1 of 86

Network Security

Chapter 3

Panko and Panko

Business Data Networks and Security, 10^th Edition, Global Edition

2 of 86

The Target Breach

Attacks and Attackers

Protecting Dialogs Cryptographically

Other Forms of Authentication

Firewalls

Antivirus Protection

3 of 86

The Target Breach

Christmas Season 2013
BlackPOS malware “scrapes” transaction data
Debit/credit transactions of 40 million customers
In separate attack, information stolen on 70 million Target customers
Sales losses, stock decline, technology officer fired, CEO fired

https://zh.wikipedia.org/wiki/%E7%9B%AE%E6%A8%99%E7%99%BE%E8%B2%A8#%E5%AE%89%E5%85%A8%E4%BA%8B%E4%BB%B6

4 of 86

3.1 The Target Breach

BlackPOS

5 of 86

3.1 The Target Breach

E-Mail Spear Phishing Attack

Fazio Mechanical Services

6 of 86

3.1 The Target Breach

7 of 86

3.1 The Target Breach

Not shown:

Constant ongoing

command and control communication from the outside

8 of 86

3.1 The Target Breach

偽造者

9 of 86

The Target Breach

Attacks and Attackers

Protecting Dialogs Cryptographically

Other Forms of Authentication

Firewalls

Antivirus Protection

10 of 86

3.2 Malware and Vulnerabilities

Malware

A general name for evil software

Malware attacks

11 of 86

3.2 Malware and Vulnerabilities

Vulnerabilities (安全漏洞/弱點)

Security flaws in specific programs
Enable specific attacks against these programs
Vendors release patches to close vulnerabilities
However, users do not always install patches promptly or at all, so continue to be vulnerable
Also, zero-day attacks occur before the patch is released for the vulnerability

12 of 86

3.3 Viruses and Worms

Viruses

Pieces of code that attach themselves to other programs

Worms

Stand-alone programs that do not need to attach to other programs

13 of 86

3.3 Viruses and Worms

Typical Propagation Vectors

E-mail attachments
Visits to websites (even legitimate ones)
Social networking sites
Many others (USB RAM sticks, peer-to-peer file sharing, etc.)
These requires human gullibility, which is slow

易受欺騙

14 of 86

3.3 Viruses and Worms

Directly propagating worms

Jump to victim hosts directly
Target hosts must have a specific vulnerability for this to succeed
No action is necessary on the part of the victim
Directly propagating worms can spread with amazing speed
In 2003, SQL Slammer infected most of its 75,000 victims within ten minutes.

15 of 86

3.4 Other Types of Malware

Mobile Code on Webpages

HTML webpages can contain scripts
Commands in a simplified programming language
Scripts are called mobile code because they are downloaded with the webpage
Scripts are normally benign but may be damaging if the browser has a vulnerability

良性的

16 of 86

3.4 Other Types of Malware

Trojan Horses

Trojan horses are programs that disguise themselves as system files.
Spyware Trojans collect sensitive data and send the data to an attacker

假扮，偽裝

17 of 86

3.4 Other Types of Malware

Downloaders

Malware that downloads a larger malware program onto the infected computer

Spam

Unsolicited Commercial E-Mail

18 of 86

3.5 Payloads

After propagation, viruses and worms execute their payloads
Malicious payloads do damage

Payloads can erase hard disks
Payloads can send users to pornography sites if they mistype URLs

Even malware without payloads can do damage

Not all malware has payloads—malicious or otherwise
Can still cause computer to run slowly or crash

19 of 86

3.6 Attacks on Human Judgment

Social Engineering

Tricking the victim into doing something against personal or organizational security interests
Open E-Mail Attachments, visit websites, etc.

20 of 86

3.6 Attacks on Human Judgment

Phishing Attacks

A sophisticated social engineering attack in which an authentic-looking e-mail or website entices the user to enter his or her username, password, or other sensitive information

Spear phishing attacks

Spear phishing attacks are directed at a particular individual.

誘使,慫恿

21 of 86

22 of 86

3.6 Attacks on Human Judgment

Credit Card Number Theft

Uses stolen credit card numbers to make unauthorized transactions

Identity Theft

Involves collecting enough data to impersonate the victim in large financial transactions
Can result in much greater financial harm to the victim than credit card theft
May take a long time to restore the victim’s credit rating

23 of 86

3.7 Human Break-Ins (Hacking)

Hacking

Intentionally using a computer resource without authorization or in excess of authorization.
The key issue is authorization.

24 of 86

3.8 Stages in an Attack

Exploit

The actual break-in
The tool used is also called an exploit

After the Break-In

Manually exploits the resource
Leaves a Trojan horse behind for continuous automated exploitation

剝削

25 of 86

3.9 Distributed Denial-of-Service (DDoS) Attack with Bots

Denial-of-Service (DOS) attack: an attack to make a computer or entire network unavailable to its legitimate users.

