Understanding Network Protocols for Security: TCP/IP, DNS, and HTTP/S Vulnerabilities

Hello. Today, we are going to explore the hidden rules that make the internet work. Think of the internet as a giant, worldwide postal service. For this service to function, everyone must follow the same set of rules for addressing packages, sending them, and making sure they arrive safely. These rules are called network protocols. Understanding these rules is the first step to understanding how someone with bad intentions might try to break them to steal information or cause damage. We will look at three of the most important sets of rules: TCP/IP, DNS, and HTTP/S. Let's start with the foundation of it all: TCP/IP. This isn't one single rule, but a whole collection of rules that act as the engine of our global postal service. TCP/IP defines how our digital messages are broken down, addressed, sent across the world, and put back together at their destination. The two most important parts are IP and TCP. IP, or Internet Protocol, is like the part of the postal system that handles addressing. Every device connected to the internet, from your phone to a massive server, has a unique IP address, just like every house has a unique street address. This address ensures that your data packets, the small pieces of your message, are sent toward the correct destination. TCP, or Transmission Control Protocol, is like the quality control department of the postal service. Imagine you are sending a very long book to a friend. You can’t fit the whole book in one small envelope. So, you tear the book into individual pages, number each page, and put each page into its own envelope. TCP does this with your data, breaking it into smaller pieces called segments and numbering them. When the envelopes arrive, your friend (the receiving computer) uses TCP to check that all the pages have arrived and puts them back in the correct order. If a page is missing, TCP requests that it be sent again. It guarantees a reliable, ordered delivery. Because these rules are so fundamental, attackers have found clever ways to exploit them. One common attack is called IP Spoofing. This is like a prankster sending thousands of packages to a celebrity's house but writing your return address on every single one. The celebrity's staff would be overwhelmed, and all the "return to sender" packages would flood your mailbox, making it impossible for you to receive real mail. In the digital world, an attacker can send a flood of data to a server but fake the source IP address. This hides the attacker's true location and makes it very hard to stop the flood, which is known as a Denial-of-Service attack. Another attack targets TCP directly. When two computers want to talk, they perform a three-step greeting, like a secret handshake. The first computer says "SYN" (Can we talk?), the second replies "SYN-ACK" (Yes, I'm ready), and the first finishes with "ACK" (Okay, let's begin). An attack called a SYN Flood is like knocking on a door, and when the person opens it, you just stand there silently, never completing the greeting. The person at the door is stuck waiting for you and can't answer any other knocks. Attackers do this digitally by sending thousands of initial "SYN" requests to a server but never finishing the handshake. The server wastes all its resources waiting for replies that will never come, eventually crashing or becoming unavailable to real users. Because TCP was designed a long time ago, it didn't originally have security as its top priority. The address information on our digital envelopes, like the source and destination IP addresses, is written in plain text. This means anyone who can peek at the data as it travels across the network can see who is talking to whom, even if they can’t read the message inside. This information alone is very valuable for an attacker planning a more complex operation. Now, let's move on to our second protocol: DNS, the Domain Name System. If TCP/IP is the postal service, DNS is the internet's phonebook. It’s much easier for us to remember names like "google.com" than a string of numbers like "142.250.187.206". DNS is the system that translates the human-friendly domain names we type into our browsers into the numerical IP addresses that computers use to find each other. Here’s how it works. When you type a website address into your browser, your computer first asks a local DNS server, often run by your internet provider, "What is the IP address for this name?" If the local server knows the answer because it has looked it up recently, it tells your computer immediately. If not, it goes on a quest. It asks a main root server, which points it to the server for the domain ending, like ".com" or ".org". That server then points it to the final, authoritative server that holds the official record for the website you want. Once your computer gets the correct IP address, it can connect directly to the website's server. This phonebook system can also be attacked. The most famous vulnerability is DNS Spoofing, also called Cache Poisoning. Imagine a criminal tricks your local phone operator into changing the number for your bank in their