Computer Network and Security

Active and passive Attacks

• Passive Attacks

Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions. The goal of the opponent is to obtain information that is being transmitted. Two types of passive attacks are release of message contents and traffic analysis.

• Release of message contents

The release of message contents is easily understood (Figure 1.3). A telephone conversation, an electronic mail message, and a transferred file may contain sensitive or confidential information. We would like to prevent an opponent from learning the contents of these transmissions.

Fig 1.3

• Traffic analysis

A second type of passive attack is traffic analysis,  Suppose that we had a way of masking the contents of messages or other information traffic so that opponents, even if they captured the message, could not extract the information from the message. The common technique for masking contents is encryption. If we had encryption protection in place, an opponent might still be able to observe the pattern of these messages. The opponent could determine the location and identity of communicating hosts and could observe the frequency and length of messages being exchanged. This information might be useful in guessing the nature of the communication that was taking place.Passive attacks are very difficult to detect because they do not involve any change of the data. 

• Active Attacks

Active attacks involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: masquerade, replay, modification of messages, and denial of service.

• Masquerade:

A masquerade takes place when one entity pretends to be a different entity. 

• Replay:

It involves the passive capture of a data unit and than   re-transmit it to produce an unauthorized effect.

•  Modification of message:

Modification of messages simply means that some portion of a legitimate message is altered, or that
messages are delayed or reordered, to produce an unauthorized effect .

• Denial of service:

The denial of service prevents  the normal use or management of communications facilities 

. This attack may have a specific target; for example, an entity may suppress all messages 

directed to a particular destination . Another form of service denial is the disruption of an entire network, either by disabling the network or by overloading it with messages so as to degrade performance.