DOCSLIB.ORG

Security Monitoring for Network Protocols and Applications Vinh Hoa La

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security Monitoring for Network Protocols and Applications Vinh Hoa La Security monitoring for network protocols and applications Vinh Hoa La To cite this version: Vinh Hoa La. Security monitoring for network protocols and applications. Networking and Internet Architecture [cs.NI]. Université Paris-Saclay, 2016. English. NNT : 2016SACLL006. tel-01782396 HAL Id: tel-01782396 https://tel.archives-ouvertes.fr/tel-01782396 Submitted on 2 May 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. 1176$&// 7+(6('('2&725$7 '( /¶81,9(56,7(3$5,66$&/$< 35(3$5(($ 7(/(&2068'3$5,6 e&2/('2&725$/(1 6FLHQFHVHW7HFKQRORJLHVGHO ,QIRUPDWLRQHWGHOD&RPPXQLFDWLRQ 67,& 6SpFLDOLWpGHGRFWRUDW,QIRUPDWLTXH 3DU 09LQK+RD/D 6HFXULW\0RQLWRULQJIRU1HWZRUN3URWRFROVDQG $SSOLFDWLRQV 7KqVHSUpVHQWpHHWVRXWHQXHj(YU\OHRFWREUH &RPSRVLWLRQGX-XU\ 0)DULG1$,7$%'(66(/$03URIHVVHXU8QLYHUVLWp3DULV'HVFDUWHV 3DULV9 5DSSRUWHXU 00DUFHOR',$6'($025,0'LUHFWHXUGHUHFKHUFKH&156/,3830&5DSSRUWHXU 03DWULFN6(1$&3URIHVVHXU(1$&±7RXORXVH([DPLQDWHXU 0PH)DWLKD=$,',0DvWUHGH&RQIpUHQFHV+'58QLYHUVLWp3DULV6XG([DPLQDWULFH 0$GULHQ%(&8+HDGRI5HVHDUFK 7HFKQRORJ\$LUEXV'6&\EHUVHFXULW\([DPLQDWHXU 0:LVVDP0$//28/,'U,QJpQLHXUGHUHFKHUFKH0RQWLPDJH([DPLQDWHXU 0PH$QD5RVD&$9$//,3URIHVVHXU7HOHFRP6XG3DULV'LUHFWHXUGHWKqVH Titre : Monitorage des Aspects Sécuritaires pour les Protocoles de Réseaux et Applications. Mots clés : sécurité, détection d'intrusion, surveillance de sécurité, supervision de réseaux Résumé : La sécurité informatique, aussi applications. Nous proposons également des connue comme la cyber-sécurité, est toujours approches innovantes fondées sur un sujet d'actualité dans la recherche en l'apprentissage supervisé pour prétraiter et sciences informatiques. Comme les cyber- analyser l'entrée de données. Notre cadre est attaques grandissent de plus en plus en volume validé dans une large gamme de cas d’études, y et en sophistication, la protection des systèmes compris la surveillance des réseaux ou réseaux d'information devient une tâche traditionnels TCP / IP (v4) (LAN, WAN, la difficile. Les chercheurs dans la communauté surveillance de l'Internet), la supervision des de recherche prêtent une attention constante à réseaux de objets connectés utilisant la la sécurité, en particulier dans les deux technologie 6LoWPAN (IPv6), et également directions suivantes: (i) - la conception des l’analyse des logs d'autres applications. infrastructures sécurisée avec des protocoles de Dans chaque cas d’étude, nous décrivons communication sécurisés et (ii) - surveillance / comment nous collectons les jeux de données supervision des systèmes ou des réseaux afin de d'audit, extrayons les attributs pertinents, trouver et de remédier aux vulnérabilités. La traitons les données reçues et décodons leur dernière vérifie que tout ce qui a été conçu dans signification de sécurité. Pour ces objectifs, la première fonctionne correctement et en toute l’outil Montimage Monitoring Tool (MMT) est sécurité. Ceci étant le sujet principal de cette utilisé comme le cœur de notre approche. Nous thèse. évaluons également la performance de la Cette dissertation présente un cadre de solution et sa possibilité de marcher dans les surveillance de la sécurité en tenant en compte systèmes "à plus grande échelle" avec les jeux des différents types de jeu de données d'audit y de données plus volumineux. compris le trafic de réseaux et les logs dans les Title : Security Monitoring for Network Protocols and Applications. Keywords : security, intrusion detection, security monitoring, network monitoring Abstract: Computer security, also known as framework that takes into consideration cyber-security or IT security is always an different types of audit data set including emerging topic in computer science research. network traffic and applications’ exchanged Because cyber-attacks are growing in both messages. We propose also some novel volume and sophistication, protecting approaches based on supervised machine information systems or networks becomes a learning to pre-process and analyze the data difficult task. People in research community input. Our framework is validated in a wide give an ongoing attention in