DOCSLIB.ORG

Opportunistic Computing in Wireless Networks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Opportunistic Computing in Wireless Networks OPPORTUNISTIC COMPUTING IN WIRELESS NETWORKS DISSERTATION Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy in the Graduate School of The Ohio State University By Zhimin Yang, B.E., M.E., M.S. Graduate Program in Computer Science and Engineering The Ohio State University 2010 Dissertation Committee: Dong Xuan, Adviser Ten-Hwang Lai Feng Qin Copyright by Zhimin Yang 2010 ABSTRACT Opportunistic computing is the exploitation of opportunities as they arise to pro- vide computing services that meet application requirements. It maximally utilizes available resources to improve such services subject to application constraints. When applied to different applications, we have different concrete instances of opportunistic computing. In this dissertation, we focus on its utilization in the context of wire- less networking applications. Particularly, we study four instances of opportunistic computing in wireless networks: opportunistic social networking, opportunistic local- ization, opportunistic encryption, and opportunistic authentication. First, we study opportunistic social networking with mobile phones. We develop E-SmallTalker, a novel distributed mobile communication system that aims to fa- cilitate more effective social networking among strangers in physical proximity. We propose a privacy-preserving opportunistic commonality discovery protocol that uti- lizes iterative Bloom filters to encode user information. We eliminate unnecessary user interactions by exploiting Bluetooth service attributes to publish encoded user data. Second, we study opportunistic localization in wireless sensor networks. We pro- pose an “anti-sensor network” system to localize an adversary’s sensors in a non- cooperative environment where these sensors try to evade or deter localization. The system relies on a set of monitors opportunistically observing intermittent wireless ii signals emitted by sensors in the protected area. With these observations, we esti- mate sensor locations with an opportunistic localization algorithm. We also design improved algorithms to handle additional countermeasures that sensors can employ such as message encryption and non-uniform transmission power levels. Third, we study opportunistic encryption in wireless LANs. We identify and analyze security issues in the current 802.11i security standard. We illustrate the se- vere consequences resulting from the lack of frame authentication with an exemplary denial-of-service attack. We propose a new key-establishment algorithm for oppor- tunistic encryption in the link layer. Our algorithm makes minimal changes to the existing 802.11 protocol. Fourth, we study opportunistic authentication in wireless web applications. We propose opportunistically utilizing users’ trusted devices such as mobile phones to aid web authentication in wireless networks. We design and implement a prototype one- time-password (OTP) authentication system that works seamlessly in heterogeneous environments. We propose a one-time-password reference service that allows an OTP- token to be opportunistically used in multiple web applications. We also propose a new connection-aware one-time-password algorithm to thwart man-in-the-middle attacks by using connection information. iii Dedicated To My Family For Love and Support iv ACKNOWLEDGMENTS First of all, I would like to thank my advisor, Dr. Xuan, for his superb guidance and inspirations throughout this academic experience. I really enjoyed all the insight- ful conversations which made this dissertation possible. Dr. Xuan showed me how to rigorously define and refine problems, develop solutions, and organize research papers. He’s knowledgeable, patient and always has insightful suggestions and comments. Dr. Xuan broadened my scope and his diligence and passion for high quality research will always encourage me to achieve more. Both my wife and I thank Dr. Xuan from the bottom of our hearts for the kind support and help when our family was in the difficult and unexpected situations. All the wonderful Thanksgiving, Christmas, and Chinese New Year parties at Dr. Xuan’s home are joyful memories which can never be forgettable. I can’t say enough to thank him. I am also extremely grateful to Dr. Ten H. Lai, Dr. Feng Qin, Dr. Eylem Ekici, and Dr. Timothy Long for serving in my candidacy exam and/or dissertation committees and their constructive feedback in this research. I would also like to acknowledge my labmates, Dr. Xun Wang, Dr. Sriram Chel- lappan, Dr. Wenjun Gu, Dr. Xiaole Bai, Adam C. Champion, Boxuan Gu, Jiangpeng Dai, Xudong Ni and Jin Teng for the stimulating discussions. You make my life in OSU so enjoyable. I wish you the best in your career. v