Passive attack
A passive attack observes without touching: the attacker intercepts information in transit or collects it from where it is already exposed, changing nothing and provoking no response from the system. It is hard to detect precisely because it generates no activity, and it is rarely the whole attack. It is the phase that makes the next one cheap.
How it works
The definition rests on one sentence: the attacker sends nothing to the target, or sends so little that it blends into normal traffic. They listen to a network, capture packets, read metadata, and collect what the organisation publishes without realising it publishes it. Because nothing is modified or interrupted, the target system has no event to log.
The classic case is capturing traffic on a shared segment or on a wireless network: anything travelling unencrypted is readable, and what travels encrypted still reveals who talks to whom, when, and how much. That pattern analysis, without ever reaching the content, is usable intelligence on its own.
The other half never touches the target’s network at all. Collecting what the organisation has made public (names, addresses, technologies, files with metadata inside them) is OSINT, and it is the most passive way of preparing an attack that exists. In the reconnaissance phase the two are used together.
Passive does not mean harmless
A passive attack is almost never the end goal: it is what makes the next step cheap. With credentials captured from an unencrypted session, the attacker no longer needs to guess anything. With a map of which machine talks to which, they know where to move the moment they are in.
The border with the active attack is thinner than it looks. Somebody positioned in the middle of a conversation can start out merely listening and decide later to alter what passes through: at that moment they stop being passive and become an adversary in the middle. The position is identical; what changes is whether they touch anything.
On wireless there is an in-between case that comes up often: capturing the material exchanged during association in order to work on it later and offline, as in the PMKID attack. There is no interaction with any user and nothing is broken, and the result can still be a password.
What stops it
Detecting a passive attack is not the answer; leaving nothing to listen to is. The measure that genuinely neutralises it is encryption in transit applied everywhere and not only at the internet edge, with TLS kept current and no exemption carved out for internal traffic, which is exactly where cleartext protocols keep turning up.
Next comes reducing who is able to listen. Network segmentation limits what traffic reaches somebody who has landed in one segment, and the wireless equivalent is refusing to trust a network because of its name: an impersonated access point, the evil twin, turns the victim into the party handing the traffic over voluntarily.
And there is the part that cannot be encrypted, which is what the organisation publishes. Reducing that surface is not about hiding: it is about knowing what is out there before somebody else does.
Where this shows up in an audit
On an engagement the passive part is done first and touches nothing: we collect what the organisation publishes and, where scope allows, listen to traffic from the position of an employee or a visitor. It answers two questions, and the second matters more: what is visible, and how much of that could have been seen without getting in anywhere.
On a wireless penetration test it is the starting point outright. We measure which networks the organisation broadcasts and with what protections, which devices associate automatically to networks they recognise, and what can be captured from the street without authenticating to anything.
The finding is written against the exposed data, not against the tool that captured it. The problem is that unencrypted internal traffic exists; the packet capture is only how it gets shown.