Network Vulnerabilities and Attacks
Introduced| English | Meaning |
|---|---|
| ARP poisoning/ɑːp ˈpɔɪzənɪŋ/ | Supplying false address-resolution information to associate an IP address with the wrong link-layer address. |
| on-path attack/ɒn pæθ əˈtæk/ | An attack in which an adversary positions themselves in a communication path to intercept or alter exchanged data. |
| MAC flooding/mæk ˈflʌdɪŋ/ | Sending many apparent source addresses to exhaust or disrupt a switch's address table; the outcome depends on its controls and behaviour. |
| switch/swɪtʃ/ | A network device that forwards frames to the appropriate ports using hardware addresses. |
| eavesdropping/ˈiːvzdrɒpɪŋ/ | Secretly listening to or intercepting another person's communications. |
| DNS poisoning/ˌdiː en ˈes ˈpɔɪzənɪŋ/ | Introducing false name-resolution information so a domain name may resolve to an unintended destination. |
| denial of service/dɪˈnaɪəl ɒv ˈsɜːvɪs/ | An attack that prevents or disrupts legitimate access to a system or service. |
| distributed denial of service/ˈdɪstrɪbjuːtɪd dɪˈnaɪəl ɒv ˈsɜːvɪs/ | An attack using many sources to overwhelm a service or exhaust its resources, disrupting legitimate access. |
| rogue access point/rəʊɡ ˈækses pɔɪnt/ | An unauthorised wireless access point that can expose users or an organisation's network to risk. |
On-path and flooding attacks
- ARP poisoning 地址解析投毒: fake ARP messages send traffic to the adversary — an on-path attack 中间人攻击.
- MAC flooding 物理地址泛洪: overloading a switch 交换机 so it broadcasts all traffic (eavesdropping 窃听).
- The adversary reads or alters messages between two parties.
Redirection and denial
- DNS poisoning 域名投毒: a fake record redirects users to a malicious site.
- Smurf attack: an ICMP flood — a denial of service (DoS) 拒绝服务.
- Many machines at once = a distributed denial of service (DDoS) 分布式拒绝服务.
A man-in-the-middle attack sits between a user and a server
Identify the network attack
Each attack has a distinct trace: ARP=two MACs for one IP; MAC flooding=switch overload; DNS=redirect; smurf=ICMP flood.
An adversary secretly sitting between two parties, reading their traffic, performs a(n)...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
This is an on-path / man-in-the-middle attack.
One IP address shown with two different MAC addresses in a log suggests...
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Duplicate MAC for one IP = ARP poisoning.
An unauthorised access point plugged into an open port is a ____ access point.
Difficulty 1/5 · 100 coins + a small bonus on first completion today
A rogue access point bypasses the firewall.
Which attacks let an adversary eavesdrop on traffic? (Choose all)
Difficulty 2/5 · 140 coins + a small bonus on first completion today
A UPS failure is not an eavesdropping attack.
How networks get exploited
- An open port lets an attacker install a rogue access point 非法接入点.
- A rogue AP bypasses the firewall entirely.
- We rate risk by impact and the skill an exploit needs.
In an on-path (man-in-the-middle) attack, both parties think they are talking directly to each other. They are actually each talking to the adversary, who quietly reads or changes every message.
When many machines flood a target at once, it is a distributed denial of service (DDoS).
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Many attackers at once = DDoS.
In ARP poisoning, the adversary tells the network "the target's IP belongs to MY hardware address." Traffic meant for the target now flows through the adversary first. The tell-tale sign in a log: one IP shown with two different MAC addresses.
Key network attacks: ARP poisoning (eavesdrop from an on-path / man-in-the-middle position), MAC flooding (eavesdrop by forcing the switch to broadcast every frame), DNS poisoning (redirect), and smurf/DoS/DDoS (flood). Weak or open ports let an adversary add a rogue access point that bypasses the firewall.