CompTIA Security+ (SY0-601): Network Attacks
This section describes various flood attacks aimed at overwhelming systems with excessive traffic or malformed packets, including ping floods, smurf and fraggle attacks, SYN floods, and other specialized techniques like XMAS scans and teardrop attacks. It also covers more destructive attacks such as permanent DoS and fork bombs that exhaust system resources or cause hardware failure.
Flood Attack
A specialized type of DoS which attempts to send more packets to a single server or host than they can handle
Key Terms
Flood Attack
A specialized type of DoS which attempts to send more packets to a single server or host than they can handle
Ping Flood
An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings)
Smurf Attack
Attacker sends a ping to subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing
Fraggle Attack
Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets
SYN Flood
Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake
XMAS Attack
A specialized network scan that sends the FIN, PSH, and URG flags set and can cause a device to crash or reboot
Related Flashcard Decks
Study Tips
- Press F to enter focus mode for distraction-free studying
- Review cards regularly to improve retention
- Try to recall the answer before flipping the card
- Share this deck with friends to study together
| Term | Definition |
|---|---|
Flood Attack | A specialized type of DoS which attempts to send more packets to a single server or host than they can handle |
Ping Flood | An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings) |
Smurf Attack | Attacker sends a ping to subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing |
Fraggle Attack | Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets |
SYN Flood | Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake |
XMAS Attack | A specialized network scan that sends the FIN, PSH, and URG flags set and can cause a device to crash or reboot |
Ping of Death | An attack that sends an oversized and malformed packet to another computer or server |
Teardrop Attack | Attack that breaks apart packets into IP fragments, modifies them with overlapping and oversized payloads, and sends them to a victim machine |
Permanent DoS | Attack which exploits a security flaw to permanently break a networking device by reflashing its firmware |
Fork Bomb | Attack that creates a large number of processes to use up the available processing power of a computer |
DNS Amplification | Attack which relies on the large amount of DNS information that is sent in response to a spoofed query on behalf of the victimized server |
Stopping DDoS | GitHub suffered a 1.35 Tbps DDoS Blackholing or Sinkholing An IPS can prevent a small-scale DDoS Specialized security services cloud providers can stop DDoS attacks |
Session Theft | Attacker guesses the session ID for a web session, enabling them to take over the already authorized session of the client |
TCP/IP Hijacking | Occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access |
Blind Hijacking | Occurs when an attacker blindly injects data into the communication stream without being able to see if it is successful or not |
Clickjacking | Attack that uses multiple transparent layers to trick a user into clicking on a button or link on a page when they were intending to click on the actual page |
MITB | Man-in-the-Browser: |
Watering Hole | Occurs when malware is placed on a website that the attacker knows his potential victims will access |
Replay Attack | Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed Multi-factor authentication can help prevent successful replay attacks |
Transitive Attacks | Transitive Attacks aren’t really an attack but more of a conceptual method When security is sacrificed in favor of more efficient operations, additional risk exists |
DNS Poisoning | Occurs when the name resolution information is modified in the DNS server’s cache If the cache is poisoned, then the user can be redirected to a malicious website |
Unauthorized Zone Transfer | Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks |
Altered Hosts File | Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website Windows stores the hosts file in the following directory: |
Pharming | Occurs when an attacker redirects one website’s traffic to another website that is bogus or malicious |
Domain Name Kiting | Attack that exploits a process in the registration process for a domain name that keeps the domain name in limbo and cannot be registered by an authenticated buyer |
ARP Poisoning | Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the local area network Allows an attacker to essentially take over any sessions within the LAN ARP Poisoning is prevented by VLAN segmentation and DHCP snooping |