Lecture 11 - Network Security

Question 1

Two Threat Models

Answer 1

Passive Attack (Observing)

• Eavesdropping/Sniffing
• Traffic Analysis

Active Attack (Actually Attacking)

• Spoofing attack
• Squatting attack
• Phishing

Question 2

Network Attack Example

Answer 2

Denial of Service by TCP Syn Flooding

• Initiate a genuine connection but then immediately break it.
• Never finish the 3-way request
• Victim busy with timeout.
• Amplify with botnets

Question 3

Open Systems Interconnection (OSI)

Answer 3

Framework for layering network protocols

Question 4

TCP/IP

Answer 4

Simplifies TCP/IP
Application Layer
Transport
Internet
Network Access.

Question 5

IP Security

Answer 5

IP is connectionless and stateless.
Security mechanism
- IP authentication header (AH)
- IP encapsulation security payload.(EPS)

Question 6

Encapsulation Security Payload (ESP)

Answer 6

additional header within the IP packet that describes what encryption and authentication is in use

Question 7

Security Parameter Index

Answer 7

a number, stores security parameter.

Uses DH KEX

Question 8

Transport and Tunnel Mode

Answer 8

Transport Mode

• Simply encrypt packets
• Prevent content to be read but not traffic analysis

Tunnel Mode

• Protect some segment of a channel with encryption
• Prevent Traffic Analysis and manipulation of payload
• Eg. VPN

Question 9

ARP

Answer 9

• Protocol used in iPv4 to obtain physical MAC address for given IPs
• To construct IP & TCP packets for communication

Question 10

ARP cache Poisoning

Answer 10

• Man-in-middle attack
• By sending an requested ARP reply and overwrite the MAC address in a host ARP cache with our own.
  Prevent by:
  -Ignore unsolicited ARP request
  -Keep track who has what IP

Question 11

DNS

Answer 11

• Translate domain names into IP address.
• Caches the new website.
• DNS packets are UDP. Stateless, on transport layer

Question 12

DNS Spoofing

Answer 12

• Poison the cache of a nameserver people are using.
• Replace a website lookup with our IP, the Phish.
• Achieve through prior ARP cache poisoning, reply flod or kaminsky attack.

Protection

• random query number protect spoof replies
• DNSSEC certificate

Question 13

Denial of Service

Answer 13

• attempt to make a machine/network resource unavailable to its intended users.
• Flooding a machine with request. eg ping flood.
• Distributed Dos using more than one machine.

Question 14

Amplification attacks

Answer 14

utilise an aspect of a network protocol to increase the bandwith of an attack.

Question 15

Smurf Attack

Answer 15

broadcast an ICMP Ping request to a router but with a spoofed IP belonging to the victim.

Question 16

Fraggle Attack

Answer 16

Identical to smurf but using UDP echo packets