Presentation Transcript

1. Week 10 - Monday

   CS363

2. Last time What did we talk about last time? Inference Multilevel databases
3. Questions?
4. Project 3
5. Assignment 4
6. Security Presentation Graham Welsh
7. Network Basics
8. Packet switched The Internet is a packet switched system This means that individual pieces of data (called packets) are sent on the network Each packet knows where it is going A collection of packets going from point A to point B might not all travel the same route C B 1 A 2 D
9. Circuit switched Phone lines are circuit switched This means that a specific circuit is set up for a specific communication Operators used to do this by hand Now it is done automatically Only one path for data A C B 1
10. Circuit vs. packet switching Which one is faster? Circuit switching Which one is more predictable? Circuit switching So, why is the Internet packet switched? More adaptable
11. ARPA The Advanced Research Projects Agency was created in 1958 to respond to the Russians launching Sputnik The ARPANET connected its first two major nodes over 10 years later Packet switched was used so that the network could still communicate after a nuclear strike
12. Network strength If a single cut can case a network to go down, that network is vulnerable to a single point of failure Most important networks like electrical systems have redundancy so that this doesn’t happen to a whole city Resilience or fault tolerance
13. Terminology A computer network is at least two computers connected together Often one is a server and the other is a client A computer system in a network is called a node The processor in a node is called a host A connection between two hosts is a link
14. Network characteristics Anonymity: We don’t know who we’re dealing with Automation: Communication may be entirely between machines without human supervision Distance: Communications are not significantly impacted by distance Opaqueness: It is hard to tell how far away other users are and to be sure that someone claiming to be the same user as before is
15. Shape and size The arrangement of a network, in terms of its links, is called its topology The boundary separates systems that are on a network from those that are not With the Internet, this line is blurry It is hard to know who owns hosts in a network Makes enforcing the law difficult How is a network controlled? Who does it?
16. Communication Analog or digital A modem converts between the two Portmanteau of “modulator-demodulator” Copper wire is the main workhorse Twisted pair is a pair of insulated copper wires Limit of about 10 Mbps and about 300 feet without a boost Coaxial cable has a single wire surrounded by an insulation jacket covered by a grounded braid of wire Repeatersor amplifiers are needed periodically to prevent signal degradation
17. Other media Optical fiber Carries light instead of electricity Higher bandwidth and less signal degradation than copper Replacing aging copper lines Wireless Good for short distance Uses radio signals Microwave Strong signals Requires line of sight Infrared Similar to microwave but weaker signals Satellites Need geosynchronous orbits Secure applications need smaller footprints than broadcasts
18. Protocols There are many different communication protocols The OSI reference model is an idealized model of how different parts of communication can be abstracted into 7 layers Imagine that each layer is talking to another parallel layer called a peer on another computer Only the physical layer is a real connection between the two
19. Layers Protocols and standards define each layer Not every layer is always used Sometimes user errors are referred to as Layer 8 problems
20. TCP/IP The OSI model is conceptual Most network communication uses TCP/IP We can view TCP/IP as four layers:
21. TCP/IP Transmission Control Protocol (TCP) Creates a reliable communication session Wraps information into packets Uses port numbers to connect processes to information streams Internet Protocol (IP) Allows for unreliable transport Wraps packets into datagrams Uses IP addresses for routing User Datagram Protocol (UDP) Alternative to TCP that is unreliable but has low overhead
22. Addressing A message datagram is sent to a domain name such as google.com The Domain Name System (DNS) converts google.com into an IP address such as 74.125.226.229 The server at 74.125.226.229 receives the datagram and unwraps the corresponding packet The packet has a port number (probably port 80, for HTTP), which is delivered to whatever program is communicating on port 80
23. Types of Networks Local area network (LAN) Small: Often not more than 100 users within 2 miles Local controlled Physically protected Limited scope Wide area network (WAN) One organization controls it Covers a large distance Physically exposed Internetworks A connection of two or more separate networks The most significant is the Internet Enormous Heterogeneous Physically and logically exposed
24. Network Threats
25. Why is a network vulnerable? Anonymity Many points of attack (targets and origins) Sharing Complexity Unknown perimeter
