Quick Revision - Lectrure 7a

W7a – Network Security 1

Key terms to learn first

Key term	Simple definition
Network	Connected devices that communicate and share information.
Interception	Unauthorised viewing or capturing of data.
Modification	Unauthorised changing of data.
Fabrication	Creating fake data or messages.
Interruption	Preventing authorised users from accessing a service.
Sniffer	A tool that captures and monitors network traffic.
Spoofing	Pretending to be another device or user.
Port scanning	Checking devices for open network ports and services.
SSID	The name of a Wi-Fi network.
WEP	An old, insecure Wi-Fi encryption protocol.
WPA2	A stronger Wi-Fi security protocol that replaced WEP.
DoS	An attack that makes a service unavailable.
DDoS	A DoS attack launched from multiple compromised devices.
Botnet	A network of infected devices controlled remotely by an attacker.

1. Network transmission media

Networks use different methods to transfer information:

Cable: Transfers data through physical wires.
Optical fibre: Uses light to transmit data.
Microwave: Uses radio waves to transmit information.
Wi-Fi: Uses wireless radio signals.
Satellite communication: Sends information through satellites.

Communication media vulnerabilities

Attackers can target communication channels through:

Wiretapping: Secretly monitoring communications.
Sniffing: Capturing network traffic.
Rogue receivers: Unauthorised devices receiving communications.
Interception: Capturing information while it travels.
Impersonation: Pretending to be a legitimate user or device.

Remember: Data can be attacked while travelling between devices, not just when stored on a computer.

2. Four main threats to network communication

These are particularly important to remember.

Threat	Meaning	Example
Interception	Unauthorised viewing of information.	Attacker reads private messages.
Modification	Unauthorised changes to information.	Attacker changes a transaction amount.
Fabrication	Creating fake information.	Attacker creates a fake network message.
Interruption	Preventing access to information or services.	Attacker takes a website offline.

Modification and fabrication techniques

Data corruption: Information becomes damaged or incorrect.
Sequencing: Changing the order of data packets.
Substitution: Replacing legitimate data with different data.
Insertion: Adding unauthorised data into a communication.
Replay attack: Capturing legitimate data and sending it again later.

Replay attack

A user sends login information to a server.
An attacker intercepts the encrypted information.
The attacker captures the authentication message.
The attacker reuses the captured message to attempt access.

Key term: Replay attack = capturing and reusing legitimate communication.

3. Interruption and loss of service

Network services can become unavailable because of:

Routing problems: Incorrect routing information sends traffic to the wrong destinations.
Excessive demand: Too much traffic overwhelms network capacity.
Component failure: Hardware or software stops working.

4. Port scanning

Port scanning is a reconnaissance technique.
Attackers use it to discover open ports and available services.
It is commonly an early step in an attack.
Nmap is a tool used for network scanning.

Information discovered through a port scan includes:

Port number.
Protocol.
Port state.
Service.
Product.
Version.

Remember: Port scanning helps identify potential entry points into a network.

5. Wireless network vulnerabilities (Wi-Fi)

Wi-Fi has security risks involving three important security principles:

Confidentiality

Wireless messages can be intercepted by anyone within range.
Unencrypted messages can be read by attackers.

Integrity

Attackers can spoof legitimate devices.
They may take over or forge communication sessions.

Availability

Wireless services can be disrupted.
Examples include jamming and forced disassociation.

Other Wi-Fi weaknesses

Hidden SSIDs: Hidden network names can still be discovered by monitoring client requests.
SSID in frames: The network name may appear in wireless communication frames.
Rogue access points: Attackers create fake Wi-Fi access points.
SSID spoofing: Attackers copy trusted network names to trick devices into connecting.

6. WEP – Wired Equivalent Privacy

Insecure / outdated

WEP was designed to protect early Wi-Fi communications.
Its weaknesses were identified in 2001.
Attackers can crack WEP encryption within minutes.

