Lecture 7 ~ Wireless Security ~

Assalamualaikum w.b.t...

Lam lecture kali nie encek ajr kami Wireless Security.. ermmmm... best gak lecture kali nie.. xla busannn.. ermm...

Wireless LANs
•IEEE ratified 802.11 in 1997.
~Also known as Wi-Fi.
•Wireless LAN at 1 Mbps & 2 Mbps.
•WECA (Wireless Ethernet Compatibility Alliance) promoted Interoperability.
~Now Wi-Fi Alliance
•802.11 focuses on Layer 1 & Layer 2 of OSI model.
~Physical layer
~Data link layer


802.11 Components
~Two pieces of equipment defined:
•Wireless station
*A desktop or laptop PC or PDA with a wireless NIC.
•Access point
*A bridge between wireless and wired networks
*Composed of
~Radio
~Wired network interface (usually 802.3)
~Bridging software
*Aggregates access for multiple wireless stations to wired network.


802.11 modes
~Infrastructure mode
•Basic Service Set (BSS)
*One access point
•Extended Service Set
*Two or more BSSs forming a single subnet.
•Most corporate LANs in this mode.
~Ad-hoc mode
•Also called peer-to-peer.
•Independent Basic Service Set
•Set of 802.11 wireless stations that communicate directly without an access point.
*Useful for quick & easy wireless networks.


Infrastructure mode



Ad-hoc mode



802.11 Physical Layer
~Originally three alternative physical layers
•Two incompatible spread-spectrum radio in 2.4Ghz ISM band
*Frequency Hopping Spread Spectrum (FHSS)
~75 channels
*Direct Sequence Spread Spectrum (DSSS)
~14 channels (11 channels in US)
•One diffuse infrared layer
•802.11 speed
*1 Mbps or 2 Mbps.


802.11 Data Link Layer
~Layer 2 split into:
•Logical Link Control (LLC).
•Media Access Control (MAC).
~LLC - same 48-bit addresses as 802.3.
~MAC - CSMA/CD not possible.
•Can’t listen for collision while transmitting.
~CSMA/CA – Collision Avoidance.
•Sender waits for clear air, waits random time, then sends data.
•Receiver sends explicit ACK when data arrives intact.
•Also handles interference.
•But adds overhead.
~802.11 always slower than equivalent 802.3


RTS / CTS
~To handle hidden nodes
~Sending station sends
•“Request to Send”
~Access point responds with
•“Clear to Send”
•All other stations hear this and delay any transmissions.
~Only used for larger pieces of data.
•When retransmission may waste significant time.


802.11b
•802.11b ratified in 1999 adding 5.5 Mbps and 11 Mbps.
•DSSS as physical layer.
~11 channels (3 non-overlapping)
•Dynamic rate shifting.
~Transparent to higher layers
~Ideally 11 Mbps.
~Shifts down through 5.5 Mbps, 2 Mbps to 1 Mbps.
*Higher ranges.
*Interference.
~Shifts back up when possible.
•Maximum specified range 100 meters
•Average throughput of 4Mbps


Joining a BSS
•When 802.11 client enters range of one or more APs
~APs send beacons.
~AP beacon can include SSID.
~AP chosen on signal strength and observed error rates.
~After AP accepts client.
*Client tunes to AP channel.
•Periodically, all channels surveyed.
~To check for stronger or more reliable APs.
~If found, re-associates with new AP.


Roaming and Channels
~Re-association with APs
•Moving out of range.
•High error rates.
•High network traffic.
*Allows load balancing.
~Each AP has a channel.
•14 partially overlapping channels.
•Only three channels that have no overlap.
*Best for multi cell coverage.


802.11a
~802.11a ratified in 2001
~Supports up to 54Mbps in 5 Ghz range.
•Higher frequency limits the range
•Regulated frequency reduces interference from other devices
~12 non-overlapping channels
~Usable range of 30 metres
~Average throughput of 30 Mbps
~Not backwards compatible


802.11g
~802.11g ratified in 2002
~Supports up to 54Mbps in 2.4Ghz range.
•Backwards compatible with 802.11b
~3 non-overlapping channels
~Range similar to 802.11b
~Average throughput of 30 Mbps
~802.11n due for November 2006
•Aiming for maximum 200Mbps with average 100Mbps


Open System Authentication
~Service Set Identifier (SSID)
~Station must specify SSID to Access Point when requesting association.
~Multiple APs with same SSID form Extended Service Set.
~APs can broadcast their SSID.
~Some clients allow * as SSID.
•Associates with strongest AP regardless of SSID.


MAC ACLs and SSID hiding
~Access points have Access Control Lists (ACL).
~ACL is list of allowed MAC addresses.
•E.g. Allow access to:
*00:01:42:0E:12:1F
*00:01:42:F1:72:AE
*00:01:42:4F:E2:01
~But MAC addresses are sniffable and spoofable.
~AP Beacons without SSID
•Essid_jack
*sends deauthenticate frames to client
*SSID then displayed when client sends reauthenticate frames


Interception
•Wireless LAN uses radio signal.
•Not limited to physical building.
•Signal is weakened by:
~Walls
~Floors
~Interference
•Directional antenna allows interception over longer distances.
•Directional antenna provides focused reception.


802.11 Wireless LAN
~Three basic security services defined by IEEE for the WLAN environment
•Authentication
*provide a security service to verify the identity of communicating client
stations
•Integrity
*to ensure that messages are not modified in transit between the wireless
clients and the access point in an active attack
~Confidentiality
•to provide “privacy achieved by a wired network”


802.11 Authentication



802.11b Security Services
~Two security services provided:
•Authentication
*Shared Key Authentication
•Encryption
*Wired Equivalence Privacy






Wired Equivalence Privacy
~Shared key between
•Stations.
•An Access Point.
~Extended Service Set
•All Access Points will have same shared key.
~No key management
•Shared key entered manually into
*Stations
*Access points
*Key management nightmare in large wireless LANs


RC4
~Ron’s Code number 4
•Symmetric key encryption
•RSA Security Inc.
•Designed in 1987.
•Trade secret until leak in 1994.
~RC4 can use key sizes from 1 bit to 2048 bits.
~RC4 generates a stream of pseudo random bits
•XORed with plaintext to create ciphertext.


