DOCSLIB.ORG

Network Securitysecurity

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Network Securitysecurity NetworkNetwork SecuritySecurity ISOCISOC NTWNTW 20002000 NTW 2000 © 2000, Cisco Systems, Inc. 1 IntroductionIntroduction NTW 2000 ©2000, 2000, Cisco Cisco Systems, Systems, Inc. Inc. 2 NetworkNetwork SecuritySecurity ComponentsComponents NTW 2000 © 2000, Cisco Systems, Inc. 3 ISPISP ExampleExample Internet Foreign Site . ISP Service Plane Customer Site T1 WWW DNS1 Pub 2 DNS2 TFTP Pub1 ISP Management Plane . NTW 2000 © 2000, Cisco Systems, Inc. 4 EnterpriseEnterprise ExampleExample Protected Network Engineering Finance Internet Admin WWW Server DNS Server Dial-Up Business Access Partners NTW 2000 © 2000, Cisco Systems, Inc. 5 CurrentCurrent ThreatsThreats andand AttackAttack MethodsMethods NTW 2000 ©2000, 2000, Cisco Cisco Systems, Systems, Inc. Inc. 6 AttackAttack TrendsTrends • Exploiting passwords and poor configurations • Software bugs • Trojan horses • Sniffers • IP address spoofing • Toolkits • Distributed attacks NTW 2000 © 2000, Cisco Systems, Inc. 7 AttackAttack TrendsTrends High Attacker Knowledge Attack Sophistication Low 1988 2000 NTW 2000 © 2000, Cisco Systems, Inc. 8 Vulnerability Exploit Cycle Novice Intruders Automated Use Crude Scanning/Exploit Exploit Tools Tools Developed Crude Exploit Widespread Use Intruders Begin Tools Distributed of Automated Using New Types Scanning/Exploit of Exploits Tools Advanced Intruders Discover Vulnerability Source: CERT Coordination Center NTW 2000 © 2000, Cisco Systems, Inc. 9 IncreasinglyIncreasingly SeriousSerious ImpactsImpacts • $10M transferred out of one banking system • Loss of intellectual property - $2M in one case, the entire company in another • Extensive compromise of operational systems - 15,000 hour recovery operation in one case • Alteration of medical diagnostic test results • Extortion - demanding payments to avoid operational problems NTW 2000 © 2000, Cisco Systems, Inc. 10 EvolvingEvolving DependenceDependence • Networked appliances/homes • Wireless stock transactions • On-line banking • Critical infrastructures • Business processes NTW 2000 © 2000, Cisco Systems, Inc. 11 TheThe Community’sCommunity’s VulnerabilityVulnerability Internal Exploitation Internet External Exploitation 100% vulnerable 75% vulnerable Source: Cisco Security Posture Assessments 1996-1999 NTW 2000 © 2000, Cisco Systems, Inc. 12 UnauthorizedUnauthorized UseUse 70 Yes 60 Percentage No of 50 Respondents Don't 40 Know 30 20 10 0 1996 1997 1998 1999 2000 Source: 2000 CSI/FBI Computer Crime and Security Survey NTW 2000 © 2000, Cisco Systems, Inc. 13 ConclusionConclusion Sophisticated attacks + Dependency + Vulnerability NTW 2000 © 2000, Cisco Systems, Inc. 14 ClassesClasses ofof AttacksAttacks • Reconnaisance Unauthorized discovery and mapping of systems, services, or vulnerabilities • Access Unauthorized data manipulation, system access, or privilege escalation • Denial of Service Disable or corrupt networks, systems, or services NTW 2000 © 2000, Cisco Systems, Inc. 15 ReconnaissanceReconnaissance MethodsMethods • Common commands and administrative utilities nslookup, ping, netcat, telnet, finger, rpcinfo, File Explorer, srvinfo, dumpacl • Public tools Sniffers, SATAN, SAINT, NMAP, custom scripts NTW 2000 © 2000, Cisco Systems, Inc. 16 NetworkNetwork SniffersSniffers Router5 … telnet Router5 Got It !! User Access Verification Username: squiggie password: Sq%*jkl[;T Router5>ena Password: jhervq5 Router5# NTW 2000 © 2000, Cisco Systems, Inc. 17 ISPISP ExampleExample Internet Foreign Site . ISP Service Plane Customer Site T1 WWW DNS1 Pub 2 DNS2 TFTP Pub1 ISP Management Plane. NTW 2000 © 2000, Cisco Systems, Inc. 18 EnterpriseEnterprise ExampleExample Engineering Finance Internet Admin WWW Server DNS Protected Server Network Dial-Up Business Access Partners NTW 2000 © 2000, Cisco Systems, Inc. 19 nmapnmap • network mapper is a utility for port scanning large networks: TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep) TCP Ping scanning Direct (non portmapper) RPC scanning Remote OS Identification by