Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CySec 1 > Basics of Networks and Network Security > Flashcards

Basics of Networks and Network Security Flashcards

1
Q

The Internet Protocol Suite (TCP/IP)

A

Application: Interface to the applications.
The application layer provides applications with standardized data exchange. Its protocols include the Hypertext Transfer Protocol (HTTP) to HTTPS.

Transport: Host-to-Host delivery of data. Reassembles segments into messages and passes them to the application layer.
TCP handles communications between hosts and provides flow control, multiplexing and reliability. The transport protocols include (TCP) and User Datagram Protocol (UDP).

(Network)/Internet: Routing the data to the correct destination.
The network layer protocols are the IP and the Internet Control Message Protocol (ICMP), which is used for error reporting.

Data Link: Interface to the physical devices. Transfer data from the network layer from one device to another on the same network.
The protocols in this layer include Ethernet for local area networks (LANs) and the Address Resolution Protocol (ARP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Data Link Layer: Ethernet

A

§ Ethernet is the most popular protocol for the Data Link Layer - de facto standard for Local Area Networks (LANs)
§ Solves problem of addressing with same LAN
- each ethernet frame specifies sender and receiver
§ Every client has a unique identifier/address
- Media/Medium Access Control (MAC) address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Ethernet: Hubs and Switches

A
  • Hub: replicate all incoming frames to all ports (broadcast)
  • Switch: learn MAC address(es) per switch port (unicast)
    (also supports broadcast (via ff:ff:ff:ff:ff:ff), just sends incoming frame to all connected devices)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ethernet: Virtual LANs (VLAN)

A

§ VLAN separate single physical LAN into multiple logical/virtual LANs
- overloads type and payload of Ethernet frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Wireless LAN Concepts

A

§ Base Station: also referred to as Access Point - all clients connect to Base Station
§ Service Set Identifier (SSID)
- factually the name of the wireless network
§ Basic Service Set Identifier (BSSID)
- unique address of base station, commonly MAC address
§ Channel
- frequency at which to transmit data over the air
- 13 (overlapping) channels in 2.4GHz range, 23 non-overlapping in 5GHz range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Announcing SSIDs

A

§ APs frequently announce their presence using so-called beacons

  • Contains network identifier (SSID), support modes, channel which is used
  • If encryption modes are used, these are also announced
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

WPA2: Handshake

A
  1. AP(Base Station) : STA(client station):
    Message includes the MAC address of the AP and a nonce (Anonce)
  2. STA : AP:
    The STA generates its own nonce (Snonce) and uses both nonces and both MAC addresses, plus the PSK, to generate a PTK(pairwise transient key). The STA then sends a message containing its MAC address and Snonce, enabling the AP to generate the same PTK. This message includes a message integrity code (MIC)^2(Message Integrity Code).
    The key used with the MIC is KCK(Key Confirmation Key).
  3. AP : STA:
    The AP is now able to generate the PTK. The AP then sends a message to the STA, containing the same information as in the first message, but this time including a MIC
  4. STA : AP:
    This is merely an acknowledgment message, again protected by a MIC.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

WPA2: Message Integrity Check (MIC)

A

§ MAC has a different meaning in Wi-Fi, therefore MIC is used - technically, it is a MAC
§ Agreed upon PTK is actually combination of multiple keys
- 16 bytes Key Confirmation Key (KCK): used for MIC
- 16 bytes Key Encryption Key (KEK): used for Group Temporal Key transmission (used for broadcast communication)
- 16 bytes Temporal Key (TK): Key actually used to encrypt data
- 16 bytes additional material for MIC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Mapping of IP address to MAC address: ARP

A

§ We typically use IP addresses when sending packets to a host
§ Solution: Address Resolution Protocol (ARP)
- allows to dynamically detect MAC address for given IP address
- Messages sent via broadcast to all connected devices
• ARP Request: Who has IP 1.2.3.4? Tell 1.2.3.5
• ARP Response: 1.2.3.4 is at 00:12:34:56:78:9A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Getting IP addresses: DHCP

A

§ Dynamic Host Configuration Protocol (DHCP)
- hosts request network configuration (e.g., IP and gateway) from DHCP server
• DHCP DISCOVER broadcast over Ethernet
- DHCP server is central entity that hands out IP configuration
§ IPs are only leased for a certain time
- allows for non-used IPs to be re-allocated
- clients therefore regularly REQUEST same IP again

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IPv4 header format

A

§ Version: 4 for IPv4, 6 for IPv6
§ IHL: IP header length
§ Total length: Number of bytes (incl. header)
§ Fragmentation: Info on how packet is split
§ Time-to-Live: Time a packet should survive
§ Protocol: Protocol of IP payload
§ Header Checksum
§ Source/Destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Maximum size of an IP payload?