I would like to express my gratitude to all those who have advised, helped, and supported me during the past years. Finally, I am forever indebted to my family for their unconditional love and sup- port throughout my life. My lovely son, David, is the every reason for me to go ahead. vi VITA April 14, 1972 ..............................Born – Harbin, China 1995 ........................................Bachelor in Engineering Harbin Institute of Technology Harbin, China 1997 ........................................Master in Engineering Harbin Institute of Technology Harbin, China 2009 ........................................Master of Science The Ohio State University 2005 – Present ..............................Graduate Teaching Associate / Gradu- ate Research Associate The Ohio State University PUBLICATIONS Research Publications Zhimin Yang, Eylem Ekici, Dong Xuan. “A Localization-Based Anti-Sensor Network System”. Proceedings of the 26th IEEE International Conference on Computer Com- munications (IEEE INFOCOM mini conference), 2396 - 2400, Anchorage, Alaska, USA, May 2007. Wenjun Gu, Zhimin Yang, Can Que, Dong Xuan, Weijia Jia. “On Security Vulnera- bilities of Null Data Frames in IEEE 802.11 based WLANs”. Proceedings of the 28th IEEE International Conference on Distributed Computing Systems(IEEE ICDCS), 28 - 35, Beiing, China, June 2008. vii Zhimin Yang, Adam C. Champion, Boxuan Gu, Xiaole Bai, Dong Xuan. “Link-Layer Protection in 802.11i WLANs with Dummy Authentication”. Proceedings of the 2nd ACM Conference on Wireless Network Security (ACM WiSec short paper), 131 - 138, Zurich, Switzerland, March 2009. Xudong Ni, Zhimin Yang, Xiaole Bai, Adam Champion, Dong Xuan. “DiffUser: Differentiated User Access Control on Smartphone”. Proceedings of the 5th IEEE International Workshop on Wireless and Sensor Networks Security (IEEE WSNS), Macau, China, Oct. 2009. Boxuan Gu, Xiaole Bai, Zhimin Yang, Adam Champion, Dong Xuan. “Malicious Shellcode Detection with a Virtual Memory Snapshot”. to appear in Proc. of IEEE International Conference on Computer Communications (IEEE INFOCOM), 2010. Wenjun Gu, Zhimin Yang, Dong Xuan, Weijia Jia, Can Que. “Null Data Frame: A Double-edged Sword in IEEE 802.11 WLANs”. to appear in IEEE Transactions on Parallel and Distributed Systems (TPDS), accepted 2009 . Jiangpeng Dai, Xiaole Bai, Zhimin Yang, Zhaohui Shen, Dong Xuan. “PerFallD: A Pervasive Fall Detection System Using Mobile Phones”. to appear in Proc. of IEEE PerCom Workshop on Pervasive Healthcare (PerHealth), 2010. Zhimin Yang, Boying Zhang, Jiangpeng Dai, Adam C. Champion, Dong Xuan, Du Li. “E-SmallTalker: A Distributed Mobile System for Social Networking in Physical Proximity”. to appear in Proc. of IEEE International Conference on Distributed Computing Systems(IEEE ICDCS), 2010. viii FIELDS OF STUDY Major Field: Computer Science and Engineering Studies in: Computer Networking Prof. Anish Arora Prof. Eylem Ekici Prof. Ten-H. Lai Prof. David Lee Prof. Ming T. Liu Prof. Prasun Sinha Prof. Dong Xuan Software Systems Prof. Paul Sivilotti Prof. Igor Malkiman Parallel and Distributed Systems Prof. P. Sadayappan Prof. Gagan Agrawal Prof. Feng Qin ix TABLE OF CONTENTS Page Abstract....................................... ii Dedication...................................... iv Acknowledgments.................................. v Vita ......................................... vii ListofFigures ................................... xiii Chapters: 1. INTRODUCTION .............................. 1 1.1 Motivation ............................... 1 1.2 ContributionsofThisDissertation . 6 1.3 OrganizationofThisDissertation . 9 2. OPPORTUNISTIC SOCIAL NETWORKING WITH MOBILE PHONES 11 2.1 Motivation ............................... 12 2.2 RelatedWork.............................. 17 2.3 Opportunistic Social Networking: Privacy Preserving Commonality DiscoveryandVerification . 22 2.3.1 Commonality Discovery Problem . 22 2.3.2 Opportunistic Commonality Discovery Protocol . .. 25 2.3.3 Opportunistic Commonality Verification Protocol . ... 29 2.4 E-SmallTalker System Design, Implementation and Evaluation. 32 2.4.1 SystemArchitecture . 32 2.4.2 SystemImplementation . 39 x 2.4.3 SystemPerformanceEvaluation. 40 2.5 Discussions ............................... 47 2.6 Summary ................................ 50 3. OPPORTUNISTIC LOCALIZATION IN WIRELESS SENSOR NETWORKS 51 3.1 Motivation ............................... 52 3.2 RelatedWork.............................. 54 3.3 The Opportunistic Localization System Architecture . ...... 55 3.3.1 SystemDescription. 55 3.3.2 SensorCounter-Measures . 57 3.4 Opportunistic Localization Algorithms . ... 58 3.4.1 Basic Opportunistic Localization Methodology . .. 58 3.4.2 Localization with Encrypted Messages . 64 3.4.3 Localization with Power Level Variations . 69 3.5 PerformanceEvaluation .