Availability

26 of 86

3.9 Distributed Denial-of-Service (DDoS) Attack with Bots

The collection of compromised computers is called a botnet.

27 of 86

SYN Flood

https://en.wikipedia.org/wiki/SYN_flood
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

28 of 86

TCP three-way handshake

SYN Flood

https://en.wikipedia.org/wiki/SYN_flood

29 of 86

3.10 Advanced Persistent Threats

Long-term attack on an organization

Can last months or even years

Uses extremely advanced techniques

Often begins with a spear phishing attack

Difficult and expensive to do

So usually done by national governments
Although well-funded criminal groups can do it

30 of 86

3.11 Types of Attackers

Hackers

Old-school hackers driven by curiosity, a desire for power, and peer reputation
Today, most hackers are career criminal hackers who hack for money
Criminal attackers are well-funded and have an online criminal infrastructure

Purchase malware
Hire expertise when needed
Credit card “fences, “etc.

31 of 86

3.11 Types of Attackers

Malware Attackers

It is not illegal to write malware.
It is illegal to release malware against a company.

32 of 86

3.11 Types of Attackers

Employees, Ex-Employees, and Other Insiders

Current employees: revenge or theft
Extremely dangerous

Already have access
Know the systems
Know how to avoid detection
Are trusted by the organization

報復

Insiders

33 of 86

3.11 Types of Attackers

Employees, Ex-Employees, and Other Insiders

IT and security employees are the most dangerous
Ex-employees are Dangerous, so all access must be terminated before Leaving
Contractors with access permissions are also “insiders”

34 of 86

3.11 Types of Attackers

Cyberterrorists

Cyberterror attacks by terrorists
Cyberwar by nations
Dangerous because tend to be sophisticated
Dangerous because focus on doing widespread damage instead of committing isolated crimes

35 of 86

The Target Breach

Attacks and Attackers

Protecting Dialogs Cryptographically

Other Forms of Authentication

Firewalls

Antivirus Protection

36 of 86

Protecting Dialogs Cryptographically

Cryptography is the use of mathematics to protect information.
Confidentiality

Symmetric Key Encryption

Message Authentication and Integrity

Electronic Signature (Digital Signature)

37 of 86

3.12 Symmetric Key Encryption for Confidentiality

Symmetric Key Encryption: Two sides share a single key to encrypt and decrypt messages.

38 of 86

3.12 Symmetric Key Encryption for Confidentiality

39 of 86

3.12 Symmetric Key Encryption for Confidentiality

40 of 86

3.12 Symmetric Key Encryption for Confidentiality

128 bits

41 of 86

Public-Key Cryptography (Asymmetric Cryptography)� – Encryption for Confidentiality

Each party (entity) has a pair of keys:

Public key which may be distributed widely.

Private key which is known only to the owner.

Bob

Alice

42 of 86

Public-Key Cryptography - Authentication

* Either key can be used for encryption, the other for decryption.

Bob

Alice

43 of 86

3.13 Electronic Signature Authentication

Authentication means proving a sender's identity.
Message integrity: the receiver is able to detect if the packet is altered by an attacker while the packet is in transit.

44 of 86

Host-to-Host Virtual Private Networks (VPNs)

https ://en.wikipedia.org/wiki/Virtual_private_network

SSL: Secure Socket Layer (Netscape)

TLS: Transport Layer Security (IETF)

* SSL/TLS is supported widely in Web browsers.

45 of 86

The Target Breach

Attacks and Attackers

Protecting Dialogs Cryptographically

Other Forms of Authentication

Firewalls

Antivirus Protection

46 of 86

3.15 General Authentication Concepts

Credential: Proof of identity.

47 of 86

3.16 Reusable Password Authentication

Reusable Passwords

Passwords are strings of characters
They are typed to authenticate the use of a username (account) on a computer
They are used repeatedly and so are called reusable passwords.

Benefits

Ease of use for users (familiar)
Inexpensive (often free) because they are built into operating systems.

48 of 86

3.16 Reusable Password Authentication

Often Weak (Easy to Crack)

Hackers use password dictionaries that include common passwords, names, and simple variations such as capitalizing the first letter and adding a number at the end

Dictionary attacks can crack almost all passwords in seconds or minutes.

A password that can be cracked using a dictionary can never be adequately strong-no matter how long it is.

