Topic 3.1 Notes – Network Vulnerabilities and Attacks
What Network Vulnerabilities and Attacks Are
A network vulnerability is a weakness in how a network is set up, protected, or trusted that an attacker can exploit.
A few quick reminders make the attacks easier to follow:
- IP address means the logical address used to route traffic.
- MAC address means the hardware address used on the local network.
- Switch forwards Ethernet frames inside a LAN.
- Default gateway moves traffic between the LAN and other networks.
- DNS turns domain names into IP addresses.
- ICMP carries control and diagnostic traffic, like ping.
Why networks get attacked:
- Intercept traffic and read data in transit
- Alter or redirect traffic by tricking systems about where to send it
- Disrupt communication with flooding or DoS
- Map the network to find useful targets
- Gain a foothold and move laterally to other devices
This connects straight to the CIA triad:
- Confidentiality gets hit by sniffing and interception
- Integrity gets hit by spoofing, poisoning, and redirection
- Availability gets hit by DoS and flooding
Common Network Attacks
ARP poisoning
ARP lets a gateway match an IP address to a MAC address on the local network. In ARP poisoning, an attacker sends false ARP info so the gateway links the victim’s IP to the attacker’s MAC.
That means traffic meant for the victim goes to the attacker first.
ARP spoofing as an on-path attack
This often creates an on-path attack. In the right-hand panel, the attacker is pretending to be each side of the connection so traffic passes through them first. Once in that position, the attacker can:
- copy traffic
- forward it
- alter it
- drop it
MAC spoofing is related, but different. It means faking a MAC address. Students often mix these up. ARP poisoning corrupts the IP-to-MAC pairing. MAC spoofing fakes the device identity.
MAC flooding
A switch keeps a table of which MAC addresses are on which ports. In MAC flooding, the attacker sends many frames with many fake source MAC addresses. This can overflow the switch’s table and force it into broadcast mode.
Then the attacker can capture traffic not meant for them.
That is sniffing or eavesdropping, which means capturing data in transit.
DNS poisoning
In DNS poisoning, the attacker plants a false domain-to-IP record by pretending to be a trusted name source. A user types the correct website name but gets sent to the wrong IP.
That often leads to credential harvesting. The fake site looks real, the user logs in, and the attacker steals the username and password.
Smurf attack
A smurf attack is a DoS attack using ICMP:
- The attacker sends ICMP requests to a broadcast address.
- The victim’s IP is spoofed as the source.
- Many devices reply to the victim.
- The victim gets flooded.
Smurf attack
The diagram shows the amplification effect. One spoofed set of ICMP requests triggers many replies toward the target.
A DDoS has the same goal of harming availability, but the traffic comes from many attacking devices.
Where These Attacks Get Their Opening
These attacks need an entry point:
- Missing or misconfigured firewalls can allow malicious traffic in for spoofing, flooding, or reconnaissance.
- Compromised device on the LAN gives the attacker an internal foothold for lateral movement.
- Unprotected physical switch ports let someone plug into the LAN unless port security is enabled.
- Wireless signals outside secure space let attackers capture traffic and beacon frames, which may reveal SSID and security protocol info.
- Failure to authenticate users or devices makes joining the network easier.
- Rogue access point means an attacker plugs a wireless AP into an internal port, creating wireless access to the LAN and possibly bypassing the perimeter firewall.
- Weak wireless encryption makes intercepted wireless traffic easier to compromise.
How to Classify the Risk
Risk terms need to stay clear:
- Vulnerability = weakness
- Threat = harmful actor
- Likelihood = chance of success
- Impact = harm caused
- Risk = likelihood + impact to assets
What changes likelihood:
- reachable from outside?
- physical access needed?
- authentication required?
- wireless encryption weak?
- segmentation or firewalls present?
- advanced skill required?
Automated vulnerability scanners find known weaknesses on networks, devices, and apps. Reports usually show:
- affected system
- vulnerability
- severity
- evidence
- mitigation
A scanner’s severity is not the same as organizational risk. Context matters.
Risk examples:
- High risk
Weak wireless encryption + one unsegmented internal network + valuable server. Easy access and high impact. - Moderate risk
Firewall allows external ICMP. Useful for reconnaissance, but not automatically severe. - Low risk
AP broadcasts beacon frames with SSID and encryption protocol. It reveals info, but does not grant access by itself.
