Lesson 11 - Implementing Secure Network Protocols

Question 1

provides an automatic method for network address allocation.

Answer 1

Dynamic Host Configuration Protocol (DHCP)

Question 2

is a type of DoS attack where a rogue client repeatedly requests new IP addresses using spoofed MAC addresses, with the aim of exhausting the IP address pool.

Answer 2

DHCP starvation
This makes it more likely that clients seeking an address lease will use the rogue DHCP server.

Question 3

resolves fully qualified domain names (FQDNs) to IP addresses.

Answer 3

Domain Name System (DNS)
The name servers work over port 53.

Question 4

A type of hijacking attack where the attacker steals a domain name by altering its registration information and then transferring the domain name to another entity. Sometimes referred to as brandjacking.

Answer 4

Domain Hijacking

Question 5

A network-based attack where an attacker exploits the traditionally open nature of the DNS system to redirect a domain name to an IP address of the attacker’s choosing.

Answer 5

DNS poisoning
Several DNS poisoning attack can be perpetrated:
Man in the Middle
DNS Client Cache Poisoning
DNS Server Cache Poisoning

Question 6

obtaining information about a private network by using its DNS server to perform a zone transfer (all the records in a domain) to a rogue DNS or simply by querying the DNS service, using a tool such as nslookup or dig.

Answer 6

DNS Footprinting

Question 7

A security protocol that provides authentication of DNS data and upholds DNS data integrity.

Answer 7

DNS Security Extensions (DNSSEC)
Helps to mitigate spoofing and poisoning attacks by providing a validation process for DNS responses.
The Key Signing Key for a particular domain is validated by the parent domain or host ISP. The top-level domain trusts are validated by the Regional Internet Registries and the DNS root servers are self-validated, using a type of M-of-N control group key signing. This establishes a chain of trust from the root servers down to any particular subdomain.

Question 8

A network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.

Answer 8

Lightweight Directory Access Protocol (LDAP)
Pot 389

Question 9

A network protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.

Answer 9

LDAP Secure (LDAPS)
LDAPS (TLS over TCP port 636)

Question 10

Protocol for monitoring and managing network devices. SNMP works over UDP ports 161 and 162 by default.

Answer 10

Simple Network Management Protocol (SNMP)
Widely framework for management and monitoring.
Device queries take place over port 161 (UDP); traps are communicated over port 162 (also UDP).
SNMP v3 supports encryption and strong user-based authentication.

Question 11

Provides a transport over which to synchronize these time dependent applications.

Answer 11

Network Time Protocol (NTP)
NTP works over UDP on port 123.
Top-level NTP servers (stratum 1) obtain the Coordinated Universal Time (UTC) from a highly accurate clock source, such as an atomic clock.

Question 12

The protocol used to provide web content to browsers. HTTP uses port 80. HTTPS(ecure) provides for encrypted transfers, using SSL/TLS and port 443.

Answer 12

HyperText Transfer Protocol (HTTP)
HTTP also features a forms mechanism (POST) whereby a user can submit data from the client to the server.
HTTP is nominally a stateless protocol; this means that the server preserves no information about the client during a session.

Question 13

A security protocol that uses certificates for authentication and encryption to protect web communication.

Answer 13

Transport Layer Security (TLS)
Secure Socket Layer (SSL)

Question 14

An attack where a man-in-the-middle tries to force the use of a weak cipher suite and SSL/TLS version.

Answer 14

Downgrade Attack

Question 15

the algorithms supported by both the client and server to perform the different encryption and hashing operations required by the protocol.

Answer 15

A cipher suite
Prior to TLS 1.3, a cipher suite would be written in the following form:
ECDHE-RSA-AES128-GCM-SHA256
This means that the server can use Elliptic Curve Diffie-Hellman Ephemeral mode for session key agreement, RSA signatures, 128-bit AES-GCM (Galois Counter Mode) for symmetric bulk encryption, and 256-bit SHA for HMAC functions. Suites the server prefers are listed earlier in its supported cipher list.

TLS 1.3 uses simplified and shortened suites. A typical TLS 1.3 cipher suite appears as follows:
TLS_AES_256_GCM_SHA384
Only ephemeral key agreement is supported in 1.3 and the signature type is supplied in the certificate, so the cipher suite only lists the bulk encryption key strength and mode of operation (AES_256_GCM), plus the cryptographic hash algorithm (SHA384) used within the new hash key derivation function (HKDF). HKDF is the mechanism by which the shared secret established by D-H key agreement is used to derive symmetric session keys.

