CLASS MEMO¶

variation of attacks¶

I asked CLAUDE about attacking methods.

In practice, attacks target the implementation and usage far more often than the underlying math.

Brute-force / key search — exploits insufficient key length or weak entropy. Weak random number generators fall here too (the famous PS3 ECDSA nonce reuse is a classic).
Cryptanalysis — differential and linear cryptanalysis exploit statistical bias in the algorithm itself.
Padding oracle attacks — use the success/failure (or error type) of decryption as a hint to recover plaintext. POODLE, Lucky13.
Chosen-plaintext / chosen-ciphertext attacks — attacker manipulates inputs to leak key information.
Downgrade attacks — force a switch to weaker cipher suites, as in FREAK and Logjam.
Hash collisions — forgery using MD5/SHA-1 collisions. Birthday attacks and length-extension attacks belong here.
Replay attacks — resend legitimate encrypted messages to bypass authentication.
Side channels — infer keys from timing or power (overlaps with Hardware below).

Man-in-the-middle (MITM) — intercept the communication path; SSL strip downgrades HTTPS to HTTP.
DNS spoofing / cache poisoning — redirect to malicious name resolution.
ARP spoofing — hijack traffic within a LAN.
TCP session hijacking — take over an already-established session.
BGP hijacking — falsify routing info to reroute traffic.
DDoS / amplification — saturate bandwidth via DNS or NTP reflection.
Certificate Authority (CA) compromise — undermine TLS trust by issuing fraudulent certificates.

Buffer overflow — write past stack/heap boundaries to overwrite adjacent data or the return address.
Use-after-free — exploit a reference to already-freed memory.
Double-free / off-by-one — corrupt heap management structures. Integer overflow — break size calculations so allocations are wrongly sized.
Format string attacks — use %n and friends for arbitrary read/write. T- ype confusion — trick the program into misinterpreting an object’s type.
ROP / return-to-libc — bypass DEP (non-executable memory) by chaining existing code fragments to execute arbitrary logic.

The area from your Flush+Reload lab.

Cache side channels — Flush+Reload, Prime+Probe, Evict+Time. Infer secrets from cache hit/miss timing differences.
Spectre — mislead branch prediction into speculative execution, leaking otherwise-inaccessible data via the cache.
Meltdown — use out-of-order execution to read kernel memory. MDS family (ZombieLoad / RIDL / Fallout) — leak data from internal CPU buffers.
Rowhammer — rapidly hammer specific DRAM rows to flip bits in adjacent rows.
Port contention (SMoTherSpectre) — infer secrets from execution-port congestion.

Privilege escalation — get root via setuid binary abuse or kernel vulnerabilities. Sandbox escape — chroot escape (classically the chdir trick to another directory), container escape.
TOCTOU race conditions — exploit the time gap between check and use.
Symlink attacks — trick a privileged process into operating on an unintended file.
Confused deputy — fool a privileged process into acting on the attacker’s behalf; CSRF is one variant.
Path traversal — use ../ to reach files outside the intended scope.

The attack surface that bypasses technical controls — usually the highest cost-effectiveness for attackers.

Phishing / spear phishing — steal credentials via fake sites or emails; the targeted version is “spear.”
Pretexting — extract information under a plausible pretext (posing as IT support, etc.). Business Email Compromise (BEC) — impersonate an executive or business partner to direct fraudulent payments.
Baiting — exploit curiosity or greed, e.g., a dropped USB drive.
Tailgating — physically follow an authorized person through a door.
Vishing / smishing — phone- and SMS-based extraction.
Insider threat — abuse or negligence by someone with legitimate access.

Fault injection — glitch voltage or clock to deliberately corrupt computation and skip authentication checks. Power analysis (SPA/DPA) / EM analysis — extract keys from power consumption or electromagnetic emissions.
Cold boot attack — recover keys from residual DRAM data right after power-off.
JTAG / debug port abuse — extract firmware or tamper with memory via debug interfaces.
Hardware trojans — malicious circuitry inserted during design or manufacturing.
Supply chain attacks — compromise components or the manufacturing process.
Bus snooping / microprobing — physically eavesdrop on or alter board traces or on-chip wiring.