digital forensics

- Security information and event management

• Previously known as the demilitarized zone (DMZ)
– An additional layer of security between the Internet and you
– Public access to public resources

• Protocol for reading and writing directories over an IP network
– An organized set of records, like a phone directory

• X.500 specification was written by the International Telecommunications Union (ITU)
– They know directories!
• DAP ran on the OSI protocol stack
– LDAP is lightweight, and uses TCP/IP (tcp/389 and udp/389)

• LDAP is the protocol used to query and update an X.500 directory
– Used in Windows Active Directory, Apple OpenDirectory, OpenLDAP, etc.

• Hierarchical structure - Builds a tree

• Container objects
– Country, organization, organizational units

• Leaf objects
– Users, computers, printers, files

• Terminal Access Controller Access-Control System
– Remote authentication protocol
– Created to control access to dial-up lines to ARPANET

• TACACS+
– The latest version of TACACS, not backwards compatible
– More authentication requests and response codes
– Released as an open standard in 1993

• Modify the DNS server
– Requires some crafty hacking

• Modify the client host file
– The host file takes precedent over DNS queries

• Send a fake response to a valid DNS request
– Requires a redirection of the original request or the resulting response
– Real-time redirection
– This is an on-path attack

• Some switches support automatic configuration
– Is the switch port for a device, or is it a trunk?

• There’s no authentication required
– Pretend to be a switch
– Send trunk negotiation

• Now you’ve got a trunk link to a switch
– Send and receive from any configured VLAN

• Switch administrators should disable trunk negotiation
– Administratively configure trunk interfaces and device/access interfaces

• Define different VLANs

• You only have access to your VLAN
– Good security best practice

• “Hop” to another VLAN - this shouldn’t happen

• Two primary methods
– Switch spoofing and double tagging