Question 16

A library of programming utilities used, for example, to enable software developers to access functions of the TCP/IP network stack under a particular operating system.

Answer 16

application programming interface (API)
Use of these APIs is authorized via a token or secret key.

Question 17

Attack method where malicious XML is passed as input to exploit a vulnerability in the target app.

Answer 17

XML injection

Question 18

A protocol used to transfer files between network hosts.

Answer 18

File Transfer Protocol (FTP)
Variants include S(ecure)FTP, FTP with SSL (FTPS and FTPES) and T(rivial)FTP. FTP utilizes ports 20 and 21.
All authentication and data transfer are communicated as plaintext, meaning that credentials can easily be picked out of any intercepted FTP traffic.

Question 19

A secure version of the File Transfer Protocol that uses a Secure Shell (SSH) tunnel as an encryption method to transfer, access, and manage files.

Answer 19

SSH FTP (SFTP)
Secure Shell (SSH) over TCP port 22

Question 20

Another means of securing FTP is to use the connection security protocol SSL/TLS. There are two means of doing this:

Answer 20

Explicit TLS (FTPES)—use the AUTH TLS command to upgrade an unsecure connection established over port 21 to a secure one. This protects authentication credentials. The data connection for the actual file transfers can also be encrypted (using the PROT command).
Implicit TLS (FTPS)—negotiate an SSL/TLS tunnel before the exchange of any FTP commands. This mode uses the secure port 990 for the control connection. A type of FTP using TLS for confidentiality.
FTPS is tricky to configure when there are firewalls between the client and server. Consequently, FTPES is usually the preferred method.

Question 21

The protocol used to send mail between hosts on the Internet.

Answer 21

Simple Mail Transfer Protocol (SMTP)
Messages are sent over TCP port 25.

Question 22

SMTP communications can be secured using TLS. This works much like HTTPS with a certificate on the SMTP server. There are two ways for SMTP to use TLS:

Answer 22

STARTTLS—this is a command that upgrades an existing unsecure connection to use TLS. This is also referred to as explicit TLS or opportunistic TLS.
SMTPS—this establishes the secure connection before any SMTP commands (HELO, for instance) are exchanged. This is also referred to as implicit TLS.
The STARTTLS method is generally more widely implemented than SMTPS. Typical SMTP configurations use the following ports and secure services:

Question 23

TCP port 110 protocol that enables a client to access email messages stored in a mailbox on a remote server. The server usually deletes messages once the client has downloaded them.

Answer 23

Post Office Protocol v3 (POP3)
POP3S is the secured version of the protocol, operating over TCP port 995 by default.

Question 24

TCP/IP application protocol providing a means for a client to access and manage email messages stored in a mailbox on a remote server.

Answer 24

Internet Message Access Protocol v4 (IMAP4)
IMAP4 utilizes TCP port number 143.
The default port for IMAPS is TCP port 993.

Question 25

An email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications.

Answer 25

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 26

A generic name for protocols that carry voice traffic over data networks.

Answer 26

Voice over IP (VoIP)

Question 27

Used to establish, disestablish, and manage VoIP and conferencing communications sessions. It handles user discovery (locating a user on the network), availability advertising (whether a user is prepared to receive calls), negotiating session parameters (such as use of audio/ video), and session management and termination.

Answer 27

Session Initiation Protocol (SIP)
Where unencrypted SIP typically runs over TCP port 5060, SIPS uses TCP port 5061.

Question 28

Opens a data stream for video and voice applications over UDP. The data is packetized and tagged with control information (sequence numbering and time-stamping).

Answer 28

real-time Transport Protocol (RTP).

Question 29

Version of RTP secured using TLS.

Answer 29

SRTP

Question 30

A secure tunnel created between two endpoints connected via an unsecure network (typically the Internet).

Answer 30

virtual private network (VPN)

Question 31

The practice of encapsulating data from one protocol for safe transfer over another network such as the Internet.

Answer 31

tunnel

Question 32

Developed by Cisco and Microsoft to support VPNs over PPP and TCP/IP. PPTP is highly vulnerable to password cracking attacks and considered obsolete.

