Types of attacks

This objective focuses on understanding how attackers exploit structural weaknesses in network protocols and human behavior to compromise a network. CompTIA divides these threats into infrastructure-level attacks and social engineering tactics.

Let’s break down these common attack methodologies and their impacts on network operations.

1. Denial of Service (DoS / DDoS)

The primary goal of these attacks is to destroy Availability by overwhelming a system’s resources until legitimate users can no longer access it.

• DoS (Denial of Service): A single attacker, using a single computer and an internet connection, targets a victim system, attempting to exhaust its CPU, memory, or network bandwidth. Because it originates from one IP address, a simple firewall rule can usually block it.
• DDoS (Distributed Denial of Service): A coordinated attack originating from thousands or millions of geographically distributed devices that simultaneously attempt to overwhelm a target. The attacker infects vulnerable computers and IoT devices worldwide with malware, turning them into a massive, remote-controlled army called a Botnet. When the attacker sends commands, the entire botnet floods the target simultaneously, making it incredibly difficult to defend against because blocking individual IP addresses is useless.

2. Layer 2 & Network Protocol Attacks

These attacks exploit fundamental local area network protocols (such as Ethernet, ARP, and VLAN trunking) to bypass security boundaries.

VLAN Hopping

• The Attack: An attacker plugs into a standard access switch port but tricks the switch into believing their device is actually a secondary switch. This allows them to forge an 802.1Q trunk link directly to their laptop.
• The Impact: Once a trunk link is established, the attacker can bypass security routers and inject traffic directly into any other VLAN on the network (e.g., hopping from the Guest VLAN into the secure Server VLAN).
• Mitigation: Disable Dynamic Trunking Protocol (DTP) on all user access ports and explicitly hardcode them as access mode.

MAC Flooding

• The Attack: A switch uses a Content Addressable Memory (CAM) table to map physical MAC addresses to specific switch ports. An attacker sends millions of fake, randomized MAC addresses into a single switch port within seconds.
• The Impact: The switch’s CAM table runs out of memory and overflows. When a CAM table fills up completely, most switches enter a fail-safe state called Fail-Open Mode. In this mode, the switch stops behaving like an intelligent switch. It starts acting like an unmanaged legacy network Hub, broadcasting 100% of incoming network traffic out of every physical port. The attacker can then easily capture sensitive passwords or data in transit over other users’ ports.
• Mitigation: Implement Port Security to limit the number of allowed MAC addresses per port.

ARP Spoofing & ARP Poisoning

Address Resolution Protocol (ARP) resolves known Layer 3 IP addresses to local Layer 2 MAC addresses. It has no built-in authentication, making it highly vulnerable to manipulation.

• ARP Spoofing: An attacker sends fake, unsolicited ARP messages across the local network, claiming that their physical laptop’s MAC address is officially tied to the IP address of the default gateway router.
• ARP Poisoning: The actual consequence of spoofing. The neighboring computers accept the fake information and update their internal ARP caches with the fraudulent mapping.
• The Impact: Every computer in the office blindly directs its outbound internet traffic straight to the attacker’s laptop instead of the real router, enabling an immediate On-Path (Man-in-the-Middle) data capture.
• Mitigation: Enable Dynamic ARP Inspection (DAI) on local switches.

3. Name Resolution & Wireless Attacks

DNS Spoofing & DNS Poisoning

While ARP attacks target the local network, DNS attacks target how names are resolved across the network or wider internet.

• DNS Spoofing: The general practice of redirecting a user to a fraudulent IP address when they type a valid website name into their browser.
• DNS Poisoning: The attacker targets a local DNS caching server, injecting a fraudulent record into its active database (e.g., mapping yourbank.com to the attacker’s malicious server IP instead of the bank’s real IP).
• The Impact: Every user on that network who subsequently attempts to browse that website will be seamlessly directed to a perfect visual clone of the site built by the attacker to harvest corporate credentials.
• Mitigation: Implement DNSSEC to cryptographically validate name resolution signatures.

