Foundations of Network and Computer Security John Black Lecture #20 Oct 17th 2007 CSCI 6268/TLEN 5831, Fall 2007 Announcements Project #0 Due on Friday Hand print-out in, in class If CAETE mail to Martin (See web page for Martin's email and OH) Martin's OH, Mondays, 11am, CSEL 122 Friday will be a midterm review session Tomorrow's Colloquium is my tenure talk Come if you like... not mandatory Networking Refresher For some of you this will be boring... sorry The basic model: Backbone (not a single line these days) ISP Et h ISP Et h LAN user1 LAN user2 Basic Networking Suppose user1 sends a UDP packet to user2, what happens? What's UDP? <a href="/keyword/user-datagram-protocol/" >user datagram protocol</a> Just like IP but with ports Well, first we need an IP address! What's an IP address For IPv4, it's a &quot;dotted quad&quot; of bytes Ex, 128.138.242.21 32 bits For IPv6, it's 128 bits 16 bytes in hex separated by colons Sending a UDP packet Assume IPv4 Get IP address via DNS Domain Name Service Distributed database mapping textual names to IP addresses Insecure DNS spoofing More on this later Ok, so we have an IP address And we presumably have a port # Pack it Up! Eth Header IP Header UDP Header Src addr, Dest addr, Chksm Src IP, Dest IP, Len, Chksm, TTL Src Port, Dest Port, Len, Chksm Ethernet addresses are called &quot;MAC addresses&quot; Ethernet checksum is actually appended to end of packet Ethernet MTU is 1500 bytes Message Routing on a Network Usually done via OSPF or LSP for LANs <a href="/keyword/open-shortest-path/" >open shortest path</a> First, Link-State Protocol These protocols assume &quot;modest sized&quot; networks A routing protocol decides how to forward packets based on routing tables BGP is used on backbone <a href="/keyword/border-gateway/" >border gateway</a> Protocol Routes using incomplete information Local Routing Table Our local routing table (on host of user1) is not going to have a route to IP of user2 Routing table will therefore send our packet to the gateway Gateway is the machine/router on the &quot;edge&quot; of the network responsible for processing all incoming/outgoing traffic from/to the LAN NAT boxing, firewalling, and other stuff is usually done here as well Getting to the Gateway How to we route to the IP address of the gateway on our local Ethernet? ARP (Address Resolution Protocol) Translates IP addresses into MAC addresses Caches old lookups, so we probably already have the MAC address of the gateway If not, we send an ARP Request to the LAN, including the IP address whose MAC we seek Owner (ie, the gateway) sends ARP Reply with his MAC address and we cache it Usually, all other machines who hear the ARP Reply cache it as well Leads to attacks... more later Sending to the Gateway Now we have the MAC address of the gateway Send our packet to the gateway via the Ethernet protocol This is usually done with a hardware device (network card) which often puts the Eth header on your packet for you, computes checksums, etc. Broadcasts packet, detects collisions <a href="/keyword/exponential-backoff/" >exponential backoff</a> Promiscuous mode Sniffers use this Works through hubs, but doesn't work through switches on a switched Ethernet You can often fool switches Gateway Receives Eth Packet Strips Eth header and again tries to route the resulting IP packet Looks in routing table, sends to ISP ISP probably routes using BGP Reaches other ISP Note that we're using other Ethernets and similar physical-layer protocols for each hop! Other ISP routes to other LAN's gateway Gateway sees IP is in its range and does ARP to route to user2 User2 Receives Packet User2 receives the IP packet Removes IP header No one else (is supposed to) look inside packet until user2 receives it NAT boxes break this rule Firewalls break this rule See it's a UDP packet and &quot;sends&quot; to proper port Ports are mapped to applications via listento() Application receives message and processes it Other Protocols We didn't even talk about SLIP or PPP ATM, FDDI, Wireless What about DHCP? Dynamic IP addresses There is also ICMP Internet Control Message Protocol Echo (ping), traceroute Application Layer Protocols SNMP Network Management SMTP Sendmail POP/IMAP Mail protocols MTU Maximum Transmission Unit MTU for Ethernet is 1500 bytes If MTU is exceeded, packet is &quot;fragmented&quot; IP has support for packet fragmentation and reassembly A packet is broken into as many pieces as necessary to comply with MTU Fragments routed as regular IP datagrams, independent of each other Reassembly done at host only IP Best Effort Datagrams IP is &quot;best effort&quot; There is no tracking of packets If something is dropped... oh well If one fragment is dropped, many transport layer protocols (like TCP) will consider the whole thing lost and not ACK This seems bad, but it's one of the biggest successes of IP UDP is IP with ports, so it too is &quot;best effort&quot; TCP Transmission Control Protocol Stateful connections Runs over IP just like UDP, but adds more than just ports Establish a connection with listen() and connect() IP and UDP were &quot;stateless&quot; protocols Reliable delivery Unlike best-effort, this protocol guarantees delivery of packets, in proper order Uses sequence numbers, sliding windows, ACKs every transmission Crypto on a Network How do we do crypto on a network? We've seen application-layer examples SSL/TLS, SSH This is called &quot;end-to-end&quot; cryptography, meaning between hosts The routers don't care if the innermost part of each packet (the &quot;payload&quot;) is ciphertext or plaintext IPSec IPSec does crypto at the network layer (the IP layer) Extremely well-engineered; hardly used We won't study IPSec in this course Network Security: The <a href="/keyword/biggest-challenge/" >biggest challenge</a> s What are the biggest problems now, today, on the Internet What are the most common types of attacks? Viruses, worms Break-ins via software vulnerabilities Denial of Service attacks (DoS) And Distributes Denial of Service (DDoS) What about keyloggers, spyware, rootkits? Not as relevant to network security More likely to be end-results of other break-ins A recent virus was found to install a keylogger Viruses (Worms) Today, most everyone just calls them viruses Technically most are &quot;worms&quot; Worm is a self-contained propagating program Viruses embed in other programs and selfreplicate Kind of like viruses in biology Viruses: History Morris Worm, Nov 2n...