Misc 52

It's been such a long time since I've come up with an article that I find it hard to name this one. It seems miscellaneous anyway, so I'll name it that way.

This article is about using port-mirroring with Linux iptables for purposes such as Sniffing, IDS Monitoring and so on.

For this article, I'm going to show you how to capture DNS requests made by an application on an Android phone. Sounds difficult, but with sniffing, you can finish this task in less than 5 minutes!

First, you need to get on the Linux box (via Telnet or whatever) doing the routing. (Well, I'm technically on a WRT160NL running DD-WRT, so it is a Linux box)

We'll need to enter the following commands:
iptables -t mangle -A PREROUTING -s 172.16.1.139 -j ROUTE --tee --gw 172.16.1.150



In this case, 172.16.1.139 is the phone's IP address, while 172.16.1.150 is the IP of the system doing the sniffing. The above command redirects traffic coming FROM the phone.

In iptables, a packet goes through the following tables:
1) Filter
2) NAT
3) Mangle

Filter is for filtering of unwanted packets, NAT is for address translations, and Mangle is for final modification of packets (for things like QoS or mirroring).

Visit here to have a clearer idea of how the packet is routed.

The ROUTE target is an experimental target that performs routing in the mangle table. The -tee parameter specifies to MIRROR a packet, and the -gw parameter specifies the gateway to send it through.

Here is the documentation for the ROUTE target

Next, if we're interested in the return traffic, we can also enter the following commands:
iptables -t mangle -A POSTROUTING -d 172.16.1.139 -j ROUTE --tee --gw 172.16.1.150

If we are interested in ALL traffic, we can omit the -d and -s parameters.

Now we can fire up Wireshark and do some sniffing. First, we'll need to select the right interface for sniffing. Mine is quite obvious:



Now, as we are interested in DNS traffic in this scenario, we'll use the filter:
ip.addr == 172.16.1.139 && udp.port == 53

Go generate the request in your phone. Lo and behold, as if black magic, you now know the DNS names your phone applications are connecting to.



From here you can do what you want. Let's say you want to find out what port the phone is accessing and what type of traffic goes through. No problem, just scroll down and look for the line where the answer comes back in (usually one line after the request).



We'll then use the following filters:
ip.addr == 1.2.3.4 && tcp.flags.syn == 1

Of course, replace 1.2.3.4 with the response address. You'll get something like this:



In our case, it's port 8300 we're looking for!

Of course, this is not where we stop. Remember, the extra rule takes up extra CPU cycles. When you're done, remember to remove everything using:
iptables -t mangle -D PREROUTING -s 172.16.1.139 -j ROUTE --tee --gw 172.16.1.150
iptables -t mangle -D POSTROUTING -d 172.16.1.139 -j ROUTE --tee --gw 172.16.1.150

NETSEC 10

Last chapter, then time for exam papers!

Identification is not the same as Authentication. Identification is concerned with "Who you are?", while Authentication is concerned with "Are you really who you are?"

An example of Identification is a username, and Authentication is a password.

Authentication can be done in three ways:
-What you have - Smart card, Token
-What you know - Passwords, secret answers, PIN
-What you are - Biometrics like fingerprint

2FA is simply a combination of any of these two.

The disadvantage of "What you have" is that it can be stolen or forged.

The disadvantage of "What you know" is that it can be brute-forced. Most of the time it is easily cracked via technical methods.

The most secure method thus far (the level of security depends on the accuracy of the system) is "What you are". Biometrics such as voice, fingerprint and iris are things that cannot be forgotten, lost or stolen and is extremely impractical to forge (with current technologies. Who knows, maybe you're from 2020 and they've forged people).

Biometric must be something that is completely unique to an individual. Biometrics that meet these requirements include fingerprints, finger scans, retinal scans, voice scans, handwriting recognition, face recognition, and hand scans.

Biometrics require a hardware infrastructure (scanners, etc) and a database to store these information in digital form. They must also be smart enough to be able to compare newly scanned biometric information with stored information (which are bound to be slightly different).

The biometric protocol is to (in case of Fingerprint):
1) Capture - The fingerprint of those permitted are scanned
2) Process - The fingerprint is processed and quantized into binary data
3) Store or Verify (First time only) - The data is stored, or in case of verification, the data is compared against the one stored in the database.