Rogue Devices and Services

Unsanctioned hardware introduced to a secure network without administrative approval.

• Rogue DHCP Server: An attacker plugs an unauthorized DHCP server (or a misconfigured home router) into an office network drop. It begins handing out fake IP addresses and incorrect DNS servers, and it points its default gateway option back to the attacker’s device to intercept client traffic.
• Rogue Access Point (AP): An employee or an attacker plugs a cheap wireless router directly into an open wall jack in the office, creating an unmonitored wireless backdoor into the corporate network that completely bypasses formal firewall security policies.

Evil Twin

• The Attack: A highly deceptive wireless attack. The attacker configures a portable access point to broadcast the exact same SSID name as the legitimate local corporate Wi-Fi (e.g., “Corporate_Guest”). They position themselves close to users and blast a strong signal, or execute a deauthentication attack to kick devices off the real network.
• The Impact: Users’ devices automatically connect to the attacker’s stronger rogue signal instead of the real corporate access point, allowing the attacker to capture all unencrypted traffic as it passes through their devices.

4. On-Path Attacks

• What it is: Historically known as a Man-in-the-Middle (MitM) attack. The attacker positions themselves logically or physically directly between two communicating endpoints (such as a user’s workstation and a web server).
• The Impact: Neither the user nor the server notices anything wrong because the attacker seamlessly relays the packets back and forth. However, because the data passes through the attacker’s interface, they can silently record sensitive sessions, inject malicious payloads, or modify data in transit in real time.

5. Social Engineering & Human Exploits

Social engineering bypasses advanced technical firewalls by targeting the weakest link in any security blueprint: human psychology.

• Phishing: Mass email campaigns that appear to be authentic messages from trusted sources (banks, IT support, delivery services). They rely on urgency or fear to trick users into clicking malicious links, entering corporate login credentials, or downloading infected attachments.
• Tailgating (Piggybacking): A physical breach where an unauthorized individual closely follows an authorized employee through a secure doorway or badge-access gate, entering a building without scanning their own credentials.
• Shoulder Surfing: Simply looking over an employee’s shoulder to covertly watch them type PIN codes or passwords, or view sensitive documents on their screen.
• Dumpster Diving: Searching through physical trash bins or recycling dumpsters outside an office building to locate un-shredded papers containing proprietary network layouts, access credentials, passwords, or employee roster lists.

6. Malware

Malware is an umbrella term for any type of malicious software engineered to damage, disrupt, or exploit a system.

• Viruses: Malicious code that attaches itself to a legitimate file or program and relies on human action (like running an executable) to spread to other files.
• Worms: Self-replicating malware that does not require human interaction. It scans the local network independently, identifies unpatched system vulnerabilities, and exploits them to automatically crawl from computer to computer, exhausting network bandwidth.
• Ransomware: Encrypts the local file systems or network shares of an organization, completely locking users out. The attackers demand a cryptocurrency payment in exchange for the decryption key.
• Trojan Horse: Malicious code that masquerades as a helpful, legitimate utility (such as a free game or file compressor). Once installed by the user, it executes its hidden malicious payload in the background.
• Spyware / Keyloggers: Software that silently records user keystrokes, screenshots, and web activity, then sends the stolen data to an external server controlled by the attacker.

Attack Identifiers Study Matrix

Attack Type	Primary Target Layer	Core Exam Identifier / Clue
DDoS	High Availability	Uses a global network of compromised Botnets to swamp targets.
MAC Flooding	Layer 2 Switch	Overflows the CAM table, forcing the switch into a legacy hub state.
ARP Poisoning	Local Network / Cache	Associates the attacker’s MAC address with a router’s IP address.
DNS Poisoning	Name Server Database	Alters hostname records to steer users to fraudulent IP hosts.
Evil Twin	Wireless RF	Broadcasting a duplicate SSID name to capture user sessions.
Worm	System Automation	Self-replicating malware that spreads across networks without human aid.