3. The attacker solves 6 blocks so the transaction gets 6 confirmations.
...
Is it possible theoretically and practically? What could be used to prevent such an attack?
Let's say the attacker has a decent 10 GH/s farm. It would only take him 3 months on average to solve 6 blocks. Doesn't sound practical to me.
The 6 blocks need to be consecutive and current, not random.