Network and Protocol Attacks

Nothing on its own. The source address is chosen by whoever builds the packet, and nothing along the path verifies it, because routers forward on the destination. It proves a value was written, not who wrote it.

The resolver only accepts a reply that matches its outstanding query: same server address and port, same ephemeral port it asked from, same 16-bit message ID, same question. And it must arrive before the genuine answer.

A dangling DNS record still resolves to a target that is no longer yours: a released storage bucket, app slot or cancelled vendor tenant. Whoever re-registers that target name is then served under your subdomain.

The amplification factor is the ratio of response bytes reaching the victim to request bytes the attacker spent. A 62-byte request drawing a 3,000-byte answer runs at roughly 48x, so a small uplink delivers a large flood.

Bandwidth is one of four exhaustible resources. A site also runs out of connection-table entries, worker-pool slots, or headroom in one slow dependency every request waits on - any of which fails while the link sits idle.

Signing proves who composed the message and that nobody altered it; encryption hides it from others. Neither says this copy is the first. Only receiver-held state — a counter, remembered identifier or time window — refuses a duplicate.

Only that the sender holds a value the service issued earlier and has not expired. The factors were checked once, at issuance; every later request is honoured on possession alone. A session proves acceptance in the past, not presence now.

The lease route is far cheaper. One answer installs the attacker as gateway and resolver for that host and then needs no upkeep. Answering for the gateway's address covers one victim at a time and must be re-asserted continuously, forever.

Nothing meaningful. LLMNR, NBT-NS and mDNS carry no authentication, no signature and no record of who owns a name, so the client accepts the first well-formed reply matching its query. Whoever answers fastest on the link owns the name.

Because they are different products. Eight fat hosts sell throughput. A hundred thousand consumer addresses sell source diversity: traffic spread across thousands of networks, each flow indistinguishable from an ordinary customer, that no single coarse decision removes.

Connectionless carriage, so one arriving datagram is enough to commit a full answer, and no check that the address being answered is the address that asked. A bulky request/response pair then supplies the ratio.

A counter stores one number per sender but needs ordered delivery and must survive restarts. An identifier set tolerates disorder but needs storage and a retention bound. A clock window needs synchronised clocks and, alone, still permits replay inside it.

Because the receiver does not demand one exact value. Any sequence number falling inside the advertised receive window is acceptable, so the real search is the sequence space divided by the window - thousands of guesses on a high-throughput link, not billions.

Because the policy gates logins, and a renewing session never produces another one. Idle timers restart on every request and refresh credentials mint fresh tokens with no ceremony, so the login that would demand the factor may never arrive.

Because the value it checks is written by the sender. Over UDP the effect lands when the datagram arrives, so a forger never needs the reply. The allowlist constrains honest traffic and stops nobody willing to lie.

Only a saturated link. Bigger connection tables and worker pools add slots an attacker occupies almost free, and extra workers push more concurrent calls into the one slow dependency, whose capacity is usually not yours to buy.

Windows treats name resolution as a chain, not one authority. NXDOMAIN ends only the DNS step; the host then asks every machine on its own link over LLMNR and NBT-NS, and accepts the first reply it gets.

Nothing. Flood capacity is a commodity: the buyer rents time on a fleet someone else built, supplies a target and a duration, and never touches a host. The volume that arrives says nothing about the buyer's skill.

Time and predictability. The peering session stays up for weeks, so thousands of spoofed guesses can be tried against it, and both router addresses plus TCP port 179 are public, leaving far less of the connection identity to guess.

Only attacks whose effect lands on arrival: single-datagram commands, floods that consume state at the target, and provoking a third party into answering the forged address. Anything needing something back is out of reach.

Roughly 2^30 to 2^32: a 16-bit message ID times 14 to 16 bits of ephemeral-port randomisation, all inside one round-trip. A gigabit of forgeries buys odds near one in tens of thousands per race.

Because the asset handed over is the organisation's own name, not the dead resource. A held subdomain inherits cookies scoped to the parent domain, any trust granted by name suffix, certificate eligibility for that host, and the name's reputation.

Rank attacks by what the attacker keeps committed per unit of your capacity. A request dribbled out over minutes costs them one socket and a few bytes; it costs you a connection entry and a pinned worker throughout.

The header sits outside the signed bytes, so whoever holds the message changes that value and resends the identical body. The deduplication key never matches, the signature still verifies, and the instruction executes again. The key must live inside the signed content.

Plenty. Encryption protects session content, but the first hop sits underneath it: it decides which names resolve and to what, denies upgrades to protocols that start in the clear, drops selectively, and sees the printers and cameras that never encrypt.

No DNS message was forged and no cache was altered. The DNS server truthfully said the name does not exist; the client then used a different protocol that has no authority at all.

Concede the arithmetic, reject the conclusion. The objective is to be believed as the authority for a name, and that is on sale far cheaper at the registrar, where changing the delegation beats no entropy.

Remove either and the attack dies, so remove both: retire the record before releasing the resource, and prefer targets bound to proven domain ownership. Patching removes neither dependency.

Stolen control-plane credentials. Someone used another organisation's cloud API access to launch a handful of very large instances aimed at the target, so capacity appeared in minutes, cost the attacker nothing, and was billed to the account owner.