Network attacks and countermeasures

Earlier lessons described attacks as they arose with each protocol and component. This lesson draws them together into the families a security manager must recognize: denial of service, interception and on-path attacks, spoofing, attacks on routing and naming, reconnaissance and attacks that use the network to move and exfiltrate data. For each family it explains how the attack works in principle, what the warning signs are and which countermeasures work. The treatment is conceptual: the aim is to choose and justify defenses, not to carry out attacks, and testing any network without written authorization may be a criminal offense.

Denial of service

A denial of service, DoS, attack aims to make a service unavailable to legitimate users. A distributed denial of service, DDoS, attack uses many sources at once, usually a botnet of compromised computers, routers, cameras and cloud servers. DDoS attacks fall into three broad types. Volumetric attacks flood the target's links with more traffic than they can carry, measured in bits or packets per second; record attacks reported by mitigation providers have exceeded several terabits per second. Protocol attacks exhaust state in servers, firewalls or load balancers, such as SYN floods filling connection tables. Application-layer attacks send seemingly legitimate requests, such as HTTP requests for expensive search pages, at a rate the application cannot handle; they need far less bandwidth and are harder to distinguish from real users. The HTTP/2 Rapid Reset technique disclosed in October 2023 is a recent example of an application-layer method that produced record request rates.

Reflection and amplification attacks combine spoofing with services that reply with more data than they receive. The attacker sends small requests with the victim's address forged as the source to many servers, such as open DNS resolvers, NTP servers, memcached servers or CLDAP servers, and those servers send their larger replies to the victim. The amplification factor is the ratio of response size to request size. Historical attacks used memcached with amplification factors reported in the tens of thousands, which produced a 1.35 Tb/s attack on a code hosting site in 2018.

# Amplification: attacker uplink multiplied by the protocol's amplification factor (illustrative factors)
attacker_mbps = 1_000  # 1 Gb/s of spoofed requests from a botnet
protocols = {'DNS (ANY, open resolver)': 50, 'NTP (monlist, legacy)': 500, 'CLDAP': 60, 'memcached (UDP, exposed)': 10_000}
for name, factor in protocols.items():
    gbps = attacker_mbps * factor / 1_000
    print(f"{name:28s} factor {factor:>6,}  potential attack {gbps:>10,.0f} Gb/s")
print('Real attacks are limited by reflector capacity and the network paths in between.')

DNS (ANY, open resolver)     factor     50  potential attack         50 Gb/s
NTP (monlist, legacy)        factor    500  potential attack        500 Gb/s
CLDAP                        factor     60  potential attack         60 Gb/s
memcached (UDP, exposed)     factor 10,000  potential attack     10,000 Gb/s
Real attacks are limited by reflector capacity and the network paths in between.

Countermeasures work at several levels. Upstream, ingress filtering by every network operator under BCP 38 would stop spoofed packets and with them most reflection attacks, but adoption is incomplete. At the organization's edge, DDoS protection comes from upstream scrubbing services, offered by internet providers and specialist firms, that divert traffic during an attack, filter it and return clean traffic; from content delivery networks that absorb load across many locations; and from rate limiting, SYN cookies and connection limits on firewalls and load balancers. In the application, caching, autoscaling, challenge pages for suspicious clients and protecting expensive operations behind authentication reduce the impact of application-layer floods. Organizations should also make sure their own servers cannot be used as reflectors by disabling unneeded UDP services, closing open resolvers and patching NTP and memcached configurations.

DDoS readiness is largely planning. Know which services matter most and what an outage costs; contract mitigation before an attack, because signing up during one is slow; document how to activate scrubbing, who has authority to do so and how to communicate with customers; run exercises; and avoid single points of failure such as one DNS provider. Extortion demands threatening DDoS are common; paying encourages repeat attacks and does not guarantee anything.

Interception and on-path attacks

An on-path attack, traditionally called man-in-the-middle, places the attacker between two parties so they can read, alter or inject traffic. Routes to an on-path position include ARP poisoning and rogue DHCP on local networks, rogue or evil twin access points, DNS spoofing and cache poisoning, BGP hijacking on the internet, compromised routers and malicious proxies, and malware on the endpoint itself. Once in position, attackers can capture credentials sent in clear text, strip or downgrade encryption, for example by preventing a redirect from HTTP to HTTPS, or present forged certificates and hope users click through warnings.

The decisive countermeasure is strong, authenticated encryption end to end: TLS with certificate validation, HTTP Strict Transport Security so browsers refuse to fall back to HTTP, HSTS preloading for important domains, mutual TLS between services, IPsec or WireGuard for network tunnels and SSH with verified host keys for administration. Encryption turns an on-path attacker from someone who can read and change everything into someone who can only observe metadata or disrupt traffic. Supporting controls make on-path positions harder to obtain: dynamic ARP inspection, DHCP snooping, 802.1X with server certificate validation, DNSSEC and secure routing. Users and applications must treat certificate warnings as attacks, not inconveniences.

Spoofing

Spoofing means forging an identifier to impersonate something trusted. IP address spoofing forges the source of packets; it is easy for one-way traffic such as UDP floods and reflection, but much harder for full TCP sessions because the attacker does not see the replies unless on-path. MAC spoofing defeats MAC filtering and MAC-based authentication. Email spoofing forges the sender address, countered by SPF, DKIM and DMARC as lesson 7 described. Caller ID spoofing is addressed by STIR/SHAKEN. DNS spoofing returns forged answers. GPS spoofing, increasingly reported near conflict zones, forges satellite navigation signals and can affect the timing that some networks rely on, which is one reason critical networks use multiple time sources. The general countermeasure is to authenticate identities cryptographically rather than trust identifiers that anyone can forge.

