Telecommunications and Network Security

Overview

The Telecommunications and Network Security domain is the most detailed and comprehensive domain of study for the CISSP test.

Caveat: If you’re an experienced network engineer, some of this information may seem simplistic or out of date. This is not the latest and greatest network security info, but this information is what you’ll need to know to study for the CISSP exam.

The professional should fully understand the following:

The Telecommunications and Network Security domain includes the structures, transmission methods, transport formats, and security measures that provide confidentiality, integrity, availability, and authentication for transmissions over private and public communications networks and media. This domain is the information security domain that is concerned with protecting data, voice, and video communications and ensuring the following:

The Telecommunications Security domain of information security is also concerned with the prevention and detection of the misuse or abuse of systems, which poses a threat to the tenets of Confidentiality, Integrity, and Availability (C.I.A.).

The C I A Triad

The fundamental information systems security concept of C.I.A. relates to the Telecommunications domain in the following three ways.

Confidentiality

Confidentiality is the prevention of the intentional or unintentional unauthorized disclosure of contents. Loss of confidentiality can occur in many ways. For example, loss of confidentiality can occur through the intentional release of private company information or through a misapplication of network rights.

Some of the elements of telecommunications used to ensure confidentiality are:

Integrity

Integrity is the guarantee that the message sent is the message received and that the message is not intentionally or unintentionally altered. Loss of integrity can occur either through an intentional attack to change information (for example, a web site defacement) or, most commonly, through accidental alteration of data by an operator. Integrity also contains the concept of nonre-pudiation of a message source, which we will describe later.

Some of the elements used to ensure integrity are:

Availability

This concept refers to the elements that create reliability and stability in networks and systems. Availability ensures that connectivity is accessible when needed, allowing authorized users to access the network or systems. Also included in that assurance is the guarantee that security services for the security practitioner are usable when they are needed. The concept of availability also tends to include areas in Information Systems (IS) that are traditionally not thought of as pure security (such as guarantee of service, performance, and up time) yet are obviously affected by an attack such as a denial of service (DoS).

Some of the elements that are used to ensure availability are:

You should also know another point about availability: The use of ill-structured security mechanisms can also affect availability. Overengineered or poorly designed security systems can impact the performance of a network or system as seriously as an intentional attack can.

The C.I.A. triad is often represented by a triangle, as shown in Figure 3-1.

Figure 3-1: The C.I.A. triad.

Before we start to look at the various infrastructure devices and elements, we need to take a quick look at the OSI model and the TCP/IP protocol suite. These devices use many different protocols at varying OSI model layers, and the CISSP candidate will need to know one from another.

Protocols

In this section, we will examine the OSI and the TCP/IP layered models and the protocols that accompany each of these models.

A protocol is a standard set of rules that determine how computers communicate with each other across networks. When computers communicate with one another, they exchange a series of messages. A protocol describes the format that a message must take and the way in which computers must exchange messages. Protocols enable different types of computers, such as Macintoshes, PCs, Unix systems, and so on, to communicate in spite of their differences. They communicate by describing a standard format and communication method and by adhering to a layered architecture model.

The Layered Architecture Concept

Layered architecture is a conceptual blueprint of how communications should take place. It divides communication processes into logical groups called layers.

There are many reasons to use a layered architecture:

How Data Moves through a Layered Architecture

Data is sent from a source computer to a destination computer. In a layered architecture model, the data passes downward through each layer from the highest layer (the Application Layer, Layer 7 in the OSI model) to the lowest layer (the Physical Layer, Layer 1 of the OSI model) of the source. It is then transmitted across the medium (cable) and is received by the destination computer, where it is passed up the layers in the opposite direction from the lowest (Layer 1) to the highest (Layer 7).

LAYERED MODELS

Layered models serve to enhance the development and management of a network architecture. They primarily address issues of data communications, but they also include some data processing activities at the upper layers. These upper layers address application software processes, the presentation format, and the establishment of user sessions. Each independent layer of a network architecture addresses different functions and responsibilities. All of these layers work together to maximize the performance of the process and interoperability. Examples of the various functions addressed are data transfer, flow control, sequencing, error detection, and notification.

Each of the various protocols operates at specific layers. Each protocol in the source computer has a job to do: Each one is responsible for attaching its own unique information to the data packet when it comes through its own layer. When the data packet reaches the destination computer, it moves up the model. Each protocol on the destination computer also has a job to do: Each protocol detaches and examines only the data that was attached by its protocol counterpart at the source computer; then it sends the rest of the packet up the protocol stack to the next higher layer. Each layer at each destination sees and deals only with the data that was packaged by its counterpart on the sending side.

Open Systems Interconnect (OSI) Model

In the early 1980s, the Open Systems Interconnect (OSI) reference model was created by the International Organization for Standardization (ISO) to help vendors create interoperable network devices. The OSI reference model describes how data and network information are communicated from one computer through a network media to another computer.

The OSI reference model breaks this approach into seven distinct layers. Layering divides a piece of data into functional groups that permit an easier understanding of each piece of data. Each layer has a unique set of properties and directly interacts with its adjacent layers. The process of data encapsulation wraps data from one layer around a data packet from an adjoining layer.

DATA ENCAPSULATION

Data encapsulation is the process in which the information from one data packet is wrapped around or attached to the data of another packet. In the OSI reference model, each layer encapsulates the layer immediately above it as the data flows down the protocol stack. The logical communication that happens at each layer of the OSI reference model does not involve a separate physical connection, because the information that each protocol needs to send is encapsulated within the protocol layer.

The Seven Layers

The OSI reference model is divided into seven layers, which we will examine here. (The mnemonic phrase “All People Seem to Need Data Processing” (APSTNDP) can be used to remember the names of the OSI layers.)

OSI Security Services and Mechanisms

OSI defines six basic security services to secure OSI communications. A security service is a collection of security mechanisms, files, and procedures that help protect the network. They are:

  1. Authentication

  2. Access control

  3. Data confidentiality

  4. Data integrity

  5. Nonrepudiation

  6. Logging and monitoring

In addition, the OSI model defines eight security mechanisms. A security mechanism is a control that is implemented in order to provide the six basic security services. These are:

  1. Encipherment

  2. Digital signature

  3. Access control

  4. Data integrity

  5. Authentication

  6. Traffic padding

  7. Routing control

  8. Notarization

Transmission Control Protocol Internet Protocol (TCP IP)

Transmission Control Protocol/Internet Protocol (TCP/IP) is the common name for the suite of protocols originally developed by the Department of Defense (DoD) in the 1970s to support the construction of the Internet. The Internet is based on TCP/IP, which is named for the two best-known protocols in the suite. A CISSP candidate should be familiar with the major properties of TCP/IP and should know which protocols operate at which layers of the TCP/IP protocol suite.

TCP/IP Protocols

Table 3-1 lists some important protocols that populate the TCP/IP model and their related layers.

Table 3-1: TCP/IP Protocols

Open table as spreadsheet

LAYER

PROTOCOL

Host-to-host

Transmission Control Protocol (TCP)

Host-to-host

User Datagram Protocol (UDP)

Internet

Internet Protocol (IP)

Internet

Address Resolution Protocol (ARP) l

Internet

Reverse Address Resolution Protocol (RARP)

Internet

Internet Control Message Protocol (ICMP)

Figure 3-2 shows OSI model layers mapped to their corresponding TCP/IP protocols.

Figure 3-2: OSI model layers mapped to TCP/IP protocols.

Transmission Control Protocol (TCP)

TCP provides a full-duplex, connection-oriented, reliable connection. Incoming TCP packets are sequenced to match the original transmission sequence numbers. Because any lost or damaged packets are retransmitted, TCP is very costly in terms of network overhead and is slower than UDP. Reliable data transport is addressed by TCP to ensure that the following goals are achieved:

User Datagram Protocol (UDP)

UDP is similar to TCP but gives only a “best effort” delivery, which means it offers no error correction, does not sequence the packet segments, and does not care in which order the packet segments arrive at their destination. Consequently, it’s referred to as an unreliable protocol.

UDP does not create a virtual circuit and does not contact the destination before delivering the data. Thus, it is also considered a connectionless protocol. UDP imposes much less overhead, however, which makes it faster than TCP for applications that can afford to lose a packet now and then, such as streaming video or audio. Table 3-2 illustrates the differences between TCP and UDP.

Table 3-2: TCP versus UDP

Open table as spreadsheet

TCP

UDP

Sequenced

Unsequenced

Connection-oriented

Connectionless

Reliable

Unreliable

High overhead

Low overhead

Slower

Faster

CONNECTION-ORIENTED VERSUS CONNECTIONLESS NETWORK SERVICES

The traditional telephone-versus-letter example may help you to understand the difference between TCP and UDP. Calling someone on the phone is like TCP because you have established a virtual circuit with the party at the other end. That party may or may not be the person you want to speak to (or might be an answering machine), but you know whether or not you spoke to them. Alternatively, using UDP is like sending a letter. You write your message, address it, and mail it. This process is like UDP’s connectionless property. You are not really sure it will get there, but you assume the post office will provide its best effort to deliver it.

TCP and UDP must use port numbers to communicate with the upper layers. Port numbers are used to keep track of the different conversations that are simultaneously crossing the network. Originating source port numbers dynamically assigned by the source host are usually some number greater than 1023.

Internet Protocol (IP)

All hosts on the Internet have a logical ID called an IP address. On the Internet, and on any network using IP, each data packet is assigned the IP address of the sender and the IP address of the recipient. Each device then receives the packet and makes routing decisions based upon the packet’s destination IP address. Each device then receives the packet and makes routing decisions based upon the packet’s destination IP address.

IP provides an unreliable datagram service, meaning that it does not guarantee that the packet will be delivered at all, that it will be delivered only once, or that it will be delivered in the order in which it was sent.

Address Resolution Protocol (ARP)

IP needs to know the hardware address of the packet’s destination so that it can send the packet. ARP is used to match an IP address to a Media Access Control (MAC) address. ARP allows the 32-bit IP address to be matched up with this hardware address.

A MAC address is a 6-byte, 12-digit hexadecimal number subdivided into two parts. The first three bytes (or first half) of the MAC address is the manu-facturer’s identifier (see Table 3-3). This can be a good troubleshooting aid if a network device is acting up, because it will isolate the brand of the failing device.[*] The second half of the MAC address is the serial number the manufacturer has assigned to the device.

Table 3-3: Common Vendors’ MAC addresses

Open table as spreadsheet

FIRST THREE BYTES

MANUFACTURER

00000C

Cisco

0000A2

Bay Networks

0080D3

Shiva

00AA00

Intel

02608C

3COM

080007

Apple

080009

Hewlett-Packard

080020

Sun

08005A

IBM

ARP interrogates the network by sending out a broadcast seeking a network node that has a specific IP address and then asking it to reply with its hardware address. ARP maintains a dynamic table (known as the ARP cache) of these translations between IP addresses and MAC addresses so that it has to broadcast a request to every host only the first time it is needed. Figure 3-3 shows a flow chart of the ARP decision process.

Figure 3-3: The ARP decision process.

Reverse Address Resolution Protocol (RARP)

In some cases the MAC address is known but the IP address needs to be discovered. This is sometimes the case when diskless machines are booted onto the network. Using RARP, the machine sends out a packet that includes its MAC address along with a request to be informed of which IP address should be assigned to that MAC address. A RARP server responds with the answer.

Internet Control Message Protocol (ICMP)

ICMP is a management protocol and messaging service provider for IP. ICMP’s primary function is to send messages between network devices regarding the health of the network. It can inform hosts of a better route to a destination if there is trouble with an existing route, and it can help identify the problem with a route. PING is an ICMP utility used to check the physical connectivity of machines on a network.

Other TCP/IP Protocols

[*]Source: Mastering Network Security, Chris Brenton (Sybex, 1999).

LAN Technologies

A local area network (LAN) (see Figure 3-4) is a discrete network that is designed to operate in a specific, limited geographic area such as a single building or floor. LANs connect workstations and file servers together so that they can share network resources such as printers, e-mail, and files. LAN devices connect to one another by using a type of connection medium (such as copper wire or fiber optics), and they use various LAN protocols and access methods to communicate through LAN devices (such as bridges or routers). LANs can also be connected to a public switched network.

Figure 3-4: Local Area Networks (LANs).

