Network Security: Chapter 9

• Chapter 9 discusses security in networks and distributed systems
• Dr. Sayed Elsayed is the author

Chapter Outline

• Brief review of network terms and concepts are covered
• Definitions, communication media, and protocols are included
• Vulnerabilities in networks are covered
• Threats like wiretapping, modification, and addressing are described
• Interception, association, WEP, and WPA in wireless networks are covered
• Denial of service and distributed denial of service explained
• Protections for vulnerabilities are explained
• Cryptography for networks using SSL, IPsec, and virtual private networks is included
• Firewalls, intrusion detection, and protection systems are detailed
• Managing network security, security information, and event management are covered

Introduction to Networks

• A network involves two devices connected via hardware and software to facilitate communication
• Networks include computers, printers, storage devices, and the necessary connecting wires
• Networks typically involve many clients interacting with multiple servers

Network Concepts

• Data communications travel via wires or wirelessly
• Both wired and wireless networks are vulnerable to attacks
• Data can be intercepted through eavesdropping, wiretapping, or sniffing

Network Transmission Media

• In cable networks, Ethernet or LAN signals are susceptible to interception
• LAN connectors, such as NICs, have unique MAC addresses
• Packet sniffing involves examining each packet using tools like Wireshark
• Wires radiate signals that intruders can read
• Cable splicing involves attackers cutting and splicing cables to copy data
• Optical fiber is not tappable without detection and is immune to inductive tapping
• Microwaves broadcast through the air and are easily accessible to outsiders
• Satellite communication footprints allow antennas within range to intercept signals
• Other radio wave technologies like cellular, Bluetooth, and near field communication are used

Microwave Transmission

• Microwaves are broadcast through the air, making them easier for outsiders to access

Communication Media Strengths and Weaknesses

• Wire is widely used, inexpensive, but susceptible to emanation and physical wiretapping
• Optical fiber is immune to emanation and difficult to wiretap, yet exposed at connection points
• Microwave signals are strong but exposed to interception along the transmission path
• Wireless networks are available and built into devices, signal degrades and is intercepted
• Satellite communications are strong and fast but have delays and signal exposure over a wide area

Addressing and Routing

• Intercepting communications media is one way to strike a network
• Integrity and availability threats apply
• Addressing and routing is fruitful for attackers
• Protocols, addressing, routing, and ports are potential vulnerabilities

Addressing and Routing Details

• A protocol is a set of conventions for computer interaction, allowing a high level view of communications
• Addressing uses the network interface card (NIC) with a MAC address for each computer
• Routing involves routers directing traffic along a path to a destination
• Ports are numbers associated with application programs

Threats to Network Communications

• Concepts include interception, modification, fabrication, and interruption
• Interception includes eavesdropping and wiretapping
• Modification and fabrication refer to data corruption or integrity failures
  • A sequencing attack occurs when packets arrive out of order
  • Substitution replaces a piece of the data stream
  • Insertion adds data values into a stream
  • Replay attack reuses intercepted data
  • Physical replay attack feeds fake visuals to security cameras
• Interruption involves loss of service or DoS attacks, affecting routing or causing component failure

Data Corruption Sources

• Data corruption includes typing errors, malicious code, hardware failure, noise, software flaws, and hacker activity

Wireless Network Security

• Wireless communication is less secure than wired due to signal exposure
• The 802.11 protocol suite governs wireless communication
• Described is how devices communicate in the 2.4 GHz radio signal band allotted to WiFi
• Wireless signals degrade due to interference and distance
• Poor signals may cause connection drops
• WiFi data units are called frames
• Management frames handle beacon, authentication, and association requests
• SSID identifies a wireless access point

Denial of Service (DoS)

• A DoS attack attempts to defeat availability by denying users access
• Flooding attacks occur from demand exceeding capacity
• Blocked access involves preventing a service from functioning
• Access failure includes: insufficient capacity, blocked access, and unresponsive component
• A Ping of Death attack floods pings to the victim
• A Smurf attack spoofs the victim's address

DoS continued...

