VIDEO Intypedia013en LESSON 13: DNS SECURITY. AUTHOR: Javier Osuna García-Malo de Molina. GMV Head of Security and Process Consulting Division

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "VIDEO Intypedia013en LESSON 13: DNS SECURITY. AUTHOR: Javier Osuna García-Malo de Molina. GMV Head of Security and Process Consulting Division"

Transcription

1 VIDEO Intypedia013en LESSON 13: DNS SECURITY AUTHOR: Javier Osuna García-Malo de Molina GMV Head of Security and Process Consulting Division Welcome to Intypedia. In this lesson we will study the DNS domain name system that is widely used on the Internet. We will analyse its usefulness, weaknesses and the measures that can be taken to minimize attacks. Join us! SCENE1. THE DNS SYSTEM. BASIC CONCEPTS Hi Bob, this morning the travel agency where a friend of mine works had a problem with their website and how their customers accessed it. I have checked their website and it looks like an attacker has taken advantage of the DNS system to simulate the agency's website. Their intention was to impersonate the agency and steal its customer's data. Given that I haven't studied in depth how DNS works internally, could you give me some advice to guide my friend? Of course, Alice, let's get into it. As you know, Internet is a network of millions of interconnected computers. Usually, addressing schemes are used to locate each specific computer. In an analogue world, this would equal the postal addresses that allow us to send letters to each household. On the Internet, however, it is common to use schemes based on numbers: depending on the amount and size of these numbers, you can "access" more or less computers. Script Intypedia013en 1

2 Right. For the Internet, the addressing scheme based on IP addresses is widely used. For example, I read that if the protocol is IPv4, then the addresses will have four numbers separated by periods, like: Indeed. This system is great for machines to exchange information, but people find it much easier to memorize descriptive names instead of multi-digit numbers. For example, to call someone on the phone, first you look their name up on your contact list. It is much easier to associate a name or a nickname to a person than a telephone number. The same thing goes for a computer or an electronic device. This is precisely where domain name systems like the DNS are useful. They allow the translation of more or less descriptive "human" addresses into "machine" addresses, in this case IP addresses. For example, it is easier to memorize or even guess the address of the UPM University "www.upm.es" than to work with its IP address " ". And not only that, it also allows other functions like sending s. The DNS system has its origins in the early 80's. Before that, a more rudimentary system was used: the contents of an OS file named "hosts" associated the domain name with an IP. Like a sort of local contact list. Nowadays, the DNS is a hierarchical and distributed database system, where the initial element of this system is known as a root server. To simplify this system, we generally refer to DNS clients and DNS servers. The former is software run by a computer to generate DNS requests to resolve domain names, while the later will attempt to answer the request. If they don't know the answer to a client's request they can forward the request to another server. On the Internet you can delve into the architecture and communication of this system and the importance of DNS records for a correct domain name resolution of websites, s, etc. It is important to highlight that due to the fact that the number of IP addresses, the number of DNS requests and user demands increased considerably, the DNS system had to implement measures to improve response time and performance. To do this, the DNS to which we connect from our home or office, usually stores the association between a domain name, which has already been consulted, and one or more IP's in a temporary memory. The access to this memory, which is called cache, is much faster. So every time I enter a URL in my browser I'm performing a DNS request? Well, strictly speaking, not every domain name resolution has to be a request to a DNS. In fact, Web browsers and operating systems often have a cache too. It is also possible to introduce the association between a domain name and an IP in the "hosts" file as was done before the existence of the DNS. Script Intypedia013en 2