LAN media access methods control the use of a network (its Physical and Data Link Layers). Next we will discuss the basic characteristics of Ethernet, ARCnet, Token Ring, and FDDI - the LAN technologies that account for virtually all deployed LANs.

Ethernet

The Ethernet media access method transports data to the LAN by using Carrier-Sense Multiple Access with Collision Detection (CSMA/CD), discussed shortly in the section “LAN Transmission Protocols.” Currently, this term is often used to refer to all CSMA/CD LANs. Ethernet was designed to serve on networks with sporadic, occasionally heavy traffic requirements. Ethernet defines a bus-topology LAN. Figure 3-5 shows an Ethernet network segment, and Table 3-4 lists the various Ethernet types.

Figure 3-5: Ethernet network segment.

Table 3-4: Ethernet Types

Open table as spreadsheet

ETHERNET TYPE

CABLE TYPE

RATED SPEED

RATED DISTANCE

10Base2

Thinnet coax

10 Mbps

185 meters

10Base5

Thicknet coax

10 Mbps

500 meters

10BaseT

UTP

10 Mbps

300 meters

100BaseT (TX, T4, Fast Ethernet)

UTP

100 Mbps

300 meters

1000BaseT (Gigabit Ethernet)

UTP

100 Mbps

300 meters

ARCnet

ARCnet is one of the earliest LAN technologies. It uses a token-passing access method in a star topology on coaxial cable. ARCnet provides predictable, if not fast, network performance. One issue with ARCnet stations is that the node address of each station has to be manually set during installation, thus creating the possibility of duplicate, conflicting nodes.

Token Ring

IBM originally developed the Token Ring network in the 1970s. It is second only to Ethernet in general LAN popularity. The term Token Ring refers both to IBM’s Token Ring network and to IEEE 802.5 networks. All end stations are attached to a device called a Multistation Access Unit (MSAU). One station on a Token Ring network is designated the active monitor. The active monitor makes sure that there is not more than one token on the ring at any given time. If a transmitting station fails, it probably cannot remove a token as it makes it way back onto the ring. In this case, the active monitor will step in, remove the token, and generate a new one.

Fiber Distributed Data Interface (FDDI)

Like Token Ring, FDDI is a token-passing media access topology. It consists of a dual ring LAN that operates at 100 Mbps or more over fiber optic cabling. FDDI employs a token-passing media access with dual counterrotating rings, and with only one ring active at any given time. If a break or outage occurs, the ring will then wrap back the other direction, keeping the ring intact. The following are the major advantages of FDDI:

The major drawbacks of FDDI are its expense and the expertise needed to implement it properly.

A variation of FDDI called Copper Distributed Data Interface (CDDI) uses a UTP cable to connect servers or other stations into the ring instead of using fiber-optic cable. Unfortunately, this introduces the basic problems that are inherent with the use of copper cabling (length and interference problems).

DUELING ETHERNETS

Digital, Intel, and Xerox teamed up to create the original Ethernet I standard in 1980. In 1984, they followed up with the release of Ethernet II. The Institute of Electrical and Electronic Engineers (IEEE) founded the 802.3 subcommittee to create an Ethernet standard that was almost identical to the Ethernet II version. These two standards differ only in their descriptions of the Data Link Layer: Ethernet II has a “Type” field, whereas 802.3 has a “Length” field. Otherwise, both are the same in their Physical Layer specifications and MAC addressing.

Cabling Types

Network cabling commonly comes in three types: twisted pair, coaxial, and fiber-optic, as shown in Figure 3-6.

Figure 3-6: Cabling types.

Coaxial Cable (Coax)

Coax consists of a hollow outer cylindrical conductor that surrounds a single, inner wire conductor. Two types of coaxial cable are currently used in LANs: 50-ohm cable, which is used for digital signaling, and 75-ohm cable, which is used for analog signaling and high-speed digital signaling. Coax requires fixed spacing between connections.

Coax is more expensive, yet it is more resistant to electromagnetic interference (EMI) than twisted pair cabling and can transmit at a greater bandwidth and distance. However, twisted pair cabling is so ubiquitous that most installations rarely use coax except in special cases, such as broadband communications.

Coax can come in two types for LANs:

  1. Thinnet - (RG58 size)

  2. Thicknet - (RG8 or RG11 size)

There are two common types of coaxial cable transmission methods:

  1. Baseband - The cable carries only a single channel. Baseband is a transmission method that is accomplished by applying a direct current to a cable. The currents, or signals, hold binary information. Higher voltage usually represents the binary value of 1, whereas lower voltage represents the binary value of 0. Ethernet is baseband.

  2. Broadband - The cable carries several usable channels, such as data, voice, audio, and video. Broadband includes leased lines (T1 and T3), ISDN, ATM, DSL, Broadband wireless, and CATV.

Baseband uses the full cable for its transmission, whereas broadband usually divides the cable into channels so that different types of data can be transmitted at the same time. Baseband permits only one signal to be transmitted at a time, whereas broadband carries several signals over different channels.

Twisted Pair

Twisted pair cabling is a relatively low-speed transmission medium, which consists of two insulated wires that are arranged in a regular spiral pattern. The wires can be shielded (STP) or unshielded (UTP). UTP cabling is a four-pair wire medium used in a variety of networks. UTP does not require the fixed spacing between connections that is necessary with coaxial-type connections.

UTP comes in several categories. The category rating is based on how tightly the copper cable is wound within the shielding: the tighter the wind, the higher the rating and its resistance against interference and attenuation. In fact, UTP Category 3 wire was often used for phone lines, but now the Category 5 wire is the standard, and even higher categories are available. Eavesdroppers can more easily tap UTP cabling than the other cable types. The categories of UTP are:

Table 3-5 shows the UTP categories and their rated performance.

Table 3-5: UTP Categories of Performance

Open table as spreadsheet

UTP CAT

RATED PERFORMANCE

COMMON APPLICATIONS

Cat1

Under 1 MHz

Analog Voice, older ISDN BRI

Cat2

1 MHz

IBM 3270, AS/400/Apple LocalTalk

Cat3

16 MHz

!0BaseT, 4 Mbps Token Ring

Cat4

20 MHz

16 Mbps Token Ring

Cat5

100 MHz

100BaseT

Fiber Optic Cable

Fiber-optic cable is a physical medium that is capable of conducting modulated light transmission. Fiber-optic cable carries signals as light waves, thus allowing higher transmission speeds and greater distances due to less attenuation. This type of cabling is much more difficult to tap than other cabling and is the most resistant to interference, especially EMI. It is sometimes called optical fiber.

Fiber-optic cable is usually reserved for the connections between backbone devices in larger networks. In some very demanding environments, however, fiber-optic cable connects desktop workstations to the network or links to adjacent buildings. Fiber-optic cable is the most reliable cable type, but it is also the most expensive to install and terminate.

Fiber-optic cable has three basic physical elements:

Figure 3-7 shows a cross section of a fiber optic-cable and its layers.

Figure 3-7: Fiber-optic cable cross section.

Cabling Vulnerabilities

Failures and issues with cables often constitute a large part of the network’s problems. The CISSP candidate should be aware of a few of them.

Coaxial cabling has two primary vulnerabilities: cable failure and length issues. All network devices attached to the same length of coax in a bus topology are vulnerable to disconnection from the network if the cable is broken or severed. This was one reason the star and ring topologies overtook the bus topology in installed base. Also, exceeding the specified effective cable length can be a source of cabling failures.

Twisted pair cables currently have two categories in common usage: CAT3 and CAT5. The fundamental difference between these two types is how tightly the copper wires are wound. This tightness determines the cable’s resistance to interference, the allowable distance it can be pulled between points, and the data’s transmission speed before attenuation and crosstalk begin to affect the signal. CAT3 is an older specification with a shorter effective distance, and it can contribute to failure if the specified effective cable length (100 meters in most cases) is exceeded.

UTP does not require the fixed spacing between connections that is necessary with some coaxial-type connections. UTP also is not as vulnerable to failure due to cable breaks as coax, but eavesdroppers can more easily tap UTP cabling than either coax or fiber.

Fiber-optic cable is immune to the effects of noise and electromagnetic interference (EMI) and therefore has a much longer effective usable length (up to 2 kilometers in some cases). It can carry a heavy load of activity much more easily than the copper types, and as such it is commonly used for infrastructure backbones, server farms, or connections that need large amounts of bandwidth. The primary drawbacks of this cable type are its cost of installation and the high level of expertise needed to have it properly terminated.

Cable failure terms to remember are:

Transmission Types

In addition, a CISSP candidate should know the difference between analog and digital transmission. Figure 3-8 shows the difference between an analog and a digital signal, and Table 3-6 shows the difference between analog and digital technologies.

Figure 3-8: Examples of analog and digital signals.

Table 3-6: Analog versus Digital Technologies

Open table as spreadsheet

ANALOG

DIGITAL

Infinitely varying wave form

Square wave form

Continuous signal

Pulses

Varied by amplification

On-off only

ASYNCHRONOUS AND SYNCHRONOUS COMMUNICATIONS

Asynchronous communication transfers data by sending bits of data sequentially. Start and stop bits mark the beginning and the end of each transfer. Communications devices must operate at the same speed to communicate asynchronously. Asynchronous communication is the basic language of modems and dial-up remote access systems. Synchronous communication is characterized by very high-speed transmission rates governed by electronic clock timing signals.

Network Topologies

A network topology defines the manner in which the network devices are organized to facilitate communications. A LAN topology defines this transmission manner for a Local Area Network. There are five common LAN topologies: bus, ring, star, tree, and mesh.

Bus

In a bus topology, all the transmissions of the network nodes travel the full length of cable and are received by all other stations (see Figure 3-9). Ethernet primarily uses this topology. This topology does have some faults. For example, when any station on the bus experiences cabling termination errors, the entire bus can cease to function.

Figure 3-9: A bus topology.

Ring

In a ring topology, the network nodes are connected by unidirectional transmission links to form a closed loop (see Figure 3-10). Token Ring and FDDI both use this topology.

Figure 3-10: A ring topology.

Star

In a star topology, the nodes of a network are connected directly to a central LAN device (see Figure 3-11). Here is where it gets a little confusing: The logical bus and ring topologies that we previously described are often implemented physically in a star topology. Although Ethernet is logically thought of as a bus topology (its first implementations were Thinnet and Thicknet on a bus), 10BaseT is actually wired as a star topology, which provides more resiliency for the entire topology when a station experiences errors.

Figure 3-11: A star topology.

Tree

The tree topology (as shown in Figure 3-12) is a bus-type topology where branches with multiple nodes are possible.

Figure 3-12: A tree topology.

Mesh

In a mesh topology, all the nodes are connected to every other node in a network (see Figure 3-13). This topology may be used to create backbone-redundant networks. A full mesh topology has every node connected to every other node. A partial mesh topology may be used to connect multiple full mesh networks together.

Figure 3-13: A mesh topology.

LAN Transmission Protocols

LAN transmission protocols are the rules for communication between computers on a LAN. These rules oversee the various steps in communicating, such as the formatting of the data frame, the timing and sequencing of packet delivery, and the resolution of error states.

Carrier Sense Multiple Access (CSMA)

This is the foundation of the Ethernet communications protocol. It has two functional variations: CSMA/CA and CSMA/CD; the latter is the Ethernet standard. In CSMA, a workstation continuously monitors a line while waiting to send a packet, and then transmits the packet when it thinks the line is free. If the workstation doesn’t receive an acknowledgment from the destination to which it sent the packet, it assumes a collision has occurred, and it resends the packet. This is defined as persistent carrier sense. Another version of CSMA is called nonpersistent carrier sense, in which a workstation waits a random amount of time before resending a packet, thus resulting in fewer errors.

Carrier-Sense Multiple Access with Collision Avoidance (CSMA/CA)

In this variation of CSMA, workstations are attached to two coaxial cables. Each coax cable carries data signals in one direction only. A workstation monitors its receive cable to determine whether the carrier is busy. It then communicates on its transmit cable if it detects no carrier. Thus, the workstation transmits its intention to send when it feels the line is clear due to a precedence that is based upon previously established tables. Pure CSMA does not have a feature to avoid the problem of one workstation dominating a conversation.

