Here are three examples of network-based attacks and their typical targets:

Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks

• Target: These attacks aim to overwhelm a server or network with traffic, making it unavailable to legitimate users. Common targets include web servers, email servers, and DNS servers.
• How they work: In a DoS attack, a single attacker floods the target with a massive volume of traffic. DDoS attacks involve multiple, often geographically distributed, attackers or compromised devices (forming a botnet) that coordinate to generate an even larger-scale attack.
• Impact: A successful DoS or DDoS attack can cause significant disruptions, preventing users from accessing websites, online services, or network resources. This can lead to financial losses, reputational damage, and loss of productivity.
• Mitigation: As we previously discussed, mitigating these attacks often involves:
• Identifying the source of the attack and blocking the malicious traffic using techniques like Access Control Lists (ACLs) on routers or firewalls.
• Using specialized DDoS mitigation services that can identify and filter out malicious traffic.

On-Path or Man-in-the-Middle (MiTM) Attacks

• Target: MiTM attacks aim to intercept and potentially manipulate communication between two parties without their knowledge. They often target users on a local network who are accessing sensitive information like online banking credentials or confidential company data.
• How they work: An attacker on the same network as the victim can exploit vulnerabilities like ARP poisoning to position themselves between the victim’s device and the intended destination (e.g., the router or a server). The attacker can then intercept, view, and even modify the data being exchanged. We discussed the role of ARP poisoning in on-path attacks in our previous conversation.
• Impact: A successful MiTM attack can result in stolen credentials, data breaches, unauthorized access to systems, and malware infections.
• Mitigation: Common mitigation techniques, as we have covered, include:
• Enabling security features like Dynamic ARP Inspection (DAI) on network switches to prevent ARP poisoning.
• Using secure protocols like HTTPS, which encrypts data in transit, making it much more difficult for an attacker to intercept and read sensitive information.
• Educating users about the risks of connecting to untrusted networks and encouraging the use of VPNs on public Wi-Fi.

DNS-Based Attacks

• Target: These attacks exploit vulnerabilities in the Domain Name System (DNS), which translates domain names (e.g., google.com) to numerical IP addresses that computers use to communicate. By compromising the DNS system, attackers can redirect users to malicious websites or intercept their online activity.
• Types and how they work:
• DNS Poisoning: The attacker manipulates DNS records, either on a user’s device or a DNS server, to associate a legitimate domain name with a malicious IP address. When a user tries to access that domain, they are redirected to the attacker’s server.
• DNS Hijacking: Similar to DNS poisoning, but the attacker typically targets the user’s device directly by changing its DNS server settings to a malicious one controlled by the attacker. This gives the attacker control over all DNS lookups from the device.
• Domain Hijacking: The attacker exploits vulnerabilities to gain control of a domain name’s registration and redirects traffic to their servers.
• Impact: DNS attacks can lead to phishing attempts, malware infections, data theft, and disruption of legitimate services.
• Mitigation:
• Using secure DNS services like Cloudflare DNS (1.1.1.1) or Quad9 DNS (9.9.9.9), which offer enhanced security features like DNSSEC (DNS Security Extensions) to verify the authenticity of DNS records. We previously discussed these services as examples of trusted DNS servers.
• Implementing security best practices on DNS servers, such as using strong passwords, limiting administrative access, and keeping software up to date.
• Educating users about the dangers of clicking on suspicious links and verifying website authenticity before entering sensitive information.