Chegg
-- Sign In
More
Learn about
Chegg Study
-------------------------------------------------
Top of Form
SubmitClose
Bottom of Form
Free Shipping: Physical textbook orders of $55 or moreSee details
Excludes tax and shipping. Expires on 12/15/14. Not to be combined with other offers. Terms of offer are subject to change
Code: CHEGGFREESHIPApply
Home
home / homework help / questions and answers / engineering / computer science / 1. [16 points total, tcp/ip] a. unlike ip fragmentation...

Ask a new question?
Question

1. [16 points total, TCP/IP]
a. Unlike IP fragmentation (which can be done by intermediate devices), IP reassembly can be done only at the final destination. What problems do you see if IP reassembly is attempted in intermediate devices like routers? [8 points]
Answer: It's important to understand that while reassembly is the complement to fragmentation, the two processes are not symmetric. A primary differentiation between the two is that while intermediate routers can fragment a single datagram or further fragment a datagram that is already a fragment, intermediate devices do not perform reassembly. There are a number of reasons why the decision was made to implement IP reassembly this way. Perhaps the most important one is that fragments can take different routes to get from the source to destination, so any given router may not see all the fragments in a message. Another reason is that having routers need to worry about reassembling fragments would increase their complexity. Finally, as we will see, reassembly of a message requires that we wait for all fragments before sending on the reassembled message. Having routers do this, slow routing down. Since routers don't reassemble they can immediately forward all fragments on to the ultimate recipient.
However, there are drawbacks to this design as well. One is that it results in smaller fragments traveling over longer routes than if intermediate reassembly occurred. This increases the chances of a fragment going missing and the entire message being discarded. Another is a potential inefficiency in the utilization of data link layer frame capacity. In the example above, the 1,300-byte fragments would not be reassembled back into a 3,300 byte datagram at the end of the 1,000-MTU link. If the next link after that one also had an MTU of 3,300, we would have to send three frames, each encapsulating a 1,300-byte fragment, instead of a single larger frame, which is slightly slower.
b. Let’s assume that Host A (receiver) receives a TCP segment from Host B (sender) with an out-of-order sequence number that is higher than expected as shown in the diagram. Then, what do Host A (receiver) and host B (sender) do? [8 points]
Answer: When Host B (sender) sends TCP segments with an out-of-order sequence number that is higher than expected to Host A (receiver) the receiver fails to receive the TCP segments which is detected by TCP/IP protocol .After detection of segments TCP/IP recovered it. After the reassembling sent back to sender where it the sequence is good enough to receive by the receiver Host A. In this process the Transmission of data is occurred in good and effective way.
2. Describe or propose a way to detect ARP spoofing attack. What could be a possible weakness in your proposed method? Please do not discuss any prevention method (e.g., port security is an example of a preventive method). [8 points]
Answer: The Address Resolution Protocol (ARP) due to its statelessness and lack of an authentication mechanism for verifying the identity of the sender has a long history of being prone to spoofing attacks. ARP spoofing is sometimes the starting point for more sophisticated LAN attacks like denial of service, man in the middle and session hijacking. The current methods of detection use a passive approach, monitoring the ARP traffic and looking for inconsistencies in the Ethernet to IP address mapping. The main drawback of the passive approach is the time lag between learning and detecting spoofing. This sometimes leads to the attack being discovered long after it has been orchestrated. In this paper, we present an active technique to detect ARP spoofing. We inject ARP request and TCP SYN packets into the network to probe for inconsistencies. This technique is faster, intelligent, scalable and more reliable in detecting attacks than the passive methods. It can also additionally detect the real mapping of MAC to IP addresses to a fair degree of accuracy in the event of an actual attack.
3. [Wireless LAN Security-WEP] What is the main difference between the FMS attack and Chopchop attack? Clearly explain your answer [8 points]
Answer: Fluhrer, Mantin and Shamir published the RST key recovery attack on WEP in 2001 is called FMS attack. Their attack is based on the idea that an attacker who listens passively to the trac of a WEP protected network can record a lot of encrypted packets including the initialization vectors used for these packets. Because the RST bytes of the plain text of most packets are easily predictable, the attacker is able to recover the RST bytes of the key streams used to encrypt these packets. The initialization vector is transmitted unprotected with the packets, so the attacker initially also knows the RST 3 bytes of the per packet key for all packets. All following bytes of the per packet key are the same for all packets, but are initially unknown to the attacker.
The Chopchop attack allows an attacker to interactively decrypt the last M bytes of plain text of an encrypted packet by sending m 128 packets in average to the network. The attack does not reveal the root key and is not based on any special properties of the RC4 stream cipher.
