Changes

TCP/IP Hijacking is occurs when an attacker takes control of an ongoing session between a client and a server. This is similar in to a man-in-the-middle attack except that the rogue agent sends a reset request to the client so that the client loses contact with the server while the rogue systemassumes the role of the legitimate client, continuing the session. == Mathematical Attacked == The solution to a number of the types of attack outlined above has involved the use of encryption. A mathematical attack involves the use of computation based on the mathematical properties of the encryption algorithm to attempt to decrypt data. The best way to avoid the decryption of data is to use strong encryption (128-bit) rather than rely on weaker encryption (both 40-bit and 56-bit encryption can easily be broken). == Password Guessing == On systems which rely solely on a login name and password the security of the entire system is only as strong as the passwords chosen by the users. The best way to ensure passwords are not cracked is to avoid the use of simple words or phrases which can be found in a dictionary. This needs to be balanced with making the passowrds easy enough to remember so that users do not write them on pieces of paper and stick them on their laptops or monitors for others to find. The best passwords consist of a mixture of upper and lower case characters combined with numbers and special characters. A common approach is to substitute numbers in place of similar letters. For example '''W3ath3rN3ws''' uses the number 3 in place of the letter 'E', the reasoning being that the number 3 is much like a reversed 'E' making the password easy to remember. Unfortunately most password cracking algorithms know about this type of substitution. There are two primary mechanisms for breaking password protection, ''brute force'' and ''dictionary''. == Brute Force Password Attacks == A brute force attack uses algorithms to systematically try every possible permutation of characters in an effort to find the correct password. If allowed to persist, a brute force attack will eventually identify the correct password, although a well implemented security strategy will disable the account and block the IP address from which the attempts were made after 3 or 4 failed password attempts. == Dictionary Password Attacks ==