Network Attacks

Network attacks exploit weaknesses in computer networks, communication protocols and web applications. This lesson covers four key attack types required by the GCSE Computer Science specification: denial-of-service (DoS/DDoS), man-in-the-middle, brute force and SQL injection.

---

Denial-of-Service (DoS) Attacks

A denial-of-service (DoS) attack aims to make a computer, server or network resource unavailable to its intended users. The attacker floods the target with so many requests that it cannot respond to legitimate traffic.

How a DoS Attack Works

1. The attacker sends a huge volume of requests to the target server
2. The server's resources (CPU, memory, bandwidth) are consumed trying to process all the requests
3. Legitimate users cannot access the service — the website goes down or becomes extremely slow

Distributed Denial-of-Service (DDoS)

A DDoS attack uses many compromised computers (called a botnet) to flood the target simultaneously. Because the attack comes from thousands of different IP addresses, it is much harder to block.

Feature	DoS	DDoS
Source	Single computer	Many computers (botnet)
Scale	Limited by one machine's bandwidth	Massive — potentially millions of requests per second
Difficulty to block	Easier (block one IP)	Harder (thousands of different IPs)
Detection	Simpler pattern	Traffic appears to come from legitimate sources worldwide

Impact of DDoS Attacks

• Business revenue loss — an online shop cannot take orders while offline
• Reputation damage — customers lose confidence in the service
• Distraction — DDoS may be used to divert attention while another attack (e.g. data theft) takes place
• Service disruption — critical services like banking or healthcare may be affected

Defences Against DDoS

• Traffic filtering — identifying and blocking malicious traffic
• Content Delivery Networks (CDNs) — distributing traffic across many servers worldwide
• Rate limiting — restricting the number of requests from any single source
• Intrusion detection systems (IDS) — monitoring for unusual traffic patterns
• Redundancy — using multiple servers so the service can continue even under attack

---

Man-in-the-Middle (MITM) Attacks

In a man-in-the-middle attack, the attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other.

How MITM Works

1. Alice sends a message to Bob
2. The attacker intercepts the message before it reaches Bob
3. The attacker reads the message (and may modify it)
4. The attacker forwards the message to Bob, who believes it came directly from Alice
5. Neither Alice nor Bob knows the attacker is involved

Common MITM Techniques

Technique	Description
Wi-Fi eavesdropping	The attacker sets up a rogue Wi-Fi hotspot (e.g. "Free_Coffee_WiFi") and intercepts all traffic from users who connect
ARP spoofing	The attacker sends fake ARP messages to link their MAC address with a legitimate IP address on the local network
SSL stripping	The attacker downgrades an HTTPS connection to HTTP, removing encryption so data can be read in plaintext

Defences Against MITM

• Encryption (HTTPS/TLS) — encrypts data in transit so even if intercepted, it cannot be read
• VPN (Virtual Private Network) — creates an encrypted tunnel for all network traffic
• Certificate verification — browsers check SSL/TLS certificates to verify the identity of websites
• Avoiding public Wi-Fi for sensitive transactions (banking, email)
• HSTS (HTTP Strict Transport Security) — forces browsers to only use HTTPS connections

---

Brute Force Attacks

A brute force attack systematically tries every possible combination of characters until the correct password is found. It is the simplest form of password cracking — but it can be very effective against weak passwords.

How Brute Force Works

The attacker uses automated software to try passwords in sequence:

• a, b, c, ... z
• aa, ab, ac, ... zz
• aaa, aab, ... zzz
• And so on, including numbers and special characters

Time to Crack

The time required depends on password length, character set and computing power:

Password	Character Set	Combinations	Estimated Time
4 lowercase letters	26	456,976	Less than 1 second
6 mixed case + numbers	62	56.8 billion	Hours
10 mixed + symbols	95	59.9 quintillion	Thousands of years

Dictionary Attacks

A dictionary attack is a variation that tries common words and known passwords (e.g. "password", "123456", "qwerty") rather than every possible combination. It is faster than pure brute force because it targets likely passwords first.

Rainbow Tables

A rainbow table is a precomputed lookup table mapping password hashes to their original plaintext values. If an attacker obtains a database of hashed passwords, they can look up the hashes in the rainbow table to find the original passwords — without needing to crack each one individually.

Defences Against Brute Force

Defence	How It Works
Strong passwords	Longer passwords with mixed characters exponentially increase cracking time
Account lockout	Lock the account after a set number of failed attempts (e.g. 5)
Rate limiting	Introduce a delay between login attempts
CAPTCHA	Require human interaction to prevent automated attempts
Two-factor authentication	Even if the password is guessed, a second factor is needed
Salted hashing	Adding a random salt before hashing defeats rainbow table attacks

---

SQL Injection

SQL injection is an attack that inserts malicious SQL code into input fields on a website to manipulate the underlying database. It exploits applications that do not properly validate user input.

How SQL Injection Works

Consider a simple login form where the website builds an SQL query from user input:

SELECT * FROM users WHERE username = '[input]' AND password = '[input]'

An attacker enters the following as the username: ' OR 1=1 --

The query becomes:

SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = ''

• OR 1=1 is always true, so the query returns all rows
• -- comments out the rest of the query (including the password check)
• The attacker is logged in without knowing any valid credentials

What SQL Injection Can Do

• Bypass authentication — log in without valid credentials
• Extract data — read customer records, passwords, financial data
• Modify data — change prices, delete records, add admin accounts
• Delete data — drop entire database tables

Real-World Example: TalkTalk (2015)

The TalkTalk data breach was caused by SQL injection. Attackers stole personal details of approximately 157,000 customers. TalkTalk was fined £400,000 by the ICO — the largest fine at that time.

Defences Against SQL Injection

Defence	How It Works
Parameterised queries (prepared statements)	Separate the SQL code from user input so input is treated as data, not code
Input validation	Check that input matches expected formats (e.g. reject special characters in a username field)
Input sanitisation	Escape special characters that could be interpreted as SQL
Least privilege database accounts	The web application connects with limited permissions, reducing what an attacker can do
Web Application Firewall (WAF)	Filters incoming requests for known attack patterns

---

Key Terms Summary