Load more

Recommended publications
  • Wireless Local Area Networks: Threats and Their Discovery Using Wlans Scanning Tools Ms
    International Journal of Advanced Networking Applications (IJANA) ISSN No. : 0975-0290 137 Wireless Local Area Networks: Threats and Their Discovery Using WLANs Scanning Tools Ms. Rakhi Budhrani Bhavnagar, Gujarat, India. Dr. R. Sridaran, Dean, Faculty of Computer Applications, Marwadi Education Foundation’s Group of Institutions, Rajkot, Gujarat, India. ----------------------------------------------------------------------ABSTRACT-------------------------------------------------------- Wireless Local Area Networks frequently referred to as WLANs or Wi-Fi networks are all the passion in recent times. Wireless networks offer handiness, mobility, and can even be less expensive to put into practice than wired networks in many cases. But how far this technology is going provide a protected environment in terms of privacy is again an anonymous issue. Realizing the miscellaneous threats and vulnerabilities associated with 802.11-based wireless networks and ethically hacking them to make them more secure is what this paper is all about. On this segment, we'll seize a look at common threats, vulnerabilities related with wireless networks. This paper presents an overview some of the WLANs Scanning, Sniffing and Auditing tools available on the internet. This paper Reviews these tools along with their merits, demerits and how they can be used for hacking, exploiting security holes and their usage characterization in WLANs. Keywords - Current threats in WLANs, Exploiting Security, WLANs Scanning, WLANs Sniffing, Multifunctional, WLANs auditing tools penetrate any wired network via wireless network as Access Point (AP) is bridging between wireless and I. INTRODUCTION wired network. Wireless Networks present a host of issues for network managers. Unauthorized access he Institute of Electrical and Electronics points, broadcasted SSIDs, unknown stations, MITM Engineers (IEEE) provides 802.11 set of attacks such as session hijacking and spoofed MAC standards for WLANs.
    [Show full text]
  • PDF with Notes
    Wireless Tools Training materials for wireless trainers This talk covers tools that will show you a great deal of information about wireless networks, including network discovery, data logging, security auditing, and spectrum analysis. Version 1.4 by Rob, @2009-11-23 Version 1.5 by Rob, @2010-02-28 Version 1.6 by Rob, @2010-03-12 Goals ‣ The goal of this talk is to provide an introduction to a few software tools that will help you to: ‣ monitor your WiFi network to identify problems ‣ perform security audits and prevent attacks ‣ observe the ongoing performance of your network and plan for future needs ‣ detect interference 2 Types of wireless tools ‣ Network ESSID scanners ‣ Wireless protocol analyzers ‣ Encryption cracking tools ‣ Wireless device auditing and management ‣ “War driving” tools: network mapping ‣ Spectrum analysis 3 Built-in wireless clients 4 If a computer has a wireless card, it has a basic network scanner. NetStumbler http://www.stumbler.net/ 5 NetStumbler was one of the first and most widely used WiFi detection tools. It runs only in Windows XP or Windows 2000, and works with many (but not all) wireless cards. NetStumbler can be used for mapping the coverage of your WiFi network, War Driving, rogue AP detection, aligning antennas on a long distance link, and more. NetStumbler is not open source, and was last updated in 2004. http://www.vistumbler.net/ 6 Vistumbler is an updated open source network detection tool for Windows Vista and Windows 7. It supports many of the same features as NetStumbler, including network detection and GPS integration. It also works with Google Earth to allow realtime WiFi mapping on a live map.
