1.9 Network Attacks

Attacks that overwhelm or intercept

A Denial-of-Service (DoS) attack floods a system with traffic so legitimate users can't access it. A Distributed DoS (DDoS) uses many compromised devices (a botnet) to multiply the attack's power. A man-in-the-middle (MITM) attack secretly intercepts and possibly alters communication between two parties who believe they're talking directly to each other.

Attacks that exploit trust and identity

IP spoofing forges the source IP address in packets to disguise the attacker's identity or impersonate a trusted host. On-path attacks (a type of MITM) position the attacker between victim and destination to eavesdrop or modify data. Packet sniffing captures network traffic to steal unencrypted data like passwords.

Why networks are vulnerable

Networks rely on protocols (like TCP/IP) that were originally designed for functionality, not security, making them exploitable. Attackers exploit weak authentication, unencrypted traffic, and open ports. Defenses include firewalls, encryption (e.g., HTTPS, VPNs), intrusion detection systems (IDS), and network segmentation to limit damage and detect abnormal traffic patterns.

Key terms

DoS attack

An attack that overwhelms a system with traffic or requests, denying access to legitimate users.

DDoS attack

A DoS attack launched from many compromised devices (a botnet) simultaneously.

Man-in-the-middle (MITM) attack

An attack where the attacker secretly intercepts and possibly alters communication between two parties.

IP spoofing

Forging the source IP address of a packet to disguise identity or impersonate a trusted system.

Packet sniffing

Capturing network traffic to extract data, often exposing unencrypted sensitive information like passwords.

Try an AP-style question

What attack is this?

1. DNS tunneling
2. ARP spoofing
3. SQL injection
4. Brute force