3 For example, in the Windows operating system this can be done in C:\windows\System32\drivers\etc\hosts. How interesting! And by what you are saying, it seems that this system is more critical than I first thought. That's right. Companies and public organisations are aware of the importance and the impact that their unavailability may cause. For this reason, security is extremely high in the most important elements of the system, such as root servers that often face DoS attacks, for example. In any case, we will discuss some of the most famous attacks to the system in order to see the scale of this and also analyse what happened to your friend's server. SCENE2. ATTACKS TO THE DNS. PURPOSES Let's cut to the chase, Bob. What can you tell me about the most famous attacks to this system and, most importantly, what are the real purposes of these attacks? Let's see. Nowadays, without the DNS architecture, Internet communications would be rather complicated: accessing websites, sending s, etc. In practice, attackers use DNS to their advantage for identity theft, spying or stealing information. I'll summarize some of the typical attacks, although, possibly in future lessons, we'll take a closer look at each one of them. 1. Pharming Most attacks related to domain resolution have the purpose of stealing user's access credentials from banks, shops, social networks, online gaming, etc. To achieve this, they redirect a legitimate website's traffic to a false website specially designed to replace the first one. It can also be done with . Locally, one of the most common forms of pharming is to change the "hosts" file in the attacked operating system. This can be done using a Trojan. Similarly, it would be possible to modify the request to the DNS commands of the OS and to change the Internet connection settings related to the DNS. The modification of the DNS, whether changing its local settings or the DNS servers to which users connect over the Internet or by a man-in-the-middle attack, will normally cause the redirection of traffic. In addition to the problems of impersonation and theft, we should pay attention to this issue because it would allow the monitoring of communications, i.e., spying. In fact, there are currently proposals to eliminate dependence on traditional DNS architecture that could be controlled by only a few countries. Solutions like DNS over p2p, OpenDNS, OpenNIC and others, are mentioned more and more often. Script Intypedia013en 3

4 2. DNS cache poisoning In a "DNS cache poisoning" the attacker requests the attacked DNS for a domain that is hosted on another DNS controlled by the attacker, which we will call "malicious DNS". Since the attacked DNS doesn't have that domain in its cache, it will end up sending a request to the malicious DNS. The malicious DNS will not only answer with the IP associated to the requested domain, but also with fraudulent IP s joined with domains, such as banks. The attacked DNS will reply to the attacker's initial request with the domain IP he asked for and will save in the cache the rest of malicious domain/ip associations. The attacked DNS, from that moment until it clears its cache, will return the fraudulent IP s when it receives requests associated with the additional domains the malicious DNS answered with. In the summer of 2008, researcher Dan Kaminsky released a series of new findings that proved the seriousness of the poisoning problem and how it can even be applied on a global scale over the Internet. For example, it could be used to compromise application upgrades, which is known as "evilgrade", so that an attacker could impersonate the site from where we download the OS updates. 3. DNS ID Spoofing with Sniffing DNS ID Spoofing is basically impersonating an identity in a DNS. To use this attack we must be able to listen or to "sniff" the traffic generated by the target user's machine. To begin with, the user will send a request to a DNS this must have an ID between 1 and that the attacker can discover just by sniffing. Before the DNS replies, the attacker has to reply using the same identifier as the request sent to the original port, which has also been discovered. This reply will associate the accessed domain with a fraudulent IP. Then the deceived user's machine will receive a non malicious reply that it will discard, since it has already received another with the same identifier. As you can see, in most cases the problem comes because the DNS traffic requests and responses isn't authenticated, allowing attackers to impersonate and tamper easily. This attack is an example of a man-in-the-middle attack to the DNS protocol. There certainly are quite a few attacks. Are there any more? Okay, this one is exceptional: do you think there is a way of knowing if a DNS has resolved a domain before we ask for it? Script Intypedia013en 4

