Network, application and physical attack indicators

Objective 2.4 in this course covers malicious activity. This lesson finishes it, taking the network, application and physical attacks in CompTIA's scope note. As with the two lessons before it, the objective's verb is analysing indicators — each attack is presented as what it looks like from the defender's side.

Why this matters

This is the objective's widest spread of named terms, and it is also the one that feeds most directly into Domain 4. When you get to the lesson on reading logs to support an investigation, the whole exercise is matching a log extract to one of the names below.

The questions come in two shapes: "which attack is described?" and "what does this log show?". Both reward knowing the indicator rather than the mechanism.

The lesson

DDoS, amplified and reflected, and the traffic shape that gives it away

A denial of service makes a resource unavailable. Distributed denial of service does it from many sources at once, which removes the obvious defence of blocking the source.

CompTIA names two mechanisms:

• Amplified — the attacker sends a small request to a service that returns a much larger response. DNS, NTP and memcached are the classic amplifiers, with response-to-request ratios in the tens or hundreds.
• Reflected — the attacker spoofs the victim's address as the source, so the service's reply goes to the victim. The reflecting servers are innocent third parties and, from the victim's side, are the apparent attackers.

The two are almost always combined: a reflected, amplified attack lets a modest attacker generate enormous traffic that arrives from thousands of legitimate servers.

Indicators: a sudden traffic volume far above baseline; traffic overwhelmingly from one protocol and one source port (UDP/53, UDP/123); huge responses to requests you never sent; and — the distinguishing one — the sources are legitimate servers, not compromised hosts.

Controls: upstream scrubbing or a DDoS mitigation service, rate limiting, anycast to spread the load, and — for your own servers — making sure you are not an amplifier by disabling open recursion and monitoring.

An application-layer DoS is different in shape: low traffic volume, but each request is expensive. It looks like normal traffic until you notice response times climbing with no bandwidth increase.

DNS attacks, on-path, credential replay and malicious code

DNS attacks are a family:

• DNS poisoning / cache poisoning — inserting a false record into a resolver's cache, so users are sent to the attacker's address while typing the correct name. Indicator: a name resolving to an unexpected address, and resolution differing between resolvers. DNSSEC addresses it by signing records.
• Domain hijacking — taking control of the domain registration itself, usually by compromising the registrar account. More total than poisoning, and the control is registrar-side: registry lock and MFA on the registrar account.
• DNS tunnelling — encoding data inside DNS queries and responses to move data or run C2 through a channel almost nobody blocks. Indicator: unusually long query names, high query volume to one domain, high proportion of TXT or NULL records.
• URL redirection and typosquatting get people to the wrong place without touching DNS at all.

On-path (CompTIA's term for what older material called man-in-the-middle) is an attacker positioned between two parties, able to read and alter traffic. It is achieved by ARP poisoning on a local segment, a rogue or evil-twin access point, DNS poisoning, or route manipulation. Indicators: duplicate IP or changed MAC warnings, certificate warnings users learned to click through, and a gateway MAC address that changes. The control is authenticated encryption — TLS with proper certificate validation makes the position much less useful — plus dynamic ARP inspection and 802.1X on the network side.

Credential replay captures a valid authentication and reuses it. The defence is not secrecy but freshness: nonces, timestamps, sequence numbers and session tokens that expire, so a captured exchange is not valid a second time. Kerberos timestamps exist for exactly this reason.

Malicious code as an indicator category covers unexpected scripts, macros, and binaries executing — the evidence side of the previous lesson.

Injection, replay, privilege escalation, forgery and directory traversal

The application attacks, stated as what you would see:

• Injection — SQL, command, LDAP, XML. Indicator: input containing syntax for the interpreter behind the field — quotes, semicolons, comment markers, shell metacharacters — appearing in application logs or WAF alerts, usually followed by errors or unusually large responses.
• Replay — as above, at the application layer: the same request, valid signature or token, submitted again. Indicator: duplicate transaction ids or identical requests from different addresses.
• Privilege escalation — vertical is a user gaining higher privileges; horizontal is a user accessing another user at the same level, usually by changing an identifier in a request. Indicator: an account performing actions outside its role, a sudden group membership change, or sequential access to other users' records.
• Forgery — cross-site request forgery (CSRF) makes an authenticated user's browser submit an action they did not intend, exploiting the fact that the browser attaches their session automatically. Indicator: state-changing requests with a referrer from an unrelated site. The control is anti-CSRF tokens and SameSite cookies. Server-side request forgery (SSRF) makes the server fetch a URL the attacker chose — often internal addresses or the cloud metadata endpoint, which is how cloud credentials get stolen.
• Directory traversal — using ../ sequences or encoded equivalents to escape the intended directory and read files elsewhere. Indicator: traversal sequences in request paths, requests for /etc/passwd or Windows system paths. The control is canonicalising and validating paths, never building them from user input.

Environmental, RFID cloning, brute force and the physical side of the exam

CompTIA's physical attacks are three, and they are easy marks because they are rarely revised.

• Brute force, physically: forcing a door, cutting a lock, smashing a case. The controls are physical — stronger barriers, bollards, mantraps — and, importantly, detection, because a determined physical attacker will get in and the question is how quickly you know.
• RFID cloning: copying an access badge. Low-frequency proximity cards can be read at a distance and duplicated with cheap equipment. Controls are higher-security encrypted credentials, a second factor at sensitive doors, and — the cheap one — actually reviewing access logs for a badge used in two places.
• Environmental: attacking the conditions rather than the system. Cutting power, defeating cooling, triggering suppression. Indicator: environmental monitoring alerts, or an outage with no corresponding system fault. Controls are UPS, generators, redundant cooling and monitoring — which is Domain 3.

Adjacent physical concerns the exam raises: tailgating (following someone through a door) and piggybacking (being let through knowingly), shoulder surfing, dumpster diving, and the malicious USB from the vector lesson.

Reading a log extract and naming the attack, which is what 4.9 will drill

A short set of mappings to carry into Domain 4:

The technique that makes these fast: read for the anomaly, then name it. Every row above is a deviation from something normal — a rate, a direction, a geography, a character class, a group membership. Domain 4's investigation lesson formalises this into correlation across sources.

What to take into the exam

• Reflected attacks arrive from innocent third-party servers; amplification is about response size. They are usually combined.
• On-path is CompTIA's term for man-in-the-middle, and proper TLS validation is what makes the position much less useful.
• Replay is defeated by freshness — nonces, timestamps, expiring tokens — not by encryption alone.
• CSRF abuses the victim's browser; SSRF abuses the server, and the cloud metadata endpoint is its highest-value target.
• Horizontal escalation is sideways to another user's data; vertical is upward in privilege.