CSEC3616Cybersecurity Engineering

    What an attack on a network is

    The definition of an attack on a network, why the remote, uncontrolled input surface changes the threat model, the passive/active split, and the seven ways the unit lists for compromising a network's security goals.

    • State the unit's definition of an attack on a network.
    • Distinguish a passive network attack from an active one, with an example of each.
    • Name the seven ways the unit lists for compromising a network's security goals, and give an example of each.

    12 min read

    Intuition

    Earlier in the unit, an attack was defined in general terms: any event or sequence of actions that might violate a security goal. A network changes what that definition means in practice, because a networked program’s input can arrive from any remote party, with no prior control over who sends it or what they send. That remote, uncontrolled surface is what makes network attacks worth studying as their own category.

    Mechanism

    An attack on a network is an event or sequence of actions that might lead to a violation of one or more security goals. What makes this decisively different from “simple” software security is that the input to a program, a web server or a mail server, comes from remote, and there is no a priori control over who can send that input. The remote side can choose any kind or any amount of traffic to send toward a network, and any device on the Internet, a browser, a CCTV camera, an IoT sensor, can end up part of the attacking side rather than the defending one. A successful intrusion into a network then gives the attacker room to explore, breach and exploit further, well beyond whatever single weakness let them in.

    Mechanism

    Network attacks split into two families. Passive attacks are eavesdropping or monitoring: the attacker’s goal is to obtain information being transmitted, without altering it. This covers release of message contents and traffic analysis, and passive attacks are very difficult to detect precisely because they involve no alteration of the data at all. Active attacks involve modifying the data stream or creating a false one, and fall into four categories: replay, masquerade, modification of messages, and denial of service.

    Compare

    Eavesdropping or monitoring. The attacker only wants information, never alters what is sent. Covers release of message contents and traffic analysis. Hard to detect, since nothing about the data changes.

    Modification of the data stream, or creation of a false one. Covers replay, masquerade, modification of messages, and denial of service. Detectable in principle, since the data stream itself is disturbed.

    Threat

    A masquerade is one entity pretending to be a different entity. The unit’s own example is a captured, valid authentication sequence, replayed after the fact, letting a low-privilege entity obtain the extra privileges of the entity it is impersonating.

    Mechanism

    Beyond the passive/active split, the unit lists seven concrete ways a network’s security goals get compromised, each with its own worked example:

    • Masquerade. An entity claims to be another entity (also called impersonation).
    • Eavesdropping. An entity reads information it is not intended to read. A person-in-the-middle attack that captures packet contents is the unit’s example, sometimes yielding login information directly if the connection is not secured.
    • Loss or modification of transmitted information. Data is altered or destroyed. After a person-in-the-middle attack, an attacker can intercept a request, for example a password change, alter it, and forward the modified version on to the server.
    • Forgery of information. An entity creates new information in the name of another entity, for example changing the address on an account after gaining access to it.
    • Denial of accountability. An entity falsely denies its participation in a communication act. An attacker who used a victim’s stolen credentials to do something illegal can deny it, leaving the victim to somehow prove they were not responsible.
    • Sabotage / Denial of Service. Any action aimed at reducing the availability or correct functioning of services or systems. A DDoS attack against a remote server is the unit’s own example.
    • Authorization violation. An entity uses a service or resource it is not intended to use. The unit’s example is the moment an attacker who has taken over an account begins accessing it.

    Control

    The unit’s own example for eavesdropping names its defence directly: capturing packet contents, including login information, depends on the connection not being secured. An HTTPS connection is what closes that gap for Web traffic specifically, encrypting the contents a plain-HTTP eavesdropper would otherwise read. This does not address the other six categories on its own; masquerade, forgery, denial of accountability, sabotage and authorization violation each need their own defences, which is exactly what the cryptographic protocols layered on top of this stack, covered elsewhere in this module, are built to provide.

    Exam detail

    Two different sevens can get confused here: the passive/active split with its four active sub-categories (replay, masquerade, modification of messages, denial of service) is one classification; the unit’s list of seven ways to compromise a network’s security goals (masquerade, eavesdropping, loss or modification of information, forgery, denial of accountability, sabotage/DoS, authorization violation) is a second, more detailed one. They overlap, masquerade and denial of service appear in both, but the second list is not simply a relabelling of the first: forgery, denial of accountability and authorization violation have no direct counterpart in the passive/active split.

    Aside

    The unit’s own diagram illustrating attacks on communication networks did not survive extraction from the source material. The definitions and examples above are taken directly from the accompanying text and are unaffected.

    Recall

    An attacker gains access to a victim's account, changes the account's registered address to their own, and later denies having touched the account at all. Which of the unit's categories does each part of this match?

    Gaining access and using the account is an authorization violation. Changing the address is forgery of information, creating new information in the account owner’s name. Denying having done it afterward is denial of accountability. A single incident can trigger several of the unit’s categories at once; they describe distinct ways a security goal can be compromised, not mutually exclusive labels for a whole attack.

    Recall

    • An attack on a network is any event or action sequence that might violate a security goal; what makes networks distinct is remote, uncontrolled input with no prior control over the sender.
    • Passive attacks (eavesdropping, traffic analysis) obtain information without altering it, and are hard to detect for exactly that reason. Active attacks (replay, masquerade, modification, denial of service) alter or fabricate the data stream.
    • The unit’s seven ways to compromise a network’s security goals: masquerade, eavesdropping, loss or modification of information, forgery, denial of accountability, sabotage/denial of service, and authorization violation.

    Source

    Week 8 slides PDF