Carrier-Sense Multiple Access with Collision Detection (CSMA/CD)

Under the Ethernet CSMA/CD media-access process, any computer on a CSMA/CD LAN can access the network at any time. Before sending data, CSMA/CD hosts listen for traffic on the network. A host wanting to send data waits until it does not detect any traffic before it transmits. Ethernet enables any host on a network to transmit whenever the network is quiet. In addition, the transmitting host constantly monitors the wire to make sure that no other hosts begin transmitting. If the host detects another signal on the wire, it then sends out an extended jam signal, which causes all nodes on the segment to stop sending data. These nodes respond to that jam signal by waiting a bit before attempting to transmit again.

CSMA/CD was created to overcome the problem of collisions that occur when packets are simultaneously transmitted from different nodes. Collisions occur when two hosts listen for traffic and, upon hearing none, they both transmit simultaneously. In this situation, both transmissions are damaged and the hosts must retransmit at a later time.

Polling

In the polling transmission method, a primary workstation checks a secondary workstation regularly at predetermined times to determine whether it has data to transmit. Secondary workstations cannot transmit until the primary host gives them permission. Polling is commonly used in large mainframe environments where hosts are polled to determine whether they need to transmit. Because polling is very inexpensive, low-level and peer-to-peer networks also use it.

Token Passing

Used in Token Ring, FDDI, and Attached Resource Computer Network (ARC-net) networks, stations in token-passing networks cannot transmit until they receive a special frame, called a token. Possession of this token grants the right to transmit. If a node that is receiving the token has no information to send, it passes the token to the next end station. This arrangement prevents the collision problems that are present in CSMA. Token-passing networks will work well if large, bandwidth-consuming applications are commonly used on the network.

Token Ring and IEEE 802.5 are two principal examples of token-passing networks. Each station can then hold the token for a maximum period of time, as determined by the 802.5 specification.

Unlike CSMA/CD networks (such as Ethernet), token-passing networks are deterministic, which means that it is possible to calculate the maximum time that will pass before any end station can transmit. This feature and the fact that collisions cannot occur make Token Ring networks ideal for applications in which the transmission delay must be predictable and robust network operation is important. Factory automation environments are examples of such applications.

Unicast, Multicast, Broadcast

There are three flavors of LAN transmission methods:

Networking Devices

Many networking devices coexist on the Internetwork. These devices provide communications between hosts, computers, and other network devices. The following sections describe the major categories of these devices.

Hubs and Repeaters

Repeaters and hubs operate at the Physical Layer of the OSI model. Repeaters amplify the data signal to extend the length of a network segment, and they help compensate for signal deterioration due to attenuation. Hubs and repeaters are used to connect multiple LAN devices, such as servers and workstations. They do not add much intelligence to the communications process, however, because they don’t filter packets, examine addressing, or alter the data packet. Figure 3-14 shows a repeater or hub amplifying the network signal.

Figure 3-14: A hub or repeater.

Bridges

Like hubs, bridges also amplify the data signals, but they make intelligent decisions as to where to forward the data. A bridge forwards the data to all other network segments if the Media Access Control (MAC) address of the destination computer is not on the local network segment. If the destination computer is on the local network segment, it does not forward the data.

Because bridges operate at the Data Link Layer, OSI Layer 2, they do not use IP addresses (IP information is attached in the Network Layer, Layer 3). Because a bridge automatically forwards any broadcast traffic to all ports, an error state known as a broadcast storm can develop, overwhelming the network devices. Figure 3-15 shows a bridged network.

Figure 3-15: A bridged network.

BROADCASTS

A broadcast is a data packet (FF.FF.FF.FF) that is sent to all network stations at the same time. Broadcasts are an essential function built into all protocols. When servers need to send data to all the other hosts on the network segment, network broadcasts are useful. If a lot of broadcasts are occurring on a network segment, however, network performance can be seriously degraded. It is important to use these devices properly and to segment the network correctly.

Spanning Tree

To prevent broadcast storms and other unwanted side effects of looping, Digital Equipment Corporation created the Spanning Tree Protocol (STP), which has been standardized as the 802.1d specification by the IEEE.

A spanning tree uses the spanning tree algorithm (STA), which senses that the switch has more than one way to communicate with a node and determines which way is best. It blocks out the other paths but keeps track of them in case the primary path becomes unavailable.

Switches

A switch is similar to a bridge or a hub, except that a switch will send the data packet only to the specific port where the destination MAC address is located, rather than to all ports that are attached to the hub or bridge. A switch relies on the MAC addresses to determine the source and destination of a packet, which is Layer 2 networking.

Switches primarily operate at the Data Link Layer, Layer 2, although intelligent Layer 3 switching techniques (combining, switching, and routing) are being more frequently used (see “Layer 3 Switching,” in the subsequent discussion of routers). Figure 3-16 shows a switched network.

Figure 3-16: A switched network.

Transparent Bridging

Most Ethernet LAN switches use transparent bridging to create their address lookup tables. Transparent bridging allows a switch to learn everything it needs to know about the location of nodes on the network.

Transparent bridging has five steps:

  1. Learning

  2. Flooding

  3. Filtering

  4. Forwarding

  5. Aging

Routers

Routers add more intelligence to the process of forwarding packets. When a router receives a packet, it looks at the Network layer source and destination addresses (IP address) to determine the path the packet should take, and forwards the packet only to the network to which the packet was destined.

This prevents unnecessary network traffic from being sent over the network by blocking broadcast information and traffic to unknown addresses. Routers operate at the Network Layer, Layer 3 of the OSI protocol model. Routers are necessary when communicating between virtual LANs (VLANs). Figure 3-17 shows a routed network.

Figure 3-17: A routed network.

Routing Methodologies

Three fundamental routing methodologies exist, and other routing protocols and methods expand on these.

Static routing refers to the definition of a specific route in a configuration file on the router and does not require the routers to exchange route information dynamically.

Distance vector routing uses the Routing Information Protocol (RIP) to maintain a dynamic table of routing information, which is updated regularly. RIP bases its routing path on the distance (number of hops) to the destination. RIP maintains optimum routing paths by sending out routing update messages if the network topology changes (see Figure 3-18).

Figure 3-18: Distance vector routing.

For example, if a router finds that a particular link is faulty, it will update its routing table and then send a copy of the modified table to each of its neighbors. RIP is the oldest and most common type of dynamic routing, and it commonly broadcasts its routing table information to all other routers every minute. RIP is the earliest and the most commonly found Interior Gateway Protocol (IGP).

Link state routers function like distance vector routers, but they use only first-hand information when building routing tables by maintaining a copy of every other router’s Link State Protocol (LSP) frame. This helps to eliminate routing errors and considerably lessens convergence time.

The Open Shortest Path First (OSPF) is a link-state hierarchical routing algorithm intended as a successor to RIP. It features least-cost routing, multipath routing, and load balancing.

The Internet Gateway Routing Protocol (IGRP) is a Cisco protocol that uses a composite metric as its routing metric, including bandwidth, delay, reliability, loading, and maximum transmission unit.

Layer 3 Switching

Although most standard switches operate at the Data Link Layer, Layer 3 switches operate at the Network Layer and function like a router by incorporating some router features. The pattern matching and caching on Layer 3 switches is similar to the pattern matching and caching on a router. Both use a routing protocol and routing table to determine the best path. However, a big difference between a router and a Layer 3 switch is that Layer 3 switches have optimized hardware to pass data as fast as Layer 2 switches.

Also, a Layer 3 switch has the ability to reprogram the hardware dynamically with the current Layer 3 routing information, providing much faster packet processing. The information received from the routing protocols is used to update the hardware caching tables.

Within the LAN environment, a Layer 3 switch is usually faster than a router because it is built on switching hardware. Many of Cisco’s Layer 3 switches, such as the Cisco Catalyst 6000, are actually routers that operate faster because they are built on switching hardware with customized chips inside the box.

VLANs

A Virtual Local Area Network (VLAN) allows ports on the same or different switches to be grouped so that traffic is confined to members of that group only. It also restricts broadcast, unicast, and multicast traffic. A VLAN is a collection of nodes that are grouped together in a single broadcast domain in a switch and are based on something other than physical segment location.

A VLAN creates an isolated broadcast domain, and a switch with multiple VLANs creates multiple broadcast domains, similarly to a router. A VLAN restricts flooding to only those ports included in the VLAN. However, VLANs can’t route from one to another. Such routing would defeat the purpose of the VLAN: to isolate the traffic from the general traffic flow.

Some advantages of VLANs are:

VLANs can span across multiple switches, and you can have more than one VLAN on each switch. For multiple VLANs on multiple switches to be able to communicate via a single link between the switches, you must use a process called trunking. Trunking is the technology that allows information from multiple VLANs to be carried over just one link between switches. The VLAN Trunking Protocol (VTP) is the protocol that switches use to communicate among themselves about VLAN configuration.

When a VLAN is implemented with private-port, or single-user, switching, it provides fairly stringent security because broadcast vulnerabilities are minimized. A closed VLAN authenticates a user to an access control list on a central authentication server, where the user is assigned authorization parameters to determine his or her level of network access.

BROADCAST DOMAIN

A broadcast domain is a network (or portion of a network) that will receive a broadcast packet from any node located within that network. Normally everything on the same side of the router is all part of the same broadcast domain.

BROUTERS

Brouters are hybrid bridge/router devices. Instead of dropping an undeliverable packet, as a router would do, a brouter attempts to bridge the packet using its MAC address.

Gateways

Gateways are primarily software products that can be run on computers or other network devices. They can be multiprotocol (link different protocols) and can examine the entire packet. Mail gateways are used to link dissimilar mail programs. Gateways can also be used to translate between two dissimilar network protocols.

LAN Extenders

A LAN extender is a remote-access, multilayer switch that connects to a host router (see Figure 3-19). LAN extenders forward traffic from all the standard network-layer protocols (such as IP, IPX, and AppleTalk) and filter traffic based on the MAC address or network-layer protocol type. LAN extenders scale well, because the host router filters out unwanted broadcasts and multicasts. LAN extenders, however, are not capable of segmenting traffic or creating security firewalls.

Figure 3-19: LAN extenders.

Firewall Types

Another important type of network device is a firewall. A CISSP candidate will need to know the basic types of firewalls and their functions, which firewalls operate at which protocol layer, and the basic variations of firewall architectures.

Firewalls act as perimeter access-control devices and are classified into three common types:

  1. Packet-level filtering firewalls

  2. Proxy firewalls, such as application-level or circuit-level

  3. Stateful inspection firewalls

Packet Filtering Firewalls

The packet-filtering firewall examines both the source and destination address of the incoming data packet. This firewall either blocks the packet or passes it to its intended destination network. The firewall can allow or deny access to specific applications or services based on the Access Control Lists (ACLs). ACLs are database files that reside on the firewall, are maintained by the firewall administrator, and tell the firewall specifically which packets can and cannot be forwarded to certain addresses.

The firewall can also be configured to allow access for only authorized application port or service numbers. It looks at the data packet to get information about the source and destination addresses of an incoming packet, the session’s communications protocol (TCP, UDP, or ICMP), and the source and destination application port for the desired service.

A packet-level firewall doesn’t keep a history of the communications session. It operates at the Network Layer of the OSI model and offers good performance. Ongoing maintenance of the ACLs can become an issue. Figure 3-20 shows an external router being used as a simple packet-filtering firewall.

Figure 3-20: A packet-filtering router.

Application Level Firewalls

An application-level firewall (see Figure 3-21) is commonly a host computer that is running proxy server software, making it a proxy server. This firewall works by transferring a copy of each accepted data packet from one network to another, thereby masking the data’s origin. A proxy server can control which services a workstation uses on the Internet, and it aids in protecting the network from outsiders who may be trying to get information about the network’s design.

Figure 3-21: Application-level proxy firewall process.

Also called an application-layer gateway, it is commonly used with a dual-homed host. It operates at the OSI protocol Layer 7, the Application Layer. It is more secure because it examines the packet at the Application Layer, but it does so at the expense of performance.

As opposed to packet firewalls, proxy firewalls capture some session history. Proxy firewalls have higher protocols carried on low-level protocols, such as e-mail or HTML.

DYNAMIC PACKET-FILTERING FIREWALLS

A dynamic packet-filtering firewall employs a technology that enables the modification of the firewall security rule. This type of technology is used mostly for providing limited support for UDP. For a short period of time, this firewall remembers all of the UDP packets that have crossed the network’s perimeter, and it decides whether to enable packets to pass through the firewall.