What is the maximum payload that fits into an IPv4 packet?

A

65515 (slightly less than 2^16-1)

=> Total length has up to 16 bits, so packet can be up to 2^(16) − 1b, minus 20b for the header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

IPv4 Original Addressing

A
  • Class A network (24 bit hosts): 16,777,216 IPs in a network
  • Class B network (16 bit hosts): 65,536 IPs in a network
  • Class C network (8 bit hosts): 256 IPs in a network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Classless Inter-Domain Routing (CIDR)

A
  • Dynamic size of network part, no fixed classes (or ranges)
    • Netmask indicates how many bits belong to the network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name the Network ID for the /14 network which contains the IP address 134.96.225.205.

A

134.96.0.0/14, 134.96.0.0 - 134.99.255.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How many usable IP addresses for clients does the network with the netmask 255.255.224.0 contain?

A

8190 (2^13 − 2) [Network address, broadcast address]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How many hosts are inside the

a network identified by /21?

A

2^11 = 2,048

Since /21 refers to the fact that the first 21 bits of the IP identify the network, we have 11 bits left to address hosts in that network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Internet/Network Layer: Routing

A

Routing is the process of transmitting packets from a source to a destination elsewhere (mostly between different networks)

Router accepts incoming packets forwards them to(wards) the destination on outgoing links

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Routing Tables

A

§ Each router knows its neighbors

- In addition, knows which neighbor is best fit to forward packet to others routers (stored in routing tables)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Path Vector Routing

A

§ Routers keep track of path to use to reach destination
- Sequence of Autonomous Systems to traverse (ASes)
- Next hop to reach the destination
§ Routers advertise their networks for neighbors
- “I am AS 123 and responsible for prefixes C and F.”
- Neighboring routers forward announcements, prepend their own AS Number (ASN) to the path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

BGP

A

Border Gateway Protocol

  • Scales very well for large number of routers
  • Allows to model politics

iBGP (internal) for routing within AS

eBGP (external) for routing between ASes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ICMP Usage: Tracerouting

A

Find the route a packet traverses

  • Send packets to destination with increasing TTLs (starting at 1)
  • Routers on the path drop packet and send ICMP Time Exceeded when TTL=0 (using their IP as source)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

IPSec: Authentication Header (AH)

A

§ Next protocol indicates higher-layer protocol to be used
§ Payload length indicates length of AH
§ Sequence number allows for packet replay detection
§ Integrity Check Value (ICV) of variable length (depends on the agreed upon algorithm used for HMAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IPSec: Tunnel Mode vs. Transport Mode

A

§ IPSec ESP can be run in two operation modes - AH as well, but AH is deprecated

§ Transport Mode: only encrypts and authenticates payload
- Used for endpoint-to-endpoint connections.
Orig IP Header; ESP Header; Orig IP Payload(encrypted); ESP Auth/ICV

§Tunnel Mode: encapsulates original packet into new IP packet (encrypts and authenticates entire IP packet)
New IP Header; ESP Header; Orig IP Header(encrypted); Orig IP Payload(encrypted); ESP Auth/ICV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Transport Layer: Ports

A
  • Processes bind to a port
  • Segments sent to this port are passed to the process bound to it
  • Ports are included in addressing scheme
    **
    § Services usually have well-defined ports
  • e.g., HTTP runs on port 80, HTTPS on port 443, DNS 53, DHCP 67 and 68 (more on that later)
  • ports < 1024 are reserved and privileged
    § “Outgoing” ports are usually randomly assigned by the OS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Multiplexing: Network Address Translation (NAT)

A

=> shortage of IPs and non-routable private networks
Solution: Network Address Translation (NAT)
- Router translates client source IPs to its external IP
- Router keeps track of source/dest. IP/port mappings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

UDP: User Datagram Protocol

A

is a minimalistic Transport Layer protocol

  • simple and stateless
  • unreliable data transmission
28
Q

UDP Header format

A

§ 8 byte header

  • source and destination port
  • total segment length (including the header)
  • optional (in IPv4) checksum
29
Q

Transmission Control Protocol (TCP)

A

§ TCP is an advanced Transport Layer protocol
- connection-oriented
• three-way handshake to initialise connection
• IP addresses are validated
- reliable data transmission
• acknowledgement mechanism forces arrival of data
• lost segments are retransmitted
- congestion control
• adaptation to packet loss to optimal transferrate