We can summarize the chopchop attack before encryption, a four byte CRC32 checksum named ICV is appended to the data of the packet. The packet with the trailing checksum P can be represented as an element of the polynomial ring F2. If the checksum is correct, P mod PCRC=PONE holds, where PONE is a known polynomial and P CRC is a known polynomial too, which is irreducible. We can write P as QX 8+R. Here R is the last byte of P And Q are all remaining bytes. When the encrypted packet is truncated by one byte, Q will most probably have an incorrect checksum.
4. A huge enterprise decides to use a symmetric encryption to protect routing update messages between its own routers (i.e. entire routing update messages are encrypted by a strong shared symmetric key). They think this will prevent routing table modification attacks. Do you think their decision is appropriate? Do you see any problems or issues with their decision? [10 points]
Answer: I think their decision is appropriate in a order to protect routing update messages between its own routers by two types of symmetric key distribution approaches for securing BGP messages. In the first approach, a centralized controller establishes the necessary keys among the BGP routers and hence, we call protocols using this approach as centralized key distribution protocols. In the second approach, we assume that a centralized controller does not exist and each AS distributes the necessary keys to the BGP routers of other ASes. We call key distribution protocols using this approach as distributed key distribution protocols.A main objective of BGP is to advertise the routing path information for IP prefixes. Towards this, BGP routers initiate TCP connections with other BGP peers and exchange the path information in the form of BGP update messages. For this discussion, we represent an update message as a tuple: (prefix, as path),where the prefix denotes what the message needs to advertise or withdraw, and the as path denotes the sequence of ASes through which this update message has traversed. When a BGP router receives an update message, it will concatenate the as path field of the message with it’s AS number and propagate the message to other neighbouring ASes. When a BGP router receives multiple paths for the same prefix, the router chooses the best path based on its own criteria. Although BGP update messages can be used to advertise as well as withdraw IP prefixes, without loss of generality, we assume that update messages contain prefix advertisement.
5. An ACK scan does not provide information about whether a target machine’s ports are open or closed, but rather whether or not access to those ports is being blocked by a firewall. If there is no response or an ICMP “destination unreachable†packet is received as a response, then the port is blocked by a firewall. If the scanned port replies with a RST packet, then ACK packet reached its intended host. So the target port is not being filtered by a firewall. Note, however, that port itself may be open or closed.
Describe a rule (or a set of rules) that could be used by Snort to detect an ACK scan. Cleary express your assumption and explain your rules. Do you think Bro can do a better job detecting an ACK scan? Explain your answer. [15 points]
Answer: Snort is a widely used network intrusion detection and prevention system(NIDS/NIPS). It gained popularity because of its powerful detection system base on rules which are shared in public by users and snort administrators. Snort and its rule updates are open source and free for public use and modification capability to detect specific network activity and flexibility in rule generation. It can have any number of rule options separated by semicolons and is always enclosed within parentheses. An option is composed of three parts:
1. Option keyword – Identifies the option you want to use
2. Semicolon – separates the keyword from value
3. Option value – the value you want to pass to the option keyword
A set of basic snort rules are as follows:- msg– The value you provide on this field will be the message written on the alert and packet logs.
- e.g. (msg:â€Web traffic to Intranetâ€;) sid – The keyword used to identify rules in snort. Output modules or log scanners can use SID to uniquely identify rules. Authors have reserved SID ranges for rules as shown below:
a. Range 0-99 is reserved for future use.
b. Range 100-1,000,000 is reserved for rules that come with official Snort Distribution. Well known snort rules have this ID
c. ID above 1,000,000 are used for custom rules on a network logto – Tells snort to log the packet to a custom file name instead of the standard output file
- e.g. (logto:â€web_server_logs_Jan_2010.logâ€;) minfrag – Sets the threshold value for the smallest acceptable IP fragment size. This is useful in detecting attack mechanisms that breaks fragments into small pieces of data before sending them into the target network to avoid detection.
- e.g. (minfrag:256;) dsize – Sets the packet’s payload size the packet should have for a match to happen. We can add a greater than > or less than < sign to match for Inequality. Format is (dsize:[<|>]NUMBER;).
- e.g. (dsize:>1500;) – match for giants
- e.g. (dsize:< 64;) – match for runts content – Search for a pattern in the packet’s payload. This is useful in finding suspicious URL, embedded malicious codes, content encoding and other known string patterns malwares leave on the payload.
