CAPEC-157: Sniffing Attacks
Description
In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The target data stream must be transmitted on a medium to which the adversary has access.
Consequences
- Confidentiality
Read Data
Mitigations
- Encrypt sensitive information when transmitted on insecure mediums to prevent interception.