# Blockchain for Future Wireless Networks: A Decade Survey
## 3 The Proposed Taxonomy for Security Attacks and Countermeasures
### Passive Attacks
Transport layer attacks--An end-to-end connection set-up is done for transferring the data packets, congestion, and flow control in the transport layer [149]. It uses transmission control protocol (TCP) and user datagram protocol (UDP). TCP is used for reliable data transmission while UDP reduces the overhead and latency. Due to their security vulnerability, these protocols suffer from flooding and session hijack attacks. 5. Flooding attacks--TCP sends numerous ping requests in this type of attack, whereas UDP sends several UDP packets. It creates network congestion to legitimate traffic and makes the system unresponsive [150]. Malicious users perform this attack using route requests (RREQ) or data flooding. A flooding attack is prevented by configuring the firewall and installing an intrusion prevention system (IPS) to identify network traffic patterns [151]. The authors of [152; 153] presented TCP SYN flooding (half-open attack) prevention and mitigation techniques in a WN-based software-defined network. Moreover, ref. [115] proposed an OpenFlow-based TCP SYN authentication approach that overcomes the issue of flooding. [PERSON] et al. [116] proposed a decentralized blockchain solution that provides security in named data networking (NDN) of things by mitigating flooding attacks and data phishing. 6. Session hijack--In this attack, a session is taken away by an attacker between sender and receiver. In addition, the attacker takes off the victim's session and behave like a legitimate user over the communication [154]. Session sniffing, cross-site scripting, and predictable sessions token ID are the most responsible parameters that perform session attacks. The adverse effect of this attack deteriorates the security of WN systems; for example, the attack can authenticate malicious users for banking systems, commits identity theft, and steal web server and enterprise data [155]. Encryption algorithm, user authentication scheme, secure cookies, ciphering the packets, internet protocol security (IPSec), and SSL approaches are used to prevent session hijacking [156]. The authors of [117] discussed various techniques to avoid session hijacking, and ref. [118] provided a proxy server that overcame the session hijacking problem on the web server. [PERSON] et al. [119] proposed a blockchain-based access control scheme that detects UAVs and mitigates session hijacking on the Internet of drone environment (IoD). 7. Application layer attacks--A user interface layer with file transfer protocol (FTP) and real-time transport protocol (RTP) delivers applications and services to the end-user to maintain QoS. 8. Simple mail transfer protocol (SMTP) attacks - Here, the connection between the mail server and the attacker's machine is exploited, wherein the server sends the web banner (HTTP version, encoding style, server version, etc.) back to the attacker side [157] Consequently, the attackers can find valuable information about the application using this web banner. The malicious user performs this attack by sending phishing emails and spam messages. The user's SMTP server continues sending multiple emails to other servers until that server crashes. This happens because there is no strong access control that restricts the device's physical access, due to which the SMTP server cannot withstand the attack. Employing SSL, TLS, and inserting a security layer into the SMTP server prevents this attack [120]. To do so, [PERSON] et al. [121] proposed a cryptocurrency and blockchain-enabled email system that prevents SMTP attacks and controls mail spamming. * SQL injection--In structured query language (SQL) injection, attackers parse SQL commands in the SQL database and gain unauthorized access to several websites [158]. Malicious users retrieve confidential information from database tables, alter those tables, and drop it. To alleviate the risk of SQL injection, one can make more than one database user account, deploy a secure web applications firewall, limit privileges, and add input validation [159].