Network Attacks

Question 1

Flood Attack

Answer 1

A specialized type of DoS which attempts to send more packets to a single server or host than they can handle

Question 2

Ping Flood

Answer 2

An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings)

Question 3

Smurf Attack

Answer 3

First, the malware creates a network packet attached to a false IP address — a technique known as “spoofing.”

Inside the packet is a ping message, asking network nodes that receive the packet to send back a reply

These replies, or “echoes,” are then sent back to network IP addresses again, setting up an infinite loop.

Question 4

Fraggle Attack

Answer 4

Attacker sends a UDP echo packet to flood a server with UDP packets. Similar to smurf (which uses ping echos)

Question 5

SYN Flood

Answer 5

Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake

Question 6

XMAS Attack

Answer 6

send a very specifically crafted TCP packet to a device on the network. This crafting of the packet is one that turns on a bunch of flags. There is some space set up in the TCP header, called flags. And these flags all are turned on or turned off, depending on what the packet is doing.

Xmas turns on 3 flags which are very unusual, so device is confused, could cause DoS

Question 7

Ping of Death

Answer 7

Ping of Death (a.k.a. PoD) is a type of Denial of Service (DoS) attack in which an attacker attempts to crash, destabilize, or freeze the targeted computer or service by sending malformed or oversized packets using a simple ping command

older one, ping flood is newer

Question 8

Teardrop Attack

Answer 8

type of DoS

the client sends an intentionally fragmented information packet to a target device. Since the packets overlap, an error occurs when the device tries to reassemble the packet. The attack takes advantage of that error to cause a fatal crash in the operating system or application that handles the packet.

Question 9

Permanent DoS

Answer 9

Attack which exploits a security flaw to permanently break a networking device by reflashing its firmware

Question 10

Fork Bomb

Answer 10

Attack that creates a large number of processes to use up the available processing power of a computer

Question 11

DNS Amplification

Answer 11

A Domain Name Server (DNS) Amplification attack is a popular form of Distributed Denial of Service (DDoS), in which attackers use publically accessible open DNS servers to flood a target system with DNS response traffic. The primary technique consists of an attacker sending a DNS name lookup request to an open DNS server with the source address spoofed to be the target’s address. When the DNS server sends the DNS record response, it is sent instead to the target. Attackers will typically submit a request for as much zone information as possible to maximize the amplification effect.

Question 12

Stopping DDoS

Answer 12

Blackholing: Identifies any attacking IP addresses and routes all their traffic to a nonexistent server

Question 13

Session Theft

Answer 13

Attacker guesses the session ID for a web session, enabling them to take over the already authorized session of the client

Question 14

TCP/IP Hijacking

Answer 14

Occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access

Question 15

Blind Hijacking

Answer 15

Occurs when an attacker blindly injects data into the communication stream without being able to see if it is successful or not

Question 16

Clickjacking

Answer 16

is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages

Question 17

Man-in-the-Browser: MITB

Answer 17

Man-in-the-browser is a form of man-in-the-middle attack where an attacker is able to insert himself into the communications channel between two trusting parties by compromising a Web browser used by one of the parties, for the purpose of eavesdropping, data theft and/or session tampering.

Question 18

Watering Hole

Answer 18

Occurs when malware is placed on a website that the attacker knows his potential victims will access

Question 19

Replay Attack

Answer 19

Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed

Multi-factor authentication can help prevent successful replay attacks

Question 20

Transitive Attacks

Answer 20

Transitive Attacks aren’t really an attack but more of a conceptual method

When security is sacrificed in favor of more efficient operations, additional risk exists

Question 21

DNS Poisoning

Answer 21

Occurs when the name resolution information is modified in the DNS server’s cache

If the cache is poisoned, then the user can be redirected to a malicious website

Question 22

Unauthorized Zone Transfer

Answer 22

Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks

DNS Zone transfer is the process where a DNS server passes a copy of part of it’s database (which is called a “zone”) to another DNS server.

basic DNS Zone Transfer Attack isn’t very fancy: you just pretend you are a secondary and ask the primary for a copy of the zone records. And it sends you them

Question 23

Altered Hosts File

host files

Answer 23

Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website

The computer file hosts is an operating system file that maps hostnames to IP addresses. It is a plain text file.

Question 24

Pharming

Answer 24

Occurs when an attacker redirects one website’s traffic to another website that is malicious

Question 25

Domain Name Kiting

Answer 25

Attack that exploits a process in the registration process for a domain name that keeps the domain name in limbo and cannot be registered by an authenticated buyer

Question 26

ARP Poisoning

Answer 26

Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the local area network

Allows an attacker to essentially take over any sessions within the LAN

ARP Poisoning is prevented by VLAN segmentation and DHCP snooping