Circuit Level Firewalls

Like an application-level firewall, a circuit-level firewall is used as a proxy server. It is similar to the application-level firewall in that it functions as a proxy server, but it differs in that special proxy application software is not needed.

This firewall creates a virtual circuit between the workstation client (destination) and the server (host). It also provides security for a wide variety of protocols and is easier to maintain.

Stateful Inspection Firewalls

A stateful inspection firewall intercepts incoming packets at the Network Layer and then uses an inspection engine to extract state-related information from upper layers. It maintains the information in a dynamic state table and evaluates subsequent connection attempts. Stateful inspection firewalls keep low-protocol records at the IP level.

The packets are queued and then analyzed at all OSI layers against the state table. By examining the state and context of the incoming data packets, protocols that are considered connectionless, such as UDP-based applications and Remote Procedure Calls (RPCs), can be tracked more easily.

Firewall Architectures

The four basic types of firewall architectures are:

  Note 

Keep in mind that some of these architectures are specifically associated with one of the previously discussed firewall types, while other architectures can employ a combination of types.

Packet Filtering Routers

A packet-filtering router is the most common and oldest firewall device in use. A packet-filtering router sits between the private “trusted” network and the “untrusted” network or network segment. This firewall architecture is used as a packet-filtering firewall, described in the previous section. A packet-filtering router is sometimes used to directly manage access to a demilitarized zone (DMZ) network segment, discussed later under “Screened-Subnet Firewalls.”

Screened Host Firewalls

Like a dual-homed host, described in the next subsection, a screened-host firewall uses two network cards to connect to the trusted and untrusted networks, but it adds a screening router between the host and the untrusted network (see Figure 3-22). It provides both network-layer (routing) and application-layer (proxy) services. This type of firewall system requires an intruder to penetrate two separate systems before he or she can compromise the trusted network.

Figure 3-22: A screened-host firewall.

The host is configured between the local trusted network and untrusted network. Because the firewall can be the focus of external attacks, it is sometimes called the sacrificial lamb.

Dual Homed Host Firewalls

Another very common firewall architecture configuration is the Dual-Homed Host (see Figure 3-23). A dual-homed host has two network interface cards (NICs) but no screening router. It uses two NICs to attach to two separate networks, commonly a trusted network and an untrusted network.

Figure 3-23: A dual-homed host firewall.

This architecture is a simple configuration that consists of a single computer (the host) with two NICs: One is connected to the local trusted network and the other is connected to the Internet or an untrusted external network. A dual-homed host firewall usually acts to block or filter some or all of the traffic trying to pass between the networks.

IP traffic forwarding is usually disabled or restricted; all traffic between the networks and the traffic’s destination must pass through some kind of security inspection mechanism.

The host’s routing capabilities must be disabled so that it does not unintentionally enable internal routing, which will connect the two networks together transparently and negate the firewall’s function. Many systems come with routing enabled by default, such as IP forwarding, which makes the firewall useless.

Screened Subnet Firewalls

One of the most secure implementations of firewall architectures is the screened-subnet firewall. A screened-subnet firewall also uses two NICs, but it has two screening routers with the host acting as a proxy server on its own network segment. One screening router controls traffic local to the network, while the second monitors and controls incoming and outgoing Internet traffic.

It employs two packet-filtering routers and a bastion host. Like a screened-host firewall, this firewall supports both packet filtering and proxy services, yet it can also define a demilitarized zone (DMZ).

A DMZ is a network added between an internal network and an external network in order to provide an additional layer of security. Sometimes it is also called a perimeter network. The DMZ creates a small network between the untrusted network and the trusted network where the bastion host and other public Web services exist. The outside router provides protection against external attacks, while the inside router manages the private network access to a DMZ by routing it through the bastion host.

Many firewalls allow you to place a network in the demilitarized zone (DMZ). Figure 3-24 shows a common firewall implementation employing a DMZ.

Figure 3-24: Common firewall implementation.

BASTION HOST

A bastion host is any computer that is fully exposed to attack by being on the public side of the demilitarized zone (DMZ), unprotected by a firewall or filtering router. Firewalls and routers, anything that provides perimeter access-control security, can be considered bastion hosts. Other types of bastion hosts can include Web, mail, DNS, and FTP servers. Often a bastion host is used as a sacrificial lamb. Because of their exposure, a great deal of effort must be put into designing and configuring bastion hosts to minimize the chances of penetration.

A WORD ABOUT NETWORK ARCHITECTURES

Network architecture refers to the communications products and services that ensure that the various components of a network, such as devices, protocols, and access methods, work together. Originally, a manufacturer’s network system often did not interoperate within its own product line, much less enable connectivity with the products of other manufacturers. Although IBM’s Systems Network Architecture (SNA) and Digital Equipment Corporation’s DECnet were seen as an advance in solving these problems within the vendor’s product line, they still did not interoperate outside of that product line. The Open Systems Interconnection (OSI) model by the International Organization for Standardization (ISO) was a big step in solving this problem. Other network architecture examples include the Xerox Networking System (XNS) and the Advanced Research Projects Agency Network (ARPANET), the originator of the Internet. These and other standard computer network architectures divide and subdivide the various functions of data communications into isolated layers, which makes it easier to create products and standards that can interoperate.

SOCKS

A Socket Security (SOCKS) server provides another variation of firewall protection. SOCKS is a Transport Layer, secure networking proxy protocol. SOCKS replaces the standard network systems calls with its own calls. These calls open connections to a SOCKS proxy server for client authentication transparently to the user. Common network utilities, such as Telnet or FTP, need to be SOCKS-ified, or have their network calls altered to recognize SOCKS proxy calls.

This is a circuit-level proxy server that does not require the server resource overhead of conventional proxy servers. SOCKS uses port 1080 and is used both for outbound host access by a workstation and to allow a host outside of a firewall to connect transparently and securely through the firewall.

As a consequence, some sites may have port 1080 opened for incoming connections to a system running a SOCKS daemon. One of the more common uses of SOCKS is to allow ICQ traffic to hosts that are behind a firewall.

Common Data Network Services

Some of the common services that a data network provides are:

File Transfer Services

A server providing File Transfer Protocol (FTP) services can allow fully anonymous login without requiring passwords, or it can be set up to require a valid username/password pair. FTP servers provide a simple interface resembling a standard Unix file directory. Users can retrieve files and then view or execute the files later, if they have the appropriate applications.

However, if an FTP server is not configured correctly, it can provide access to any file found on the host computer or even on the network connected to the host computer. FTP servers should be restricted to accessing a limited directory space and should require the use of passwords whenever feasible.

Sometimes an organization may wish to support an anonymous FTP server to allow all external users the ability to download nonsensitive information without using strong authentication. In this case, FTP should be hosted outside the firewall or on a service network not connected to corporate networks that contain sensitive data. Table 3-7 shows a sample of such an FTP policy.

Table 3-7: Sample FTP Service Policy

Open table as spreadsheet

POLICY STATEMENT

NONANONYMOUS FTP SERVICE

ANONYMOUS FTP SERVICE

Require FTP server outside the firewall

N

Y

Require FTP server on the service network

N

Y

Require FTP server on protected network

Y

N

Require FTP server on the firewall itself

N

N

FTP server will be accessed by Internet

N

Y

FTP AND FIREWALL PROXY

Applications gateways may require a proxy for FTP services to be supported through the firewall. All incoming requests for FTP network services should go through the appropriate proxy on the firewall regardless of which host on the internal network will be the final destination. These application-level firewalls should be configured such that outbound network traffic appears as if the traffic had originated from the firewall (i.e., only the firewall is visible to outside networks). In this manner, direct access to network services on the internal network is not allowed.

SFTP

SFTP (Secure File Transfer Protocol) is replacing FTP because it includes strong encryption and authentication. SFTP is an FTP-style client that can be used to exchange files over a network and is an encryption-based replacement for the insecure FTP. SFTP provides secure file transfer functionality using SSH or SSH-2; it is the standard file transfer protocol for use with the SSH-2 protocol.

Although SFTP is designed primarily to provide file transfer services, it can provide secure file system access to a remote server. An SFTP server can be designed to provide only file transfer access, or it can provide system command access as well. SFTP can restrict users to their home directories, is not vulnerable to the flashfxp transfer utility (which allows an unknown third-party to use the network for file transfer to a remote location), and is much less vulnerable to remote exploitation than standard FTP. It can be configured to authorize users with certificates as well as passwords. MacSFTP is a Macintosh application used to transfer files over TCP/IP using SFTP.

SSH SSH 2

Secure Shell (SSH) is a set of protocols that are used primarily for remote access over a network by establishing an encrypted tunnel between an SSH client and an SSH server. This protocol can be used to authenticate the client to the server. In addition, it can also provide confidentiality and integrity services. It is composed of a Transport Layer protocol, a User Authentication protocol, and a Connection protocol. A number of SSH software programs are available on the Internet for free, such as OPENSSH.

SAVING CONFIGURATION FILES AND TRIVIAL FILE TRANSFER PROTOCOL

Sometimes, when a network device fails, the configuration programmed into it is also lost. This can especially happen to routers. The procedure that is used to prevent this from occurring consists of capturing the configuration files by logging a terminal session during a configuration session and then storing that configuration on floppies or installing a Trivial File Transfer Protocol (TFTP) server. The TFTP server is then accessed during the configuration session to save or retrieve configuration information to the network device. Because TFTP is very insecure, this server must be located in a secure area.

Secure Shell version 2 (SSH-2) contains security enhancements over the original SSH and should be used in place of SSH. SSH-2 is not strictly a VPN product, but it can be used like one. SSH opens a secure, encrypted shell (command line) session from the Internet through a firewall to the SSH server. After the connection is established, it can be used as a terminal session or for tunneling other protocols.

SSH-2 should be used instead of Telnet when connecting to remote hosts. Tunneling features available in SSH-2 can be utilized for providing secure connections to applications that are connected to a remote server, such as connecting to a POP3 e-mail server.

TFTP

Trivial File Transfer Protocol (TFTP) is a stripped-down version of FTP. TFTP has no directory browsing abilities; it can do nothing but send and receive files. TFTP is commonly used to capture router configuration files by logging a terminal session during a configuration session and then storing that configuration on a TFTP server. The TFTP server is then accessed during the configuration session to save or retrieve configuration information to the network device. However, in contrast to FTP, session authentication does not occur, so it is insecure. Some sites choose not to implement TFTP because of the inherent security risks.

Data Network Types

A CISSP candidate will also need to know the basics of the data network structures - the types of cabling, the various network access methods and topologies, and the differences between various LANs and WANs.

SONET

Synchronous Optical Network (SONET) is a standard for telecommunications transmission over fiber optics. SONET network rings transmit voice and data over fiber-optic networks. Multiple varying-speed SONET rings often communicate with each other. SONET is a self-healing technology, meaning that it can recover from a break by employing a redundant ring, making the technology fault-tolerant.

A data network consists of two or more computers that are connected for the purpose of sharing files, printers, data, and so forth. To communicate on the network, every workstation must have an NIC inserted into the computer, a transmission medium (such as copper, fiber, or wireless), a Network Operating System (NOS), and a LAN device of some sort (such as a hub, bridge, router, or switch) to physically connect the computers together.

In addition to the local area network we described, two other common types of LANs are:

Wide Area Networks

A Wide Area Network (WAN) is a network of subnetworks that are physically or logically interconnected over a larger geographic area than LANs.

A WAN may be privately operated for a specific user community, may support multiple communication protocols, or may provide network connectivity and services via interconnected network segments (extranets, intranets, and VPNs). WAN technologies will be examined in more detail later.

Internet

The Internet, a WAN that was originally funded by the DoD, uses TCP/IP for data interchange. The term Internet refers to the global network of public networks and Internet service providers (ISPs) throughout the world. Either public or private networks (with a VPN) can utilize the Internet.

Intranet

An intranet is an Internet-like logical network that uses a firm’s internal, physical network infrastructure. Because it uses TCP/IP and HTTP standards, it can use low-cost Internet products such as Web browsers. A common example of the use of an intranet would be a company’s human resource department publishing employee guidelines that are accessible by all company employees through the familiar Web interface. An intranet provides more security and control than a public posting on the Internet.

