Eavesdropping attacks: how they work, types, detection and prevention

What is an eavesdropping attack?

In security terms, eavesdropping is a passive attack: one that "does not alter systems or data", in the definition NIST's glossary takes from CNSSI 4009. The ITU-T's X.800 security architecture describes passive threats the same way, as threats that would not modify any information, and gives observing data on a communications line as its example. Security teaching usually splits passive attacks in two:

• Release of message contents: reading what was sent, such as a password, a contract or a medical record.
• Traffic analysis: learning from the pattern of communication (who talks to whom, when, how often and how much) even when the content is encrypted. X.800 lists traffic padding among the protections against it.

The attacker needs only two things: a position where the traffic passes, and a way to make sense of it. A position can be physical (a cable, a switch port, a room), logical (a compromised router, a cloud account that can mirror traffic) or radio (anywhere within range of a Wi-Fi or Bluetooth signal).

What gets stolen is rarely the conversation for its own sake. It is credentials that unlock other systems, session cookies, invoices that can be altered for payment fraud, or intelligence gathered over months.

Passive vs active eavesdropping

The line between the two is whether the attacker changes anything to get the data.

Active eavesdropping overlaps with the manipulator-in-the-middle (MITM) attack, which MITRE ATT&CK tracks as adversary-in-the-middle (T1557). The attacker positions themselves between two parties, relays their traffic so nothing looks broken, and reads or alters it on the way. Our guide to man-in-the-middle attacks covers that active side in depth, including phishing proxies that get past MFA.

How an eavesdropping attack works

Whatever the medium, an attack runs through the same three stages.

1. Get into position. Join the same Wi-Fi, plug into a spare port, compromise a device on the path, or gain access to a cloud account. MITRE notes that attackers with network access can use switch port mirroring (SPAN) to see far more traffic, and in the cloud can use native features such as AWS Traffic Mirroring, Google Cloud Packet Mirroring or Azure virtual network TAP.
2. Capture. Put an interface into promiscuous mode and record with a packet sniffer such as Wireshark or tcpdump, the same tools administrators use every day, or run malware that captures keystrokes, audio or the screen on the endpoint itself.
3. Extract. Filter the capture for credentials, cookies, files and message content; crack captured password hashes offline; or build a picture from metadata when the content is encrypted.

One detail makes cloud and data-centre networks more exposed than they look: TLS often ends at a load balancer or reverse proxy, and traffic behind it travels unencrypted between internal services. An attacker who can mirror that internal traffic sees it in the clear.

Types of eavesdropping attacks

Network sniffing on wired networks

On a modern switched network, a device only receives its own traffic, so an attacker has to change that first. The usual methods are ARP cache poisoning (MITRE T1557.002), where forged ARP replies make other hosts send their traffic to the attacker's MAC address, and abusing a mirroring port. Old protocols that send credentials in clear text, such as Telnet, FTP, HTTP, SNMPv1 and v2c, and POP3 or IMAP without TLS, turn a short capture into a list of passwords.

Wi-Fi eavesdropping and evil twin access points

Radio does not stop at the wall. On an open network, anyone nearby can record unencrypted traffic. On a WPA2-Personal network, everyone who knows the shared password can, with some effort, decrypt each other's traffic, and a captured handshake lets an attacker try to guess a weak password offline.

An evil twin (MITRE T1557.004) is a rogue access point broadcasting the same network name (SSID) as a real one, often with a stronger signal, so phones and laptops join it and route everything through the attacker.

WPA3 raises the bar: WPA3-Personal resists offline password guessing, and Protected Management Frames, which WPA3 requires, protect management frames from eavesdropping and forging. On guest networks, Wi-Fi Enhanced Open encrypts traffic even without a password.

Manipulator-in-the-middle and SSL stripping

An attacker in the middle can proxy HTTPS and present their own certificate, which a careful browser flags with a warning, or try to strip the connection down to plain HTTP when a user types a bare domain name. HTTP Strict Transport Security (HSTS, RFC 6797) closes that gap by telling browsers to use HTTPS only for the site. A valid, current certificate is part of that defence, which is why renewing SSL certificates on time is a security task, not an admin chore.

VoIP and video call eavesdropping

Voice over IP uses SIP to set up calls and RTP to carry audio. When RTP is not encrypted, anyone who captures the packets can reassemble the conversation. SRTP (RFC 3711) encrypts the media, and SIP over TLS protects the signalling. Most business phone systems support both, but they are not always enabled, especially on older on-premises PBXs and cheap desk phones.