26. Why do people attack networks? Kevin Mitnick Once the most wanted computer criminal in the US Challenge Fame Money State espionage Industrial espionage Organized crime Stolen credit card numbers Identity theft Ideology Hacktivist groups like Anonymous Cyberterrorism from al Qaeda and similar groups
27. Reconnaissance
28. Reconnaissance A smart attacker learns everything he or she can about the system before attacking it Useful methods for reconnaissance of a network include: Port scans Social engineering Dumpster diving OS and application fingerprinting Background research
29. Port scan Many targeted systems include servers that are always listening on various ports, waiting for communication A port scanner is a program that tries to connect on many interesting ports to see what kinds of communication is ready to do If a server is poorly configured, it might be listening on ports even the administrators don’t know about Common free port scanners: nmap netcat
30. Social engineering Social engineering means techniques used to get a human being to unknowingly divulge information to an outsider Often this is done by posing as tech support or some kind of contractor Attackers can pretend to be someone from another department Most employees have been trained to be reluctant to give up their passwords However, they will often reveal their IP address, OS information, and other useful pieces of system information
31. Gathering more intelligence Port scans and social engineering can tell a lot Dumpster diving or going through trash can tell a lot as well You can learn which pieces of hardware have been bought by their packaging Phone lists or organization charts could be in the trash Diagrams, notes, even passwords could be written on scraps of paper Old hard drives with sensitive information could turn up For high level attacks, real spying is possible
32. OS and application fingerprinting Port scanning gives a lot of information For example, port 80 is used for HTTP But you may want to know which OS or application is actually listening at a port Vulnerabilities are often system-dependent Some applications will reveal themselves directly Others will give more information if you ask for a feature that is unavailable or give a bad command You are being fingerprinted when you visit websites Your browser identifies which browser it is You can hide this information, but your web pages might look weird
33. Documentation and hacking tips How do you actually do the attack? Same as everything else: Google Once you know the system you are attacking, you can search the Internet and security blogs and boards for vulnerabilities Because networking is often between different kinds of systems running different kinds of software, features are well-documented Most big viruses and worms use publicly known vulnerabilities that haven’t been patched
34. Eavesdropping
35. Eavesdropping and wiretapping Eavesdropping means overhearing private information without much effort Administrators need to periodically monitor network traffic Wiretapping implies that more effort is being used to overhear information Passive wiretapping is only listening to information Active wiretapping means that you may adding or changing information in the stream
36. Cable wiretapping If you are on the same LAN, you can use a packet sniffer to analyze packets Packets are constantly streaming by, and your computer usually only picks up those destined for it Passwords are often sent in the clear Wireshark is a free, popular packet sniffer Cable modems are filters that give you only the data you need Sophisticated attackers can tap into a cable network Data is supposed to be encrypted, but many networks don’t turn encryption on Inductance is a property that can allow you to measure the signals inside of a wire without a direct physical connection Using inductance or physically connecting to a wire changes its impedance, which can (but usually is not) measured Signals are often multiplexed, sharing media with other signals, which can increase the sophistication needed to wiretap
37. Wireless eavesdropping Wireless networks are easy to disrupt, but attackers usually have little to gain by this Since they are broadcast, it is not difficult to intercept the signal Special antennas can receive the signal from a longer distance than usual Some networks are entirely unencrypted WEP is almost completely broken WPA have WPA2 have vulnerabilities that can be exploited in some cases
38. Other media Microwave is easy to intercept Long distance phone can use microwaves Cell phones can use microwaves One difficulty with making use of the intercepted signal is that microwave signals are heavily multiplexed, making it hard to untangle individual signals Satellites are similar (unsecure but heavily multiplexed) Optical fiber is very difficult to tap Cutting a single fiber means recalibrating the network Repeaters and taps that connect the fiber are the best places to attack
39. Upcoming
40. Next time… More on network threats Network security controls Cody Kump presents
41. Reminders Read Sections 7.2 and 7.3 Work on Assignment 4 Due on Friday Study for Exam 2 Next Monday