802.11 Confidentiality



WEP – Sending
~Compute Integrity Check Vector (ICV).
•Provides integrity
•32 bit Cyclic Redundancy Check.
•Appended to message to create plaintext.
~Plaintext encrypted via RC4
•Provides confidentiality.
•Plaintext XORed with long key stream of pseudo random bits.
•Key stream is function of
~40-bit secret key
~24 bit initialisation vector
~Ciphertext is transmitted.


WEP Encryption



WEP – Receiving
~Ciphertext is received.
~Ciphertext decrypted via RC4
•Ciphertext XORed with long key stream of pseudo random bits.
•Key stream is function of
~40-bit secret key
~24 bit initialisation vector (IV)
~Check ICV
•Separate ICV from message.
•Compute ICV for message
•Compare with received ICV


Shared Key Authentication
~When station requests association with Access Point
•AP sends random number to station
•Station encrypts random number
•Uses RC4, 40 bit shared secret key & 24 bit IV
•Encrypted random number sent to AP
•AP decrypts received message
•Uses RC4, 40 bit shared secret key & 24 bit IV
•AP compares decrypted random number to transmitted random number
~If numbers match, station has shared secret key.


WEP Safeguards
~Shared secret key required for:
•Associating with an access point.
•Sending data.
•Receiving data.
~Messages are encrypted.
•Confidentiality.
~Messages have checksum.
•Integrity.
~But management traffic still broadcast in clear containing SSID.


Initialization Vector
~IV must be different for every message transmitted.
~802.11 standard doesn’t specify how IV is calculated.
~Wireless cards use several methods
•Some use a simple ascending counter for each message.
•Some switch between alternate ascending and descending counters.
•Some use a pseudo random IV generator.


Passive WEP attack
~If 24 bit IV is an ascending counter,
~If Access Point transmits at 11 Mbps,
~All IVs are exhausted in roughly 5 hours.
~Passive attack:
•Attacker collects all traffic
•Attacker could collect two messages:
*Encrypted with same key and same IV
*Statistical attacks to reveal plaintext
*Plaintext XOR Ciphertext = Keystream


Active WEP attack
~If attacker knows plaintext and ciphertext pair
•Keystream is known.
•Attacker can create correctly encrypted messages.
•Access Point is deceived into accepting messages.
~Bitflipping
•Flip a bit in ciphertext
•Bit difference in CRC-32 can be computed


Limited WEP keys
~Some vendors allow limited WEP keys
•User types in a passphrase
•WEP key is generated from passphrase
•Passphrases creates only 21 bits of entropy in 40 bit key.
~Reduces key strength to 21 bits = 2,097,152
~Remaining 19 bits are predictable.
~21 bit key can be brute forced in minutes.


Creating limited WEP keys



Brute force key attack
•Capture ciphertext.
~IV is included in message.
•Search all 240 possible secret keys.
~1,099,511,627,776 keys
~170 days on a modern laptop
•Find which key decrypts ciphertext to plaintext.


128 bit WEP
~Vendors have extended WEP to 128 bit keys.
•104 bit secret key.
•24 bit IV.
~Brute force takes 10^19 years for 104-bit key.
~Effectively safeguards against brute force attacks.


IV weakness
~WEP exposes part of PRNG input.
•IV is transmitted with message.
•Every wireless frame has reliable first byte
*Sub-network Access Protocol header (SNAP) used in logical link control layer,
upper sub-layer of data link layer.
*First byte is 0xAA
•Attack is:
*Capture packets with weak IV
*First byte ciphertext XOR 0xAA = First byte key stream
*Can determine key from initial key stream
~Practical for 40 bit and 104 bit keys
~Passive attack.
•Non-intrusive.
•No warning.


Wepcrack
•First tool to demonstrate attack using IV weakness.
~Open source, Anton Rager.
•Three components
~Weaker IV generator.
~Search sniffer output for weaker IVs & record 1st byte.
~Cracker to combine weaker IVs and selected 1st bytes.
•Cumbersome.


Airsnort
~Automated tool
•Cypher42, Minnesota, USA.
•Does it all!
•Sniffs
•Searches for weaker IVs
•Records encrypted data
•Until key is derived.
~100 Mb to 1 Gb of transmitted data.
~3 to 4 hours on a very busy WLAN.


Avoid the weak IVs
•FMS described a simple method to find weak IVs
~Many manufacturers avoid those IVs after 2002
~Therefore Airsnort and others may not work on recent hardware
•However David Hulton aka h1kari
~Properly implemented FMS attack which shows many more weak IVs
~Identified IVs that leak into second byte of key stream.
~Second byte of SNAP header is also 0xAA
~So attack still works on recent hardware
~And is faster on older hardware
~Dwepcrack, weplab, aircrack


Generating WEP traffic
•Not capturing enough traffic?
~Capture encrypted ARP request packets
~Anecdotally lengths of 68, 118 and 368 bytes appear appropriate
~Replay encrypted ARP packets to generate encrypted ARP replies
~Aireplay implements this.


802.11 safeguards
•Security Policy & Architecture Design
•Treat as untrusted LAN
•Discover unauthorised use
•Access point audits
•Station protection
•Access point location
•Antenna design


Security Policy & Architecture
•Define use of wireless network
~What is allowed
~What is not allowed
•Holistic architecture and implementation
~Consider all threats.
~Design entire architecture
•To minimize risk.


Wireless as untrusted LAN
~Treat wireless as untrusted.
•Similar to Internet.
~Firewall between WLAN and Backbone.
~Extra authentication required.
~Intrusion Detection
•at WLAN / Backbone junction.
~Vulnerability assessments


Discover unauthorized use
•Search for unauthorised access points, ad-hoc networks or clients.
•Port scanning
~For unknown SNMP agents.
~For unknown web or telnet interfaces.
•Warwalking!
~Sniff 802.11 packets
~Identify IP addresses
~Detect signal strength
~But may sniff your neighbours…
•Wireless Intrusion Detection
~AirMagnet, AirDefense, Trapeze, Aruba,…


Access point audits
•Review security of access points.
•Are passwords and community strings secure?
•Use Firewalls & router ACLs
~Limit use of access point administration interfaces.
•Standard access point config:
~SSID
~WEP keys
~Community string & password policy


Station protection
•Personal firewalls
~Protect the station from attackers.
•VPN from station into Intranet
~End-to-end encryption into the trusted network.
~But consider roaming issues.
•Host intrusion detection
~Provide early warning of intrusions onto a station.
•Configuration scanning
~Check that stations are securely configured.


