0

So the first reason we give to encrypt content is to prevent against a man in the middle sniffing all data. That is the reason ssh is used and not telnet for example. But in today's networks where there are really no hubs and all switches how easy and how prevalent are packet sniffing attacks?

What exactly needs to be done to get into a situation to sniff data and are there any tools to help?

I am not saying anything about encryption here, its purely a question about the feasibility and/or practicability of packet sniffing attacks. In fact recording encrypted communications might be useful in some scenarios e.g. to do cryptanalysis on the data or other attacks. So how do I sniff data in today's networks?

  • 3
    Connect to a open wifi network, run wireshark and see for yourself. – Ayrx Jun 4 '14 at 5:32
  • 1
    Perhaps this doesn't add much, but the answer is "Super easy." Even someone with no prior "hacking" experience could spend about 10 minutes figuring wireshark out and immediately start sniffing connections. Since its passive, you can't even tell if you're being sniffed. – KnightOfNi Jun 5 '14 at 1:46
2

'How common' is not answerable or useful - you need to look at your risk.

'How easy' is much simpler to answer. It is incredibly easy if you are on the same network segment as an endpoint, but it is also easy if you can compromise a router or switch.

So, if you have data communications that are a target for an attacker, then they will work out how much value that data has for them. The threshold here is pretty low, because of the ease of attack, however it requires the attacker to have a local connection of some kind.

The tools to do this are free and easy to use, so please conduct your own risk assessment to identify the risk to you.

2

As others have said, it is very easy indeed and there are many simple tools available for intercepting data in the clear.

It is also very common. The delivery of malware is generally automated and industrial in scale, many 10's of thousands of machines in a typical botnet. Targeted attacks are more limited in scale but are generally not discovered for months if not years and so have loads of time to sniff out lots of interesting data.

The risk is not limited to direct information theft either, especially in targeted attacks. Data will often reveal or suggest secondary data that will lead to further methods of attack. Shared passwords for example or too generous permissions. Password reuse is very common so sniffing out passwords for one, low-risk but insecure system will lead on to the compromise of secondary more secure systems.

To sniff out data, you've rightly identified that attaching to a switch is of no use. Wi-Fi is a prime target, false access points for example. Routers and servers are common points of compromise where malware or spyware can be installed and left collecting data for long periods before trickling the data out to a C&C server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.