Fichas
363
Fichas del conjunto (184)
- 1What is probability?An indicator of how likely something is to happen
- 2What are mutually exclusive events?two events which cannot happen simultaneously
If A and B are mutually exclusive, then P(A OR B) = P(A) + P(B) - 3What is a transposition cipher?A cipher where the letters aren't change, but the order is
e.g. scytale - 4What is a substitution cipher?A cipher where letters are changed but the order is preserved
e.g. Caesar cipher (shift letters with the key 3) - 5How do we typically break a substitution cipher?Use frequency of English letters and compare to frequency of letters in the cipher (this is a ciphertext-only attack)
- 6What is a monoalphabetic substitution cipher?A substitution cipher where the key is constant
- 7What is a polyalphabetic substitution cipher?A substitution cipher where the key is repeatedly mapped to the whatever is being encrypted
e.g. i do not like this module!
k ey key keyk eyke ykeykey - 8What is the vignere cipher?A substitution cipher with a polyalphabetic key
- 9What are the three core steps in cryptography?Step 1 - Precisely secure the threat model, which includes a formal model/definition as well as what security means
Step 2 - Propose a construction
Step 3 - Prove that breaking the construction under the threat model will solve an underlying problem - 10Why is it important to have models and definitions (cryptography)?- If you don't understand what you want to achieve, how can you possibly know when you have achieved it
- Developing a precise threat model and security definition forces the designer to think about what they really what (e.g. what is essential/not)
- Enables meaningful evaluation and comparison of schemes
- Allows others to understand the security guarantee provided by some scheme - 11Why is it important to have clear assumptions (cryptography)?- Allows researchers to attempt to validate the assumption
- Allows meaningful comparison between schemes
- Enables process of security - 12What are symmetric ciphers?Cryptographic ciphers which use the same key to encrypt and decrypt
- 13What is one-time pad and how does it work?One-time pad is a cryptographic cipher which works by XOR'ing the message with the key for encryption, and XOR'ing the ciphertext with the key for decryption
This cipher achieves perfect secrecy, which means # messages = # keys, which produces as much ciphertext as there is messages - 14What are the threat models for symmetric key encryption?Ciphertext-only attack
Known-plaintext only attack
Chosen-plaintext only attack
Chosen ciphertext attack - 15What are ways we can prevent ciphertext-only attacks from revealing information, and what are flaws in these?Make it impossible to learn the key - necessary but doesn't protect us completely
Make it impossible to learn plaintext ciphertext - What if the attacker learns 90% of the plaintext?
Make it impossible for the attack to learn any character from plaintext - What is they guess a character, and it's right? - 16What is perfect secrecy?An idea theorised by Claude Shannon
Suggests that observing the ciphertext should not change the attackers knowledge about the distribution of the plaintext
If X possible encryption for m in the message space, there must be a key such that encK(m) = X and decK(X) = m
|m| values of K
|m| = |X|
= number of messages, keys and ciphertext much be equal - 17What are psuedorandom generators?Random number generators which aren't completely random, as they depend on an initial value called a seed
- 18What is a stream cipher?Symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream (key stream)
Each digit is encrypted one-by-one - 19What is an issue with a stream cipher?Doesn't provide message integrity - which means that a message has not been tampered with or altered
- 20What is a block cipher?A block cipher is an encryption method that applies a deterministic algorithm (AES, DES) along with a symmetric key to encrypt a block of text
- 21What are the three types of block ciphers (in this module)?Electronic code book (ECB) - Encrypts each character to a cipher character using the key
Cipher block chaining (CBC) - First message has an IV added to it, then encrypted to produce the first cipher character, then from here on out the cipher characters are used as the next IV
Counter (CTR) - idk - 22How does the diffie-hellman algorithm work?Alice/Bob agree a modulus P, and a base G
Alice chooses a secret integer X, then sends Bob A = G^X mod P
Bob does the same with Y, and sends B = G^Y mod P
Alice now computes S = B^Y mod P
Bob does same S = B^X mod p
We now have a secret key S - 23What is an adversary?Entity that attacks, or is a threat to a computing system
- 24What is an attack?An assault on system security that derives from an intelligent threat
Act which deliberately attempts to evade security services and violate the security policy of a system - 25What are security services/security policies?Security services - prevent bad things from happening
Security policies - define what is good/bad - 26What is confidentiality (channel security)?Keeping data and resources hidden
- 27What is integrity, and what are the two types (channel security)?Origin integrity - data is coming from where it is supposed to be coming from
Data integrity - data isn't tampered with - 28What is availability (channel security)?Efficient transfer of information through the channel
