Sniffing attacks are becoming a thing of the past. Or not?

[Father]

It would seem that all digital information transmission channels are already encrypted, and some even twice. Intercepting other people's traffic is almost impossible and very labor-intensive. But sniffing attacks still appear in incident reports. Even if much less often than ten years ago.

How and why do attackers "listen" to other people's traffic? Will sniffing attacks be relevant in the future? About this and more-in a new article by Cyber Media.

Theory with history, or What is sniffing?​

We remind you that most often sniffing in information security is called unauthorized interception and analysis of network packets. A crime is committed using a special class of sniffer apps. If such tools are used for pentests and other good purposes, they are called "traffic analyzers". tcpdump and tshark are considered classic solutions of this type.

A sniffing attack is an incident in which attackers "listen" to transmitted information on the network (as in the case of telephone conversations). The main goal of hackers is to obtain data about a user or company, which can then be used for criminal purposes.

Fyodor Muzalevsky
Director of the Technical Department of RTM Group

If we limit ourselves to hacking situations (we will also include penetration testing here), then sniffers are most often used to analyze traffic in order to find credentials, as well as confidential information.

Less often, these tools are used to intercept and fake requests.To do this, the attacker must be in certain conditions. Between the victim and the server, for example (the so-called man-in-the-middle attack). In addition, traffic capture and analysis tools are used to track traffic flows and resources visited by the victim.

The maximum number of sniffing attacks occurred in the 1990s. However, they also happen in our time. For example, in January 2020, it became known about criminals from Indonesia who infected almost two hundred sites with the GetBilling JS sniffer. The list of victims included online stores in the United States, Brazil, Australia and other countries.

The second high-profile example is the sniffing attack on British Airways. In 2018, using the same JS-sniffer, criminals managed to intercept the financial and personal data of 380 thousand users of the company's website and mobile application.

What about today?​

Sniffers are still part of the hacker's basic toolkit. However, they are rarely used and in special cases, experts say. The fact is that current information transfer protocols are usually well protected from such malware.

Sergey Polunin
Head of the Infrastructure IT Protection Group at Gazinformservis

You need to understand that the days of unencrypted data transfer protocols are long gone. Now in corporate environments, you will no longer find telnet, imap, irc and similar communication protocols that previously did not involve any encryption. They have long been replaced by more reliable counterparts, and even simple HTTP is now almost never used.

At the same time, attackers do not despair and find effective ways to bypass encryption. If they succeed, they intercept the traffic. Especially if you have already managed to get to the company's internal network, explains Sergey Polunin.

Andrey Shabalin
Data Analysis Analyst at NGR Softlab

The main application area of sniffers is gradually shifting towards industrial espionage: in this regard, expensive hardware and software complexes are being developed that allow access to encrypted information with a high level of security.

Sometimes attackers do not even try to bypass encryption and are content with passively collecting encrypted data. It helps you identify the file and mail servers that the client communicates with, domain controllers, and DNS servers without additional network scanning and security measures being triggered.

In addition, a new type of sniffer has been developed in recent years. These include solutions for intercepting network traffic distributed over radio channels, Wi-Fi, and GSM.

Alexey Semenychev
Head of the Department of expertise and analytics of the company "Garda Technologies "(part of the group of companies "Garda")

Wi-Fi traffic is actively used in organizations, even for accessing trusted network segments. Often, guest segments of Wi-Fi networks in organizations either do not have passwords or use very simple passwords, which makes it easier for attackers to access the traffic of such networks and the encryption keys used. This allows you to decrypt someone else's traffic and get the necessary data about accounts, services used, and possibly passwords from it.

Another risk factor is the GSM standard. Mobile devices continue to use it for communication when more modern protocols are not available. Listening to such traffic does not require significant computing resources, but it can provide hackers with a lot of confidential information transmitted in conversations and SMS messages, experts say.

Alexey Semenychev
Head of the Department of expertise and analytics of the company "Garda Technologies "(part of the group of companies "Garda")

A separate vector for radio channels is interception of data entered from radio and Bluetooth keyboards. Manufacturers of second-tier computer peripherals often neglect strong encryption in the radio modules of their keyboards and use outdated versions of Bluetooth, which allows you to get identifiers of the keys being pressed from the intercepted traffic, including restoring logins and passwords of accounts.

