Attacks and their impact on the network

Why this matters

Objective 4.2 is "summarize various types of attacks and their impact to the network", and summarize sets the depth: you need to recognise each attack from a description and know what it does. You are not expected to perform them.

The useful way to learn this list is by which trust each attack abuses. Almost every attack here exploits a protocol that was designed for a cooperative network and simply believes what it is told — ARP, DHCP and DNS have no authentication at all, and three of the attacks below are just that fact used deliberately.

The lesson

ARP poisoning and ARP spoofing

Address Resolution Protocol (ARP) maps an IP address to a MAC address on the local segment. It has no authentication whatsoever: a host asks "who has 192.168.1.1?" and believes the first answer, and it will also accept unsolicited replies.

ARP poisoning / ARP spoofing exploits that. The attacker sends forged ARP replies claiming that the gateway's IP belongs to the attacker's MAC address. Victims update their ARP caches and start sending their traffic to the attacker, who forwards it on so nothing appears wrong.

The result is an on-path position on a switched network, which the switch itself cannot prevent because the frames are correctly addressed as far as it is concerned.

Mitigations: dynamic ARP inspection on the switch, which validates ARP against DHCP snooping data; static ARP entries for critical addresses; and encryption, so that being on the path yields nothing readable.

On-path attack

An on-path attack — the term that replaced "man-in-the-middle" — is any position where the attacker sits between two parties, able to read and potentially alter traffic while both believe they are talking directly.

ARP poisoning is one route to it. Others are a rogue access point, DNS manipulation, a compromised router, or a malicious proxy.

What it enables: reading credentials and data, modifying content in flight, and downgrade attacks that push a connection to weaker encryption.

The defence is authentication and encryption end to end. TLS with certificate validation is what defeats it, because the attacker cannot present a valid certificate for a domain they do not control — which is exactly why training users to click through certificate warnings is so damaging.

DNS poisoning and DNS spoofing

DNS poisoning corrupts a resolver's cache so that a name resolves to an attacker-controlled address. Everyone using that resolver is then sent to the wrong place, with no visible sign — the address bar shows the correct name.

DNS spoofing is the broader family: forged responses, a compromised DNS server, or a manipulated hosts file, all achieving the same result.

Mitigations: DNSSEC, which signs records so forged answers fail validation; restricting recursion so your resolver is not open to the internet; and encrypted transport (DoH/DoT) so responses cannot be tampered with in flight. This is the practical payoff of the DNS security material in domain 3.

Rogue devices and services

A rogue device or service is one operating on the network without authorisation.

A rogue DHCP server is the classic, and it may be malicious or accidental — someone plugging a home router into a wall port is the usual cause. It answers DHCP requests, and because clients accept whichever offer arrives first, some hosts receive the attacker's gateway and DNS settings. The symptom is distinctive and frequently examined: some clients work normally while others get a wrong address or gateway, apparently at random.

The mitigation is DHCP snooping, which designates trusted ports and drops server responses arriving on any other port.

A rogue access point is an unauthorised AP attached to the network, providing a path that bypasses the perimeter entirely. Wireless controllers scan for these; the wired-side control is 802.1X on access ports.

Evil twin

An evil twin is a rogue AP configured to impersonate a legitimate network — same SSID, often stronger signal. Clients associate with it, sometimes automatically because the SSID is in their saved list, and all their traffic passes through the attacker.

It is frequently combined with a deauthentication attack that knocks clients off the real AP so they reconnect to the stronger imposter.

Mitigations: WPA3 and 802.1X, so the client authenticates the network rather than merely joining it; management frame protection, which blunts deauthentication; and wireless intrusion detection to spot a duplicate SSID on an unexpected BSSID — which is where the BSSID distinction from domain 2 earns its keep.

MAC flooding

Media Access Control (MAC) flooding targets the switch's MAC address table, which is finite. The attacker sends a flood of frames with random source MAC addresses until the table is full.

With no room to learn legitimate addresses, many switches fail open and begin flooding frames out every port — effectively behaving like a hub. The attacker then sees traffic that should have been switched only to its intended recipient.

The mitigation is port security, limiting the number of MAC addresses permitted per port and shutting the port down or restricting it when that number is exceeded.

VLAN hopping

VLAN hopping is reaching a VLAN you are not assigned to. Two methods:

Switch spoofing. The attacker's device pretends to be a switch and negotiates a trunk link, which then carries every VLAN. The mitigation is to disable automatic trunk negotiation and configure access ports explicitly as access ports.

Double tagging. The attacker sends a frame with two 802.1Q tags. The first switch strips the outer tag — which matches the native VLAN — and forwards the frame, which still carries the inner tag, into the target VLAN. Mitigated by changing the native VLAN to an unused one and not using VLAN 1 for anything, exactly as the trunking lesson set out.

Denial of service

Denial-of-service (DoS)/distributed denial-of-service (DDoS) attacks availability — the third leg of the CIA triad — by making a service unusable.

A DoS comes from one source. A DDoS comes from many, typically a botnet, which makes it far harder to absorb and far harder to block by address.

The categories:

• Volumetric — saturate the bandwidth. Often amplified by reflecting off services that return large responses to small queries: open DNS resolvers, NTP, and memcached. This is why open resolvers matter.
• Protocol — exhaust connection state, as in a SYN flood that opens half-connections and never completes them.
• Application layer — expensive requests that consume server resources while looking like ordinary traffic, which makes them hard to filter.

Mitigations: upstream scrubbing services, rate limiting, anycast to spread load across many sites, and a CDN in front of public services. The key point is that volumetric attacks cannot be mitigated at your own edge — if your link is full, the damage is already done upstream of anything you control.

Social engineering

Social engineering attacks the person rather than the technology, and it is how the majority of successful breaches begin — because it bypasses every control in this course.

Phishing is fraudulent messages designed to obtain credentials or deliver malware. Variants: spear phishing targets a specific person with researched detail; whaling targets executives; vishing uses voice calls; smishing uses SMS.

Dumpster diving is searching discarded material for useful information — printed configurations, network diagrams, password notes, decommissioned hardware. The control is shredding, and the secure disposal step from the decommissioning lesson.

Shoulder surfing is observing someone entering credentials, directly or via a camera. Controls are privacy screens, awareness, and positioning displays away from windows and walkways.

Tailgating is following an authorised person through a controlled door. Controls are mantraps, turnstiles, badge-in-badge-out, and a culture where challenging an unbadged stranger is expected rather than rude.

The pattern across all four: technical controls do not address them. Awareness training, verification procedures, and making the secure path the easy one are what work.

Malware

Malware is software written to cause harm. The categories that appear as answer options:

• Virus — attaches to a file and requires a user to run it.
• Worm — self-propagating across a network with no user action, which is why worms spread fastest and why exposed SMB has been so damaging.
• Trojan — appears legitimate and conceals a malicious function.
• Ransomware — encrypts data and demands payment. The network's defence is segmentation to limit spread, and tested, offline backups — the only reliable recovery, and the reason the DR lesson insists backups are validated.
• Spyware and keyloggers — capture activity and credentials.
• Rootkit — hides itself and other malware at a deep level, which is what makes it hard to remove and often means rebuilding the host.
• Botnet — a network of compromised machines under common control, used to launch the DDoS attacks above.