What Are Passive and Active Security Attacks?

TL;DR

Security attacks fall into passive and active categories. Passive attacks secretly obtain information by reading message contents or analyzing communication patterns, while active attacks modify data, create false streams, impersonate entities, replay captured messages, or deny access to services. Encryption can conceal message contents, although traffic details such as host identity, message length, and transmission frequency may remain observable.

Transcript

in this presentation we will see about security attacks we will start the session with the outcomes upon the completion of the session the learner will be able to outcome number one we will understand various passive attacks outcome number two we will understand various active attacks and outcome number three we will know the differences between pa... Read More

Key Insights

• A security attack is an action that compromises the security of an individual or organization, potentially causing data loss, data corruption, ransomware, malicious software injection, or server defacement when the attack succeeds.
• The OSI security architecture has three key components: security attacks, security mechanisms, and security services. Security attacks are divided into two broad types, passive attacks and active attacks.
• A passive attack is unauthorized observation or reading of communications without changing the transmitted messages. Its goal is to obtain information, and it generally does not affect system resources because the attacker only monitors the communication.
• Release of message contents is a passive attack in which an attacker obtains and reads a copy of a message exchanged between legitimate parties. Encrypting the data can prevent the attacker from understanding the captured content.
• Traffic analysis is a passive attack that examines encrypted communication patterns rather than readable content. An attacker may observe communicating hosts, their locations or identities, message lengths, and transmission frequency to infer the nature of the communication.
• An active attack is an attack that modifies a data stream or creates and inserts a false data stream. Its four presented categories are masquerade, replay, modification of messages, and denial of service.
• Masquerade is an active attack in which one entity pretends to be another, such as by using stolen credentials or sending a message that appears to come from an authorized sender.
• Replay, message modification, and denial of service create unauthorized effects by retransmitting captured messages, altering legitimate content before delivery, or overloading a server until authorized users receive degraded performance or cannot access its service.

Questions & Answers

Q: What is a security attack in network security?

A security attack is an action that compromises the security of an individual or an organization. If successfully launched, it may cause loss or corruption of data, ransomware, injection of viruses, worms, or other malicious software into a network, or defacement of servers. The OSI security architecture treats a security attack as one of its three key components, alongside security mechanisms and security services.

Q: What is the difference between passive and active attacks?

A passive attack observes or reads transmitted information without modifying the messages, while an active attack changes data streams or creates false ones. Passive attackers seek information through eavesdropping, message reading, or traffic monitoring and generally do not affect system resources. Active attackers produce unauthorized effects through masquerade, replay, message modification, or denial of service.

Q: What are the types of passive security attacks?

The two presented types of passive security attacks are release of message contents and traffic analysis. Release of message contents occurs when an attacker obtains and reads communication between legitimate parties. Traffic analysis occurs when an attacker studies observable communication patterns, including host information, message length, and transmission frequency, even when encryption prevents direct understanding of the message contents.

Q: How does encryption help prevent release of message contents?

Encryption transforms a message before transmission so that only the intended parties can understand it through decryption. If Bob encrypts data before sending it and only Alice can decrypt it, an attacker who captures a copy cannot read the underlying message. Without encryption, the attacker may directly learn the information communicated between the sender and receiver.

Q: What information can traffic analysis reveal about encrypted messages?

Traffic analysis can reveal details about communication even when an attacker cannot understand encrypted message contents. The attacker may observe the location or identity of communicating hosts, the length of transmitted messages, the frequency of transfers, and broader message patterns. These observations can help the attacker guess the nature of the communication taking place between the legitimate parties.

Q: How does a masquerade attack work?

A masquerade attack occurs when one entity pretends to be a different entity. An attacker may steal another person's username and password, log in with those credentials, and appear legitimate because the system verifies the credentials. An attacker can also send a message that appears to come from an authorized sender, potentially using that identity to request additional privileges.

Q: What is a replay attack and how does it affect communication?

A replay attack occurs when an attacker captures a legitimate message and retransmits it later. For example, the attacker may collect messages sent from Bob to Alice and subsequently send the same messages again and again. The retransmission is intended to produce an unauthorized effect, confuse the receiver, or provoke the receiver by making captured communication appear valid again.

Q: How do message modification and denial-of-service attacks work?

Message modification occurs when an attacker captures a legitimate message, changes its contents, and sends the altered version to the receiver, who does not receive the sender's original instruction. A denial-of-service attack targets availability by overloading or stressing a server, degrading its performance, and preventing an authorized user from accessing or obtaining the service that the server should provide.

Summary & Key Takeaways

• A security attack is an action that compromises the security of an individual or organization. A successful attack can cause data loss, data corruption, ransomware, malicious software injection, or server defacement. Within the OSI security architecture, security attacks are considered alongside security mechanisms and security services as three key components.

• Passive attacks obtain information without modifying messages or affecting system resources. Release of message contents involves unauthorized reading of communications, while traffic analysis examines communication patterns. Encryption can prevent an attacker from understanding message contents, but observable metadata may still reveal details about the nature of the communication.

• Active attacks modify data streams or create false ones. Masquerade involves pretending to be another entity, replay retransmits captured messages, and message modification changes legitimate content before delivery. A denial-of-service attack overloads or stresses a server so that authorized users experience degraded performance or cannot obtain the requested service.