Network Security: Attacks CS 161: Computer Security Prof. Vern Paxson - - PowerPoint PPT Presentation

▶
network security attacks
SMART_READER_LITE
LIVE PREVIEW

Network Security: Attacks CS 161: Computer Security Prof. Vern Paxson - - PowerPoint PPT Presentation

May 05, 2023 102 likes •707 views

Network Security: Attacks CS 161: Computer Security Prof. Vern Paxson TAs: Paul Bramsen, Apoorva Dornadula, David Fifield, Mia Gil Epner, David Hahn, Warren He, Grant Ho, Frank Li, Nathan Malkin, Mitar Milutinovic, Rishabh Poddar, Rebecca

slide-1
SLIDE 1

Network Security: Attacks

CS 161: Computer Security

  • Prof. Vern Paxson

TAs: Paul Bramsen, Apoorva Dornadula, David Fifield, Mia Gil Epner, David Hahn, Warren He, Grant Ho, Frank Li, Nathan Malkin, Mitar Milutinovic, Rishabh Poddar, Rebecca Portnoff, Nate Wang

http://inst.eecs.berkeley.edu/~cs161/

March 9, 2017

slide-2
SLIDE 2

IP Packet Header (Continued)

  • Two IP addresses

– Source IP address (32 bits in main IP version) – Destination IP address (32 bits, likewise)

  • Destination address

– Unique identifier/locator for the receiving host – Allows each node to make forwarding decisions

  • Source address

– Unique identifier/locator for the sending host – Recipient can decide whether to accept packet – Enables recipient to send reply back to source

slide-3
SLIDE 3

Postal Envelopes:

(Post office doesn’t look at the letter inside the envelope)

slide-4
SLIDE 4

Analogy of IP to Postal Envelopes:

(Routers don’t look at the payload beyond the IP header) IP source address IP destination address

slide-5
SLIDE 5

IP: “Best Effort ” Packet Delivery

  • Routers inspect destination address, locate “next

hop” in forwarding table

– Address = ~unique identifier/locator for the receiving host

  • Only provides a “I’ll give it a try” delivery service:

– Packets may be lost – Packets may be corrupted – Packets may be delivered out of order source destination

IP network

slide-6
SLIDE 6

Threats Due to the Lower Layers

slide-7
SLIDE 7

Layers 1 & 2: General Threats?

Application Transport (Inter)Network Link Physical 7 4 3 2 1

Framing and transmission of a collection of bits into individual messages sent across a single “subnetwork” (one physical technology) Encoding bits to send them

  • ver a single physical link

e.g. patterns of voltage levels / photon intensities / RF modulation

slide-8
SLIDE 8

Physical/Link-Layer Threats: Eavesdropping

  • Also termed sniffing
  • For subnets using broadcast technologies (e.g.,

WiFi, some types of Ethernet), get it for “free”

– Each attached system’s NIC (= Network Interface Card) can capture any communication on the subnet – Some handy tools for doing so

  • tcpdump (low-level ASCII printout)
slide-9
SLIDE 9

9

TCPDUMP: Packet Capture & ASCII Dumper

slide-10
SLIDE 10

Physical/Link-Layer Threats: Eavesdropping

  • Also termed sniffing
  • For subnets using broadcast technologies (e.g.,

WiFi, some types of Ethernet), get it for “free”

– Each attached system’s NIC (= Network Interface Card) can capture any communication on the subnet – Some handy tools for doing so

  • tcpdump (low-level ASCII printout)
  • Wireshark (GUI for displaying 800+ protocols)
slide-11
SLIDE 11

11

Wireshark: GUI for Packet Capture/Exam.

slide-12
SLIDE 12

12

Wireshark: GUI for Packet Capture/Exam.

slide-13
SLIDE 13

13

Wireshark: GUI for Packet Capture/Exam.

slide-14
SLIDE 14

Physical/Link-Layer Threats: Eavesdropping

  • Also termed sniffing
  • For subnets using broadcast technologies (e.g.,

WiFi, some types of Ethernet), get it for “free”

– Each attached system’s NIC (= Network Interface Card) can capture any communication on the subnet – Some handy tools for doing so

  • tcpdump (low-level ASCII printout)
  • Wireshark (GUI for displaying 800+ protocols)
  • Bro (scriptable real-time network analysis; see bro.org)
  • For any technology, routers (and internal

“switches”) can look at / export traffic they forward

  • You can also “tap” a link

– Insert a device to mirror the physical signal

slide-15
SLIDE 15
slide-16
SLIDE 16

Physical/Link-Layer Threats: Eavesdropping

  • Also termed sniffing
  • For subnets using broadcast technologies (e.g.,

WiFi, some types of Ethernet), get it for “free”

– Each attached system’s NIC (= Network Interface Card) can capture any communication on the subnet – Some handy tools for doing so

  • tcpdump (low-level ASCII printout)
  • Wireshark (GUI for displaying 800+ protocols)
  • Bro (scriptable real-time network analysis)
  • For any technology, routers (and internal