Attacks on routing and naming

BGP has no built-in way to verify that an autonomous system is entitled to announce a prefix, so a mistaken or malicious announcement can redirect traffic for large parts of the internet. Well-known incidents include the 2008 event in which a Pakistani operator's announcement, intended to block a video site domestically, leaked globally and made the site unreachable worldwide for hours, and a 2018 hijack of address space belonging to a major cloud DNS service, used to redirect users of a cryptocurrency wallet site to a fraudulent server and steal funds. Route leaks, where a network wrongly propagates routes it learned from one provider to another, cause similar disruption by accident.

RPKI lets address holders publish signed route origin authorizations stating which autonomous systems may originate their prefixes and with what maximum prefix length; networks that perform route origin validation reject invalid announcements. Adoption has grown substantially, and by 2025 roughly half of announced IPv4 routes were covered by route origin authorizations, according to public RPKI monitoring services. RPKI does not validate the whole path; work on path validation continues, with ASPA, autonomous system provider authorization, being standardized. Organizations should create authorizations for their own prefixes, ask their providers whether they validate routes, and monitor announcements of their address space. The Mutually Agreed Norms for Routing Security, MANRS, initiative promotes filtering, anti-spoofing, coordination and validation among network operators.

Naming attacks target DNS and domain registration. Besides cache poisoning, attackers take over domains through compromised registrar accounts, change records at DNS hosting providers, register look-alike domains and exploit dangling DNS records that still point to cloud resources the organization has deleted, letting an attacker claim the resource and serve content on the organization's subdomain. Controls include registrar lock and multifactor authentication on registrar and DNS accounts, DNSSEC, monitoring for look-alike registrations and certificate issuance through certificate transparency logs, removing DNS records when resources are retired and CAA records that restrict which certificate authorities may issue certificates for the domain.

Reconnaissance, lateral movement and exfiltration

Attacks unfold in stages, and network controls can interrupt several of them. Reconnaissance gathers information: passive methods use public sources such as DNS records, certificate transparency logs, search engines and leaked data; active methods scan ports, probe services and map networks. Defenders reduce their exposed surface, monitor for scanning and use the same techniques on themselves through attack surface management. After initial access, attackers move laterally, using stolen credentials and remote administration protocols such as SMB, RDP, WinRM and SSH. Segmentation, restricting administrative protocols to management hosts, and detecting unusual internal connections stop or reveal lateral movement. Command and control, C2, channels let attackers direct compromised hosts, often over HTTPS, DNS or legitimate cloud services to blend in. Exfiltration sends stolen data out, sometimes in bulk, sometimes slowly to avoid detection.

Network detection and response tools analyze traffic metadata and flows to spot these patterns: a workstation suddenly connecting to hundreds of internal hosts, beaconing at regular intervals to a new domain, unusual DNS volumes, or large outbound transfers at night. Egress filtering, allowing outbound traffic only through proxies and only to necessary destinations, makes C2 and exfiltration harder. Data loss prevention can inspect outbound content for sensitive data. None of these controls is perfect alone; together they raise the attacker's cost and the chance of detection.

Choosing countermeasures by risk

Countermeasures cost money and effort, so managers weigh them against risk. The quantitative approach from Domain 1 applies: the annualized loss expectancy, ALE, is the single loss expectancy multiplied by the annualized rate of occurrence, and a control is justified if the reduction in ALE exceeds its annual cost.

# Value of a network control using annualized loss expectancy (illustrative figures)
scenarios = {
    'DDoS outage of online store': dict(sle=600_000, aro_before=0.8, aro_after=0.1, cost=120_000),
    'Lateral movement to file servers': dict(sle=1_500_000, aro_before=0.3, aro_after=0.1, cost=180_000),
    'Evil twin credential theft': dict(sle=80_000, aro_before=0.5, aro_after=0.05, cost=60_000),
}
for name, s in scenarios.items():
    before = s['sle'] * s['aro_before']
    after = s['sle'] * s['aro_after']
    value = before - after - s['cost']
    print(f"{name:34s} ALE before ${before:>9,.0f}  after ${after:>8,.0f}  control ${s['cost']:>8,.0f}  net value ${value:>9,.0f}")

DDoS outage of online store        ALE before $  480,000  after $  60,000  control $ 120,000  net value $  300,000
Lateral movement to file servers   ALE before $  450,000  after $ 150,000  control $ 180,000  net value $  120,000
Evil twin credential theft         ALE before $   40,000  after $   4,000  control $  60,000  net value $  -24,000

The numbers are estimates, and qualitative factors matter too: legal obligations, safety, reputation and the effect on customers. A control with a slightly negative net value may still be required by regulation or contract, and a cheap control that removes a catastrophic but unlikely risk may be worth more than its ALE suggests. The point of the calculation is to make reasoning explicit and comparable, not to replace judgment.

Thinking like a manager

For DDoS, the manager's answer is planning and upstream capacity. For on-path attacks, it is authenticated encryption plus controls that make on-path positions hard to obtain. For spoofing, it is cryptographic authentication of identities. For routing and naming attacks, it is RPKI, registrar security, DNSSEC and monitoring. For lateral movement and exfiltration, it is segmentation, egress control and detection. And for every choice, it is a risk-based justification that leadership can understand.