5 Mmm... Well I don't know. The answer is yes. That is called "DNS cache snooping". For example, from a DNS used by a company's employees we could obtain information like the banks the company works with, the banks its employees work with, its customers, suppliers, political profiles of its employees, the software they have installed and so on. In fact, other attacks based on zone transfer were very common in the past. These would exploit the misconfiguration of a DNS server to dump the data of the domains it managed. In the particular case of an organization's DNS server, with this attack you could obtain a complete map of the organization's internal network: hosts, internal IP addresses, and so on. But that doesn't seem that bad... Well, sure, it's less dangerous than other attacks, but besides having legal implications, that information could also be used to perform attacks such as phishing, social engineering or to effectively exploit software vulnerabilities. There are also other uses that take advantage of the DNS architecture, but we will have time to talk about steganography with DNS, malware distribution via DNS, fast flux, and so on in the future. SCENE 3. RECOMMENDATIONS AND SECURITY. Bob, what can be done to minimize those attacks? I have to give my friend some advice at least... On one hand we have traditional measures. From a user's perspective, we have to take the appropriate steps to ensure that our computers and routers are properly protected. As we already discussed in previous lessons, this entails: upgrading our software, configuring the antivirus properly, using a firewall, a proper password policy... In most cases the attacks will come this way. On the other hand, if your mission is to protect an infrastructure, then you should have a strong access control and an effective monitoring system; you should raise awareness among employees about social engineering techniques; only allow access to the DNS cache from machines hosted within the internal network; have the updated versions of software implemented in the DNS; configure services correctly... In addition, if in the worst case scenario you suffer an attack, it is essential to have the DNS trace of whom, what and Script Intypedia013en 5

6 when changes are made to the DNS information. This way you will be able to detect what happened and how. Without doubt, the biggest problem of the DNS is that its design didn't consider security aspects. Today there are standards such as DNSSEC (Domain Name System Security Extensions) from the IETF (Internet Engineering Task Force), which provide authentication and integrity of data exchanged via DNS using public key cryptography, thus hindering spoofing attacks. We need to be aware of these proposals to improve global security. You have clarified many things, Bob. Thanks. I think with this information I can guide my friend so she can advise her customers the safest way to connect to her agency. I think that is enough for today. On the Intypedia website you can find additional information for this lesson, especially on the DNS system architecture. See you later. See you soon! Script adapted to the Intypedia format from the document sent by Javier Osuna García-Malo de Molina Madrid, Spain. March Script Intypedia013en 6

Lesson 13: DNS Security. Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division

Lesson 13: DNS Security. Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division Lesson 13: DNS Security Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division Introduction to DNS The DNS enables people to use and surf the Internet, allowing the translation

More information

DOMAIN NAME SECURITY EXTENSIONS

DOMAIN NAME SECURITY EXTENSIONS DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions

More information

VIDEO Intypedia012en LESSON 12: WI FI NETWORKS SECURITY. AUTHOR: Raúl Siles. Founder and Security Analyst at Taddong

VIDEO Intypedia012en LESSON 12: WI FI NETWORKS SECURITY. AUTHOR: Raúl Siles. Founder and Security Analyst at Taddong VIDEO Intypedia012en LESSON 12: WI FI NETWORKS SECURITY AUTHOR: Raúl Siles Founder and Security Analyst at Taddong Hello and welcome to Intypedia. Today we will talk about the exciting world of security

More information

ARP and DNS. ARP entries are cached by network devices to save time, these cached entries make up a table

ARP and DNS. ARP entries are cached by network devices to save time, these cached entries make up a table ARP and DNS Both protocols do conversions of a sort, but the distinct difference is ARP is needed for packet transfers and DNS is not needed but makes things much easier. ARP Address Resolution Protocol

More information

WPAD TECHNOLOGY WEAKNESSES. Sergey Rublev Expert in information security, "Positive Technologies" (srublev@ptsecurity.ru)

WPAD TECHNOLOGY WEAKNESSES. Sergey Rublev Expert in information security, Positive Technologies (srublev@ptsecurity.ru) WPAD TECHNOLOGY WEAKNESSES Sergey Rublev Expert in information security, "Positive Technologies" (srublev@ptsecurity.ru) MOSCOW 2009 CONTENTS 1 INTRODUCTION... 3 2 WPAD REVIEW... 4 2.1 PROXY AUTO CONFIGURATION

More information

5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep)

5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) 5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) survey says: There are things that go bump in the night, and things that go bump against your DNS security. You probably know

More information

VIDEO intypedia007en LESSON 7: WEB APPLICATION SECURITY - INTRODUCTION TO SQL INJECTION TECHNIQUES. AUTHOR: Chema Alonso

VIDEO intypedia007en LESSON 7: WEB APPLICATION SECURITY - INTRODUCTION TO SQL INJECTION TECHNIQUES. AUTHOR: Chema Alonso VIDEO intypedia007en LESSON 7: WEB APPLICATION SECURITY - INTRODUCTION TO SQL INJECTION TECHNIQUES AUTHOR: Chema Alonso Informática 64. Microsoft MVP Enterprise Security Hello and welcome to Intypedia.

