An adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information. The adversary doesn't prevent reception or change content but simply observes and reads the traffic. The attacker might precipitate or indirectly influence the content of the observed transaction, but the attacker is never the intended recipient of the information.
Any target that transmits readable data over a public or multicast network could be attacked in this way.
The attacker must be able to intercept the transmissions containing the data of interest. Depending on the network topology between the recipients, placement of listening equipment may be challenging (such as if both the sender and recipient are members of a single subnet and therefore the listener must also be attached to that subnet.
Solutions and Mitigations
Cryptographic techniques that render a data-stream unreadable can thwart this type of attack.
More information is available — Please select a different filter.
Page Last Updated or Reviewed:
December 07, 2015
Use of the Common Attack Pattern Enumeration and Classification dictionary and classification taxonomy, and the associated references from this website, are subject to the