Threats, Vulnerabilities, and Mitigations · Topic 7 of 9
Network and Password Attacks
Security+ network and password attacks: DDoS, DNS poisoning, evil twin, on-path, replay, spraying, brute force, credential stuffing and downgrade.
- 4 min
- Includes a diagram
- DDoS harms availability. Amplified and reflected attacks use third parties to enlarge or hide the traffic.
- DNS poisoning places false records in a cache. DNSSEC helps verify answers.
- An evil twin copies a real network name. A rogue access point is any unauthorized access point.
What it is
Network attacks target the traffic and services that connect systems. Password attacks target the credentials that guard accounts.
You will be asked to name the attack from a short description, and to choose the control that stops it.
How it works
Denial of service
A distributed denial of service (DDoS) attack uses many systems to flood a target so that real users cannot reach it. It harms availability.
| Variation | How it works |
|---|---|
| Amplified | A small request triggers a much larger response sent to the victim |
| Reflected | The attacker spoofs the victim's address so that replies from third parties go to the victim |
| Application layer | Floods a service with requests that look legitimate |
Defenses include traffic filtering, rate limiting, a content delivery network and a scrubbing service from the provider.
DNS attacks
The Domain Name System (DNS) turns names into addresses. In DNS poisoning, false records are placed in a resolver's cache so users are sent to the wrong address. Domain hijacking takes control of a domain name registration.
DNS Security Extensions (DNSSEC) use digital signatures to help clients confirm that DNS answers are genuine.
Wireless attacks
| Attack | Description |
|---|---|
| Rogue access point | An unauthorized access point connected to the network |
| Evil twin | A fake access point that copies a real network name to trick users into connecting |
| Deauthentication | Forged management frames that knock clients off a network |
| Jamming | Radio noise that blocks the signal |
Using Wi-Fi Protected Access 3 (WPA3), enterprise authentication and wireless intrusion detection reduces these risks.
On-path and replay
An on-path attack (previously called man in the middle) places the attacker between two parties so that traffic can be read or altered. A replay attack captures valid data, such as a login exchange, and sends it again later.
Transport Layer Security (TLS) with certificate validation protects against on-path eavesdropping. Time stamps and one time values defend against replay.
Credential replay and malicious code
Credential replay reuses stolen authentication data, such as a captured hash or token, without learning the password. Malicious code attacks use scripts or programs that run on a victim system. Short lived tokens and multifactor authentication (MFA) limit their value.
Password attacks
| Attack | Description |
|---|---|
| Brute force | Tries every possible combination |
| Dictionary | Tries words from a list of likely passwords |
| Password spraying | Tries a few common passwords against many accounts to avoid lockout |
| Credential stuffing | Uses username and password pairs leaked elsewhere |
| Rainbow table | Uses precomputed hash values to find a password, defeated by salting |
Online attacks guess against a live login, so lockouts and rate limits help. Offline attacks work on a stolen hash file and are limited only by computing power, so slow salted hashing matters.
Cryptographic attacks
A downgrade attack forces a connection to use a weaker protocol. A collision attack finds two inputs with the same hash. A birthday attack uses the mathematics of probability to find collisions faster than expected.
What to remember for the exam
- DDoS harms availability. Amplified and reflected attacks use third parties to enlarge or hide the traffic.
- DNS poisoning places false records in a cache. DNSSEC helps verify answers.
- An evil twin copies a real network name. A rogue access point is any unauthorized access point.
- On-path attackers sit between two parties. Replay attackers resend captured data.
- Password spraying uses few passwords across many accounts, and brute force typically tries many guesses against one account.
- Credential stuffing uses leaked pairs from other sites.
- Salting defeats rainbow tables. MFA reduces the value of stolen passwords.
- A downgrade attack forces a weaker protocol.
If many accounts fail to log in with the same one or two passwords and no single account is locked, think password spraying.
Common mistakes
Confusing spraying with brute force. Spraying avoids lockout by spreading a few guesses across many accounts. Brute force hammers one account.
Mixing up evil twin and rogue access point. A rogue access point is any unauthorized device. An evil twin specifically imitates a legitimate network.
Thinking Hypertext Transfer Protocol Secure (HTTPS) blocks every on-path attack. It does when certificates are checked, but users who click through certificate warnings can still be exposed.
Believing reflected and amplified attacks are the same. One hides the source by bouncing traffic, and the other enlarges the response. Many attacks combine both.
Forgetting credential reuse. One breached site can expose accounts elsewhere if passwords are reused.
Account lockout helps against online guessing, but it does nothing against an offline attack on a stolen hash file.
Check yourself
What is the purpose of DNSSEC?
It adds digital signatures to DNS data so clients can check that answers are genuine.
What distinguishes password spraying from brute force?
Spraying tries a few common passwords against many accounts, while brute force tries many passwords against one account.
Which attack places the attacker between two communicating parties?
An on-path attack.
Topic 7 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.