Advantages of Fingerprinting:
-Moderately Reliable
-Cheap to manufacture
-Little data needs to be stored (<1KByte)
-Easy to implement everywhere (e.g. Even in webpages)

Disadvantages:
-Requires close contact with scanner
-Dirt on finger can affect recognition
-Fingerprint readers have to be cleaned

Another way of scanning as mentioned is the Iris/Retinal scans. Advantages are:
-More accurate and have more characteristics to match
-Can scan through glasses and contact lenses (in case of Iris)
-Low error rate (one in 2 million)

Disadvantages
-Difficulty reading blind or cataract patients
-Cumbersome to use

And now we're done.

NETSEC 09

Here comes my favorite chapter in the whole book. It's probably the final chapter since biometrics isn't important. Let's begin!

Oh did I mention, it's CRYPTOGRAPHY TIME!

Cryptography is the conversion of information into an form incomprehensible by people who do not have secret knowledge. In other words, creating the encryption/decryption system is the essence of cryptography.

Cryptanalysis is the opposite. Cryptanalysis is the breaking of the cryptography system by obtaining the secret through various means to break a code.

Plaintext (or less technically cleartext) is the original data. It is directly readable, or in case of data, useful.

Ciphertext is the plaintext that has gone through a cipher to make it unreadable.

Cipher is the encryption algorithm.

Key is the secret (typically a series of bits or a String which is later converted into bits) used by the cipher to encrypt/decrypt the plaintext into the ciphertext and vice versa.

Encryption is the conversion of plaintext into ciphertext using a cipher and key.

Decryption is the conversion of ciphertext into plaintext using a cipher and key.

cipherEncrypt(plainText,key) = cipherText;
cipherDecrypt(plaintext,key) = plainText;

In other words, the input of encryption is plaintext, and the output is ciphertext. The input of decryption is ciphertext, and the output is plaintext.

The goals of cryptography are slightly different, it now is:
C - Confidentiality
I - Integrity
A - Authentication
N - Non-Repudiation

Repudiation occurs when a user denies that he has sent something after he did. Non-repudiation ensures that he cannot do that, which we will see later in Asymmetric Encryption. It makes sure that NOBODY CAN PROVE that a transaction didn't take place if it did.

Private key encryption is known as symmetric cryptography, secret key, or single key.
Public key encryption is known as asymmetric cryptography.

The common symmetric key algorithms (ciphers) are:
-DES - Data Encryption Standard
-3DES - Triple DES
-AES - Advanced Encryption Standard
-IDEA - International Data Encryption Algorithm)
-RC[2,4,5] - Ron's Code, or Rivest Cipher

-Symmetric encryption is faster than asymmetric cryptography as the algorithm is computationally less complex
-Both side uses the same keys, therefore it must be private
-Shorter key length can be used to achieve the same level of security provided by an asymmetric system using longer key length

Both sides need to have the key before communication can take place. This is sent to the other side through various secure and insecure means (can be in-band and out-of-band).

The main disadvantage of symmetric encryption is the difficulty of sending the keys across securely. Keys may be lost/stolen/modified as it transits an insecure medium.

Assuming that 5 parties need to communicate, and they are NOT to be able to decipher each other's communication, then the number of keys required would be exponential according to the formula:
n(n-1)/2

2 parties would need 1 key, 3 parties would need 3 keys, 4 parties would need 6 keys, 5 parties would need 10 keys, and so on. 50 parties would need 1225 keys which is really impractical.

The problem with key distribution is solved through asymmetric encryption. Whitfield Diffie and Martin Hellman introduced the Diffie Hellman scheme in 1976. Another scheme, known as RSA (Rivest, Shamir and Adelman) was introduced later on.

Asymmetric encryption involves two mathematically related keys known as the public and private key. Either key can be public or private, as long as the private key is only owned by the owner.

Let k be the keys, p be the plaintext, c be the ciphertext, and f(x,y) be the encryption and g(x,y) be the decryption functions of the cipher. An asymmetric encryption would satisfy:

f(p1,k1) = c1;
g(c1,k2) = p1;

f(p2,k2) = c2;
g(c2,k1) = p2;

f'(c1,k1) = p1; DOES NOT EXIST
f'(c2,k1) = p2; DOES NOT EXIST
h(k1) = k2; DOES NOT EXIST

You may not encrypt and decrypt using the same key. You cannot derive the other key using the first key (you may only use bruteforce). The public key would be public and should be available for everyone. These are usually stored into key servers such as http://pgp.mit.edu/. You may also send public keys through email and websites. The private key, however, MUST be kept only to the owner.

