Network Attacks

🧭

On this page — click any heading below to jump straight to it. ⬅️ Back to P-II.II. Computer Communications & Networks

---

OSI Layer: Cross-Layer — Security

Definition

Network attacks are deliberate attempts to exploit vulnerabilities in network protocols, devices, software, or configurations to compromise the confidentiality, integrity, or availability (the CIA triad) of data or services.

Classification by Behaviour

1. Passive Attacks

• The attacker observes communication without altering it — data itself is never modified, making passive attacks very hard to detect.
• Eavesdropping / Sniffing — capturing unencrypted traffic on a shared medium (e.g., using a packet sniffer on an unsecured Wi-Fi network) to read confidential data directly.
• Traffic Analysis — even without reading encrypted content, an attacker infers information from patterns (who is communicating with whom, how often, at what volume) — useful for intelligence-gathering even against fully encrypted traffic.
• Countermeasure focus: prevention (strong encryption, traffic padding) rather than detection, since passive attacks leave no trace to detect after the fact.

2. Active Attacks

• The attacker modifies, injects, or disrupts data/communication — detectable in principle, since the disruption itself often leaves evidence.
• Masquerade/Spoofing — the attacker impersonates a legitimate entity (e.g., IP spoofing forges a source address; DNS spoofing forges a DNS response) to gain unauthorised access or redirect traffic.
• Replay — a legitimate data transmission (e.g., an authentication exchange) is captured and retransmitted later to fraudulently repeat its effect (e.g., replaying a captured login token).
• Modification of messages — part of a legitimate message is altered, delayed, or reordered to produce an unauthorised effect.
• Denial of Service (DoS) — deliberately disrupts or degrades the availability of a service or network resource for legitimate users (see below).

Classification by Target/Mechanism

Denial of Service (DoS) / Distributed DoS (DDoS)

• Overwhelms a target's resources (bandwidth, CPU, connection table) with excessive traffic or requests, denying service to legitimate users.
• DoS — from a single source; DDoS — coordinated from many compromised machines (a botnet) simultaneously, making it far harder to block by simply filtering one source IP.
• Sub-types: volumetric (flooding raw bandwidth, e.g., UDP flood), protocol (exploiting handshake/state mechanics, e.g., SYN flood), application-layer (exhausting server resources with seemingly legitimate requests, e.g., HTTP flood).

Man-in-the-Middle (MITM)

• The attacker secretly positions themselves between two communicating parties, able to intercept, and potentially alter, traffic while both parties believe they are communicating directly with each other.
• Enabled by techniques like ARP spoofing (on a local network) or rogue Wi-Fi access points.

Spoofing (IP / DNS / Email)

• IP spoofing — forging the source IP address of packets, often used to launch DoS attacks that are hard to trace back or to bypass simple IP-based access controls.
• DNS spoofing (cache poisoning) — injecting false DNS records so a domain name resolves to an attacker-controlled address instead of the legitimate one.

Social-Engineering-Enabled Attacks

• Phishing — fraudulent communication (commonly email) tricking users into revealing credentials or installing malware; a network-adjacent attack since it is typically the delivery vector for more technical exploits.

Malware-Based Attacks

• Worms — self-propagating malware that spreads across a network without needing a host file or user action, directly exploiting network protocol vulnerabilities.
• Viruses/Trojans/Ransomware — spread via network vectors (email attachments, drive-by downloads, infected shared drives) even though propagation itself may require some user action.

The CIA Triad Framing

Mitigations

• Firewalls — filter traffic based on rules (IP, port, protocol) at the network perimeter.
• IDS/IPS (Intrusion Detection/Prevention Systems) — detect (and, for IPS, actively block) known attack signatures or anomalous behaviour patterns.
• Encryption (TLS/IPsec) — protects confidentiality and integrity even if traffic is intercepted (defeats passive eavesdropping and reduces MITM effectiveness).
• Network segmentation — limits how far an attacker can move laterally after breaching one segment.
• Regular patching — closes known vulnerabilities before they can be exploited.

CSS Exam Angle

• Structure answers around passive vs active first, then the CIA triad — examiners reward this two-level framework explicitly rather than an unstructured list of attack names.
• Connect to Pakistan's PECA 2016 (Prevention of Electronic Crimes Act) as the legal response to network/cyber attacks — a strong interdisciplinary point for CSS.
• Cross-reference the "Top 7 Network Attack Types" page for a ready-made enumerated list with mitigations if the question specifically asks to "list and explain" attack types.

