Computer Science and Engineering Computer System Security CSE 5339/7339 Session 25 November 16, 2004

Computer Science and Engineering Contents  Security in Networks  Group Work  Wing’s presentation

Computer Science and Engineering IP Protocol  Unreliable packet delivery service  Datagram (IPv4) Service TypeVERSHLENTOTAL LENGTH IDENTIFICATIONFLAGSFRAGMENT OFFSET TIME TO LIVEPROTOCOLHEADER CHECKSUM SOURCE ADDRESS DESTINATION ADDRESS PADDINGOPTIONS (IF ANY) DATA

Computer Science and Engineering Attacks  IP Spoofing  Teardrop attacks

Computer Science and Engineering ICMP (Internet Control Message Protocol)  Transmit error messages and unusual situations  Different types of ICMP have slightly different format TypeCodeCHECKSUM Unused (must be zero) DATA: Header and 1 st 64 bits of offending datagram ICMP time-exceeded message

Computer Science and Engineering ICMP (Echo request/reply)  Transmit error messages and unusual situations  Different types of ICMP have slightly different format TypeCodeCHECKSUM Sequence number DATA (optional) ICMP Echo Request/Reply Message Identifier

Computer Science and Engineering Ping of Death Attack  Denial of service attack (1 st in 1996)  Some systems did not handle oversized IP datagrams properly  An attacker construct an ICMP echo request containing 65,510 data octets and send it to victim  The total size of the resulting datagram would be larger than the octet limit specified by IP  System would crash

Computer Science and Engineering SMURF  Attacker send echo request message to broadcast address  Attacker also spoofs source address in the request Intermediary Attacker Victim

Computer Science and Engineering UDP (User Datagram Protocol) CHECKSUM (optional) DATA LENGTH DESTINATION PORTSOURCE PORT  From one application to another (multiple destinations)  Port  positive integer (unique destination)

Computer Science and Engineering Attacks on UDP  Fraggle  Trinoo

Computer Science and Engineering Fraggle (similar to smurf)  UDP port 7 is used for echo service  An attacker can create a stream of user datagram with random source port and a spoofed source address  Destination port is 7 and destination source is a broadcast address at some intermediate site  The attack can get worse if the source port = 7  Could be prevented by filtering out UDP echo requests destined for broadcast addresses

Computer Science and Engineering spoofed source Victim’s host broadcast destination random source port destination Port = 7 spoofed source Victim’s host broadcast destination source Port = 7 destination Port = 7 Stream of UDP datagrams

Computer Science and Engineering Trinoo  Distributed denial of service  In smurf and fraggle, trafic comes from a single intermediate node.  Trinoo allows the attacker to flood the victim from hundreds intermediate sites simultaneously  Two programs: master and daemon – installed in many different stolen accounts

Computer Science and Engineering attacker master daemon Large number of UDP packets to random ports

Computer Science and Engineering TCP CODE BITSHLENRESVWINDOW URGENT POINTER SEQUENCE NUMBER PADDINGOPTIONS (IF ANY) DATA CHECKSUM DESTINATION PORTSOURCE PORT Acknowledgment  Reliable delivery  TCP messages are sent inside IP datagrams

Computer Science and Engineering TCP Overview  TCP segments are sent inside IP datagrams  TCP divides a stream of data into chncks that fit in IP datagrams  It ensures that each datagram arrives at its destination  Itthen reassembles the datagrams to produce the original message

Computer Science and Engineering TCP Overview (cont.)  TCP uses an acknowledgment-and retransmission scheme  TCP sending software keeps a record of each datagram and waits for an acknowledgment  If no acknowledgment is received during the timeout interval, the datagram is retransmitted

Computer Science and Engineering Host A Host B Establishing a TCP Connection Using a 3-way handshake Host AHost B Closing a TCP Connection (one way A to B) Message 1 (SYN + SEQ) Message 2 (SYN + SEQ + ACK) Message 3 (ACK) Message 1 (FIN + SEQ) Message 2 (ACK)

Computer Science and Engineering Group Work Discuss possible attacks

Computer Science and Engineering Attacks on TCP  SYN Flood  Half-opened connection table  LAND  Spoofed source address = destination address  Source port = destination port  Certain implementations  freezing  TRIBE Flood Network (TFN)  Similar to trinoo but more than one attack  UDP flood, smurf, SYN floods, and others

Computer Science and Engineering Probes and Scans Ping scan and traceroute (What machines exist on a given network and how they are arranged) Remote OS fingerprinting (What OS each detected host is running) (Different OS respond to invalid packets differently) (Example: FIN to connection that has not been opened) Port Scanning (Which ports are open?  port scanner) Open a TCP connection and close it immediately Use half opened connections

Computer Science and Engineering Wired Backbone with Mobile nodes Fixed Communication Network Fixed Host Fixed host Fixed Host Base Station Wired Backbone Mobile Host

Computer Science and Engineering Mobile IP (Cont.) Arbitrary Topology of Routers and Links Home Agent Mobile Host at Home Foreign Agent Mobile Host visiting A foreign subnet Home subnet Foreign subnet

Computer Science and Engineering Wireless Multi-hop Backbone Mobile Host

Computer Science and Engineering Hybrid backbone Fixed Communication Network Fixed Host Fixed host Fixed Host Base Station Wired Backbone Mobile Host Wireless Multi-hop Backbone Mobile Host Hybrid Backbone Mobile Host