Private keys are typically kept secure using a passphrase. The passphrase is used to encrypt/decrypt the private key, which is used to decrypt anything encrypted with the public key. (I love this chapter).

An example of asymmetric encryption would be:
I want to send YOU a mail
I obtain YOUR public key somehow (through online directories or otherwise)
I encrypt my mail with YOUR public key and send it to you
YOU decrypt the mail with YOUR private key

Two advantages of symmetric over asymmetric is:
-Less computationally complex, so symmetric is faster
-Symmetric key needs a shorter key length to have the same key strength

Two advantages of symmetric key over asymmetric are:
-It is difficult to transmit the key
-Difficult to manage keys (keys increase exponentially to the number of parties)

The number of keys required is simply: 2*n;

Remember, when referring to decryption and encryption, always use the keyword "corresponding". For example, use the "corresponding" public key to decrypt something encrypted with a private key.

If I want to send you something, and I encrypt with my public key instead, then you must have my private key to decrypt. Since only I have my private key, you will never be able to read that message unless you stole it from me.

Encryption with my private key is only done so that you can verify that I indeed AM the one that sent that message. This is not for confidentiality because anyone can get the public key for decryption. It's more for non-repudiation (i.e. If the message can be decrypted with the public key, then the owner of the public key definitely sent it, unless the private key was compromised).

The advantages of asymmetric keys are:
-Keys can be exchange easily without any special arrangement.
-Can be used to implement non-repudiation

The disadvantages are:
-Slow compared to symmetric key cryptography
-Computationally very complex, and programming is very difficult

As a review:
To send a confidential message - Use the receiver's public key to encrypt
To receive a confidential message - Decrypt with your own private key
To sign a message - Encrypt the message with your own private key
To verify a signature - Decrypt the message with signer's public key

If you use the wrong public key to sign, then the intended recipient would not be able to see the message. Certificates are used to store the public key for identification. We'll cover this later.

Let's now talk about hash functions. Hash functions are one way message-digest functions used to find the fingerprint of a particular object. It performs one-way transformation in a way where:

f(x) = y; Exists
f'(y) = x; Does not exist

Hash is not an encryption. The original document cannot be derived from the hash.

Hashes are typically used to check the integrity of the message. Message X has fingerprint x, but Modified Message X will have a fingerprint of y.

Properties of Hashes are:
A small change in input results in a big change in output - The Avalanche Effect
-As an example, if "An apple" gives abc1298fe, "An Apple" would give 1029defef

Input of different lengths always produce same length outputs
-If "Apple" gives abc1298fe, "An Apple" would give 1029defef

Two different inputs will not produce the same input (Anti-collision)
-By definition, since the hash output is 128-bits, then out of every 2^(128) input, only two would give the same output. That is a huge number.

It would take 128 bits * 2^(128) bits of space to store rainbow tables to defeat MD5. It is even more impractical to defeat SHA-1.

Same input always same output
-If "Apple" gives abc1298fe now, it will ALWAYS be abc1298fe.

These are the tested MD5 algorithms:
-MD4/MD5 (128-bits)
-SHA-1 (160-bits)
-SHA-2 (comprises of SHA-224, SHA-256, SHA-384, SHA-512)

Verification of the message Integrity through hash is as such:
I send you a message, and a hash of that message
You hash the received message, and compare it with the attached hash

A Digital Certificate is used to identify the owner. It is used in a Public Key Infrastructure and issued by Certificate Authorities. The Public Key is stored in the Digital Certificate, and the hash of a portion of the Digital Certificate is signed using the Certificate Authority's private key. This lets you:
-Verify and communicate with the owner
-Verify that the Digital Certificate came from a real CA

Digital certificates typically have a common name used in proving the identity of e-commerce sites (SSL/TLS). The most common digital certificate standard is the X.509. (There is a mistake in seminar, it's not a signature, it's a certificate).

A benefit of Asymmetric encryption is the use of Digital Signatures to implement non-repudiation and origin authenticity. It can also be used to verify that information is not lost in transit.