- 29What is anonymity and availability (network security)?Anonymity - untraceable, unobservable, unlinkable
Availability - making sure the data/resources are always obtainable - 30What is accountability?Making sure actions of an entity can be traced by to that entity
- 31What is a threat?Set of circumstances that has potential to cause loss/harm
- 32What is a vulnerability?Weakness within the system that can be exploited
- 33What is a countermeasure?A means to prevent a vulnerability from being exploited
- 34What are the five things security entails?Identifying assets
Identifying threats
Identifying vulnerabilities
Designing countermeasures
Accessing risk - 35What are the four classes of threat?Disclosure - snooping
Deception - modification, spoofing, repudiation, denial of receipt
Disruption - modification
Usurpation - modification, spoofing, delay, ddos - 36What are the four common threats?Snooping/interception - unauthorised interception of information via a network
Falsification - unauthorised change of information
Masquerading - impersonation of another entity e.g. phishing
Repudiation - a false denial that an entity received some information - 37How do we define security?Using security policies, which are statements of what is allowed in the system
Also using security mechanism which enforce the policy, and aim to prevent, detect and react to threats - 38What are the steps involved in creating a security policy?Step 1 - security requirements analysis, which Id's assets and their value, vulnerabilities, threats and risk. Also id's legal & contractual requirements
Step 2 - Work out what a suitable security will be, which most likely will be an abstract set of rules to become with due to their complex nature. These rules will classify what is authorised, required and prohibited activities, states and information flaws
Step 3 - Create a policy document, which turns the high-level security policy (step 2) into a document which can be used for reference by anyone implementing controls - 39What are the three things should a security policy clearly layout?Overall objectives
Principles
Underlying threat model - 40What are cookies?A way to keep users authenticated after login
Server provides cookies to the user - 41What is HTTPS?Secure HTTP using SSL
- 42What are limitations of HTTPS?Usability - Users don't tend to notice the lock symbol, which means they're likely to get spoofed, and they ignore alerts
Fingerprinting - maps an arbitrarily large data item (such as a computer file) to a much shorter bit string, its fingerprint, that uniquely identifies the original data - 43What is a path traversal attack?Where the attacker try's the most common paths for your website in the hopes of gaining access to something they shouldn't e.g. /admin.php
This process can be automated by an attacker - 44How can we prevent path traversal attacks?Don't index the pages on google
Use different filenames
Require authentication - 45What is a password cracking attack?If a username is known, an attack can try all variation of passwords to guess your password
Instead of comparing a hash of the password with the attempts, make it so every login attempt is a server request - 46How can we prevent password cracking attacks?Limit password attempts
Use CAPCHA's after each attempt - 47What is a threat model?A threat model is an abstract model in which potential threats, such as security vulnerabilities are ID'd
e.g. STRIDE (Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege) - 48What are injection attacks?An attack where user input is take advantage of to make the website do something it should e.g. SQL Injection
- 49What is command injection?Where a function which receives user input is made to perform something else e.g. exec() attack in php, which runs a system command
- 50What is SQL injection?An injection attack which takes advantage of user input which queries a database, in which the attacker is able to access the database
Works by the attacker adding an SQL query to their input and sending to the database, which processes and returns result
(can bypass auth, retrieve hidden information and deliver a denial of service) - 51How do we prevent SQL injection attacks?Sanitise inputs - escape characters so the input is never instantly sent off the the database as a string
Use prepared statements - SQL statements which are made in preparation, but aren't executed until values have been passed - 52What is cross-site scripting (XSS)?An injection attack where the attack is able to inject client-side code into web pages
This code is then served to another client by the server
This works because web browsers will execute anything sent to them via a websever - 53What are the four types of XSS attacks?XSS Phishing
XSS Redirect
Reflected XSS
Stored XSS - 54What is a XSS phishing attack?It's when a legitimate link has been compromised, so that when a person clicks on the link an embedded iframe will appear with a link to the malicious page
- 55What is a XSS redirect attack?Injection attack where attacker inserts code which redirects a user to a malicious page
- 56What is a reflected XSS attack?Injection attack where a malicious script is reflected off the web server
Only affects user issuing malicious request, results in error messages or search results - 57What is a stored XSS attack?Injection attack where injected code is stored on database and served to users