Example

Reported disruptions to Pakistani banks' online services from suspected cyberattacks (often DDoS or targeted intrusion attempts) are real, citable examples of network-level attacks with direct national economic impact, and are the kind of applied example that strengthens a CSS answer beyond textbook definitions.

Likely Questions

1. Discuss various types of network attacks and the mechanisms used to prevent them.
2. Differentiate passive and active attacks with examples of each.
3. Explain the CIA triad and map common network attacks to the property each primarily violates.
4. Differentiate DoS from DDoS, and classify DoS attacks by mechanism (volumetric, protocol, application-layer).

📜 Past-Paper Questions & Structured Answers

Questions are paraphrased; answer focus is suggested guidance, not an official marking scheme.

2017 · Paper-I · Q2(a) · 8 marks

Question (paraphrased): Suggest technical measures against cybercrime while protecting privacy.

Answer focus: Pair threats with controls and include privacy-respecting implementation.

Aim: prevent unauthorised access, fraud and service disruption while limiting unnecessary exposure of citizens’ personal information.

Privacy safeguards: collect only necessary data, restrict and audit access to logs, define retention periods and separate operational monitoring from unrestricted surveillance. Pseudonymise identifiers where feasible and investigate specific incidents with authorised procedures.

Example: a government portal can combine HTTPS, MFA for administrators, least-privilege database access, monitored alerts and encrypted backups. These controls address different failure modes; encryption alone would not stop an authorised insider from misusing excessive access.

Conclusion: defence in depth is stronger than any single product, and privacy must be designed into monitoring and data handling.

2018 · Paper-I · Q2(b) · related incident-response question · 4 marks

Question (paraphrased): Explain how digital evidence should be preserved, using device examples.

Answer focus: Preserve integrity, acquisition, documentation and chain of custody.

Preserve the scene: document the device, connections, time and visible state; prevent unauthorised alteration. For a phone, isolate communications where appropriate; for a live computer, a trained examiner considers volatile-memory capture before shutdown.

Acquire carefully: create a forensic copy using suitable tools and write-blocking where applicable; record cryptographic hashes so later copies can be checked for change. Analyse the copy while securing the original.

Maintain chain of custody: record who collected, transferred and accessed the evidence, when and why. Protect media from damage and keep acquisition notes and logs. Hashes demonstrate consistency of a copy; they do not alone prove who created the underlying content.

2021 · Paper-I · Q2(b) · related cybercrime/ethics question · 7 marks

Question (paraphrased): Discuss computer crimes and ethical challenges.

Answer focus: Define, classify with examples, explain ethical tensions and responses.

Computer crime uses computers as a target or tool of wrongdoing: unauthorised access, malware, account theft, online fraud and denial of service are examples. A phishing message may steal credentials; ransomware may encrypt an organisation’s records; a DDoS attack may make a service unavailable.

Ethical challenges: security testing without permission can violate privacy and disrupt services; bulk monitoring can expose innocent users’ data; employees may misuse privileged access; copying software or digital content can violate licence terms and creators’ rights. Legal compliance and ethical responsibility are related but not identical.

Responsible response: obtain authorisation before testing, use least privilege, minimise personal-data collection, apply proportionate monitoring and preserve evidence through controlled procedures. Disclose discovered vulnerabilities through responsible channels and respect software/content licences.

Example: a university administrator investigating an account compromise should preserve relevant logs and limit access to investigators, rather than browse unrelated student messages. This balances incident response with privacy and accountability.

2022 · Paper-I · Q3(b) · related security-principles question · 6 marks

Question (paraphrased): Explain information-security and privacy principles.

Answer focus: CIA triad plus identity, accountability and privacy with examples.

Application: a hospital needs confidential patient records, accurate prescriptions and available emergency systems. A technically secure database can still violate privacy if it collects excessive data or permits unrelated reuse; security is necessary but not the whole of privacy.

Direct network-attack question: 2022 Paper-II Q5(c), 6 marks, concerns SYN flooding and backlog limits. Its full answer is in Reliable Data Transfer and TCP and Seven Common Network Attack Types.