8/10/2019 NS-UNIT1 (1)

1/40

SUB:NETWORK SECURITY

UNIT-1

8/10/2019 NS-UNIT1 (1)

2/40

Information Security:

It can be defined as measures adopted toprevent the unauthorized use, misuse,

modification or denial of use of knowledge,

facts, data.

Information security has been affected by

twomajor developments over the last several

decades.

Introduction of computersinto organizations.

Introduction of distributed systems.

8/10/2019 NS-UNIT1 (1)

3/40

These two developments lead to computer

security and network security.

computer security deals with collection of

tools designed to protect data.

Network security measures are needed to

protect data during transmission.

8/10/2019 NS-UNIT1 (1)

4/40

OSI Security ArchitectureOR----Threeaspects of IS are:

Security Attack: Any action that comprisesthe security of information.

Security Mechanism: A mechanism that is

designed to detect, prevent, or recover from asecurity.

Security Service: It is a processing or

communication service that enhances thesecurity of the data processing systems andinformation transfer.

8/10/2019 NS-UNIT1 (1)

5/40

Security Attacks

8/10/2019 NS-UNIT1 (1)

6/40

Interruption:This is an attack onavailability

Interception:This is an attack onconfidentiality

Modification:This is an attack on

integrity Fabrication:This is an attack on

authenticity

8/10/2019 NS-UNIT1 (1)

7/40

Availability:

Assures that systems work promptly andservice is not denied to authorized users.

Integrity:Assures that information and programs are

changed only in a specified and authorizedmanner.

Confidentiality:

Assures that private or confidential information isnot made available or disclosed to unauthorized

individuals

8/10/2019 NS-UNIT1 (1)

8/40

Authenticity:

Verifying that users are who they say they areand that each input arriving at the system

came from a trusted source.

8/10/2019 NS-UNIT1 (1)

9/40

Different kinds of attacks are:

InterruptionAn asset of the system is destroyed or becomes

unavailable or unusable. It is an attack on

availability.Examples:

Destruction of some hardware

Jamming wireless signals

Disabling file management systems

8/10/2019 NS-UNIT1 (1)

10/40

Interception

An unauthorized party gains access to an asset. Attackon confidentiality.

Examples:

Wire tapping to capture data in a network.

Illicitly copying data or programs

Eavesdropping

Modification:

When an unauthorized party gains access and tampersan asset. Attack is on Integrity.

Examples:

Changing data file

Altering a program and the contents of a message

8/10/2019 NS-UNIT1 (1)

11/40

Fabrication

An unauthorized party inserts a counterfeit

object into the system. Attack on Authenticity.

Also called impersonation.

Examples:

Hackers gaining access to a personal email and

sending message

Insertion of records in data files

nsertion of spurious messages in a network

8/10/2019 NS-UNIT1 (1)

12/40

Security Attacks

Security attacks can be classified in terms of

Passive attacks and Active attacks.

Apassive attack attempts to learn or make

use of information from the system but doesnot affect system resources.

An active attack attempts to alter system

resources or affect their operation

8/10/2019 NS-UNIT1 (1)

13/40

Passive Attacks: Two types:

Release of message content

It may be desirable to prevent the opponent fromlearning the contents (i.e sensitive or confidentialinfo) of the transmission.

Traffic analysis:

A more subtle technique where the opponentcould determinethe location and identity ofcommunicating hostsand could observe the

frequency & length of encrypted messages beingexchanged there by guessing the nature ofcommunication taking place.

8/10/2019 NS-UNIT1 (1)

14/40

Passive attacks:

Passive attacks are very difficult to detectbecause they do not involve any alternation of

the data.

As the communications take place in a verynormal fashion, neither the sender nor

receiver is aware that a third party has read

the messages or observed the traffic pattern.

So, the emphasis in dealing with passive

attacks is on preventionrather than detection.

8/10/2019 NS-UNIT1 (1)

15/40

Active Attacks:---------:Four types:

Masquerade: Here, an entity pretends to besome other entity. It usually includes one ofthe other forms of active attack.

Replay: It involves the passive capture of a

data unit and its subsequent retransmission toproduce an unauthorized effect.

Modification of messages: It means that some

portion of a legitimate message is altered, orthat messages are delayed to produce anunauthorized effect.