How WEP works

The client and access point share a pre-shared key.
The access point sends a random number to the client.
The client encrypts the number using the shared key.
The access point decrypts and checks the number.
If authentication succeeds, encrypted communication begins.

WEP weaknesses

Weakness	Explanation
Weak encryption key	Effective key sizes are only 40 or 104 bits.
Static key	The same key may be reused for months.
Brute-force attacks	Attackers can repeatedly guess encryption keys.
RC4 weaknesses	WEP uses RC4 in a flawed way.
IV collisions	Repeated initialization vectors weaken encryption.
Faulty integrity check	Its checksum does not adequately protect against malicious modification.
No proper authentication	Knowledge of the access point's SSID and MAC address can be treated as sufficient in the described system.

Important terms:

IV (Initialization Vector): A value used to help initialise encryption.
Brute force: Repeatedly trying possible passwords or keys.
Dictionary attack: Trying words and commonly used passwords.
RC4: An encryption algorithm used by WEP.

7. WPA and WPA2

Stronger than WEP

WPA was introduced in 2003 to replace WEP.
WPA2 followed in 2004.
WPA2 introduced stronger security mechanisms.

Advantages over WEP

Non-static keys: New session keys are generated.
Automatic key changes: Encryption keys change for each packet, as described in the lecture.
Authentication: Can use passwords, tokens or certificates.
AES encryption: Provides stronger encryption.
Integrity protection: Uses cryptographic integrity checks.
Four-way handshake: Establishes separate encryption and integrity keys.

Remember:

WEP = weak and outdated.
WPA = improved replacement.
WPA2 = stronger security using AES and improved key management.

8. Denial of Service (DoS)

DoS (Denial of Service):

An attack designed to make a system or service unavailable.
Prevents legitimate users from accessing a resource.
Often overwhelms the victim or exploits a software weakness.

Types of DoS attacks covered in the lecture:

Ping flood

Attacker sends a large number of ping requests to a victim.
The victim becomes overwhelmed with requests and replies.
Uses network bandwidth and resources.

Smurf attack

Attacker sends a broadcast Echo request to a network.
The attacker uses the victim's address as the return address.
Multiple devices respond to the victim.
The victim becomes overwhelmed by replies.

Echo-Chargen attack

Two systems are made to repeatedly send and echo messages to each other.
This creates unnecessary traffic.
Can overwhelm the systems.

Teardrop attack

Attacker sends incorrectly fragmented IP packets.
The fragments contain conflicting reassembly instructions.
The victim struggles to reconstruct the packets.
In extreme cases, the operating system may crash or lock up.

DNS spoofing

Attacker pretends to be a DNS server.
Sends false DNS information.
Redirects users to malicious websites.

DNS (Domain Name System): Converts domain names into IP addresses.

Routing disruption

Routers use routing information to determine where packets should travel.
Incorrect or malicious routing information can disrupt network communication.
This may cause a loss of service.

Session hijacking

An attacker takes over an existing communication session.
The attacker interferes with the connection between the sender and receiver.
The legitimate sender may lose control of the session.

9. DDoS – Distributed Denial of Service

DDoS = DoS attack launched using multiple compromised devices.

How it works:

Attacker infects multiple computers with malicious software.
These infected computers become part of an attack network.
The attacker selects a target.
All compromised devices send traffic to the victim simultaneously.
The victim becomes overwhelmed.

Botnets

A botnet is a collection of infected devices controlled remotely.
Devices are often infected with malicious code.
Attackers use botnets to launch DDoS attacks.

C&C (Command and Control):

- The system attackers use to communicate with and control infected devices.

Zombie: An infected device that is controlled by an attacker.

Remember the difference:

DoS	DDoS
Usually comes from one attacking source.	Comes from multiple attacking devices.
Attempts to overwhelm a target.	Uses a coordinated network of devices to overwhelm a target.