□ □
[□] □
□* □
An attacker could make a partial request that does not time out and therefore creates a denial of service . As attempts became more serious , detection of the attacker would become more likely if an intrusion detection system had been deployed . An attacker must be prevented from impersonating a replica that was faulty after it recovers . An attacker might enter a poorly secured building and attempt to open locked desk drawers or safes . Since it is not possible to embed a carriage return into the window title itself , the attacker would have to convince the victim to hit enter for it to process the title as a command , although the attacker can perform a number of actions to increase the likelyhood of this happening . In order for an attack to be sucessful , an attacker must be able to act as a man-in-the-middle to intercept and modify multiple connections , which all involve a common fixed plaintext block ( such as a password ) , and have good network conditions that allow small changes in timing to be reliably observed .