• SYN flood overwhelms victims by filling SYN_RECV queue
• IP Fragmentation or Teardrop attack sends unreassembled datagrams
• Traffic redirection misleads routers
• DNS attacks target top-level domains, hijack sessions, and poison caches.

Distributed Denial-of-Service (DDoS)

• DDoS attacks infect multiple machines with Trojan horses (bots or zombies)
• Attackers signal zombies to bombard a chosen victim with traffic
• DDoS attacks are launched from scripts
• Bots consume computing and network resources
• Botnets are used for massive DoS attacks
• Botnet operators rent compromised hosts

Network Security Issues

• Networks share resources and workload
• System complexity is an issue
• Expandability creates network boundary uncertainty
• Many points of attack exist
• Anonymity allows attacks without touching the system
• Unknown paths are possible

Network Security Threats

• Common security threats include wiretapping, impersonation, and message confidence violations
• Also, message integrity violations, hacking, and DoS attacks are potential network security threats

Wiretapping Threats

• Wiretapping is intercepting communications
• Approaches include passive and active
• Packet sniffers can retrieve all packets on the net
• Inductance enables tapping wires without physical contact
• Microwave and satellite communications are prone to interception
• Optical fiber offers security, as the entire network is checked
  • It carries light energy, preventing magnetic field-based tapping
• Wiretappers target weaknesses in repeaters, splices, and connecting equipment

Impersonation

• Impersonation involves pretending to be someone or something with the attacker having several choices
  • These choices are include guessing identity, picking up identity details, circumventing authentication, using a non-authenticated target

Message Confidentiality Violations

• Includes misdelivery, exposure, or traffic flow analysis

Message Integrity Violations

• Includes falsification (changing, replacing, redirecting, or deleting messages) or noise interference

Hacking

• Hacking is a significant security threat
• Hackers can develop tools to search vulnerabilities
• Hackers analyze, plan, code, simulate, and test future attacks

DoS

• Includes connectivity, flooding, routing problems, and disruption of service

Network Security Control through Encryption

• Encryption involves link encryption and end-to-end encryption
• Link Encryption encrypts data before it's placed on communication links
• Decryption occurs as communication enters the receiving computer

End-to-End Encryption

• Provides security from one end of transmission to the other

Link Encryption versus End-to-end Encryption

• Link Encryption is applied by sending host, is transparent to user, done in hardware
• End-to-end Encryption is applied by sending process, uses software, and is user's choice

Authentication Issues in Distributed Systems

• Main concerns are ensuring authenticity of communicating hosts and users
• Authentication mechanisms address security concerns in distributed systems

Authentication Mechanisms

• Digital Distributed Authentication (DDA) uses digital signatures
• Distributed Computer Environment (DCE) provides distributed services, uses crypto techniques
• Kerberos uses a trusted Key Distribution Center (KDC) to authenticate users and services
  • It is designed for client-server applications, uses symmetric-key

Authentication Mechanisms continued...

• SESAME: aimed at secure authentication in multi-vendor systems, supporting auth techniques
• CORBA: a middleware standard, authenticates by integrating security mechanisms provided by protocols
  • CORBA apps use auth and access control by protocols

Kerberos

• Kerberos authenticates in distributed systems and was designed at MIT
• A central server provides authenticated tokens to applications

Kerberos Design

• Kerberos is designed to withstand attacks
• No passwords are communicated through the network
• Cryptographic protection guards against spoofing
• There are validity and timestamps prevent replay
• It relies on mutual authentication

Kerberos Imperfections

• Continuous availability of KDC is necessary
• Authenticity of servers is required
• Kerberos requires timely transactions
• Subverted workstations can replay passwords
• Weak passwords can be guessed
• Kerberos may not scale or address security concerns in systems