Extranet

Like an intranet, an extranet is a private network that uses Internet protocols. In contrast to an intranet, certain users outside the company (partners, vendors, and so forth) can access an extranet, but the general public cannot. An example of someone using this type of network is a company’s supplier accessing a company’s private network (via a VPN or Internet connection with some kind of authentication) but only having access to the information that he or she needs.

WAN Technologies

To become more familiar with the various types of WAN technologies, you must understand WAN protocols, topologies, and devices. Like LAN protocols, WAN protocols are the rules for communicating between computers on a WAN. Because the WAN is more often used for connecting diverse networks than a LAN, these protocols address the issues involved with communications between many large and disparate networks.

Dedicated Lines

A dedicated line is a communications line that is indefinitely and continuously reserved for transmission rather than being switched on and off as transmission is required. A dedicated line can be a leased line or a point-to-point link. When a communications carrier reserves a dedicated line for a customer’s private use, this is called a leased line.

Dedicated lines are also called point-to-point links, and use private circuits. Private circuits evolved before packet-switching networks. A private circuit network is a dedicated analog or digital point-to-point connection joining geographically diverse networks.

T carriers

T-carriers are dedicated lines that carry voice and data information over trunk lines. Types and speeds of various T-carriers and dedicated lines are:

WAN Switching

When the network grows and needs more than a single point-to-point connection, WAN switching is required. There are two main flavors of WAN switching: circuit switching and packet switching.

Circuit Switched Networks

Circuit switching is defined as a switching system in which a dedicated physical circuit path must exist between the sender and receiver for the duration of the transmission or the “call.” A circuit-switched network describes a type of WAN that consists of a physical, permanent connection from one point to another. This technology is older than packet switching, which we discuss next, but it is the main choice for communications that need to be “on” constantly and have a limited scope of distribution (one transmission path only). This network type is used heavily in telephone company networks. ISDN is an example of a circuit-switched network.

Packet Switched Networks

Packet switching is defined as a networking method where nodes share bandwidth with each other by sending small data units called packets. A packet-switched network (PSN or PSDN) is a network that uses packet-switching technology for data transfer. In contrast to circuit-switched networks, the data in packet-switched networks is broken up into packets and then sent to the next destination based on the router’s understanding of the best available route. At that destination, the packets are reassembled based on their originally assigned sequence numbers. Although the data is manhandled a lot in this process, it creates a network that is very resistant to error. Table 3-8 lists some of the basic differences between circuit switching and packet switching.

Table 3-8: Circuit Switching versus Packet Switching

Open table as spreadsheet

CIRCUIT SWITCHING

PACKET SWITCHING

Constant traffic

Bursty traffic

Fixed delays

Variable delays

Connection-oriented

Connectionless

Sensitive to loss of connection

Sensitive to loss of data

Voice-oriented data

Data-oriented data

Packet-Switched Technologies

Packet-switched networks can be far more cost effective than dedicated circuits because they create virtual circuits, which are used as needed, rather than supplying a continuous dedicated circuit. Examples of packet-switching networks are X.25, Link Access Procedure-Balanced (LAPB), Frame Relay, Switched Multimegabit Data Service (SMDS), Asynchronous Transfer Mode (ATM), and Voice over IP (VoIP).[*]

VIRTUAL CIRCUITS

Frame Relay uses virtual circuits to forward packets. Switched virtual circuits (SVCs) are virtual circuits that are dynamically established on demand and are torn down when transmission is complete. SVCs are used in situations where data transmission is sporadic. SVCs have three phases: circuit establishment, data transfer, and circuit termination (teardown). Permanent virtual circuits (PVCs) are virtual circuits that are permanently connected. PVCs save the bandwidth that is associated with circuit establishment and teardown. A PVC provides the Frame Relay customer with guaranteed bandwidth.

Other WAN Protocols

Common WAN Devices

WAN devices enable the use of WAN protocols and topologies. The following are examples of these device types:

Figure 3-25 shows a network that allows Internet access with several different devices.

Figure 3-25: Shared Internet access with WAN and LAN devices.

Network Address Translation (NAT)

Generically, NAT (Network Address Translation) describes the process of converting an IP address valid within one network to a different IP address valid within another network. More specifically, NAT converts a private IP address on the inside, trusted network to a registered “real” IP address seen by the untrusted, outside network.

The Internet Assigned Numbers Authority (IANA) has reserved three blocks of the IP address space for private Internet addresses:

Employing these internal addresses through NAT enhances security by hiding the true IP address of the packet’s origin. As each incoming or outgoing packet is converted by NAT, the request may be authenticated.

Also, NAT helps conserve the number of global IP addresses that a company requires and allows the company to use a single IP address for its outside communications.

NAT can be statically defined, or it can be configured to dynamically use a group of IP addresses. For example, Cisco’s version of NAT lets an administrator create policies that define:

NAT is described in general terms in RFC 1631, which discusses NAT’s relationship to Classless InterDomain Routing (CIDR) as a way to reduce the IP address depletion problem. NAT is often included as part of a router, and most firewall systems now include NAT capability. Figure 3-26 shows the NAT concept.

Figure 3-26: Network Address Translation (NAT).

[*]Source: Communications Systems and Networks, Ray Horak (M&T Books, 2000).

Remote Access Technologies

Remote access technologies can be defined as those data networking technologies that are uniquely focused on providing the remote user (telecommuter, Internet/intranet user, or extranet user/partner) with access into a network while striving to maintain the principal tenets of Confidentiality, Availability, and Integrity.

There are many obvious advantages to employing secure remote network access, such as the following:

Remote Access Types

While several of these remote access types share common WAN protocols, we list them here to indicate their importance in the area of remote access security.

Remote Access Security Methods

The following are some common methods for securing remote access devices:

Virtual Private Networking (VPN)

A virtual private network (VPN) is created by building a secure communications link between two nodes, emulating the properties of a point-to-point private link. A VPN can be used to facilitate secure remote access into a network, securely connect two networks together, or create a secure data tunnel within a network.

The portion of the link in which the private data is encapsulated is known as the tunnel. It may be referred to as a secure, encrypted tunnel, although it’s more accurately defined as an encapsulated tunnel, because encryption may or may not be used. To emulate a point-to-point link, data is encapsulated, or wrapped, with a header that provides routing information. Most often the data is encrypted for confidentiality. This encrypted part of the link is considered the actual virtual private network connection. Figure 3-27 shows a common VPN configuration for remote access into a company intranet through the Internet.

Figure 3-27: A common VPN configuration.

VPN Examples

The following are some common VPN configurations:

Remote Access VPNs

A VPN can be configured to provide remote access to corporate resources over the public Internet to maintain confidentiality and integrity. This configuration allows the remote user to utilize whatever local ISP is available to access the Internet without forcing the user to make a long-distance or 800 call to a third-party access provider. Using the connection to the local ISP, the VPN software creates a virtual private network between the dial-up user and the corporate VPN server across the Internet. Figure 3-28 shows a remote user VPN connection.

Figure 3-28: A remote access VPN.

Network-to-Network VPNs

A VPN is commonly used to connect two networks, perhaps the main corporate LAN and a remote branch office LAN, through the Internet. This connection can use either dedicated lines to the Internet or dial-up connections to the Internet. However, the corporate hub router that acts as a VPN server must be connected to a local ISP with a dedicated line if the VPN server needs to be available 24/7. The VPN software uses the connection to the local ISP to create a VPN tunnel between the branch office router and the corporate hub router across the Internet. Figure 3-29 shows a remote branch office connected to the corporate main office using a VPN tunnel through the Internet.

Figure 3-29: A network-to-network VPN.

Intranet Access VPNs

If remote users need to access sensitive data on a LAN physically disconnected from the rest of the corporate network, a VPN may provide the solution. A VPN allows the LAN with the sensitive data to be physically connected to the corporate internetwork but separated by a VPN server, as shown in Figure 3-30. This ensures that only authorized users on the corporate network can establish a VPN with the VPN server and gain access to the sensitive data.

Figure 3-30: An intranet access VPN.

In this case, the VPN server is not acting as a router between the corporate internetwork and the department LAN, because a router would connect the two networks, thus allowing everyone access to the sensitive LAN.

VPN Tunneling

Tunneling is a method of transferring data from one network to another network by encapsulating the packets in an additional header. The additional header provides routing information so that the encapsulated payload can traverse the intermediate networks, as shown in Figure 3-31.

Figure 3-31: VPN tunnel and payload.

For a tunnel to be established, both the tunnel client and the tunnel server must be using the same tunneling protocol. Tunneling technology can be based on either a Layer 2 or a Layer 3 tunneling protocol. These layers correspond to the Open Systems Interconnection (OSI) Reference Model.

Tunneling, and the use of a VPN, is not intended as a substitute for encryption/decryption. In cases where a high level of security is necessary, the strongest possible encryption should be used within the VPN itself, and tunneling should serve only as a convenience.

VPN and Remote Access Protocols

Both the Point-to-Point Tunneling Protocol (PPTP) and the Layer Two Tunneling Protocol (L2TP) are Layer 2 tunneling protocols using Data Link Layer formatting and encapsulating the payload in a Point-to-Point Protocol (PPP) frame (discussed subsequently). Layer 3 protocols correspond to the Network Layer and use packets. IPSec tunnel mode is an example of a Layer 3 tunneling protocol that encapsulates IP packets in an additional IP header.

Layer 3 tunneling technologies generally assume that all of the configuration issues are preconfigured, often by manual processes. For these protocols, there may be no tunnel maintenance phase. For Layer 2 protocols, however, a tunnel must be created, maintained, and then terminated.

Point-to-Point Tunneling Protocol (PPTP)

Point-to-Point Tunneling Protocol (PPTP) works at the Data Link Layer of the OSI model. It is designed for individual client-to-server connections, so it allows only a single point-to-point connection per session. PPTP is commonly used by Windows clients for asynchronous communications. PPTP uses the native PPP authentication and encryption services.

PPTP allows IP, IPX, or NetBEUI traffic to be encrypted and then encapsulated in an IP header to be sent across a corporate IP internetwork or a public IP internetwork, such as the Internet. PPTP uses a TCP connection for tunnel maintenance and a modified version of Generic Routing Encapsulation (GRE) to encapsulate PPP frames for tunneled data. The payloads of the encapsulated PPP frames can be encrypted and compressed.

Layer 2 Tunneling Protocol (L2TP)

Layer 2 Tunneling Protocol (L2TP) is a combination of PPTP and the earlier Layer 2 Forwarding Protocol (L2F) and also works at the Data Link Layer. L2TP is an accepted tunneling standard for VPNs. Dial-up VPNs also use this standard frequently. Like PPTP, it was designed for single point-to-point client-to-server connections. Like PPTP, L2TP allows IP, IPX, or NetBEUI traffic to be encrypted and then sent over any medium that supports point-to-point datagram delivery, such as:

L2TP supports TACACS+ and RADIUS, but PPTP does not. L2TP running over IP networks uses UDP and a series of L2TP messages for tunnel maintenance. L2TP also uses UDP to send L2TP-encapsulated PPP frames as the tunneled data. The payloads of encapsulated PPP frames can be encrypted and compressed.

Internet Protocol Security (IPSec)

IPSec operates at the Network Layer and allows multiple simultaneous tunnels. IPSec contains the functionality to encrypt and authenticate IP data. While PPTP and L2TP are aimed more at dial-up VPNs, IPSec also encompasses network-to-network connectivity.

Although IPSec operates at the Network Layer and enables multiple simultaneous tunnels, it is not multiprotocol. IPSec has the functionality to encrypt and authenticate IP data. It is built into the new IPv6 standard and is used as an add-on to the current IPv4. IPSec tunnel mode allows IP packets to be encrypted and then encapsulated in an IP header to be sent across a corporate IP internetwork or a public IP internetwork, such as the Internet.

IPSec uses an authentication header (AH) to provide source authentication and integrity without encryption, and it uses the Encapsulating Security Payload (ESP) to provide authentication and integrity along with encryption. With IPSec, only the sender and recipient know the key. If the authentication data is valid, the recipient knows that the communication came from the sender and that it was not changed in transit.

Serial Line Internet Protocol (SLIP)

Serial Line Internet Protocol (SLIP) is a TCP/IP protocol and early de facto standard for asynchronous dial-up communication. An ISP may provide a SLIP connection for Internet access. PPP is now preferred over SLIP because it can handle synchronous as well as asynchronous communication. PPP can share a line with other users, and it has error detection that SLIP lacks.