Processing1

49 of 86

3.16 Reusable Password Authentication

Passwords Should Be Long and Complex

Should have a minimum of eight to twelve characters
Should mix case, digits, and other keyboard characters ($, #, etc.)
Example: r8pWm#4D*&2B
Can only be cracked with brute force attacks (trying all combinations of characters)
This is very difficult and often impossible
However, long, complex passwords are often written down

50 of 86

3.17 Other Forms of Authentication

Perspective

Goal is to replace reusable passwords

Access Cards

Permit door access
Can be used for computer access
Proximity access cards do not require physical contact

51 of 86

3.17 Other Forms of Authentication

Biometrics

Biometrics uses body measurements to authenticate you
Vary in cost, precision, and susceptibility to deception
Fingerprint recognition

Inexpensive but poor precision, deceivable
Sufficient for low-risk uses
On a notebook, may be better than requiring a reusable password

可欺騙的

52 of 86

3.17 Other Forms of Authentication

Iris recognition

Based on patterns in the colored part of your eye
Expensive but precise and difficult to deceive

Facial recognition

Based on facial features
Controversial because can be done surreptitiously—without the supplicant’s knowledge

暗中地

爭論的

53 of 86

Social Credit System in China

https://en.wikipedia.org/wiki/Social_Credit_System

https://youtu.be/fM3KONWxgIo?t=97

54 of 86

3.18 Digital Certificate Authentication

Challenge and Response

55 of 86

3.18 Digital Certificate Authentication

Certificate Authority (CA): a trusted organization which distributes�the public key of a person in a document called a digital certificate.

56 of 86

3.18 Digital Certificate Authentication

57 of 86

自然人憑證

http://moica.nat.gov.tw/

58 of 86

印鑑證明

59 of 86

3.18 Digital Certificate Authentication

True Party	Has a Public and Private Key
Supplicant	Encrypts challenge message with supplicant’s private key
Verifier	Decrypts response message with true party’s public key
Choice	If decryption works, supplicant knows the true party’s private key so must be the true party

60 of 86

3.19 Two-Factor Authentication

Supplicant needs two forms of credentials
Example: debit card and PIN
Strengthens authentication
Fails if

Attacker controls user’s computer
Attacker can intercept authentication communication

攔截

61 of 86

The Target Breach

Attacks and Attackers

Protecting Dialogs Cryptographically

Other Forms of Authentication

Firewalls

Antivirus Protection

62 of 86

3.20 General Firewall Operation

63 of 86

3.20 General Firewall Operation

64 of 86

3.20 General Firewall Operation

What happens if a provable attack packet arrives?
What happens if a legitimate packet arrives?
What happens if a packet that is probably an attack packet arrives?

What are the implications of the answer?

65 of 86

3.21 States in a Conversation

Stateful Inspection Firewalls use the concept of communication states

66 of 86

3.22 Stateful Packet Inspection (SPI)

What would the firewall do with

a packet containing a SYN segment?

67 of 86

3.22 Stateful Packet Inspection (SPI)

What would the firewall do with

a packet containing a FIN segment?

68 of 86

3.22 Stateful Packet Inspection (SPI)

What would the firewall do with

a packet containing a pure ACK segment?

69 of 86

3.22 Stateful Packet Inspection (SPI)

Yes (Trying to Open a Connection)

70 of 86

3.23 Access Control Lists (ACLs) for Attempts to Open a Connection

Rule	Destination IP Address or Range	Service	Action
1	ALL	25	Allow connection
2	10.47.122.79	80	Allow connection
3	ALL	ALL	Do not allow connection

What will the SPI firewall do if the destination host is 10.47.122.79 and the service is 80?

71 of 86

3.23 Access Control Lists (ACLs) for Attempts to Open a Connection

What will the SPI firewall do if the destination host is 10.47.122.79 and the service is 25?

Rule	Destination IP Address or Range	Service	Action
1	ALL	25	Allow connection
2	10.47.122.79	80	Allow connection
3	ALL	ALL	Do not allow connection

72 of 86

3.23 Access Control Lists (ACLs) for Attempts to Open a Connection

What packets will match the third row?

Rule	Destination IP Address or Range	Service	Action
1	ALL	25	Allow connection
2	10.47.122.79	80	Allow connection
3	ALL	ALL	Do not allow connection

73 of 86

3.22 Stateful Packet Inspection (SPI)

No (Not Trying to Open a Connection)

74 of 86

3.22 Stateful Packet Inspection (SPI)

	Internal Host		External Host
Connection	IP Address	Port	IP Address	Port
1	128.171.17.13	3270	10.74.118.4	80
2	128.171.34.5	4747	60.3.5.75	25

Approved Connections Table

What if the internal IP address is 128.171.34.5, the external IP address is 60.3.5.75 and the source and destination ports are 4747 and 25?

75 of 86

3.22 Stateful Packet Inspection (SPI)

Approved Connections Table

What if the internal IP address is 128.171.34.9, the external IP address is 60.3.5.75 and the source and destination ports are 4747 and 25?

	Internal Host		External Host
Connection	IP Address	Port	IP Address	Port
1	128.171.17.13	3270	10.74.118.4	80
2	128.171.34.5	4747	60.3.5.75	25

76 of 86