Network Security Foundations: Malware, Denial of Service, Spoofing, and Trust
Network Attacks
On February 7, 2000, a 15-year-old Canadian teenager using the name MafiaBoy attacked Yahoo, Amazon, and eBay. The sites were disrupted for hours, with losses exceeding $1.2 billion and turmoil in the stock market. MafiaBoy was later identified as high-school student Michael Calce, who had compromised several university networks and used their servers for DDoS attacks. The incident directly contributed to the creation of many of today's cybercrime laws. MafiaBoy later left cybercrime and worked in network security.
In January 2017, malware was installed on 300 computers in 20 classrooms and laboratories at the University of Alberta, resulting in the theft of user information belonging to nearly 3,000 students.
In April 2017, a computer-science student at Laurentian University accessed the university's system without authorization to demonstrate its vulnerability. The incident exposed personal records of nearly 2,000 students, including passwords, telephone numbers, and grades.
The Internet was originally designed to connect mutually trusting users to a transparent network, so security did not seem as necessary. Today's networks are no longer fully transparent or mutually trusting. Network security therefore studies attacks against networks, defenses against them, and architectures that better prevent attacks.
Malware
Malware can lead to lost files and exposed private information. Some malware spreads by making copies of itself. A virus can depend on a user action, such as opening an infected attachment, while a worm can propagate without that interaction by exploiting a vulnerable system or application.
KNOWLEDGE QUIZ
Denial of Service
A denial-of-service (DoS) attack interferes with legitimate access to servers or network infrastructure. Flooding can exhaust a target's access-link capacity so that legitimate packets cannot obtain service. When several sources contribute traffic, the attack is distributed denial of service (DDoS).
IP Spoofing
IP spoofing means claiming a source IP address belonging to another system. This can obscure the source of unwanted traffic or exploit a service that wrongly treats an address as proof of identity. A stronger defense does not trust a visitor solely because of the claimed source IP address; it uses appropriate authentication as well.
Forge a source address and watch who gets fooled
Every IP packet carries a source address, but nothing in IP itself stops a sender from writing any address there. Build Mallory's packet on the diagram and see what an address-based trust rule does with it. All addresses are documentation examples; nothing is sent.
Mallory wants server A to run a transfer. A trusts host B by its IP address. Click src on Mallory's packet to forge the source, then click ➤ to send. Try the router's 🛡 filter and the server's 🔒 authentication as defenses.
KNOWLEDGE QUIZ
Review three defensive decisions
A campus service receives an unexpected executable attachment, suffers unavailable service when unwanted requests occupy capacity, and permits personal-record access based only on a claimed source IP. For each situation, identify the risk and propose one reasonable defensive action. Explain why increasing capacity alone does not fix the identity problem. Do not execute attachments or generate traffic.