A digital signature is "a type of asymmetric cryptography used to simulate the security properties of a signature in digital form". It provides:
-Authentication - The signer is really who he is
-Non-repudiation - The signer cannot deny that he did not sign it
-Integrity - The data was sent and received without alteration

Signing is done in two simple steps:
-Hash the message
-Sign the has, then attach it with the message

The message sent is...
Plaintext+Sign(MD5(Plaintext))

The receiver then takes the hash, and decrypts it with the public key of the sender (If it can be decrypted, it verifies the sender and provides non-repudiation).

Now he hashes the message, and compares it with the decrypted hash (Verifies the Integrity of the message if it matches).

PGP is a software that makes use of asymmetric encryption to provide services such as signing and encryption for mainly email. In this case, event the sent message is encrypted, so a message to you looks like:
cipherEncrypt(plainText,yourPublic)+cipherEncrypt(md5(plainText),myPrivate)

Don't have funny ideas about "myPrivate" here. It's a key not a part.

NETSEC 08

We now go into a short chapter of Wireless Security. The advantage of having wireless is that it is convenient, doesn't require extensive cabling and planning, has a high ROI and can increase productivity (mobile users). It can also be used for temporary deployments such as during a trade show.

Wireless operates on the 2.4GHz and the 5GHz radio frequency ranges. The NIC has a Radio transceiver attached to it to allow communication with the AP. Wireless can experience interference when communicating through heavy walls, large metal objects, etc.

Wireless can operate in two modes:
-Infrastructure - Indirectly through a central place, e.g. AP
-Ad-Hoc - Directly between two hosts

APs are typically used to connect wireless clients to a wired network.

Each wireless network is identified with an SSID (Service Set Identifier) and it can be configured as Infrastructure mode on the AP or Ad-Hob mode on the initial client. SSIDs are periodically advertised through beacons.

Ad-Hoc clients do not require an access point and is easier to set up temporarily. Infrastructure mode takes advantage of the high powered antennae to cover wide areas.

802.11 refers to the wireless standards established by the IEEE. Here's a simple breakdown:

802.11a
-Operates on 5GHz, less crowded, and less interference from other appliances
-Speed up to 54Mbps
-Incompatible with b/g

802.11b
-Operates on 2.4GHz, more crowded, likely to be interfered by microwaves, cordless phones, etc.
-Speed up to 11Mbps but can operate over further distances
-More susceptible to heavy walls and big metal objects

802.11g
-Operates on 2.4GHz
-Speed up to 54Mbps, same range as b
-Backwards compatible with b, but will operate at lower speeds

802.11n
-Operates on both 2.4GHz and 5GHz (or either)
-300Mbps through MIMO technology

All vulnerabilities of a wired ethernet applies to wireless, and in addition, it is especially prone to interception attacks, as well as interruption through jamming.

Frames are sent as far as the radio transmissions take it, and any device within range of an unprotected network can intercept every packet.

War Driving refers to the technique that involves driving through a neighborhood to map APs using a wireless-enabled laptop. The information can then be used to plan attacks on insecured networks, or badly secured ones. AirSnort and NetStumbler are two free wireless network detectors.

To combat insecurities, the WEP (Wired Equivalent Privacy) was developed. Ideally, only the receiver can comprehend the received data. It is designed to provide the same level fo security of a wired LAN, prevent malicious users from sniffing, and prevent malicious users from sending crafted frames. It uses the RC4 encryption with a 40- or 128-bit key (symmetric) for Confidentiality and the CRC32 checksum for Integrity. The keys need to be configured on both ends. It works no the Data Link and Physical Layers, so it does not offer end-to-end security (and it is not designed to).

All that being said, WEP is not very secure, and can be cracked under 5 minutes, but it should be the bare minimum.

Measures against sniffing (some more effective than others) include:
-Changing the default SSID
-Disable SSID broadcasting
-Use MAC filtering
-Use an encryption scheme
-Change WEP keys often (or make use of TKIP)
-Only share what is needed
-Disable access point administration over wireless

Short chapter eh?

NETSEC 07

We now go into the topic of Malicious Code. Malicious Code can be any code that is capable of causing harm to a system. Malicious code include Viruses, Worms, Trojan Horses, and can include certain malicious Java Applets and ActiveX Controls.

It is sometimes not possible to classify a code under a specific class, so the general term "malware" is used. A malware is not necessarily a virus, but is a virus is definitely a malware.

Malicious code cause harm to the network by attacking the goals of network security (cause DoS, modify data, leak out confidential information). This would end up reducing productivity, causing bad reputation and loss of revenue.