- e.g. (content:â€<?php>while(;;){alert(Pwnd!);}<php>â€;)
- e.g. (content:â€Accept-Encoding: bbbbbbbbblateâ€;) flags – check for TCP flags for certain values. This can be useful in detecting unusual network behavior like FIN scans.
- There are 8 flags variables available in Snort:
F – FIN (LSB in TCP Flags byte)
S – SYN
R – RST
P – PSH
A – ACK
U – URG
2 – Reserved bit 2
1 – Reserved bit 1 (MSB in TCP Flags byte)
- e.g. alert any any -> any any (flags: SF,12; msg: “Possible SYN FIN scanâ€;) seq – Refers to the TCP sequence number field for a specific value. Not used very much since sequence number are randomly generated.
- e.g. (seq:45992) detects packets with sequence number equal to 45992 ack
- This rule option keyword refers to the TCP header’s acknowledge field. Its only practical purpose so far is to detect NMAP TCP pings. TCP NMAP ping works by setting this field to zero and sending a packet with the TCP ACK flag set to determine if a network host is active.
- e.g. (flags: A; ack: 0; msg: “NMAP TCP pingâ€;) itype – Check the ICMP type field against a specific value. This could be used to detect invalid ICMP packets with incorrect itype value which can be used on DoS attacks like flooding.
- e.g. (itype:8;) → detect ICMP echo
- see http://www.iana.org/assignments/icmp-parameters for ICMP Type numbers icode – test the ICMP code field against a specific value
- see http://www.iana.org/assignments/icmp-parameters for more info on the different ICMP icode values and their meaning
- like the itype, icode can be used to detect suspicious ICMP packets with incorrect icode values. This packets may be used in spoofing, flood obfuscation and DoS attacks.
- e.g. (icode:3;) match for ICMP Destination unreachable session
- dumps the application layer information for a given session. This is a very useful rule option. This allows us to print information inside the packet that maybe related to user-name, password, executed commands, etc.
- e.g. alert tcp any any → any 21 (content:â€FTP Session Dataâ€; session:printable;) generates an alert then prints FTP session to standard output. offset – modifier for the content option, sets the offset to begin attempting a pattern match from the beginning of the packet payload. It s useful in detecting CGI scans where in the search string cannot be found on the first 4 bytes of the payload. This can only be used when the content rule option was specified.
- e.g (contentâ€CGI scanâ€; offset:5;)
- The first 5 bytes will be skipped for matching. The string pattern “CGI scan†will be matched on the 6th byte onwards depth – modifier for the content option, sets the maximum search depth for a pattern match attempt. Like in offset, the content keyword must have a value for this to be used. It can be said that depth tells how far snort will search for content matching.
- e.g (contentâ€CGI scanâ€; depth:10;)
- The string pattern “CGI scan†will be matched only on the first 10 bytes. ttl – The IP header’s Time-To-Live field value for exact match.
- e.g. (ttl:1;) id – Check the IP header’s fragment ID field for a specific value
- e.g. (id:31337;) ipopts – This keyword is used to look for IP options on an IP header if there is any. IP options can be attached at the end of IP headers and can take up to
40 bytes of space. These options are commonly used for:
- Record Route (rr)
- Time Stamps (ts)
- Loose Source Routing (lssr)
- Strict Source Routing (ssrr)
Bro’s scan detection has since been modified to incorporate a threshold random walk approach . Various algorithmic approaches to detecting scans have also been developed. For example, Graph-based Intru-sion Detection System, GrIDS, recognizes scans based on structures the communications form when inserted into a graph .Leckie and Kotagiri use probabilistic mod-eling to determine how likely it is that a source will contacta particular destination IP address or port, using the con-ditional probabilities to determine if a source is scanning.Robertsonet al developed a method based on the traf-fic returned to a source, where no response or a RST-ACK was indicative of scanning. Approaches based on visual representation of connection data have also been developed for detecting port scans (e.g., Muelderet al.) However, the threshold random walk (TRW) approach to detecting port scans developed by Junget al.[6] has become the gold standard for scan detection, and has been used for activities such as worm detection and quarantine . Their approach uses sequential hypothesis testing, where each new connection request from an external source is evaluated. If the destination exists, then there is more support for the source being benign (or, rather, not scanning). How-ever, if the destination does not exist, then there is more support for the source to be scanning. Once the hypotheses is that the source is scanning has been accepted or rejected, it is labelled with the result. The use of sequential hypotheses is testing allows the user to customize variables based on the density of hosts on their network and on the desired detection.