It's not just keyboards that are sensitive to Bluetooth attacks, adds Alexey Semenychev. This type of attack can affect IoT and mobile devices. And this is confirmed by the latest news. So, in September, the presentation of a device based on the Raspberry Pi Zero 2 W device, which can hack any gadget from Apple, took place.

At the same time, hackers in the process of sniffing are increasingly using modern tools that allow you to automate many operations. An example is BetterCap, which initially collects information for a MITM (Man-in-The-Middle) attack and then automatically searches for credentials in traffic.

Evgeny Gryaznov
R-Vision TDP Product Manager at R-Vision

However, if SSL Pinning is not used, even HTTPS traffic can still be monitored. Some mobile app developers still believe that if you wrap traffic in HTTPS, then you don't need to encrypt your credentials or bank data during transmission, but this is a serious mistake.

According to the expert, BetterCap can also be used in conjunction with tools for creating false access points. For example, to the most popular free Wi-Fi network in the capital – MT_FREE. If your smartphone doesn't automatically connect to Wi-Fi hotspots, you can easily become a victim of a MITM attack.

Future sniffers​

Sniffing as a means of intercepting traffic will become a thing of the past. This is the opinion of some Cyber Media interlocutors.

Sergey Polunin
Head of the Infrastructure IT Protection Group at Gazinformservis

The widespread adoption of encryption protocols does not leave a chance to simply eavesdrop on traffic. Attackers will only have to hope for errors in the implementation of this encryption itself or the negligence of administrators who will not be able to correctly configure it.

Other experts believe that attackers will continue to find vulnerabilities in existing data transmission methods and encryption protocols. But sniffing itself will change significantly-in response to new technologies and security tools.

Evgeny Gryaznov
R-Vision TDP Product Manager at R-Vision

As encryption and the secure development ideology of SDLC are implemented at the earliest stages, attackers may switch to other protocols. For example, on WPA 3.0, which almost completely eliminates a number of attacks on Wi-Fi networks.
The reverse implementation of popular protocols like Apple's Bluetooth, which allows anyone to send false data to the phone and thereby practically block its operation, showed that even popular protocols still have interesting and new attack vectors.

While the purpose of such attacks, as experts explain, remains the search for confidential data. But over time, the analysis of resources that a person visits may come to the fore.

Fyodor Muzalevsky
Director of the Technical Department of RTM Group

Search for resources used by the victim is becoming increasingly popular. After all, it is this information that is convenient to use in the social engineering that is so widespread now. Most likely, criminals will develop in this direction in the near future.

Indeed, traffic interception can become a pinpoint weapon that is used to collect information about employees or the company as a whole. However, the success of such attacks in the future is still doubtful for experts.

Ilya Samsonov
Chief Operating Officer of MediaPro

The growth of public awareness of security issues will also have an impact. With increased cybersecurity awareness and training of organizations ' personnel, the number of successful attacks may decrease. Including using sniffing.

In any case, traffic encryption and network security will be enhanced, and the information available for interception will be reduced. However, this will not stop attackers-they will start looking for new ways to bypass protection, experts warn.

Alexander Zubrikov
General Director ITGLOBAL.COM Security

For example, using social engineering to collect access through phishing attacks or using malware to spoof digital certificates.

In addition, with the development of smart devices and the Internet of Things, sniffing can gain access to sensitive information transmitted between devices, such as smart homes and medical devices.

The evolution of traffic interception is a logical response to changes in information security technologies and environments. That is why sniffing can become more intelligent and large-scale in the future.

Jeannette Magomedova
Senior lecturer of the Information Security Department of MTUCI

Expected trends include targeting multiple platforms (mobile devices, cloud services, IoT networks), as well as the use of artificial intelligence and machine learning to analyze and process intercepted data.

Conclusions​

We should not forget about sniffing as a potential threat, according to Cyber Media's interlocutors. Although traffic interception tools have ceased to be a massive weapon in the hands of hackers, they are still capable of causing irreparable damage to the company.

Moreover, sniffers will definitely develop, albeit in a new field – in wireless data transmission technologies. Time will tell how powerful this evolution will be. And new public cases of successful sniffing attacks, of course.