More information

DNS security: poisoning, attacks and mitigation

DNS security: poisoning, attacks and mitigation DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain

More information

The Trivial Cisco IP Phones Compromise

The Trivial Cisco IP Phones Compromise Security analysis of the implications of deploying Cisco Systems SIP-based IP Phones model 7960 Ofir Arkin Founder The Sys-Security Group ofir@sys-security.com http://www.sys-security.com September 2002

More information

DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008

DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you

More information

FAQ (Frequently Asked Questions)

FAQ (Frequently Asked Questions) FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias

More information

Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder.

Make a folder named Lab3. We will be using Unix redirection commands to create several output files in that folder. CMSC 355 Lab 3 : Penetration Testing Tools Due: September 31, 2010 In the previous lab, we used some basic system administration tools to figure out which programs where running on a system and which files

More information

CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE

CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE Due to the encouraging feedback this series of articles has received, we decided to explore yet another type of cyber intrusionthe Man In The Middle (MITM)

More information

2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008

2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How does the DNS work? A typical DNS query The

More information

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped

More information

INFORMATION SECURITY REVIEW

INFORMATION SECURITY REVIEW INFORMATION SECURITY REVIEW 14.10.2008 CERT-FI Information Security Review 3/2008 In the summer, information about a vulnerability in the internet domain name service (DNS) was released. If left unpatched,

More information

Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. SEED Labs Local DNS Attack Lab 1

Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. SEED Labs Local DNS Attack Lab 1 SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation s Course,

More information

Remote DNS Cache Poisoning Attack Lab

Remote DNS Cache Poisoning Attack Lab SEED Labs Remote DNS Cache Poisoning Attack Lab 1 Remote DNS Cache Poisoning Attack Lab Copyright c 2014 Wenliang Du, Syracuse University. The development of this document is/was funded by the following

More information

Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities

More information

Internet Security [1] VU 184.216. Engin Kirda engin@infosys.tuwien.ac.at

Internet Security [1] VU 184.216. Engin Kirda engin@infosys.tuwien.ac.at Internet Security [1] VU 184.216 Engin Kirda engin@infosys.tuwien.ac.at Christopher Kruegel chris@auto.tuwien.ac.at Administration Challenge 2 deadline is tomorrow 177 correct solutions Challenge 4 will

More information

Client Server Registration Protocol

Client Server Registration Protocol Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are

More information

Server Certificates based on DNSSEC

Server Certificates based on DNSSEC Server Certificates based on DNSSEC Audun Jøsang and Kashif Sana Dar University of Oslo josang@mn.uio.no and kashifd@ifi.uio.no Abstract. Globally unique domain names and IP addresses that are provided

More information

Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006

Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,

More information

An Intrusion Detection System for Kaminsky DNS Cache poisoning

An Intrusion Detection System for Kaminsky DNS Cache poisoning An Intrusion Detection System for Kaminsky DNS Cache poisoning Dhrubajyoti Pathak, Kaushik Baruah Departement of CSE, IIT Guwahati drbj153@alumni.iitg.ernet.in, b.kaushik@iitg.ernet.in Abstract : Domain

More information

Security of IPv6 and DNSSEC for penetration testers

Security of IPv6 and DNSSEC for penetration testers Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions

More information

Before the. Committee on Energy and Commerce Subcommittee on Communications and Technology United States House of Representatives

Before the. Committee on Energy and Commerce Subcommittee on Communications and Technology United States House of Representatives Testimony of Fiona M. Alexander Associate Administrator, Office of International Affairs National Telecommunications and Information Administration United States Department of Commerce Before the Committee

