Networks

Question 1

TCP/IP Model

Answer 1

Application
Transport
Internet
Link
Physical

Question 2

Application Layer

Answer 2

data,
process-to-process communication

Question 3

Transport Layer

Answer 3

TCP segment / UDP datagram,
host-to-host communication

Question 4

Internet Layer

Answer 4

packet,
connects segments

Question 5

Link Layer

Answer 5

frame,
single network segments

Question 6

Physical Layer

Answer 6

bit,
the wire

Question 7

TCP (Transmission Control Protocol)

Answer 7

• transport layer
• connection oriented, reliable, stream delivery service on top of IP.
• retransmission of dropped/corrupt packets, in-order delivery
• flow & congestion control
• keeps track of client and server state

Question 8

User Datagram Protocol (UDP)

Answer 8

• no 3-way handshake –> unreliable
• connectionless, no analogue to ISNs (TCP’s initial sequence number) –> easy to spoof

Question 9

Firewalls

Answer 9

• network level access control
• inspect traffic and filter/modify it based on rules

Question 10

Border Gateway Protocol (BGP)

Answer 10

• standard exterior gateway (route between ASes)
• allows for specifying complex routing policies
• runs the distance-vector algorithm
• attacker goals: blackholing (drop all traffic) & redirect sensitive traffic through an untrusted AS

Question 11

HTTP Access Control

Answer 11

• HTTP is stateless (doesn’t know previous and following requests), so need mechanisms to enforce authentication and authorization
• HTTP Authentication.
• Session cookies.
• TLS certificates.
• Secure Remote Password (SRP).
• Kerberos.
• OAuth2.0.
• OpenID Connect.

Question 12

Cookies

Answer 12

• Basic mechanism for persistent state over HTTP.
  – Allows servers to store a small amount of data on the client’s machine.
  – Used for authentication, tracking.
  – Manipulated by Set-Cookie and Cookie HTTP headers.

Question 13

TLS

Answer 13

• Application-level cryptographic protocol to provide confidentiality and integrity between applications. Also, either one-way or mutual authentication.
• relies on X.509 certificates and the public-key infrastructure
• Certificate authorities can be malicious or compromised… not always secure
• does not help you if you connect to malicious site
• does not help already vulnerable web applications

Question 14

Limiting factor of an anomaly detection system?

Answer 14

false positives

Question 15

Golden rule of cookie generating

Answer 15

cookies should not be predictable (otherwise, CSRF risk –> someone can predict your cookie and pretend to be you)