The worksheetDownload the PDF
Answers

F11.4 Network attacks

Cyber security · GCSE · OCR J277 1.4.1, Edexcel 1CP2 4.2.1 · about 20 min

BugBotLab

What this lesson is about

Brute force, denial of service, data interception and SQL injection, and detecting a flood.

Questions 6 marks in all

  1. [1 mark]What is a brute force attack?

    1. ATrying every possible password until one works
    2. BFlooding a server with requests
    3. CReading data as it travels
    4. DTricking a database
    Answer: A. It relies on speed and short passwords.

  2. [1 mark]What does a denial of service attack do?

    1. AFloods a system so it cannot serve real users
    2. BSteals passwords
    3. CEncrypts files for ransom
    4. DReads private messages
    Answer: A. It attacks availability.

  3. [1 mark]How is intercepted data made useless to an attacker?

    1. ABy encrypting it
    2. BBy compressing it
    3. CBy deleting it
    4. DBy sending it faster
    Answer: A. Encrypted data is unreadable without the key.

  4. [1 mark]What is a botnet?

    1. AMany hijacked computers used together in an attack
    2. BA kind of firewall
    3. CA password manager
    4. DA backup system
    Answer: A. A DDoS uses a botnet to flood from many places at once.

  5. [1 mark]How is SQL injection prevented?

    1. AValidating input and keeping it separate from the query
    2. BUsing a faster database
    3. CEncrypting the web page
    4. DAdding more servers
    Answer: A. Never trust user input in a query.

  6. [1 mark]How many possible codes does a 4-digit PIN have?

    Answer: 10000. 10 to the power 4.

The task: flood detector

Count how many requests come from each address in requests. Print <address>: <n> for each, sorted from the most requests to the fewest. Any address with 5 or more requests is an attack: print BLOCK on its line, and at the end print blocked: <addresses>, the blocked addresses joined by , .

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

requests = [
    "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5", "10.0.0.2",
    "10.0.0.5", "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5",
]

The hint students can ask for: Count the requests per address into a dictionary, then sort those counts from the largest down. Mark and collect any address that reaches the threshold, and list the collected ones at the end.

A solution

from bugbot import *
connect()
requests = [
    "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5", "10.0.0.2",
    "10.0.0.5", "10.0.0.5", "10.0.0.9", "10.0.0.5", "10.0.0.5",
]
counts = {}
for address in requests:
    counts[address] = counts.get(address, 0) + 1
blocked = []
for address, n in sorted(counts.items(), key=lambda kv: kv[1], reverse=True):
    if n >= 5:
        print(f"{address}: {n} BLOCK")
        blocked.append(address)
    else:
        print(f"{address}: {n}")
print("blocked:", ", ".join(blocked))

Any program that meets the task's checks is marked correct in the simulator; this is one way, not the only way.