8/10/2019 NS-UNIT1 (1)

16/40

Denial of service: This attack prevents or

inhibits the normal use or management of

communication facilities.

8/10/2019 NS-UNIT1 (1)

17/40

Active attacks:

it is quite difficult to preventactive attacksabsolutely, because of the wide variety of

potential physical, software and network

vulnerabilities.

Instead, the goal is to detectactive attacks

and to recoverfrom any disruption or delays

caused by them.

8/10/2019 NS-UNIT1 (1)

18/40

Security Services:

It is a processing or communication servicethat is provided by a system to give a specific

kind of production to system resources.

Security services implement security policiesand are implemented by security mechanisms.

8/10/2019 NS-UNIT1 (1)

19/40

Confidentiality

Confidentiality is the protection of transmitted

data from passive attacks.

It is used to prevent the disclosure of information

to unauthorized individuals or systems.

It has been defined as ensuring that information

is accessible only to those authorized to have

access.

Protection of traffic flow from analysis. Ex: Acredit card number has to be secured during

online transaction.

8/10/2019 NS-UNIT1 (1)

20/40

Authentication

This service assures that a communication isauthentic.

For a single message transmission, its function isto assure the recipient that the message is fromintended source.

For an ongoing interaction two aspects areinvolved:

First, during connection initiation the serviceassures the authenticity of both parties.

Second, the connection between the two hosts isnot interfered allowing a third party tomasquerade as one of the two parties.

8/10/2019 NS-UNIT1 (1)

21/40

Integrity

Integrity means that data cannot be modifiedwithout authorization.

Like confidentiality, it can be applied to a

stream of messages, a single message orselected fields within a message.

Two types of integrity services are available. They are

Connection-Oriented Integrity Service:

Connectionless-Oriented Integrity Service:

8/10/2019 NS-UNIT1 (1)

22/40

Connection-Oriented Integrity Service:

It assuresthat messages are received as sent,with no duplication, insertion, modification,reordering or replays.

Destruction of data is also covered here.

Hence, it attends to both message streammodification and denial of service.

Connectionless-Oriented Integrity Service:

It deals with individual messages regardless oflarger context, providing protectionagainstmessage modificationonly.

8/10/2019 NS-UNIT1 (1)

23/40

Non-repudiation

Non-repudiation prevents either sender or

receiver from denying a transmitted message.This capability is crucial to e-commerce. Without

it an individual or entity can deny that he, she orit is responsible for a transaction, therefore not

financially liable. Access Control

It is the ability to limit and control the access tohost systems and applications via communication

links. For this, each entity trying to gain accessmust first be identified or authenticated, so thataccess rights can be tailored to the individuals.

8/10/2019 NS-UNIT1 (1)

24/40

Availability

It is defined to be the property of a system ora system resource being accessible and usable

upon demand by an authorized system entity.

8/10/2019 NS-UNIT1 (1)

25/40

Security Mechanisms:

Specific Security Mechanisms: Encipherment: It refers to the process of applying

mathematical algorithms for converting data into aform that is not intelligible. This depends on algorithmused and encryption keys.

Digital Signature: The appended data or acryptographic transformation applied to any data unitallowing to prove the source and integrity of the dataunit and protect against forgery.

Access Control: A variety of techniques used forenforcing access permissions to the system resources.

Data Integrity: A variety of mechanisms used to assurethe integrity of a data unit or stream of data units.

8/10/2019 NS-UNIT1 (1)

26/40

Authentication Exchange: A mechanism intendedto ensure the identity of an entity by means of

information exchange.Traffic Padding: The insertion of bits into gaps in

a data stream to frustrate traffic analysisattempts.

Routing Control: Enables selection of particularphysically secure routes for certain data andallows routing changes once a breach of securityis suspected.

Notarization: The use of a trusted third party toassure certain properties of a data exchange

8/10/2019 NS-UNIT1 (1)

27/40

A Model Of Inter Network Security

8/10/2019 NS-UNIT1 (1)

28/40

The general model shows that there are fourbasictasks in designing a particular security service:

1. Design an algorithm for performing the security-related transformation. The algorithm should be suchthat an opponent cannot defeat its purpose

2. Generate the secret information to be used with thealgorithm

3. Develop methods for the distribution and sharing ofthe secret information

4. Specify a protocol to be used by the two principals thatmakes use of the security algorithm and the secretinformation to achieve a particular security service

8/10/2019 NS-UNIT1 (1)

29/40

Buffer Overflow & Format String

Vulnerabilities

Vulnerability: Vulnerability is an inherent

weakness in design, configuration,

implementation or management of a networkor system that renders it susceptible to a

threat.

