Network Attacks

Question 1

Flood Attack

Answer 1

A specialized type of DoS which attempts to send more packets to a single server or host than they can handle

Question 2

Ping Flood

Answer 2

An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings)

Question 3

Smurf Attack

Answer 3

Attacker sends a ping to subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing

Question 4

Fraggle Attack

Answer 4

Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets

Question 5

SYN Flood

Answer 5

Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake

Question 6

XMAS Attack

Answer 6

A specialized network scan that sends the FIN, PSH, and URG flags set and can cause a device to crash or reboot

Question 7

Ping of Death

Answer 7

An attack that sends an oversized and malformed packet to another computer or server

Question 8

Teardrop Attack

Answer 8

Attack that breaks apart packets into IP fragments, modifies them with overlapping and oversized payloads, and sends them to a victim machine

Question 9

Permanent DoS

Answer 9

Attack which exploits a security flaw to permanently break a networking device by reflashing its firmware

Question 10

Fork Bomb

Answer 10

Attack that creates a large number of processes to use up the available processing power of a computer

Question 11

DNS Amplification

Answer 11

Attack which relies on the large amount of DNS information that is sent in response to a spoofed query on behalf of the victimized server

Question 12

Stopping DDoS

Answer 12

GitHub suffered a 1.35 Tbps DDoS

Blackholing or Sinkholing
▪ Identifies any attacking IP addresses and routes all their traffic to a nonexistent server through the null interface

An IPS can prevent a small-scale DDoS

Specialized security services cloud providers can stop DDoS attacks

Question 13

Session Theft

Answer 13

Attacker guesses the session ID for a web session, enabling them to take over the already authorized session of the client

Question 14

TCP/IP Hijacking

Answer 14

Occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access

Question 15

Blind Hijacking

Answer 15

Occurs when an attacker blindly injects data into the communication stream without being able to see if it is successful or not

Question 16

Clickjacking

Answer 16

Attack that uses multiple transparent layers to trick a user into clicking on a button or link on a page when they were intending to click on the actual page

Question 17

MITB

Answer 17

Man-in-the-Browser:
Occurs when a Trojan infects a vulnerable web browser and modifies the web pages or transactions being done within the browser

Question 18

Watering Hole

Answer 18

Occurs when malware is placed on a website that the attacker knows his potential victims will access

Question 19

Replay Attack

Answer 19

Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed

Multi-factor authentication can help prevent successful replay attacks

Question 20

Transitive Attacks

Answer 20

Transitive Attacks aren’t really an attack but more of a conceptual method

When security is sacrificed in favor of more efficient operations, additional risk exists

Question 21

DNS Poisoning

Answer 21

Occurs when the name resolution information is modified in the DNS server’s cache

If the cache is poisoned, then the user can be redirected to a malicious website

Question 22

Unauthorized Zone Transfer

Answer 22

Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks

Question 23

Altered Hosts File

Answer 23

Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website

Windows stores the hosts file in the following directory:
\%systemroot%\system 32\drivers\etc

Question 24

Pharming

Answer 24

Occurs when an attacker redirects one website’s traffic to another website that is bogus or malicious

Question 25

Domain Name Kiting

Answer 25

Attack that exploits a process in the registration process for a domain name that keeps the domain name in limbo and cannot be registered by an authenticated buyer

Question 26

ARP Poisoning

Answer 26

Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the local area network

Allows an attacker to essentially take over any sessions within the LAN

ARP Poisoning is prevented by VLAN segmentation and DHCP snooping