Location of Access Points
•Ideally locate access points
~In centre of buildings.
•Try to avoid access points
~By windows
~On external walls
~Line of sight to outside
•Use directional antenna to “point” radio signal.


WPA
•Wi-Fi Protected Access
~Works with 802.11b, a and g
•“Fixes” WEP’s problems
•Existing hardware can be used
•802.1x user-level authentication
•TKIP
~RC4 session-based dynamic encryption keys
~Per-packet key derivation
~Unicast and broadcast key management
~New 48 bit IV with new sequencing method
~Michael 8 byte message integrity code (MIC)
•Optional AES support to replace RC4


WPA and 802.1x
~802.1x is a general purpose network access control mechanism
~WPA has two modes
•Pre-shared mode, uses pre-shared keys
•Enterprise mode, uses Extensible Authentication Protocol (EAP) with a RADIUS
server making the authentication decision
•EAP is a transport for authentication, not authentication itself
•EAP allows arbitrary authentication methods
•For example, Windows supports
~EAP-TLS requiring client and server certificates
~PEAP-MS-CHAPv2


Practical WPA attacks
•Dictionary attack on pre-shared key mode
~CoWPAtty, Joshua Wright
•Denial of service attack
~If WPA equipment sees two packets with invalid MICs in 1 second
•All clients are disassociated
•All activity stopped for one minute
•Two malicious packets a minute enough to stop a wireless network


Summary
•WAP is used on small, handheld devices like cell phones for out-of-the-office
connectivity
•Designers created WTLS (Wireless Transport Layer Security) as a method to ensure
privacy of the data because it was being broadcast
•802.11 does not allow physical control of the transport mechanism
•Transmission of all network data wirelessly transmits frames to all wireless
machines, not just a single client
•Poor authentication. The SSID is broadcast to anyone listening
•Flawed implementation of the RC4 encryption algorithm makes even encrypted traffic
subject to interception and decryption
•WEP is used to encrypt wireless communications in an 802.11 environment and S/MIME
for email


huhuhuuu.. quite byk gak la mender yg nk kne ingt lam lecture nie.. ermmm.. layann....


alhamdulillah...

"The fact you are down isn't as important as whether you are satisfied in being there."

Read More......

Lab 6 ~Security in Network~

Assalamualaikum w.b.t..

Lab 6 kiteorg blajar Security In Network.. Camner kiter nk securekn network kiter tue la bih kurengg.. huhuhuhu... tul ker erk? yer kot!... Aper yg perlu tahu:-
• Identify the vulnerabilities of FTP.
• Using Wireshark to capture FTP username and password.
• Explain what is IPSec.
• Enabling IPSec for securing FTP session.


Network Security and IPSec
A computer network is defined as a connection between two or more computer. Two computers are said to be interconnected if they are able to exchange information. Since it beginning network has become an essential tool for computer user. Computer users nowadays are depending on network, you cannot imagine the world without computer networking. At the beginning of their existence, computer networks were
primarily used by university researchers for sending email and by corporate employees for sharing printers. Under these conditions security did not get a lot of attention. But nowadays, as millions of ordinary citizens are using networks for banking, shopping and sending sensitive information, network security is required as a potentially massive problem.


Capturing File Transfer Protocol (FTP) Username and password
Normally FTP and Telnet send their username and password in clear text. This is not secure because intruder can used Network Monitoring tool such as Wireshark to sniff all the packet transfer during the session especially username and password. Therefore it is necessary to protect your username and password to overcome
any unauthorized activity.

1. Start your virtual machine containing winserv03_server and winserv03_client.
2. Login as Administrator
3. Set the IP address of your winserv03_server and winserv03_client as below

On winserv03_server
4. Check that your winserv03_server is already installed with FTP server and Wireshark. If FTP server installed than start the FTP service using [Start] | [Administrative tools] | [Internet Information Services (IIS)] otherwise you need a Windows Server 2003 CD to installed Internet Information Services (IIS) with FTP.


5. Whereas if wireshark is not install then it can be downloaded for free from http://www.wireshark.org.
6. If it is installed then open Wireshark on winserv03_server. [Start] | [Program] | [Wireshark].

7. Click on [Capture] | [Interfaces] to choose the network interfaces you wanted to monitor, refer figure 6.4. Choose the network interfaces that has an IP number 0f 192.168.1.106,click [Start], refer figure 6.X.


On winserv03_client
8. On winserv03_client VM open a command prompt, login to FTP server on winserv03_server using the following command.

On winserv03_server
9. As your login view the Wireshark interface on winserv03_server VM, you will notice that the username and password that you to login to the FTP server from the winserv03_client side is clearly seen on the monitor. Capture the screen of your
Wireshark output using print screen button on your keyboard.
10. To simulate this on the real environment you need two computers connected via a cross cable.




Using IPSec to secure FTP Transaction
IPSec is one of the solutions to safeguard the transmissionof data over FTP from being seen by an unauthorized user. Even though it is not mandatory to use IPSec in IPv4, it is already available in IPv4 and user has the choice to enable it. IPSec will encrypt the data sent using normal FTP connection, thus only the
authorized party can see the content. On winserv03_server
1. Click [Start] | [Run] and then type mmc.
2. Management Console will appear and then, on the menu bar click [File] | [Add/Remove snap-in].
3. On the Add/Remove Snap-in box, click [Add] button and select the [IP Security Monitor] and click [OK].
Figure below :