“switches”) can look at / export traffic they forward

  • You can also “tap” a link

– Insert a device to mirror the physical signal – Or: just steal it!

slide-17
SLIDE 17

Stealing Photons

slide-18
SLIDE 18

Protec1ng Against Eavesdropping in the Coffee Shop

slide-19
SLIDE 19
  • 1. Join the wireless network

If either match up, your laptop joins the network. Op;onally performs a cryptographic exchange.

slide-20
SLIDE 20
  • 1. Join the wireless network

If either match up, your laptop joins the network. Op1onally performs a cryptographic exchange.

slide-21
SLIDE 21
  • 1. Join the wireless network

If either match up, your laptop joins the network. Op1onally performs a cryptographic exchange. Most commonly today, that is done using WPA2.

slide-22
SLIDE 22

Password: $secret! KeyCounter

(and other stuff)

WPA2, common form (“Personal”; simplified)

KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

slide-23
SLIDE 23

Password: $secret! SSID KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-24
SLIDE 24

Password: $secret! This func;on KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-25
SLIDE 25

Password: $secret! This func;on computes this many itera;ons KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-26
SLIDE 26

Password: $secret! This func;on computes this many itera;ons

  • f this func;on

KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-27
SLIDE 27

Password: $secret! This func;on computes this many itera;ons

  • f this func;on

using this as the MAC key KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-28
SLIDE 28

Password: $secret! This func;on computes this many itera;ons

  • f this func;on

using this as the MAC key and the XOR of these as the ini;al input. KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-29
SLIDE 29

Password: $secret! This func;on computes this many itera;ons

  • f this func;on

using this as the MAC key and the XOR of these as the ini;al input. Each subsequent itera;on takes the

  • utput of the previous computa;on as

its input. KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

Both your laptop and the AP now compute: K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-30
SLIDE 30

Password: $secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

K K

Now your laptop and the AP have derived a shared secret.

WPA2, common form (“Personal”; simplified)

slide-31
SLIDE 31

Password: $Secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

K K

Eve a5acks!

Eve

K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-32
SLIDE 32

Password: $secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

K K

Eve Since the password is never exposed, if Eve doesn’t know it, the best she can do is a dic1onary aFack to try to guess it.

K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096) WPA2, common form (“Personal”; simplified)

slide-33
SLIDE 33

Password: $secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

K K

Eve Since the password is never exposed, if Eve doesn’t know it, the best she can do is a dic1onary aFack to try to guess it. This goes slowly due to the 1000s of HMAC itera;ons.

WPA2, common form (“Personal”; simplified) K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096)

slide-34
SLIDE 34

Password: $secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

K K

Eve BUT: if Eve ponies up $2.25 for a cup of coffee and gets the password to the local net …

WPA2, common form (“Personal”; simplified) K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096)

slide-35
SLIDE 35

Password: $secret! KeyCounter

(and other stuff)

KeyCounter

(and other stuff)

WPA2, common form (“Personal”; simplified)

K K

Eve BUT: if Eve ponies up $2.25 for a cup of coffee and gets the password to the local net … then she knows both of these!

K

K = F(HMAC-SHA1, “$secret!", “ATT192”, KeyCounter, 4096)

slide-36
SLIDE 36

WPA2, actually-secure-but-inconvenient form(“Enterprise”; simplified)

slide-37
SLIDE 37

WPA2, actually-secure-but-inconvenient form(“Enterprise”; simplified)

{Auth: : A}K

  • 1

CA

Your laptop is preconfigured with a cert for an Authen1ca1on Server. Auth a

slide-38
SLIDE 38

WPA2, actually-secure-but-inconvenient form(“Enterprise”; simplified)

{Auth: : A}K

  • 1

CA

You establish a secure connec;on via the AP to the Authen;ca;on Server using TLS. Auth a

slide-39
SLIDE 39

WPA2, actually-secure-but-inconvenient form(“Enterprise”; simplified)

{Auth: : A}K

  • 1

CA

You then transmit your authen;ca;on info (username/password, or your own cert) to the server Auth a

User=Alice, Password= ReallyHard2Gue$$

slide-40
SLIDE 40

WPA2, actually-secure-but-inconvenient form(“Enterprise”; simplified)

{Auth: : A}K

  • 1

CA

Auth a

K K

The Authen;ca;on Server creates a random secret key and sends it to both your laptop and the AP.

slide-41
SLIDE 41

5 Minute Break

Questions Before We Proceed?

slide-42
SLIDE 42
  • With physical access to a subnetwork,

attacker can create any message they like

– When with a bogus source address: spoofing

Physical/Link-Layer Threats: Spoofing

slide-43
SLIDE 43
slide-44
SLIDE 44
  • With physical access to a subnetwork,

attacker can create any message they like

– When with a bogus source address: spoofing

  • When using a typical computer, may require

root/administrator to have full freedom

  • Particularly powerful when combined with

eavesdropping

– Because attacker can understand exact state of victim’s communication and craft their spoofed traffic to match it – Spoofing w/o eavesdropping = “blind spoofing”

