Which of the following BEST describes the type of attack that is occurring?

A.
Smurf Attack

B.
Man in the middle

C.
Backdoor

D.
Replay

E.
Spear Phishing

F.
Xmas Attack

G.
Blue Jacking

H.
Ping of Death

Explanation:
The exhibit shows that all the computers on the network are being `pinged’. This indicates that the ping request was sent to the network broadcast address. We
can also see that all the replies were received by one (probably with a spoofed address) host on the network. This is typical of a smurf attack.
A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf
attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the
subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is
spoofed to be the address of the attacker’s victim. All the hosts receiving the PING request reply to this victim’s address instead of the real sender’s address. A
single attacker sending hundreds or thousands of these PING messages per second can fill the victim’s T-1 (or even T-3) line with ping replies, bring the entire
Internet service to its knees. Smurfing falls under the general category of Denial of Service attacks — security attacks that don’t try to steal information, but instead
attempt to disable a computer or network.
Incorrect Answers:
B: In cryptography and computer security, a man-in-the-middle attack (often abbreviated to MITM, MitM, MIM, MiM or MITMA) is an attack where the attacker
secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. One example is active
eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking
directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all relevant
messages passing between the two victims and inject new ones. This is straightforward in many circumstances; for example, an attacker within reception range of
an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle. This is not the attack illustrated in this question. Therefore, this answer is
incorrect.
C: A backdoor in a computer system (or cryptosystem or algorithm) is a method of bypassing normal authentication, securing unauthorized remote access to a
computer, obtaining access to plaintext, and so on, while attempting to remain undetected. The backdoor may take the form of an installed program (e.g., Back
Orifice) or may subvert the system through a rootkit. This is not the attack illustrated in this question. Therefore, this answer is incorrect.

D: A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.
This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet
substitution (such as stream cipher attack). For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which
Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or
the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice’s password (or hash) read from
the last session, which Bob accepts thus granting access to Eve. This is not the attack illustrated in this question. Therefore, this answer is incorrect.
E: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. As with the e-mail
messages used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from
a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source
of the e-mail is likely to be an individual within the recipient’s own company and generally someone in a position of authority. This is not the attack illustrated in this
question.
Therefore, this answer is incorrect.
F: In information technology, a Christmas tree packet is a packet with every single option set for whatever protocol is in use. The term derives from a fanciful image
of each little option bit in a header being represented by a different-colored light bulb, all turned on, as in, “the packet was lit up like a Christmas tree.” It can also be
known as a kamikaze packet, nastygram or a lamp test segment.
Christmas tree packets can be used as a method of divining the underlying nature of a TCP/IP stack by sending the packets and awaiting and analyzing the
responses. When used as part of scanning a system, the TCP header of a Christmas tree packets has the flags SYN, FIN, URG and PSH set. Many operating
systems implement their compliance with the Internet Protocol standard (RFC 791) in varying or incomplete ways. By observing how a host responds to an odd
packet, such as a Christmas tree packet, assumptions can be made regarding the host’s operating system. Versions of Microsoft Windows, BSD/OS, HP-UX,
Cisco IOS, MVS, and IRIX display behaviors that differ from the RFC standard when queried with said packets. A large number of Christmas tree packets can also
be used to conduct a DoS attack by exploiting the fact that Christmas tree packets require much more processing by routers and end-hosts than the ‘usual’ packets
do.
Christmas tree packets can be easily detected by intrusion-detection systems or more advanced firewalls. From a network security point of view, Christmas tree
packets are always suspicious and indicate a high probability of network reconnaissance activities. This is not the attack illustrated in this question. Therefore, this
answer is incorrect.
G: Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a
vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth- enabled device via the OBEX protocol.
Bluetooth has a very limited range, usually around 10 metres (32.8 ft) on mobile phones, but laptops can reach up to 100 metres (328 ft) with powerful (Class 1)
transmitters. Bluejacking is usually harmless, but because bluejacked people generally don’t know what has happened, they may think that their phone is
malfunctioning. Usually, a bluejacker will only send a text message, but with modern phones it’s possible to send images or sounds as well. Bluejacking has been
used in guerrilla marketing campaigns to promote advergames. This is not the attack illustrated in this question. Therefore, this answer is incorrect.
H: A ping of death is a type of attack on a computer that involves sending a malformed or otherwise malicious ping to a computer.
A correctly formed ping message is typically 56 bytes in size, or 84 bytes when the Internet Protocol [IP] header is considered. Historically, many computer systems
could not properly handle a ping packet larger than the maximum IPv4 packet size of 65535bytes. Larger packets could crash the target computer.
In early implementations of TCP/IP, this bug was easy to exploit. This exploit affected a wide variety of systems, including Unix, Linux, Mac, Windows, printers, and
routers. Generally, sending a 65,536-byte ping packet violates the Internet Protocol as documented in RFC 791, but a packet of such a size can be sent if it is
fragmented; when the target computer reassembles the packet, a buffer overflow can occur, which often causes a system crash. Later a different kind of ping
attack became widespread–ping flooding simply floods the victim with so much ping traffic that normal traffic fails to reach the system, a basic denial-of-service

attack.
The exhibit shows that all the computers on the network are being `pinged’. This indicates that the ping request was sent to the network broadcast address. This is
more typical of a smurf attack than a ping of death attack. Therefore, this answer is incorrect.

http://www.webopedia.com/TERM/S/smurf.html
http://en.wikipedia.org/wiki/Man-in-the-middle_attack
http://en.wikipedia.org/wiki/Backdoor_%28computing%29
http://en.wikipedia.org/wiki/Replay_attack
http://searchsecurity.techtarget.com/definition/spear-phishing http://en.wikipedia.org/wiki/Christmas_tree_packet
http://en.wikipedia.org/wiki/Bluejacking
http://en.wikipedia.org/wiki/Ping_of_death