4. Repeat step 3 by selecting IP Security Policy Management on
Local Machine and then click [Finish].
5. On the Add/Remove Snap-in, click [OK].
6. In the right pane, right-click on [Secure Server (Require
Security)] | [Properties].
7. In the Secure Server (Require Security) Properties dialog box, highlight All IP Traffic and click [Edit].
8. On the Edit Rule Properties dialog box, select the Authentication Method tab. Click add and screen New Authentication Method Properties will appear. Select Use this string (preshared key) and then type MSPRESS in the scroll box, then click OK. Make sure your client preshared key must be same as server preshared key
9. Highlight the Preshared Key and click the [Move up] button to make the preshared key as a first priority for the authentication.
On winserv03_client
10. Click [OK] on the [Secure Server (Require Security)] Properties dialog box and close it.
11. Right-click on [Secure Server (Require Security)], and click [Assign] from the pop-up menu.
12. Click [Start] | [Run] and then type mmc.
13. Management Console will appear and on the menu bar click [File] | [Add/Remove snap-in].
14. On the Add/Remove Snap-in box, click [Add] button and select the [IP Security Monitor] and click [OK].
15. Repeat step 3 by selecting IP Security Policy Management on Local Machine and then click [Finish].
16. On the Add/Remove Snap-in, click [OK].
17. In the right pane, right-click on [Secure Server (Require Security)] | [Properties].
18. In the Client (Response Only) Properties dialog box, highlight and click [Edit].
19. On the Edit Rule Properties dialog box, select the [Authentication Method] tab. Click [add] and screen New Authentication Method Properties will appear. Select Use this string (preshared key) and then type MSPRESS in the scroll
box, then click [OK].
20. Highlight the Preshared Key and click the Move up button to make the preshared key as a first priority for the authentication. Click [Apply] | [OK].
21. Click [OK] on the Client (Response Only) Properties dialog box and close it.
22. Right-click on Client (Response Only), and click [Assign]. Click [Apply] | [OK].


Hmm.. lam lab kali nie aku xbejayer aplikasikan kt PC aku.. der prob per ntahh.. so, aku just tgk member yg wat kat PC dia... So far paham gak la cikit2... Xpaham pn layan ajer.. uhukksss...


alhamdulillahh...

"To the world you might be one person, but to one person you might be the world.."

Read More......

Lecture 6 ~Security In Networks~

Assalamualaikum w.b.t..

Lecture 6 kiteorg diterangkan tentang Security In Networks... Topic cover in dis lecture:-
~Introduction to Network
~Who cause security problem
~Network security issues
~Network security controls


Overview Of Computer Networks
Definition
• A computing network is a computing environment with more than one independent
processors
•May be multiple users per system
•Distance between computing systems is not considered (a communications media
problem)
•Size of computing systems is not relevant


Network Resources
•Computers
•Operating system
•Programs
•Processes
•People


Network Architecture



What is a Network Can Provide?
~Logical interface function
•Sending messages
•Receiving messages
•Executing program
•Obtaining status information
•Obtaining status information on other network users and their status


Basic Terminology
~Node
•Single computing system in a network.
~Host
•A single computing system's processor.
~Link
•A connection between two hosts.
~Topology
•The pattern of links in a network.


Types Of Network



Network Topology
Bus Topology
•To provide a single communication network on which any node can place information
and from which any code can retrieve information
•Attachments to the bus do not impact the other nodes on the bus



Star Topology
•Has a central switch
•All nodes wishing to communicate do so through the central host
•The central host receives all messages, identifies the addresses, selects the link
appropriate for that addresses and forwards the messages



Ring Topology
•To connect a sequence of nodes in a loop or ring
•Can be implemented with minimum cabling
•Containing a token can control a “synchronous” loop



Mesh Topology
•Each node can conceptually be connected directly to each other node
•Has integrity and routing advantages
•Not easily subject to destructive failures
•Routing logic can be used to select the most efficient route through multiple
nodes



ISO REFERENCE MODEL
~Open Systems Interconnection (OSI)
•Describes computer network communications.
•Developed by the International Standards Organization (ISO).
•Consists of Seven Layers.
•Model describes peer-to-peer correspondence, relationship between corresponding
layers of sender and receiver.
•Each layer represents a different activity performed in the actual transmission of
a message.
•Each layer serves a separate function.
•Equivalent layers perform similar functions for sender and receiver.


Layer Responsible



Message Assembly In ISO Model



Networks As Systems
~Single System
•Single set of security policies associated with each computing system.
•Each system concerned with:
*integrity of data
*secrecy of data
*availability of service
•Operating system enforces its owns security policies.


Advantages Of Computing Networks
~Resource sharing
•Reduces maintenance and storage costs.
~Increased reliability (i.e. availability of service)
•If one system fails users can shift to another.
~Distributing the workload
•Workload can be shifted from a heavily loaded system to an underutilized one.
~Expandability
•System is easily expanded by adding new nodes


Who Cause Security Problem
•Hacker
•Spy
•Student
•Businessman
•Ex-employee
•Stockbroker
•Terrorist
•etc


Network Security Problem Area
~Authentication
•Deals with determining whom you are talking to before entering into a business
deal or before revealing sensitive information
~Secrecy
•What usually comes to mind when people think about network security
~Non-repudiation
•Deals with signature
~Integrity control
•Keeping information is not modified, add or delete by unauthorized user


Network Security Issues
~Disadvantages of computing networks
•Sharing
*Access controls for a single system may be inadequate.
~Complexity
•A network may combine two or more systems with dissimilar operating systems with
different mechanisms for interhost connection. Complexity of this nature makes
the certification process extremely difficult.
•Unknown perimeter
*One host may be a node on two or more different networks.
~Disadvantages of computing networks
•Many points of attack
*Access controls on one machine preserves the secrecy of data on that processor.
However, files stored in a remote network host may pass through many host
machines to get to the user.
•Unknown path
*May be many paths from one host to another and users generally do not have
control of how their messages are routed.
•Label formats differences
*A problem which may occur in multilevel systems is that the access labels may
have different formats since there is no standard.
~Disadvantages of computing networks
•Anonymity
*Attack can passed through many other hosts in an effort to disguise from where
the attack originated
*Attack remotely without contact the system administrator or user


