attack is implemented on the service, need to be implemented on the client so it can be tested