ByteOS Network

CAPEC-158:Sniffing Network Traffic

Attack Pattern ID:158

Version:v3.9

Attack Pattern Name:Sniffing Network Traffic

Abstraction:Detailed

Status:Draft

Typical Severity:Medium

Details Content History Related Weaknesses Reports

▼Description

In this attack pattern, the adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information at the protocol level. Network sniffing applications can reveal TCP/IP, DNS, Ethernet, and other low-level network communication information. The adversary takes a passive role in this attack pattern and simply observes and analyzes the traffic. The adversary may precipitate or indirectly influence the content of the observed transaction, but is never the intended recipient of the target information.

▼Relationships

Nature	Type	ID	Name
ChildOf	S	157	Sniffing Attacks
CanFollow	S	697	DHCP Spoofing

Nature: ChildOf

Type: Standard

ID: 157

Name: Sniffing Attacks

Nature: CanFollow

Type: Standard

ID: 697

Name: DHCP Spoofing

▼Prerequisites

The target must be communicating on a network protocol visible by a network sniffing application.

The adversary must obtain a logical position on the network from intercepting target network traffic is possible. Depending on the network topology, traffic sniffing may be simple or challenging. If both the target sender and target recipient are members of a single subnet, the adversary must also be on that subnet in order to see their traffic communication.

▼Skills Required

Low

Adversaries can obtain and set up open-source network sniffing tools easily.

▼Resources Required

A tool with the capability of presenting network communication traffic (e.g., Wireshark, tcpdump, Cain and Abel, etc.).

▼Consequences

Scope	Likelihood	Impact	Note
Confidentiality	N/A	Read Data	N/A

Scope: Confidentiality

Likelihood: N/A

Impact: Read Data

Note: N/A

▼Mitigations

Obfuscate network traffic through encryption to prevent its readability by network sniffers.

Employ appropriate levels of segmentation to your network in accordance with best practices.

▼Related Weaknesses

ID	Name
CWE-311	Missing Encryption of Sensitive Data

ID: CWE-311

Name: Missing Encryption of Sensitive Data

▼Taxonomy Mappings

Taxonomy Name	Entry ID	Entry Name
ATTACK	1040	Network Sniffing
ATTACK	1111	Multi-Factor Authentication Interception

Taxonomy Name: ATTACK

Entry ID: 1040

Entry Name: Network Sniffing

Taxonomy Name: ATTACK

Entry ID: 1111

Entry Name: Multi-Factor Authentication Interception