TCP/IP Fingerprinting (nearly 500) Reverse-ident scanning. NTW 2000 © 2000, Cisco Systems, Inc. 20 nmapnmap • nmap {Scan Type(s)} [Options] <host or net list> • Example: my-unix-host% nmap -sT my-router Starting nmap V. 2.53 by [email protected] ( www.insecure.org/nmap/ ) Interesting ports on my-router.example.com (10.12.192.1) (The 1521 ports scanned but not shown below are in state closed) Port State Service 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 80/tcp open http 110/tcp open pop-3 NTW 2000 © 2000, Cisco Systems, Inc. 21 WhyWhy DoDo YouYou Care?Care? • The more information you have, the easier it will be to launch a successful attack: Map the network Profile the devices on the network Exploit discovered vulnerabilities Achieve objective NTW 2000 © 2000, Cisco Systems, Inc. 22 AccessAccess MethodsMethods • Exploiting passwords Brute force Cracking tools • Exploit poorly configured or managed services anonymous ftp, tftp, remote registry access, nis, … Trust relationships: rlogin, rexec, … IP source routing File sharing: NFS, Windows File Sharing NTW 2000 © 2000, Cisco Systems, Inc. 23 AccessAccess MethodsMethods cont’dcont’d • Exploit application holes Mishandled input data: access outside application domain, buffer overflows, race conditions • Protocol weaknesses: fragmentation, TCP session hijacking • Trojan horses: Programs that plant a backdoor into a host NTW 2000 © 2000, Cisco Systems, Inc. 24 IPIP PacketPacket • Internet Protocol IP = connectionless network layer SAP = 32 bits IP address RFC 791, Sep 1981 NTW 2000 © 2000, Cisco Systems, Inc. 25 IP:IP: PacketPacket FormatFormat 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Version| IHL |Type of Service| Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Identification |Flags| Fragment Offset | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Time to Live | Protocol | Header Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Destination Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Internet Datagram Header NTW 2000 © 2000, Cisco Systems, Inc. 26 IP Spoofing A Hi, my name is B C Attacker NTW 2000 © 2000, Cisco Systems, Inc. B 27 IP:IP: NormalNormal RoutingRouting A, C via Ra B via Ethernet Rb B B -> B,C via Ra B via Rb A C via Rc A -> B A Ra A -> B Rc C Routing based on routing tables NTW 2000 © 2000, Cisco Systems, Inc. 28 IP:IP: SourceSource RoutingRouting b R a, R Rb B ia v B unknown B -> C via Rc A A -> B via Ra, Rb A Ra A -> B via Ra, Rb Rc C Routing based on IP datagram option NTW 2000 © 2000, Cisco Systems, Inc. 29 IPIP UnwantedUnwanted RoutingRouting , R2 ia R1 C ->A v C A unknown B via Internet Internet C-> A unknown A v ia R B via R1 1, R2 A unknown B via DMZ R1 B C->A via R1, R2 DMZ A via Intranet A intranet R2 B via DMZ C unknown C->A via R1,R2 NTW 2000 © 2000, Cisco Systems, Inc. 30 IPIP UnwantedUnwanted RoutingRouting ((ContCont.).) C-> A v C ia B A unknown B via Internet Internet P PP -up A unknown A via Ethernet dial ia B B via PPP C via PPP A v C-> A intranet B (acting as router) C->A via B NTW 2000 © 2000, Cisco Systems, Inc. 31 IPIP SpoofingSpoofing UsingUsing SourceSource RoutingRouting B is a friend allow access Rb B B-> A v ia C A Ra A ,Rc ->B Ra via Ra , Rc B->A via C,Rc,Ra ,C Rc C A->B via Ra,Rc,C B->A via C, Rc,Ra A->B via Ra, Rc,C Back traffic uses the same source route NTW 2000 © 2000, Cisco Systems, Inc. 32 TransportTransport ControlControl ProtocolProtocol • TCP = connection oriented transport layer • RFC 793, Sep 1981 • SAP= 16 bits TCP ports NTW 2000 © 2000, Cisco Systems, Inc. 33 TCPTCP PacketPacket FormatFormat 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Port | Destination Port | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Acknowledgment Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data | |U|A|P|R|S|F| | | Offset| Reserved |R|C|S|S|Y|I| Window | | | |G|K|H|T|N|N| | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Checksum | Urgent Pointer | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options | Padding | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | data | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ TCP Header Format NTW 2000 © 2000, Cisco Systems, Inc. 34 TCPTCP connectionconnection establishmentestablishment B A flags= SYN, seq=( Sb,?) flags=SYN+ACK, seq=(Sa,Sb) fl ags=A CK, s eq=(S b,Sa) flags=ACK, seq=(Sb,Sa+8) data=“Username:” NTW 2000 © 2000, Cisco Systems, Inc. 35 TCPTCP blindblind spoofingspoofing BA C masquerading as B flags=SYN, seq=(Sb,?) flags=SYN+ACK, seq=(Sa,Sb) flags=ACK, seq=(Sb,Sa) flags=ACK, seq=(Sb,Sa+8) data=“Username:” CC guessesguesses SaSa AA believesbelieves thethe connectionconnection comescomes
Load more

Recommended publications
  • Final Report
    Augment Spoofer Project to Improve Remediation Efforts (ASPIRE) Final Report Dr. Kimberly Claffy and Dr. Matthew Luckie September 21, 2020 Table of Contents A Executive Summary 2 B Problem: Long-standing vulnerability that threatens U.S. critical infrastructure 3 C Technical Approach 3 D Development Deliverables 6 D.1 Extend visibility capabilities to infrastructure behindNATs............. 6 D.2 SupportforAS-levelopt-innotificationsystem . ............ 7 D.3 Automated monthly reports to regional operator mailing lists............ 7 D.4 Maintainspooferoperations . ...... 8 E Analysis of Remediation Efforts 10 E.1 Impactofprivatenotificationsonremediation . ............ 10 E.2 Impact of public (“name-and-shame”) notifications . ............. 10 F Technology Transition and Commercialization 12 F.1 Commercializationopportunities . ......... 12 F.2 Expansiontoothermeasurementplatforms . ......... 12 G Overcoming misaligned incentives to deploy SAV 12 G.1 Impactofexogenousinterventions . ........ 13 G.2 Liability,insurance,andindustrystandards . ............. 13 G.3 Regulatingtransparency . ..... 14 G.4 Regulatinggovernmentprocurement . ........ 14 G.5 Stickydefaults: vendorSAVresponsibility . ............ 15 H Deliverables 17 A Executive Summary 1. Performer: University of California, San Diego (UCSD) & University of Waikato, NZ 2. Award: DHS S&T contract 140D7018C0010. 3. Period of Performance: 1 Sept 2018 - 19 Sept 2020. Despite source IP address spoofing being a known vulnerability – arguably the greatest archi- tectural vulnerability in the TCP/IP protocol suite as designed – for close to 30 years, and despite many efforts to shed light on the problem, spoofing remains a viable attack method for redirection, amplification, and anonymity. While some application-layer patches can mitigate these attacks, attackers continuously search for new vectors. To defeat DDoS attacks requires operators to en- sure their networks filter packets with spoofed source IP addresses, a best current practice (BCP) known as source address validation (SAV).
    [Show full text]
  • Firewalls and Vpns
    Firewalls and VPNs Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-17/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-1 Overview 1. What is a Firewall? 2. Types of Firewalls 3. Proxy Servers 4. Firewall Location and Configuration 5. Virtual Private Networks These slides are based on Lawrie Brown’s slides supplied with William Stalling’s th book “Cryptography and Network Security: Principles and Practice,” 7 Ed, 2017. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-2 What is a Firewall? Interconnects networks with differing trust Only authorized traffic is allowed Auditing and controlling access Can implement alarms for abnormal behavior Provides network address translation (NAT) and usage monitoring Implements VPNs Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-3 Firewall Limitations Cannot protect from attacks bypassing it E.g., sneaker net, utility modems, trusted organisations, trusted services (e.g., SSL/SSH) Cannot protect against internal threats E.g., disgruntled or colluding employees Cannot protect against access via Wireless LAN If improperly secured against external use, e.g., personal hot spots Cannot protect against malware imported via laptops, PDAs, and storage infected outside Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-4 Firewalls – Packet Filters Examine each IP packet (no context) and permit or deny according to rules Washington University in St.