Point-to-Point Protocol (PPP)

The Point-to-Point Protocol (PPP) defines an encapsulation method to transmit multiprotocol packets over Layer 2 point-to-point links, such as a serial interface. PPP is a full-duplex protocol that can be used on various physical media, including twisted pair or fiber-optic lines or satellite transmissions. It uses a variation of High Speed Data Link Control (HDLC) for packet encapsulation.

A user may connect to a network access server (NAS) through ISDN, ADSL, dial-up plain old telephone service (POTS), or another service and then run PPP over that connection. Most implementations of PPP provide limited authentication methods, including:

Password Authentication Protocol

The Password Authentication Protocol (PAP) is a basic clear-text authentication scheme. The NAS requests the username and password, and PAP returns them in clear text, unencrypted. PAP user authentication is often used on the Internet, which simply sends a username and password to a server, where they are compared with a database of authorized users. While the user database may be kept in encrypted form, each ID and password is sent unencrypted.

This authentication scheme is not secure, because a third party could capture the user’s name and password and use it to get subsequent access to the NAS and all of the resources provided by the NAS. PAP provides no protection against replay attacks or remote client impersonation once the user’s password is compromised. A better variation on this method is the Challenge Handshake Authentication Protocol (CHAP).

Challenge Handshake Authentication Protocol

The Challenge Handshake Authentication Protocol (CHAP) is an encrypted authentication mechanism that avoids transmission of the actual password on the connection. The NAS sends a challenge, which consists of a session ID and an arbitrary challenge string, to the remote client. The remote client must use the MD5 one-way hashing algorithm to return the username and an encryption of the challenge, the session ID, and the client’s password. The username is sent unhashed.

CHAP is an improvement over PAP, because the clear-text password is not sent over the link. Instead, the password is used to create an encrypted hash from the original challenge. The server knows the client’s clear-text password and can, therefore, replicate the operation and compare the result to the password sent in the client’s response. CHAP protects against replay attacks by using an arbitrary challenge string for each authentication attempt. CHAP protects against remote client impersonation by unpredictably sending repeated challenges to the remote client throughout the duration of the connection.

During the CHAP process, a three-way handshake occurs:

  1. A link is established, and then the server agent sends a message to the machine originating the link.

  2. This machine then computes a hash function from the challenge and sends it to the server.

  3. The server determines whether this is the expected response and, if so, authenticates the connection.

At any time, the server can request the connected party to send a new challenge message. Because CHAP identifiers are changed frequently and because authentication can be requested by the server at any time, CHAP provides more security than PAP. Both CHAP and PAP are defined in RFC1334.

MS-CHAP

The Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) is an encrypted authentication mechanism very similar to CHAP. As in CHAP, the NAS sends a challenge, which consists of a session ID and an arbitrary challenge string, to the remote client. The remote client must return the username and an encrypted form of the challenge string, the session ID, and the MD4-hashed password. This design, which uses a hash of the MD4 hash of the password, provides an additional level of security because it allows the server to store hashed passwords instead of clear-text passwords.

MS-CHAP also provides additional error codes, including a password-expired code, and additional encrypted client-server messages that permit users to change their passwords. In MS-CHAP, both the access client and the NAS independently generate an initial key for subsequent data encryption by MPPE. Therefore, MS-CHAP authentication is required to enable MPPE-based data encryption.

MS-CHAP version 2

MS-CHAP version 2 (MS-CHAP v2) is an updated encrypted authentication mechanism that provides stronger security. The NAS sends a challenge to the access client that consists of a session identifier and an arbitrary challenge string. The remote access client sends a response that contains the following:

The NAS checks the response from the client and sends back a response containing an indication of the success or failure of the connection attempt and an authenticated response based on the sent challenge string, the peer challenge string, the encrypted response of the client, and the user’s password. The remote access client verifies the authentication response and, if correct, uses the connection. If the authentication response is not correct, the remote access client terminates the connection.

Using this process, MS-CHAP v2 provides mutual authentication; the NAS verifies that the access client has knowledge of the user’s password, and the access client verifies that the NAS has knowledge of the user’s password. MS-CHAP v2 also determines two encryption keys: one for data sent and one for data received.

Extensible Authentication Protocol

Because most implementations of PPP provide very limited authentication methods, the Extensible Authentication Protocol (EAP) was designed to allow the dynamic addition of authentication plug-in modules at both the client and server ends of a connection.

EAP is an extension to PPP that allows for arbitrary authentication mechanisms for the validation of a PPP connection. This allows vendors to supply a new authentication scheme at any time, providing the highest flexibility in authentication uniqueness and variation. EAP is supported in Microsoft Windows 2000 and is defined in RFC 2284.

EAP Transport Level Security

EAP Transport Level Security (EAP-TLS) is an IETF standard (RFC 2716) for a strong authentication method based on public-key certificates. With EAP-TLS, a client presents a user certificate to the dial-in server, and the server presents a server certificate to the client. The client provides strong user authentication to the server, and the server provides assurance that the user has reached the server that he or she expected. Both systems rely on a chain of trusted authorities to verify the validity of the offered certificate.

EAP-TLS is the specific EAP method implemented in Microsoft Windows 2000. Like MS-CHAP and MS-CHAP v2, EAP-TLS returns an encryption key to enable subsequent data encryption by MPPE.

Wireless VPNs

Wireless LANs (WLANs) can especially benefit from a VPN. A VPN can be used to act as a gateway between the WLAN and the network and can supplement the WEP’s authentication and encryption functions. All traffic between the wired and wireless network should travel through the VPN tunnel and be encrypted with the IPSec protocol. IPSec thwarts sniffer attacks launched using applications such as AirSnort.

When a VPN client needs to access the network, it will connect to a VPN server, and the server will authenticate the client. Once authenticated, the VPN server will provide the client with an IP address and an encryption key. All communications will be carried out through this IP address. Every packet that passes through this secure tunnel between the client and server will be encrypted.

Consequently, an attacker cannot simply hijack an IP address to gain access, because he or she will not possess the encryption key. The VPN server will simply reject all connections from the attacker.

Guidelines for wireless VPN implementation include the following:

More detail about wireless technologies can be found later in the chapter.

RADIUS and TACACS

As the demand for large remote access networks increases, remote access authentication systems have emerged to provide better network access security for remote clients. The two most common remote access authentication systems are Remote Authentication Dial-In User Server (RADIUS) and Terminal Access Controller Access Control System + (TACACS+), which is TACACS with additional features, including the use of two-factor authentication.

TACACS and RADIUS are standards-based, which means that they are interoperable with other systems of the same type. Some of these systems provide a centralized database that maintains user lists, passwords, and user profiles that remote access equipment on a network can access to authenticate clients.

Remote Authentication Dial-in User Service (RADIUS)

The Remote Authentication Dial-in User Service (RADIUS) protocol is a lightweight, UDP-based protocol used for managing remote user authentication and authorization. It is a fully open protocol, is distributed in source code format, and can be modified to work with any security system that is currently available on the market.

RADIUS is a distributed client/server system wherein the clients send their authentication requests to a central RADIUS server that contains all of the user authentication and network service access information (network ACLs). RADIUS servers can be located anywhere on the network, and they provide authentication and authorization for network access servers and VPNs.

RADIUS can be used with TACACS+ and Kerberos to provide CHAP remote node authentication. It provides similar user authentication (including the use of dynamic passwords) and password management as a TACACS+enabled system.

Because RADIUS does not support all protocols, it is often used as a steppingstone to a more robust TACACS+ system. Also, RADIUS does not provide two-way authentication and therefore is not commonly used for router-to-router authentication. Figure 3-32 shows a RADIUS server performing authentication within a company intranet for VPN and remote access server (RAS) clients.

Figure 3-32: A RADIUS VPN.

Wireless RADIUS

Several 802.11 access points offer RADIUS authentication, which gives wireless clients access to network resources after supplying a username and password to a RADIUS server. Such user-based authentication provides a centrally managed method of verifying users who attempt to access the wireless network. Most RADIUS servers can handle this VPN client authentication functionality.

Some RADIUS implementations also allow the user to be authenticated via a digital key system, and they restrict access to preauthorized areas by the user. For example, Cisco’s RADIUS server makes it possible to establish access by time and date.

Terminal Access Controller Access Control System (TACACS)

TACACS is an authentication protocol that provides remote access authentication and related services, such as event logging. In a TACACS system, user passwords are administered in a central database rather than in individual routers, which provides an easily scalable network security solution. A TACACS-enabled network device prompts the remote user for a username and static password, and then the TACACS-enabled device queries a TACACS server to verify that password. TACACS does not support prompting for a password change or for the use of dynamic password tokens.

TACACS+ has superseded TACACS. TACACS+ provides the following additional features:

Network Availability

This section defines those elements that can provide for or threaten network availability. Network availability can be defined as an area of the Telecommunications and Network Security domain that directly affects the Information Systems Security tenet of availability.

High Availability and Fault Tolerance

The concept of high availability refers to a level of fault tolerance and redundancy in transaction processing and communications. Although these processes are not used solely for disaster recovery, they are often elements of a larger disaster recovery plan. If one or more of these processes are employed, the ability of a company to get back on-line is greatly enhanced.

Some concepts employed for high availability and fault tolerance are:

Wireless Technologies

Wireless technology is probably the fastest-growing area of network connectivity. Experts estimate that the number of Internet-connected PDAs, such as the Palm Pilot, will eclipse the number of personal computers in use in a few years. Security is an extreme concern here because all wireless technologies (mobile phones, satellite transmissions, and so forth) are inherently susceptible to interception and eavesdropping. Encryption standards are rapidly being developed to combat this problem.

IEEE Wireless Standards

IEEE 802.11 refers to a family of specifications for WLANs developed by a working group of the IEEE. 802.11 also generically refers to the IEEE Committee responsible for setting the various wireless LAN standards. This standards effort began in 1989 with the focus on deployment in large enterprise networking environments, effectively a wireless equivalent to Ethernet. The IEEE accepted the specification in 1997.

The 802.11 specification identifies an over-the-air interface between a mobile device wireless client and a base station or between two mobile device wireless clients. To date, there are four completed specifications in the family: 802.11, 802.11a, 802.11b, and 802.11g, with a fifth, 802.11e, in development as a draft standard. All four existing standards use the Ethernet protocol and carrier sense multiple access with collision avoidance (CSMA/CA) for path sharing.

There are several specifications in the 802.11 family, including:

802.1x

The IEEE drafted the 802.1x Port-Based Network Access Control standard in 2001 to provide enhanced security for users of 802.11b wireless LANs. It provides port-level authentication for any wired or wireless Ethernet client system. This supplement to ISO/IEC 15802-3:1998 (IEEE Std 802.1D-1998) defines the changes necessary to the operation of a MAC Bridge in order to provide port-based network access control capability.

Originally designed as a standard for wired Ethernet, 802.1x is applicable to WLANs. It leverages many of the security features used with dial-up networking; for example, it uses encryption keys that are unique for each user and each network session, and it supports 128-bit key lengths. It has a key management protocol built into its specification, which provides keys automatically. Keys can also be changed rapidly at set intervals. It will also support the use of Remote Authentication Dial-in User Service (RADIUS) and Kerberos. The 802.1x standard can be used to provide link-layer authentication, making employee authentication by active directories and databases easier.

The standard defines a client/server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The authentication server verifies each client connected to a switch port before making available any services offered by the switch or the LAN. Until the client has been authenticated, 802.1x access controls allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port to which the client is connected. Once the client has been authenticated, normal traffic can pass through the port.

Cisco Systems has implemented 802.1x in its Aironet series of cards, and Microsoft has added the feature to Windows XP. The goal of 802.1x is to provide a level of authentication comparable to that of the wired network. Using 802.1x, any appropriated wireless NICs no longer pose a threat because the network now authenticates the user, not the hardware.

When the user (called the supplicant) wants to use the network service, he or she will connect to the access point (called the authenticator), and a RADIUS server (the authentication server) at the other end will receive the request and issue a challenge. If the supplicant can provide a correct response, it is allowed access.

