Network sniffing is the practice of using a network interface on a computer system to monitor or capture information [1] regardless of whether it is the specified destination for the information.
An adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines. Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as Telnet, that can be captured and obtained through network packet analysis.
In addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
| ID | Name | Description |
|---|---|---|
| S1045 | INCONTROLLER |
INCONTROLLER can deploy Tcpdump to sniff network traffic and collect PCAP files.[2] |
| S0603 | Stuxnet |
DP_RECV is the name of a standard function block used by network coprocessors. It is used to receive network frames on the Profibus a standard industrial network bus used for distributed I/O. The original block is copied to FC1869, and then replaced by a malicious block. Each time the function is used to receive a packet, the malicious Stuxnet block takes control: it will call the original DP_RECV in FC1869 and then perform postprocessing on the packet data. The replaced DP_RECV block (later on referred to as the DP_RECV monitor) is meant to monitor data sent by the frequency converter drives to the 315-2 CPU via CP 342-5 Profibus communication modules. [3] |
| S1010 | VPNFilter |
The VPNFilter packet sniffer looks for basic authentication as well as monitors ICS traffic, and is specific to the TP-LINK R600-VPN. The malware uses a raw socket to look for connections to a pre-specified IP address, only looking at TCP packets that are 150 bytes or larger. Packets that are not on port 502, are scanned for BasicAuth, and that information is logged. This may have allowed credential harvesting from communications between devices accessing a modbus-enabled HMI. [4] [5] |
| ID | Mitigation | Description |
|---|---|---|
| M0808 | Encrypt Network Traffic |
Ensure that wired and/or wireless traffic is encrypted when feasible. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS. [6] |
| M0932 | Multi-factor Authentication |
Use multi-factor authentication wherever possible. |
| M0930 | Network Segmentation |
Segment networks and systems appropriately to reduce access to critical system and services communications. |
| M0926 | Privileged Account Management |
Restrict root or administrator access on user accounts to limit the ability to capture promiscuous traffic on a network through common packet capture tools. [7] |
| M0814 | Static Network Configuration |
Statically defined ARP entries can prevent manipulation and sniffing of switched network traffic, as some AiTM techniques depend on sending spoofed ARP messages to manipulate network host's dynamic ARP tables. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0800 | Detection of Network Sniffing | AN1932 |
Real-time monitoring identifies a process loading a packet capture driver or executing a known capture utility on an Industrial Control System (ICS) host's network interface, from a process or account not associated with documented network analysis responsibilities. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
| AN2156 |
Real-time monitoring identifies a process opening a raw socket or executing tcpdump/tshark on an Industrial Control System (ICS) Linux asset's network interface, from a User Identifier (UID) that does not normally perform packet capture. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2201 |
Real-time monitoring identifies a new device on the Industrial Control System (ICS) network placing its Network Interface Card (NIC) in promiscuous mode, detectable by anomalous broadcast traffic handling or unauthorized Switched Port Analyzer (SPAN) session requests on managed switches. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2202 |
Real-time monitoring identifies unauthorized Switch Port Analyzer (SPAN) session configuration or port mirroring enabled from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) on an Industrial Control System (ICS) switch. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |