Common Network Attacks (DoS, Spoofing, MITM)

Denial of Service (DoS) Attacks

A DoS attack aims to make a service unavailable, typically by overwhelming it with far more traffic or requests than it can handle, exhausting its resources until legitimate users can no longer get through.

DDoS: The Distributed Version

Single Attacker ------> Target   (a DoS attack - one source, easy to block)

Many Compromised Devices ----\
                               >------> Target   (a DDoS attack - thousands of sources)
Many Compromised Devices ----/

A Distributed Denial of Service (DDoS) attack uses many compromised devices (a "botnet") simultaneously, making it far harder to block, since traffic arrives from thousands of different, seemingly legitimate-looking sources rather than one obvious attacker.

Spoofing: Pretending to Be Something Else

Spoofing means falsifying information - like a source IP address or a MAC address - to disguise the true origin of traffic, or to impersonate a trusted device. IP spoofing, for example, can make attack traffic appear to originate from a legitimate address.

Man-in-the-Middle (MITM) Attacks

In a MITM attack, an attacker secretly positions themselves between two communicating parties, intercepting - and potentially altering - traffic without either side realizing anything is wrong.

Normal:    You  <----------------------->  Website
MITM:      You  <----> Attacker <----> Website
                (attacker can read or modify everything passing through)

Why Encryption Defends Against MITM

HTTPS (covered earlier in this section) directly defends against MITM attacks: even if an attacker intercepts the traffic, the encrypted content is unreadable and any tampering is detectable, since the connection's integrity checks would fail.