Threats In Network
~Security Exposures
•Privacy
*With many unknown users on a network, concealing sensitive data becomes more
difficult.
•Data Integrity
*Because more nodes and more users have potential access to a computing system,
the risk of data corruption is higher.
•Authenticity
*It is difficult to assure the identity of a user on a remote system.
•Covert channels
*Networks offer more possibilities for construction of covert channels for data
flow.
~Impersonating
•Involved the use of physical keys and biometrics checks
•Cracker can configures a system to masquerade as another system, thus gaining
unauthorized access to resources or information on system that ‘trust’ the system
being mimicked
~Eavesdropping
•Allows a cracker to make a complete transcript of network activity
•Cracker can obtain sensitive information such as passwords, data and procedures
for performing functions.
•Cracker can eavesdrops:
*Using wiretapping
*By radio
*Via auxiliary ports on terminals
*Using software that monitors packets sent over the network.
~Denial of service
•A user can render the system unusable for legitimates users by ‘hogging’ a
resource or damaging or destroying resources
•Attacks may be caused deliberately or accidentally
•3 forms of network denial of service attacks:
*Service overloading
*Message flooding
*Signal grounding
~Packet replay
•Refers to recording and retransmission of message packets in the network
•Intruder could replay legitimate authentication sequence messages to gain access
to a system
•Frequently undetectable
~Packet modification
•Significant with integrity threat
•Involves a system intercepting and modifying a packet destined for another system


Networks Security Control
~Encryption
~Strong Authentication
~IPSec,VPN,SSH
~Kerberos
~Firewall
~Intrusion Detection System (IDS)
~Intrusion Prevention System (IPS)
~Honeypot


Encryption
~Link to Link VS End to End
~Link to Link
•Covers layer 1 and 2 of the OSI model
•Decryption occurs just as the communication arrives at and enters the receiving
computer.
•If we have good physical security, we may not be too concerned about this
exposure.
~End to End
•Provides security from one end of a transmission to the other layer 6 or 7
•The encryption can be done by:
*A hardware device between the user and the host.
*A software running on the host computer.
•Protect data on every layer


Strong Authentication
~In strong authentication, one entity ‘proves’ its identity to another by
demonstrating knowledge of a secret known to be associated with that entity,
without revealing that secret itself during the protocol.
~Also called ‘challenge-response’ authentication.
~Use cryptographic mechanisms to protect messages in protocol:
•Encryption.
•Integrity mechanism (e.g. MAC).
•Digital signature.


IPSec,SSH,SSL(application level sec.)
~IPSec
•Optional in IPv4
•Defines a standard means for handling encrypted data.
•Implemented at IP layer, so affects all layer above it, in particular TCP and UDP.
•Provide authentication (AH) and encryption (ESP)
~SSH
•Secure remote login (encrypt data send over the network)
~SSL
•Secure socket layer, encrypt data over the transport layer.
•SSL interfaces between applications (such as browsers) and the TCP/IP protocols
to provide server authentication, optional client authentication, and an
encrypted communications channel between client and server.


Kerberos
~Supports authentication in distributed systems.
~Kerberos is based on the idea that a central server provides authentication tokens,
called tickets, to requesting applications.
•A ticket is an unforgeable, nonreplayable, authenticated object.
•It is an encrypted data structure naming a user and a service that is allowed to
obtain.
•Also contain a time value and some control information.



Firewall
•What is a firewall?
•A Firewall is a network security device designed to restrict access to resources
(information or services) according to a security policy.
•Firewalls are not a “magic solution” to network security problems, nor are they a
complete solution for remote attacks or unauthorised access to data
•A Firewall is a network security device
•It serves to connect two parts of a network and control the traffic (data) which
is allowed to flow between them
•Often installed between an entire organisation's network and the Internet
•Can also protect smaller departments
•A Firewall is always the single path of communication between protected and
unprotected networks
•A Firewall can only filter traffic which passes through it
•If traffic can get to a network by other means, the Firewall cannot block it


Intrusion Detection System
~Is a device or software tools or hardware tools that monitor activity to identify
malicious or suspicious events
~Used to detect unauthorized access to a computer system or network
~IDS component
•Sensor
*generate security events
•Console
*to monitor events and alerts and control the sensors
•Central Engine
*records events logged by the sensors in a database and uses a system of rules to
generate alerts from security events received
~Types of IDS
•Signature based
•Anamoly based


Intrusion Prevention System
~network security device that monitors network and/or system activities for
malicious or unwanted behavior and can react, in real-time, to block or prevent
those activities
~Network-based IPS, for example, will operate in-line to monitor all network traffic
for malicious code or attacks
~When an attack is detected, it can drop the offending packets while still allowing
all other traffic to pass
~Intrusion prevention technology is considered by some to be an extension of
intrusion detection (IDS) technology
~In addition, most IPS solutions have the ability to look at (decode) layer 7
protocols like HTTP, FTP, and SMTP which provides greater awareness


Honeypot
~Decoy systems that are designed to lure a potential attacker away from critical
systems
~Design to
•Divert attacker from critical system
•Collect information on attacker’s activity
•Encourage attacker to stay long enough for admin. to notice
~Contain fabricated info. not for normal user to used
~Simulated traffic that emulate real network


Hacking And Prevention
~motivated by thrill of access and status
•hacking community a strong meritocracy
•status is determined by level of competence
~benign intruders might be tolerable
•do consume resources and may slow performance
•can’t know in advance whether benign or malign
~IDS / IPS / VPNs can help counter
~awareness led to establishment of CERTs
•collect / disseminate vulnerability info / responses
~Hacker Behavior Example
1. select target using IP lookup tools
2. map network for accessible services
3. identify potentially vulnerable services
4. brute force (guess) passwords
5. install remote administration tool
6. wait for admin to log on and capture password
7. use password to access remainder of network


Criminal Enterprise
~organized groups of hackers now a threat
•corporation / government / loosely affiliated gangs
•typically young
•often Eastern European or Russian hackers
~common target credit cards on e-commerce server criminal hackers usually have
specific targets
~once penetrated act quickly and get out
~IDS / IPS help but less effective
~sensitive data needs strong protection


Criminal Enterprise Behavior
1. act quickly and precisely to make their activities harder to detect
2. exploit perimeter via vulnerable ports
3. use trojan horses (hidden software) to leave back doors for re-entry
4. use sniffers to capture passwords
5. do not stick around until noticed
6. make few or no mistakes.


Inside Attacker
~among most difficult to detect and prevent
~employees have access & systems knowledge
~may be motivated by revenge / entitlement
•when employment terminated
•taking customer data when move to competitor
~IDS / IPS may help but also need:
•least privilege, monitor logs, strong authentication,
~termination process to block access & mirror data


Inside Behavior Example
1. create network accounts for themselves and their friends
2. access accounts and applications they wouldn't normally use for their daily jobs
3. e-mail former and prospective employers
4. conduct furtive instant-messaging chats
5. visit web sites that cater to disgruntled employees, such as f'dcompany.com
6. perform large downloads and file copying
7. access the network during off hours.


