index.md (4737B)
1 +++ 2 title = "Lecture 2: Network security 1" 3 +++ 4 5 # Lecture 2: Network security 1 6 7 Recap: computer networks has several layers 8 9  10 11 ## Local Area Network attacks 12 The attacker is present directly on the local network. 13 14 ### Sniffing 15 Attacker sets network interface to promiscuous mode 16 => can access all traffic on the segment. 17 18 Why? 19 - Many protocols (FTP, POP, HTTP, IMAP) send auth info in plaintext 20 - You can collect personal data 21 22 Tools 23 - dsniff, filesnarf, mailsnarf...: passively monitor network for interesting data 24 - arpspoof, dnsspoof, macof: help sniff 25 - sshmitm, webmitm: man-in-the-middle attacks against redirected SSH and HTTPS 26 27 Detecting sniffers: 28 - typically passive and in promiscuous 29 - can be detected directly by ifconfig, cpm, ifstatus 30 - but kernel-level rootkits can hide them 31 - suspicious DNS lookups: try to resolve names associated with IP address, you can trap them by generating connection from fake IP not on local network and see if someone resolves it 32 - latency: since promiscuous mode processes every packet, measure response time of the host 33 - unusual behavior (e.g. specific to kernels) 34 35 If we want to sniff: TCPDump (analyses traffic on network segment, can use expressions to filter packets) 36 - expressions: `<qualifier> <id>` 37 - `<qualifier>`: 38 - type: defines the entity kind (host, net, port) 39 - dir: direction of traffic (src, dst, src and dst) 40 - proto: specifices protocol (ether, ip, arp, rarp) 41 - operators can be used (logical, relational, binary) 42 - can access packet data 43 44 But switched ethernet doesn't allow direct sniffing... 45 solutions: 46 - MAC flooding: 47 - switches have table with MAC address/port mappings 48 - flooding the switch with invalid MAC addresses may overflow table memory and revert its behavior from "switch" to "hub" 49 - MAC duplicating/cloning: 50 - reconfigure your host to have same MAC address as machine whose traffic you want to sniff 51 52 ## Spoofing 53 ARP spoofing with forwarding 54 - ARP == address resolution protocol 55 1. ARP `who-has <ip>` packet sent to broadcast, contains sender's MAC address and IP address 56 2. Person with address `<ip>` replies with `arp reply` and their MAC address 57 - attacks: 58 - ARP doesn't provide authentication 59 - if you're faster than queried host, you can provide false IP/link-level address mapping 60 - fake ARP queries can be used to store wrong mappings in host cache 61 - since ARP is stateless, you send fake replies even if there wasn't a request 62 - man-in-the-middle attack: 63 - attacker creates two alias interfaces with IP addresses of A and B 64 - disable attacker's ARP functions (`ifconfig -arp`) 65 - set attacker's ARP caches to correct values (`arp -s host mac_addr`) 66 - attacker sets IP forwarding between two interfaces 67 - => traffic flows A<->B but through attacker's machine 68 69 You can use tools for these attacks, or you can create your own packets (made easier with libnet). 70  71 72 IP spoofing (local network) 73 - host impersonates another by sending datagram with address of other host as source address 74 - attacker sniffs network looking for replies from attacked host 75 76 Spoofing remotely 77 - blind IP spoofing: 78 - host sends IP datagram with address of some other host as source address 79 - host replies to legitimate host 80 - usually attacker doesn't have access to reply 81 82 UDP spoofing 83 - DNS: 84 - DNS maps name to IP address. can be recursive (via root↔TLD↔authoritative servers) or iterated (local DNS communicates with root/TLD/authoritative server in turn) 85  86 - attacks: 87 - simple: e.g. if authentication is based on DNS name, the DNS server can reply with a fake trusted name under the control of the attacker. countermeasure: double lookup, for both IP address and name, and compare results. 88 - advanced: poisoning. every DNS query has a random ID; the reply ID has to match. 89 - birthday attack: in group of 23 people, probability of 2 having same birthday is 50%. so use the same for DNS — send n queries and n replies for every request, with different query ids. 90 - Kaminsky's trick: the attacker can own the entire domain. request random name within target domain to avoid cache, send stream of forged DNS responses to victim with glue records (designating nameservers) pointing to the attacker's IP addresses 91 92  93 94 ## Hijacking 95 Steps: 96 - attacker waits for client request 97 - races against legitimate host to produce reply 98