A virus is a program that attaches itself into another program. It can be embedded at the start (similar to a launcher), or at the end of a program (similar to the use of a codecave).

For a virus to start working, the infected program must be executed. Some virus perform deadly operations immediately, while others remain inactive until conditions are met (e.g. A command is sent from the attacker, or a certain day and time).

Most viruses are written in assembly language, with the exception of macro viruses. Viruses can be playful or harmful (causing loss or corruption of data and/or services).

The life cycle of a virus is:
-Replication
-Activation

There are several kind of viruses. The most common of which are:

File Infector viruses - The most common virus class. It infects a file and hides within the code of another program. The infected program is an executable file which activates the virus and the program when run. The virus can then continue to run after the program is closed.

Viruses cannot exist in data/text files because the code within are not run. Instead, they are simply interpreted as ASCII characters. So even if a text file is infected, it would just appear to be a bunch of corrupted characters when open.

Boot sector viruses are stored in the boot sector of media (C/DVDs, diskettes, HDDs). It is executed when a computer first turns on, searches for the boot sector, and executes it. The virus is then loaded into the computer before, while or after the bootstrapper initializes the OS.

A boot sector virus can only be used to infect a machine if it is used to start it up. It cannot be used to infect a machine if it is introduced after bootup. A boot sector virus can then spread to other media while the OS is running.

A macro virus is a virus that makes use of powerful macro languages provided by certain programs (e.g. Word, Excel). These viruses execute each time the document is opened and may infect all future documents created with the application. The Melissa virus is an example of the macro virus, which causes the victim machine to mail out confidential documents with the Melissa virus attached to it.

A worm is a type of virus that can replicate itself but cannot attach itself to other programs. It is self-replicating and does not alter files but resides in active memory and duplicates itself. Mainly worms are used to use up objectives, but can also perform other tasks.

Viruses can spread through:
-Network
-Infected media
-Files from the internet
-Attachments
-ICQ/IRC
-P2P
-etc.

Antivirus softwares are used to remove malwares. They involve scanning and removing them. Anti-virus softwares can be:
-Virus scanning software
-Memory scanning software
-Integrity checkers
-Activity blockers

Virus scanning software can scan files and boot records. It may be able to notify the user, clean, delete, or quarantine the files/directories/disks affected. Virus scanners can look for known viruses, as well as new viruses.

Known viruses are found using signature scanning - a unique pattern of bits or binary data in the virus/program. The signature is like the fingerprint of a virus which is made as unique as possible for the identification of the virus.

Signature scanning may be able to find variants of existing viruses. False positives is relatively low. New viruses with different methods may not be detected as they may have different signatures.

Since antivirus softwares may not know the existence of new viruses, they make use of heuristic algorithms to scan. It is similar to signature scanning, but it looks for certain characteristics of the code (e.g. certain instructions that typically are not found in normal programs, such as modifiction of a driver, or modification of the registry).

If it finds a program that does unusual things, then it classifies it as a virus. However, it is more prone to false positives as legitimate programs (such as a Registry scanner) may be classified as malicious.

A Trojan Horse is a malicious, security breaking program that is disguised as something benign. An apparently useful program may have additional code to collect, exploit, falsify or destroy data.

A Trojan Horse is not a virus, in that although it does everything a virus can do, it does not attach itself to another program or attempt to replicate themselves. Trojans can be used for:
-Spying
-Relaying malicious connections (redirect connections to cause attacks to appear from another vector)
-Access restricted resources
-Launch a DDoS attack
-Capture keystrokes (Keylogger)

Trojans typically comprise of two parts:
-Server
-Client

The server is installed in the victim's machine, and the client is used by the attacker to connect to the victim's machine.

An example would be: Attacker makes the victim accept the Trojan server disguised as a game. The victim accepts and executes the file, causing the Trojan to be installed somewhere in the directory structure. The Trojan also modifies the Registry to cause it to be loaded automatically the next time the PC boots up. The attacker then connects to the Trojan to do work. The victim may also need to relay the IP of itself back to the attacker through means like DynDNS or email.

Defenses include:
-Do not download programs from dubious sites
-Do not open suspicious email attachments
-Prevent execution of ActiveX controls
-Don't accept programs in chatlines
-Check comments for files in P2P networks
-Use anti-spyware to detect and remove
-Configure a firewall to check for attempts to open ports
-Scan floppies and CDs before using

A Trojan may or may not be detected by Anti-Virus programs because they do things many other servers do, but famous ones like Sub Seven are definitely detected.