    [Show full text]
  • Opportunistic Keying As a Countermeasure to Pervasive Monitoring
    Opportunistic Keying as a Countermeasure to Pervasive Monitoring Stephen Kent BBN Technologies Abstract This document was prepared as part of the IETF response to concerns about “pervasive monitoring” (PM) [Farrell-pm]. It begins by exploring terminology that has been used in IETF standards (and in academic publications) to describe encryption and key management techniques, with a focus on authentication and anonymity. Based on this analysis, it propose a new term, “opportunistic keying” to describe a goal for IETF security protocols, in response to PM. It reviews key management mechanisms used in IETF security protocol standards, also with respect to these properties. The document explores possible impediments to and potential adverse effects associated with deployment and use of techniques that would increase the use of encryption, even when keys are distributed in an unauthenticated manner. 1. What’s in a Name (for Encryption)? Recent discussions in the IETF about pervasive monitoring (PM) have suggested a desire to increase use of encryption, even when the encrypted communication is unauthenticated. The term “opportunistic encryption” has been suggested as a term to describe key management techniques in which authenticated encryption is the preferred outcome, unauthenticated encryption is an acceptable fallback, and plaintext (unencrypted) communication is an undesirable (but perhaps necessary) result. This mode of operation differs from the options commonly offered by many IETF security protocols, in which authenticated, encrypted communication is the desired outcome, but plaintext communication is the fallback. The term opportunistic encryption (OE) was coined by Michael Richardson in “Opportunistic Encryption using the Internet Key Exchange (IKE)” an Informational RFC [RFC4322].
    [Show full text]
  • Server / Drone / Client Infrastructure[Edit] Kismet for Mac Keyboard
    Kismet For Mac Developer(s) Mike Kershaw (dragorn) Stable release 2020-04-R3[1] / May 2, 2020; 5 months ago Repository Written in C++ Operating system Cross-platform Type Packet Sniffer License GPL Website www.kismetwireless.net 1. Kismet For Mac Keyboard 2. Kismet For Mac Download 3. Kismet For Mac Os 4. Kismet For Mac Kismet is a network detector, packet sniffer, and intrusion detection system for 802.11wireless LANs. Kismet will work with any wireless card which supports raw monitoring mode, and can sniff 802.11a, 802.11b, 802.11g, and 802.11n traffic. The program runs under Linux, FreeBSD, NetBSD, OpenBSD, and Mac OS X. The client can also run on Microsoft Windows, although, aside from external drones (see below), there's only one supported wireless hardware available as packet source. Distributed under the GNU General Public License,[2] Kismet is free software. Features[edit] Traditional Lipsticks, Liquid Lipsticks, Matte Lipsticks, Lip Plumping Glosses, Lip Liners and More! Showing 1–21 of 70 results. Rated 5.00 out of 5. CEO Semi-Matte Lipstick $ 18.00 Add to cart. Yours Truly Semi-Matte Lipstick $ 18.00 Add to cart. Sweetie Semi- Matte Lipstick. Two files stored in the /etc/kismet directory called 'apmanuf' and 'clientmanuf' are used to help Kismet determine the types and manufacturers of AP or wireless clients based on MAC. KisMAC is an open-source and free sniffer/scanner application for Mac OS X. It has an advantage over MacStumbler / iStumbler / NetStumbler in that it uses monitor mode and passive scanning. Kismet differs from other wireless network detectors in working passively.
    [Show full text]
  • Software-Defined Networking: Improving Security for Enterprise and Home Networks
    Worcester Polytechnic Institute Digital WPI Doctoral Dissertations (All Dissertations, All Years) Electronic Theses and Dissertations 2017-04-24 Software-defined etN working: Improving Security for Enterprise and Home Networks Curtis Robin Taylor Worcester Polytechnic Institute Follow this and additional works at: https://digitalcommons.wpi.edu/etd-dissertations Repository Citation Taylor, C. R. (2017). Software-defined Networking: Improving Security for Enterprise and Home Networks. Retrieved from https://digitalcommons.wpi.edu/etd-dissertations/161 This dissertation is brought to you for free and open access by Digital WPI. It has been accepted for inclusion in Doctoral Dissertations (All Dissertations, All Years) by an authorized administrator of Digital WPI. For more information, please contact [email protected]. Software-defined Networking: Improving Security for Enterprise and Home Networks by Curtis R. Taylor A Dissertation Submitted to the Faculty of the WORCESTER POLYTECHNIC INSTITUTE In partial fulfillment of the requirements for the Degree of Doctor of Philosophy in Computer Science by May 2017 APPROVED: Professor Craig A. Shue, Dissertation Advisor Professor Craig E. Wills, Head of Department Professor Mark Claypool, Committee Member Professor Thomas Eisenbarth, Committee Member Doctor Nathanael Paul, External Committee Member Abstract In enterprise networks, all aspects of the network, such as placement of security devices and performance, must be carefully considered. Even with forethought, networks operators are ulti- mately unaware of intra-subnet traffic. The inability to monitor intra-subnet traffic leads to blind spots in the network where compromised hosts have unfettered access to the network for spreading and reconnaissance. While network security middleboxes help to address compromises, they are limited in only seeing a subset of all network traffic that traverses routed infrastructure, which is where middleboxes are frequently deployed.