More information

1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained

1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:

More information

Securing DNS Infrastructure Using DNSSEC

Securing DNS Infrastructure Using DNSSEC Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias rmohan@afilias.info February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival

More information

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann

More information

Recommended Practice Case Study: Cross-Site Scripting. February 2007

Recommended Practice Case Study: Cross-Site Scripting. February 2007 Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber

More information

COSC 472 Network Security

COSC 472 Network Security COSC 472 Network Security Instructor: Dr. Enyue (Annie) Lu Office hours: http://faculty.salisbury.edu/~ealu/schedule.htm Office room: HS114 Email: ealu@salisbury.edu Course information: http://faculty.salisbury.edu/~ealu/cosc472/cosc472.html

More information

Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System

Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce 18/02/15 Networks: DNS attacks 1 Domain Name System The domain name system (DNS) is an applica>on- layer protocol

More information

Penetration Testing Walkthrough

Penetration Testing Walkthrough Penetration Testing Walkthrough Table of Contents Penetration Testing Walkthrough... 3 Practical Walkthrough of Phases 2-5... 4 Chose Tool BackTrack (Armitage)... 5 Choose Target... 6 Phase 2 - Basic Scan...

More information

Frequently Asked Questions (FAQ)

Frequently Asked Questions (FAQ) Your personal information and account security is important to us. This product employs a Secure Sign On process that includes layers of protection at time of product log in to mitigate risk, and thwart

More information

Firewalls, IDS and IPS

Firewalls, IDS and IPS Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not

More information

Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies

Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies Cyber Security in Taiwan's Government Institutions: From APT To Investigation Policies Ching-Yu, Hung Investigation Bureau, Ministry of Justice, Taiwan, R.O.C. Abstract In this article, we introduce some

More information

Threat Events: Software Attacks (cont.)

Threat Events: Software Attacks (cont.) ROOTKIT stealthy software with root/administrator privileges aims to modify the operation of the OS in order to facilitate a nonstandard or unauthorized functions unlike virus, rootkit s goal is not to

More information

Firewalls, Tunnels, and Network Intrusion Detection

Firewalls, Tunnels, and Network Intrusion Detection Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Security Scanning Procedures Version 1.1 Release: September 2006 Table of Contents Purpose...1 Introduction...1 Scope of PCI Security Scanning...1 Scanning

More information

Online Security Awareness - UAE Exchange - Foreign Exchange Send Money UAE Exchange

Online Security Awareness - UAE Exchange - Foreign Exchange Send Money UAE Exchange The responsibility of safeguarding your personal information starts with you. Your information is critical and it must be protected from unauthorised disclosure, modification or destruction. Here we are

More information

VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY. AUTHOR: Alejandro Ramos Fraile

VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY. AUTHOR: Alejandro Ramos Fraile VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY AUTHOR: Alejandro Ramos Fraile Tiger Team Manager (SIA company). Security Consulting (CISSP, CISA) Hello and welcome to Intypedia. Today we are

More information

Multifaceted Approach to Understanding the Botnet Phenomenon

Multifaceted Approach to Understanding the Botnet Phenomenon Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic

More information

WEB ATTACKS AND COUNTERMEASURES

WEB ATTACKS AND COUNTERMEASURES WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in

More information

Penetration Testing Report. Client: xxxxxx Date: 19 th April 2014

Penetration Testing Report. Client: xxxxxx Date: 19 th April 2014 1. Executive Summary Penetration Testing Report Client: xxxxxx Date: 19 th April 2014 On the 19th of April, a security assessment was carried out on the internal networks of xxxxxx, with the permission

More information

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks

More information

2. From a control perspective, the PRIMARY objective of classifying information assets is to:

2. From a control perspective, the PRIMARY objective of classifying information assets is to: MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected

More information

Lesson 10: Attacks to the SSL Protocol

Lesson 10: Attacks to the SSL Protocol Lesson 10: Attacks to the SSL Protocol Luciano Bello - luciano@debian.org Chalmers University Dr. Alfonso Muñoz - amunoz@diatel.upm.es T>SIC Group. Universidad Politécnica de Madrid Security of the SSL