- 58How do we fix XSS attacks?Sanitization - this is difficult because the attacks are context dependant (i.e. in JS, CSS etc)
Blacklisting specific 'functions' - 59What is cross-site request forgery (CSRF)?Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated
- 60What are the steps in a CSRF attack (from the slides)?1. Victim is logged into vulnerable web site
2. Victim visits malicious page on attacker web site
3. Malicious content is delivered to victim
4. Victim involuntarily sends a request to the vulnerable web site - 61How do we prevent a CSRF attack?Tokens - an additional parameter which checks if the submission is valid
Check referral header - cannot be spoofed by an attacker, yet changable in browser
Challenge-response mechanisms - re-auth, CAPTCHA - 62What is an example CSRF attack?1. Victim logs into bank
2. Cookie is set
3. Victim visits site/link with a hidden img tag
4. Transfer money to the attacks account - 63What techniques do ISP's/Countries employ to censor content?DNS Blocking - when a request is sent to an ISP DNS server, they'll be a response of cannot find this webpage
IP Blocking - DNS will return an address to a specific webpage, but the router drops all packets to the page and the browser concludes the page is inaccessible - 64What are two other types of censorship techniques?Proxy blocking - involves blacklisting proxies i.e. different server address which may be used to access content which is censored
Hybrid blocking - IP based redirection to proxy - 65What are the tradeoffs in the four censorship techniques?DNS Blocking - ez n cheap to implement, blocks at domain level, ez to bypass
IP Blocking - ez n cheap to implement, blocks at ip address/port level, no so ez to bypass but still ez
Proxy blocking - expensive to implement, blocks at webpage level
Hybrid blocking - cheap, difficult to implement, has vulnerabilities (NICE WHAT ARE THEY IDIOT), blocks at webpage level - 66What are the limitations of censoring content?Censorship typically ends in legitimate content being blocked and banned content not
Easy to bypass most of the techniques
Expensive to build/maintain
Blocking one type of content encourages blocking other types of content
Not transparent - 67Aside from the censorship techniques such as DNS blocking, how else is content censored?People - in china people are employed to monitor population traffic
Laws - regulations placed on ISP's to block specific content
Fear/intimidation - 68What is a censorship resistance system, and what is an example of one?A censorship resistance system is software which is build to combat censorship
TOR - 69What are the two properties a censorship resistance system should maintain, even under attack?Hiding the user's identity (to prevent censoring)
Hiding where the user is visiting (to prevent intimidation) - 70What is anonymous communication, and how is it achieved?Anonymous communication is the hiding of identities of two communication end points
Achieved using layered encryption and random delays, this removes the correlation between input/output traffic - 71What is the goal of an anonymous communication system, such as TOR?To make all users look as similar as possible, to give an even bigger crowd
- 72What is an anonymous remailer in anonymous communication?A server that receives messages with embedded instructions on where to send them next, and forwards the message without revealing the location it came from
- 73What is the 'threshold mix'?A routing protocol which enables hard-to-trace communication
- 74How does the 'threshold mix'?In each round, the “threshold mix”
accepts a fixed number of messages
• Once the number of messages reaches
the “batch size” the mix flushes and
sends them all, in a random order
• Other strategies are possible, but this
is the type of mix we will examine in
the exercise
• After observing one round, the
attacker knows the set of senders and
receivers, but not who sent each
message - 75How is traffic analysis performed on a network using a routing protocol such as 'threshold mix'Observe traffic over many rounds of communication
Adversary can count each recipitents share of messages received
messages received by userX / messages received in toal
This gives us userX's amount of messages - 76How is anonymous web traffic typically achieved, and problems with this approach?By making all traffic look the same (padding), this doesn't work so well in practice because traffic is very variable (kb-gb)
hiding timing correlations (delays), this also doesn't work so well in practice because long latencies tend to be intolerable, especially for interactive traffic - 77What is onion routing (TOR)?Routing paradigm where the path to the destination is chosen, messages are then encrypted with public keys of the routers on the path and as they pass through a router a layer of encryption is removed
e.g. if we have the path A-B-C, it would look like E(A,E(B,E(C,M))), where E(x,y) represents y encrypted with x key - 78How does TOR hide communication patterns?By relying data through volunteer servers (i think these are typically other users)
Data is routed through these 'volunteer nodes' (over an encrypted tunnel) before reach one of TOR's centralised directory authorities - 79TOR uses two types of encryption, what are these and what do they encrypt?Circuit encryption - links/unlinks data entering/leaving a server
