11. Network security Flashcards
Why do we need network security?
Attacks: Routing, Naming
Internet is by design insecure/secure?
insecure
Any host is on by default for other hosts to connect
True
Packet switched networks are vulnerable to ______ attacks
resource exhaustion
Components of security
Availability
Confidentiality
Authenticity
Integrity
availability
ability to use resource
Confidentiality
concealing information (Bank account)
Authenticity
assures origin of information
Integrity
prevents unauthorized changes
Security Threat definition
Anything that is a potential violation of the components of security
Security Attack definition
action that results in a violation of the components of security
Attack on confidentiality
Eavesdropping - listening to people
Negative impacts of attacks
theft of confidential info
unauthorized use
false info
disruption of service
Control plane authentication
Session: point-to-point b/w routes
Path: protects AS paths
Origin: ensures that AS advertising prefix is the owner
Route Attacks: How?
configuration error (accident)
router compromised by attacker
unscrupulous isp
types of attacks
Configure router/ management softwar
tamper with software
tamper with routing message
Most common type of attack
router hijack
Origin Attestation
Certificate binding prefix to owner
Path attestation
signatures along AS path
Why is DNS vulnerable
Resolvers trust responses
Responses can contain info unrelated to query
NO authentication
DNS Cache Poisoning
so resolver requests a thing, attacker sends a fuckton of stuff to recursive solver handling the thing hoping to match before the legit source resolves the thing.
Now the recursive resolver caches the attackers response instead of the legit one
DNS Cache Poisoning Defenses
- Query ID (can be guessed though)
- Randomize ID
- Source port randomization
- 0x20 Encoding
- Source port randomization PROBLEM
resource intensive
NAT can derandomize
0x20 Encoding
DNS is case insensitive
DNS amplification attack
exploits asymmetry in size between queries and responses
Attacker sends requests to DNS resolver at a size of 60 bytes with the src as the victim. So the dns resolver sends the response to the actual victim but the response is 3000 bytes
DNS amplification attack - Defenses
Prevent spoofing
Disable open resolvers
