A Taxonomy of Computer Attacks with Applications to Wireless Networks
Total Page:16
File Type:pdf, Size:1020Kb
A TAXONOMY OF COMPUTER ATTACKS WITH APPLICATIONS TO WIRELESS NETWORKS by Daniel Lowry Lough Dissertation submitted to the Faculty of the Virginia Polytechnic Institute and State University in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Engineering Approved: NathanielJ.DavisIV (Chairman) Ezra A. Brown Mark T. Jones Randy C. Marchany Scott F. Midkiff Charles E. Nunnally April 2001 Blacksburg, Virginia c Copyright 2001 by Daniel Lowry Lough A Taxonomy of Computer Attacks with Applications to Wireless Networks by Daniel Lowry Lough Committee Chair: Nathaniel J. Davis IV Computer Engineering Abstract The majority of attacks made upon modern computers have been successful due to the exploitation of the same errors and weaknesses that have plagued computer systems for the last thirty years. Because the industry has not learned from these mistakes, new protocols and systems are not designed with the aspect of security in mind; and security that is present is typically added as an afterthought. What makes these systems so vulnerable is that the security design process is based upon assumptions that have been made in the past; assumptions which now have become obsolete or irrelevant. In addition, fundamental errors in the design and implementation of systems repeatedly occur, which lead to failures. This research presents a comprehensive analysis of the types of attacks that are being leveled upon computer systems and the construction of a general taxonomy and methodologies that will facilitate design of secure protocols. To develop a compre- hensive taxonomy, existing lists, charts, and taxonomies of host and network attacks published over the last thirty years are examined and combined, revealing common denominators among them. These common denominators, as well as new information, are assimilated to produce a broadly applicable, simpler, and more complete taxon- omy. It is shown that all computer attacks can be broken into a taxonomy consist- ing of improper conditions: Validation Exposure Randomness Deallocation Improper Conditions Taxonomy; hence described by the acronym VERDICT. The developed methodologies are applicable to both wired and wireless systems, and they are applied to some existing Internet attacks to show how they can be classified under VERDICT. The methodologies are applied to the IEEE 802.11 wireless local area network protocol and numerous vulnerabilities are found. Finally, an extensive annotated bibliography is included. Keywords: VERDICT, computer attack taxonomy, IEEE 802.11, wireless security, integrity flaws, computer security iv Dedication This work is dedicated to the One Almighty God, who has called me to be His servant. ...for all have sinned and fall short of the glory of God... Romans 3:23 ...He chose us in Him before the foundation of the world, that we should be holy and blameless before Him. In love He predestined us to adoption as sons through Jesus Christ to Himself, according to the good pleasure of His will... Ephesians 1:4–5 For while we were still helpless, at the right time Christ died for the ungodly. For one will hardly die for a righteous man; though perhaps for the good man someone would dare even to die. But God demonstrates His own love toward us, in that while we were yet sinners, Christ died for us. Romans 5:6–8 For God so loved the world, that He gave His only begotten Son, that whoever believes in Him should not perish, but have eternal life. John 3:16 v Who has believed our message? And to whom has the arm of the LORD been revealed? For He grew up before Him like a tender shoot, and like a root out of parched ground; He has no stately form or majesty that we should look upon Him, nor appearance that we should desire Him. He was despised and forsaken of men, a man of sorrows, and acquainted with grief; and like one from whom men hide their face, He was despised, and we did not esteem Him. Surely our griefs He Himself bore, and our sorrows He carried; yet we ourselves esteemed Him stricken, smitten of God, and afflicted. But He was pierced through for our transgressions, He was crushed for our iniquities; the chastening for our well-being fell upon Him, and by His scourging we are healed. All of us like sheep have gone astray, each of us has turned to his own way; but the LORD has caused the iniquity of us all to fall on Him. He was oppressed and He was afflicted, yet He did not open His mouth; like a lamb that is led to slaughter, and like a sheep that is silent before its shearers, so He did not open His mouth. By oppression and judgment He was taken away; and as for His generation, who considered that He was cut off out of the land of the living, for the transgression of my people to whom the stroke was due? His grave was assigned with wicked men, yet He was with a rich man in His death, because He had done no violence, nor was there any