Link encryption (TLS) - disguises individual circuits - 80What are the weaknesses of TOR?Susceptible to traffic analysis
Exit nodes are compromised
Heartbleed - bug in TLS (fixed now lmao he doesn't update his slides, was fixed in 2014) - 81What is freenet?An anonymous content distribution network
Content is hosted by sharing it amongst users of the network (P2P?) - 82What is Psiphon?A censorship resistance system
Routes requests from censored country through uncensored country
No centralised control, meaning it's difficult to block but also difficult to find a server
If a user cannot modify browser settings/install software, it is still usable - 83What is malware?Any unwanted program that infects a computer
Set of instructions that run on your computer and make your system do something that an attacker wanted to do - 84What are the types of malware?Worms
Viruses
Trojans
Backdoor
Rootkit
Scareware
Adware - 85Why is malware a good idea for an attacker?Allows them to steal personal information
Allows them to delete files
Allows them to perform click fraud
Allows them to steal software serial nums
Allows them to user your computer as a relay node - 86What is a virus?A program that can infect other programs by modifying them to include a, possibly evolved version of itself
- 87What are the two types of viruses?Polymorphic - mutate while keeping the original algorithm intact
Metamorphic - change after each infection - 88What is a trojan?A piece of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow unauthorised access to the victim computer
- 89What is a rootkit?A root kit is a component that uses stealth to maintain a persistent and undetectable presence on the machines
Provide admin level access to a computer or network
Can run in user or kernel space
Can provide backdoors, conceal other malware, enforce DRM - 90What is a worm?A worm is a self-replication computer program which uses a network to send copies of itself to other nodes and do so without any user intervention i.e. stuxnet
Can cause DDoS, can be used to install a botnet - 91What is a botnet?Network of infected machines, under control from a 'botmaster' and is used for carrying out attacks including a DDoS and stealing information
- 92What is an advanced persistent threat ( APT), who are the typical attackers and what is the goal?Umbrella term for highly skilled, highly specialised attacks against western institutions
Attackers are typically nation-state level attackers or organised crime groups
Goal = steal info/cyber terrorism - 93What are the typical targets of malware and APT's?Media
Defence contractors
Security companies
Manufactures
Individuals
Basically every cunt and there dad why did he waste 7 slides with this shit - 94What are the four stages in an attack life cycle?Reconnaissance
Initial compromise
Command and control
Exfiltration - 95What is command and control (C&C)?How the malware talks to the malware owner
- 96What are the two main topologies used in command and control?Centralised
De-centralised - 97What evasion techniques are used in command and control?TOR - makes it difficult to locate botmasters/bots
Stenography - information in plain sight e.g. commands in html comments
DNS Fast flux - method for hiding server, website hides behind zombie nodes. Querying domain returns a subset of possible domains with short TTL. User/bot connects to IP which acts as a proxy to botmaster server
Domain generation algorithms (DGA) - 98What are the goals when designing a command and control channel?Hard to identify (the bots)
Robust to failure
Easy to use - 99How does a centralised botnet work, and what are the advantages/disadvantages of this topology?Bot master is a server
Malware are given an address to this server, this can either be hard-coded or done using DGA
Malware contacts the server to get commands on what they should do
Server directly responds to the malware to issue commands
+ ez to set up/maintain
- single point of failure - 100What is an example C&C centralised system?IRC
Where the bot master hosts a IRC server and creates a channel
Bots connect to channel and receive commands, and send data to the same channel
+ ez to set up/maintain
- ez to block, insecure, little anonymity - 101What is a social botnet?Where the command and control message are delivered via social networks
e.g. thaidoor - 102Why create a botnet via social media?Almost all countries whitelist social media websites
Ez
Millions of accounts to hide in
Social network traffic does not stand out - 103How does a de-centralised botnet work, and what are the advantages/disadvantages of this topology?De-centralised botnets work using a peer-to-peer architecture
+ scalable - supports much larger botnets
+ robust - take down requires the removal of every node
+ no single point of failure
- complex aZ - 104What are domain generation algorithms (DGA's)?Malware generates domains according to some function
Attempts to connect, botmaster does the same and registers the domain
Malware uses any domain that it can successfully connect to (usually has a failsafe) - 105What is Torpig?Botnet that was used for information theft
Was reversed engineered by some guys lol, but they didn't shut it down due to ethical concerns REALLY MATE
Used DGA to generate domains, also based on dates - 106What is protocol mimicking?make one protocol appear ass another e.g. HTTP as VOIP