6. Explain the main difference between SQL injection and XSS attacks. [10 points]
Answer: SQL injection attack is that an attacker can inject SQL into input taken from a form, as well as through the fields of a cookie. Your input validation logic should consider each and every type of input that originates from the user be it form fields or cookie information as suspect. Also if you discover too many alerts coming in from a signature that looks out for a single-quote or a semi-colon, it just might be that one or more of these characters are valid inputs in cookies created by your Web application. Therefore, you will need to evaluate each of these signatures for your particular Web Application. A trivial regular expression to detect SQL injection attacks is to watch out for SQL specific meta-characters such as the single-quote (') or the double-dash (--).
XSS is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy .Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems they rely on. Exploiting one of these, they fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Therefore , these scripting attacks are a special case of code injection.
7. As shown in the above diagram, Kevin, the system admin, installed a text-message sender and a text-message receiver in a Multi-Level-Secure (MLS) environment. In the MLS environment, two security levels exist (i.e., Unclassified (Low) and Classified (High) levels). His goal is to enforce the Bell-La Padula (BLP) access control model in the network. In a nut shell, the BLP model defines two mandatory access control rules:
No Read Up Rule: a subject (Low) at a lower security level must not read an object (High) at a higher security level. Simply, a Low entity cannot have read-access to a High object. No Write Down Rule: a subject (High) at a higher security level must not write to any object (Low) at a lower security level. Simply, a High entity cannot have a write-access to a Low object.
In this scenario, enforcing the BLP model means no confidential information flows from Classified LAN (High) to Unclassified LAN (Low). However, information can still flow from Unclassified LAN to Classified LAN.
To achieve his goal, he configured both text message sender and receiver as follows:
· The text message sender is configured to send a text message to the text message receiver via TCP/IP protocol.
· The text message receiver is configured to receive a simple text message from the sender via TCP/IP protocol.
· The following IP/port is given to each machine: o Text message sender : 192.168.2.2 and port 9898 is open o Text message receiver: 192.168.3.3 and port 9999 is open o A text message is allowed to be sent only from port 9898 of 192.168.2.2 (sender) host to port 9999 of 192.168.3.3 (receiver) host.
Part A) As you can see from the diagram above, the text message sender and receiver have been compromised by the adversary and the Trojan, respectively. However, the router with Snort IDS installed (router/snort) is securely protected and can be fully trusted.
Write efficient Snort rules and access control lists which will be implemented on the router/snort to detect or block confidential information leakage from High to Low. Write your rationale for writing your rules and access control lists. For example, if the text message receiver (Trojan at High LAN) attempts to send a text message (confidential information) to the text message sender (the adversary at Low LAN), the attempt will be either blocked by your access control list(s) or detected by your snort rule(s).
Do not write more than 5 rules and lists in total. At least one access control list must be included. [15 points]
Hint: Access control lists are discussed in Module 10 and snort rules are covered in Module 7 as well as Lab2. To see more snort options, please refer to chapter 3 of Snort User Manual 2.9.1 by the Snort Project (link: http://www.snort.org/assets/166/snort_manual.pdf)
Answer: Rule options follow the rule header and are enclosed inside a pair of parentheses. There may be one option or many and the options are separated with a semicolon. If you use multiple options, these options form a logical AND. The action in the rule header is invoked only when all criteria in the options are true. You have already used options like msg and ttl in previous rule examples. All options are defined by keywords. Some rule options also contain arguments. In general, an option may have two parts: a keyword and an argument.
Working with Snort Rules
Pass -This action tells Snort to ignore the packet. This action plays an important role in speeding up Snort operation in cases where you don’t want to apply checks on certain packets. For example, if you have a vulnerability assessment host on your own network that you use to find possible security holes in your network, you may want Snort toignore any attacks from that host. The pass rule plays an important part in such a case.
Log-
The log action is used to log a packet. Packets can be logged in different ways, as discussed later in this book. For example, a message can be logged to log files or in a database. Packets can be logged with different levels of detail depending on the command line arguments and configuration file. To find available command line arguments with your version of Snort, use “snort -?†command.
Alert-
The alert action is used to send an alert message when rule conditions are true fora particular packet. An alert can be sent in multiple ways. For example, you can send an alert to a file or to a console. The functional difference between Log and Alert actions isthat Alert actions send an alert message and then log the packet. The Log action only logs the packet.
Activate-
The activate action is used to create an alert and then to activate another rule forchecking more conditions. Dynamic rules, as explained next, are used for this purpose.The activate action is used when you need further testing of a captured packet.
Dynamic-
Dynamic action rules are invoked by other rules using the “activate†action. In normal circumstances, they are not applied on a packet. A dynamic rule can be activated only by an “activate†action defined in another role.
