csds 344 midterm 1

Confidentiality, Integrity, Availability

- Only those authorized to view data can view it
- Might involve proving you have access to data and you are who you say you are

- Data is not modified from an unauthorized source
- You can ensure the data is from the source/sender

- Systems and services are available
- Resilience against attacks, failures, compromise

- Stored files on a filesystem
- Records in a database
- Physical folders (physical security)

- Data communicated through a web page
- Data sent via network
- Radio data via WiFi, Bluetooth, NFC, LoRa, etc

Something (person, software, etc) that can cause harm
Could be a natural disaster, power outage, etc

Where a system or computer is vulnerable to harm
Insecure code, physical security to data center, no backup disk

The possibility of a threat happening
Well known vulnerability in a very popular library → Higher Risk
Less known vulnerability on a server that is not connected to a network → Less Risk

Identify Assets - What do we need to protect?
Identify Threats - What can harm the things we want to protect?
Assess Vulnerabilities - What vulnerabilities could have a high impact?
Assess Risks - What would the impact be of the vulnerability? What are we willing to accept?
Mitigate Risks - How can we reduce the risk?

Usually a separate team within an organization

Preparation - How should we respond to the incident?
Detection and Analysis - How can we detect if an incident occurred and understand it?
Containment - How do we ensure the damage from the incident does not spread?
Eradication - How do we remove the cause of the incident?
Recovery - How do we recover from the incident?

When implementing computer security, we want layers
Don't rely on one single defense (e.g. password to a system)

External Network - VPN, DMZ, logging, pen testing, etc
Network Perimeter - Firewalls, proxies, logging, pen testing, etc
Internal Network - IDS, IPS, logging, pen testing, etc
Host - Auth, hardening, IDS, IPS, firewall, antivirus, scanning, pen testing, logging, etc
Application - Patching, pen testing, auditing, logging, etc
Data - Encryption, backups, authorization, etc

developing and using coded algorithms to protect and obscure transmitted information so that it may only be read by those with the permission and ability to decrypt it.

obscures communications so that unauthorized parties are unable to access them

Storing secret information like passwords
Secure web browsing and transmission of information
Secure authentication - proving identities
Digital signatures - proving who people are or things have not been modified
Non repudiation - proving that this is from a person and they cannot deny

The same key is used for both encryption and decryption
Very fast compared to asymmetric
Both parties must know key

DES / 3DES - Data Encryption Standard - Don't Use
Blowfish - Don't Use
RC4 - Don't Use
AES - Advanced Encryption Standard - Use (128, 192, 256 key sizes)

Stream - Encrypt bits one bit at a time
Block - Take a set number of bits (more popular)
-- ECB - Electronic Code Book - Don't Use
-- CBC - Cipher Block Chaining (cannot run in parallel, can use)
-- GCM - Galois Counter Mode (can run in parallel, should use when possible)

Two separate keys are used: public and private key
Slower than symmetric and larger keys sizes
But, it allows other people to send you message using your public key
No need to distribute key
MUST keep private key safe

RSA - Ron Rivest, Adi Shamir, and Len Adleman (Mathematician)
1024, 2048, or 4096 bit keys (2048 should be used as min)
ECC - Elliptic Curve Cryptography
Family of algorithms
Does not require as large key sizes
DSS - Digital Signature Standard
Used for creating digital signatures
Enhanced with ECDSA (elliptical curve DSA)
ECDH - Diffie-Hellman Key Exchange
Used for exchanging symmetric key

Encoding is not encryption! It is just a way of representing data.

Base64 encoding is a popular technique for encoding data
Commonly used to represent binary characters
It uses characters and numbers to encode 6 bits (2^6 = 64) at a time
Example:
\$ echo "secret" | base64
c2VjcmV0Cg==

We use encoding such as ASCII and UTF-8 to represent characters in binary
We can use base64 to store keys and to transmit keys as well

Generate a key:
openssl enc -e -aes-256-cbc -pbkdf2 -salt -P

Encrypt a file:
openssl enc -e -aes-256-cbc -pbkdf2 -kfile key -in secret -out secret.enc

Decrypt a file:
openssl enc -d -aes-256-cbc -pbkdf2 -kfile key -in secret.enc -out secret.dec

public - You provide this key to people, so they know what to use to send you data
private - You keep this private, this is used to decrypt the messages sent to you

Generate a private key:
openssl genrsa -out private.pem 2048

Get the public key:
openssl rsa -in private.pem -pubout > public.pem

Encrypt:
openssl pkeyutl -encrypt -inkey public.pem -pubin -in secret.msg -out secret.enc

