MAC attacks without knowing the key Attacks on a MAC that do not require the discovery of the key are possible.
Consider the following MAC algorithm. Let $M=(X_1\mathbin\|\dots\mathbin\|X_m)$ be a message that is treated as a concatenation of 64-bit blocks $X_i$. Then define:
$\Delta(M) = X_1 \oplus\dots\oplus X_m$
and 
$C_k(M) = E_k[\Delta(M)]$
where $\oplus$ is the exclusive-OR operation and encryption algorithm is DES
in ECB mode. Thus the key length is 56 and the MAC length is 64 bits.

How would an attacker breach the system without knowing the encryption
key?
One way to try tackling simpler problems like this is by writing them out as equations and doing algebra on them.  In this case, let's take this statement from your comment with the answer:


  The opponent can now concatenate the new message, which consists of $Y_1 || \dots || Y_m$ with the original MAC to form a message that will be accepted as authentic by the receiver. 


So this is saying that the following equation is true:

$$
C_k(Y_1 || \dots || Y_m) = C_k(X_1 || \dots || X_m)
$$

But is it really true?  One way we can test this is by using the laws of equations (like in algebra) to rewrite this one over and over and see if it has the same truth value as some other equation that we can independently tell is true.

By applying the definition of $C_k(M) = E_k(\Delta(M))$ to both sides of the first equation we get:

$$
E_k(\Delta(Y_1 || \dots || Y_m)) = E_k(\Delta(X_1 || \dots || X_m))
$$

And since the function $E_k$ is a block cipher, it has an inverse $D_k$, which by applying to both sides we can get this:

$$
\Delta(Y_1 || \dots || Y_m) = \Delta(X_1 || \dots || X_m)
$$

Applying the definition of $\Delta(M)$ to both sides we get:

$$
Y_1 \oplus \dots \oplus Y_m = X_1 \oplus \dots \oplus X_m
$$

So the attack that you've quoted in your comment hinges on the fact that it must somehow cause this equation to be true.  Your comment explains the attack as this (I've corrected a notational error):


  The opponent can attack the system by replacing $X_1 || \dots || X_{m-1}$ with any desired values $Y_1 || \dots || Y_{m-1}$ and replacing $X_m$ with $Y_m$ where $Y_m$ is calculated as follows: $Y_m = Y_1 \oplus \dots \oplus Y_{m−1} \oplus \Delta(M)$.


Let's try substituting that for $Y_m$ in the equation:

$$
Y_1 \oplus \dots \oplus Y_{m-1} \oplus (Y_1 \oplus \dots \oplus Y_{m−1} \oplus \Delta(M)) = X_1 \oplus \dots \oplus X_m
$$

XOR is an operation where every element is its own inverse, so $Y_i \oplus Y_i = 0$ which is the identity element.  It's also an associative and commutative operation, so in the left side of this equation we can cancel out all of the $Y_i$ terms, and we get:

$$
\Delta(M) = X_1 \oplus \dots \oplus X_m
$$

Which is nothing other than the definition of $\Delta(M)$, which we were given as a premise.  So the technique you cited is guaranteed to forge a message and its tag different from $M$.  Worse, it allows the adversary to pick any values they like for $Y_1$ to $Y_{m-1}$.



The short, intuitive summary of that is that the problem with this MAC is that the way the $\Delta(M)$ it combines the plaintext message blocks with XOR gives the attacker way too much latitude.  Given any message $M$, it's trivial for the attacker to compute $\Delta(M)$, as well as many, many ways that they can compute a message $M'$ such that $M ≠ M'$ but $\Delta(M) = \Delta(M')$.  And since the MAC is just the deterministic encryption of $\Delta(M)$, that guarantees a successful forgery.