Fast Scenario ID
- False IP-to-MAC pairing at the gateway means ARP poisoning
- Secret forwarding between two parties means on-path attack
- Too many fake MACs sent to a switch means MAC flooding
- Capturing traffic in transit means sniffing/eavesdropping
- False domain-to-IP record means DNS poisoning
- Fake login page stealing credentials means credential harvesting
- ICMP to broadcast with victim’s spoofed IP means smurf attack
- One compromised device reaching others means lateral movement
- Unauthorized wireless AP on an internal port means rogue access point
Key Takeaways
Network Vulnerability
A weakness in network access, forwarding, addressing, wireless protection, or traffic control that an adversary may exploit
Address Resolution Protocol (ARP)
A local-network protocol that associates IP addresses with MAC addresses in an ARP table
ARP Poisoning Attack
Sending falsified ARP packets that link a target’s IP address to the adversary’s MAC address, redirecting the target’s traffic to the adversary
MAC Spoofing
Faking the MAC address presented by a device, often to impersonate another device or a trusted identity
On-Path Attack / Man-in-the-Middle Attack
Secretly intercepting communication between two parties and copying or altering it before forwarding it, while both parties believe they communicate directly
MAC Flooding Attack
Overwhelming a switch’s MAC address table with frames from many apparent MAC addresses, forcing frames to be broadcast and exposed for capture
Eavesdropping / Sniffing
Capturing, recording, or copying data in transit without authorization, without necessarily altering it
DNS Poisoning Attack
Planting a false DNS record that maps a legitimate domain to an adversary-controlled IP address and redirects users to the wrong host
Credential Harvesting
Using a fake login site that imitates a real one to capture users’ genuine credentials
Denial-of-Service (DoS) Attack
An attack that makes a system, service, or resource unavailable to authorized users
Smurf Attack
A DoS attack that sends ICMP requests with the victim’s spoofed source address to a broadcast address, causing many devices to flood the victim with replies
Distributed Denial-of-Service (DDoS) Attack
A DoS attack in which multiple devices attack the same target simultaneously
Network Mapping
Gathering information about a network’s internal addresses, devices, services, and connections to identify targets for later attacks
Lateral Movement
Using access to one compromised device or system to reach and compromise other systems on the network
Rogue Access Point
An unauthorized wireless access point connected to an internal network port, creating a wireless path into the LAN that may bypass boundary firewalls
Automated Vulnerability Scanner
A tool that checks networks, devices, and applications for known vulnerabilities and reports findings, severity, evidence, and recommended mitigations
Threat
Something capable of exploiting a vulnerability and causing harm
Likelihood
The chance that a vulnerability will be successfully exploited
Impact
The magnitude of harm that would result if a vulnerability were exploited
Risk
The combination of the likelihood of exploitation and its potential impact on organizational assets
High Network Risk
A network risk that lets an adversary cause significant harm with relative ease, combining high likelihood with high impact
Moderate Network Risk
An intermediate network risk, often involving a weakness that reveals useful system information without by itself enabling severe harm
Low Network Risk
A network risk that is difficult to exploit and is likely to have only minimal negative impact
Beacon Frame
A frame broadcast by a wireless access point that announces network information such as its SSID and wireless security or encryption protocols
Notes
Network Vulnerability
A weakness in network access, forwarding, addressing, wireless protection, or traffic control that an adversary may exploit
Address Resolution Protocol (ARP)
A local-network protocol that associates IP addresses with MAC addresses in an ARP table
ARP Poisoning Attack
Sending falsified ARP packets that link a target’s IP address to the adversary’s MAC address, redirecting the target’s traffic to the adversary
MAC Spoofing
Faking the MAC address presented by a device, often to impersonate another device or a trusted identity
On-Path Attack / Man-in-the-Middle Attack
Secretly intercepting communication between two parties and copying or altering it before forwarding it, while both parties believe they communicate directly
MAC Flooding Attack
Overwhelming a switch’s MAC address table with frames from many apparent MAC addresses, forcing frames to be broadcast and exposed for capture
Eavesdropping / Sniffing
Capturing, recording, or copying data in transit without authorization, without necessarily altering it
DNS Poisoning Attack
Planting a false DNS record that maps a legitimate domain to an adversary-controlled IP address and redirects users to the wrong host
Credential Harvesting
Using a fake login site that imitates a real one to capture users’ genuine credentials
Denial-of-Service (DoS) Attack
An attack that makes a system, service, or resource unavailable to authorized users
Smurf Attack
A DoS attack that sends ICMP requests with the victim’s spoofed source address to a broadcast address, causing many devices to flood the victim with replies
Distributed Denial-of-Service (DDoS) Attack
A DoS attack in which multiple devices attack the same target simultaneously
Network Mapping
Gathering information about a network’s internal addresses, devices, services, and connections to identify targets for later attacks
Lateral Movement
Using access to one compromised device or system to reach and compromise other systems on the network
Rogue Access Point
An unauthorized wireless access point connected to an internal network port, creating a wireless path into the LAN that may bypass boundary firewalls
Automated Vulnerability Scanner
A tool that checks networks, devices, and applications for known vulnerabilities and reports findings, severity, evidence, and recommended mitigations
Threat
Something capable of exploiting a vulnerability and causing harm
Likelihood
The chance that a vulnerability will be successfully exploited
Impact
The magnitude of harm that would result if a vulnerability were exploited
Risk
The combination of the likelihood of exploitation and its potential impact on organizational assets
High Network Risk
A network risk that lets an adversary cause significant harm with relative ease, combining high likelihood with high impact
Moderate Network Risk
An intermediate network risk, often involving a weakness that reveals useful system information without by itself enabling severe harm
Low Network Risk
A network risk that is difficult to exploit and is likely to have only minimal negative impact
Beacon Frame
A frame broadcast by a wireless access point that announces network information such as its SSID and wireless security or encryption protocols