Decrypt:
\$ openssl pkeyutl -decrypt -inkey private.pem -in secret.enc

One way "encryption"
Cannot reverse, but can still attack by testing hashed values
Used to create a signature or "store" a password
Can be used for integrity and confidentiality

MD5 - Don't Use
MD4 - Don't Use
SHA-0 - Don't Use
SHA-1 - Don't Use
SHA-2 - Can Use
SHA-256 - Should Use

Essentially: Hashes with asymmetric encryption
You generate a hash from a message and then sign it with your private key
Receiver can verify by hashing the same message and using your public key to verify
Used for non-repudiation, guarantees who sent the message

Never NEVER store passwords in the clear

Argon2id (should use)
PBKDF2 (can use)
Bcrypt (can use)

Not encryption, but relevant to this field
Hiding data within other data sources
- Changing bits in an image
- Storing data within a video

Used to attack passwords stored in a database or a system
Pre-calculated hashes with certain characters
If you find a hash, you can compare the hash in the table to find the original string
Can get very large
Using a salt (and good password policies, to come later) helps defend against this attack

Salt is used to add randomness to a hash
Protects against an attack like a rainbow table
Salts should be stored with encrypted data
You need to use it to derive the key to decrypt data
Typically prepended

Add randomness to symmetric encryption
This must be stored as well along encrypted data
Encode like a salt

- Provide a mechanism for sharing public keys
- Provide a mechanism for verifying they are who they say they are (as long as you trust who says they are who they say they are)

X.509 - Standard for formatting a certificate, defines attributes:
Version - X.509 version
Public Key - The public key of the holder
Serial Number - Unique identifier of the certificate
DN - The distinguished name of the holder
Validity - When the cert was issued and when does it expire
Digital Signature - The CA's signature on the certificate
Signature Algorithm - The algorithm Used
Other optional fields

- Create a certificate signing request (contains public key and information)
- Certificate authority does the following:
-- Verifies it is indeed the identify requesting the certificate
-- Generate a certificate that they sign with a private key
-- Issue the certificate
- Requester then installs the certificate on their web server

- The infrastructure that manages this is known as Public Key Infrastructure (PKI)

- Signs certificates
- Needs to be trusted by operating system in order to trust certificates they sign

Self-signed, installed in Operating System

Self-sign or Private CAs sometimes used for test environments

- Signed by Root CA
- Used to issue certificates
- Much easier to replace an intermediate CA instead of a Root CA

If a private key is compromised or some other vulnerability is discovered, a certificate may be revoked

There are two main mechanisms to do this:
CRL - Certificate Revocation List
- Managed by CA, these are pulled to determine if a certificate is not valid (they can be pushed as well)
OCSP - Online Certificate Status Checking Protocol
- Real time check if a certificate is valid

- Using certificates, provides a protocol to establish a secure connection to maintain confidentiality
- Certificates do not do this automatically, they are part of this

- Client and server negotiate ciphers (e.g. aes-256) as well as hash functions
- Public and Private Key (asymmetric) used to exchange symmetric key
- Symmetric is faster, but we don't have a shared key yet
- CA key is used to verify the signature on the certificate
- Pre-master key is used to create a session key (AES)

1. Client Hello (ciphersettings, SSL version, etc)
2. Server Hello (ciphersettings, SSL version, X.509 cert., etc)
3. Client authenticates the server with the CA
4. Client sends pre-master secret
5. Client has session key and finishes handshake
6. Server has session key and finishes handshake

- Created by Phil Zimmerman
- Used to encrypt email and messages
- old, but very secure
- You have to know who is sending
- Combines symmetric and asymmetric encryption
- Use the public key of a person you want to send an email to encrypt a session key (symmetric key) and the message
- No CA, you have to verify somehow (there's some services for this)

Many things!
Hosts/End Systems
Applications
Communication Links
Packets
Packet Switches
Link Layer
Routers
Transmission Rate (Bandwidth)
ISP
TCP/IP

Network of Networks
Made of Standards
Protocols
Addressing
Reliable Communication
Much more ...