    [Show full text]
  • How Can We Protect the Internet Against Surveillance?
    How can we protect the Internet against surveillance? Seven TODO items for users, web developers and protocol engineers Peter Eckersley [email protected] Okay, so everyone is spying on the Internet It's not just the NSA... Lots of governments are in this game! Not to mention the commerical malware industry These guys are fearsome, octopus-like adversaries Does this mean we should just give up? No. Reason 1: some people can't afford to give up Reason 2: there is a line we can hold vs. So, how do we get there? TODO #1 Users should maximise their own security Make sure your OS and browser are patched! Use encryption where you can! In your browser, install HTTPS Everywhere https://eff.org/https-everywhere For instant messaging, use OTR (easiest with Pidgin or Adium, but be aware of the exploit risk tradeoff) For confidential browsing, use the Tor Browser Bundle Other tools to consider: TextSecure for SMS PGP for email (UX is terrible!) SpiderOak etc for cloud storage Lots of new things in the pipeline TODO #2 Run an open wireless network! openwireless.org How to do this securely right now? Chain your WPA2 network on a router below your open one. TODO #3 Site operators... Deploy SSL/TLS/HTTPS DEPLOY IT CORRECTLY! This, miserably, is a lot harder than it should be TLS/SSL Authentication Apparently, ~52 countries These are usually specialist, narrowly targetted attacks (but that's several entire other talks... we're working on making HTTPS more secure, easier and saner!) In the mean time, here's what you need A valid certificate HTTPS by default Secure cookies No “mixed content” Perfect Forward Secrecy A well-tuned configuration How do I make HTTPS the default? Firefox and Chrome: redirect, set the HSTS header Safari and IE: sorry, you can't (!!!) What's a secure cookie? Go and check your site right now..
    [Show full text]
  • The Danger of the New Internet Choke Points
    The Danger of the New Internet Choke Points Authored by: Andrei Robachevsky, Christine Runnegar, Karen O’Donoghue and Mat Ford FEBRUARY 2014 Introduction The ongoing disclosures of pervasive surveillance of Internet users’ communications and data by national security agencies have prompted protocol designers, software and hardware vendors, as well as Internet service and content providers, to re-evaluate prevailing security and privacy threat models and to refocus on providing more effective security and confidentiality. At IETF88, there was consensus to address pervasive monitoring as an attack and to consider the pervasive attack threat model when designing a protocol. One area of work currently being pursued by the IETF is the viability of more widespread encryption. While there are some who believe that widely deployed encryption with strong authentication should be used extensively, many others believe that there are practical obstacles to this approach including a general lack of reasonable tools and user understanding as to how to use the technology, plus significant obstacles to scaling infrastructure and services using existing technologies. As a result, the discussion within the IETF has principally focused on opportunistic encryption and weak authentication. “Weak authentication” means cryptographically strong authentication between previously unknown parties without relying on trusted third parties. In certain contexts, and by using certain techniques, one can achieve the desired level of security (see, for instance, Arkko, Nikander. Weak Authentication: How to Authenticate Unknown Principals without Trusted Parties, Security Protocols Workshop, volume 2845 of Lecture Notes in Computer Science, page 5-19. Springer, (2002)). “Opportunistic encryption” refers to encryption without authentication. It is a mode of protocol operation where the content of the communication is secure against passive surveillance, but there is no guarantee that the endpoints are reliably identified.
