Category: Network security

The final week of new topics for Network Security covered Security for Large Computer Systems. This post will also contain a short review of the FIT5044 subject. The first point to consider when implementing large scale security solutions is the fast moving nature of computer security in addition to the difficulty in change associated with large business networks. Increased integration, particularly with  the availability of inter-organization or publicly available services adds difficulty considering the mutually exclusive nature of security and convenience.

As can be seen there are a large number of areas were security must be actively enforce on a large network.

IDS systems to investigate:

Snort (http://www.snort.org)

Cisco IDS (http://www.cisco.com/warp/public/cc/pd/sqsw/sqidsz/index.shtml)

Subject Review:

FIT5044 – Network Security was my favorite subject of the MIT course thus far. It contains very interesting subject material and introduces students to topics they must independently investigate to gain proper understanding (I think all post graduate subject should subscribe to this). It is proposed that the subject should be a good addition for non-IT students however I imagine this would be quite challenging without some fundamental IT background. I recommend this subject to anyone in the MIT course.

We moved up to the application layer and looked at Web/Email security and malicious programs in week 10. Some of the possible (or impossible) improvements to email systems were discussed. I feel that some of the options we looked at would be impossible given POP3 style communications. The predominance of IMAP and web based email clients could allow for extensions of email systems in the future. The same key issues of data communications were cited as areas where email needs to be improved:

• Privacy/Confidentiality
• Authentication
• Non-repudiation
• Proof of submission

Some suggested areas of reading on these topics for email: Secure/Multipurpose email extension, Privacy Enhance email.

Integrity and DoS where issues raised when discussing web server security. Additionally the concerns for web server clients. The increasing emergence of cross site scripting XSS indeed puts many users at risk. The automation of modern web browsers, high usage of cookies and large amount of confidential information stored within most people’s browsers server to further increase the threat of XSS.

Given such a large array of risks one could ask how can we protect systems.

In addition to firewalls, anti-virus programs should be utilized. Due to the large amount of computing resources required dedicated scanning machines for system are becoming more common.

Malicious programs come in a wide variety of forms and functions, they can be a field of research all on their own and definitely require more than a week to understand.

Week 9 continued from IPsec into security at the transport layer, specifically SSL. Unsurprisingly, given that SSL uses public key cryptology is used at least in the initial stages of all SSL connection, distribution and authentication of public keys was the first issue raised. The use of certificate authorities providing signed keys is the current solution. Similarly to IPsec, authentication, integrity and confidentiality are the goals of SSL.

With such a wide number of computers using SSL, there needs to be provisioning for different cypher suits which is included in the SSL handshake:

There was also some discussion over the definition of sockets, my interpretation is that they are basically application layer ports. A better explination can be found here: http://pro-programmers.blogspot.com/2009/02/socket-vs-port.html

Work also began on the second assignment, development of firewalls using iptables.

Week 8 saw a continuation on network layer security. IPsec was discussed in detail throughout the lecture, specifically how the three objectives could be acheived:

• Integrity
• Authentication
• Confidentiality

During the week I had a look at some open source implementation that enable there objectives:

• Kerebos – http://web.mit.edu/kerberos/ (Authentication only)
• Ubuntu ipsec-tools tutorial – https://help.ubuntu.com/community/IPSecHowTo
• IPSec how-to – http://www.ipsec-howto.org/t1.html

Still working on getting a practical test run going, aiming to do some testing with Wireshark to demonstrate the effectiveness of IPsec.

Unfortunately I missed week 7’s lecture thus will be making only a review of the lecture notes. The topic for week 7 was the IP layer and IP security. Using the simplistic network layering of App, Trans, Network, Data Link and Physical [All trains now depart promptly]. We see that the IP is a network level protocol. It is the most common network layer,  a list of other network layers can be found here: http://en.wikipedia.org/wiki/Network_Layer#Protocols. Importantly the function of the network layer is end-to-end routing of packets through networks. The security concerns listed in the lecture were:

• Authentication
• Message reply
• Message alteration
• Message delay and denial

Some of the original vulnerabilities associated with the IP layer (ping of death and smurf  attacks) were outlined. Next some of the key components of the IP layer were introduced:

• Bridge
• Router
• Gateway
• Firewall

With the basics out of the way, notes on how to increase the security of the network layer commenced. Authentication, Integrity and Confidentiality were identified and IPSec posed as a  partial solution. Authentication and confidentiality can be enhanced with IPsec through the Authentication Header [AH] and Encapsulating Security Payload [ESP].

The application of IPSec comes in two modes:

• Transport mode: Peer-to-peer communications, generally used in internal network comms. Data packets are encrypted, headers are not.
• Tunnel mode: Header and payload are encrypted, most commonly seen in remote-access.