    [Show full text]
  • Anti Spoofing
    Anti-Spoofing What is Spoofing? In simple terms, A technique used to gain unauthorized access to computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host. Types Of Spoofing Attacks IP Address ARP DNS Spoofing Spoofing Spoofing IP Address Spoofing Attacks • IP address spoofing is one of the most frequently used spoofing attack methods. • An attacker sends IP packets from a false (or “spoofed”) source address in order to disguise itself. ARP Spoofing Attacks • ARP is short for Address Resolution Protocol, a protocol that is used to resolve IP addresses to MAC (Media Access Control) addresses for transmitting data. • In this attack, a malicious party sends spoofed ARP messages across a local area network in order to link the attacker’s MAC address with the IP address of a legitimate member of the network. • ARP spoofing only works on local area networks that use the Address Resolution Protocol. DNS Server Spoofing Attacks • The Domain Name System (DNS) is a system that associates domain names with IP addresses. • In a DNS server spoofing attack, a malicious party modifies the DNS server in order to reroute a specific domain name to a different IP address. • In such cases, the new IP address will be for a server that is actually controlled by the attacker and contains files infected with malware. • DNS server spoofing attacks are often used to spread computer worms and viruses. Anti-Spoofing Antispoofing is a technique for identifying and dropping packets that have a false source address.
    [Show full text]
  • Cases of IP Address Spoofing and Web Spoofing —
    3-3 StudiesonCountermeasuresforThwarting SpoofingAttacks—CasesofIPAddress SpoofingandWebSpoofing— MIYAMOTO Daisuke, HAZEYAMA Hiroaki, and KADOBAYASHI Youki This article intends to give case studies for of thwarting spoofing attack. Spoofing is widely used when attackers attempt to increase the success rate of their cybercrimes. In the context of Denial of Service (DoS) attacks, IP address spoofing is employed to camouflage the attackers’ location. In the context of social engineering, Web spoofing is used to persuade victims into giv- ing away personal information. A Web spoofing attacker creates a convincing but false copy of the legitimate enterprises’ web sites. The forged websites are also known as phishing sites. Our research group developed the algorithms, systems, and practices, all of which analyze cybercrimes that employ spoofing techniques. In order to thwart DoS attacks, we show the deployment scenario for IP traceback systems. IP traceback aims to locate attack source, regardless of the spoofed source IP addresses. Unfortunately, IP traceback requires that its sys- tems are widely deployed across the Internet. We argue the practical deployment scenario within Internets of China, Japan, and South Korea. We also develop a detection method for phishing sites. Currently, one of the most important research agenda to counter phishing is improving the accuracy for detecting phishing sites. Our approach, named HumanBoost, aims at improving the detection accuracy by utilizing Web users’ past trust decisions. Based on our subject experiments, we analyze the average detection accuracy of both HumanBoost and CANTINA. Keywords IP spoofing, Web spoofing, Internet emulation, IP traceback, Machine learning 1 Introduction measures. IP traceback aims to locate attack sources, regardless of the spoofed source IP DoS attacks exhaust the resources of addresses.
    [Show full text]
  • Towards Remediating Ddos Attacks
    Towards Remediating DDoS Attacks Arturs Lavrenovs NATO CCDCOE, Tallinn, Estonia [email protected] DOI: 10.34190/IWS.21.046 Abstract: The Internet infrastructure has been struggling with distributed denial­of­service (DDoS) attacks for more than two decades. This paper reviews aspects of current remediation strategies for reflected amplified DDoS attacks and identifies elements that are insufficiently researched which might be hindering remediation efforts. It identifies additional actors who should be playing a role in these efforts and reviews their incentives and motivation. The issue has long been whether it is possible to remediate abused protocols faster than the protocols get deprecated while devices using them remain functional until the end of their life. It now appears that it is. The Memcache protocol attack capacity was only 319 Mbps in May 2020 but it was 1.7 Tbps only two years previously. Thus it can be considered fully remediated. The paper examines why this was a successful remediation effort and whether it could be applied to other commonly abused protocols by using the reflector capacity measurement methodology. In contrast, the long­term abused DNS protocol has not seen a significant drop in capacity, which is lingering around 27.5 Tbps. Keywords: DDoS attacks, DDoS attack capacity, DDoS attack remediation, reflectors, amplifiers 1. Introduction The first DDoS network attack was two decades ago and was soon followed by reflected amplified DDoS attacks that have been plaguing the Internet ever since. Although the number of reflectors observed by scanning projects has been steadily decreasing, the attack capacity is ever­growing and is setting new records.