Hacking And Prevention
~Exploitation of machine/Unauthorized used of machine and network resources
~Hacking involves 5 phase
•Reconaisance
•Scanning
•Gaining access
•Maintaining access
•Covering track


Reconaisance And Scanning
~Gaining general information on the target host
•Company background
•Number of machine
•Types of machine
•OS
•Domain name
•IP address
•Location


How To?
~Find out initial information
*Google,whois,Nslookup
~Find out address range
*ARIN
*Traceroute
~Find active machine
*Ping
~Find open port
*Ports scanner
*Nmap
*War dialers
~Figure out OS
*Nmap
~Map Out Network
*VisualRoute


Gaining And Maintaining Access
~The info. Gather from previous step can help identifying vulnerabilities
~Exploit vulnerabilities to gain access
*Un patch system is dangerous as the vulnerabilities has been made worldwide
*Milw0rm.com, www.securityfocus.com, insecure.org and etc
*Vulnerabilities is used to install backdoor than can be used for future attack.
~Tools are available online
*Backtrack, metasploit and etc


Covering Track
~Every activity is logged
~Syslog, accesslog, eventlog,


Lam lecture nie encek go thru jer semue coz encek ckp kiteorg da biaser sgt daa blajar mender nie.. ermm.. mmg pn.. tp.. kiteorg jer xbraper nk ingt.. encek kater bacer ajer sniri.. bacer ajer ler...


alhamdulillah...

"Live your life in the manner that you would like your kids to live theirs.."

Read More......

Lab 5 ~ Web Application Security ~

Assalamualaikum w.b.t...

Lab 5 kali nie kiteorg blajar Web Application Security... Apa yg kiteorg blajar adalah camner menggunakan Web Application Hacking simulation using WebGoat and WebScarab. Antare objektif yg perlu dicapai:-
• Describe the flaw of web application and how it is exploited.
• Exploit web application vulnerabilities.
• List prevention method that can be taken to overcome web
application vulnerabilities

Web Application Security
Web application or simply called webapp is an application that can be accessed using a web browser over a network, either the Internet or within the Local Area Network. It is developed using browser-supported language such as HTML, JavaScript, PHP, ASP
and etc. The script produced is then rendered by common web browser. Web application let user to access application or system anywhere and at any time provided the user is connected to a network connection and there is a web browser installed on the
machine. This ease of usage makes webapp popular among Internet user. Moreover the ability to update and maintain web applications without distributing and installing software on potentially thousands of client computers contribute to the
popularity of the webapp. Nowadays webapp is used for accessing mail, online banking, online shopping, online reservation, wikis and many other functions.


WebGoat and WebScarab
WebGoat is a simulation toolkit used to demonstrate how we can exploit the vulnerabilities of a poorly design web application. The design of the web application in the WebGoat is deliberately designed with insecure J2EE framework so that user can understand the security issue by applying the security knowledge
they have into exploiting a real vulnerability in WebGoat application. In every scenario of the lesson, WebGoat provide hints and code to further explain the lesson. WebGoat will keep track on the progress of the user on every lesson they completed, user can see their level of competence in trying to solve every problem given in the lesson.


Web Application Hacking simulation using WebGoat and WebScarab
1. Copy the WebGoat-OWASP_Standard-5.2.zip and extract it to the C:\ drive
2. Open the C:\ WebGoat-5.2 folder and open the webgoat.bat to start the apache
tomcat J2EE

3. Open an IE 6.0 web browser or a firefox web browser and type http://localhost/WebGoat/attack

4. login as User Name: guest Password: guest

5. open webscarab-selfcontained-20070504-1631.jar
6. If the WebScarab does not open do install the JDK module (jdk-6u4-windows-i586-
p.exe) to your computer.
7. Once the WebScarab started, you should see the interface as figure below

8. Next Configure the Web browser proxy starting so that it listen to 127.0.0.1
(localhost) port 8008
9. Go to WebScarab and click on the intercept tab and enable the intercept request
checkbox but disable the intercept response checkbox. This will enable the
intercept features of the WebScarab in which it will intercept any request
signal from the web browser.

10. Close your previous web browser, open it again and type in
http://localhost/WebGoat/attack.
11. WebScarab will intercept your request to visit the website by prompting an Edit
request window as depicted in figure below. This prompted window shows the
request data that you send to the web server.

12. The text field indicated by the arrow shows the text field containing the data
you send to the web server and it can be modified.(in some of the following task
you need to modified the content of the text field to help you solve the problem
in lesson.
13. For this task do not changes the text field value just click the [Accept
changes] button to view the WebGoat main page.
14. Each time you click on a submit button or a link on the webpage, the Edit
request window will always appear, so make sure you click on Accept changes
button to view your request page display on the browser.



Getting started with WebGoat and WebScarab
1. click on [Start WebGoat]

2. Click on the Introduction | How to work with WebGoat menu.

3. Read and follow the instruction given in the WebGoat.



XSS attack
Task
1. This lesson will show you how XSS is used for phishing attack
2. Click on the Cross Site Scripting (XSS) | Phising with XSS menu.
3. Apply the script below to the text field in order to create a false login page so
that you can harvest the username and password keyed in by the user.


4. Once you hit the Search button you will see a comment page containing a place for you to login. This login page is created using the java script above.
5. Try login in with any username and password; if this is a real phishing website you would not get the prompted message on your screen but the value you supplied might be send across the world to a server that gather the login
information.
6. Next click on the Cross Site Scripting (XSS) | Reflected XSS Attacks menu.
7. In this lesson some prevention mechanism has been build in the script, some field have a validation toward the character you supplied. It will reject any tag symbol you used, however there are still some that is not protected. By using
the script below find which the text field that can be exploited using XSS attack?




Injection Flaws
Task
1. This lesson will show you how SQL Injection is applied to an application system.
2. Click on the Injection Flaws | Numeric SQL Injection menu, refer figure below

3. From the combo list choose a weather station and click the [Go!] button, (Do not
forget to click on the accept changes button of the edit request windows) you
will get the information for the country you select.
4. To apply the Injection flaws you need to choose a new country and click [Go!]
button. Before clicking the [Accept changes] button on the edit request windows,
in the [URLEncoded] tab, add the value station variable with

5. Once the value is changed, click [Accept changes] button. The entire data is
displayed on the screen. This shows that by manipulating the input field that is
not properly design we can display the entire data in the database.

