CS5008: Internet Computing

Transcription

1 CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015

2 Internet Security When a computer connects to the Internet and begins communicating with others, it is taking a risk network connection gives attackers opportunity to compromise security Internet security is the protection of a computer's internet account and files from intrusion and disruption browser security and network security a secure Internet platform is designed so that agents (users or programs) can only perform actions that have been allowed Technologies used include firewalls, authentication methods and encryption 2

3 Terminology Asset is a resource of value such as the data in a database Vulnerability is a weakness or gap in security Attack is an assault on system security that derives from an intelligent threat RFC 2828 Passive attack does not affect system resources but intercepts communications, e.g. eavesdropping, stealing Active attack alters system resources or affect their operation, e.g. denial of service attack 3

4 Attack Types Denial-of-service (DOS) attacks next slides Man-in-the-middle (MITM) attack active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them Spoofing: IP spoofing; ARP poisoning Buffer/heap overflow Exploit applications with (known) security weaknesses (e.g. FTP, Telnet) 4

5 Denial-of-service attacks Denial-of-service (DoS) attack is an attempt to make a computer resource unavailable to its intended users Distributed denial-of-service (DDoS) attacks are sent by multiple persons, or bots Symptoms of denial-of-service attacks include inability of legitimate users to connect and unusually slow network performance Targets machine with flood of external communications requests, so much so that it cannot respond to legitimate traffic Web connections or bomb DoS attack may consume and disrupt services and include execution of malware, e.g. MyDoom 5

6 DoS Attack Examples ICMP flood ping flood: large number of ping packets ping of death: malformed ping packet smurf attack: ICMP messages with spoofed source IP are broadcast to a computer network nuke attack: fragmented ICMP packets Others TCP/IP attacks SYN flood: flood of TCP SYN packets, often with a forged sender address fraggle attack: UDP messages with spoofed source IP are broadcast to a computer network teardrop attack: mangled IP fragments 6

7 More Network Vulnerabilities Port scanning attacker attempts to connect in sequence to a wide range of services (port numbers) on a single computer portsweep is to scan multiple hosts for a specific listening port Connection hijacking (Man-In-the-Middle Attack) malicious party intercepts a legitimate communication between two hosts to controls the flow of communication and to eliminate or alter the information sent attacker could inject forged packets with the correct sequence numbers 7

8 Firewalls Prevent intruders (by securing Internet connections) from unauthorized access and denial of service attacks to your network isolate internal network from Internet at large Firewall could be a router, gateway, or special purpose computer examines packets flowing in and out of organization s network; some packets are allowed to pass through, others are blocked placed on every connection that network has to Internet 8

9 How Firewalls Work Firewall has rules for traffic entering and leaving based on: source and destination IP address source and destination port numbers protocol type in IP header (TCP/UDP/ICMP) TCP flag bits (SYN, SYNACK, ACK, FIN) ICMP message types Main types of firewalls packet-level firewalls (packet filters and stateful-inspection filters) application-level firewalls (application gateways) Organization have single or multiple levels of firewall 9

10 Packet Filters Firewall is unaware of sessions/applications and what the intruder is trying to do IP spoofing remains a problem done by simply changing the source address of incoming packets from their real address to an address inside the organization s network basic packet filter will pass this packet Stateful inspection determine whether packet is start of a new connection or part of existing connection using TCP flag bits 10

11 Securing Network Perimeter Securing the network perimeter: controls on access points to prevent or deter unauthorized external access Access points of network Web traffic (port 80) (port 25) remote login (port 22) Basic elements in restricting access Firewalls Proxies Network Address Translation (NAT) not covered this year 11

12 Application-Level Firewalls Operates at Application Layer Controls input, output, and/or access from, to, or by an application or service Can be a proxy service Requires more processing power than packet filters which can impact network performance because of the increased complexity of what they do 12

13 Browser Security The Web browser (client) itself is vulnerable to attack or exploit In particular scripts written in Javascript and insecure plugins may be used in attacks Recommendations include: use the most recent/secure version of Web browser/ plugins tighten the security settings on your browsers block pop-up windows See e.g. also Google s Browser Security Handbook 13

14 Web application security Web applications can be at risk due to flaws in the design, development, and maintenance of the application Common threats/attacks: input validation, e.g. Buffer overflow and SQL injection parameter manipulation, e.g. Query string manipulation and Form field manipulation authentication, e.g. Brute force attack and Dictionary attacks session management, e.g. Session hijacking cryptography: poor key generation or key management Improving Web Application Security 14

15 SSL SSL (Secure Sockets Layer) is a communications protocol which works between TCP and HTTP Transport Layer Security (TLS) is an IETF standard similar to SSL Version 3 Provides security between browser and Web server using HTTPS protocol (TCP port 443) RFC 2818 Uses X.509 certificates SSL/TLS uses public-key cryptography to exchange a secret (session) key and then uses symmetric (private-key) encryption encryption not covered this year because symmetric encryption such as AES much more efficient than symmetric encryption such as RSA algorithm also performs message authentication client and server use a handshake protocol 15

16 Data transmission using SSL/TLS 16

17 HTTPS and lock 17