What Makes a Network Vulnerable? Anonymity Many points of attack (targets & origins) Sharing Complexity of system Unknown perimeter Unknown path

Who Attacks Networks Hackers break into organizations from the outside Challenge Fame Money & Espionage Ideology However, most security breaches are internal, by employees and ex-employees

Threat Precursors Port Scan Social Engineering Reconnaissance Bulletin Board / Chat Docs Packet Sniffers (telnet/ftp in cleartext)

Network Security Threats Interception If interceptor cannot read, have confidentiality (privacy) If cannot modify without detection, have message integrity

Network Security Threats Impostors (Spoofing/ Masquerade) Claim to be someone else Need to authenticate the sender--prove that they are who they claim to be True Person Impostor

Network Security Threats Remotely Log in as Root User Requires cracking the root login password Then control the machine Read and/or steal information Damage data (erase hard disk) Create backdoor user account that will let them in easily later Root Login Command

Security Threats Content Threats Application layer content may cause problems Viruses In many ways, most severe security problem in corporations today Must examine application messages

Replay Attack First, attacker intercepts a message Not difficult to do

Replay Attack Later, attacker retransmits (replays) the message to the original destination host Does not have to be able to read a message to replay it

Replay Attack Why replay attacks? To gain access to resources by replaying an authentication message In a denial-of-service attack, to confuse the destination host

Thwarting Replay Attacks Put a time stamp in each message to ensure that the message is “fresh” Do not accept a message that is too old Place a sequence number in each message Do not accept a duplicated message Message Time Stamp Sequence Number

Thwarting Replay Attacks In request-response applications, Sender of request generates a nonce (random number) Places the nonce in the request Server places the nonce in the response Neither party accepts duplicate nonces Request Response Nonce Nonce

Network Security Threats Denial of Service (DOS) Attacks Overload system with a flood of messages Or, send a single message that crashes the machine

Denial of Service (DOS) Attacks Transmission Failure Connection Flooding Echo-Chargen Ping of Death Smurf Syn Flood Traffic Redirection DNS Attacks Distributed Denial of Service