    [Show full text]
  • Proposed Methods of IP Spoofing Detection & Prevention
    International Journal of Science and Research (IJSR), India Online ISSN: 2319-7064 Proposed Methods of IP Spoofing Detection & Prevention Sharmin Rashid1, Subhra Prosun Paul2 1, 2World University of Bangladesh, Dhanmondi, Dhaka, Bangladesh Abstract: In computer networking, the term IP address spoofing or IP spoofing refers to the creation of Internet Protocol (IP) packets with a forged source IP address, called spoofing, with the purpose of concealing the identity of the sender or impersonating another computing system. On January 22, 1995, in an article entitled, ―New form of attack on computers linked to Internet is uncovered, John Markoff of the New York Times reported on the TCP/IP protocol suite's security weakness known as IP spoofing. The IP spoofing security weakness was published by S. M. Bellovin (1989). However, not much attention has been paid to the security weaknesses of the TCP/IP protocol by the general public. This is changing as more people and companies are connecting to the Internet to conduct business. This paper is on ― “Proposed methods of IP Spoofing Detection & Prevention”. This paper contains an overview of IP address and IP Spoofing and its background. It also shortly discusses various types of IP Spoofing, how they attack on communication system. This paper also describes some methods to detection and prevention methods of IP spoofing and also describes impacts on communication system by IP Spoofing. We think that our proposed methods will be very helpful to detect and stop IP spoofing and give a secured communication system. Keywords: IP address, IP Spoofing, TCP/IP, Compression, Cryptography 1.
    [Show full text]
  • Lecture 16: TCP/IP Vulnerabilities and Dos Attacks: IP Spoofing, SYN Flooding, and the Shrew Dos Attack
    Lecture 16: TCP/IP Vulnerabilities and DoS Attacks: IP Spoofing, SYN Flooding, and The Shrew DoS Attack Lecture Notes on “Computer and Network Security” by Avi Kak ([email protected]) March 16, 2021 5:43pm ©2021 Avinash Kak, Purdue University Goals: • To review the IP and TCP packet headers • Controlling TCP Traffic Congestion and the Shrew DoS Attack • The TCP SYN Flood Attack for Denial of Service • IP Source Address Spoofing Attacks • BCP 38 for Thwarting IP Address Spoofing for DoS Attacks • Python and Perl Scripts for Mounting DoS Attacks with IP Address Spoofing and SYN Flooding • Troubleshooting Networks with the Netstat Utility CONTENTS Section Title Page 16.1 TCP and IP 3 16.2 The TCP/IP Protocol Stack 5 16.3 The Network Layer (also known as the Internet 14 Layer or the IP Layer) 16.4 TCP, The Transport Layer Protocol for Reliable 25 Communications 16.5 TCP versus IP 34 16.6 How TCP Breaks Up a Byte Stream That 36 Needs to be Sent to a Receiver 16.7 The TCP State Transition Diagram 38 16.8 A Demonstration of the 3-Way Handshake 44 16.9 Splitting the Handshake for Establishing 52 a TCP Connection 16.10 TCP Timers 58 16.11 TCP Congestion Control and the Shrew DoS Attack 60 16.12 SYN Flooding 68 16.13 IP Source Address Spoofing for SYN Flood 71 DoS Attacks 16.14 Thwarting IP Source Address Spoofing With BCP 38 84 16.15 Demonstrating DoS through IP Address Spoofing and 89 SYN Flooding When The Attacking and The Attacked Hosts Are in The Same LAN 16.16 Using the Netstat Utility for Troubleshooting 103 Networks 16.17 Homework Problems 113 Computer and Network Security by Avi Kak Lecture 16 Back to TOC 16.1 TCP and IP • We now live in a world in which the acronyms TCP and IP are almost as familiar as some other computer-related words like bits, bytes, megabytes, etc.