    [Show full text]
  • Wireless Evolution •..••••.•.•...•....•.•..•.•••••••...••••••.•••.••••••.••.•.••.••••••• 4
    Department of Justice ,"'''''''''<11 Bureau of Investigation ,Operational Technology Division WIRELESS EVDLUTIDN IN THIS Iselil-it:: .. WIRELESS EVOLUTIDN I!I TECH BYTES • LONG TERM EVOLUTIQN ill CLDUD SERVICES • 4G TECHNOLOGY ill GESTURE-RECOGNITION • FCC ON BROADBAND • ACTIVITY-BASED NAVIGATION 'aw PUIi! I' -. q f. 8tH'-.1 Waa 8RI,. (!.EIi/RiW81 R.d-nl)) - 11 - I! .el " Ij MESSAGE FROM MANAGEMENT b7E he bou~~aries of technology are constantly expanding. develop technical tools to combat threats along the Southwest Recognizing the pathway of emerging technology is Border. a key element to maintaining relevance in a rapidly changing technological environment. While this The customer-centric approach calls for a high degree of T collaboration among engineers, subject matter experts (SMEs), proficiency is fundamentally important in developing strategies that preserve long-term capabilities in the face of emerging and the investigator to determine needs and requirements. technologies, equally important is delivering technical solutions To encourage innovation, the technologists gain a better to meet the operational needs of the law enforcement understanding of the operational and investigative needs customer in a dynamic 'threat' environment. How can technical and tailor the technology to fit the end user's challenges. law enforcement organizations maintain the steady-state Rather than developing solutions from scratch, the customer­ production of tools and expertise for technical collection, while centric approach leverages and modifies the technoloe:v to infusing ideas and agility into our organizations to improve our fit the customer's nFlFlrt~.1 ability to deliver timely, relevant, and cutting edge tools to law enforcement customers? Balancing these two fundamentals through an effective business strategy is both a challenge and an opportunity for the Federal Bureau of Investigation (FBI) and other Federal, state, and local law enforcement agencies.
    [Show full text]
  • Wireless Networks Security in Jordan: a Field Study
    International Journal of Network Security & Its Applications (IJNSA), Vol.5, No.4, July 2013 Wireless Networks Security in Jordan: A Field Study Ahmad S. Mashhour1&Zakaria Saleh2 1IS Dept, University of Bahrain [email protected] 2MIS Dept, Yarmouk University, Jordan [email protected] ABSTRACT The potential of wireless communications, has resulted in a wide expand of wireless networks. However, the vulnerabilities and threats that wireless networks are subjectedto resulted in higher risk for unauthorized users to access the computer networks.This research evaluates the deployed Wireless Network in Jordan as well as the use of the security setting of the systems and equipment used. Caution will be taken to avoid network access as only existence of the network is sought. Wardriving involve the use of freeware tools such as NetStumbler, or Kismet, which was originally developed to be used for helping network administrators make their systems more secure. Thestudy is carried out through field evaluation of the Wireless Local Area Network (WLAN)in light of the use of Wardriving, and proposessome measures that can be taken to improve securityof the wireless network by the users. KEY WORDS Security, Wardriving, Wireless Local Area Network (WLAN), Wired Equivalent Privacy (WEP). 1. INTRODUCTION Wireless networks have evolved rapidly in the last few years due to the developments of new wireless standards and cost-effective wireless hardware. This has led to widespread adoption of the technology in home and small businesses. With the growth of wireless networking, security is the main weakness of the whole wireless system, which resulted in improper uses of network resources.
    [Show full text]
  • Applied Crypto Hardening
    Applied Crypto Hardening Wolfgang Breyha, David Durvaux, Tobias Dussa, L. Aaron Kaplan, Florian Mendel, Christian Mock, Manuel Koschuch, Adi Kriegisch, Ulrich Pöschl, Ramin Sabet, Berg San, Ralf Schlatterbeck, Thomas Schreck, Alexander Würstlein, Aaron Zauner, Pepi Zawodsky (University of Vienna, CERT.be, KIT-CERT, CERT.at, A-SIT/IAIK, coretec.at,FH Campus Wien, VRVis, MilCERT Austria, A-Trust, Runtux.com,Friedrich-Alexander University Erlangen-Nuremberg, azet.org, maclemon.at) April 25, 2017 Contents 1. Abstract 5 1.1. Acknowledgements ........................................ 6 2. Introduction 8 2.1. Audience .............................................. 8 2.2. Related publications ........................................ 8 2.3. How to read this guide ....................................... 8 2.4. Disclaimer and scope ........................................ 9 2.4.1. Scope ............................................ 10 2.5. Methods ............................................... 11 3. Practical recommendations 12 3.1. Webservers ............................................. 12 3.1.1. Apache ........................................... 12 3.1.2. lighttpd ........................................... 13 3.1.3. nginx ............................................ 14 3.1.4. Cherokee .......................................... 15 3.1.5. MS IIS ............................................ 17 3.2. SSH ................................................. 20 3.2.1. OpenSSH .......................................... 20 3.2.2. Cisco ASA .........................................
