Insertion Attack refers to which scenario?

Insertion Attack refers to which scenario?

• A. An attack that inserts extra packets into the stream.
• B. An IDS evasion technique where the host accepts packets while the IDS discards them.
• C. An IDS evasion technique where the IDS discards packets while the host accepts them.
• D. A type of port scanning.

Answer: (C)

Insertion attacks rely on a mismatch between what the IDS sees and what the target system processes. The attacker exploits a situation where the IDS discards certain packets, but the actual host accepts and processes them anyway. Because the IDS never observes or flags the malicious data, there’s no alert, and the payload executes on the host. This is the essence of the scenario described: the IDS drops the packets while the host accepts them. It’s not about simply adding extra packets, and it isn’t about a port scan. The key idea is evading detection by delivering traffic to the host that the IDS does not observe or consider, allowing the attacker to slip malicious activity past defenses.

Insertion attacks rely on a mismatch between what the IDS sees and what the target system processes. The attacker exploits a situation where the IDS discards certain packets, but the actual host accepts and processes them anyway. Because the IDS never observes or flags the malicious data, there’s no alert, and the payload executes on the host. This is the essence of the scenario described: the IDS drops the packets while the host accepts them. It’s not about simply adding extra packets, and it isn’t about a port scan. The key idea is evading detection by delivering traffic to the host that the IDS does not observe or consider, allowing the attacker to slip malicious activity past defenses.