# What is an Eavesdropping Attack?

> An eavesdropping attack is unauthorized observation or capture of communications, commonly performed without altering the traffic or alerting the communicating parties.

- Canonical URL: https://yellowcube.eu/glossary/eavesdropping-attack/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

An adversary may collect message contents, credentials, identifiers, addressing information, timing, volumes, or other metadata from wired, wireless, virtual, or intermediary network points. It is primarily a confidentiality attack, although collected information can enable later attacks.

Plaintext can expose content directly. Sound end-to-end encryption can protect content in transit, but observable metadata may still reveal relationships and behavior. Compromised endpoints or keys, incorrectly authenticated sessions, or authorized intermediaries can expose plaintext despite encryption elsewhere.

### Key points

- **Observation points:** Exposure may occur on a local link, wireless channel, shared or compromised infrastructure, monitoring interface, intermediary service, or endpoint where communications are available in readable form.
- **Detection challenge:** A strictly passive observer sends no traffic and may be invisible to the endpoints. Investigations often focus on how access was obtained, sensor or account changes, key exposure, and resulting misuse.
- **Defensive priorities:** Minimize plaintext protocols, use authenticated end-to-end encryption where appropriate, protect keys and endpoints, control access to captures and telemetry, secure network infrastructure, and limit retained sensitive data.
- **Important limitation:** Encryption does not hide all metadata and cannot protect plaintext before encryption or after decryption. Link encryption may also leave content visible at intermediate systems, and a compromised endpoint can bypass transport protections entirely.

### Related terms

[Man-in-the-middle (MITM) attack](<https://yellowcube.eu/glossary/man-in-the-middle-attack/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Network traffic](<https://yellowcube.eu/glossary/network-traffic/>) · [Wireless security](<https://yellowcube.eu/glossary/wireless-security/>) · [Network monitoring](<https://yellowcube.eu/glossary/network-monitoring/>)

### Sources

[IETF RFC 6973 (Informational): Privacy Considerations for Internet Protocols](https://www.rfc-editor.org/rfc/rfc6973.html) · [RFC 7624 (IAB, Informational): Confidentiality in the Face of Pervasive Surveillance](https://www.rfc-editor.org/rfc/rfc7624.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.