Part B) Describe a way for the Trojan to covertly transmit 4 characters (e.g., A, B, C and D) to the adversary without being detected or blocked by your rules and access control lists provided in Part A.
[9 points].
Answer: It have no access to the file. If the system does not tell its status, a file can be created with the same name to check for a name duplication error. The single bit that this one creation gives is not much but with high speed systems, many files can be created or deleted thus improving bandwidth. The amount of file creations or deletions per second that can occur is the number of bits that can be transmitted.
The most common method of implementation is through malicious software or code . This is most often referred to as a Trojan horse. Trojan Horses are malicious code which gains access to systems without the knowledge of the system administrators. These programs can be disguised as legit programs, such as e-mails, computer games, or other benign looking files. Most often the Trojan is sent to a system user who will not realize that it is a Trojan while some are placed in systems by the intruder directly. Once it gains access it disguises itself as a legitimate program so a firewall or virus scanner will not detect its presence. It can then begin to transmit through covert storage channel.
8. [topic: IPsec VPN] What do you think are the advantages & disadvantages of using both AH and ESP protocols on the same end to end IPsec connection (transport mode)? In addition, it is recommended that the ESP protocol should be performed before the AH protocol. Why is this approach recommended rather than authentication (AH) before encryption (ESP)? [9 points]
Answer: "Authentication Header" (AH) and "Encapsulating Security Payload" (ESP) are the two main wire-level protocols used by IPsec, and they authenticate (AH) and encrypt+authenticate (ESP) the data flowing over that connection. They are typically used independently, though it's possible (but uncommon) to use them both together.
AH is used to authenticate — but not encrypt — IP traffic, and this serves the treble purpose of ensuring that we're really talking to who we think we are, detecting alteration of data while in transit, and (optionally) to guard against replay by attackers who capture data from the wire and attempt to re-inject that data back onto the wire at a later date. Authentication is performed by computing a cryptographic hash-based message authentication code over nearly all the fields of the IP packet (excluding those which might be modified in transit, such as TTL or the header checksum), and stores this in a newly-added AH header and sent to the other end.
The ESP protocol provides one or both of encryption and packet authentication ESP a bit more complicated because the encapsulation surrounds the payload rather than precedes it as with AH: ESP includes header and trailer fields to support the encryption and optional authentication. It also provides Tunnel and Transport modes which are used in by-now familiar ways. ESP can also optionally provide authentication, with the same HMAC as found in AH. Unlike AH, however, this authentication is only for the ESP header and encrypted payload: it does not cover the full IP packet. Surprisingly, this does not substantially weaken the security of the authentication, but it does provide some important benefits.
ESP may be used with or without AH packet authentication. some form of packet authentication should always be used whenever data is encrypted.Without authentication, the encryption is vulnerable to active attacks which may allow an enemy to break the encryption. ESP should always either include its own authentication or be used with AH authentication.The RFCs require support for only two mandatory encryption algorithms – DES, and null encryption and for two authentication methods , keyed MD5 and keyed SHA. Implementers may choose to support additional algorithms in either category.The authentication algorithms are the same ones used in the IPsec authentication header.
Want an answer?

No answer yet. Submit this question to the community.
Ask question
Computer Science tutors who can help right now

Prashanth U.
MIT
129

Mayur D.
Sardar Patel University
151

Brian K.
University of California, Irvine
53

See more tutors
ABOUT CHEGG * Media Center * Chegg For Good * Brand Partnerships * Privacy Policy * Your CA Privacy Rights * Terms of Use * General Policies * Intellectual Property Rights * Investor Relations
RESOURCES
* Site Map * Mobile * Publishers * Join Our Affiliate Program * Advertising Choices
PUBLISHER PAGES * McGraw-Hill * Cengage * Pearson * Wiley * Elsevier
HELPFUL LINKS * Return Your Books * Rent Textbooks * eTextbooks * Used Textbooks * Cheap Textbooks * College Textbooks * Sell Textbooks * Chegg Study Help * Chegg Coupon * Solutions Manual * Scholarships * Career Search * Online Tutoring * Internships
COMPANY
* Chegg College Blog * Jobs * Customer Service * Give Us Feedback
Chegg Plants Trees

© 2003-2014 Chegg Inc. All rights reserved.
Over 5 million trees planted
<img src="http://www.chegg.com/_ajax/cheggpixel?ns=1" />
 Top Textbooks
 Top eTextbooks
 Top Textbook Solutions
 Sell your books
Asker Response %