optional · CSS study notes
Seven Common Network Attack Types
🧭
On this page — click any heading below to jump straight to it. ⬅️ Back to P-II.II. Computer Communications & Networks
OSI Layer: Cross-Layer — Security
Definition
A seven-category revision checklist of common network/cyber attacks, with mechanisms and mitigations. This is not a verified 2016 prevalence ranking or a seven-item question from the 2016 FPSC paper.
The 7 Attack Types, Explained in Detail
1. Malware
- Umbrella term for malicious software: viruses (attach to and spread via host files, need user action to trigger), worms (self-propagating across a network with no host file or user action needed), trojans (disguised as legitimate software, executes hidden malicious payload), ransomware (encrypts victim's data and demands payment for the decryption key).
- Mitigation: antivirus/anti-malware software, regular patching, application whitelisting, network segmentation to limit worm propagation.
2. Phishing
- Fraudulent communication (most often email, but also SMS "smishing" or voice "vishing") designed to trick a user into revealing credentials or installing malware, typically by impersonating a trusted entity.
- Spear phishing — a targeted variant aimed at a specific individual/organisation using personalised, researched detail to increase credibility.
- Mitigation: user security-awareness training, email filtering/authentication (SPF/DKIM/DMARC), multi-factor authentication (limits damage even if credentials are stolen).
3. SQL Injection
- Exploits poorly sanitised user input in a web application to inject malicious SQL commands, manipulating the backend database (e.g., bypassing login checks, extracting or deleting data).
- Mitigation: parameterised queries/prepared statements, input validation and sanitisation, least-privilege database accounts, web application firewalls (WAF).
4. Cross-Site Scripting (XSS)
- Injecting malicious scripts into a trusted website, which then execute in the browsers of victims who visit that site — the attack exploits the victim's trust in the website, not the website's server directly.
- Stored XSS (malicious script permanently saved on the server, e.g., in a comment field) vs Reflected XSS (script is embedded in a crafted URL/request and reflected back immediately, not stored).
- Mitigation: input sanitisation and output encoding, Content Security Policy (CSP) headers, HttpOnly cookie flags.
5. Denial of Service (DoS/DDoS)
- Floods a target with excessive traffic or requests to exhaust its bandwidth, processing capacity, or connection state, denying access to legitimate users.
- DDoS specifically uses a distributed botnet of many compromised machines, making the attack harder to block by simple source-IP filtering.
- Mitigation: rate limiting, traffic scrubbing services, CDN-based load absorption, anycast distribution of the target service.
6. Man-in-the-Middle (MITM)
- Intercepting (and potentially altering) communication between two parties who believe they are communicating directly with each other.
- Common enabling techniques: ARP spoofing on a LAN, rogue Wi-Fi access points, or a compromised/malicious network node along the path.
- Mitigation: end-to-end encryption (TLS/HTTPS), certificate validation, VPN use on untrusted networks.
7. Password / Brute-Force Attacks
- Systematically guessing credentials, either by trying every possible combination (brute force) or by trying commonly used passwords/leaked credential lists (dictionary attack / credential stuffing), usually automated.
- Mitigation: account lockout policies, rate limiting login attempts, strong password policies, multi-factor authentication.
Quick-Reference Table (Attack → One-Line Mitigation)
| Attack | Core Mechanism | Primary Mitigation |
|---|---|---|
| Malware | Malicious software execution/propagation | Antivirus + patching + segmentation |
| Phishing | Social engineering via fraudulent communication | Awareness training + MFA + email filtering |
| SQL Injection | Unsanitised input manipulates database queries | Parameterised queries + input validation |
| XSS | Malicious script executes in victim's browser | Output encoding + CSP headers |
| DoS/DDoS | Resource exhaustion via traffic flood | Rate limiting + CDN/scrubbing + anycast |
| MITM | Interception between two trusting parties | End-to-end encryption + certificate checks |
| Brute-force | Automated credential guessing | Lockout policy + MFA + rate limiting |
CSS Exam Angle
- This page is designed as a ready-made enumerated list for "list and briefly explain common network attacks" questions — pair each item with its one-line mitigation to show applied, not just definitional, understanding.
- Note the sub-type distinctions where they exist (stored vs reflected XSS; DoS vs DDoS; brute-force vs dictionary/credential-stuffing) — these details differentiate a strong answer from a surface-level one.
- Cross-reference the broader "Network Attacks" page for the passive/active and CIA-triad theoretical framing if the question is more conceptual rather than a direct enumeration.
Example
A phishing email impersonating a bank asking a customer to "verify" their account details is a textbook example still highly relevant to Pakistan's growing digital banking user base (Easypaisa, JazzCash, and traditional bank apps), and a realistic applied example to cite in an answer.
Likely Questions
- Enumerate and briefly explain common types of network security attacks.
- Differentiate stored and reflected Cross-Site Scripting (XSS).
- Why is SQL Injection possible, and what is the standard mitigation technique?
- What distinguishes a DDoS attack from a simple DoS attack in both mechanism and mitigation?
📜 Past-Paper Questions & Structured Answers
Questions are paraphrased; answer focus is suggested guidance, not an official marking scheme.
Year-label clarification: “2016” describes the old topic heading; no 2016 seven-attack-list question was found in the reviewed paper. Treat the list above as a revision checklist, not a verified ranking or quotation from FPSC.
2022 · Paper-II · Q5(c) · 6 marks
Question (paraphrased): Explain handshake resource exhaustion and assess a backlog limit.
Answer focus: Mechanism, denial of service, why the cap is insufficient and mitigation.
SYN flood mechanism: a conventional TCP server receives SYN, sends SYN-ACK and retains half-open state while waiting for the final ACK. An attacker creates many such incomplete connections, exhausting pending-state capacity and blocking genuine clients.
Backlog assessment: limiting pending entries bounds resource use, but a full queue still excludes legitimate arrivals. Enlarging it increases capacity without removing the underlying vulnerability.
Mitigation: SYN cookies encode enough state in the server response to defer allocation until a valid final ACK. SYN proxies, appropriate timeouts, rate limiting and filtering can complement cookies. A volumetric flood may still overwhelm a link even when handshake state is protected.
Relevance to the list: this is a protocol/state-exhaustion DoS example. Do not answer a specific handshake question with an unrelated seven-item attack list.
Broader related answers: 2017 technical safeguards (8 marks), 2021 computer crimes/ethics (7 marks), and 2022 security/privacy principles (6 marks) are developed in Network Attacks.