security including range of case studies including traditional two main directions: (i) - designing secured TCP/IP(v4) network monitoring (LAN, WAN, infrastructures with secured communication Internet monitoring), Internet of Things (IoT) protocols and (ii) - monitoring/supervising the using 6LoWPAN technology (IPv6), and other systems or networks in order to find and applications' logs. In each case study, we remediate vulnerabilities. The former can assist describe how we collect the audit data set, the later by forming some additional extract the relevant attributes, handle received monitoring-supporting modules. Whilst, the data and decode their security meaning. For later verifies whether everything designed in these goals, Montimage Monitoring Tool the former is correctly and securely (MMT) is used as the core of our approach. We functioning. This is the main topic of this assess also the solution's performance and its thesis. possibility to work in “larger scale" systems This dissertation presents a security monitoring with more voluminous datasets. Université Paris-Saclay Espace Technologique / Immeuble Discovery Route de l’Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France Abstract Computer security, also known as cyber-security or IT security, is always an emerging topic in computer science research. Because cyber attacks are growing in both volume and sophis- tication, protecting information systems or networks becomes a difficult task. Therefore, researchers in research community give an ongoing attention in security including two main directions: (i) - designing secured infrastructures with secured communication protocols and (ii) - monitoring/supervising the systems or networks in order to find and re-mediate vul- nerabilities. The former assists the later by forming some additional monitoring-supporting modules. Whilst, the later verifies whether everything designed in the former is correctly and securely functioning as well as detecting security violations. This is the main topic of this thesis. This dissertation presents a security monitoring framework that takes into consideration different types of audit dataset including network traffic and application logs. We propose also some novel approaches based on supervised machine learning to pre-process and ana- lyze the data input. Our framework is validated in a wide range of case studies including traditional TCP/IPv4 network monitoring (LAN, WAN, Internet monitoring), IoT/WSN using 6LoWPAN technology (IPv6), and other applications' logs. Last but not least, we provide a study regarding intrusion tolerance by design and propose an emulation-based approach to simultaneously detect and tolerate intrusion. In each case study, we describe how we collect the audit dataset, extract the relevant attributes, handle received data and decode their security meaning. For these goals, the tool Montimage Monitoring Tool (MMT) is used as the core of our approach. We assess also the solution's performance and its possibility to work in \larger scale" systems with more voluminous dataset. R´esum´e La s´ecurit´e informatique, aussi connue comme la cyber-s´ecurit´e, est toujours un sujet d'actualit´edans la recherche en sciences informatiques. Comme les cyber-attaques gran- dissent de plus en plus en volume et en sophistication, la protection des syst`emesou r´eseaux d'information devient une t^ache difficile. Les chercheurs dans la communaut´ede recherche pr^etent une attention constante `ala s´ecurit´e,en particulier ils s'orientent vers deux direc- tions principales: (i) - la conception des infrastructures s´ecuris´eesavec des protocoles de communication s´ecuris´eset (ii) - surveillance / supervision des syst`emesou des r´eseauxafin de trouver et de rem´edierdes vuln´erabilit´es.La derni`erev´erifieque tout ce qui a ´et´econ¸cu dans la premi`erefonctionne correctement et en toute s´ecurit´e,ainsi d´etectant les violations de s´ecurit´e.Ceci ´etant le sujet principal de cette th`ese. Cette dissertation pr´esente un cadre de surveillance de la s´ecurit´een tenant en compte des diff´erents types de jeu de donn´eesd'audit y compris le trafic de r´eseaux et les messages ´echang´esdans les applications. Nous proposons ´egalement des approches innovantes fond´ees