    [Show full text]
  • A Survey of Defence Mechanisms Against IP Spoofing
    UGC Approved Journal IARJSET ISSN (Online) 2393-8021 ISSN (Print) 2394-1588 International Advanced Research Journal in Science, Engineering and Technology ISO 3297:2007 Certified Vol. 4, Issue 7, July 2017 A Survey of Defence Mechanisms against IP Spoofing Sarita Sahni1, Pankaj Jagtap2 M. Tech Student, SCSIT, DAVV, Indore, India1 Lecturer, SCSIT, DAVV, Indore, India2 Abstract: IP address spoofing is a serious threat to the legitimate use of the Internet. Many Preventive mechanisms are thwarted by the ability of attackers to forge or spoof the source addresses in IP packets. Attackers can evade detection and put a substantial burden on the destination network for policing attack packets. In this paper a study of methods for detection of IP address spoofing is undertaken. It compares various host based methods such as IPSec, the OS Fingerprinting, TCP probing, SYN Cookies and IP puzzles with router based methods such as ingress and egress filtering, Reverse Path Forwarding (RPF), Router based Filtering (RBF), Spoofing Prevention Method (SPM), Distributed Packet Filtering (DPF), Inter Domain Packet Filtering (IDPF), SAVE, BASE, Hop Count Filtering (HCF), Pi and StackPi on the bases of their performances and effectiveness. Keywords: Reverse Path Forwarding (RPF); Router Based Filtering (RBF); Spoofing Prevention Method (SPM); Distributed Packet Filtering (DPF); Inter Domain Packet Filtering (IDPF); Path Identification; Stack Path Identification. INTRODUCTION The Internet Protocol or IP is used for sending and receiving data over the Internet and computers that are connected to a network. Each packet has header that contain some field like fragmentation, sequence number field, flag including source and destination address. The source address is normally the address that the packet was sent from.
    [Show full text]
  • Amplification and Drdos Attack Defense – a Survey and New Perspectives
    Amplification and DRDoS Attack Defense – A Survey and New Perspectives Fabrice J. Ryba∗, Matthew Orlinski∗, Matthias Wahlisch¨ ∗, Christian Rossowy, Thomas C. Schmidtz ∗ Freie Universitat¨ Berlin, Berlin, Germany, Email: ffabrice.ryba, m.orlinski, [email protected] y Saarland University, Saarbruecken, Germany, Email: [email protected] z HAW Hamburg, Hamburg, Germany, Email: [email protected] Abstract—The severity of amplification attacks has attacks, e.g., Slowloris [21] or TCP SYN floods [22], grown in recent years with recent attacks involving several unless their defenses are also applicable to amplification hundreds of Gbps attack volume. In this paper, we survey attacks. Generally, the adversary in amplification attacks the threat of amplification attacks and compare a wide targets vulnerabilities in Internet protocols and services selection of different proposals for preventing, detecting, to amplify the amount of attack traffic. The ease of per- and filtering amplification attack traffic. Since source IP spoofing plays an important part in almost all of the forming amplification attacks and greater understanding amplification attacks surveyed, we also survey state-of- of their effect has led to an increase of attacks in recent the-art of spoofing defenses as well as approaches to trace years. This is supported, e.g., by the OpenDNS Security spoofing sources. This work acts as an introduction into Lab that saw over 5,000 different amplification attacks many different types of amplification attacks and source every hour in 2014 [23], and by Rossow’s survey of IP address spoofing. By combining previous works into a amplification vulnerabilities [13]. single comprehensive discussion we hope to prevent redun- The most prominent form of amplification attack seen dant work and encourage others to find practical solutions in recent years abuses the lack of endpoint verification for defending against future amplification attacks.
