Polytechnic University Introduction1 CS 393/682: Network Security Professor Keith W. Ross

Polytechnic University Introduction2 Networks under attack r What can wrong? r How are computer networks vulnerable? r What are some of the more prevalent attacks today?

Polytechnic University Introduction3 The bad guys can put malware into your host via the Internet r We connect our hosts to the Internet to get good stuff: m , web pages, mp3s, video clips, search results, etc. r But along with the good stuff, comes the malware, which can: m Delete files m Install spyware that collects private info m Enroll our compromised host in a botnet thousands of similarly compromised devices which can be leveraged for DDoS attacks and spam distribution

Polytechnic University Introduction4 Malware: self-replicating r Once it infects one host: m seeks entry into other hosts m and then into yet more hosts r Virus m Requires some form of human interaction to spread m Classic example: viruses r Worms m No user interaction needed m Worm in infected host scans IP addresses and port numbers, looking for vulnerable processes to infect r Trojan horse m Hidden, devious part of some otherwise useful software

Polytechnic University Introduction5 The bad guys can attack servers & network infrastructure Denial of Service (DoS): Diminishes usability of network host, network, or network infrastructure. r Vulnerability attack: Attacker sends well-crafted messages to a vulnerable app or OS, crashing service or host. r Bandwidth flooding: Attacker sends a deluge of packets to the targeted host. Target’s access link becomes clogged.. r Connection flooding: The attacker establishes large number of half- or fully-open TCP connections at the target host. Target becomes incapable of accepting legitimate connections.

Polytechnic University Introduction6 The bad guys can sniff packets r Passive sniffers near wireless transmitters r Wired environments too. m Many LANs broadcast m Residential cable access systems broadcast m Bad guys with access to internal network infrastructure can install sniffers. r Packet sniffers are passive m and therefore difficult to detect.

Polytechnic University Introduction7 The bad guys can masquerade as someone you trust r Easy to create packet w/ arbitrary source address, packet content & dest address m then transmit packet into the Internet m which forwards the packet to its destination. The bad guys can modify or delete messages r Man-in-the-middle: bad guy inserted in path between two communicating entities r Sniff, inject, modify, delete packets r Compromise integrity of data sent btwn 2 entities

Polytechnic University Introduction8 How did the Internet get to be such an insecure place? r Originally for a group of mutually trusting users attached to a transparent network. m By definition, no need for security r Mutual trust m By default, can send a packet to any other user m IP source address taken by default to be true r Today, communication between trusted users is the exception rather than the rule

Polytechnic University Introduction9 Course Goals r Become expert in Internet protocols r Understand the types of problems m Survey some attacks m Become familiar with some attack tools r Understand the basic network security tools to counter the attacks m Become familiar with firewall, IDS, VPN configuration r Focus on principles rather than technology trends, current events r Examine some advanced research topics

Polytechnic University Introduction10 Topics covered r Network attacks m reconnaissance, sniffing, port scanning, DDoS, TCP hijacking r Firewalls and intrusion detection r Cryptography m Symmetric key, public key, integrity r Secure protocols m PGP, SSL, IPsec, secure Wi-Fi r Advanced topics m IP source traceback m Reputation systems m VoIP security m P2P security

Polytechnic University Labs r 1) Wireshark: TCP/IP review r 2) Wireshark: SSL r 3) IPsec and VPNs r 4) IKE (key negotiation for IPsec) r 5) IPmodules (firewalls) r 6) Network mapping with nmap Introduction 11

Polytechnic University Introduction12 Prerequisites r CS 684 or equivalent course on computer networking m with a heavy dose of TCP/IP r Proficiency in Linux r CS 392/681 are NOT prerequisites

Polytechnic University Introduction13 Recommended Books r Course PowerPoint slides r Network Security Essentials, William Stallings, 1992, Prentice Hall; decent introduction to cryptography and secure protocols. r Computer Networking, 4 th Edition, Kurose and Ross, 2007: for networking and TCP/IP background material, cryptography and secure protocols r Counter Hack, 2nd Edition, Ed Skoudis, 2005, for material in first few lectures on attacks r Network Security, Private Communication in a Public World, C. Kaufman, R. Perlman, M. Speciner, Prentice Hall, 1995; more advanced.