sur l'apprentissage statistique, la th´eoriede l'information et de l'apprentissage automatique pour pr´etraiteret analyser l'entr´eede donn´ees.Notre cadre est valid´edans une large gamme des ´etudesde cas, y compris la surveillance des r´eseauxtraditionnels TCP / IP (v4) (LAN, WAN, la surveillance de l'Internet), la supervision des r´eseauxde objets connect´esutilisant la technologie 6LoWPAN (IPv6), et ´egalement, l'analyse des logs d'autres applications. Enfin, nous fournissons une ´etudesur la tol´eranced'intrusion par conception et proposons une approche bas´eesur l'´emulation pour d´etecteret tol´erer l'intrusion simultan´ement. Dans chaque ´etudede cas, nous d´ecrivons comment nous collectons les
Load more

Recommended publications
  • Introduction to RAW-Sockets Jens Heuschkel, Tobias Hofmann, Thorsten Hollstein, Joel Kuepper
    Introduction to RAW-sockets Jens Heuschkel, Tobias Hofmann, Thorsten Hollstein, Joel Kuepper 16.05.2017 Technical Report No. TUD-CS-2017-0111 Technische Universität Darmstadt Telecooperation Report No. TR-19, The Technical Reports Series of the TK Research Division, TU Darmstadt ISSN 1864-0516 http://www.tk.informatik.tu-darmstadt.de/de/publications/ Introduction to RAW-sockets by Heuschkel, Jens Hofmann, Tobias Hollstein, Thorsten Kuepper, Joel May 17, 2017 Abstract This document is intended to give an introduction into the programming with RAW-sockets and the related PACKET-sockets. RAW-sockets are an additional type of Internet socket available in addition to the well known DATAGRAM- and STREAM-sockets. They do allow the user to see and manipulate the information used for transmitting the data instead of hiding these details, like it is the case with the usually used STREAM- or DATAGRAM sockets. To give the reader an introduction into the subject we will first give an overview about the different APIs provided by Windows, Linux and Unix (FreeBSD, Mac OS X) and additional libraries that can be used OS-independent. In the next section we show general problems that have to be addressed by the programmer when working with RAW-sockets. We will then provide an introduction into the steps necessary to use the APIs or libraries, which functionality the different concepts provide to the programmer and what they provide to simplify using RAW and PACKET-sockets. This section includes examples of how to use the different functions provided by the APIs. Finally in the additional material we will give some complete examples that show the concepts and can be used as a basis to write own programs.
    [Show full text]
  • Detecting Packet Injection a Guide to Observing Packet Spoofing by Isps
    Detecting Packet Injection A GUidE TO OBSERVING PACKET SPOOFING BY ISPs By Seth Schoen [email protected] ELECTRONIC FRONTIER FOUNDATION eff.org Version .0 November 28, 2007 Detecting Packet Injection: A Guide To Observing Packet Spoofing by ISPs Introduction Certain Internet service providers have begun to interfere with their users’ communications by injecting forged or spoofed packets – data that appears to come from the other end but was actually generated by an Internet service provider (ISP) in the middle. This spoofing is one means (although not the only means) of blocking, jamming, or degrading users’ ability to use particular applications, services, or protocols. One important means of holding ISPs account- able for this interference is the ability of some subscribers to detect and document it reliably. We have to learn what ISPs are doing before we can try to do something about it. Internet users can often detect interference by comparing data sent at one end with data received at the other end of a connection. Techniques like these were used by EFF and the Associated Press to produce clear evidence that Comcast was deliberately interfering with file sharing applications; they have also been used to document censorship by the Great Firewall of China.1 In each of these cases, an in- termediary was caught injecting TCP reset packets that caused a communication to hang up – even though the communicating parties actually wanted to continue talking to one another. In this document, we describe how to use a network analyzer like Wireshark to run an experi- ment with a friend and detect behavior like this.
