How can an outsider tap into communications between two physical sites?

Question

When referring to 'Sites' - I am not talking about a website, but of a physical place where a company resides. Today, to secure communications between two sites - Let's say between an office in London, and an office in New York, we will use Site-to-Site VPN. We do that to encrypt communications, and also use the routing advantage of the VPN.

What are the chances, and how is it even possible, for outsiders to tap into communications that go unencrypted from my Firewall to my ISP's router and beyond? Is it possible to tap into that traffic in any part of path the packets take to my other office?

I can totally understand the reasons for a Client-to-Site VPN, impemented by SSL VPN or any other methods, because if some roaming user is connecting to his office from some WiFi hotspot, his traffic is being sent in cleartext.

Answer 1

The data bits which flow one machine to the other must travel in some way, over wires, optic fiber, radio waves or some other medium. At any point, information can be eavesdropped.

The very low-grade attackers will eavesdrop where it is easiest, i.e. close to either end. This is made easy with many WiFi hotspots; it can also be done with wired Ethernet by plugging into the same switch and "convincing" that switch to degrade to hub mode (i.e. broadcast all packets).

Somewhat higher-grade attackers will hijack one of the routers in the path. Each IP packet from machine A to machine B may have to hop through one or two dozens of routers. A router is nothing less than a computer in its own right (although most of them have a special packaging which makes them look like "network equipment"); as such, they have security holes (e.g. see this one, among many others). When an attacker gains complete access to the internal operating system of the router, he can spy on all the packets which go through the router, and also modify them arbitrarily.

Other attackers will plug in between routers. For radio links, this is as easy as having an antenna (some very directional high-frequency links can make that a bit more difficult). When the link is a simple Ethernet, this can be done even by amateurs. If you consider, for instance, a connection from Boston to Chicago, chances are that it will go through subterranean cables, long parts of which being just buried under a few feet of earth. These are not guarded and can be tapped into quite discreetly.

There are reports that some spy agencies have tried to do just that for at least 15 years, targeting no less than undersea cables, which requires a bit more work than just some night-time hiking and a shovel. Interestingly enough, what the NSA found hardest was to process the high bandwidth data (with the then available computing power).

Answer 2

Sure. There are probably a couple dozen internet-addressable routers between the two sites, all of which are essentially just computers. It's certainly not impossible to attack them and steal traffic.

In fact, I can see a number of attack vectors:

• As stated above, attack any of the routers between the two sites.
• Break into a router on either site (they often have crappy web-based config screens that can be broken fairly easily)
• Attach patch wires to the local exchange box and steal the data.
• Walk into one of your buildings and plug a wireless AP or wireless pentesting device into an empty ethernet socket. You'd be surprised how easy this is, especially if you have prospective clients come into your building.

Answer 3

I don't think @Polynomial is over simplifying this, no. If you're truly concerned that someone might be motivated enough to specifically target data flowing between 2 of your physical locations (rather than just randomly stumbling across your data amongst the normal flow), then it's absolutely possible (and highly likely) that the person/organization targeting you would figure out your IP addresses, who your ISP(s) are and target their equipment to try and intercept traffic between the IPs in question.

If this is anything more than a trivial "I wonder if..." concern, then I would advise using VPN for ALL traffic between all of your locations and a full review of your security program.