Network Security

Page 1

Two threat models

Passive attackers- eavesdropping/ wiretapping/ sniffing, traffic analysis

Active attackers- spoofing attacks (phishing/email), squatting attacks

IP security

IP is connectionless and stateless

Best effort service

No delivery guarantee

No order guarantee

IPv4 no guaranteed security support

IPv6 guaranteed- IPSec

IPSec

2 major security mechanisms- IP authentication header (AH) and IP encapsulation security payload (EPS)

Does not contain any mechanisms to prevent traffic analysis

Encapsulation Security Payload- includes additional header within the IP packet that describes what encryption and authentication is in use

Security parameter index

Stores security parameters e.g. crypto protocol and keys

Established during the internet key exchange (IKE) handshake

Uses Diffie-Hellman key exchange

References the entry in a table that corresponds to this sessions parameters

Transport mode

Encrypts packets, providing host to host encryption but using original header

Prevents contents being read but doesn't stop traffic analysis or manipulation of the header

Tunnel mode

(Gateway-gateway) protects some segment of a channel with encryption

Provides some resistance to traffic analysis, protects manipulation of payload

VPNs commonly implemented this way

ARP- obtain physical MAC address for a given IP

ARP cache poisoning- Send unrequested ARP reply, overwriting the MAC address in a hosts ARP cache with our own- man in the middle attack- all traffic now travels via attackers ethernet adaptor

ARP protection

Some OS's ignore unsolicited ARP requests or can be configured differently

Intrustion detection software should pick up ARP spoofing

DNS spoofing- poisoning cache of a nameserver, replace a website lookup with own IP- done by ARP cache poisoning/ reply flood/ kaminsky attack

DNS protection

Random query number help protect against spoof replies

Most resolvers randomise source port now

DNSSEC - authenticate name server and provide integrity for the messages

Amplification attacks

Regular attacks are your bandwidth vs your targets

Utilise some aspect of network protocol to increase bandwidth of an attack

Smurf attack- broadcast ICMP ping request to a router but with a spoofed UP belonging to victim

Fraggle attack - identical to smurf in principle but using UDP and echo packets

DNS amplification

Recursive resolvers respond to DNS queries then return a response

Response can be many times larger than the query

In ideal world all DNS resolvers would use authorised list of requesters, e.g. ISP allowing requests only from their customers

Egress filtering- why is this external IP using my resolver

Many DNS servers set up incorrectly, will happily amplify your traffic

Botnets maintain lists of these open resolvers- there are attempts to shut them down

NTP amplification

Protocol for syncing time between machines

Similar to DNS amplification

Low and slow

Slowloris- open numerous connections to a server, begin a HTTP request but never finish it

R-U-Dead-Yet- extremelt long HTTP POST, send tiny amounts at a time