    [Show full text]
  • Steelcentral Packet Analyzer Reference Manual, Personal Edition
    SteelCentral Packet Analyzer Reference Manual Personal Edition Version 10.9 October 2015 © 2015 Riverbed Technology. All rights reserved. Riverbed®, SteelApp™, SteelCentral™, SteelFusion™, SteelHead™, SteelScript™, SteelStore™, Steelhead®, Cloud Steelhead®, Virtual Steelhead®, Granite™, Interceptor®, Stingray™, Whitewater®, WWOS™, RiOS®, Think Fast®, AirPcap®, BlockStream™, FlyScript™, SkipWare®, TrafficScript®, TurboCap®, WinPcap®, Mazu®, OPNET®, and Cascade® are all trademarks or registered trademarks of Riverbed Technology, Inc. (Riverbed) in the United States and other countries. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein cannot be used without the prior written consent of Riverbed or their respective owners. F5, the F5 logo, iControl, iRules, and BIG-IP are registered trademarks or trademarks of F5 Networks, Inc. in the U.S. and certain other countries. Linux is a trademark of Linus Torvalds in the United States and in other countries. VMware, ESX, ESXi are trademarks or registered trademarks of VMware, Incorporated in the United States and in other countries. Portions of SteelCentral™ products contain copyrighted information of third parties. Title thereto is retained, and all rights therein are reserved, by the respective copyright owner. PostgreSQL is (1) Copyright © 1996-2009 The PostgreSQL Development Group, and (2) Copyright © 1994-1996 the Regents of the University
    [Show full text]
  • Ethical Hacking of a Smart Plug
    DEGREE PROJECT IN TECHNOLOGY, FIRST CYCLE, 15 CREDITS Stockholm, Sweden 2021 Ethical Hacking of a Smart Plug RAMI ACHKOUDIR ZAINAB ALSAADI 2 Ethical Hacking of a Smart Plug RAMI ACHKOUDIR ZAINAB ALSAADI Bachelor in Computer Science First Cycle, 15 Credits Supervisor: Pontus Johnson Examiner: Robert Lagerström School of Electrical Engineering and Computer Science 3 4 Abstract The number of Internet of Things (IoT) devices is growing rapidly which introduces plenty of new challenges concerning the security of these devices. This thesis aims to contribute to a more sustainable IoT environment by evaluating the security of a smart plug. The DREAD and STRIDE methods were used to assess the potential threats and the threats with the highest potential impact were penetration tested in order to test if there were any security preventions in place. The results from the penetration tests presented no major vulnerabilities which bring us to the conclusion that the Nedis Smart Plug has implemented enough security measures. Keywords - Internet of Things, IoT, penetration test, ethical hacking, IoT ​ ​ security, threat model 5 Sammanfattning Antalet Internet of Things (IoT) -enheter växer snabbt vilket medför många nya utmaningar när det gäller säkerheten för dessa enheter. Denna avhandling syftar till att bidra till en mer hållbar IoT-miljö genom att utvärdera säkerheten för en smart plug. Metoderna DREAD och STRIDE användes för att bedöma de potentiella hoten och hoten med störst potentiell påverkan penetrerades för att testa om det fanns några säkerhetsförebyggande åtgärder. Resultaten från penetrationstesterna presenterade inga större sårbarheter som ledde oss till slutsatsen att Nedis Smart Plug har genomfört tillräckliga säkerhetsåtgärder.
    [Show full text]
  • Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation
    Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation Mathy Vanhoef New York University Abu Dhabi [email protected] Abstract These issues were discovered by analyzing open source Wi-Fi In this paper, we present three design flaws in the 802.11 stacks and systematically inspecting the 802.11 standard. Our standard that underpins Wi-Fi. One design flaw is in the frame results affect all protected Wi-Fi networks, including old net- aggregation functionality, and another two are in the frame works using Wired Equivalent Privacy (WEP), up to and in- fragmentation functionality. These design flaws enable an cluding the latest Wi-Fi Protected Access 3 (WPA3). Since adversary to forge encrypted frames in various ways, which in even WEP is affected, this implies the root cause of several turn enables exfiltration of sensitive data. We also discovered design flaws has been part of Wi-Fi since its release in 1997. common implementation flaws related to aggregation and Equally worrisome is that every single device we tested was fragmentation, which further worsen the impact of our attacks. vulnerable to at least one of our attacks. Our results affect all protected Wi-Fi networks, ranging from The most trivial design flaw is in 802.11’s frame aggrega- WEP all the way to WPA3, meaning the discovered flaws tion functionality: by flipping an unauthenticated flag in the have been part of Wi-Fi since its release in 1997. In our header of a frame, the encrypted payload will be parsed as experiments, all devices were vulnerable to one or more of our containing one or more aggregated frames instead of a nor- attacks, confirming that all Wi-Fi devices are likely affected.
