Chapter 4 - Secure Networks Flashcards
Explain the four general goals for secure networking.
CIFAC: Confidentiality, Availability, Functionality, Access Control
Confidentiality - Not the idea of keeping messages secret, but also keeping network structure and data secret as well. Things like network protocols and packet header values need to be kept secure.
Availability - Ensuring that authorized users have access to information, services, and network resources.
Functionality - Preventing attackers from altering the capabilities or operation of the network (think DDoS).
Access Control - Keep attackers from accessing internal resources.
How can information be gathered from encrypted network traffic?
Information can be gathered from encrypted traffic by passively monitoring said traffic. Even encrypted, you could still see sites visited, how much data is sent or received, etc.
How does the castle model relate to secure networking?
The traditional castle model of network defense had the good guys on the inside, and the attackers on the outside. There was a well-guarded single point of entry. All network administrators had to do was secure this point of entry and attackers would be stopped.
What is a denial-of-service attack?
A denial-of-service attack is an attack made in order to attempt to render a server or network unavailable by flooding it with attack packets.
Is a slow degradation of service worse than a total stoppage? Why?
It is worse, in that it’s much harder to detect. It might just look like actual growth in traffic, as opposed to an attack.
What is a denial-of-service attack?
A denial-of-service attack is a method of overwhelming network resources in such a way that legitimate users cannot access it.
Other than a DoS attack, what could cause a company’s network to crash?
Other things that could cause a company’s network to crash might be things like:
Referral from sites with considerably larger traffic volume.
Poor coding.
What are the main goals of DoS attacks?
The primary goal of DoS attacks is to cause harm, by either stopping a service, or slowly degrading it over time.
What is the difference between a direct and indirect DoS attack?
A direct DoS occurs when the attacker sends attack packets directly from his computer. An indirect attack relies on IP address spoofing in order to try and misdirect traceback.
What is backscatter?
Backscatter is a side effect of an attacker spoofing an IP address, where the victim’s response packets unintentionally flood the spoofed IP address the attacker is using. Hilarity ensues.
What types of packets can be sent as part of a DoS attack?
Although any packet could be used in theory, there are a few particulars:
SYN Packets - Known as a SYN Flood, the SYN packets form half-open connections, as the system waits for the final confirmation packet, which won’t come. Eats up memory.
Ping Flood - The system is hit with ICMP packets that look like standard supervisory traffic, overwhelming bandwidth and CPU.
HTTP Flood - Usually with webservers, flooded with web requests, crashing due to lack of memory and CPU power.
How does a DDoS attack work?
A DDoS attack is much like a DoS attack, but the attack comes from multiple computers, often botted. This provides resources that one attacker might not have with one machine, and can take down large targets.
What is a handler, and what does it do?
A handler is an intermediary computer that coordinates large groups of bots, as significant numbers of bots can be difficult to manage. They are also known as command-and-control servers, and provide an additional layer of anonymity.
How does a P2P redirect work?
A P2P redirect works by redirecting legitimate P2P requests to an unrelated network, redirecting the “flow” of the P2P traffic. The target can generally not filter out legitimate users from the flood.
How does a reflected attack work?
A reflected attack is similar to a P2P redirect. The attacker sends spoofed requests to servers that offer legitimate services. The responses from the servers then overwhelm the victim, as they often have far more power than the victim. The servers can be blocked, but this might cause more trouble, as attackers might use something like the DNS services of the victim, thus causing additional harm.
What is a DRDoS attack, and how does it work?
A DRDoS attack is a Distributed Reflected Denial of Service attack, and it uses the same basic mechanism of the reflected attack, but using a botnet to achieve far greater volume.
What is a smurf flood?
A smurf flood is a form of the reflected attack, but it takes advantage of a server that hasn’t been configured in a way to prevent broadcasting to all devices. The attacker sends a spoofed ICMP echo to the router (or other network device), which then echoes it to all network devices. All the devices then echo to the target, flooding it. The target need not be internal to the smurfed network.
How could a malformed packet cause a host to crash?
A malformed packet is a packet that somehow violates the rules of an operating system, causing it to have unhandled exceptions and go down.
What is black holing?
Black holing is when all packets from an IP address are dropped automatically. This isn’t good, if done automatically. Spoofed IPs could cause blocking of genuine business partners or customers, and it’s simple for attackers to change IP addresses.
How can the effects of SYN floods be mitigated?
SYN Floods can be mitigated by firewalls; the firewall accepts the SYN packet and sends back the SYN/ACK packet. If no final ACK is forthcoming, the firewall drops the original packet. If the final ACK does come, it lets it through. This is called a “false open”.
What is rate limiting, and why is it good? Why is it bad?
Rate limiting is done by limiting the amount of a certain type of traffic that a network will admit to a reasonable amount. This can prevent smurf flooding by preventing an unacceptable amount of ICMP packets from entering, while still allowing broadcasting to be used. Unfortunately, this limitation can limit legitimate users as well.
Why are DoS community problems?
DoS attacks are community problems because they can saturate ISP access lines, causing problems for legitimate users, and can only really be stopped by the ISP and any organization whose computers have been zombified.
Why do hosts use Address Resolution Protocol?
Hosts use Address Resolution Protocol (or ARP) to resolve 32-bit IP addresses into 48-bit local MAC addresses. For this to work, hosts must know each other’s MAC addresses. This allows them to send and receive packets using IP addresses.
How does ARP work?
When a router receives a packet addressed to an internal host, it sends an ARP request to every host on the LAN asking for their IP address. The actual host replies with an ARP reply, the rest ignore the request. This reply contains its physical ARP reply. The network switch then records this information, along with port numbers, and looks from that point on at MAC addresses, not IP addresses.
Can ARP poisoning be used outside the LAN? Why or why not?
ARP poisoning cannot be used outside the LAN, because ARP tables aren’t used anywhere but on a LAN.
Why do hosts send ARP requests?
Hosts send ARP requests to determine the MAC addresses of hosts on their network.
What is ARP spoofing?
ARP spoofing is when false ARP replies are used to map any IP address to any MAC address. These spoofed ARP replies are broadcast to all hosts on the LAN, manipulating the ARP tables.
What is ARP poisoning, and how does it work?
ARP poisoning is when a continuous stream of unsolicited, spoofed ARP requests to all the hosts on the LAN save the gateway. This tells the hosts that the gateway is at a new location, the attacker’s MAC. All packets they want to send now go to the attacker. Thanks to the switch only looking at MAC addresses, it goes along with it.
The attacker then poisons the gateway by bombarding it with ARP replies telling it that all the hosts are at the attacker’s MAC.
The ARP requests must be continuous, or else the hosts and gateways will reply normally, and self-correct.
How can ARP poisoning be used as a DoS attack?
ARP poisoning can be used very easily as a DoS attack, by setting the MAC address of all hosts in the tables to a non-existent MAC address. All packets will be dropped, and nothing will get through.
How can ARP poisoning be prevented?
ARP poisoning can be prevented through the use of static ARP tables and static IP tables. These are set manually, and cannot be dynamically updated.
Another method would be by limiting local access, keeping foreign hosts out.
What’s the downside of static IP and ARP tables?
They’re flat-out unwieldy for anything save small networks, as they’ll have to be updated constantly whenever the network structure changes.
What is the main access control threat to Ethernet LAN?
The main access control threat to Ethernet LANs is the act of people actually physically plugging in to an ethernet port in the wall.
