Security

Recall that there are layers in a network stack

• Communication goes down to physical network
• Then up to relevant layer

Application layer (too many to cover).

• applications in this layer present a wide range of diverse threats like server-side vulnerabilities (e.g., buffer overflow, SQL injection, XSS), sppam, phishing, account theft.
• leading to many cybercrimes
• not our focus

General goals for communication security (CIA):

• Confidentiality: no one reads our communication; cryptography
• Message Integrity: no one can modify our communication w/o detection; verification
• Availability and Authentication: Redundancy, Dos/DDoS prevention; only we can access our data and communicate on our behalf

TCP Security

Recall that source and destination port/IP define a connection. The sequence number of a packet defines its place in the stream.

Recall the TCP 3-way handshake:

1. client sends SYN with SeqNum x
2. server returns SYN+ACK, SeqNum y, ACK x+1
3. client sends ACK+DATA, SeqNum x+1, ACK y+1
4. server sends ACK and data

In a abrupt termination in TCP: A sends a RESET (RST) to B. E.g., because application process on A crashed. Then, that's it and B does not ack the RST. Thus, RST is not delivered reliably, and any data in flight is lost. An attacker who knows ports and sequence numbers can disrupt any TCP connection.

So a TCP RST injection looks like the following:

A connection hijacking is to take over an already-established connection instead of RST injection.

• This is even worse.

Root cause: attacker can see packet contents and thus knows port/IP and SeqNum

A TCP data injection is when the client processes the wrong data.

SSL

The Secure Socket Layer (SSL) is a transport layer security for TCP-based apps. Used between Web browsers and servers (HTTPS). It provides the following security services:

• server authentication (is it really your bank's server)
• data encryption (transaction not altered)
• client authentication (optional)

SSLv3 was the ancestor of IETF's Transport Layer Security (TLS).

SSL/TLS sits between the Application and TCP layer. SSL provides application programming interface (API) to applications. There are C and Java SSL libraries/classes readily available.

TCP security issues:

• an attacker who observes packets can
  • forcefully RST connections
  • inject forged data
• these issues are still a major challenge today, so they use SSL/TLS to provide confidentiality, data integrity, and authentication

IP Security

While SSL protects TCP header and its payload, what about the IP header?

The integrity of the IP address. IP source address should be the sending host.

However, what if you can send packets with any source you want? People would use a bogus source address to launch a denial-of-service attack.

• send excessive packets to the destination to overload the node, or the links leading to the node.
• but, victims can identify/filter you by the source address which is why you spoof your address. Evade detection by spoofing which is putting someone else's source address in the packet (or use many different ones so they cannot be filtered).

IP Options misuse: source route lets sender control path taken through network, which can be used to side step security monitoring.

• IP options often processed in router's slow path, which means that attacker can try to overload routers

Because of the risks associated with IP options (IP options are typically set within a private network set by servers, it should not be set by clients anyways. In fact, IPv6 doesn't even support options), firewalls are configured to drop packets with options.

Security implications of ToS:

• attacker sets ToS priority for their traffic. If regular traffic does not set ToS, then network will prefer the attack traffic, increasing damage
• Today, network ToS generally does not work. ToS is redefined for differentiated service. Mostly set/used by network operators, not end-systems.

Security implications of fragmentation:

• allows evasion of network monitoring/enforcement
• e.g., split an attack across multiple fragments. Packet inspection won't match a "signature" (the signature )
• Monitor must remember previous fragments: but that costs state, which is another vector of attack.

Another fragmentation attack:

• What happens if attacker doesn’t send all of the fragments in a packet?
• Receiver (or firewall) winds up holding the ones they receive for a long time. This is called State-holding attack

Security implication of TTL:

• allows discovery of topology (a la traceroute)
• can provide a hint that a packet is spoof.
  • it arrives at a router w/ a TTL different than packets from the address usually have because path from attacker to router has different # hops.
  • brittle in the presence of routing changes.
• initial value is somewhat distinctive to the sender's operating system. This plus other such initialization allow OS fingerprinting, which allow attacker to infer its likely vulnerabilities.

Other security implications:

• no apparent problems with the protocol field. It's just a demuxing handle. If set incorrectly, next layer will find packet ill-formed.
• Bad IP checksum field will cause packet to be discarded by the network: not an effective attack.

Network Layer Threats

Security at the network layer: there are security concerns that apply to multiple applications and cut across protocol layers. Benefits of network-layer security:

• below transport layer: transparent to applications
• can be transparent to end users
• help secure routing architecture

IPSec

IPsec: Network layer security provides:

• network-layer authentication: destination host can authenticate source IP address
• network-layer confidentiality and integrity:
  • sending host encrypts the data in IP datagram.
• two principle protocols:
  • authentication header (AH) protocol
  • encapsulation security payload (esp) protocol
  • mandatory in IPv6, optional in IPv4

IPsec transport mode:

• IPsec datagram emitted and received by end-system
• protects upper level protocols
• the routers/switches can also be IPsec aware

VPN

Virtual private network (VPN) makes separated IP sites look like one private IP network. IP address and domain names (useful for authorization)

• security via IPsec tunnels
• building a real private network is expensive (its cheaper to use shared resource rather than dedicate resources)

End-to-end VPN: solves the problem of connecting remote hosts to a firewalled network. Commonly used for roaming, benefits in the form of security and private addresses only.

Physical and Link Layer Issues

Eavesdropping/sniffing:

• for subnets using broadcast technologies (e.g., wifi, pre-2000 ethernet), it's free
• for any technology, routers/switches transferring the data can look at/capture/export data

Denial of service (DOS):

• overload/jam signals (e.g., in wireless networks)
• introduce ill-formed frames/packets
• just drop frames/packet

Spoofing:

• introduce forged frames/packets
• more powerful when combined with eaves dropping (we've seen example already in upper layers)

DHCP vulnerability: attacker can listen to DHCP requests that new host broadcast

• can respond with forged offers before the actual DHCP server: essentially, taking over DNS, gateway, and other core information, and insert itself as a man-in-the-middle.