30
Q

TCP Header format

A

§ Source/destination port
§ SEQ number: Sender numbering of bytes sent
§ ACK number: Next byte expected by recipient
§ Header length: TCP header length
§ Flags: TCP control indicators
§ Checksum
§ Options

31
Q

TCP Connection Establishment

A

§ Three-way handshake

  • H1 connection request (TCP segment with SYN(j) flag)
  • H2 acknowledges SYN(k) with ACK(j+1) and connects back with SYN
  • H1 acknowledges SYN with ACK(k+1)

§ Bidirectional data stream
- Two independent directions
(Host 1 à Host 2, and Host 2 à Host 1)

32
Q

TCP: Reliable Retransmissions

A 
§ Implemented through Go-Back-N
- S sends up to N non-acknowledged segments
  • N is window size
- R sends cumulative ACK
  • acks all segments received correctly
- If segment X is lost, R discards
all subsequent (X+1...N) segments
  • sends ACKs for X-1
- S repeats sending from X (after timeout, or duplicate ACKs)
33
Q

Benefits and Drawbacks of TCP/UDP

A

§ TCP (connection-oriented)

  • overhead
  • reliable transmission
  • ordering preserved
  • not prone to IP spoofing

§ UDP (connection-less)

  • lightweight
  • prone to packet loss - no ordering
  • prone to IP spoofing
34
Q

IPv4 vs. IPv6

A

§ Addresses are longer
- 128 bit in IPv6 (vs. 32 bit in IPv4)
- Allow up to 2128 hosts
§ Simplifications
- No checksum, no header length, no fragmentation
- Significantly faster processing by routers possible
§ Better support for options
- Next header field allows for easy integration
§ Built-in security
- IPSec integration as its own header (recall hacks for IPv4)

35
Q

Provide the shortest possible notation of the following IPv6 addresses:

a) fe80:0:0:0:aabb:ccff:fedd:eeff
b) fec0:0:0:ffff:0:0:0:1
c) 2000:0:0:0:ac34:0:b43a:ffff

A

a) fe80::aabb:ccff:fedd:eeff
b) fec0:0:0:ffff::1
c) 2000::ac34:0:b43a:ffff

36
Q

Firewall Concept

A

§ Protects an organization (inside) from Internet (outside)
§ All traffic between inside and outside passes firewall
§ Only authorized traffic, as defined by policies, may pass § Assumption: ““firewall cannot be compromised””

37
Q

Simple Packet Filter (PF) Firewall

A

§ Rules/policies regarding packet headers
- Source and destination IP
- IP protocol field (e.g., ICMP/TCP/UDP)
- Source and destination transport-level address (TCP/UDP ports)
§ PF defines (ordered!) list of rules, plus default policy
- Default = drop: all packets not matching a rule are dropped
- Default = accept: all packets not matching a rule are allowed

38
Q

Stateful Inspection Firewalls

A
  • Maintain directory of TCP/UDP connections/streams
    (connection tracking)
  • Specify rules based on packets and/or connections

§ Typically, three connection states
- NEW: packets starts new TCP/UDP connection/stream
- ESTABLISHED: packet is associated with an existing connection
- RELATED: starts new connection associated with an existing connection (e.g., for passive FTP as seen before)
• determining related connections is less trivial and may require analyzing the protocol (e.g., with passive FTP)

39
Q

Demilitarized Zones (DMZ)

A

Even in internal network, we have different protection levels

  • Web server must be reachable from the outside
  • Clients must not be reachable from the outside
  • Compromised Web server must not lead to access to clients

=> Solution: Demilitarized Zones
- e.g., in CISPA implemented through numerous /26 networks

40
Q

CISPA wants to host an in-house Counter-Strike tournament. To not affect the significant work that the researchers are doing, the network administrators have created a new network for this purpose. They task you with the configuration of the firewall for the new network. They give you the following constraints:
• You should allow all traffic needed for Counter-Strike:
– TCP ports 27015-27030
– UDP ports 27000-27030
• All outgoing HTTP and HTTPS traffic should be allowed.
• All outgoing DNS traffic should be allowed.
All other traffic should be dropped. You can write the firewall configuration in the same tabular style as used in the lecture.
//Remember to allow response packets to pass the firewall and to define a default policy.//

A

NEW $INT * $EXT 27015-27030 TCP ACCEPTED
NEW $INT * $EXT 27000-27030 UDP ACCEPTED
NEW $INT * $EXT 80 TCP ACCEPTED
NEW $INT * $EXT 443 TCP ACCEPTED
NEW $INT * $EXT 53 UDP ACCEPTED
Established * * * * * ACCEPTED

41
Q

We have discussed the concepts of Switches and Hubs, shortly depict the differences and explain the advantage which one of these provides concerning security.