Divide communication into layers of responsibility
Application
Presentation
Session
Transport
Network
Datalink
Physical

- Application data is segmented into parts to be transmitted on a network
- Original data (.e.g. "GET /") gets additional header information on each layer

- Transport Layer - Sequence numbers, flow control, etc
- Network Layer - Source and destination IP is added, TTL, checksum, etc
- Datalink Layer - Source and destination MAC address, CRC check, etc

- Packets get routed through network to their destination

- Focus on routing of data from one end to another
- Routing requires addresses to exist
- Think of Postal Service, how do we get envelope from one end to the other
- Most well know protocol: IP

- Focuses on delivery from source to destination
- What is source and destination? IP Address!
- Rule: Each connected device to Internet must have unique IP

2 Problems:
- Not enough IPv4 Addresses
- Want addresses to be private

Use NAT!
- IP address may not be unique because of NAT. But if router is exposed to internet, it's IP must be unique.
- Helps protect internal network as well

- Limited address space in IPv4 (32 bits)
- IPv6 - 128 bit address!
- Additional security (IPsec)
- Change to header format (makes processing easier)
- Additional quality of service controls
- No fragmentation in routers

Note: Double colons (::) represent 0s

- Focus on ensuring packets get from one point to another
- Offers various services that control flow of packets
- 2 Well Known Protocols: TCP and UDP

- Point to Point - One sender, one receiver
- Reliable
- Pipelined
- Send & Receive Buffers
- Full Duplex
- Connection Oriented
- Flow Controlled - Sender won't overwhelm receiver
- Acknowledgement of Packets

- Sender won't overwhelm receiver
- Receiver let's sender know how much data it can receive (rwnd)
- This is the spare room it has on it side

- Congestion can happen for many different reasons
-- End systems sending too much data
-- Core network not able to keep up
-- Unreliable medium causing packet retransmits
- Sender handles congestion with congestion window (cwnd)

- Loss segment = congestion, decrease rate
- Ack segment = good network, increase rate
- Probe network by increasing and backing off when needed

- Client sends server TCP SYN segment
- No data, sends random sequence number
- Server responds with SYN ACK segment
- Still no data, sends random sequence number
- Client sends ACK (no more SYN) and optionally sends data

- When client is done, it sends a FIN segment
- Server receives FIN, replies with ACK. It puts connection in closing state, then sends FIN.
- Client receives FIN, replies with ACK
- Goes into TIME_WAIT
- Server receives ACK, connection closed

To view current TCP traffic, you can use tcpdump:
sudo tcpdump

- UDP = lightweight, "closer" to network layer

TCP
- Provides connection oriented services
- Provides reliable transfer
- Bytes in order, no packet left behind!
- Provides congestion control
- Traditionally, not good for multimedia
UDP
- Lightweight
- No Handshaking
- Just send it and see what happens

- Attack a host or service with requests / responses
- Exhaust server resources
- Reduce availability

- Distribute the attack from multiple servers or hosts
- More requests from different sources make it harder to defend

- One popular attack is a SYN flood attack
- Perform a DDOS by spoofing IP address
- IP is not verified, SYN-ACK comes from another server

- Perform a DDOS by spoofing IP address (like TCP)
- IP is not verified, server's resources exhausted, ICMP error goes to server

Problem: Message delivered to destination, who is it for? Web Browser? Discord?

IP determines endpoint, Port determines application

nmap is a popular port scanner, can identify open ports on a server

nmap can determine version of software as well
nmap -sV localhost

We can also check strength of ciphers:
nmap -p 443 --script ssl-enum-ciphers case.edu

- Exist within Application Layer, but plays critical role in Internet Layer
- Both a Protocol and a System
- Listens on Port 53
- System is made of hierarchy of DNS servers
- Hierarchy is based on authority
- Request are made over UDP
- Server has records
- Name → IP and IP → Name

- Every publicly facing site must provide an authoritative DNS server
- This server provides names/IPs for systems within domain
- Also provides what the mail server is for email
- ISPs have their own DNS server
- DNS also provides load balancing and caching

How to get answer?
- Iterative
- Client makes request to a DNS server
- If that DNS server doesn't have answer, it returns to the client next server to ask
- Client asks next server and repeats this process until it gets answer

- Cryptographic signatures added to DNS records
- Can verify domain name comes from authoritative server, Prevent response form a rogue server
- Keys used to generate digital signature, public and private key pair, Public key is published
- To work, it needs to have widespread adoption, Has received criticism

- Similar to UDP and TCP Attacks
- Ask DNS server for ANY result
- DNS resolver essentially attacks victim with response

- Various tools to troubleshoot network
-- ping hostname|ip
- Can find route on network:
-- tcptraceroute hostname|ip
- Can find out who owns network:
-- whois.com
- Can connect to service
-- nc host port

Routers
- make up Internet core
- Determine where to send packets based on routing information
- Various algorithms to determine best route (OSPF, Djikstra's)
- Use IP Address and traffic data

Switches
- used for local network
- Determine where to send with locally connected computers
- No algorithm needed, computer has direct connection
- Use Mac Address

