Question bank — Network security — DDoS, man-in-the-middle, replay attacks, countermeasures

False. Ek replayed ciphertext ek genuine message hota hai, isliye wo perfectly decrypt aur verify ho jaata hai; tumhe freshness chahiye (nonce/timestamp/sequence number), jo secrecy provide nahi karti. Dekho Message Authentication Codes (MAC) & HMAC.

False. Ye ek aisa shared secret deta hai jo koi eavesdropper nahi padh sakta (secrecy), lekin kisi ki bhi identity prove nahi karta (no authentication), isliye ek active attacker do exchanges run kar ke beech mein baith sakta hai.

False. Amplification/reflection attacks mein server ya reflector attacker se bahut zyada spend karta hai ($A=c_s/c_a\gg 1$), isliye ek chota attacker ek bade victim ko flood kar sakta hai.

False. Collapse condition hai $\lambda \ge B/T$; attacker simply SYN rate $\lambda$ double kar deta hai aur queue phir bhar jaati hai. Asli fix hai no state allocate karna (SYN cookies).

False. MAC integrity aur authenticity prove karta hai, lekin ek captured message ka MAC resend par bhi valid rehta hai — tumhe MACed data mein ek nonce ya timestamp bhi bind karna hoga.

True. Server connection state ko sequence number ke andar encode karta hai memory reserve karne ki jagah, isliye client ka ACK prove hone tak koi state hold nahi hoti — iska matlab cheap-attack/expensive-defense gap khatam ho jaata hai.

True. TLS har record mein internal sequence numbers add karta hai, isliye ek replayed record out of order hota hai aur reject ho jaata hai — bare encryption ke unlike, freshness built-in hai.

False. BCP 38 network edge par spoofed source IPs block karta hai, jo reflection attacks ko kamzor karta hai, lekin real IPs use karne wala botnet abhi bhi legitimately-looking flood kar sakta hai.

True. Replay plaintext ko kabhi nahi chhoota; attacker valid ciphertext copy karta hai aur re-send karta hai, receiver ko same action do baar karne deta hai.

Ek DDoS hazaaron botnet/spoofed IPs aur reflectors use karta hai; per-IP blocking scale nahi ho sakti, aur reflectors block karna innocent servers ko punish karta hai.

Error ye hai: ye kaam karta hai kyunki hosts ARP replies ko bina verification ke cache karte hain (IP→MAC), isliye ek forged reply traffic ko host level par redirect karta hai, switch ke galat route karne ki wajah se nahi.

Encryption point nahi hai — safety fresh random challenge $r$ se aati hai: ek purana captured response ek naye $r$ ke against verify nahi hoga, isliye encryption ke bina bhi replay fail hoti hai.

HSTS kuch bhi encrypt nahi karta; ye browser ko HTTPS use karne par force karta hai, attacker ko connection ko plain HTTP par strip karne se rokta hai.

60-byte query attacker ki cost hai; ~3000-byte reply victim ko hit karti hai, isliye amplification $A\approx 50$ ise strong banata hai precisely kyunki bheja gaya packet chota hai.

Identity verification ke bina encryption abhi bhi attacker ko do encrypted channels run karne deta hai (ek har party ke saath); tumhe certificates ya signatures ke zariye keys ko authenticate karna hoga.

Little's Law arrival pattern se independent long-run average ke liye hold karta hai; tumhe sirf average rate $\lambda$ aur average hold time $T$ chahiye.

Spoofed owner kabhi final ACK nahi bhejta, isliye connection half-open rehta hai aur server timeout $T$ tak slot hold karta hai — wo held state hi exhausted resource hai.

Taaki resolver ka bada reply victim ko bheja jaaye (reflection), attacker chhupta rahe aur amplified traffic target par point ho.

Ek signed public value prove karta hai ki wo real party se aaya; attacker wo signature forge nahi kar sakta, isliye wo apni khud ki key beech mein substitute nahi kar sakta.

Agar nonce MAC ke bahar hota, attacker use freely change kar sakta; $m\Vert n$ ko MACing karna freshness ko integrity se tie karta hai isliye ek tampered nonce verification fail kar deta hai. Dekho Transport Layer — TCP three-way handshake jahan sequence numbers ye role play karte hain.

Amplification factor hai $A=c_s/c_a$; har attack request ko expensive banana $A$ ko neeche drive karta hai isliye ek attacker akele server ko overwhelm nahi kar sakta.

Encryption akele content chhupaata hai lekin identity nahi; sirf authentication guarantee deta hai ki doosra end wohi hai jo claim karta hai, relay attack close karta hai.

Nahi — ek message jo capture karke same window mein clearing se pehle replay kiya gaya, abhi bhi unseen nonce hai; tumhe ya toh ek persistent set chahiye ya ek timestamp window $\Delta$ jo reuse se tighter ho.

Legitimate messages $|T_{\text{now}}-T_s|\le \Delta$ ke bahar fall ho sakte hain aur galti se reject ho sakte hain, ya $\Delta$ ko wide karna padega, jo replay window ko bada karta hai — clock sync ek real dependency hai.

Queue average par exactly full hoti hai; koi bhi additional legitimate SYN koi slot nahi paata, isliye service degradation precisely is boundary par shuru hoti hai, strictly iske upar nahi.

Nahi — $\lambda \ge B/T$ se, jaise $T\to 0$ required attack rate $\to \infty$ hoti hai, isliye attacker queue nahi bhar sakta; fast timeouts ek genuine mitigation hain.

Haan, aasaani se — past nonces ki koi memory nahi hone se, har replayed message naya lagta hai; statelessness ko safe rehne ke liye timestamps ya signed sequence numbers ke saath pair karna zaroori hai.

SYN cookies state-exhaustion half-open trick ko rokti hain, lekin real handshakes complete karne wala ek bada botnet abhi bhi bandwidth ya CPU exhaust kar sakta hai — cookies volumetric DDoS ka ilaaj nahi hain.