Security Attacks

1. What Is a Security Attack?

Per X.800 / Stallings, a security attack is any action that compromises the security of information — it is the threat that services protect against and mechanisms defeat. Attacks split into two families:

PASSIVE (listen, don't touch)          ACTIVE (modify / disrupt)
- Release of message content            - Masquerade
- Traffic analysis                      - Replay
                                        - Modification of messages
                                        - Denial of service
Hard to detect, prevent by encryption   Easy to detect, hard to prevent

2. Passive Attacks — Eavesdropping

Attacker only observes; sender and receiver are unaware. Goal is information, not disruption.

Release of message content: reading transmitted data — e.g. tapping a telephone line, sniffing unencrypted HTTP/Wi-Fi, reading an email in transit. Countered by confidentiality service via encryption.
Traffic analysis: even if content is encrypted, attacker observes metadata — who talks to whom, when, how much, packet sizes. Example: encrypted troop HQ traffic spikes before an attack; observing that "General called HQ 10 times tonight" leaks intent. Countered by traffic-flow confidentiality — padding, dummy traffic, onion routing (Tor), frequency hiding.

Passive attacks are hard to detect (no trace left) so the emphasis is on prevention, not detection.

3. Active Attacks — The Four Types

Attacker modifies, replays, fabricates or disrupts. Easy to detect (service breaks) but hard to prevent outright — need detection + recovery.

Attack	What happens	Example	Defeated by
Masquerade	Impersonation — pretends to be someone else	Fake bank login page, spoofed sender address, attacker logging in as admin	Authentication, certificates
Replay	Passively captures data, retransmits later to gain effect	Re-send a captured bank transfer or login token; replay old sensor reading	Nonces, timestamps, sequence numbers + authentication
Modification of messages	Alters, deletes, inserts or reorders messages	Change "pay Rs 100" to "pay Rs 10000", delete "abort attack" order	Integrity (hash/MAC/signature)
Denial of Service (DoS)	Prevents normal use — floods, disables or overloads	SYN flood, Smurf, DDoS on exam portal; jamming wireless; ransomware locking files	Availability measures: filtering, rate limiting, redundancy

Masquerade often enables the others (impersonate → then modify/replay). Replay is sometimes classed under modification, but Stallings lists it separately — remember all four names for 2-mark lists.

4. Passive vs Active — Exam Table

Point	Passive	Active
Effect on data	Only reads	Modifies / disrupts / fabricates
Victim awareness	Unaware	Service degradation reveals it
Difficulty	Hard to detect, easy to prevent (encrypt)	Easy to detect, hard to prevent (need detect + recover)
Services needed	Confidentiality (+ traffic-flow)	Authentication, integrity, non-repudiation, availability
Examples	Sniffing, traffic analysis	Spoofing, replay, tampering, flooding

Exam Points

Definition + two families with the 2 + 4 names — 2-mark list question core.
Traffic analysis example ("metadata leaks even when encrypted") — favourite 2-mark short note.
Table passive vs active (detect vs prevent line) — 5-mark theory.
Map each active attack to its service: masquerade→authentication, replay/modify→integrity, DoS→availability.

Security Attacks