1. What Makes a Network Vulnerable?
Anonymity
Many points of attack (targets & origins)
Sharing
Complexity of system
Unknown perimeter
Unknown path

2. Who Attacks Networks Hackers break into organizations from the outside
Challenge
Fame
Money & Espionage
Ideology
However, most security breaches are internal, by employees and ex-employees

3. Threat Precursors Port Scan Social Engineering
Reconnaissance
Bulletin Board / Chat
Docs
Packet Sniffers (telnet/ftp in cleartext)

4. Network Security Threats
Interception
If interceptor cannot read, have confidentiality (privacy)
If cannot modify without detection, have message integrity

5. Network Security Threats
Impostors (Spoofing/ Masquerade)
Claim to be someone else
Need to authenticate the sender--prove that they are who they claim to be
True
Person
Impostor

6. Network Security Threats
Remotely Log in as Root User
Requires cracking the root login password
Then control the machine
Read and/or steal information
Damage data (erase hard disk)
Create backdoor user account that will let them in easily later
Root Login Command

7. Security Threats Content Threats
Application layer content may cause problems
Viruses
In many ways, most severe security problem in corporations today
Must examine application messages

8. Replay Attack
First, attacker intercepts a message
Not difficult to do

9. Replay Attack
Later, attacker retransmits (replays) the message to the original destination host
Does not have to be able to read a message to replay it

10. Replay Attack Why replay attacks?
To gain access to resources by replaying an authentication message
In a denial-of-service attack, to confuse the destination host

11. Thwarting Replay Attacks
Put a time stamp in each message to ensure that the message is “fresh”
Do not accept a message that is too old
Place a sequence number in each message
Do not accept a duplicated message
Message
Time
Stamp
Sequence
Number

12. Thwarting Replay Attacks
In request-response applications,
Sender of request generates a nonce (random number)
Places the nonce in the request
Server places the nonce in the response
Neither party accepts duplicate nonces
Request
Response
Nonce
Nonce

13. Network Security Threats
Denial of Service (DOS) Attacks
Overload system with a flood of messages
Or, send a single message that crashes the machine

14. Denial of Service (DOS) Attacks
Transmission Failure
Connection Flooding
Echo-Chargen
Ping of Death
Smurf
Syn Flood
Traffic Redirection
DNS Attacks
Distributed Denial of Service