Malicious packet sniffing
In this video, we'll discuss
packet sniffing, with a focus on how
threat actors may use this technique to
gain unauthorized access to information.
Previously, you learned about
the information and data packets
that travel across the network.
Packets include a header which contains
the sender's and receiver's IP addresses.
Packets also contain a body, which
may contain valuable information like names,
date of birth, personal messages,
financial information, and credit card numbers.
Packet sniffing is the practice of using
software tools to observe
data as it moves across a network.
As a security analyst,
you may use packet sniffing to analyze and capture
packets when investigating ongoing incidents
or debugging network issues.
Later in this certificate program,
you'll gain hands-on practice
with some packet sniffing software.
However, malicious actors may also use
packet sniffing to look at
data that has not been sent to them.
This is a little bit like opening somebody else's mail.
It's important for you to learn about how
threat actors use packet sniffing
with harmful intent so you can be
prepared to protect against these malicious acts.
Malicious actors may insert themselves in the middle of
an authorized connection between two devices.
Then they can use packet sniffing to spy on
every data packet as it comes across their device.
The goal is to find valuable information in
the data packets that they can
then use to their advantage.
Attackers can use software applications
or a hardware device to look into data packets.
Malicious actors can access a network packet with
a packet sniffer and make changes to the data.
They may change the information
in the body of the packet,
like altering a recipient's bank account number.
Packet sniffing can be passive or active.
Passive packet sniffing is a type of
attack where data packets are read in transit.
Since all the traffic on a network
is visible to any host on the hub,
malicious actors can view
all the information going
in and out of the device they are targeting.
Thinking back to the example of a letter being delivered,
we can compare a passive packet sniffing
attack to a postal delivery person
maliciously reading somebody's mail.
The postal worker, or packet
sniffer, has the right to deliver the mail,
but not the right to read the information inside.
Active packet sniffing is a type of
attack where data packets are manipulated in transit.
This may include injecting
internet protocols to redirect the packets to
an unintended port or
changing the information the packet contains.
Active packet sniffing attack would
be like a neighbor telling the delivery person
"I'll deliver that mail for you," and then reading the mail
or changing the letter before putting it in your mailbox.
Even though your neighbor knows you
and even if they deliver it to the correct house,
they are actively going out of
their way to engage in malicious behavior.
The good news is that
malicious packet sniffing can be prevented.
Let's look at a few ways
the network security professional
can prevent these attacks.
One way to protect against
malicious packet sniffing is to use
a VPN to encrypt and protect
data as it travels across the network.
If you don't remember how VPNs work,
you can revisit the video about
this topic in the previous section of the program.
When you use a VPN,
hackers might interfere with your traffic,
but they won't be able to decode it
to read it and read your private information.
Another way to add a layer of
protection against packet sniffing is to make sure
that websites you have use
HTTPS at the beginning of the domain address.
Previously, we discussed how HTTPS uses SSL/TLS to
encrypt data and prevent eavesdropping
when malicious actors spy on network transmissions.
One final way to help protect yourself against
malicious packet sniffing is to
avoid using unprotected WiFi.
You usually find unprotected WiFi in
public places like coffee shops,
restaurants, or airports.
These networks don't use encryption.
This means that anyone on the network can access
all of the data traveling to and from your device.
One precaution you can take is avoiding
free public WiFi unless you have
a VPN service already installed on your device.
Now you know how threat actors may use
packet sniffing and how to
protect a network from these attacks.
Let's move on to discuss other network intrusions.
No Comments