Every network and system has some kind ofvulnerability.

8/10/2019 NS-UNIT1 (1)

30/40

Buffer Overflow: A buffer overflow occurswhen a program or process tries to store more

data in a buffer than it was intended to hold.

It happens when the attacker intentionally

enters more data than a program was writtento handle.

This allows an attacker to overwrite data thatcontrols the program and can take overcontrol of the program to execute theattackerscode instead of programmerscode.

8/10/2019 NS-UNIT1 (1)

31/40

Exploiting the overflowable buffer involves

the following tasks:

Finding a way of injecting into the buffer

Specify a return address where malicious

code resides for the program to execute the

code

Determining the payload/code to be executed

8/10/2019 NS-UNIT1 (1)

32/40

Format String Vulnerability: A format string

vulnerability occurs when programmers pass

externally supplied data to aprintf function as

or as part of the format string argument.

Format string attacks can be used to crash a

program or to execute harmful code.

Format string bugs most commonly appear

when a programmer wishes to print a string

containing user supplied data.

8/10/2019 NS-UNIT1 (1)

33/40

Format string vulnerability attacks fall into

three categories:

denial of service, readingand writing.

denial of service attacks are characterized byutilizing multiple instances of the %s format

specifier to read data off of the stack until the

program attempts to read data from an illegal

address, which will cause the program to

crash.

8/10/2019 NS-UNIT1 (1)

34/40

reading attacks typically utilize the %x format

specifier to print sections of memory that we

do not normally have access to. This is aserious problem and can lead to disclosure of

sensitive information.

writing attacks utilize the %d, %u or %xformat specifiers to overwrite the Instruction

Pointer and force execution of user-supplied

shell code. This is exploited using single write

method or multiple writes method.

8/10/2019 NS-UNIT1 (1)

35/40

Session Hijacking:

Session Hijacking is security threat to whichmost systems are prone to.

Session hijack is a process whereby the

attacker inserts themselves into an existingcommunication session between twocomputers.

The three main protocols that manage thedata flow on which session hijacking occursare TCP, UDP, and HTTP.

8/10/2019 NS-UNIT1 (1)

36/40

Session hijacking can be done at two levels:

1.Network Level Hijacking:

( involves TCP and UDP sessions)

It refers to the interception and tamperingofpackets transmitted between client and server

during a TCP or UDP session.2. Application Level Hijacking:

(occurs with HTTP sessions. )

to obtaining session IDs to gain control of theHTTP user session as defined by the webapplication.

8/10/2019 NS-UNIT1 (1)

37/40

TCP Session Hijacking

Fig: The three way handshake method for session

establishment and sending Data over TCP

8/10/2019 NS-UNIT1 (1)

38/40

The goal of the TCP session hijacker is to create astate where the client and server are unable to

exchange data, so that he can forge acceptablepackets for both ends, which mimic the realpackets.

why the client and server will drop packetssent

between them: because

the serverssequence number no longer matches

the clientsACK number and likewise, the clientssequence number no longer matches

the serversACK number.

8/10/2019 NS-UNIT1 (1)

39/40

To hijack the session in the TCP network thehijacker should employ following techniques:

IP Spoofing: IP spoofing is a technique used to

gain unauthorized access to computers.

Blind Hijacking: If source routing is disabled, thesession hijacker can also employ blind hijacking

where he injects his malicious data intointercepted communications in the TCP session. Itis called blindbecause the hijacker can send thedata or commands, but cannot see the response.

Man in the Middle attack (packet sniffing): Thistechnique involves using a packet sniffer thatintercepts the communication between the clientand server.

8/10/2019 NS-UNIT1 (1)

40/40

Route Table Modification:An attacker wouldbe able to put himself in such a position toblock packets by modifying routing tables.

ARP Attacks: Address Resolution Protocol(ARP) spoofing, also known as ARP poisoning

or ARP Poison Routing (APR), is a techniqueused to attack an Ethernet wired or wirelessnetwork.

It allows an attacker to sniff data frames on alocal area network (LAN), modify the traffic, orstop the traffic altogether.