Physical/Link-Layer Threats: Spoofing

slide-45
SLIDE 45
  • “On path” attackers can see victim’s traffic

⇒ spoofing is easy

  • “Off path” attackers can’t see victim’s traffic

– They have to resort to blind spoofing – Often must guess/infer header values to succeed

  • We care about the work factor: how hard is this

– Sometimes they can just brute force

  • E.g., 16-bit value: just try all 65,536 possibilities!
  • When we say an attacker “can spoof”, we usually

mean “w/ feasible chance of achieving their goal”

Spoofing Considerations

slide-46
SLIDE 46
  • 2. Configure your connec;on

Your laptop shouts: HEY, ANYBODY, WHAT BASIC CONFIG DO I NEED TO USE?

slide-47
SLIDE 47

Internet Bootstrapping: DHCP

  • New host doesn’t have an IP address yet

– So, host doesn’t know what source address to use

  • Host doesn’t know who to ask for an IP address

– So, host doesn’t know what destination address to use

  • (Note, host does have a separate WiFi address)
  • Solution: shout to “discover” server that can help

– Broadcast a server-discovery message (layer 2) – Server(s) sends a reply offering an address

host host host ... DHCP server

DHCP = Dynamic Host Configuration Protocol

slide-48
SLIDE 48

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

DNS server = system used by client to map hostnames like gmail.com to IP addresses like 74.125.224.149 Gateway router = router that client uses as the first hop for all of its Internet traffic to remote hosts

slide-49
SLIDE 49

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r D H C P A C K DHCP request (broadcast)

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

slide-50
SLIDE 50

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r DHCP request D H C P A C K (broadcast)

Threats?

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

slide-51
SLIDE 51

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r DHCP request D H C P A C K (broadcast)

Local attacker on

same subnet can hear new host’s DHCP request

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

slide-52
SLIDE 52

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r DHCP request D H C P A C K (broadcast)

This happens even for WPA2-Enterprise, since request is explicitly sent using broadcast

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

slide-53
SLIDE 53

Dynamic Host Configuration Protocol

new
 client DHCP server DHCP discover (broadcast) D H C P

  • f

f e r DHCP request D H C P A C K (broadcast)

Attacker can race the actual server; if attacker wins, replaces DNS server and/or gateway router

“offer” message includes IP address, DNS server, “gateway router”, and how long client can have these (“lease” time)

slide-54
SLIDE 54
  • Substitute a fake DNS server

– Redirect any of a host’s lookups to a machine of attacker’s choice (e.g., gmail.com = 6.6.6.6)

  • Substitute a fake gateway router

– Intercept all of a host’s off-subnet traffic

  • (even if not preceded by a DNS lookup)

– Relay contents back and forth between host and remote server

  • Modify however attacker chooses

– This is one type of invisible Man In The Middle (MITM)

  • Victim host generally has no way of knowing it’s happening! 😠
  • (Can’t necessarily alarm on peculiarity of receiving multiple

DHCP replies, since that can happen benignly)

  • How can we fix this?

DHCP Threats

Hard, because we lack a trust anchor

slide-55
SLIDE 55
  • DHCP threats highlight:

– Broadcast protocols inherently at risk of local attacker spoofing

  • Attacker knows exactly when to try it …
  • … and can see the victim’s messages

– When initializing, systems are particularly vulnerable because they can lack a trusted foundation to build upon – Tension between wiring in trust vs. flexibility and convenience – MITM attacks insidious because no indicators they’re

  • ccurring

Summary: DHCP Security Issues

slide-56
SLIDE 56

Layer 3 Threats

slide-57
SLIDE 57

57

Layer 3’s View of the World

Application Transport (Inter)Network Link Physical 7 4 3 2 1

4-bit Version 4-bit Header Length 8-bit Type of Service (TOS)

16-bit Total Length (Bytes) 16-bit Identification

3-bit Flags

13-bit Fragment Offset

8-bit Time to Live (TTL)

8-bit Protocol 16-bit Header Checksum 32-bit Source IP Address 32-bit Destination IP Address Payload

IP = Internet Protocol

Bridges multiple “subnets” to provide end-to-end internet connectivity between nodes

slide-58
SLIDE 58
  • Can set arbitrary IP source address

– “Spoofing” - receiver has no idea who attacker is – Could be blind, or could be coupled w/ sniffing – Note: many attacks require two-way communication

  • So successful off-path/blind spoofing might not suffice
  • Can set arbitrary destination address

– Enables “scanning” - brute force searching for hosts

  • Can send like crazy (flooding)

– IP has no general mechanism for tracking overuse – IP has no general mechanism for tracking consent – Very hard to tell where a spoofed flood comes from!

  • If attacker can manipulate routing, can bring traffic

to them for eavesdropping or MITM (not so easy)

Network-Layer (IP) Threats