How Hackers Snoop In Your Web Traffic?

With advancement in technology and in the sphere of IT, hacking methods are also evolving. New forms of malware and viruses are being unleashed to cripple, maim and hold a system to ransom. Hackers also use various techniques to snoop into your web traffic and sniff out data of sensitive nature and then use it to hurt you or blackmail you.

Sometimes, when you are on a public network and you don’t use encryption protocols, you could fall prey to snooping. It is called man-in-the-middle attack. A local attacker will sniff your traffic and find out useful login details and other data of sensitive nature through analysis. It tries to spoof your end point authentications to make both ends mutually agreeable to the other and then get entry past the security gateways. Security protocols like SSL which are use in VPNs, etc use end point authentication to prevent such attacks.

ARP poison

Address resolution protocol (ARP) poisoning is a form of hacking where a computer on a network spoofs the router on that network to request another computer on that network to divert traffic to the hacker’s computer. This is a common form of hacking technique and not very sophisticated.

Servers which host too many connections on a single server are often vulnerable to such attacks. It is easy to spoof a router because the ARP only allows the network to map out IPs rather than providing each node (computer) with a table of the mapping.

Other forms of attacks include sending malwares from a single IP address or Trojans from a DDoS launch which uses numerous IP addresses to send a heavy load of traffic to a server so that the server gets overloaded and crashes. The requests sent by the legitimate IP address get blocked.

New form of attack

Hackers, in recent months, have started to reconfigure web proxy configuration in operating systems and web browsers to steal sensitive data. According to a blog post shared by SecurityAsia, Microsoft malware researchers in recent months have found and analyzed Word documents which have malicious codes and they configure the browsers that the victim uses so that they respond to a web proxy used by the hackers.

The hackers embed a self-signed root certificate in the victim’s system in addition to reconfiguring the web proxies of your browsers and then the certificate is used to snoop in on encrypted and secured HTTPS traffic as soon as they pass through the proxy servers controlled by the attackers.

The same post also reports that in a recent conference many researchers presented facts to validate that attackers have started to launch man-in-the-middle attacks to affect Web Proxy Auto-Discovery (WPAD) protocol which allow them to take control of sensitive data and online identities of their victims and then use them to blackmail them to pay them a ransom. Unfortunately, this has been observed even when the victims were using VPN servers or encrypted HTTPs connections.

Conclusion

As hackers become more restive and desperate and the attacks evolve, you have to take every precaution available at your disposal to prevent these. A VPN, despite some weaknesses, will protect you from a large number of attacks. Don’t let your guard down or make it easy for attackers to steal your information or debase your right to privacy.