3.5 Network Attacks

Attacks that flood or intercept traffic

A Denial-of-Service (DoS) attack overwhelms a system with traffic so legitimate users can't access it; a Distributed DoS (DDoS) attack uses many compromised devices (a botnet) to multiply the flood. A man-in-the-middle (MITM) attack secretly intercepts and possibly alters communication between two parties who believe they're talking directly to each other.

Exploiting trust and address weaknesses

Spoofing attacks forge identifying information (IP address, MAC address, or email sender) to impersonate a trusted source. On-path attacks (a type of MITM) position the attacker between the client and server, often via ARP spoofing or rogue Wi-Fi access points, to eavesdrop or modify data in transit.

Password and packet-level attacks

Brute-force attacks try many password combinations to gain unauthorized access, while dictionary attacks use lists of likely passwords. Packet sniffing captures unencrypted network traffic to steal data like credentials. Strong encryption (e.g., HTTPS, WPA2/3) and network monitoring help defend against these attacks.

Key terms

DoS attack

An attack that floods a system with traffic to deny service to legitimate users.

DDoS attack

A DoS attack amplified by using a botnet of many compromised devices.

Man-in-the-middle (MITM) attack

An attack where the attacker secretly intercepts and possibly alters communication between two parties.

Spoofing

Forging identifying information (IP, MAC, or email address) to impersonate a trusted source.

Brute-force vs. dictionary attack

Brute-force tries all possible password combinations; dictionary attacks try a list of likely/common passwords.

Try an AP-style question

What is most likely happening?

1. A port scan
2. A software update
3. A normal backup
4. A DNS lookup