tailieunhanh - LECTURE NOTES 19: PRACTICAL INSECURITY

The objective of network security is to protect networks and their applications against attacks, ensuring information availability, confidentiality and integrity. When organizations design their network security architectures to meet this objective, they must consider a number of factors. Not all networks and their associated applications have the same risks of attacks or possible costs of repairing attack damages. Therefore, companies must perform cost-benefit analyses to evaluate the potential returns on investment for various network security technologies and components versus the opportunity costs of not implementing those items. In the process, enterprises should make sure to consider their network security implementations as competitive advantages that can attract. | Computer and Network Security November 13 2001 Lecture Notes 19 Practical Insecurity Lecturer Roger Dingledine Ron Rivest Scribe Cody Cotier Hastings Langer 1 Outline Practical Insecurity 1 Video Brazilian Voting Scheme 2 Practical Insecurity Packet level protocol issues Figure 1 TCP Handshake The TCP protocol is a connection-oriented reliable protocol built on top of the IP protocol. Connections are created by the three-way handshake illustrated above . A connection is requested in step 1 when host A sends to host B a SYN packet. Host B responds with a SYN ACK packet and then host A completes the handshake using an ACK packet. Layered on top of this exchange is the use of sequence numbers by both sides. Sequence numbers are used to describe the order of packets so both sides can take steps to make sure that all the data is getting through in the right order. There are a number of possible ways to exploit the TCP protocol either to deny service from a legitimate user or to obtain unauthorized privileges. May be freely reproduced for educational or personal use. 1 These notes contain only the topics discussed in lecture and are derived from Roger Dingledine s document in Handout 30 http www handouts . 1 2 2 PRACTICAL INSECURITY IP address spoofing In general an attacker can claim to come from an IP address different from his actual address by setting the packet source address to the IP address of a different possibly non-existent host. 1. Allows trust-based attacks described later 2. Hard to trace 3. Works particularly well when spoofing rhost Note that if the attacker does spoof his IP address he needs to either be good at guessing responses or have some way of intercepting or overhearing the response packets. Question What is a rhost relationship Answer Rhost is an IP-based trusted relationship with no authentication of users required from trusted computers. SYN flooding A computer keeps track of pending connections .