Networking Basics Quiz - Week 5

Ports

• Ports are virtual start and end points for network communication.
• Each port has a unique number.
• Specific ports are assigned protocols to differentiate traffic types (e.g., HTTP uses port 80).

Key Hardware Components

• Network Interface Card (NIC): Converts data into electrical signals for communication.
• Media Access Control (MAC) Address: Unique hardware ID for devices crucial for LAN communication.
• Hubs and Switches: Connect devices in a network; switches route data only to intended devices using MAC addresses.

Key Internet Components

• HTTP (Hyper Text Transfer Protocol): Controls data communication over the internet (e.g., retrieving web pages).
• IP Address: Unique device identifier on the internet; can change.
• URL (Uniform Resource Locator): Readable way to access an IP address; translated by Domain Name Servers (DNS).
• ARP (Address Resolution Protocol): Translates IP addresses to MAC addresses for local communication.

Port and Router Vulnerabilities

• Port Scanning: Checks open ports and listens for data. Attackers can exploit open ports to send malicious data or identify vulnerabilities.
• Port scanning tools (e.g., Nmap) can be used to identify vulnerabilities or applications.
• Vanilla scans check all ports sequentially, strobe scans target specific services.
• Stealth scanning (e.g., fragmented packets) makes probes harder to detect.
• Router vulnerabilities: War driving (unauthorized wireless network access), lack of password, malicious network activities.

Server Vulnerabilities

• Denial-of-Service (DoS) Attacks: Can happen unintentionally due to high server traffic (e.g., website crashes, university registration).
• Service Request Flood: Overloads a server with too many requests, causing it to shut down.
• Bandwidth Flood: Sends requests exceeding the server's bandwidth capacity, causing denial of service.
• SYN Flood: Exploits TCP/IP handshake; overwhelms the server with open connections.
• Security Operation Centers (SOCs): Use tools (firewalls, DMZs, etc.) to monitor and prevent attacks.

Packet Sniffing

• Passive attack; monitors and logs network traffic.
• Packet sniffers capture unencrypted data (e.g., passwords, financial information).
• Hub-based networks make sniffing easier than switch-based networks, although switch-based sniffing is possible with overloaded or promiscuous mode switches.

Spoofing

• Address Resolution Protocol (ARP) spoofing: ARP maps IP addresses to MAC addresses. Attackers can change the IP-to-MAC mapping to reroute traffic to them; tools such as Ettercap can do this.
• DNS spoofing: On the internet, an attacker can use DNS protocol spoofing.

Replay Attacks

• Attackers capture communication (e.g., login credentials), and later replay it to gain unauthorized access.
• Even encrypted data can be vulnerable in replay attacks.

VPNs

• Trusted VPN: Older type, relying on private lines.
• Secure VPN: Most common, using encryption protocols.
• Hybrid VPN: Combination of trusted and secure VPNs.
• VPNs encrypt data packets to prevent unauthorized access.

Encryption

• VPNs encrypt data in transit (transport mode) or as created (tunnel mode).
• Different VPNs use various encryption standards (e.g., AES).

Digital Certificates

• Verifies server identities in TLS (Transport Layer Security).
• Links a server's public key to its identity.
• Issued by a Certificate Authority (CA).
• The CA verifies the server's identity and digitally signs the certificate.
• Servers submit Certificate Signing Requests (CSRs) to the CA.

Transport Layer Security (TLS)

• Foundation of secure internet connections (e.g., HTTPS).
• TLS handshake involves:
  • Client sending "Client Hello."
  • Server replying with "Server Hello" and digital certificate.
  • Both agreeing on encryption key.
• TLS 1.3: Faster and more secure version, uses forward secrecy and stronger cipher suites, removing weaker protocols.