What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?

Question

We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude sniffing on the local network (a pretty major exclusion I know, but indulge me), surely the attacker would need to have access to your ISP's servers, the server of the site you're connecting to, or one of the peering networks in between?

Has there ever been any research done on the incidence of this kind of attack?

Answer 1

It depends on your threat model. If you're worried about big organizations who really really want to see your data, they're probably going to see it. The hardware and software to do this is generally available to ISPs since they're required by law to provide for "Lawful Intercept" in many jursidictions: http://en.wikipedia.org/wiki/Lawful_interception And unfortunately, the implementations by the router companies are pretty bad, as Forbes notes, so hackers may get access also.

Then there are all the other possible attacks, like DNS cache poisoning, phishing or routing (BGP) attacks, on connections that don't have the good endpoint authentication that SSL provides. See e.g. how the Dalai Lama's organization was hacked. Even security gurus figured they would be vulnerable to that kind of attack.

If no one (including insiders at your ISP or near your destinations) cares about you, you'll probably not be snooped on unless your local network is a convenient and easy target, like most wireless networks are. But if sufficiently savvy and persistent folks (even individuals) do care, beware.

Answer 2

It is definitely possible to sniff traffic on a network. Not to mention the different methods presented by the answers already here I would like to write about all the different equipment you are passing through when your connecting to someone on the internet.

Every single equipment you connect too has to be secured against attack, including having to trust that there is no rough insider on the equipment you connect through.

• If someone is able to login to your ISP's Cisco router and redirect all your traffic through a MITM your are vulnerable
• If there is a rough insider he can also listen in on all your unencrypted traffic

Please see How to own an ISP in 10 minutes for a proof of concept.

Answer 3

DNS spoofing/cache poisoning/etc. are also techniques to facilitate MiTM (especially when partnered with sslstrip). ARP spoofing/poisoning is of course popular (this a LAN based attack so maybe it’s excluded given your question).

"How likely" to me is the hard part of your question. If you have something of value it’s possible someone will spend the time to see if they can trick you for their advantage.

Opportunistic attackers seem to play more around wireless networks or other shared networks (unless they can easily commandeer your home router/modem, for example).

Answer 4

Assuming you trust your connection, I'd imagine the chances of this happening are pretty tiny. Basically, it would need to happen either at your ISP (maybe a misconfguration there sends your traffic to all customers on the same 'node' as you) or the remote end (maybe a misconfigured switch broadcasts traffic to one server to all the ones on the same switch).

I can't really picture that any of the major tier 1 networks have any ability to sniff your traffic. At the speeds they are seeing, it would require some pretty beefy hardware.