More information

WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services

WEB SITE SECURITY. Jeff Aliber Verizon Digital Media Services WEB SITE SECURITY Jeff Aliber Verizon Digital Media Services 1 SECURITY & THE CLOUD The Cloud (Web) o The Cloud is becoming the de-facto way for enterprises to leverage common infrastructure while innovating

More information

Network Security: Introduction

Network Security: Introduction Network Security: Introduction 1. Network security models 2. Vulnerabilities, threats and attacks 3. Basic types of attacks 4. Managing network security 1. Network security models Security Security has

More information

Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology

Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2

More information

PCI Security Scan Procedures. Version 1.0 December 2004

PCI Security Scan Procedures. Version 1.0 December 2004 PCI Security Scan Procedures Version 1.0 December 2004 Disclaimer The Payment Card Industry (PCI) is to be used as a guideline for all entities that store, process, or transmit Visa cardholder data conducting

More information

Own your LAN with Arp Poison Routing

Own your LAN with Arp Poison Routing Own your LAN with Arp Poison Routing By: Rorik Koster April 17, 2006 Security is a popular buzzword heard every day throughout our American culture and possibly even more so in our global economy. From

More information

A Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method.

A Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method. A Brief Overview of VoIP Security By John McCarron Voice of Internet Protocol is the next generation telecommunications method. It allows to phone calls to be route over a data network thus saving money

More information

DNS Security FAQ for Registrants

DNS Security FAQ for Registrants DNS Security FAQ for Registrants DNSSEC has been developed to provide authentication and integrity to the Domain Name System (DNS). The introduction of DNSSEC to.nz will improve the security posture of

More information

Insecurity breeds at home

Insecurity breeds at home Insecurity breeds at home - Vulnerabilities in SOHO routers Amrita Center for Cyber Security Amrita University Small Office Home Office(SOHO) Routers 2 Problem at hand No technology available to detect/prevent

More information

Web Application Attacks and Countermeasures: Case Studies from Financial Systems

Web Application Attacks and Countermeasures: Case Studies from Financial Systems Web Application Attacks and Countermeasures: Case Studies from Financial Systems Dr. Michael Liu, CISSP, Senior Application Security Consultant, HSBC Inc Overview Information Security Briefing Web Applications

More information

Linux Network Security

Linux Network Security Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols

More information

Layered security in authentication. An effective defense against Phishing and Pharming

Layered security in authentication. An effective defense against Phishing and Pharming 1 Layered security in authentication. An effective defense against Phishing and Pharming The most widely used authentication method is the username and password. The advantages in usability for users offered

More information

20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7

20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7 20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic

More information

DDoS Attacks: The Latest Threat to Availability. Dr. Bill Highleyman Managing Editor Availability Digest

DDoS Attacks: The Latest Threat to Availability. Dr. Bill Highleyman Managing Editor Availability Digest DDoS Attacks: The Latest Threat to Availability Dr. Bill Highleyman Managing Editor Availability Digest The Anatomy of a DDoS Attack Sombers Associates, Inc. 2013 2 What is a Distributed Denial of Service

More information

SPEAR PHISHING UNDERSTANDING THE THREAT

SPEAR PHISHING UNDERSTANDING THE THREAT SPEAR PHISHING UNDERSTANDING THE THREAT SEPTEMBER 2013 Due to an organisation s reliance on email and internet connectivity, there is no guaranteed way to stop a determined intruder from accessing a business

More information

Phishing Activity Trends Report June, 2006

Phishing Activity Trends Report June, 2006 Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account

More information

Application security testing: Protecting your application and data

Application security testing: Protecting your application and data E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers

More information

Where every interaction matters.

