These are not guarded and can be tapped into quite discreetly.

There are reports that some spy agencies have tried to do just that for at least 15 years, targeting no less than undersea cables, which requires a bit more work than just some night-time hiking and a shovel. Interestingly enough, what the NSA found hardest was to process the high bandwidth data (with the then available computing power).

share|improve this answer

Sure. There are probably a couple dozen internet-addressable routers between the two sites, all of which are essentially just computers. It's certainly not impossible to attack them and steal traffic.

In fact, I can see a number of attack vectors:

  • As stated above, attack any of the routers between the two sites.
  • Break into a router on either site (they often have crappy web-based config screens that can be broken fairly easily)
  • Attach patch wires to the local exchange box and steal the data.
  • Walk into one of your buildings and plug a wireless AP or wireless pentesting device into an empty ethernet socket. You'd be surprised how easy this is, especially if you have prospective clients come into your building.
share|improve this answer
    
You mentioned 2 types of vectors here - An outside attack and an inside attack. How can someone from the outside can attack any of the routers between the sites? By finding out my ISP and then mapping the routers the packets can travel to? According to you it would be fairly easy to break into any site's router, are you not over simplifying things? –  Franko Dec 7 '12 at 10:36

I don't think @Polynomial is over simplifying this, no. If you're truly concerned that someone might be motivated enough to specifically target data flowing between 2 of your physical locations (rather than just randomly stumbling across your data amongst the normal flow), then it's absolutely possible (and highly likely) that the person/organization targeting you would figure out your IP addresses, who your ISP(s) are and target their equipment to try and intercept traffic between the IPs in question.

If this is anything more than a trivial "I wonder if..." concern, then I would advise using VPN for ALL traffic between all of your locations and a full review of your security program.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.