The remainder of the lecture notes focussed on an explanation of the encryption and key exchanges. A decent summary video which helped me:

A couple of useful python scripts I made from copying the explanations on wikipedia:

Extended Euclidean algorithm – Used in RSA for determining the public key, once the private is chosen (see wikipage)

Pollard’s rho algorithm – One method for factorizing (see wikipage), try creating a semi prime with 20 digits then one with 60 digits. Time how long it takes for each 😉

Helpful link with some prime numbers for testing

Week 6 continued on the topic of firewalls. We got into some more detailed discussion about the implementation of the concept of firewalls. For example, the use of hardware/software and integration into the OS kernel etc. The question of where and how the firewall engine should be implemented generates a number of options. One thing to remember is that (all else being equal) a more secure configuration will result in less convenience for the business/users. The requirements in terms of security and convenience of each case must be the driving force behind decisions such as the FE implementation.

Next weeks lecture will be focussed on the IP layer and IP security. This week the focus for network security has been the RSA assignment so this is a short post!

Firewall was the topic of week 5’s lecture. We begun by discussing what the definition of a firewall is. We put it simply:

• A firewall is a “choke point/guard box” of controlling and monitoring the network traffic.„
• It allows interconnections between different networks with some level of trust.„
• It imposes restrictions on network services (only authorized traffic is allowed).„
• It enforces auditing and controlling access (alarms of abnormal behavior can be generated).„
• It provides perimeter defence.

Ideally a firewall will block all ‘bad’ traffic whilst allowing all good traffic. Differentiating between good and bad traffic is a very difficult task.

Some slides were dedicated to the demilitarized zone [DMZ]. As shown above the DMZ is a sub network which is exposed to the internet. One would usually see servers such as web, email and DNS in the DMZ.

After running through the key components of firewall architecture, the lecture focussed on the importance of organisation structure and needs. Knowing which services are required, who should be able to use them and from which locations they can be used is necessary knowledge.

Some firewall types were also explored in the lecture notes:

• Packet filtering [network layer]
• Stateful packet filtering
• Circuit level [transport layer]
• Proxy firewalls [Application level]

There was a lot more detail in the lecture notes which I look forward to hearing about in next weeks lecture.

The fourth lecture for network security continued down the path of encryption. We completed week three’s material discussing the reasoning behind and applications for encryption. The focus of week 4’s material was the public key encryption framework, specially the  RSA system. Although we had little time to discuss, also on the agenda were hash functions and Digital signatures.

The point of the public key system is that two people can have no shared secret key, yet still communicate securely.

Shared information: Public key[encrypt] (which may be certified by a certificate authority)  +  encryption algorithm

Private information: Private key [decrypt]

In this way party A can send an encrypted message to party B using party B’s public certificate.

The mathematical process for generating RSA public and private key pairs is amazing simple and effective:

1) Generate 2 prime numbers as randomly as possible; p and q

2) n = pq

3) as p and q are prime numbers -> φ(n) = (p – 1)(q – 1)   [φ – numberof coprimes]

4) Generate 2 numbers, e and d where:

-> (ed) mod φ(n) = 1

e is easy to generate as it must be coprime with φ(n).

then  d =  e^–1 mod φ(n)

With this in mind it can be seen that d [private key] can be found using (e,n) [public key]. However as the key size increases, the computing power [workload] required to break the encryption increases dramatically.

“RSA claims that 1024-bit keys are likely to become crackable some time between 2006 and 2010 and that 2048-bit keys are sufficient until 2030.”

In any case, now that we have our public and private key, how do we use them??

Lets say Alice wants to send a message ‘m’ to Bob.

1. Alice gets Bob’s public key – (e,n)
2. Alice encrypts here message before sending it: m^e(mod n)  -> encrypted message [c]
3. Bob decrypts using his private key(d,n):  c^d(mod n) -> message 😀

Some constraints to note:

• The message needs to be an integer between 1 and n… not difficult considering ascii
• Long messages need to be encrypted in block.

The lecture notes say that the good points of public key systems are that key distribution is not a problem.

This fact does not however protect Alice from being tricked by a MITM attack when she is retrieving Bob’s public key. Lets hope that Alice checks the validity of Bob’s public key and that the CA and software vendors ensure that vulnerabilities such as certificate chaining are avoided.

For an intersting presentation on the vulnerailities of the public key system used in https see: http://www.securitytube.net/video/157

Network security’s third lecture saw an introduction to cryptography. We actually spent the first half of the lecture finishing discussion on week 2’s topics.

First off came Private key vs Public key encryption a nice, clear, diagrammatic explanation of the difference can be for here: http://www.wdvl.com/Authoring/Tools/Tutorial/public_vs_private.html

The main difference between the two being that a public key system has both public and private keys. In a private key system, the same key is used for both encryption and decryption. A key issue here is how the key is to be distributed.

A simple example of how public key systems work: