Question

Suppose Alice and Bob are sending packets to each other over a computer network. Suppose Trudy positions herself in the network so that she can capture all the packets sent by Alice and send whatever she wants to Bob; she can also capture all the packets sent by Bob and send whatever she wants to Alice. List some of the malicious things Trudy can do from this position.

Short answer

Trudy can perform packet sniffing, tampering, replay attacks, man-in-the-middle attacks, DoS, and data injection.

Step-by-step solution

Understand the Concept of Packet Sniffing

Trudy is in the position to intercept and capture the data packets traveling between Alice and Bob. This means she can view all the data Alice and Bob are sending to each other.

Packet Tampering

Trudy can alter the data within the intercepted packets. For example, if Alice is sending a message to Bob saying "Hello," Trudy could change this to "Goodbye" before forwarding it to Bob.

Replay Attacks

Trudy can store packets and send them to Bob or Alice at a later time, even after the session between Alice and Bob has ended. This is known as a replay attack.

Man-in-the-Middle Attack

As Trudy can intercept and modify communications going both ways, she can perform a man-in-the-middle attack. She can deceive Alice into thinking she is communicating with Bob and vice versa, thus controlling the entire conversation.

Denial of Service (DoS)

Trudy can choose to block certain packets from reaching their destination. By holding or discarding these packets, she can prevent Alice and Bob from communicating effectively, causing a denial of service.

Data Injection

Trudy can insert new packets into the data stream that Alice and Bob are not aware of. This could include malicious commands or false information.

Key concepts

Packet Sniffing

Packet sniffing refers to the practice of intercepting and logging data packets traveling over a network. When Trudy positions herself on the network between Alice and Bob, she can engage in packet sniffing. This enables her to see every message or data file exchanged between them. Think of it like eavesdropping on a conversation, except in a digital form.
Packet sniffing can be used to gather sensitive information such as:

• Usernames and passwords
• Personal messages
• Credit card details

To protect against packet sniffing, encryption techniques like SSL/TLS are often used. This allows the data packets to remain unreadable to anyone intercepting them, as only end-point devices have the decryption keys.

Packet Tampering

Packet tampering occurs when intercepted data packets are altered by an unauthorized party. In our scenario, Trudy could capture a message from Alice intended for Bob and change its content before passing it along. This means Bob's received message might not be the same as Alice's sent message.
The consequences of packet tampering can be severe, leading to:

• Miscommunication
• Fraud
• Unauthorised transactions

Detecting packet tampering usually involves verifying the integrity of a packet. Techniques like hash functions can be used where the sender appends a hash value of the message. If the received message's hash doesn't match, it indicates tampering has occurred.

Man-in-the-Middle Attack

A man-in-the-middle (MITM) attack involves an attacker secretly inserting themselves between two parties communicating, without them knowing. This allows the attacker to intercept, modify or block communication between the two.
In the exercise scenario, Trudy acts as this middle entity, controlling the conversation between Alice and Bob. It allows her to alter messages unnoticed and mislead both parties.
MITM attacks may result in:

• Loss of sensitive information
• Identity theft
• Unauthorized actions and decisions

Preventing such attacks involves using strong encryption protocols to secure communications. Additionally, proper authentication mechanisms ensure that each party in a communication is truly who they claim to be.

Replay Attack

A replay attack involves the malicious capturing and re-sending of packets at a later time to deceive the recipient. After storing conversations or packets, Trudy could decide to send them again to either Alice or Bob, often to mimic legitimate communication or activity.
This kind of attack can lead to:

• Duplicated transactions
• Fraudulent commitments
• Fooling systems for unauthorized access

Countermeasures against replay attacks generally involve timestamping and using unique session tokens in communications. When a system detects a timestamp that is out-of-date or recognizes a duplicated token, it can flag or dispense with the fraudulent packet.