An example security policy for prevention of viruses can be:
1) All systems in the organization must be installed with firewalls and antivirus
2) Virus signatures must be updated
3) All media must be scanned for viruses before use
4) Programs downloaded from the Internet must be approved by the administrator before use

NETSEC 06

Let's go back to the first chapter and discuss why LANs are connected to the internet. The most common reason is for company to sell goods or advertise products through their website. Companies may also better communicate with partners and employees. Employees would also be more productive due to the resources available in the Internet.

However, this exposes the company to dangers such as:
-Intrusions
-Port scanning
-DoS
-Undesired packets
-Connection to untrusted networks

A firewall is a device, or a system of devices, that is designed to prevent unauthorized access to or from a private network. It isolates the LAN from the Internet by implementing the company's security policy with respect to Internet connections.

Typically, a Router is needed to connect to the Internet. As it is the border of the network, a firewall is typically implemented in a router. The router is then known as a screening router (discussed later). The perimeter device (whether it is a dedicated firewall or a screening router) is the first line of defense, and typically provides logging functions as well.

There are three main types of firewalls:
-Packet filter
-Application gateway
-Proxy server

Packet filters look at each packet and checks it against the firewall rules (typically a table that is matched from top to bottom). If it matches a rule (either PERMIT or DENY), it is applied to the packet. Packet filtering is effective, fast, and transparent to users.

An application gateway provides the highest level of security. This involves inspection of the application layer data, such as in the case of NBAR, where it is able to defend against tunneled traffic (e.g. Port 80 but not HTTP inside).

A proxy server is an intermediate server that makes connections on behalf of users. It breaks the client-server model. Each connection would then need two handshakes: One between client and firewall, and one between firewall and target host.

Proxy servers conceal the internal addressing of the clients, and it allows inspection of the application layer data (i.e. able to inspect tunneled traffic), allowing them to filter viruses, malware and other malicious content. However, it adds latency and sometimes bandwidth problems as extra steps are required to establish connections.

How a firewall works depend on what its filters are based on and also the OSI layer it operates on. Firewalls typically work at Layers 2 and above (it is not possible, feasible or practical to filter based on Layer 1 characteristics).

A perimeter firewall, however, cannot defend against internal attacks or any other attack that doesn't go through the firewall such as social engineering. Clients can also bypass perimeter firewalls by dialing out through a modem or using a VPN tunnel (such as HotSpot Shield)

The most basic type of firewall is the packet filter firewall, which examines the headers and fields of the protocols to determine whether it is permitted or denied. The action to take is stored in an ACL (Access-Control List).

Ingress filtering and egress filtering denotes filtering of incoming and outgoing packets respectively. The direction is with respect to the LAN.

Packet filter can be placed on the network-level (router-based) or the host-level (host-based). Network-level firewalls are typically implemented in routers, making it a screening router. It protects against threats passing through it.

At Host-level, it is typically a personal firewall installed on each host to protect ONLY that host.

Information used in packet filtering include:
Source/Destination IP, MAC, Port, Direction of traffic, Protocol and fields/flags (such as TCP bits, and IP Fragments/DSCP options).

The information can be used to block access to specific websites (by IP, not domain name) and connection to specific ports (e.g. cannot use FTP). It can also be used to block certain hosts from entering. A lot of flexibility can be added by specifying the port.

The ACLs can be default allow or default deny. It is typically default deny, which means that traffic that doesn't match any policy is implicitly denied at the end.

Packet filtering has the advantage of being faster due to having low overhead. This results in higher throughput than other types of firewall. This is due to the fewer evaluations it needs to perform.

However, certain rules are complex to specify, test, and modify. Exceptions may be difficult to create and it is difficult to block services using dynamic ports. IP Spoofing attacks can also defeat this type of firewall to a certain extend (attacks that require one sided communication, for example, can use a spoofed source IP).

An IDS (Intrusion Detection System) is similar to a firewall in that it is used to monitor the network. However, it monitors based on things like signatures (specific pattern that indicate an attack) and anomalies (network activity deviation). An IDS does not typically prevent intrusions as it is not inline with the traffic (it works with mirrored traffic), so it would have to rely on a secondary device (such as a router) to block attacks. It is vulnerable also to single-packet attacks.

IPSs are IDS that are inline with the traffic, and can block attacks without the help of a secondary device.