    [Show full text]
  • Lecture 16: TCP/IP Vulnerabilities and Dos Attacks: IP Spoofing, SYN Flooding, and the Shrew Dos Attack
    Lecture 16: TCP/IP Vulnerabilities and DoS Attacks: IP Spoofing, SYN Flooding, and The Shrew DoS Attack Lecture Notes on “Computer and Network Security” by Avi Kak ([email protected]) March 16, 2021 5:43pm ©2021 Avinash Kak, Purdue University Goals: • To review the IP and TCP packet headers • Controlling TCP Traffic Congestion and the Shrew DoS Attack • The TCP SYN Flood Attack for Denial of Service • IP Source Address Spoofing Attacks • BCP 38 for Thwarting IP Address Spoofing for DoS Attacks • Python and Perl Scripts for Mounting DoS Attacks with IP Address Spoofing and SYN Flooding • Troubleshooting Networks with the Netstat Utility CONTENTS Section Title Page 16.1 TCP and IP 3 16.2 The TCP/IP Protocol Stack 5 16.3 The Network Layer (also known as the Internet 14 Layer or the IP Layer) 16.4 TCP, The Transport Layer Protocol for Reliable 25 Communications 16.5 TCP versus IP 34 16.6 How TCP Breaks Up a Byte Stream That 36 Needs to be Sent to a Receiver 16.7 The TCP State Transition Diagram 38 16.8 A Demonstration of the 3-Way Handshake 44 16.9 Splitting the Handshake for Establishing 52 a TCP Connection 16.10 TCP Timers 58 16.11 TCP Congestion Control and the Shrew DoS Attack 60 16.12 SYN Flooding 68 16.13 IP Source Address Spoofing for SYN Flood 71 DoS Attacks 16.14 Thwarting IP Source Address Spoofing With BCP 38 84 16.15 Demonstrating DoS through IP Address Spoofing and 89 SYN Flooding When The Attacking and The Attacked Hosts Are in The Same LAN 16.16 Using the Netstat Utility for Troubleshooting 103 Networks 16.17 Homework Problems 113 Computer and Network Security by Avi Kak Lecture 16 Back to TOC 16.1 TCP and IP • We now live in a world in which the acronyms TCP and IP are almost as familiar as some other computer-related words like bits, bytes, megabytes, etc.
    [Show full text]
  • Hack Instagram Using John the Ripper Hack Instagram Using John the Ripper
    hack instagram using john the ripper Hack instagram using john the ripper. - The Best Working Methods of 2020. On this page you will find the other methods except InstaRipper which are used to hack Instagram accounts. Of course, InstaRipper is not the only way to make access inside an Instagram profile successfully. And today we are going to explain the each of working methods in detailed step by step tutorial. The methods are gathered from leading & most reliable hacking related blogs and forums. All are checked and tested before we decided to add them to the list. So, make yourself comfortable and focused for reading because here we go! Method #1 - Using a Keylogger (The Best Method) Since Instagram is visited by users in 99% cases from smartphones & tablets (comparing to desktop computers), we are going to talk about a mobile keylogger here. What is a keylogger? It's an application made to monitor keystrokes on a certain device and store it inside a logs documents or automatically send it to a server or email address of the keylogger's administrator. This means that if you install a keylogger app on someone’s mobile phone, you can spy on everything they typed on their keyboard when they are texting with someone from any messaging app (Facebook, Instagram, SMS, WhatsApp, any other!). Everything what they typed anywhere inside their cellphone from the moment a keylogger is installed on their device will be sent to your keylogger's account or your email address. But the THING with a keylogger is, How to Install it on someone’s phone without being noticed? After a keylogger is installed and running on device, it can't be noticed because its process is running in a background of operating system, and it will auto-run itself every time a device is turned on.