- Focuses on transmitting packets within network
- Use a different address: MAC Address
- Each address unique to network card
- Address can be "cloned"

- Protocol responsible for transmitting on a network
- Network used to use shared line
- Had to "listen" for communication before sending
- After sending, had to wait to hear if collision

- Send fake data packets to a switch
- Flood the switch so table fills
- Goal is that every packet coming in gets sent to all devices in "fail-open mode"

- Placed at point where level of trust changes
- Block IPs and/or ports
- Network based and host-based firewalls
- Home router acts as a firewall
- Various types:
- Packet Filter
- Stateful Packet Inspection
- Deep Packet Inspection

- Simple solution
- Examines destination IP and port and protocol being used
- Examines one packet at a time
- More sophisticated attacks can spread an attack across multiple packets

- Examines traffic from a connection (e.g. a TCP connection from a web browser to a web server)
- Connection is the pairing of a source/destination IP and port combination
- Uses a state table to keep track of connection
- Once connection closes (TCP close) any additional traffic would need to establish a new connection using TCP

- More complex, analyze content of traffic where others look at essentially the origin and destination
- Privacy issues if content is opened
- If encrypted traffic, such as TLS, not so much an issue unless proxied

- Traffic passes through areas where trust changes
- Create network zones:
- DMZ
- Internal
- Application
- Data
- and more ...
- Have redundancy within networks (load balancers)

- Used for application, example is a web proxy
- Can provide defense to application by being a reverse proxy
- Can configure in Apache web server as well
- Can be put in an external DMZ (were you have web servers in internal DMZ)

- Hardware or software
- Monitor network, hosts, applications, can determine if there is an attack based on a certain signature or anomaly
- Signature is like an antivirus
- Anomaly can be traffic or activity on the network or system
- IPS is a like an IDS, but actually prevents intrusion

- Attracts attackers to a system with the idea there is valuable data
- Larger group of honeypots is a honeynet
- Might implement countermeasures or traps for attackers

- Should use WPA2 or WPA3
- Do not use WEP
- Tools to attack wireless networks: Kismet, Aircrack-nG

- Allow you to create a secure connection between two points
- Typically used to access organization resources when offsite
- Service used at Case is Fortinet

- Should authenticate clients connected to network
- Do not allow anyone to access network by plugging into Ethernet

- SSH instead of Telnet
- SFTP/SCP instead of FTP

MITM - Man In The Middle
- Capture traffic between two endpoints
- Can modify traffic as well (we will see later with app pen testing)

- Software should be installed from trusted sources
-- Debian and other Linux OS make this easy using apt
- Software should be checked for upgrades and upgraded
-- Again, Debian and other Linux OS make this easy with apt
- Software should be removed if it is not being used
-- Every piece of additional software can prevent a vulnerability
-- Again, .... apt!

only permissions that are absolutely needed are available for users

- Default accounts may have passwords that are not changed
- For example, home router
- Good idea to change them but also restrict permissions

- Software may have default configuration that is insecure
- Or, additional configuration options can make it more secure

- Balance between usability and security

Prevent non-text region of process from being executed

Prevent attacks that depend on items being loaded in specific areas in memory

Can configure firewall rules on the OS, no hardware needed

Can install services that automate security

- Broad categorization of software that is malicious
- This includes the following:
- Viruses
- Trojan Horses
- Worms
- etc

- Spreads, self-replicates
- Can be sent in email, embedded within software, on a USB drive, etc
- Very easy to send emails with APIs (e.g. Microsoft Outlook)

- Taking a virus or other malware and making it appear as legitimate
- Can be sent via email or packaged as part of software
- Might install a key logger or open a backdoor (bind to a port and listen)

- Monitors device such as web activity, key logger, or webcam
- Transmit data to another server

- Some applications misuse permissions, they can be considered in some sense spyware
- But, the differentiation is whether permission was granted by the user
- Or, the user is made somewhat aware of data being gathered
- Can gather passwords or other sensitive information
- Can be used in conjunction with ransomware

- Can be a mechanism to deliver malware
- Sending an email to an organization to have a user install software or click on a link
- Spear-phishing - Targeting specific people in an organization
- Using whois service, company web pages, LinkedIn

- Install Antivirus software
- Do not open attachments from senders you do not know
- Be wary of senders you think you know
- Only install software from trusted sources
- Verify email senders by checking domains
- Be wary of emails with unexpected salutations, links to click on, urgency to act, grammar errors, sending gift cards for payment, princes or princesses in countries you have never been, etc