    [Show full text]
  • M 3 AAWG Describes Costs Associated with Using Crypto
    Messaging, Malware and Mobile Anti-Abuse Working Group M3AAWG Describes Costs Associated with Using Crypto March 2017 The reference URL for this document: www.m3aawg.org/Crypto-Costs I. Introduction Deploying opportunistic encryption as described in TLS for Mail: M3AAWG Initial Recommendations is an excellent way to start protecting email traffic between providers. Using Forward Secrecy to Secure Data is a further step providers can take. Forward secrecy ensures that encrypted traffic can never be decrypted, even if the relevant private keys are somehow eventually obtained. However, most everything, including cryptographic secrecy and privacy, comes at a cost. This document describes the budget and other costs associated with using cryptography to help the reader make an informed decision about what to do, or not do, when faced with the need to deploy encryption. II. When Needed, Content based Spam and Malware Filtering Should Be Done On-System, Not Passively On-Network Links While encryption protects against unwanted eavesdropping or tampering, it also precludes passive network monitoring1 for beneficial purposes, such as blocking spam or filtering malware. Traffic inspection is still possible; however, it just needs to be done on the endpoints before the traffic gets encrypted or after the traffic gets decrypted. In thinking about opportunities to do traffic inspection, it is important to distinguish between two cases: 1. Hop-by Hop Encryption In the hop-by-hop encryption case (for example, opportunistic SSL/TLS for SMTP2), traffic is encrypted and then decrypted for each hop (e.g., each link in the delivery chain). As a result, there are opportunities for filtering, and unfortunately, for eavesdropping or tampering at each intervening node.
    [Show full text]
  • Applied Crypto Hardening
    DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan Applied Crypto HarDENING WOLFGANG BrEyha, David Durvaux, TOBIAS Dussa, L. AarON Kaplan, Florian Mendel, Christian Mock, Manuel Koschuch, Adi Kriegisch, Ulrich Pöschl, Ramin Sabet, BerG San, Ralf Schlatterbeck, Thomas Schreck, AarON Zauner, Pepi Zawodsky (University OF Vienna, CERT.be, KIT-CERT, CERT.at, A-SIT/IAIK, CORetec.at, FH Campus Wien, VRVis, MilCERT Austria, A-Trust, Runtux.com, Friedrich-AleXANDER University Erlangen-NurEMBERg, azet.org, maclemon.at) January 13, 2014 DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan Do NOT TALK UNENCRYPTED Applied Crypto HarDENING • DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan PAGE 2 OF 81 DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan AcknoWLEDGEMENTS WE WOULD LIKE TO EXPRESS OUR THANKS TO THE FOLLOWING REVIEWERS AND PEOPLE WHO HAVE GENEROUSLY OffERED THEIR TIME AND INTEREST (in ALPHABETICAL ORder): BrOwn, Scott Millauer, TOBIAS Brulebois, Cyril O’Brien, Hugh Dirksen-Thedens, Mathis Pacher, Christoph DulaunoY, AleXANDRE Palfrader, Peter Gühring Philipp Pape, TOBIAS (layout) Grigg, IAN Petukhova, Anna (Logo) Horenbeck, Maarten Pichler, Patrick Huebl, AxEL Roeckx, Kurt Kovacic, Daniel Seidl, Eva (PDF layout) Lenzhofer, Stefan Wagner, Sebastian (“SEBIX”) Lorünser, Thomas Zangerl, AleXANDER The REVIEWERS DID REVIEW PARTS OF THE DOCUMENT IN THEIR AREA OF Expertise; ALL REMAINING ERRORS IN THIS DOCUMENT ARE THE SOLE RESPONSIBILITY OF THE PRIMARY authors. Applied Crypto HarDENING • DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan PAGE 3 OF 81 DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan DrAFT REvision: ea089c8 (2014-01-11 22:11:44 +0100) AarON Kaplan AbstrACT “Unfortunately, THE COMPUTER SECURITY AND CRYPTOLOGY COMMUNITIES HAVE DRIFTED APART OVER THE LAST 25 years.
    [Show full text]