| 名称 |
Sniffing Network Traffic |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
In this attack pattern, the adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information at the protocol level. Network sniffing applications can reveal TCP/IP, DNS, Ethernet, and other low-level network communication information. The adversary takes a passive role in this attack pattern and simply observes and analyzes the traffic. The adversary may precipitate or indirectly influence the content of the observed transaction, but is never the intended recipient of the target information. |
| 前置条件 |
The target must be communicating on a network protocol visible by a network sniffing application. The adversary must obtain a logical position on the network from intercepting target network traffic is possible. Depending on the network topology, traffic sniffing may be simple or challenging. If both the target sender and target recipient are members of a single subnet, the adversary must also be on that subnet in order to see their traffic communication. |
| 解决方案 | Obfuscate network traffic through encryption to prevent its readability by network sniffers. Employ appropriate levels of segmentation to your network in accordance with best practices. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-311 |
Missing Encryption of Sensitive Data |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-157 |
In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1040 |
Network Sniffing |
| 1111 |
Multi-Factor Authentication Interception |
|