Passive Sniffing Attack
See also, Passive Reconnaissance
Passive sniffing is a fundamental technique used in reconnaissance and hacking that focuses on monitoring and intercepting network traffic without actively interacting with or modifying the data in transit or the target systems.
Here is a comprehensive breakdown of passive sniffing based on the sources:
Characteristics and Definition
- Nature of the Attack: Passive attacks generally do not tamper with the data and primarily involve intercepting and monitoring network traffic and data flow on the target network.
- Interaction: Passive sniffing involves no active interaction with the target system or network, and it means sending no packets.
- Detection Difficulty: These attacks are typically difficult to detect because the attacker does not send any traffic actively. They provide significant stealth advantages over active sniffing.
- Objective: The goal is to monitor packets sent by others. Attackers perform reconnaissance on network activities using sniffers to capture unencrypted data in transit, clear-text credentials, or other sensitive information useful for performing active attacks later.
Operation and Environment
Passive sniffing is highly effective in certain network environments:
-
Hub-Based Networks (Shared Ethernet): This is the classic environment for passive sniffing.
- Mechanism: In a shared Ethernet environment (using a hub), a single bus connects all hosts, and all machines receive packets meant for one specific machine. Because hubs broadcast all traffic to all ports, an attacker running a sniffer can easily capture all traffic flowing through the hub.
- Collision Domain: Passive sniffing works effectively within a common collision domain—a network sector that is not switched or bridged.
-
Switched Networks (Limited Use): Most modern networks use switches, which eliminate the risk of passive sniffing by directing traffic only to the intended recipient. However, passive sniffing can still occur if traffic is re-routed through other methods.
- Active vs. Passive: Since switches regulate data flow, if an attacker wants to sniff a switched network, they must employ active sniffing techniques (like MAC flooding or ARP poisoning) to force the switch to behave like a hub.
Techniques Related to Passive Information Gathering
Passive activities are prominent in the reconnaissance phase and are closely related to passive sniffing:
| Technique | Description | Context |
|---|---|---|
| Footprinting/Reconnaissance | Gathering information about a target without direct interaction. | Relies on publicly available or stored information (e.g., search engines, social media, proprietary databases). |
| Sniffing and Eavesdropping | Intercepting and monitoring data flow, including capturing data packets containing sensitive information like passwords, account info, and clear-text credentials. | Often used against insecure protocols like Telnet, HTTP, SNMPv1/v2, FTP, and email protocols (SMTP, POP, IMAP). |
| Network Traffic Analysis | Observing external traffic characteristics to infer information. | Attackers analyze captured data to determine broadcasted SSIDs, authentication methods, encryption, and the possibility of recovering SSIDs. |
| Passive Banner Grabbing | Identifying the operating system or application version of a remote system by capturing and analyzing packets from the target host via sniffing, rather than actively probing it. | This method examines characteristics like TTL (Time To Live), Window Size, and the presence of the DF (Don't Fragment) bit in sniffed packets. |
| Passive Vulnerability Scanning | Identifying vulnerabilities by monitoring information exposed by systems during normal communications without directly interacting with the network. | This method identifies active operating systems, applications, and ports, but cannot provide a path for directly combating attacks. |
| Passive Sniffing in Cloud | Monitoring and interception of network traffic between two cloud nodes; unencrypted sensitive data (e.g., login credentials) during transmission across a network are at high risk. | Attackers can sniff credentials/cookies using tools like Wireshark and Capsa Portable Network Analyzer. |
| Passive Wireless Sniffing | Detecting the existence of an Access Point (AP) by sniffing the packets from the airwaves (beacons, probes, etc.), which reveals the AP, SSID, and other device information. | The attacker does not attempt to connect or inject data packets. |
Sniffing Mechanism (Common to Active and Passive)
Whether active or passive, sniffing relies on turning the Network Interface Card (NIC) of a system into promiscuous mode.
- Promiscuous Mode: When a machine runs a sniffer, it turns its NIC into promiscuous mode, allowing it to bypass the standard filter that prevents the host from reading traffic addressed to other devices. In this mode, the NIC listens to and accepts all data transmitted on its segment, regardless of the destination MAC address.
- OSI Layer: Sniffers typically operate at the Data Link Layer (Layer 2) of the OSI model.
Related Passive Attacks
Passive attacks related to sniffing include:
- Eavesdropping: Unauthorized listening of conversations or reading of messages, which involves the interception of communication such as audio, video, or text.
- Shoulder Surfing: Secretly observing a target to gather critical information like passwords or PINs.
- Dumpster Diving: Searching through trash bins to retrieve sensitive information like bills, contact information, source codes, or sticky notes with passwords.
- Passive Wiretapping: Snooping or eavesdropping to monitor and record traffic to find passwords or other information.