JNTU B.Tech IV NETWORK SECURITY Previous Question Paper (July - 2021 - R15)

Active attacks involve altering system resources or affecting their operation. They are considered easier to detect because they leave observable traces, such as unauthorized modifications to data, service interruptions, or changes in system logs. However, they are difficult to prevent because they often exploit inherent vulnerabilities in protocols, software design, or human behavior that are necessary for network functionality.

Key active attacks include:

• Masquerade: An entity pretends to be another authorized entity to gain unauthorized access. Example: An attacker uses a stolen password to log into a server as an administrator.
• Replay: An attacker captures a valid data transmission and retransmits it later to produce an unauthorized effect. Example: Capturing a bank transaction packet and re-sending it to initiate a duplicate transfer.
• Modification of Messages: A portion of a legitimate message is altered, delayed, or reordered. Example: Intercepting a financial transaction and changing the recipient's account number.
• Denial of Service (DoS): Preventing normal use or management of communication facilities. Example: Flooding a web server with excessive requests so that legitimate users cannot access the site.

Stack-based and heap-based buffer overflows differ primarily in the memory region targeted and the mechanism of exploitation.

In a Stack-based overflow, the attacker exploits the LIFO (Last-In, First-Out) nature of the stack to overwrite the return address of a function, redirecting execution to malicious code. In a Heap-based overflow, the attacker targets memory allocated at runtime; because the heap lacks a return address structure, the attack typically focuses on corrupting function pointers or object pointers, which are subsequently called by the application, leading to arbitrary code execution.