Securing Networks · 3.1
⚔️ Common Network Attacks
The tactics attackers use to disrupt, steal from, and control networks⏱ ~3 min
🏙️A network is a city — and criminals attack cities in specific ways
A city can be robbed (data theft), vandalized (defacement), shut down (denial of service), or have its communications intercepted (man-in-the-middle). Network attacks map directly to physical crime analogies. Understanding the attack type tells you the attacker's goal — and the appropriate defense.
Six Major Network Attack Categories
| Attack Type | How It Works | Goal | Real Example |
|---|---|---|---|
| Phishing | Fraudulent email/message tricks victim into revealing credentials or installing malware | Credential theft, malware delivery | 2016 DNC email breach: spear-phishing email tricked staffer into entering Gmail credentials on a fake page |
| Malware | Malicious software installed on victim's system via email attachment, download, or drive-by | Data theft, ransomware, remote control | WannaCry ransomware (2017): infected 230,000 computers in 150 countries in one day |
| Man-in-the-Middle (MitM) | Attacker intercepts communications between two parties, reading or modifying traffic | Credential theft, session hijacking, data manipulation | Open WiFi packet sniffing captures unencrypted login sessions |
| Ransomware | Encrypts victim's files and demands payment for decryption key | Financial extortion | Colonial Pipeline (2021): $4.4M ransom paid; fuel distribution to SE United States disrupted for 5 days |
| Denial of Service (DoS/DDoS) | Floods target with traffic to make it unavailable to legitimate users | Disruption, extortion, distraction | 2016 Dyn DNS attack took down Twitter, Netflix, Reddit for hours using Mirai botnet (IoT devices) |
| Man-in-the-Mobile (MitMo) | Malware on mobile device intercepts SMS verification codes (bypassing MFA) | Bypass two-factor authentication | Zeus banking trojan's mobile component captured SMS OTPs to drain bank accounts |
Why Network Attacks Happen
- •Financial gain — ransomware, credential theft for banking fraud, selling stolen data on dark web
- •Espionage — nation-states stealing intellectual property, military secrets, or political intelligence
- •Disruption / hacktivism — DDoS attacks against organizations the attacker opposes politically
- •Competitive advantage — corporate espionage, stealing trade secrets or customer lists
- •Revenge — disgruntled employees or ex-contractors with residual access
- •Challenge / notoriety — proving skill; script kiddies gaining reputation in attacker communities
Recognizing a Phishing Email — Checklist
- •🚩 Sender domain — does it match the company it claims to be? (paypa1.com ≠ paypal.com)
- •🚩 Urgency language — 'Act immediately', 'Your account will be suspended', 'Final warning'
- •🚩 Suspicious links — hover before clicking; URL shown differs from URL in text
- •🚩 Request for credentials — legitimate companies never ask for your password via email
- •🚩 Generic greeting — 'Dear Customer' instead of your actual name
- •🚩 Unexpected attachment — especially .exe, .zip, .doc with macros, or .pdf with embedded links
- •🚩 Grammar/spelling errors — less common with AI-generated phishing now, but still a signal
Staying Safe Online — Five Core Habits
- 1.Verify before you click — hover over links; go directly to websites instead of clicking email links
- 2.Enable MFA everywhere — a phished password is useless without the second factor
- 3.Keep software updated — most malware exploits known vulnerabilities that patches already fixed
- 4.Use unique passwords per site — credential stuffing only works when you reuse passwords
- 5.Trust your instincts — if an email feels off, it probably is. Call the sender directly using a known number to verify
★ FactThe average organization faces 700+ social engineering attacks per year. In 2024, the FBI's Internet Crime Complaint Center (IC3) received 880,418 complaints with potential losses exceeding $12.5 billion — a 22% increase from 2023. Phishing remained the #1 attack vector for the 5th consecutive year.
🧠Quick Checkfirst try = +5 XP
A company's CEO receives an urgent email from what appears to be the CFO: 'I'm in a board meeting and can't talk — we need to wire $87,000 to a vendor immediately for a time-sensitive contract. I'll explain later. Here are the wire instructions.' The email domain is cfO@company.com (capital O, not zero). What attack type is this, and what should the CEO do?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days