Where every interaction matters. Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper

More information

Understanding Home Network Security

Understanding Home Network Security Whitepaper Understanding Home Network Security Creating and Maintaining a Secure Home Network Executive Summary There are countless dangers lurking on the Internet, and routers are equipped to prevent

More information

E-BUSINESS THREATS AND SOLUTIONS

E-BUSINESS THREATS AND SOLUTIONS E-BUSINESS THREATS AND SOLUTIONS E-BUSINESS THREATS AND SOLUTIONS E-business has forever revolutionized the way business is done. Retail has now a long way from the days of physical transactions that were

More information

Phishing Activity Trends

Phishing Activity Trends Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record

More information

KEY STEPS FOLLOWING A DATA BREACH

KEY STEPS FOLLOWING A DATA BREACH KEY STEPS FOLLOWING A DATA BREACH Introduction This document provides key recommended steps to be taken following the discovery of a data breach. The document does not constitute an exhaustive guideline,

More information

Protecting Your Organisation from Targeted Cyber Intrusion

Protecting Your Organisation from Targeted Cyber Intrusion Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology

More information

WatchGuard Technologies, Inc. 505 Fifth Avenue South Suite 500, Seattle, WA 98104 www.watchguard.com

WatchGuard Technologies, Inc. 505 Fifth Avenue South Suite 500, Seattle, WA 98104 www.watchguard.com SMALL BUSINESS NETWORK SECURITY GUIDE WHY A REAL FIREWALL PROVIDES THE BEST NETWORK PROTECTION AUGUST 2004 SMALL BUSINESS NETWORK SECURITY GUIDE: WHY A REAL FIREWALL PROVIDES THE BEST NETWORK PROTECTION

More information

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.

More information

Why is a strong password important?

Why is a strong password important? Internet Security Why is a strong password important? Identity theft motives: To gain access to resources For the challenge/fun Personal reasons Theft methods Brute forcing and other script hacking methods

More information

Computer Security Literacy

Computer Security Literacy Computer Security Literacy Staying Safe in a Digital World Douglas Jacobson and Joseph Idziorek CRC Press Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor & Francis

More information

Security Issues with Distributed Web Applications

Security Issues with Distributed Web Applications Security Issues with Distributed Web Applications Device Connectivity We are entering the era of Device Connectivity, which is the fourth wave of evolution for Internet-enabled applications. The first

More information

DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come!

DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come! DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come! Amir Herzberg and Haya Shulman Dept. of Computer Science Bar Ilan University 8/1/2013 About us Bar Ilan University

More information

Session Hijacking Exploiting TCP, UDP and HTTP Sessions

Session Hijacking Exploiting TCP, UDP and HTTP Sessions Session Hijacking Exploiting TCP, UDP and HTTP Sessions Shray Kapoor shray.kapoor@gmail.com Preface With the emerging fields in e-commerce, financial and identity information are at a higher risk of being

More information

Designing federated identity management architectures for addressing the recent attacks against online financial transactions.

Designing federated identity management architectures for addressing the recent attacks against online financial transactions. Designing federated identity management architectures for addressing the recent attacks against online financial transactions. Dr. Christos K. Dimitriadis Security Officer INTRALOT S.A. Scope and Agenda

More information

Proxies. Chapter 4. Network & Security Gildas Avoine

Proxies. Chapter 4. Network & Security Gildas Avoine Proxies Chapter 4 Network & Security Gildas Avoine SUMMARY OF CHAPTER 4 Generalities Forward Proxies Reverse Proxies Open Proxies Conclusion GENERALITIES Generalities Forward Proxies Reverse Proxies Open

More information

Predictability of Windows DNS resolver. ing. Roberto Larcher - http://webteca.altervista.org - robertolarcher@hotmail.com

Predictability of Windows DNS resolver. ing. Roberto Larcher - http://webteca.altervista.org - robertolarcher@hotmail.com Predictability of Windows DNS resolver ing. Roberto Larcher - http://webteca.altervista.org - robertolarcher@hotmail.com rev. 1 - March 11, 2004 Abstract The main DNS security issues have very often focused

More information

Packet Sniffing on Layer 2 Switched Local Area Networks

Packet Sniffing on Layer 2 Switched Local Area Networks Packet Sniffing on Layer 2 Switched Local Area Networks Ryan Spangler ryan@packetwatch.net Packetwatch Research http://www.packetwatch.net December 2003 Abstract Packet sniffing is a technique of monitoring

More information

INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS

INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS Effective Date June 9, 2014 INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS OF THE HELLER SCHOOL FOR SOCIAL POLICY AND MANAGEMENT Table of Contents 1.