    [Show full text]
  • Intrusion Detection System of Industrial Control Networks Using Network Telemetry Stanislav Ponomarev Louisiana Tech University
    Louisiana Tech University Louisiana Tech Digital Commons Doctoral Dissertations Graduate School Summer 2015 Intrusion Detection System of industrial control networks using network telemetry Stanislav Ponomarev Louisiana Tech University Follow this and additional works at: https://digitalcommons.latech.edu/dissertations Part of the Computer Sciences Commons, Electrical and Computer Engineering Commons, and the Language and Literacy Education Commons Recommended Citation Ponomarev, Stanislav, "" (2015). Dissertation. 199. https://digitalcommons.latech.edu/dissertations/199 This Dissertation is brought to you for free and open access by the Graduate School at Louisiana Tech Digital Commons. It has been accepted for inclusion in Doctoral Dissertations by an authorized administrator of Louisiana Tech Digital Commons. For more information, please contact [email protected]. INTRUSION DETECTION SYSTEM OF INDUSTRIAL CONTROL NETWORKS USING NETWORK TELEMETRY. by Stanislav Ponomarev, B.S., M.S. A Dissertation Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy COLLEGE OF ENGINEERING AND SCIENCE LOUISIANA TECH UNIVERSITY August 2015 ProQuest Number: 3664531 All rights reserved INFORMATION TO ALL USERS The quality of this reproduction is dependent upon the quality of the copy submitted. In the unlikely event that the author did not send a complete manuscript and there are missing pages, these will be noted. Also, if material had to be removed, a note will indicate the deletion. ProQuestQue ProQuest 3664531 Published by ProQuest LLC(2015). Copyright of the Dissertation is held by the Author. All rights reserved. This work is protected against unauthorized copying under Title 17, United States Code. Microform Edition © ProQuest LLC. ProQuest LLC 789 East Eisenhower Parkway P.O.
    [Show full text]
  • Recent Advances in Reliable Transport Protocols∗
    Recent Advances in Reliable Transport Protocols∗ Costin Raiciu, Janardhan Iyengar, Olivier Bonaventure Abstract Transport protocols play a critical role in today’s Internet. This chapter first looks at the recent of the reliable transport protocols. It then explains the growing impact of middleboxes on the evolvability of these protocols. Two recent protocol extensions, Multipath TCP and Minion, which were both designed to extend the current Transport Layer in the Internet are then described. 1 Introduction The first computer networks often used ad-hoc and proprietary protocols to interconnect different hosts. During the 1970s and 1980s, the architecture of many of these networks evolved towards a layered architec- ture. The two most popular ones are the seven-layer OSI reference model [119] and the five-layer Internet architecture [27]. In these architectures, the transport layer plays a key role. It enables applications to re- liably exchange data. A transport protocol can be characterized by the service that it provides to the upper layer (usually the application). Several transport services have been defined: • a connectionless service • a connection-oriented bytestream service • a connection-oriented message-oriented service • a message-oriented request-response service • an unreliable delivery service for multimedia applications The connectionless service is the simplest service that can be provided by a transport layer protocol. The User Datagram Protocol (UDP) [87] is an example of a protocol that provides this service. Over the years, the connection-oriented bytestream service has proven to be the transport layer service used by most applications. This service is currently provided by the Transmission Control Protocol (TCP) [89] in the Internet.
    [Show full text]
  • Bypassing Firewalls and Nats by Exploiting Packet-In-Packet Attacks in Ethernet
    Bypassing Firewalls and NATs By Exploiting Packet-in-Packet Attacks in Ethernet Ben Seri, Gregory Vishnepolsky and Yevgeny Yusepovsky Introduction 4 Who we are 5 Motivation for bypassing NATs/Firewalls 6 Packet-in-Packet attacks in wireless protocols 6 Packet-in-Packet attack in Ethernet 8 Ethernet PHYs 8 Ethernet PHY/MAC Interface (MII) 9 MAC layer framing 9 Packet-in-Packet data flow 10 Calculating the CRC complement 12 Possible attack payloads 12 IPv6 Router Advertisement 13 IPv6 mapped IPv4 addresses 14 Search domain and WPAD on windows 14 Bit errors in Ethernet cables? 15 Bit-error-rate in Ethernet cables - Survey results 15 Querying Ethernet statistics from Cisco switches 16 1-click Attack Scenario 16 Physical layer of Ethernet 18 Shielding 18 Types of Ethernet cables 19 Differential noise margin 20 Possible reasons for bit errors in an Ethernet cable 20 Excessive attenuation 21 Impedance mismatch influence on the signal propagation 21 EMI susceptibility 21 Crosstalk 22 Excessive EMI 22 Cable measurements setup 22 Detecting cabling faults with a tester 23 Lab reproduction of cabling faults 24 The crosstalk model 25 EtherOops – ©2020 ARMIS, INC. – 2 TECHNICAL WHITE PAPER ​ ​ ​ ​ ​ The short model 26 Model scenario for cables connected in series 28 Primitives for a 0-click attack 29 Spoofing IPv4 source addresses on the Internet 29 Google DNS 4-tuples 30 Alternative method: ICMP errors 31 Finding MAC addresses 32 Discovering MACs from Wi-Fi monitor mode 33 Discovering allowed traffic through the firewall using WiFi sniffing 34 Proximity attack using an EMP device 35 Prior research on “EMP simulation” devices 35 Wideband interference generation using a spark-gap radio transmitter 36 Attack model and experimental setup 39 EMP pulse measurements 41 Conclusion 44 EtherOops – ©2020 ARMIS, INC.
