100-160 Question 60
Select 2A network administrator notices unusual traffic patterns indicating that an attacker might be exploiting a vulnerability in the TCP three-way handshake. Which of the following actions by an attacker could be related to this vulnerability?
- A
Sending a flood of SYN packets without completing the handshake
- B
Intercepting and modifying packets during data transmission
- C
Spoofing the source IP address during the handshake process
- D
Encrypting the TCP header to avoid detection by firewalls
- E
Forcing the server to send large amounts of data to an unsuspecting victim through amplification
Show answer and explanation
Correct answers: A, C
Explanation
The TCP three-way handshake is vulnerable to attacks such as SYN floods, where incomplete handshakes overwhelm server resources, and IP spoofing, which disguises the attacker's identity. Understanding these vulnerabilities is crucial for identifying and mitigating TCP/IP-based cyber threats.
- A. Correct.
This describes a SYN flood attack, where the attacker exploits the TCP three-way handshake by sending numerous SYN packets to consume server resources without completing the handshake.
- B. Incorrect.
This describes a man-in-the-middle (MITM) attack, which involves intercepting and modifying communication. While serious, it is unrelated to TCP handshake vulnerabilities.
- C. Correct.
Spoofing the source IP address during the handshake confuses the victim server and can be used in attacks such as SYN floods or other TCP/IP-based exploits.
- D. Incorrect.
Encrypting the TCP header is not a common or viable method to exploit TCP/IP vulnerabilities, as encryption would disrupt normal communication processes.
- E. Incorrect.
This describes amplification attacks like UDP reflection, which is unrelated to TCP handshake vulnerabilities.