15.01.2024 Views

CompTIA A+ Certification All-in-One Exam Guide

  • No tags were found...

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

network can be spoofed. Here are a few quick examples of commonly

spoofed data:

• Source MAC address and IP address, to make you think a packet came

from somewhere else

• E-mail address, to make you think an e-mail came from somewhere

else

• Web address, to make you think you are on a Web page you are not on

• User name, to make you think a certain user is contacting you when in

reality it’s someone completely different

Generally, spoofing isn’t so much a threat as it is a tool to make threats. If

you spoof my e-mail address, for example, that by itself isn’t a threat. If you

use my e-mail address to pretend to be me, however, and to ask my

employees to send in their user names and passwords for network login?

That’s clearly a threat. (And also a waste of time; my employees would never

trust me with their user names and passwords.)

Man-in-the-Middle In a man-in-the-middle (MITM) attack, an attacker taps

into communications between two systems, covertly intercepting traffic

thought to be only between those systems, reading or in some cases even

changing the data and then sending the data on. A classic man-in-the-middle

attack would be a person using special software on a wireless network to

make all the clients think his laptop is a wireless access point. He could then

listen in on that wireless network, gathering up all the conversations and

gaining access to passwords, shared keys, or other sensitive information.

Session Hijacking Somewhat similarly to man-in-the-middle attacks,

session hijacking tries to intercept a valid computer session to get

authentication information. gUnlike man-in-the-middle attacks, session

hijacking only tries to grab authentication information, not necessarily

listening in like a man-in-the-middle attack.

Brute Force CompTIA describes brute force as a threat, but it’s more of a

method that threat agents use. Brute force is a method where a threat agent

guesses many or all possible values for some data. Most of the time the term

brute force refers to an attempt to crack a password, but the concept also

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!