- 107What is namecoin?Decentralised method to register and control domain names
- 108How do we prevent command and control?Blacklisting/whitelisting - use firewalls to block known malicious traffic/only allow known good traffic
Sinkholing - force C&C traffic to a controlled location - keeps the botnet alive but removes impact
Paritioning - this prevents de-centralised architecures by dividing the network enough that communication can't occur - 109What is ransomware?Attack where the victim has their disk encrypted and are requested to pay ransom to decrypt
e.g. Wannacry - 110What are the four ways malware can reside in a host?Overwriting - the malware can overwrite the targeted executable completely
Prepending - the malware will begin to take affect when the program is launched, but the program will still function as intended
Cavity - malware is nested within a target executable, and will take effect when the user does something specific
Multi-cavity - similar to cavity but more spread, so different activities in the infected executable will perform activate different parts of the malware - 111What is a packer?Software that unpacks itself in memory when the packed file is executed
Packer attacks can compress, encrypt, randomise, add junk, anti-vm, virtualise - 112What is a macro virus?Virus which uses a built-in script engine within other software and is run when the infected file is opened
- 113How do userland rookit's work?Run as if they were applications
Can inject malicious DLL's into other applications
Can overwrite memory of other applications
Modifies applications on machine to perform desired actions
E.g. replace passwd command to give attacker backdoor admin
access - 114Explain the steps involved in DLL injection?Step 1- create a malicious DLL (to replace and actual DLL)
step 2 - create a malicious DLL (to replace and actual DLL)
step 3 - apil cal to make space for mallicous DLL's, the legit ones are then overwritten
step 4 - the DLL that just overwrote the legit DLL grabs code from the second malicious DLL
step 5 - Now when the application which runs the DLL is run, the malicious code will be run - 115What is a kernel rootkit?Rootkit which replaces portions of the core operation system e.g. device drivers
Difficult to write but has unrestricted access
Very difficult to detect and remove - 116What is a bootkit?Kernel-mode rootkit that infects start up code such as the master boot record (MBR)
Can be used to avoid all protections of an OS, this is because the OS consider the system in a trusted state at the moment the OS boot loader took control - 117What is a hypervisor rootkit?Theoretical rootkit where the target OS runs inside a VM so can intercept all hardware calls
- 118What is a propagation vector, and what is an example?A propagation vector is a method in which code is able to distribute itself or infect a computer
e.g. shared folder, email, fake codec, fake antivirus, fake page - 119What is a backdoor?A way to access a machine once it's infected
Usually via an access terminal, and is used to carry out further attacks/control applications - 120What are the four types of backdoor communications?Basic - TCP connection from attacker to infected machine
Reverse - TCP from infected machine to attacker
Covert - ICMP connection from attack to infected machine
Rendezvous - Connection from both the attacker & infected machine to another node - 121What is the difference between a worm, virus and trojan?Virus - code embedded in a file/program
Trojan - malicious computer program which misleads users of its true intent
Worms - self-contained and may spread autonomously - 122How do worms propagate?Scanning - chooses random addresses
Coordinated scanning - different copies of the worm scan different addresses
Flash - assemble tree of vulnerable hosts in advance, propagate along tree
Meta-server - asks server for hosts to infect
Topological - uses information from infected hosts (web server logs, email address books, config files, SSH known hosts)
Contagion - propagate parasitically along with normally initiate comms - 123What are three approaches for detecting host-based malware?Signature-based detection
Heuristic-based detection
Checksum-based detection - 124What is the impossibility result?The idea that we can't make a perfect virus/malware detector
P is a perfect detection program
V is a virus
V can call P
if P(V) = true -> halt
if P(V) = false -> spread - 125How does heuristic-based detection work?By analysing program behaviour, things such as network access, file open, attempts to delete files, attempts to modify the boot sector
An alert is thrown when something like this happens
+ better for caching new malware
- can still miss things & be evaded - 126How does signature-based detection work?Find a 'string' that can identify the virus
Look in payloads & system calls
Match new samples to known signatures
+ fast, accurate for known signatures
- bad for new samples, easily evadable - 127How does checksum-based detection work?Compute a checksum for good binary & configuration
Detect change by comparing checksum
At some point there will be more malware than goodwar - 128What is sandbox analysis?Primary way of collecting malware
Run malware in control environment, virually
Log all system calls, memory usage and network traffic