Cisco introduced the Lightweight Extensible Authentication Protocol (LEAP) for its Aironet devices. Using LEAP, client devices dynamically generate a new WEP key as part of the login process instead of using a static key. In the Cisco model, the supplicant and authentication server change roles and attempt mutual communication. Using this method of authentication, the risk of authenticating to a rogue access point is minimized. After authentication, the authentication server and the supplicant determine a WEP key for the session. This gives each client a unique WEP for every session.

Spread-Spectrum Technologies

The de facto communication standard for wireless LANs is spread spectrum, a wideband radio frequency technique originally developed by the military for use in secure, mission-critical communications systems.[*] Spread spectrum uses a radio transmission mode that broadcasts signals over a range of frequencies. The receiving mobile device must know the correct frequency of the spread-spectrum signal being broadcast.

Two different spread spectrum technologies for 2.4 GHz wireless LANs currently exist: direct-sequence spread spectrum (DSSS) and frequency-hopping spread spectrum (FHSS).

Direct Sequence Spread Spectrum (DSSS)

DSSS is a wideband spread-spectrum transmission technology that generates a redundant bit pattern for each bit to be transmitted. DSSS spreads the signal over a wide frequency band in which the source transmitter maps each bit of data into a pattern of chips. At the receiving mobile device, the original data is recreated by mapping the chips back into a data bit. The DSSS transmitter and receiver must be synchronized to operate properly. A DSSS signal appears as low-power wideband noise to a non-DSSS receiver and therefore is ignored by most narrowband receivers.

DSSS spreads across the spectrum, but the number of independent, nonoverlapping channels in the 2.4 GHz band is small (typically only three). Therefore, only a very limited number of colocated networks can operate without interference. Some DSSS products enable users to deploy more than one channel in the same area by separating the 2.4 GHz band into multiple subbands, each of which contains an independent DSSS network.

Frequency-Hopping Spread Spectrum (FHSS)

FHSS uses a narrowband carrier that continually changes frequency in a known pattern. The FHSS algorithm spreads the signal by operating on one frequency for a short duration and then “hopping” to another frequency. The minimum number of frequencies engaged in the hopping pattern and the maximum frequency dwell time (how long it stays on each frequency before it changes) are restricted by the FCC, which requires that 75 or more frequencies be used with a maximum dwell time of 400 ms.

The source mobile device’s transmission and the destination mobile device’s transmission must be synchronized so that they are on the same frequency at the same time. When the transmitter and receiver are properly synchronized, it maintains a single logical communications channel. Like DSSS, FHSS appears to be noise of a short duration to a non-FHSS receiver and hence is ignored.

FHSS makes it possible to deploy many nonoverlapping channels. Because there are a large number of possible sequences in the 2.4 GHz band, FHSS products enable users to deploy more than one channel in the same area by implementing separate channels with different hopping sequences.

WLAN Operational Modes

The IEEE 802.11 wireless networks operate in one of two operational modes: ad hoc mode and infrastructure mode. Ad hoc mode is a peer-to-peer type of networking, whereas infrastructure mode uses access points to communicate between the mobile devices and the wired network.

Ad Hoc Mode

In ad hoc mode, each mobile device client communicates directly with the other mobile device clients within the network. That is, no access points are used to connect the ad hoc network directly with any WLAN. Ad hoc mode is designed so that only the clients within transmission range (within the same cell) of each other can communicate. If a client on an ad hoc network wants to communicate outside the cell, a member of the cell must operate as a gateway and perform a routing service. Figure 3-35 shows a wireless session in ad hoc mode.

Figure 3-35: WLAN ad hoc mode.

Infrastructure Mode

Each mobile device client in infrastructure mode sends all of its communications to a network device called an access point (AP). The access point acts as a bridge does in a LAN and forwards the communications to the appropriate network, either the WLAN or another wireless network. Figure 3-36 shows access points attached to a wired LAN to create an Infrastructure Mode 802.11b WLAN.

Figure 3-36: Infrastructure Mode 802.11b WLAN.

A TYPICAL BLUETOOTH SESSION

A Bluetooth-based mobile device listens to determine whether there are any other Bluetooth radios in its vicinity. If it doesn’t find any, it configures itself as the “master” device, then it configures its radio transmission to a randomly selected frequency. When another Bluetooth-enabled mobile device (say, a printer) is turned on, it searches for any other Bluetooth radio frequency transmissions in its vicinity.

When the printer finds the master device’s broadcast, it matches its transmitter to the same frequency pattern as the master device, and identifies itself to the master device. After the two devices exchange privilege and capability information, the printer becomes the “slave” of the master device’s piconet.

If a user walks into the room carrying a Bluetooth-equipped PDA and hears the master broadcast, the PDA automatically tunes its transmitter to the frequency pattern and identifies itself to the master device and becomes another slave to the master’s piconet. The three devices exchange information on each other’s access privileges and capabilities, thereby allowing the PDA to access both the desktop and the printer.

Bluetooth

Bluetooth (BT) is a simple peer-to-peer protocol created to connect multiple consumer mobile information devices (cellular phones, laptops, handheld computers, digital cameras, and printers) transparently. It uses the IEEE 802.15 specification in the 2.4 to 2.5 GHz band with FHSS technology. Bluetooth-enables mobile devices to avoid interference from other signals by hopping to a new frequency after transmitting or receiving a packet.[*]

Bluetooth is a low-power-consuming technology with transmission distances of up to 30 feet and a throughput of about 1 Mbps. The range will be extended to 300 feet by increasing the transmit power to 100 mW (milliwatts). Each Bluetooth network can accommodate only eight devices, but, thanks to frequency hopping, many Bluetooth networks can operate in the same vicinity. The Bluetooth MAC layer is TDMA-based. Bluetooth can carry either voice or low-rate data connections.

Bluetooth Security

Bluetooth’s main built-in security features are:

Three components are used in the security algorithms:

  1. A 48-bit Bluetooth device address, a public entity unique for each device. The address can be obtained through the inquiry (discovery) procedure.

  2. A private user key (128 bits), a secret entity. The private key is derived during initialization and is never disclosed.

  3. A random number (128 bits), different for each new transaction. The random number is derived from a pseudo-random process in the Bluetooth unit.

In addition to these link-level functions, frequency hopping and the limited transmission range also help to prevent eavesdropping. But Bluetooth PDAs are vulnerable to bluejacking, which exploits BT’s discover mode to drop code unnoticed on the victim’s unit. BT devices should be configured for non-discover mode, which limits some of its functionality but prevents bluejacking.

Wireless Application Protocol (WAP)

Wireless Application Protocol (WAP) was developed as a set of technologies related to HTML but tailored to the small screens and limited resources of handheld, wireless devices. The most notable of these technologies is the Handheld Device Markup Language (HDML). HDML looks similar to HTML but has a feature set and programming paradigm tailored to wireless devices with small screens. HDML and other elements of this architecture eventually became the Wireless Markup Language (WML) and the architecture of WAP.

Since its initial release, WAP has evolved twice. Releases 1.1 and 1.2 of the specification have the same functionality as 1.0 but with added features to align with what the rest of the industry is doing. Version 1.3 is used most often in WAP products as of this writing.

In August 2001, the WAP Forum approved and released the specifications for WAP 2.0 for public review, and Ericsson, Nokia, and Motorola all announced support for WAP 2.0. The WAP 2.0 specification contains new functionality that enables users to send sound and moving pictures, among other things, over their telephones. WAP 2.0 will also provide a toolkit for easy development and deployment of new services, including XHTML.

The WAP architecture is loosely based on the OSI model, but unlike the seven layers of OSI or the four layers of the TCP/IP model, WAP has five layers: application, session, transaction, security, and transport.

Application layer

The WAP application layer is the direct interface to the user and contains the wireless application environment (WAE). This top layer consists of several elements, including a microbrowser specification for Internet access; devices; content; the development languages Wireless Markup Language (WML) and WMLScript; wireless telephony application programming interfaces (APIs), or WTA, for accessing telephony functionality from within WAE programs;, and some well-defined content formats for phone book records, calendar information, and graphics.

Session Layer

The WAP session layer contains the Wireless Session Protocol (WSP), which is similar to the Hypertext Transfer Protocol (HTTP) because it is designed for low-bandwidth, high-latency wireless networks. WSP facilitates the transfer of content between WAP clients and WAP gateways in a binary format. Additional functionalities include content push and the suspension/resumption of connections.

The WSP layer provides a consistent interface to WAE for two types of session services: a connection mode and a connectionless service. This layer provides the following:

Transaction Layer

The WAP transaction layer provides the Wireless Transactional Protocol (WTP), which provides functionality similar to TCP/IP in the Internet model. WTP is a lightweight transactional protocol that provides reliable request and response transactions and supports unguaranteed and guaranteed push.

WTP provides transaction services to WAP. It handles acknowledgments so that users can determine whether a transaction has succeeded. It also provides a retransmission of transactions in case they are not successfully received, and it removes duplicate transactions. WTP manages different classes of transactions for WAP devices - unreliable one-way requests, reliable one-way requests, and reliable two-way requests. An unreliable request from a WAP device means that no precautions are taken to guarantee that the request for information makes it to the server.

Security Layer

The security layer contains Wireless Transport Layer Security (WTLS). WTLS is based on Transport Layer Security (TLS, similar to the Secure Sockets Layer, or SSL) and can be invoked in a manner similar to HTTPS in the Internet world. It provides data integrity, privacy, authentication, and DoS protection mechanisms. See the section following for more detail on the function of WTLS.

WAP privacy services guarantee that all transactions between the WAP device and gateway are encrypted. Authentication guarantees the authenticity of the client and application server. DoS protection detects and rejects data that comes in the form of unverified requests.

Transport Layer

The bottom WAP layer, the transport layer, supports the Wireless Datagram Protocol (WDP), which provides an interface to the bearers of transportation. It supports the CDPD, GSM, Integrated Digital Enhanced Network (iDEN), CDMA, TDMA, SMS, and FLEX protocols.

WDP provides a consistent interface to the higher layers of the WAP architecture, meaning that it does not matter on which type of wireless network the application is running. Among other capabilities, WDP provides data error correction. The bearers, or wireless communications networks, are at WAP’s lowest level.

Figure 3-37 shows the layers of WAP.

Figure 3-37: The Wireless Application Protocol.

[*]A pioneer in spread-spectrum technology was Hedy Kiesler Markey, better known as the film actress Hedy Lamarr; see www.inventions.org/culture/female/lamarr.html.

[*]Excerpted from: Wireless Security Essentials, Russell Dean Vines (Wiley, 2002).

Wireless Security

Wireless is one of the newest communications technology frontiers, offering the possibility of always-on, instant mobile communications. However, the vulnerabilities inherent to wireless computing present daunting hurdles. These vulnerabilities - eavesdropping, session hijacking, and data alteration and manipulation, in conjunction with an overall lack of privacy - are major challenges posed by wireless technologies.

Typically, when a new technology emerges, standards are created and a rush commences to develop the technology without a thorough security vetting. This has been the case with wireless, too. The result is that much work is now devoted to retrofitting security into the existing models and protocols and designing new models and protocols with better security features. Progress is being made, as standards such as 802.1x and newer versions of WAP show. Network infrastructure design, such as implementation of VPNs and RADIUS, also can help create secure pipes for wireless sessions.

Wireless Transport Layer Security Protocol

The Wireless Transport Layer Security Protocol (WTLS) is WAP’s communications security protocol. It operates above the Transport Protocol layer and provides the upper-level layer of the WAP with a secure transport service interface. The interface preserves the transport interface below it and presents methods to manage secure connections. The primary purpose of the WTLS is to provide privacy, data integrity, and authentication for WAP applications to enable safe connections to other clients.

The WTLS supports a group of algorithms to meet privacy, authentication, and integrity requirements.

Currently, privacy is implemented using block ciphers, such as DES-CBC, IDEA, and RC5-CBC. RSA- and Diffie-Hellman–based key exchange suites are supported to authenticate the communicating parties. Integrity is implemented with SHA-1 and MD5 algorithms.

For secure wireless communications, the client and the server must be authenticated and the connection encrypted. WTLS provides three classes of security:

WTLS is based on the Transport Layer Security (TLS) security layer used on the Internet but has a number of modifications to accommodate the nature of wireless networks. For one, it has been optimized for low-bandwidth networks with relatively long latency. And because of the limited processing power and memory of mobile devices, fast algorithms are implemented in the algorithm suite. In addition, restrictions on export and the using of cryptography must be observed.

