9. Network Security

Question 1

distributed authentication

Answer 1

need to access different servers throughout the day
need to have different passwords for each service
hard to remember

Question 2

centralised authentication

Answer 2

server gives user key to access other services

• key is encrypted (user cannot decrypt)
• other servers can decrypt to validate

however, tickets can be captured and sent from attacker system (spoofing)

Question 3

Kerberos

Answer 3

1. user sends userID, password, and ticket grant sever ID
2. authentication server returns User(sessionKey, TGSKey(Ticket granting ticket))
3. user gets session key by decrypting with their own key
4. user sends sessionKey(user) + TGSKey(TGT) to Ticket Granting Server
5. server returns serviceServerKey(ticket) + sessionKey(serviceSessionKey)
6. user get service session key by decrypting with session key
7. user sends serviceSessionKey(user) + serviceServerKey(ticket) to service server
8. service server replies with serviceSessionKey(response)
9. user sends serviceSessionKey(email req)
10. service server replies with serviceSessionKey(email)

Question 4

protection against replay attacks

Answer 4

maintain a replay cache on ticket granting server

if duplicated authentication request detected, error

Question 5

kerberos limitation

Answer 5

1. machines needs to be time synched
2. tickets and keys stored on server may get compromised
3. key distribution center is a single point of failure

Question 6

malware

Answer 6

malicious software

• designed to intrude, cause harm
• affects data, time, hardware, reputation

Question 7

stuxnet

Answer 7

worm spreads using vulnerability

downloads payload and affect temperature controller

Question 8

cross platform malware

Answer 8

worm must be cross platform as unable to guarantee specific platform. if worm on wrong platform, cause errors and reveals itself

Question 9

malware types

Answer 9

1. worms
2. virus
3. trojans

Question 10

virus

Answer 10

1. needs a host to run
2. when host run, virus also gets executed
3. can be inserted via
   - overwriting
   - appending
   - prepending (best: virus runs and revert files to prevent error)
4. uses mutex to check if host has already been infected
5. when spreading, may change signatures

Question 11

mutated virus (metamorphic)

Answer 11

change instructions but still does the same thing

eg. a=1 to a=2-1 ….

Question 12

encrypted virus (polymorphic)

Answer 12

decrypts itself to run
keys changes to prevent identification
encryption algorithm can change

Question 13

virus anatomy

Answer 13

1. concealment
2. propagation
3. payload

Question 14

virus triggers

Answer 14

logic bomb

time bomb

Question 15

worms

Answer 15

1. no need host
2. harmless by itself, carries a payload
3. auto replicate

Question 16

trojan

Answer 16

1. hidden inside programs
2. targeted virus
3. do not replicate, need to remain hidden

Question 17

malware infection mediums

Answer 17

1. attachment emails
2. downloaded from internet
3. social engineering

vulnerabilities caused by:

• user apathy (it won’t happen to me)
• non awareness
• inadequate security policies

Question 18

malware defence

Answer 18

1. don’t install from untrusted sources
2. check email carefully
3. update anti virus
4. backup data
5. enforce policies
6. awareness training

Question 19

malware detection

Answer 19

1. use anti virus
   - identify and remove malware
   - stops infection in the first place
   - protect the resources rather than the entrance
   - dictionary to store virus signatures
2. integrity checker approach
   - identify changes to file due to malware
   - maintain copy of hashed file
   - if file is changed, signature will be different
3. activity monitor approach
   - monitor program behaviour
   - alert user if suspicious
   - quarantine file in VM to analyse
   • some virus are environmental aware
   • if ran in VM, just sleep

Question 20

signs of malware infection

Answer 20

1. program slow down
2. sudden drop in available memory
3. changes in program size
4. very old file recently modified

Question 21

malware analysis process

Answer 21

1. basic static analysis
2. advanced static analysis
3. basic dynamic analysis
4. advanced dynamic analysis