Network Security

1. Network Security EE122 Section 12

2. Question 1

3. RST RST Data B ACK SYN ACK SYN ACK Data A time • A sends a RESET (RST) to B • E.g., because application process on A crashed • B does not ack the RST • Thus, RST is not delivered reliably • And: any data in flight is lost • But: if B sends anything more, will elicit another RST Abrupt Termination

4. Application layer • TLS/SSL encrypts all application layer data • … but does not encrypt the TCP header! End-to-end Security

5. IP Header TCP Header Encrypted Content End-to-end Security TLS/SSL (Application Layer)

6. Application layer • TLS/SSL encrypts all application layer data • … but does not encrypt the TCP header! • Transport layer • TCP sequence number defends against blind spoofing • … but not man-in-the-middle attacks • Network layer • IPsec encrypts the entire IP payload, including the TCP header End-to-end Security

7. IP Header IP Header Encrypted IP Header TCP Header Encrypted TCP Header Encrypted Content Encrypted Content End-to-end Security TLS/SSL (Application Layer) IPsec (Network Layer)

8. Need to know the sequence number Blind Spoofing

12. Need to know the sequence number • How? Guess all 65536 numbers! • Alternatively, infer • first send a legitimate TCP SYN • Let’s say the receiver responds with sequence number A • Then spoof a TCP SYN assuming the receiver responds with A+1 • Defenses? Blind Spoofing

13. Question 2

14. 228.147.0.0/16

15. Source IP: 228.147.0.1 • 228.147.0.0/16

16. Source IP: 188.0.0.1 • Egress Filtering • 228.147.0.0/16

17. Source IP: 123.456.8.8 • 228.147.0.0/16

18. Source IP: 228.147.5.5 • Ingress Filtering • 228.147.0.0/16

19. Source IP: 228.147.5.5 What’s missing? • Ingress Filtering • 228.147.0.0/16

20. Receiver Attacker Source SYN SYNACK (seqno = y) ??? ACK (ackno = k?)

21. Receiver Attacker Source … Confirmation Request ??? Confirmation Response • Defenses?

22. Receiver Attacker Source … Confirmation Request (123) ??? Confirmation Response (456?) Nonce

23. Question 3

24. Web server X 1Gbps 100Mbps You Web server X can comfortably handle the load you generate

25. Slave 1 Victim Master src = randomdst = victim Slave 2 Slave 3 Distributed Denial-of-Service (DDoS) Slave 4 Slaves send streams of traffic (perhaps spoofed) to victim Control traffic directs slaves at victim

26. Cause one non-compromised host to attack another • E.g., host A sends TCP SYN with source V to server R • R sends reply to V Reflector (R) Attacker (A) SYN Internet SYNACK Reflectors Victim (V)

27. Reflector 11 Reflector 10 Reflector 1 Reflector 8 Reflector 9 Reflector 3 Reflector 6 Reflector 2 Reflector 7 Reflector 5 Reflector 4 Slave 1 Slave 2 Victim Master Reply: src = reflectordst= victim Request: src = victim dst = reflector Slave 3 Diffuse DDoS: Reflector Attack Slave 4 Control traffic directs slaves at victim & reflectors Reflectors send streams of non-spoofed but unsolicited traffic to victim

28. No good defense… • Solutions so far • Overprovision • Distribute service to multiple machines Mitigating DDOS

29. Question 4

30. Andrew Steve E(M, Stevepub)

31. Andrew Steve E(M, Stevepub) Man-In-The-Middle

32. Andrew Steve E(M’, Stevepub) Man-In-The-Middle

33. Andrewpub??? Andrew Steve E(M, Stevepub) MAC(H(M), Andrewprivate)

34. Andrew Steve E(M, Stevepub) MAC(H(M), Andrewprivate) E(Andrewpub, Stevepub)

35. E(M, Stevepub) E(Andrewpub, Stevepub) Andrew Steve MAC(H(M), Andrewprivate) Man-In-The-Middle

36. E(M’, Stevepub) E(MITMpub, Stevepub) Andrew Steve MAC(H(M’), MITMprivate) Man-In-The-Middle