A legacy utility appliance renegotiates its management session to outdated weak ciphers after an attacker interferes with the handshake. Which cryptographic attack is occurring?
Select an answer to reveal the explanation.
Short Explanation
A downgrade attack is peer pressure on the handshake—'forget modern crypto, use the old weak stuff.' The appliance gets nudged into ciphers you would never pick on purpose.
Full Explanation
A downgrade attack interferes with protocol negotiation so endpoints abandon modern cryptography for older, weaker ciphers or protocol versions the attacker can break or exploit. When a legacy utility appliance renegotiates its management session into outdated weak ciphers after handshake interference, the cryptographic attack class is downgrade—not ransomware or DNS tricks. Municipal OT and facility appliances with long service lives are frequent victims because they still offer legacy cipher suites “for compatibility.”
Ransomware encrypting SCADA historian archives for ransom is data-extortion malware behavior, not handshake coercion into weak ciphers. DNS poisoning swapping A records for the appliance FQDN redirects name resolution; it does not by itself force weaker cryptography on an already-addressed management session. Directory traversal reading /etc-style paths on a web portal is an application path-escape attack against files, unrelated to cipher-suite negotiation.
Exam caveat: downgrade is about negotiating weaker crypto; distinguish it from purely stripping TLS (some on-path cases) and from choosing weak crypto by misconfiguration alone. Exam stems that mention renegotiation to outdated weak ciphers after interference point to active downgrade.
Operational check: disable legacy protocols and weak cipher suites on utility management interfaces, require modern TLS minimums, place appliance admin paths on management VRFs or jump hosts, monitor for unexpected cipher negotiations, and patch appliances that allow forced downgrades.