Answer 32

Point-to-Point Tunneling Protocol (PPTP)

Question 33

A protocol that uses the HTTP over SSL protocol and encapsulates an IP packet with a PPP header and then with an SSTP header.

Answer 33

Secure Sockets Tunneling Protocol (SSTP)

Question 34

Dial-up protocol working at layer 2 (Data Link) used to connect devices remotely to networks.

Answer 34

The Point-to-Point Protocol (PPP)

Question 35

A set of open, non-proprietary standards that are used to secure data through authentication and encryption as the data travels across the network or the Internet.

Answer 35

Internet Protocol Security (IPSec)
Internet Protocol Security (IPSec) operates at the network layer (layer 3) of the OSI model, so it can be implemented without having to configure specific application support. IPSec can provide both confidentiality (by encrypting data packets) and integrity/anti-replay (by signing each packet).
The main drawback is that it adds overhead to data communications.
IPSec can be used to secure communications on local networks and as a remote access protocol.

Question 36

An IPSec protocol that provides authentication for the origin of transmitted data as well as integrity and protection against replay attacks.

Answer 36

Authentication Header (AH)

Question 37

IPSec sub-protocol that enables encryption and authentication of the header and payload of a data packet.

Answer 37

Encapsulation Security Payload (ESP)
Encapsulation Security Payload (ESP) provides confidentiality and/or authentication and integrity.

Question 38

IPSec can be used in two modes:

Answer 38

Transport mode—this mode is used to secure communications between hosts on a private network (an end-to-end implementation). When ESP is applied in transport mode, the IP header for each packet is not encrypted, just the payload data. If AH is used in transport mode, it can provide integrity for the IP header.
Tunnel mode—this mode is used for communications between VPN gateways across an unsecure network (creating a VPN). This is also referred to as a router implementation. With ESP, the whole IP packet (header and payload) is encrypted and encapsulated as a datagram with a new IP header. AH has no real use case in tunnel mode, as confidentiality will usually be required.

Question 39

Framework for creating a Security Association (SA) used with IPSec. An SA establishes that two hosts trust one another (authenticate) and agree secure protocols and cipher suites to use to exchange data.

Answer 39

Internet Key Exchange (IKE)

Question 40

IKE negotiations take place over two phases:

Answer 40

Phase I establishes the identity of the two hosts and performs key agreement using the Diffie-Hellman algorithm to create a secure channel. Two methods of authenticating hosts are commonly used:
Digital certificates—the hosts use certificates issued by a mutually trusted certificate authority to identify one another.
Pre-shared key (group authentication)—the same passphrase is configured on both hosts.

Phase II uses the secure channel created in Phase I to establish which ciphers and key sizes will be used with AH and/or ESP in the IPSec session.

Question 41

VPN protocol for tunneling PPP sessions across a variety of network protocols such as IP, Frame Relay, or ATM.

Answer 41

Layer 2 Tunneling Protocol (L2TP)

Question 42

VPN configuration where only traffic for the private network is routed via the VPN gateway.

Answer 42

Split tunnel

Question 43

VPN configuration where all traffic is routed via the VPN gateway.

Answer 43

Full tunnel
Full tunnel offers better security, but the network address translations and DNS operations required may cause problems with some websites, especially cloud services. It also means more data is channeled over the link.

Question 44

Microsoft’s protocol for operating remote connections to a Windows machine (Terminal Services) allowing specified users to log onto the Windows computer over the network and work remotely. The protocol sends screen data from the remote host to the client and transfer mouse and keyboard input from the client to the remote host. It uses TCP port 3389.

Answer 44

Remote Desktop Protocol (RDP)

Question 45

Remote access tool and protocol. VNC is the basis of macOS screen sharing.

Answer 45

Virtual Network Computing (VNC)
Other example is Teamviewer

Question 46

Using features of HTML5 to implement remote desktop/VPN connections via browser software (clientless).

Answer 46

HTML5 VPN

Question 47

Accessing the administrative interface of a network appliance using a separate network from the usual data network. This could use a separate VLAN or a different kind of link, such as a dial-up modem.

Answer 47

out-of-band (OOB)

Question 48

A hardened server that provides access to other hosts.

Answer 48

jump server

Question 49

A remote administration and file-copy program that supports VPNs by using port forwarding, and that runs on TCP port 22.

Answer 49

Secure Shell (SSH)
The main uses of SSH are for remote administration and secure file transfer (SFTP).