6. Repeat this task on the Injection Flaws | String SQL Injection. Use the right
input for this problem and compare the result. (Hint: The input should be a
string).


Malicious File Execution
Task
1. This lesson will show you how Malicious File Execution is applied to an online application system.
2. Click on the Injection Flaws | Command Injection menu, refer figure below

3. By choosing the lesson plan to view and clicking on [View] button, user will be
shown the content of the lesson. This exercise will manipulate the input field by
adding the input with a command line instruction.
4. Select a new lesson and click [View]. Before clicking the [Accept changes] button
add the following command to your HelpFile variable value

5. Once you click the [Accept changes] button the following output will be displayed
on the screen.



Mase muler2 aku mmg xpham.. then tgk bdk2 laen wat.. so far ok laaa... buat2 ler faham.. yuhuuu.... Mcm beser siap kan review question..


alhamdulillah...

"Worry is like a rocking chair -- it gives you something to do but doesn't get you anywhere.."

Read More......

Lecture 5 ~Program Security~

Assalamualaikum w.b.t...

Lecture 5 kiteorg blajar bab Program Security... Topic lam lecture nie:-
~Vulnerabilities
•Secure Program
•Malicious Code
•Top 10 Web application vulnerabilities
~Safeguard to Program threat
~Pillar to Software Security


Secure Programs
~Different people have different perspective on software quality.
~Tracking faults (from developers):
•Requirements
•Design
•Code inspectionsNote: fixing might cause more faults
~Failures - are effects of faults
~Vulnerability and flaws do not map to faults and failures
~"Bugs" means different things, depending on context.
~IEEE says "fault" is inside view from the developer Failure - outside view from
user
~Types of Flaws:
•validation error
•domain error
•serialization and aliasing
•inadequate identification and authentication
•boundary condition violation
•other exploitable logic errors


Nonmalicious Program Errors?
~Buffer Overflows
•Accidental not checking array bounds Example C program

~Incomplete Mediation - data exposed or uncontrolled
http://www.testing.com/order.asp?cutID=115&part=666&qty=3&price=500&total=1500
~Time of Check to Time of use
•the process of executing the instruction
•Process all the data in the local storage rather than put on the clipboard.


Viruses and Other Malicious Code
•Programs work on data and users usually don't see the raw data.
•Malicious users can make programs that access data and other programs other than
what was intended.
•Malicious code can do harm.
•Malicious code has been around for a long long time (70's).
•Malicious code can also be accidental.


Malicious Codes
~unanticipated or undesired effects in programs generated on the intent of damage
~damage could be in form of :
•modification/destruction
•stolen data
•unauthorized access
•damage on system
•or other forms not intended by users


Viruses and ”Malicious Programs”
•Computer “Viruses” and related programs have the ability to replicate themselves
on an ever increasing number of computers. They originally spread by people
sharing floppy disks. Now they spread primarily over the Internet (a “Worm”).

•Other “Malicious Programs” may be installed by hand on a single machine. They may
also be built into widely distributed commercial software packages. These are
very hard to detect before the payload activates (Trojan Horses, Trap Doors, and
Logic Bombs).


Taxanomy of Malicious Programs



Examples of malicious codes:
~Trojan Horse - a program which performs a useful function, but also performs an
unexpected action as well.
~Virus - a code segment which replicates by attaching copies to existing executables.
•Transient - only executes when the program that it is attached to runs.
•Resident - once the program executes the virus stays in memory until it gets
triggered again. Terminate and Stay Resident (TSR).
•Worm - a program which replicates itself and causes execution of the new copy.
•Bacteria - replicates until it fills all disk space, or CPU cycles
•Logic bomb - malicious code that activates on an event (e.g., date).
•Trap Door (or Back Door) - undocumented entry point written into code for
debugging that can allow unwanted users.
~Spyware - This is new and can be non-malicious or malicious.
•Can steal your information (Identity Theft) This is done with a keystroke logger
and even though you use encryption on connections the damage is already done
before you can send it.
•Can steal your email addresses
•Can see what Web sites you visit
•Can see contents of files
•PopUp ads
•Slow down your computer
•Crash your computer



Viruses
~Personal computer viruses exploit the lack of effective access controls in these
systems
•modify files and OS itself
~Characteristics of a virus:
•replication
•requires a host program as a carrier
•activated by external action
•replication limited to (virtual) system
~Viruses are currently designed to attack single platforms.
~A virus can be referred to for example, as an IBM-PC virus (referring to the
hardware) or a DOS virus (referring to the hardware)
~The unexpected and uncontrollable replication of viruses makes them so dangerous.


How Viruses Attach
~Append viruses - execute first then transfers control to original program.
~Surround virus -has control before and after regular program.
~Integrated viruses - replace some of the target program or all of the target and
give the effect that the target program worked.


Virus Appended to a Program



How Viruses Gain Control
~The virus needs to have the CPU execute it to be in control.
~One way is to overwrite the program on the disk.
~Another is to move the original program and then after the CPU executes it then
transfer control to the program.
~Another is to install itself in memory and change the pointers of the operating
system or interrupt table to point to it.


Homes for Viruses
•Install itself in the boot sector (MBR) master boot record.
•Memory resident virus - (TSR) terminate and stay resident.
•Other homes such as applications like word processors and spread sheets and even
attachments to email.
•Even attachments to vendor distributed programs or games.


Types of Viruses
•Parasitic Virus - attaches itself to executable files as part of their code. Runs whenever the host program runs.

•Memory-resident Virus - Lodges in main memory as part of the residual operating system.

•Boot Sector Virus - infects the boot sector of a disk, and spreads when the operating system boots up (original DOS viruses).

•Stealth Virus - explicitly designed to hide from Virus Scanning programs.

•Polymorphic Virus - mutates with every new host to prevent signature detection.