A

A hub always broadcasts all frames to every connected device whereas a switch selective deploys unicast when it knows to which port the frame should be forwarded. This prevents a passive adversary which is a part of the network from acquiring all traffic.

42
Q

IPv4 packets carry a checksum of the header. On the way between two computers, who calculates and who checks the checksum? Note that it is calculated on the entire IP header (naturally excluding the checksum itself)

A

Every machine on the way needs to check it for the incoming packet to ensure it has not been corrupted. Since every router is supposed to decrease the TTL, the checksum needs to be recalculated on every hop.

43
Q

What were the first goals from Domain Name System (DNS) when created?

A

Goal #1: Map domain names to IP addresses(A/AAAA)

Goal #2: Find mail exchanges (MX) servers for a domain

Goal #3: Map IP addresses back to host names

44
Q

DNS Hierarchy

A

§ Each zone only knows its direct children

  • Root knows eTLDs (e.g., .com), but not google.com
  • Nameserver of cispa.saarland knows its direct subdomains
Buzzwords:
root domain, administrates top-level domain  (TLD)
TLD, administrates second-level domains
SLD or (eTLD+1), administrates third-level domains
45
Q

DNS Name Resolution Components

A

§ In practice, your computer will not serve as a recursive resolver

  • Application usually queries local stub resolver
  • Stub resolver forwards query to recursive resolver
  • Recursive resolver iteratively queries authoritative nameservers
46
Q

Recursive Resolvers vs. Authoritative Nameservers

A

§ Recursive Resolvers

  • Serve DNS clients (stub resolvers)
  • Resolve any domain
  • Iteratively query authoritative NSes
  • Serve authorised users

§ Authoritative NS

  • Serve recursive resolvers
  • Only reply to domains that are in their zone
  • Deny all recursive domain resolution
  • Cannot restrict user base
47
Q

DNS Resource Records

A

§ Resource Record (RR) type defines meaning of RR and its value
- DNS specifies over 80 types
- Only few are required for basic name resolution
- Single (sub)domain can have multiple entries of same type
SOA -Start of authority
A - IPv4
AAAA - IPv6
TXT - Text
NS - Nameserver
MX - Mail exchange
CNAME - Name of Domain

48
Q

Goals of DNSSEC

A

§ DNSSEC follows multiple goals

  • Data Integrity
  • Origin Authentication
  • Authenticated denial of existence

Explicit non-goals of DNSSEC

  • no confidentiality
  • no protection against DDoS attacks
  • no protection on the path between client and resolver
49
Q

DNSSEC Concepts

A

DNSSEC signs DNS resource records

  • off-the-shelf public-key crypto
  • attacker cannot spoof signed records

Additional DNSSEC resource record types
- RRSIG contains signature
- DNSKEY contains public key
- DS certifies DNSKEY (in parent zone!)
- NSEC/NSEC3 for provable NXDOMAIN responses
=>An NSEC record states the range of names that do not exist. By signing this NSEC record by a corresponding RRSIG record, one can prove that a domainname does in fact not exist.
For every existing name, there is a corresponding NSEC record.
NSEC3 hashes them as well and the orders them.

50
Q

DNSSEC Signatures: Chain of Trust

A
  • parent zone certifies keys of child zones
  • if we trust the parent zone, we can verify keys (recursively)
  • if we do not trust the parent zone directly, traverse upwards to get parent’s parent

=> only root keys need to be known (trust anchors)

51
Q

What are the trust anchors in DNSSEC? Where is it stored?

A

The trust anchors are the public keys of the root zone. They are hardcoded or preconfigured in the resolvers software.