    [Show full text]
  • Generating Datasets Through the Introduction of an Attack Agent in A
    Linköping University | Department of Computer and Information Science Master’s thesis, 30 ECTS | Datateknik 2021 | LIU-IDA/LITH-EX-A--2021/013--SE Generating Datasets Through the Introduction of an Attack Agent in a SCADA Testbed – A methodology of creating datasets for intrusion detection re- search in a SCADA system using IEC-60870-5-104 Hur en SCADA testmiljö med IEC-60870-5-104 protokollet un- der attack kan skapa data att använda för nätverksbaserade in- trångdetekteringssystem August Fundin Supervisor : Chih-Yuan Lin Examiner : Simin Nadjm-Tehrani Linköpings universitet SE–581 83 Linköping +46 13 28 10 00 , www.liu.se Upphovsrätt Detta dokument hålls tillgängligt på Internet - eller dess framtida ersättare - under 25 år från publicer- ingsdatum under förutsättning att inga extraordinära omständigheter uppstår. Tillgång till dokumentet innebär tillstånd för var och en att läsa, ladda ner, skriva ut enstaka kopior för enskilt bruk och att använda det oförändrat för ickekommersiell forskning och för undervisning. Över- föring av upphovsrätten vid en senare tidpunkt kan inte upphäva detta tillstånd. All annan användning av dokumentet kräver upphovsmannens medgivande. För att garantera äktheten, säkerheten och till- gängligheten finns lösningar av teknisk och administrativ art. Upphovsmannens ideella rätt innefattar rätt att bli nämnd som upphovsman i den omfattning som god sed kräver vid användning av dokumentet på ovan beskrivna sätt samt skydd mot att dokumentet än- dras eller presenteras i sådan form eller i sådant sammanhang som är kränkande för upphovsmannens litterära eller konstnärliga anseende eller egenart. För ytterligare information om Linköping University Electronic Press se förlagets hemsida http://www.ep.liu.se/.
    [Show full text]
  • Analysis of Web Protocols Evolution on Internet Traffic
    UNIVERSIDADE DA BEIRA INTERIOR Engenharia Analysis of Web Protocols Evolution on Internet Traffic Karikari Abina Mary Dissertação para obtenção do Grau de Mestre em Engenharia Informática (2º ciclo de estudos)) Orientador: Prof. Nuno M. Garcia Covilhã, Junho de 2014 Analysis of web protocols evolution on Internet traffic ii Analysis of web protocols evolution on Internet traffic Acknowledgements First and foremost, I want to express my sincere gratitude to the Almighty God, for his protection, strength and support. Him alone has been the brain behind my success during the period of this study. I am greatly indebted to my supervisor Professor NUNO. M. GARCIA for his advice, guidance, corrections and useful suggestion during the various stages of this research work. His scholarly criticism and interest in this research has been very rewarding, his promptness and sense of duty during my consultation with him has been highly commendable and which has made great impact in my life. My profound gratitude goes to him. My special appreciation goes to Mr Oluwafemi Olawale, Mr William Okorukwu Okey, Mr Diallo Ousmane and all my colleage in ALLAB (Assistance Living and Telecommunication Laboratory) for their assistance and support in one way or the other towards the success of this research work. My profound gratitude also goes to my Pastor Mrs Funmi Olanrewaju and her husband Mr Tola Olanrewaju for their prayer and word of encouragement towards the success of this research work. My profound gratitude also goes to my beloved parent Mr Kingsley Karikari and Mrs Comfort Karikari, Mr Nosa Osasere and my beloved uncles Mr Clement Conno, Mr Kingsley Oridomo for their prayer, moral and financial support towards the success of this project.
    [Show full text]