Think of IDS as simply a burglar alarm and a security camera combined. It detects attacks, attempts to enforce policies, and provides an audit trail after the attack is done.

An IDS can detect if a worm is attacking the network, or if a system has been compromised. It can also alert the administrator in such a case. An IDS can be configured to detect activities that does not confirm to security policies. Finally, an IDS can provide an after-attack audit trail to see how far an attacker got and where it came from.

There are different ways to categorize detection:
False Positive - Test turns out positive (e.g. ALERT!) but it's false (there is no attack).
False Negative - Test turns out negative, but it's false (there is an attack).
True Positive - Test turns out positive, and indeed there is an attack.
True Negative - Test turns out negative, and there indeed is no attack.

Like firewalls, IDS can be host-based or network-based. If they are on a single host, they would have limited view of the entire network and cannot detect attacks (or can only detect to a certain extent) attacks targeted at another host.

A honeypot is a server that is used to attack hackers. They look like tempting targets like a database server but there is actually no service running there. It is used for distracting hackers away from real targets, and to study the attack methods. However, it may not be used to convict a hacker.

NETSEC 05

Attacks can be classified into 4 types:
-Interruption (Availability)
-Modification (Integrity, Availability)
-Interception (Confidentiality)
-Fabrication (None, or Authentication/Authenticity)

Visually, the attacks look like this:
IMAGES OF THESE

These only categorizes Active Attacks, as at least one of the goals are harmed.

Attacks can be classified further. The most common class of attack is the MITM attack (Man-in-the-Middle). In MITM attacks, the attacker sits between the victim transparently. The attacker may then capture and/or modify the data before it reaches the victim. (As in a modification attack, or an interception attack).

Examples of MITM attacks are SSL Stripping and ARP Poison Routing (APR).

Another type of attack can be the Spoofing Attack. Spoofing attacks spoof a field in the protocol (such as source IP or MAC) to appear to be coming from a trusted vector. IP spoofing exists because certain services authenticate based on IP address. The existence itself is a vulnerability.

Defenses are to use 2FA, and to perform egress filtering to make sure that a router's originating LAN is not the source of spoofing. (e.g. Only allow source addresses that correspond to the company LAN to go out to the Internet).

Another type of spoofing can be web site spoofing, in case of a phishing attack. The attacker creates an authentic-looking page (such as a Bank Login Page) and lures the victim into the site by other means (e.g. Authentic-looking Email).

Finally we have the well-known ARP spoofing.

Another type of attack is the DoS attack (Denial of Service). DoS is primarily aimed at the Availability of the network/services. It is the simplest of attacks. Typically DoS attacks are done if the hacker fails to gain access to a computer (e.g. If he can't own it, no one else can).

DoS attacks are used to kill business competition. It is also used for revenge, for fun, or may be accidental (e.g. Janitor trips over a wire).

DoS attacks result in decreased productivity, lost revenue, and damaged reputation.

The types of DoS attacks are:
1) Consumption of network or computational resources
2) Disruption of configuration information
3) Physical damage

When it comes to consuming resources, typically a single attacker is not enough. It may sometimes take multiple attackers to bring a victim down. Therefore, we need to employ Distributed DoS or simply DDoS.

DoS relies on zombies or a botnet (infected hosts) which has either a server (listens for incoming commands) or a reverse client (connects to a server which it receives commands from) installed in it. It is difficult to trace who the real attacker is since the attack appears to be coming from multiple vectors, sometimes even from trusted hosts.

Session hijacking is the act of taking control of a session. Hackers get around sophisticated authentication schemes by taking over a victim's existing session AFTER it has been established and authenticated.

Password attacks are primarily brute force attacks. Brute-force attacks involve a systematic guessing of the password until a correct one is found. However, as most passwords contain common words, a dictionary brute-force attack (or simply, dictionary attack) can allow the attacker to resolve a password in a shorter time.

Passwords can be weak or strong. A strong password is one that is difficult to discover. Strong passwords are made up of:
1) Long strings
2) A large mix of character types in no apparent order (e.g. AbCd13!@ is bad, !A1C@b3e is good)
3) Words not found in dictionaries (Even H3ll0 may be bad, because of 1337 brute-force methods)

A weak password is the other way round:
1) Uses a word found in the dictionary, or a word
2) Uses very little mix of characters, such as all lowercase alphabets

The theory behind brute-force is that by definition, it is able to crack EVERY password encryption scheme EVENTUALLY. It is the feasibility of such an attack that makes it fail.