52
Q

TLS Record Protocol

A

TLS Record Protocol en-/decrypts and validates data integrity

  • Confidentiality: Symmetric encryption with private key (derived from hashed master secret in TLS Handshake Protocol)
  • Integrity: Verify data integrity via HMAC using another private key (also derived from hashed master secret)
53
Q

TLS handshake with RSA

A

Client -> Server: Nonce_c + Cipherlist (what can speak and what preferred )
Server -> Client: Nonce_s + Cipherlist (server chooses Suit)
Server -> Client: public RSA key, signed
Client -> Server: RSAenc(PMS(PreMaster Secret), public_s)
=> Both sides compute MasterSecret (MS) with Key Derivation Function (KDF) [ MS = KDF(PMS, Nonce_s, Nonce_c) ]
=> Both sides send ChangeCipherSpec message, indicating that MS is now used to secure all following messages

54
Q

Weakness of RSA-based handshake

A

§ RSA-based handshake does not achieve forward secrecy

- Forward Secrecy means that connection cannot be decrypted after it terminates

55
Q

TLS handshake with Diffie-Hellman and RSA

A

Client -> Server: Nonce_c + Cipherlist (what can speak and what preferred )
Server -> Client: Nonce_s + Cipherlist (server chooses Suit)
Server -> Client: public RSA key, signed
Server -> Client: ServerKeyExchange - Sign(both Nonce, p, g, S)
Client -> Server: C

=> § Diffie-Hellman handshake allows to generate ephemeral keys

  • even knowledge of RSA private key does not allow to recover them
  • MS is still generated from PMS, but PMS is no longer just generated by the client
56
Q

HTTPS (HTTP via TLS)

A

§ HTTPS adds security on top of HTTP
- basically, establishes TLS connection as discussed before
- speaks HTTP “inside” TLS connection (default port 443)
§ Certificate binds key material to identity of servers
- specifically, domain name serves as identity
- Web browser checks matching domain name and certificate chain to trusted root

57
Q

TLS Server Name Indication

A

§ Modern browser can communicate intended domain name
- Server Name Indication extension to handshake
§ Server checks configured certificates
- if one matches, present this to the client
- if no certificate matches, present default certificate
§ drawback: SNI transmission in clear-text
- allows to learn what domain was going to be visited

58
Q

Issuing a new certificate

A

§ Certificate Authority (CA) issues new certificate on request
- requires some validation before issuances
§ Domain Validation (DV)
- Requester has to prove he controls domain
- Example: Let’s Encrypt issues certificate automatically after Web- or DNS-based validation
§ Extended Validation (EV)
- Much stricter issuance rules
- Requires check of postal address, company name, etc.
- (very costly)

59
Q

Domain Validation

A 
Web-based: 
- random content placed at domain
- get's checked
DNS-based:
- random content placed as TXT in an under domain
- get's checked
60
Q

Certificate Revocation

A

§ There are several reasons that necessitate to revoke certificate
- private key has been compromised
- user stopped paying fee, should be terminated
- CA’s key has been compromised
- domain has changed ownership
§ CA keep Certificate Revocation Lists (CRLs)
- usually update once a day
- clients are supposed to download CRL regularly and check if any certificate in the chain is revoked
§ CRLs are being deprecated from browsers though

61
Q

Online Certificate Status Protocol (OCSP)

A

§ Turn CRL approach around
- client checks validity on request (whitelist)
- response is signed to allow for verification
§ OCSP has several drawbacks
- high load on OCSP servers
- clients need to react to tryLater
• usually connect anyways
- privacy leak
• OCSP server knows visited HTTPS sites
- Not enabled by default in all browsers

62
Q

OCSP Stapling

A

§ TLS servers regularly asks OCSP server for validity of its own certificate
- gets “ticket” with limited validity
- OCSP response is stapled to TLS handshake
§ Several benefits
- less load on OCSP server - no privacy leak
§ minor drawback: slight delay in invalidated certificates
§ Certificates can even have Must-Staple - must not be trusted unless OCSP response is stapled to it

63
Q

HTTP Strict Transport Security (HSTS)

A

§ An active network attacker could just drop all port 443 traffic
- user may (unknowingly) fall back to plain HTTP
§ Solution: HTTP Strict Transport Security (HSTS)
- HTTP response header
- until max-age is reached, browser will refuse to visit HTTP site

64
Q

DNS Certification Authority Authorization (CAA)

A

§ DNS entry to authorize CAs to issue certificate

§ CAA should be followed by CA, but cannot really be enforced

65
Q

Certificate Transparency (CT)

A

§ CT uses third party for append-only log
- all requests are sent to CT log server first
- CT log stores certificate information in append-only log
- CT hands out Signed Certificate Timestamp (SCT)
- CA adds SCT to certificate, signs it
§ Any certificate since April 2018 must have SCT, otherwise Chrome issues warning
§ CT allows to find rogue CAs, not to stop them

66
Q

DNS-based Authentication of Named Entities (DANE)

A

§ Uses DNS to ensure authority of CA / certificate

CySec 1 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions