Name: IT 安全教程 - 按 OSI 層比較攻擊方法 (IT Security Tutorial - Comparing attack methods by OSI layer)
Uploaded: 2025-08-04T18:36:49.000Z
Duration: 5 min 41 s

On any network, security controls are needed on multiple levels, as without a layered approach, you could be victim of an attack.

在任何網絡中，都需要多層次的安全控制，因為如果沒有分層方法，你就可能成為攻擊的受害者。

基礎被動語態

Passive attacks are things such as traffic sniffing or scanning, and these are done during reconnaissance to discover information about a network.

被動攻擊是指流量嗅探或掃描等行為，這些行為是在偵察過程中進行的，目的是發現網絡資訊。

Active attacks are designed to interrupt service, destroy data, or steal information.

主動攻擊旨在中斷服務、破壞數據或竊取資訊。

Here we see a depiction of the 7-layer OSI model.

這裡我們看到的是 7 層 OSI 模型的描述。

There is a potential for attacks in every layer of the OSI model.

OSI 模型的每一層都有可能受到攻擊。

We'll take one more step and separate this, and I'll show you that the first two layers, Layer 1 and Layer 2, are essentially hardware attacks.

我們再往前走一步，將其分開，我會向你展示前兩層，即第 1 層和第 2 層，本質上是硬件攻擊。

Layers 3 through 7 are more directed at software attacks.

第 3 層至第 7 層更多地針對軟件攻擊。

So now let's go through each layer, starting at Layer 7, the application layer.

現在，讓我們從第 7 層（應用層）開始，逐層分析。

The application layer is where we initiate contact with the network.

應用層是我們與網絡建立聯繫的地方。

Attacks can include software attacks, and these are designed to exploit some weakness in the code.

攻擊可包括軟件攻擊，這些攻擊旨在利用代碼中的某些弱點。

There could be phishing, be it email or pop-ups.

可能是網絡釣魚，無論是電子郵件還是彈出式窗口。

And malware, such as viruses, ransomware, trojans, and worms.

以及病毒、勒索軟件、木馬和蠕蟲等惡意軟件。

The presentation layer is where the data is presented to the application so we can view it.

呈現層是將數據呈現給應用程序以便我們查看的地方。

Attacks include forced browsing, and this is also called a failure to restrict URL access.

攻擊包括強制瀏覽，這也被稱為未限制 URL 訪問。

Now this will allow access to authenticated areas without proper credentials.

現在，這將允許在沒有適當憑證的情況下訪問已驗證區域。

Now this is a man-in-the-middle attack, where a malicious actor is between a client and a server.

這是一種中間人攻擊，即惡意行為者處於客戶端和服務器之間。

在這裡，我們看到攻擊者在中間。

And the malicious actor will monitor, capture, and control the communication with the goal of obtaining sensitive information, such as usernames and passwords.

惡意行為者將監控、捕獲和控制通信，目的是獲取用戶名和密碼等敏感資訊。

The session layer is responsible for initiating, maintaining, and tearing down a session.

會話層負責啟動、維護和中斷會話。

A couple of attacks can take place at this layer.

在這一層可能會發生幾種攻擊。

Session hijacking is also known as cookie hijacking.

It grabs the session key to gain access to the services.

它抓取會話密鑰，以獲得服務訪問權。

A session initiation protocol, or SIP flood, is where clients are flooded with multiple invite messages in order to take down the phone.

會話啟動協議，或 SIP 泛洪，是指客戶端被多個邀請消息淹沒，以便接通電話。

And a DNS poison attack, and now this is where fake address records are inserted into the DNS cache so that any requests for the address are answered with a fake IP address.

DNS 中毒攻擊，就是在 DNS 緩存中插入虛假地址記錄，這樣任何地址請求都會得到一個虛假 IP 地址的迴應。

The transport layer is responsible for transportation of the data.

At the transport layer, there are a few attacks that include port scanning.

在傳輸層，有一些攻擊包括端口掃描。

This is simply a reconnaissance attack to see what ports are open and listening.

這只是一種偵查攻擊，目的是查看有哪些端口正在打開和監聽。

And a SYN flood, now this floods the server with multiple SYN packets with no final acknowledgement.

而 SYN 泛洪則會向服務器發出多個 SYN 數據包，但沒有最終確認。

The result is that it overwhelms the server so that legitimate users are locked out.

其結果是，服務器不堪重負，合法用戶被鎖定。

The network layer is responsible for addressing and routing.

在這一層中，我們可以看到以下內容。

We can see operating system fingerprinting using ICMP.

我們可以看到使用 ICMP 進行的作業系統指紋識別。

Now this again is a passive attack to determine the operating system of the host.

現在，這又是一種確定主機作業系統的被動攻擊。

There could be routing attacks, which are done to misdirect traffic.

可能存在路由攻擊，這是為了誤導流量。

An IP spoofing attack is where data appears to be coming from another source.

IP 欺騙攻擊是指數據看似來自另一來源。

A replay attack is where a malicious actor intercepts credentials and then uses the credentials to gain access to a protected resource.

重放攻擊是指惡意行為者截獲憑證，然後使用憑證訪問受保護的資源。

And there are numerous ICMP attacks, such as a SMURF attack, which is a distributed denial of service attack.

此外，還有許多 ICMP 攻擊，如 SMURF 攻擊，這是一種分佈式拒絕服務攻擊。

At the data link layer, this is where the data is ready to be transmitted onto the network.

在數據鏈路層，數據已準備好傳輸到網絡。

在這裡，我們可以看到以下內容。

We can see network sniffing, which is simply eavesdropping, and this is common in a local area network.

我們可以看到網絡嗅探，即簡單的竊聽，這在局域網中很常見。

WPA cracking, which is done on a wireless network to decrypt the encrypted packets.

WPA 破解，即在無線網絡上對加密數據包進行解密。

And ARP cache poisoning, which is used in a man-in-the-middle attack.

以及 ARP 緩存中毒，它被用於中間人攻擊。

Now the physical layer is really simply a physical attack, and that can include theft of devices, cutting cables, or a skimming attack, where someone attaches a device to an ATM or a point-of-sale system to gather credit card numbers.

現在，物理層實際上就是簡單的物理攻擊，這可能包括盜竊設備、切斷電纜或盜刷攻擊，即有人將設備安裝到自動取款機或銷售點系統上以收集信用卡號碼。

On-a-network security controls are needed on multiple levels, as an attack can happen at every layer of the OSI model.

由於攻擊可能發生在 OSI 模型的每一層，是以需要多層次的網絡安全控制。