deceit in His mouth. But the LORD was pleased to crush Him, putting Him to grief; if He would render Himself as a guilt offering, He will see His offspring, He will prolong His days, and the good pleasure of the LORD will prosper in His hand. As a result of the anguish of His soul, He will see it and be satisfied; by His knowledge the Righteous One, My Servant, will justify the many, as He will bear their iniquities. Therefore, I will allot Him a portion with the great, and He will divide the spoils with the strong; because He poured out Himself to death, and was numbered with the transgressors; yet He Himself bore the sin of many, and interceded for the transgressors. Isaiah 53 vi Acknowledgements There are many people I would like to thank, for without them, this dissertation would not be completed: • Nathaniel Davis for being my advisor and guiding me through this dissertation process. • The Bradley Department of Electrical and Computer Engineering for fully supporting my Ph.D. work. This work was supported by a Bradley Fellowship from the Bradley Department of Electrical and Computer Engineering and a grant from the Hekimian Laboratories. • Randy Marchany for agreeing to serve on my committee, introducing me to people he knew, spending many hours talking with me about this work, and pushing me to complete the dissertation work. • All my Ph.D. Committee — Nathaniel Davis, Ezra Brown, Mark Jones, Randy Mar- chany, Scott Midkiff, and Charles Nunnally — for giving me comments about how to make the work better and encouraging me. • The staff in the department for helping me though all aspects of school. • The staff at ILLIAD (Virginia Tech InterLibrary Loan) for supporting me off campus by mailing numerous copies of articles and books. • Helmut Kopka and Patrick Daly’s guide to LATEXbookthatgreatly aidedmeinwriting this dissertation [Kopk1999]. • Aleksander Simonic for his WinEdt 2K program that is an editor for LATEXentry. vii • Richard B. Ertel who created Bibmaker, a Windows based program to manage the bibliographic entries for LATEX. • Tomas G. Rokicki, creator of dvips who helped me solve the problem of converting my files to Postscript for Acrobat pdf conversion. • Biswaroop Guha et al’s paper [Guha1997] for starting me to think about errors in protocols. • Carl Landwehr for comments on his work [Land1994]. • Matt Bishop for his hospitality when I visited UC Davis, his tutorial at USENIX, and his comments on his work [Bish1996a, Bish1999]. • Clark Weissman for a copy of the original report on FHM [Weis1973]. • All the hackers I’ve met over the years and the knowledge they have given me. • Alex Lostetter for many great memories, especially that of the 1996 “Sojorn.” • My friends Dan and Stephanie Ferrante; Ryan Smith; Fred and Kim Gray; Colin and Brenda Kerr; Brandon Ellison; Brett Kite; Victor Rosas; Dan Woodie; and Jeff Berner. • My family for their caring support: Susan and Bruce Tyler; Wilfrido, Julie, Willie, and Joey P´erez; Denys and Anna Andriyenko; and Andrew, Emily, Marianna, and Edwin Cutright. • “Mom” and “Dad” in Reva (Ed and Wanda Cutright) for the most wonderful and Godlysetofin-lawsamancanhave. • Dad who (not knowingly) got me started on my career by trading an old stove for a new Commodore VIC-20 computer over seventeen years ago. • Mom who is always there for me and who loves me more than I can ever love back. But most of all, to my wife and my best friend Rebecca. You are truly a Beautiful, Intelligent, and Godly Proverbs 31 woman. Words can not adequately describe how much Iloveyou, and I look forward to spending each and every day of the rest of my life with you. viii Contents Abstract iii Dedication v Acknowledgements vii 1 Introduction 1 2 Background and Literature Survey 7 2.1 Computer Security ................................ 7 2.1.1 TraditionalAreasofComputerSecurity................. 9 2.1.1.1 Confidentiality . ........................ 10 2.1.1.2 Integrity ............................. 10 2.1.1.3 Availability . ........................ 11 2.1.2 Information Warfare........................... 12 2.2 Assumptions Made ................................ 16 2.2.1 TrustingtheEnvironment........................ 16 2.2.2 Trusting Source Code........................... 19 2.2.3 TrustingtheApplicationandtheTrustedComputingBase...... 20 2.2.4 TrustingtheParadigms......................... 24 2.2.5 TrustingtheAssumptions........................ 25 2.3 Computer Security Problems........................... 27 2.3.1 The ARPANET Crashes in 1980, 1988, and Today ........... 27 2.3.1.1 ModuloTimeStampError.................. 27 ix 2.3.1.2 TheInternetWorm....................... 28 2.3.1.3 CrashesToday......................... 28 2.3.2 D´ej`aVuAllOverAgain......................... 28 2.3.3 WhyComputersAreNotSecure..................... 29 2.4 Penetration Testing................................ 30 2.4.1 FlawHypothesisMethodology...................... 30 2.4.1.1 FlawHypothesisMethodologyTheory...........