More information

True False questions (25 points + 5 points extra credit)

True False questions (25 points + 5 points extra credit) Student Name: ISA 656: Network Security Midterm Examination GENERAL INSTRUCTIONS The midterm is worth 110 points (including 10 extra credit points): 25 points of True/False and 75 points of short answer.

More information

Security Issues with Integrated Smart Buildings

Security Issues with Integrated Smart Buildings Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern

More information

The Continuing Denial of Service Threat Posed by DNS Recursion (v2.0)

The Continuing Denial of Service Threat Posed by DNS Recursion (v2.0) The Continuing Denial of Service Threat Posed by DNS Recursion (v2.0) US-CERT Summary US-CERT has been alerted to an increase in distributed denial of service (DDoS) attacks using spoofed recursive DNS

More information

The memoq server in a Corporate Network

The memoq server in a Corporate Network The memoq server in a Corporate Network Version 3.5 LSP Guide memoq copyright 2004-2009 Kilgray Translation Technologies. All rights reserved. Contents The memoq server in a Corporate Network...1 Version

More information

LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains

LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way

More information

What is the Internet?

What is the Internet? What is the Internet? Session 6: Internet Security Elena Silenok @silenok Charlie Robbins @nodejitsu Questions? Just Raise Your Hand Topics Ports / Protocols / OS / Packets Types of Threats Worms, viruses

More information

CSCI 4250/6250 Fall 2015 Computer and Networks Security

CSCI 4250/6250 Fall 2015 Computer and Networks Security CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP

More information

CS5008: Internet Computing

CS5008: Internet Computing CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is

More information

Actuality of SMBRelay in Modern Windows Networks

Actuality of SMBRelay in Modern Windows Networks Actuality of SMBRelay in Modern Windows Networks Ares, April 2012 intercepter.mail@gmail.com http://sniff.su Intro I first came across SMBRelay in the middle of 2000s and the experience was unsatisfying..

More information

Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines

Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious programs,

More information

Chapter 8 Security Pt 2

Chapter 8 Security Pt 2 Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,

More information

SECURING YOUR SMALL BUSINESS. Principles of information security and risk management

SECURING YOUR SMALL BUSINESS. Principles of information security and risk management SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and

More information

Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com

Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration

More information

Computer Networks: Domain Name System

Computer Networks: Domain Name System Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com

More information

Penetration Testing Scope Factors

Penetration Testing Scope Factors 1 NZ PAPER LINUX AND WEB APPLICATION SECURITY Penetration Testing Scope Factors April 20, 2013 Zeeshan Khan NZPAPER.BLOGSPOT.COM 2 Abstract: This paper contains the key points of penetration testing. All

More information

Securing End-to-End Internet communications using DANE protocol

Securing End-to-End Internet communications using DANE protocol Securing End-to-End Internet communications using DANE protocol Today, the Internet is used by nearly.5 billion people to communicate, provide/get information. When the communication involves sensitive

More information

N-CAP Users Guide Everything You Need to Know About Using the Internet! How Firewalls Work

N-CAP Users Guide Everything You Need to Know About Using the Internet! How Firewalls Work N-CAP Users Guide Everything You Need to Know About Using the Internet! How Firewalls Work How Firewalls Work By: Jeff Tyson If you have been using the internet for any length of time, and especially if

More information

Secure Software Programming and Vulnerability Analysis

Secure Software Programming and Vulnerability Analysis Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview

More information

Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz

Internet Banking Attacks. Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Internet Banking Attacks Karel Miko, CISA DCIT, a.s. (Prague, Czech Republic) miko@dcit.cz Contents Agenda Internet banking today The most common attack vectors The possible countermeasures What protection

More information