CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

An NTP amplification attack is a distributed denial-of-service technique that turns public time servers into unwitting weapons. It is the textbook example of a reflection and amplification attack, and that is exactly why exams like it. The attacker sends a small request with a forged source address. The server sends a much larger reply to the victim. Repeat across thousands of servers and the victim drowns in traffic that never came from the attacker. Why NTP Works So Well for This Three properties combine, and all three are needed. NTP runs over UDP, on port 123. UDP is connectionless — there is no handshake, so the server has no way to confirm that the address in the request is the address that sent it. That is what makes spoofing possible, and spoofing is what makes reflection possible. NTP is everywhere and rarely blocked. Time synchronization is essential infrastructure; Kerberos authentication, certificate validation, and log correlation all break when clocks drift...

A distributed reflected denial of service attack — DRDoS — combines two ideas that are individually simple and together very effective. It is worth separating them, because exams test the terms independently. Distributed means many sources. Reflected means those sources are innocent third parties. Amplified means each one sends back more than it received. Building Up From DoS DoS. One machine attacks one target. Easy to block — drop traffic from that source. DDoS. Many machines, usually a botnet, attack one target simultaneously. Harder to block, because there is no single source, and the attacker's own infrastructure is still ultimately involved. DRDoS. The attacker does not send traffic to the victim at all. Instead they send requests to thousands of legitimate public servers with the source address forged to the victim's . Every server replies to the victim, because that is where the request appears to have come from. Two things the attacker gains. First, ano...

Bluetooth is short range, which creates a false sense of safety. An attacker has to be nearby — but "nearby" means the next table in a coffee shop, the seat behind you on a train, or a car in the parking lot with a directional antenna, which extends the practical range well beyond the ten metres people assume. Bluetooth attacks are mostly attacks on pairing. Get the pairing wrong and everything above it is exposed. The Named Attacks CompTIA tests these by name, and the names are unfortunately similar, so the distinction matters. Bluejacking — sending an unsolicited message to a nearby Bluetooth device. It is a nuisance rather than a compromise: no data is taken and no control is gained. The memory hook is jacking = junk mail . Bluesnarfing — stealing data from a device over Bluetooth without authorization: contacts, messages, calendar entries, files. This one is a genuine breach. The hook is snarfing = stealing . If you learn nothing else here, learn that pair....