Email, SMS and messaging interception

Email between servers is often protected only by opportunistic STARTTLS, which a downgrade can remove. The quieter technique is inside the mailbox: an attacker who briefly controls an account adds a forwarding rule that copies mail to an outside address (MITRE T1114.003), which keeps working after the password is reset.

Phone networks are a target too. CISA's Mobile Communications Best Practice Guidance, first issued in December 2024 and revised since, responds to intrusions into commercial telecommunications infrastructure attributed to PRC-affiliated actors, which led to the theft of call records and the compromise of some private communications. Its first recommendation is to use only end-to-end encrypted communications, and it advises moving away from SMS-based multi-factor authentication.

Malware, spyware and keyloggers

When the channel is well encrypted, attackers go to the endpoint, where data exists in the clear. Keyloggers, screen capture and microphone capture (MITRE T1056.001 and T1123) record information before it is ever encrypted. This is why endpoint protection and patching belong in any anti-eavesdropping plan.

Acoustic and electromagnetic side channels

Some eavesdropping needs no network at all. In a 2023 study, researchers trained a model on the sound of laptop keystrokes and identified them with 95% accuracy from a nearby smartphone recording and 93% from a Zoom call. Electromagnetic emanations from screens and cables are the older version of the same idea, long studied under the name TEMPEST. For most organizations these are edge cases, but they are a reason not to type passwords while sharing audio on a call.

Real-world examples of eavesdropping

• Telecom interception at national scale. The intrusions behind CISA's mobile guidance show that carrier networks themselves can be the eavesdropping point, which is why the guidance favours end-to-end encryption over trusting the network.
• Business email compromise. Forwarding rules and quiet mailbox access let attackers read invoice threads for weeks, then send a convincing request to change bank details. MITRE lists hidden forwarding rules as a known way to keep this access.
• Public Wi-Fi. Evil twins and open networks remain a practical way to capture traffic from travellers, which is why MITRE's mitigations include wireless intrusion prevention and teaching users to take certificate warnings seriously.
• Keyboard acoustics. The 2023 acoustic study is research, not an incident, but it shows how little equipment an attacker needs when a microphone is already on the desk.

Methods of eavesdropping detection

Pure listening is close to invisible. Detection works because attackers have to set something up first, and those setup steps leave evidence.

How to prevent eavesdropping on a data network

The single most effective technique is encryption of data in transit, so that whatever an attacker captures is unreadable. The rest limits where an attacker can stand and what captured data is worth.

For businesses

1. Encrypt every connection. Serve websites and APIs over TLS 1.2 or 1.3 only, with HSTS, and encrypt internal service-to-service traffic too, not just the public edge.
2. Retire clear-text protocols. Replace Telnet with SSH, FTP with SFTP, and move SNMP to v3, mail access to IMAP or POP3 over TLS, and DNS to DNS over TLS or HTTPS where your resolvers support it.
3. Secure the wireless network. Use WPA3-Enterprise with 802.1X for staff, a separate guest network with Wi-Fi Enhanced Open or WPA3, and wireless intrusion detection for rogue access points.
4. Harden switches. Enable port security, DHCP snooping and Dynamic ARP Inspection, and restrict who can create mirroring sessions. For links that leave your control, consider MACsec.
5. Segment the network. Keep payment, management and guest traffic in separate segments, so one foothold does not see everything.
6. Make stolen credentials useless. Enforce phishing-resistant multi-factor authentication (FIDO2 security keys or passkeys) so a sniffed password is not enough.
7. Lock down email. Block automatic forwarding to external domains, alert on new inbox rules and review third-party app permissions.
8. Protect endpoints. Patch quickly, run endpoint detection and response, and treat unknown USB devices as suspect.
9. Encrypt calls and chat. Enable SRTP and SIP over TLS on phone systems, and use end-to-end encrypted messaging for sensitive conversations.

For individuals and remote workers

• Prefer mobile data or a trusted VPN on public Wi-Fi, and forget networks you no longer use so devices do not auto-join a look-alike.
• Check for HTTPS on any page that asks for a password, and never click through a certificate warning.
• Use a password manager and passkeys, and move off SMS codes where a service offers an app, a passkey or a security key.
• Keep your router's firmware updated, change its default admin password and use WPA3 if your devices support it.
• Mute your microphone before typing a password while you share audio on a call.

Eavesdropping, snooping, sniffing and MITM compared

If you are not sure where your own exposure is, our security testing service checks the exposed surface an eavesdropper would start from: weak TLS settings, clear-text services and misconfigured email. For the day-to-day controls in the list above, from Wi-Fi to device patching, our IT support team runs them as part of looking after your people and devices.