Truths and Misconceptions About Viruses
•Although other computers/operating systems are vulnerable to Viruses, it seems the
mentality of the programmers of Viruses is more common on PCs.
•Viruses can modify hidden and read only files. True
•Viruses can appear only in data files or Word docs, or in programs. False
•Viruses spread only on disks or in e-mail. False
•Viruses can not live in memory when the computer is shut off, but they can still be
on other storage devices. Also Reboot (warm start) is vulnerable to Viruses in
memory. True
•Viruses cannot infect hardware. True
•Viruses can be malevolent, benign, or benevolent. True


How Worm Attack




Worms
~Characteristics of a worm:
•self-contained, do not require a host
•replication
•activated by creating process
•for network worms, replication occurs across communication links
~Worms exploit flaws in the operating system or inadequate system management to
replicate.
~Release of a worm usually results in brief but spectacular outbreaks, shutting down
entire networks.
~Protection against Worms
•requires a combination of basic system security and good network security
•add-on tools:
*configuration review tools
*checksum-based change detection tools
*intrusion detection tools
•network security tools:
*wrapper program : filter network connections
*firewall system
~The most important means of defense is the identification & authentication (I&A)
controls, which are usually integrated into the system. If poorly managed, these
controls become a vulnerability which is easily exploited.



Targeted Malicious Code
~The previous notes have dealt with anonymous code not targeted to a specific
system, application or a particular purpose.
~Trapdoors - secret, undocumented entry point into a module or program.
~Salami Attack


Trapdoors and the Salami Attack
~Trapdoors are often caused by programmers leaving debug routines in the code. Or
failure to check array bounds which lets code overrun the array bounds and get
placed on the stack.
~Causes of Trapdoors:
•Programmer forgets to remove them.
•Programmer intentionally leaves them in for testing.
•Leaves them in intentionally for maintenance of the finished product.
•Leaves them in for later covert means of access.
~Salami Attacks refer to the simple fact, that when dealing with real numbers the
computer has a fixed size and will perform rounding or truncation. There will
always be those programmers that will try to conceal the small amounts on the hope
that humans will not notice



Top 10 web app vulnerabilities
~Attack associated to programs error
•Cross site scripting
•Injection flaws
•Malicious file execution
•Insecure direct object reference
•Cross site request forgery
•Information leakage and improper error handling
•Broken authentication and session management
•Insecure crypto storage
•Insecure comms
•Failure to restrict URL access



Virus Signatures
~Virus cannot be completely invisible but can be very hard to detect, especially if
it has self-modifying code.
~The code it executes can be identified and a program can scan for the tell-tail
code.
~Usually it is at the start of a program or maybe a test and jump to code at the
bottom of the file.
~If the virus writer wants to keep the program size the same to prevent detection
then it has to replace some of the program code.
~But a good scanner with a checksum can detect the changes in the code.


Example of cod red worm sign
GET/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a


The Source of Viruses
•Virus program can be small so it hides very easily in a large program.
•Might hide in a compiler, a data base manager or a file manager.
•The number one spot is an attachment to email or some public download file.


Virus Phases
•Dormant phase - the virus is idle
•Propagation phase - the virus places an identical copy of itself into other
programs
•Triggering phase – the virus is activated to perform the function for which it was
intended
•Execution phase – the function is performed



Preventing Virus Infection
~Protection against viruses
•detection tools
*example : scanners, vulnerability monitors, modification detection programs
•identification tools
*example : scanners
•removal tools
*example : disinfectors Ways to prevent Virus infections
~Scanners and disinfectors are the most popular classes of anti-virus software.
~Personal and administrative practices and institutional policies with regard to
shared or external software usage should form the first line of defense.
~Ways to prevent Virus infections
•Use only commercial software acquired from reliable, well established vendors.
•Test all new software on an isolated computer.
•Do not put a floppy disk in the machine unless it has been scanned first.
•Do not open attachments to email unless they have been scanned. Including turn
off the auto open of attachments in mail readers.
•Scan any downloaded files before they are run.
•At least once a week update the virus signature data files.
~Make a bootable disk with a virus scan program on it and write protected.
~Make and retain backup copies of executable system files in the event the virus
detection program can't remove the virus.


Preventing Web application attack
•Input validation.
•Strong output encoding.
•Do not use "blacklist" validation
•Do not use GET requests (URLs) for sensitive data or to perform value transactions
•Disable or limit detailed error handling
•errors from all layers are adequately checked and configured to prevent error
messages from being exploited by intruders
•Do not allow the login process to start from an unencrypted page
•Encrypt Password
•Check the old password when the user changes to a new password
•Do not create cryptographic algorithms
•Do not use weak algorithms
•Ensure the access control matrix is part of the business, architecture, and design
of the application


Controls Against Program Threats
•Software Engineering
•Modularity, Encapsulation, and Information Hiding
•Peer reviews
•Hazard Analysis HAZOP, FMEA, FTA
•Independent Testing
•Good Design
•Prediction
•Static Analysis
•Configuration Management
•Proofs of Program Correctness
•Operating System Controls - trusted software, confinement, audit log
•Administrative Controls - Standards of program development


Pillar of software security
•Risk Management
•Touchpoints
•Knowledge


Risk Management
•Business understands the idea of risk even software risk
~Technical perfection is impossible
~There no such thing as 100% security
•Perfect quality is a myth
•Technical problem do not always spur action
~Answer the So what? Question explicitly
•Help user undesrtand what they should do about risk
•Build better software


Touchpoints



Knowledge catalog
~Principles
~Guidelines
~Rules
~Attack patterns
~Vulnerabilities
~Historical Risks


Summary of Program Threats and Controls
~Malicious code gets a lot of publicity. But don't let media attention distract you
from the seriousness of the threat.
~There is no real way to measure the amount of damage that malicious code can do.
All one can do is estimate, and that is only for the discovered programs, what
about the ones that haven't been discovered or haven't been executed, or worst the
ones that haven't been written yet.



Summary
~Viruses come in different forms
~Some are mere nuisances, some come with devastating consequences
~E-mail worms are self replicating and clogs the networks with unwanted traffic
~Virus codes are not necessarily complex
~It is necessary to scan the systems/networks for infections on a periodic basis for
protection against viruses
~Anti-dotes to new virus releases are promptly made available by security companies
and the forms the major counter measure.


Tue la antare yg kami blajar lam lecture kali nie... Enjoy ajer!...


alhamdulillah...

"Learn to enjoy little things -- there are so many of them.."

Read More......