Network attacks

Brute force, denial of service, data interception and SQL injection, and detecting a flood.

F11.4Cyber securityGCSE20 min

Covers OCR J277 1.4.1 Threats to computer systems and networks · Edexcel 1CP2 4.2.1 Network security

Do this lesson in the simulator

Print it: worksheet (PDF) · answers (PDF) · as a web page

Some attacks go straight at the network and its computers. This lesson covers the ones on the exam: guessing passwords by brute force, flooding a service until it falls over, listening in on data as it travels, and tricking a database with SQL injection. You will build a detector that spots a flood of requests.

Brute force

A brute force attack tries every possible password until one works. A four-digit PIN has only 10,000 possibilities, which a computer tries in a moment. The longer and more varied a password, the more combinations there are, and the longer brute force takes.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

secret = "3742"
for guess in range(10000):
    attempt = str(guess).zfill(4)             # 0000, 0001, ... 9999
    if attempt == secret:
        print("cracked:", attempt, "after", guess + 1, "tries")
        break

Run this in the simulator

A four-character password using lower-case letters has 26 to the power 4, about 457,000 combinations; add capitals, digits and symbols and it climbs fast. That is why length and variety matter, and why systems lock you out after a few wrong tries.

Bars whose length goes with how many digits each number has, showing how many passwords brute force may have to try for five kinds of passwordpasswords to try (a bar's length goes with how many digits the number has)4-digit PIN10 choices each10,0004 lower-case letters26 choices each456,9764 letters or digits26 + 26 + 10 = 62 each14.8 million8 lower-case letters26 choices each209 billion8 letters or digits62 choices each218 million millionthe defence either way: lock the account after a few wrong tries,so brute force never gets far down its list
Every extra character multiplies the count by the number of choices for it, so length and variety together turn 10,000 tries into hundreds of million million. A lock-out after a few wrong tries protects even a short PIN.

Denial of service

A denial of service (DoS) attack floods a system with so many requests that it cannot answer real users: availability is broken. A distributed denial of service (DDoS) does it from thousands of hijacked computers at once, called a botnet, which makes it much harder to block.

Two pictures of a flood of requests: on the left it reaches the server and real users get no answer; on the right a filter blocks it and real users get throughno protectiona filter in fronta flood ofrequestsreal userservera flood ofrequestsreal userserverfilterso busy that real usersget no answerblocks an address sending farmore than normal; real users get in
On the left the flood uses up the server, so it has nothing left for real users: availability is broken. On the right a filter, such as a firewall rule or a limit on requests per address, stops the flood before it arrives.

Data interception

Data travelling across a network can be intercepted and read by someone listening in, using software called a packet sniffer. On open Wi-Fi this is easy, which is why sensitive data is encrypted (lesson F11.6): intercepted, it is unreadable.

A message crossing open Wi-Fi twice, with a packet sniffer listening: without encryption it reads the message, with encryption it reads only ciphertextnot encryptedsenderreceiverMEET AT NOONsniffer reads: MEET AT NOONencrypted, key 3senderreceiverPHHW DW QRRQencryptsdecrypts with the keysniffer reads: PHHW DW QRRQ
The sniffer catches the message both times. Without encryption it can read it; encrypted, all it has is ciphertext, which is useless without the key. Encryption does not stop the interception, it makes it harmless.

SQL injection

A website that builds a database query out of what you type can be tricked. If a login box puts your input straight into a query, typing something like ' OR '1'='1 can make the query always true, letting an attacker in without a password. This is SQL injection. The fix is never to trust user input, and to use queries that keep the input separate from the command (lesson F7.4).

Detecting a flood

You cannot always stop an attack, but you can spot it. A sudden burst of requests from one source, far more than normal, is a sign of brute force or a flood. Count them and raise the alarm:

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

requests = ["10.0.0.5", "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5", "10.0.0.5"]
counts = {}
for address in requests:
    counts[address] = counts.get(address, 0) + 1
for address, n in counts.items():
    if n >= 4:
        print("BLOCK", address, "-", n, "requests")
    else:
        print("allow", address, "-", n, "requests")

Run this in the simulator

Task: flood detector

Count how many requests come from each address in requests. Print <address>: <n> for each, sorted from the most requests to the fewest. Any address with 5 or more requests is an attack: print BLOCK on its line, and at the end print blocked: <addresses>, the blocked addresses joined by ,.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

requests = [
    "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5", "10.0.0.2",
    "10.0.0.5", "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5",
]

Challenges

  1. How many tries does brute force need, at most, for a 6-digit PIN?
  2. Why is a DDoS from a botnet harder to block than a DoS from one computer?
  3. Explain in one sentence how SQL injection lets someone log in without a password.