Security Attack Any action that compromises the security of information owned by
an organization.
Types of attacks
Passive
Active
Passive attack
A passive attack attempts to learn or make use of information from the system but does
not affect system resources.
Active attack
An active attack attempts to alter system resources or affect their operation.
Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions.
The goal of the opponent is to obtain information that is being transmitted.
Two types of passive attacks are
1. Release of message contents
2. Traffic analysis
Release of message contents
A telephone conversation, an electronic mail message, and a transferred file may
contain sensitive or confidential information.
Traffic analysis:
Even if messages are encrypted Opponent able to observe the pattern of the messages.
The opponent could determine the location and identity of communicating hosts and could
observe the frequency and length of messages being exchanged
Drawbacks of Passive attacks:
Very difficult to detect, because they do not involve any alteration of the data.
Neither the sender nor receiver is aware that a third party has read the messages or
observed the traffic pattern.
Active attack
An active attack attempts to alter system resources or affect their operation.
Active attacks involve some modification of the data stream or the creation of a false stream.
Can be subdivided into 4 categories:
1. Masquerade
2. Replay
3. Modification Of Messages
4. Denial Of Service
Masquerade
A masquerade takes place when one entity pretends to be a different entity .
Replay
Replay involves the passive capture of a data unit and its subsequent retransmission to
produce an unauthorized effect.
Modification of messages
Modification of messages simply means that some portion of a legitimate message is
altered, or that messages are delayed or reordered, to produce an unauthorized effect.
For example, a message meaning “Allow John Smith to read confidential file accounts” is
modified to mean “Allow Fred Brown to read confidential file accounts.”
The Denial of service prevents or inhibits the normal use or management of communication
facilities.
This attack may have a specific target.
• For example, an entity may suppress all messages directed to a particular
destination.
• Another form of service denial is the disruption of an entire network, either by
disabling the network or by overloading it with messages so as to degrade
performance.
The denial of service can take two forms
(1) flooding the server with an overwhelming amount of data.
(2) triggering some action on the server that consumes substantial computing resources.
Forces the server to perform heavy work .
Drawbacks of Active attacks
Difficult to prevent active attacks absolutely because of the wide variety of potential
physical, software, and network vulnerabilities.
Vulnerability is a flaw in a software, network or process thar attackers can exploit to
cause harm.
Differences between Active Attack and Passive Attack