What an attack on a network is

Remote input can violate network security goals

An attack on a network is an event or sequence of actions that might violate a security goal. On a network, a program’s input can arrive from any remote party, with no prior control over its sender, kind or amount.

Web and mail servers face this uncontrolled input. Any Internet device, including a browser, CCTV camera or IoT sensor, can become part of the attacking side. A successful intrusion lets the attacker explore, breach and exploit beyond the original weakness.

Passive attacks observe; active attacks alter or fabricate

Compare

Passive attacks

Eavesdropping or monitoring. The attacker only wants information, never alters what is sent. Covers release of message contents and traffic analysis. Hard to detect, since nothing about the data changes.

Active attacks

Modification of the data stream, or creation of a false one. Covers replay, masquerade, modification of messages, and denial of service. Detectable in principle, since the data stream itself is disturbed.

Seven categories describe how security goals are compromised

A masquerade is one entity pretending to be a different entity. The unit’s own example is a captured, valid authentication sequence, replayed after the fact, letting a low-privilege entity obtain the extra privileges of the entity it is impersonating.

Beyond the passive/active split, the unit lists seven concrete ways a network’s security goals get compromised, each with its own worked example:

• Masquerade. An entity claims to be another entity (also called impersonation).
• Eavesdropping. An entity reads information it is not intended to read. A person-in-the-middle attack that captures packet contents is the unit’s example, sometimes yielding login information directly if the connection is not secured.
• Loss or modification of transmitted information. Data is altered or destroyed. After a person-in-the-middle attack, an attacker can intercept a request, for example a password change, alter it, and forward the modified version on to the server.
• Forgery of information. An entity creates new information in the name of another entity, for example changing the address on an account after gaining access to it.
• Denial of accountability. An entity falsely denies its participation in a communication act. An attacker who used a victim’s stolen credentials to do something illegal can deny it, leaving the victim to somehow prove they were not responsible.
• Sabotage / Denial of Service. Any action aimed at reducing the availability or correct functioning of services or systems. A DDoS attack against a remote server is the unit’s own example.
• Authorization violation. An entity uses a service or resource it is not intended to use. The unit’s example is the moment an attacker who has taken over an account begins accessing it.

HTTPS protects contents, but other attacks need other defences

The unit’s own example for eavesdropping names its defence directly: capturing packet contents, including login information, depends on the connection not being secured. An HTTPS connection is what closes that gap for Web traffic specifically, encrypting the contents a plain-HTTP eavesdropper would otherwise read. This does not address the other six categories on its own; masquerade, forgery, denial of accountability, sabotage and authorization violation each need their own defences, which is exactly what the cryptographic protocols layered on top of this stack, covered elsewhere in this module, are built to provide.

Exam detail

Two different sevens can get confused here: the passive/active split with its four active sub-categories (replay, masquerade, modification of messages, denial of service) is one classification; the unit’s list of seven ways to compromise a network’s security goals (masquerade, eavesdropping, loss or modification of information, forgery, denial of accountability, sabotage/DoS, authorization violation) is a second, more detailed one. They overlap, masquerade and denial of service appear in both, but the second list is not simply a relabelling of the first: forgery, denial of accountability and authorization violation have no direct counterpart in the passive/active split.

Recall

An attacker gains access to a victim's account, changes the account's registered address to their own, and later denies having touched the account at all. Which of the unit's categories does each part of this match?

Gaining access and using the account is an authorization violation. Changing the address is forgery of information, creating new information in the account owner’s name. Denying having done it afterward is denial of accountability. A single incident can trigger several of the unit’s categories at once; they describe distinct ways a security goal can be compromised, not mutually exclusive labels for a whole attack.