    [Show full text]
  • Netsec Notes
    Practical Network Security: Basic Tools & Techniques Guevara Noubir Northeastern University [email protected] Counter Hack Reloaded, Ed Skoudis, 2005, Prentice-Hall. Based on Nick Plante’s slides. Taxonomy of Discussion Points Threats: Basic Network Recon and Info Gathering Threats: More Intrusive Probes and Scans Threats: Network Vulnerabilities Network Architecture Vulnerabilities Denial of Service (DoS) Threats: Application/OS Vulnerabilities Remote to Local (R2L) Attacks User to Root (U2R) aka Privilege Escalation Attacker Access Maintenance (root kits, etc) Defenses Reviewed Firewalls, Intrusion Detection, etc. CSU610: SWARM Practice – Tools 2 Recon & Info Gathering Social Engineering: “the weakest link” Physical Security Physical access, Theft, Dumpster diving Defenses: Locks, Policies (access, screen savers, etc.), Encrypted file systems, Paper shredders Web Searching and Online Recon Check company website, get contact names, look for comments in html, etc. Use Search Engines, Usenet to discover technologies in use, employee names, etc. Defenses: “Security Through Obscurity”, Policies CSU610: SWARM Practice – Tools 3 Recon & Info Gathering Whois database via Internic (.com, .net, .org) Publicly-available starting place for determining contacts, name servers, etc. for a given domain Network Solutions (edu), nic.mil, nic.gov, Allwhois Query listed registrar for detailed whois entries including contacts, postal address, name servers, emails (and formats of email) Also: Use ARIN to find IP blocks for organizations!
    [Show full text]
  • Libvirt XML Schemas
    APPENDIX A Libvirt XML Schemas This appendix covers the XML schemas used by libvirt. Each major section in the appendix describes a single libvirt domain. Everything needed to completely describe all the elements of a libvirt domain are contained in the schema. The Domain Schema The Domain schema completely describes a libvirt domain, i.e., a virtual machine. The domain can be any of the supported libvirt types including QEMU/KVM, XEN, and so on. Obviously, some of the schema sections apply to only some of the supported domain types, so it makes sense that you need to include only the parts of the schema that apply to your domain. The same applies to devices and features. If your domain does not support or have certain devices or features, then simply do not include those sections. The Domain XML schema consists of a large number of XML elements (Listing A-1). The documentation for this schema is quite extensive, but in most cases the uses of the elements in the schema are obvious. If you need documentation, refer to https://libvirt.org/formatdomain.html for more specific information about each element and attribute. © W. David Ashley 2019 257 W. D. Ashley, Foundations of Libvirt Development, https://doi.org/10.1007/978-1-4842-4862-1 APPENDIX A LIBVIRT XML SCHEmas Listing A-1. The Domain Schema <!--General metadata --> <domain type='kvm' id='1'> <name>MyGuest</name> <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid> <genid>43dc0cf8-809b-4adb-9bea-a9abb5f3d90e</genid> <title>A short description - title - of the domain</title> <description>Some
    [Show full text]
  • Technical Report RHUL–ISG–2019–3 27 March 2019
    A secure framework for protecting IPv6 Neighbor Discovery Protocol Colin Putman Technical Report RHUL–ISG–2019–3 27 March 2019 Information Security Group Royal Holloway University of London Egham, Surrey, TW20 0EX United Kingdom Student Number: 100885782 Colin Putman Title: A Secure Framework for Protecting IPv6 Neighbor Discovery Protocol. Supervisor: Chris Mitchell Submitted as part of the requirements for the award of the MSc in Information Security at Royal Holloway, University of London. I declare that this assignment is all my own work and that I have acknowledged all quotations from published or unpublished work of other people. I also declare that I have read the statements on plagiarism in Section 1 of the Regulations Governing Examination and Assessment Offences, and in accordance with these regulations I submit this project report as my own work. Signature: Date: A Secure Framework for Protecting IPv6 Neighbor Discovery Protocol Table of Contents List of Abbreviations……………………………………………….………2 Executive Summary ………………………………………………………3 1. Introduction…………………………………………………………….….4 2. Overview of NDP…………………………………………………………..5 2.1. NDP Messages 5 2.2. Functions of NDP 6 2.3. Vulnerabilities in NDP 7 2.4. Challenges with securing NDP 8 3. Secure Neighbor Discovery…………………………………………...…...10 3.1. Features of SEND 10 3.1.1. Cryptographically-Generated Addresses 10 3.1.2. Digital signatures 11 3.1.3. Certificate paths 12 3.1.4. Replay prevention 13 3.1.5. Compatibility with non-SEND devices 13 3.2. Drawbacks of SEND 14 3.3. Alternatives to SEND 16 3.3.1. Simple Secure Addressing Scheme 16 3.3.2. Source Address Validation Improvement 18 3.3.3.
    [Show full text]