Network Security

Question 1

Firewalls

Answer 1

• protect inside from outside

- have certain rules to protect

Question 2

Stateful Firewalls

Answer 2

• directory of UDP TCP connection
• connection states:
• > NEW: packet starts new connection/stream
• > ESTABLISHED: packet is associated to existing connection
• > RELATED: packet starts new connection associated to existing one

action src sport dst dport state
allow $INSIDE * * 80443 NEW -> allows new connections
allow * * * * ESTABLISHED -> allow established going out

Question 3

DMZ Networks

Answer 3

• separate internal from external network
• DMZ (Demilitarized Zone) accessible from outside
  internet
  ↓
  external firewall
  ↓
  lan switch -> web server, mail, dns
  ↓
  internal firewall
  ↓
  lan switch -> database, workstation etc

Question 4

Denial-of-Service targets

Answer 4

CPU -> overload target with complex calculations
RAM -> consume all of memory for processing requests
Bandwidth -> exhaust network bandwidth

Question 5

Distributed Denial-of-Service (DDoS)

Answer 5

• with a botnet

- multiple attacks traffic

Question 6

ICMP/UDP Floods

Answer 6

• target bandwidth
• send a lot of repeated requests
• only works when BW_att»_space; BW_target

Question 7

SYN Floods: attack and defence

Answer 7

• tries to attack TCP stack
• SYN opens TCP connection half way
• > exhaust memory by 1000s open time

solve: SYN cookies -> cookie has an ACK so needs to wait for attacker

Question 8

Reflection Attacks

Answer 8

• set source IP to items ip address

- reflectors will then send to target

Question 9

Amplification Attacks

Answer 9

• use reflector idea

- then use some protocol that needs a bigger response from server

Question 10

HTTP Flood

Answer 10

• flood server with fetching data

- very low effort for attacker

Question 11

Slowloris

Answer 11

• HTTP attack
• send an incomplete request
• send time after time more information

Question 12

R.U.D.Y.

Answer 12

• HTTP attack
• send POST ans specify large content
• slowly send parameters

Question 13

Compression bombs as HTTP

Answer 13

• HTTP support compression

- when arrives zip bomb

Question 14

Water Torture Attack

Answer 14

• DNS based attack

- overload authoritie name server with queries

Question 15

Upstream filters

Answer 15

• DoS defence

- high ISPs blacklist

Question 16

Anti-Spoofing

Answer 16

• DoS defence

- block spoofed traffic

Question 17

Detect & Block - DoS

Answer 17

• Detect and block DoS attacks
• Firewalls
• traffic analysis
• etc.

Question 18

Traffic Shaping

Answer 18

• Rate limiting; just allow maximum
• CAPTCHAs
• Reputation-based blocking

Question 19

DNS: Name Resolution

Answer 19

me -> . (root): IP of syssec.mmci.uni-saarland.de
. (root) -> me: NS .de is at 194.0.0.53

me -> de.: IP of syssec.mmci.uni-saarland.de
de. -> me: NS uni-saarland.de is at 134.96.7.7

me ->:IP of syssec.mmci.uni-saarland.de?
uni-saarland.de. -> me:NS mmci.uni-saarland.de is at 139.19.1.1

me ->:IP of syssec.mmci.uni-saarland.de?
mmci.uni-saarland.de. -> me:IP of syssec.mmci.uni-saarland.de is 139.19.86.150

Question 20

DNS Recursive Resolvers vs. Authoritative NS

Answer 20

RR A NS
serve DNS clients Server recursive resolver
Resolve any domain only replies domains that are in its zone
iterate query denies recursive domains

Question 21

DNS Cache Poisoning

Answer 21

• Inject attacker-specified RRs(Recursive resolver) to cache

- can redirect, disable

Question 22

DNS Cache Snooping

Answer 22

• Did a client recently visit domain X
• Attacker probes resolver for cached entries
• can find website out

Question 23

DNSSEC

Answer 23

• DNSSEC signs resource record
• DNSSEC RRSIG contains signature for set of RRs
• Resolver verifies signature (RRSIG RR)
• Resolver verifies public key (DNSKEY RR)

Question 24

DNSSEC criticism

Answer 24

• give to governing country power
• DNS size bigger -> DDoS
• not end to end security

Question 25

DANE

Answer 25

- DNS-based Authentication of Named Entities | - support TLS in validating certificates