Sandbox output can be used for building signatures - 129What is a 'honeypot'?A vulnerable machine made accessible to the internet, in the hope it will become infected
Usually running sandbox analysis to collect data
+ good for discovering new malware - 130How can malware evade sandboxes?By detecting and exploiting differences between end-user system and analysis system e.g. on VM behave harmlessly, on end-user perform malicious activity
Evasion tekkerz
Detect underlying vm
Detect signs of analysis environment
Malware can perform stall analysis, triggers and check for human interaction - 131How do we detect C&C?Machine learning
Either using clustering (K-means, Hierarchical, Birch streaming)
Os classifiers (decision trees, 'random forests'?) - 132What are the two best techniques currently for C&C detection?Traffic clustering - this is because C&C traffic is different from legitimate traffic
Traffic classification - this is because C&C traffic has static behavioural characteristics - 133How does traffic classification typically work?We look for known behaviour in new traffic
Train the ML algorithm on normal traffic and sandboxed traffic so it is able to distinguish
When we pass in new data which we want to classify, data points are assigned labels (benign/malware)
This technique is good for detecting known malware in which the ML can be trained with - 134How does traffic clustering typically work?The network representing the malware has a different structure to background traffic
This is especially true for p2p networks
We can use this to isolate a subgraph which represents how the malware is communicating (using random walks and clustering - 135What assumptions do we have to make when detecting malwareSeparation - That there is no overlap with malicious traffic and legitimate traffic
Continuity - That the malware behaviour is static, so the cluster/class definition don't change - 136What are the issues with many malware detection systems?Too specific in what they detect, meaning multiple systems will be needed for good protection
Performance issues
Cost issues
Lack of proper threat model
Many are tested in a controlled setting, might not translate to the real world - 137How does the Barreno model classify attacks?Influence - causative, exploratory
Specificity - targeted, indiscriminate
Security violate - integrity, availability - 138What is a gradient descent attack?An exploratory integrity attack
Works by applying gradient descent algorithm to attack point, changing features until point is misclassified - 139What are the two common approaches for defending against malware?Multi-classifier systems - use multiple classifiers trained using different feature or datasets
Game-theoretical approach - incorporate attacker strategies into learning algorithms - 140What is the access control matrix?Abstract security model
Characterises rights of domains (users) with respect to objects (files etc) - 141What is an access control list (ADL)?An attached list to each file
Contains associated domains (users) e.g. owner, group, others and their permissions e.g. read, write, execute - 142What is privilege escalation, and what are the two types?Utilise bug, or badly designed program, to access resources you
do not have permission for
Vertical - lower level user accesses function/content reserved for higher level
Horizontal - normal user access functions/content reserved for another normal user - 143What is a buffer overflow attack?Buffer overflow occurs when a program tries to put more data in a buffer than the amount of memory allocated to it
- 144What can we do to prevent buffer overflows?Stack canaries - place values around the stack, can be checked later so if stack is overwritten the values will change and overflow is detected
Randomisation - layout of memory is randomised, makes it much harder to find correct memory address to jump to - 145What protocols do we use for local/inter domain routing within the internet?TCP/IP for routing and messages
BGP for routing announcements - 146What are the basic security problems associated with TCP?Network packets pass by untrusted hosts, which mean packets can be eavesdropped, packet sniffed
TCP state can be easy to guess, which enables spoofing and session hijacking - 147What is address resolution protocol (ARP) spoofing?If MAC is not known for an IP, source sends broadcast ARP message requesting MAC
So, an attacker sends a spoofed ARP response to the target along with their MAC
All traffic for target IP is now routed through attackers address - 148What is TCP connection spoofing?Suppose the initial sequence numbers are predictable, an attacker can create a TCP session of behalf of the forged source IP
- 149How is the BGP routing protocol vulnerable?(as a reminded, BGP is a routing protocol to direct traffic between autonomous systems (AS's)
Packets are un-authenticated
Attacker can inject advertisements for arbitrary routes
Advertisement will propagate everywhere
(used for DDoS and spam) - 150How is the OSPF routing protocol vulnerable?(OSPF works using link state advertisements (LSA) to give routers on the net a complete view of topology)
Attackers can inject errors into routing tables which causes loops, denial of service and fake graphs (a threat model for this would be a single malicious router wants to disrupt all the AS traffic) - 151What security mechanism does the OSPF routing protocol have?Message integrity - every link can have its own shared secret
LSA floods the AS so even with a malicious actor, valid LSA's might still reach dest
Fight back mechanism - If a router receives its own LSA with a newer timestamp than the latest it sent, it immediately floods a new LSA - 152What are the basic DNS vulnerabilities?Interception of requests or compromise of DNS severs can result in incorrect or malicious responses e.g. malicious access point in a cafe
DNS cache poisoning - attack gains control of a local DNS server and stores and incorrect entry for a legitimate website, victim is take to attacker site when trying to visit legit site
DNS rebinding attack - malicious page cause visitors to run a client-side script that attacks machines elsewhere on the network - 153How do we protect against the basic DNS vulnerabilities?Ask DNS to query twice - protects against the interception of requests, as the attacker has to guess QueryID correctly twice
Increase Query ID - make it hard to guess in the first place
Randomise the SRC port - 154How do we protect against a DNS rebinding attack?Browser mitigation - refuse to switch to a new IP
Server-side defence - check host header for unrecognised domains/authenticate users with something other than IP
Firewall - external names can't resolve to internal addresses - 155What is a DoS attack?A denial of service is an action that prevents or impairs the authorised use of networks, system or applications by exhausting resources such as CPU units, memory, bandwidth and disk space
- 156What are the impact levels of a DoS attack?Self-recoverable - after influx of attack packets end, system returns to normal
Human-recoverable - after influx of attack packets end, reboot/reconfiguration is required
Non-recoverable - inflict permanent damage to hardware (burn out CPU) - 157What is a TCP SYN flood attack, and how is it prevented??Denial of service attack where attacker sends repeated TCP SYN messages to the target
Target replies with SYN/ACK but attacker never responds
Each connection required 280 bytes of a TCP control block (TCB)
Prevented using cookies, and smaller TCB's - 158What is bandwidth-based denial of service attack?Send high bandwidth traffic to a low bandwidth target
Another flooding attack - 159How does DDoS differ from a DoS?Attacker uses more than one host to carry out an attack, hence distributed
More hosts = more bandwidth
+ higher success rate due to more volumn
+ harder to stop due to multiple srcs
+ cheap - 160What is an example of an unintentional DDoS?Flash crowds - which is a huge influx of traffic due to a legitimate reason i.e. something going viral, black friday
- 161What is a reflector/amplifier attack respectively?Reflected DoS attack (reflector) - send spoofed request to a large number of computers, replies go to spoofed source, the target
Amplified DoS attack (amplifier) - Send request to server running 'vulnerable' service, responses are larger than request and are sent to spoofed address (target). Attack volume is increased by a large amount - 162How do we detect a DoS attempt/attack, and why are they hard to prevent?Detect a DoS attack by looking for a sudden increase in traffic
Difficult to prevent because;
Easy to perform
Traffic can be very similar to legitimate traffic
IP can be spoofed
High-volume of traffic
Usually short lived - 163What is backscatter, and what is backscatter analysis (DoS)?Backscatter is a side effect of an attack using source address spoofing - responses are scattered throughout IP address space
Backscatter analysis - observer the backscatter in a portion of the IP address space to determine characteristics of attack and victims
(reactive defence mechanism) - 164What is ingress filtering, and what are some issues with it (DoS)?A technique to prevent spoofing
Works by having routers check if source IP is in the network packet was received from
Issues;
Limited deployment
Any gaps limit effectiveness of existing deployment
(preventative defence mechanism) - 165What is route-based packet filtering (DoS)?Filtering mechanism which filters packets based on routing information from the internet AS topology
(preventative defence mechanism) - 166What is push-back and packet marking respectively (DoS)?Pushback - mechanism which looks for congestion, if congestion occurs then return the messages to sources
Packet marking - mark flows on route to monitor flows despite IP spoofing
Pi marking scheme, each router marks n bits into IP id field
Marking function - last n bits of hash of router IP address
Marking aggregation - router pushes marking into IP id field
Pi filters - High bandiwdth flows can be dropped by routers and victim - 167What are challenges related to DDoS defence?Distributed response required - cooperation between many points
Economic & social factor - legislative measures
Lack of detailed attack info - frequency of attack types, params, scale, backscatter
Lack of defence benchmark - should should the performance be measured
Difficulty to test on a large scale - 168What are the degrees of cooperation in respect to the taxonomy of DDoS defences?Autonomous - independent defence at the point of deployment
Cooperative – perform better in joint operation
Interdependent – cannot operate autonomously - 169What are the deployment locations in respect to the taxonomy of DDoS defences?Victim network – most common, the
most interested party.
