1.8.4 Common Active Attacks

Question 1

Cracking Passwords

Answer 1

Authentication is the name for any methods which allow users to prove that an account is theirs.
The most common authentication method is using a password.
Many hackers want to find people’s passwords, so that they can gain access to accounts:
Finding people’s passwords is called cracking the password.

Question 2

Brute Force attack

Answer 2

A brute force attack tries to crack a password by trying every single combination of letters and numbers until the correct one is found.
This can take a very long time, although special software is used to do this which makes it possible to make millions of attempts per second.

Question 3

Dictionary Attack

Answer 3

A quicker form of the brute force attack is the dictionary attack.
Rather than attempting every single combination, a dictionary attack tries words from a predetermined list:
A common dictionary to use would be a list of common passwords.

Question 4

Protection against cracking

Answer 4

Writing a network policy which enforces strong passwords can protect against dictionary attacks.
Using two-factor authentication can prevent the hacker from logging in, even if they have the password.
Restricting the number of failed password attempts before an account is ‘locked’ for a fixed period of time can deter hackers.

Question 5

Denial of Service Attacks

Answer 5

DoS attacks attempt to bring down a server by flooding it with loads of useless requests.
The attack aims to overload the server. This stops the server responding to legitimate requests.

Question 6

Protection against DoS attacks

Answer 6

To protect against DoS attacks, a server’s firewall can blacklist (ban) any traffic from an IP address which is known to perform DoS attacks.
Firewalls can also monitor traffic in real time. So if a new IP address starts to send too much traffic then traffic limits can be set.

Question 7

Distributed DoS attacks

Answer 7

Distributed DoS (DDos) attacks are commonly used to overcome the blacklisting of an IP address because of a high number of requests.
In a DDoS attack, the requests are sent from an army of compromised machines, known as a botnet.
Botnet machines are infected with malware which allows a hacker to send requests from their computer.
The botnet can launch a huge number of simultaneous requests. The owners of the devices in the botnet might not even realise they are taking part.