There are two types of brute-force targets. You can either brute-force the key (in case of encryption), or brute-force the plaintext (in case of hash).

Here's a practical example:
If a computer can try 72000 keys in a second, find the time it takes to brute-force...

The formula, by the way, is radix^characters/speed.

"test"

Since this is all in lower-case, then 26^4/72000 is the time-maximum (t-max) of the attack. On average, passwords are cracked in half the time-maximum (t-max).

"12345"

Since this only involves numbers, then it takes 10^5/72000.

"Passw0rd"

Since there is lower-case (26), upper-case (26) and numbers (10), the radix is 62. Therefore it takes 62^8/72000 to crack. Much longer.

"P@ssw0rd"

Now, there's the previous 62, AND all symbols. I don't know how many there are, but let's assume there's 16 symbols. You'll have 78^8/72000.

Sniffing is the easiest done in Token Ring networks, followed by Ethernet networks. Sniffing is the act of promiscuously inspecting every packet received by the NIC even if it is not intended for the computer. Sniffing can also be described as simply the act of intercepting packets traveling over a network. It is equivalent of eavesdropping.

A sniffer can be a program/device or the person using such a program. It can be used both for network management/troubleshooting (detect bottlenecks, programmers checking their program's packets, logging traffic) as well as malicious activities (stealing information off networks).

These three prerequisites must be met before sniffing can occur:
1) NIC must be in promiscuous mode
2) Hub is used to connect nodes (or ARP poisoning would be required)
3) Sniffer must be in the same LAN segment

By default, NICs are in non-promiscuous mode. That means that it will ignore packets not destined for its own MAC. However, NICs can capture and save packets not intended for itself when it is in promiscuous mode.

Information can be obtained through sniffing include: Email traffic, login usernames and passwords, and information useful for other attacks (including sequence numbers of TCP sessions). Any cleartext protocols such as HTTP, FTP, SMTP and POP3 can be sniffed.

Defenses for sniffing include:
-Replacing hubs with switches that can perform ARP snooping
-Physically check networks to ensure no unregistered hosts
-Use encryption to hide sensitive data

No matter how strong a password, once sniffed, is broken.

It is very difficult to detect sniffing because it is passive, but if the sniffing software makes use of the DNS for reverse-lookup, then it may be possible to identify suspicious hosts.

Phishing is a form of social engineering that makes use of fraudulent techniques to obtain sensitive information such as password and credit card details.

A web site phishing technique involves creating an authentic-looking site of a well-known company (such as a banking company). The phishers then create authentic-looking emails to trick recipients into accessing the phishing site. The victims would then divulge information as passwords, credit card numbers, usernames, and other things into a form on the website (e.g. When they try to log in).

Defenses for phishing include:
-Be skeptical of email with urgent requests
-Verify the emails with the company it "supposedly" came from
-Don't click on links in an email if it is suspicious
-Visit phishing guides like http://www.antiphishing.org

All the attacks described thus far are technical attacks. Technical attacks require the assailant to have good knowledge of computers, networking, programming and so on. His knowledge is used to identify vulnerabilities (he is the threat) and to carry out the attacks.

Non-technical attacks involve very little technical knowledge. These are the different non-technical attacks:

Dumpster diving - this involves digging into rubbish bins to look for sensitive data that has not been properly disposed off. Defenses include shredding of documents, credit cards and CDs.

Shoulder surfing - this involves looking over the victim's shoulders when he/she is inputting sensitive data into the computer (such as during logins).

Social Engineering is the most powerful attack in the world. It relies heavily on human interaction and is designed to exploit the natural helpfulness of humans. Social engineering works because people are not aware of the value of the information they hold, so they are careless in protecting it.

Social engineering can be performed through:
-appeal to Vanity (praises and such)
-appeal to Authority (appear to be an authoritative individual)
-eavesdropping (e.g. Shoulder Surfing, or eavesdropping for information to be used in the above two)

Social Engineering attacks can be classified under online and offline. (Or rather, technical or non-technical).

Emails containing tempting subject lines (e.g. "Nude XXX") but containing a trojan can be classified as an online social engineering attack. It can also cause damage by making people delete innocent operating-system critical files, such as the example given in the seminar where people are told to delete jdbgmgr.exe, claiming that it's a virus.