Which type of network attack involves an attacker intercepting and potentially altering the communication between two parties without their knowledge?

An On-Path attack, also known as a Man-in-the-Middle (MitM) attack, is a form of active eavesdropping where an attacker establishes an independent connection with two victims and relays messages between them. This positioning allows the attacker to intercept, read, and manipulate all communication as it travels between the two parties. The victims believe they are communicating directly with each other, unaware that their conversation is being controlled by an adversary. This attack directly compromises both the confidentiality and integrity of the communication channel.

A. Phishing Attack: This is a social engineering method used to deceive individuals into divulging sensitive information, not an interception of live network traffic.

B. SQL Injection Attack: This is an application-layer attack that exploits vulnerabilities in a database by inserting malicious SQL code through a web input field.

C. Distributed Denial-of-Service Attack: This attack's goal is to render a service unavailable by overwhelming it with traffic from multiple sources, not to intercept or alter data.

1. National Institute of Standards and Technology (NIST). Glossary. "Man-in-the-Middle (MitM) Attack." CSRC

NIST. Accessed 2023. The glossary defines a MitM attack as: "An attack where the adversary positions himself in between the user and the system so that he can intercept and alter data." The term "On-Path" is the modern

more inclusive term for this attack.

2. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 8

Section 8.2

"Principles of Cryptography

" the text describes the "man-in-the-middle attack" where an intruder

Trudy

places herself in the middle of the communication path between Alice and Bob to intercept and modify messages.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Lecture 13: Network Security. Massachusetts Institute of Technology. Page 1 of the lecture notes describes a Man-in-the-Middle attack where an adversary "can read and modify any messages sent between Alice and Bob."

4. OWASP Foundation. "SQL Injection." OWASP Cheat Sheet Series. Accessed 2023. This resource defines SQL Injection as an attack consisting of the insertion of a malicious SQL query via the input data from the client to the application.