Intermediate network – ISP can
provide the service, potential to
cooperation.
Source network – prevent DDoS at
the source, least motivation - 170What are DoS prevention 'proofs'?Cookies - verify that a request from a client comes from a given address(TCP handshake with cookie in servers ACK)
Capabilities - provide a potentially practical way to let servers inform the network that traffic is unwanted with a global auth sys (tokens, aka temporary authentication (TVA))
Proof-of-work - based on puzzles or bandwidth which cause clients to prove they are willing to work to obtain service - 171What is TVA?Traffic Validation Architecture
Capability mechanism where user requests to send (RTS) with a limited bandwidth rate
Some precapability shit is applied at routers on way to server
Server offers N bytes, T seconds
–Input link C, minimum sending rate N/T
–C/(N/T) records - 172What are the limitations of TVA?Legacy (legit?) traffic suffers highly
Requires updating of edge routers
Assumes certain knowledge of path capacities on server side to assign capabilities to flow - 173What is the Bell-LaPadula (BLP) model (security policy)?'state' machine model used for enforcing access control in government and military applications
Simple security condition, where S can read O if and only if lO <= lS where l = level
*-property S can write O if and only if lS <= O
read down, write up
s = subject, o = object - 174Why does the information flow upwards in the BLP model?Because where could be a malicious insider or there could be a simple mistake
- 175What is the BIBA model?Concerned with integrity so, the higher the level the more confidence that a program will act correctly, a subject will act appropriately and the data is trustworthy
Inverse of BLP so
S can write off if lO <= lS - with the idea that information obtained from a subject cannot be more trustworthy than the subject itself
S can read off if lS <= lO
read up, write down - 176What is the lattice model (security policy)?a complex access control model based on the interaction between any combination of objects (such as resources, computers, and applications) and subjects (such as individuals, groups or organisations).
(Basically BLP with labels) - 177What is the Chinese wall model (security policy)?An adaptation of BLP used by industries such as investment banking which prevents two teams communicating (i.e. prevent a Shell analyst reading DP data)
- 178How does the Chinese wall model work?For each object O, let y(O) be the firm it relates to
Let x(O) be that firms conflict of interest
Let x(O) = ! if the information has been sanitised
Then reading is allowed if the object (O) belongs to a firm the subject (S) has access to
S can read O if for all O' to which S has access
y(O) = y(O') V x(O) (belongs-to) x(O')
Writing is allowed if the user cannot read an object that contain unsanitised info
S can write O if S cannot read O' with
y(O) != y(O') ^ x(O) != (sanitised) - 179What is the data minimization principle?The collection of personal data must be restricted to an absolute minimum (only shit you ACTUALLY need)
- 180How does the BMA security policy work?Each medical record has a single access control list
Only the clinician in charge of that patient record may open the record. They must explicit give control to another health care professional should she wish - 181What are the main principles of the BMA security policy?Notifications - when a record is opened, changed or when another person is given access to it the patient must be notified
Persistence - no-one shall be able to delete the data until the statutory time period has expired
Attribution - all access logged
Information flow - information from one record may be appended to another if it is a subset of the first
Aggregation - controls must exist, and patients must be notified anyone on ACL has access to multiple patients data - 182What are shadow passwords?Stored hashed passwords which are only readable by system admin
- 183What is salting?The process of hashing a user's password with a randomly generated number/character
Allows users to have the same password, but different entries in the password file - 184What are the advantages to salting?Makes dictionary attacks more difficult
With 12-bit random salt, same password can hash to 212 different
hash values.
Información
- Descripción
- Fichas sobre 363, creado por Mac Howarth el 12/05/2018.
- Creado por
- Mac Howarth
- Visitas
- 2
- Valoración