records. The next time you ask the operator to connect you to your bank, they confidently give you the criminal's number instead. You call, thinking you're talking to your bank, and you give them your account number and password. In a DNS spoofing attack, an attacker tricks a DNS server into storing the wrong IP address for a legitimate website. When you try to go to your banking site, you are secretly redirected to a fake website that looks identical, designed to steal your login details. Another clever attack is a DNS Amplification attack. This is a powerful way to flood a victim with unwanted data. The attacker is like a prankster who calls a hundred libraries, spoofs the victim's phone number as the callback number, and asks each one to read the entire encyclopedia over the phone. A small request results in a massive response. Digitally, an attacker sends small DNS queries to many open servers, but forges the victim's IP address as the source. The servers all send their large replies back to the victim, overwhelming their network connection. Traditionally, your DNS requests were made in the open. It was like shouting across a room to ask for someone's phone number. Anyone in the room could hear who you wanted to call. This raised privacy concerns. To fix this, new technologies like DNS over HTTPS (DoH) were created. This is like whispering your request in a private, soundproof booth. It encrypts your DNS query, so no one can easily snoop on which websites you are visiting. However, this has created a debate. Some experts worry that if everyone uses a few large companies for these encrypted services, those companies could gain a huge amount of information about global internet traffic, creating new privacy risks. Finally, let's talk about the language of the web itself: HTTP and HTTPS. If TCP/IP is the postal service and DNS is the address book, HTTP is the language that web browsers and web servers use to talk to each other. HTTP, or Hypertext Transfer Protocol, is a simple request-and-response language. Your browser sends a request like, "GET me the homepage," and the server sends a response with the website's content. The problem with HTTP is that it's like sending a postcard. Anyone who handles it along the way can read the entire message. If you send a password or credit card number over a website using HTTP, that information is not private. This is where HTTPS comes in. The 'S' stands for Secure. HTTPS is the same language, but spoken in a secret code that only your browser and the server understand. To create this secret code, your browser and the server perform a special procedure called a TLS Handshake before they start talking. It works like this: the server first shows your browser its digital certificate, which is like an official ID card that proves its identity. Your browser checks this ID to make sure it's valid and issued by a trusted authority. Once the server is verified, your browser and the server use a clever cryptographic trick to securely agree on a secret key. From that point on, all their communication is encrypted with that key. Even with this security, there are vulnerabilities. One of the biggest dangers on public Wi-Fi is a Man-in-the-Middle attack against HTTP. If a website doesn't use HTTPS, an attacker on the same network can easily intercept, read, and even change the data being sent between you and the website. A more advanced attack is called SSL Stripping. Here, an attacker gets between you and the website you want to visit. You try to start a secure HTTPS connection, but the attacker intercepts it and tells your browser, "Don't worry about the secret code, just use regular HTTP." Meanwhile, the attacker communicates securely with the real website over HTTPS. The attacker acts as a middleman, translating between your insecure connection and the secure one, reading everything you send. To prevent this, websites can use a feature called HSTS, which tells your browser to only ever communicate with it using HTTPS. It's also crucial to pay attention to browser warnings. If you visit an HTTPS site and your browser shows a warning about an invalid certificate, it's a major red flag. This is your browser telling you that the server's ID card is expired, fake, or from an untrustworthy source. Ignoring this warning is like ignoring a police officer telling you that the person you're talking to is an impostor. You might be connecting to an attacker's server. In summary, the internet is built on a series of foundational rules, or protocols. TCP/IP is the delivery system that moves data in packets. DNS is the address book that translates names into numbers. And HTTP/S is the language used to request and view websites. Each of these protocols has weaknesses that can be exploited by attackers, from flooding servers with traffic to tricking users into visiting fake websites or intercepting their private information. Modern security relies on strengthening these protocols with encryption and other defenses, but it remains a constant battle between those building security and those trying to break it. Staying safe requires not only better technology but also our own vigilance as users.