Network eavesdropping attacks, also known as network sniffing or network snooping attacks, occur when malicious actors take advantage of insecure network connections to exfiltrate data as it is being communicated.
Just as someone eavesdrops on a conversation between two people, network eavesdropping involves listening in on conversations across network components, including servers, computers, smartphones or other connected devices.
In network eavesdropping attacks, hackers look for weak connections between clients and servers: those that are not encrypted, use devices or software that are not up to date or have malware installed via social engineering. By exploiting these weak connections, hackers intercept data packets traversing the network. Any network, web or email traffic, if not encrypted, can be read by the hacker.
Many times, hackers install sniffer programs. These legitimate applications, such as Wireshark, Snort or tcpdump, are often used by security teams to monitor and analyze network traffic to detect issues and vulnerabilities. However, these applications also can be used by bad actors to spot the same vulnerabilities and exploit them.
Network eavesdropping attacks can be passive or active. In a passive eavesdropping attack, the hacker or sniffer program only gathers intel on its target -- the data is never altered. Voice over IP (VoIP) eavesdropping is an example of a passive eavesdropping attack. During VoIP eavesdropping, a hacker or sniffer will infiltrate the network through a compromised VoIP device or via part of the VoIP infrastructure, such as a switch, cable or internet, and listen in on unencrypted VoIP calls.
In active eavesdropping attacks, hackers insert themselves into the network and masquerade themselves as legitimate connections. In active attacks, hackers can inject, modify or block packets. The most common active eavesdropping attack is a man-in-the-middle (MitM) attack. MitM attacks usually infiltrate systems through malware or spoofing attacks, including Address Resolution Protocol, DNS, Dynamic Host Configuration Protocol, IP or MAC address spoofing. Once attackers get into the system via MitM attacks, they can not only capture data, but also manipulate and send it to other devices and users by purporting to be a legitimate party.
Unfortunately, detecting and preventing passive network eavesdropping attacks are extremely difficult, if not impossible, as there are no disruptions or changes to the network. Active attacks are easier to detect, but often, data is already intercepted by the time network changes are noticed.
As with most things security, an ounce of prevention is worth a pound of cure. Here's a rundown of the best ways to prevent network eavesdropping attacks:
19 Jun 2020