The WTLS is the first attempt to provide a secure end-to-end connection for the WAP. The most common protocols, such as TLS v1.0 and SSL v3.0, were adopted as a basis of the WTLS. WTLS incorporates features such as datagram support, optimized packet size and handshake, and dynamic key refreshing.

WEP Encryption

An option in IEEE 802.11b, Wired Equivalent Privacy (WEP), uses a 40-bit shared secret key, a Rivest Code 4 (RC4) pseudorandom number generator (PRNG) encryption algorithm, and a 24-bit initialization vector (IV) to provide data encryption. The basic process works as follows:

  1. A checksum of the message is computed and appended to the message.

  2. A shared secret key and the IV are fed to the RC4 algorithm to produce a key stream.

  3. An exclusive OR (XOR) operation of the key stream with the message and checksum grouping produces ciphertext.

  4. The IV is appended to the ciphertext to form the encrypted message, which is sent to the intended recipient.

  5. The recipient, who has a copy of the same shared key, uses it to generate an identical key stream.

  6. XORing the key stream with the ciphertext yields the original plaintext message.

You can find more details about WEP in Chapter 4, “Cryptography.”

Wireless Vulnerabilities

Many vulnerabilities exist in wireless networks; let’s look at a few.

Denial-of-Service Attacks

A denial-of-service (DoS) attack is an example of the failure of the tenet of availability. A DoS attack occurs when an adversary causes a system or a network to become unavailable to legitimate users or causes services to be interrupted or delayed. Consequences can range from a measurable reduction in performance to the complete failure of the system. An example from the wireless world could be an external signal jamming the wireless channel.

There is little that can be done to keep a determined adversary from mounting a DoS attack, because, as noted, wireless LANs are susceptible to interference and interception and hence often can be easily jammed. If an attacker makes use of a powerful transceiver, enough interference can be generated to prevent wireless devices from communicating with one another. DoS attack devices do not have to be next to the devices being attacked, either; they need only to be within range of the wireless transmissions.

Examples of techniques used to deny service to a wireless device are:

The 2.4 GHz frequency range, within which 802.11b operates, is shared with other wireless devices such as cordless telephones, baby monitors, and Bluetooth-based devices. All of these devices can contribute to the degradation and interruption of wireless signals. In addition, a determined and resourceful attacker with the proper equipment can flood the frequency with artificial noise and completely disrupt wireless network operation.

The “WAP Gap”

A specific security issue that is associated with WAP is the “WAP gap.” A WAP gap results from the requirement to change security protocols at the carrier’s WAP gateway from the wireless WTLS to SSL for use over the wired network. At the WAP gateway, the transmission, which is protected by WTLS, is decrypted and then re-encrypted for transmission using SSL. Thus, the data is temporarily in the clear on the gateway and can be compromised if the gateway is not adequately protected (see Figure 3-38).

Figure 3-38: A WAP gateway.

In order to address this issue, the WAP Forum has put forth specifications that will reduce this vulnerability and thus support e-commerce applications. These specifications are defined in WAP 1.2 as WMLScript Crypto Library and the WAP Identity Module (WIM). The WMLScript Crypto Library supports end-to-end security by providing for cryptographic functions to be initiated on the WAP client from the Internet content server. These functions include digital signatures originating with the WAP client and encryption and decryption of data. The WIM is a tamper-resistant device, like a smart card, that cooperates with WTLS and provides cryptographic operations during the handshake phase.

Take special precautions to avoid the compromise of sensitive information caused by the WAP gap. WAP-enabled PEDs should not use commercial wireless network service provider gateways to access company Web servers unless end-to-end data encryption is provided.

However, the safest implementation of a WAP gateway is for companies to install the gateway in their own networks. A company WAP gateway reduces the risk of data compromise because the WTLS-to-SSL conversion required to access company Web servers would occur on a company-controlled and protected network, and connections may be monitored by IDS.

Insertion Attacks

In an insertion attack, unauthorized devices are deployed to gain access to an existing network. Laptops or PDAs can be configured to attempt access to networks simply by installing wireless network cards and setting up near a target network. If password authentication is not enabled on the network, it’s a simple matter to get a connection to an access point and network resources.

Rogue Access Points

An insertion attack could be facilitated by the deployment of rogue access points, either by a hacker or by well-meaning internal employees seeking to enhance wireless coverage. Hacker-controlled access points can be used to entice authorized wireless clients to connect to a hacker’s access point rather than to the network’s intended access points. In addition, access points not authorized by the network administrator have the potential to be improperly configured and thus vulnerable to outside attack. This raises the risk of the interception of login IDs and passwords for future direct attacks on a network. The risk can be magnified if rogue access points are deployed behind the corporate firewall.

Typically, an access point has one or several methods available to control access to a wireless LAN, typically including use of a common SSID, to allow access based on a MAC address, and WEP. Because the default authentication in 802.11 is open authentication, most systems will authenticate any user who requests connection. Shared key authentication is described but not mandated in 802.11, and it can be defeated.

Another common issue with 802.11b networks is that the access points have been designed for easy installation. So, although security features may be present, in most cases the default settings are for the features to be turned off so that the network can be up and running as quickly as possible. Network administrators who leave their equipment with the default settings intact are particularly vulnerable, as hackers are likely to try known passwords and settings when attempting to penetrate wireless networks.

Also, even when password authentication is implemented on wireless network access points, unauthorized access is still possible through the use of brute-force dictionary attacks. Password-cracking applications can methodically test passwords in an attempt to break into a network access point.

WEP Weaknesses

Most WEP products implement a 64-bit shared key, using 40 bits of this for the secret key and 24 bits for the initialization vector. The key is installed at the wired network AP and must be entered into each client as well.

WEP was not designed to withstand a directed cryptographic attack. WEP has well-known flaws in the encryption algorithms used to secure wireless transmissions. Two programs capable of exploiting the RC4 vulnerability - AirSnort and WEPCrack - both run under Linux, and both require a relatively small amount of captured data.

A number of researchers have investigated attacks on WEP:

WEP Encryption Workarounds

To address WEP encryption issues, some vendors have implemented several enhanced 802.11b security methods, such as:

Service Set Identifier (SSID) Issues

The service set identifier (SSID) is an identification value programmed in the access point or group of access points to identify the local wireless subnet. This segmentation of the wireless network into multiple networks is a form of an authentication check. If a wireless station does not know the value of the SSID, access is denied to the associated access point. When a client computer is connected to the access point, the SSID acts as a simple password, which provides a measure of security.

The wireless access point is configured to broadcast its SSID. When enabled, any client without a SSID is able to receive it and have access to the access point. Users are also able to configure their own client systems with the appropriate SSID because they are widely known and easily shared. A problem caused by the fact that most access points broadcast the SSID in their signals is that several of these access points use default SSIDs provided by the manufacturers, and a list of those default SSIDs is available for download on the Internet. This means that it’s very easy for a hacker to determine an access point’s SSID and gain access to it via software tools.

Wireless Scanning and Eavesdropping

Wireless technology is also vulnerable to eavesdropping, especially because intruders do not have to physically tap into a network. Whether on a different floor, across the room, or outside the building, an intruder can passively “sniff” your network traffic without gaining physical access as long as he or she has a WLAN card that has a promiscuous mode (that is, has the capability to capture every packet on the segment of the LAN). Covert monitoring of wireless LANs is simple. Unless specifically configured to prevent another WLAN device from joining the network, a WLAN device will accept communications from any device within its range.

Furthermore, the 802.11 protocol inherently leaves the Physical Layer header unencrypted, providing critical information to the attacker. Therefore, data encryption is the critical layer of defense, but often data is transmitted unencrypted. Using wireless packet sniffers, an attacker can passively intercept wireless network traffic and, through packet analysis, determine login IDs and passwords, as well as other sensitive data.

War Driving

War driving (also war walking) is a term used to describe a hacker who, armed with a laptop and a wireless adapter card, and traveling via a car, bus, subway train, or other form of transport, goes around sniffing for WLANs.

The concept of war driving is simple: Using a device capable of receiving an 802.11b signal, a device capable of locating itself on a map, and software that will log data from the second when a network is detected by the first, the hacker moves from place to place, letting these devices do their job. Over time, the hacker builds up a database comprising the network name, signal strength, location, and ip/namespace in use. Via SNMP, the hacker may even log packet samples and probe the access point for available data. The hacker may also mark the location of the vulnerable wireless network with chalk on the sidewalk or building itself. This is called war chalking and alerts other intruders that an exposed WLAN is nearby.

Common war driving exploits find many wireless networks with WEP disabled and using only the SSID for access control. And, as noted earlier, the SSID for wireless networks can be found quickly. This vulnerability makes these networks susceptible to what’s called the parking lot attack, in which, at a safe distance from the building’s perimeter, an attacker gains access to the target network.

Wireless Packet Sniffers and Scanners

Wireless packet analyzers, or sniffers, basically work the same way as wired network packet analyzers: They capture packets from the data stream and allow the user to open them up and look at, or decode, them. Some wireless scanners don’t employ full decoding tools but show existing WLANs and SSIDs.

A few of the wireless sniffers available are:

PDA Security Issues

PDAs have not been designed to the same standards nor exposed to the same rigorous examination as desktop operating systems, such as the functional requirements spelled out in the ISO standard 15408, the Common Criteria. When compared with the OS against security requirements described in these and other standards, most PDAs receive a very poor rating.

Loss of Confidentiality

Even if a PDA is password-protected, a malicious user can retrieve the password of a target PDA by using the Palm debug mode. The password can then be decoded by using simple tools such as the PalmCrypt tool.

Once the password has been bypassed, all of the information on the PDA is fully readable by the malicious user. Security administrators currently do not have the ability to determine whether this type of attack has occurred, nor do they have any method to determine who was responsible for the attack.

Physical Loss of Unit

Probably the most common threat to a PDA is caused by the physical loss of the device. Although some technical solutions are available to protect against some of the OS security deficiencies we just mentioned, none provide a countermeasure to the physical security concerns associated with the use of PDAs. The devices are so small and portable that the loss of the device and any information contained on it is common. They are smaller and lighter, and their mode of use puts them at a greater risk because they are generally used in uncontrolled environments.

WIFI BEST PRACTICES

Wireless best practices are similar to the recommendations for a wired network. These include:

Intrusion Detection and Response

The number of reported computer intrusion incidents is constantly on the rise, from 9,859 in 1999 to 82,094 in 2002.[*] Intrusion Detection (ID) and Response is the task of monitoring systems for evidence of an intrusion or an inappropriate usage and responding to the intrusion. ID is the detection of inappropriate, incorrect, or anomalous activity. ID is not a preventative control; it is a detective control.

Types of Intrusion Detection Systems

ID systems that operate on a specific host and detect malicious activity only on that host are called host-based ID systems. ID systems that operate on network segments and analyze that segment’s traffic are called network-based ID systems. Since there are pros and cons to each, an effective IDS should use a combination of both network- and host-based intrusion detection systems.

Host-Based ID Systems

Host-based ID systems employ small software programs called intelligent agents. They reside on a host computer, monitor the operating system, and continually write to log files and trigger alarms. They detect inappropriate activity only on the host computer; they do not monitor the entire network segment.

Host-based ID systems:

Network-Based ID Systems

Network-based ID systems commonly reside on a discrete network segment and monitor the traffic on that network segment. They usually consist of a network appliance with a NIC that is operating in promiscuous mode and is intercepting and analyzing the network packets in real time.

Network-based ID involves looking at the packets on the network as they pass by some sensor. The sensor can see only the packets that happen to be carried on the network segment it’s attached to. Network traffic on other segments, and traffic on other means of communication (such as phone lines), can’t be monitored properly by network-based IDS.

Packets are identified to be of interest if they match a signature. Three primary types of signatures are:

  1. String signatures - String signatures look for a text string that indicates a possible attack.

  2. Port signatures - Port signatures watch for connection attempts to well known, frequently attacked ports.

  3. Header condition signatures - Header signatures watch for dangerous or illogical combinations in packet headers.

IDS Approaches

The most common approaches to ID are statistical anomaly (also known as behavior-based) detection and pattern-matching (also known as knowledge-based or signature-based) detection.

Knowledge-Based ID

Knowledge-based ID systems use a database of previous attacks and known system vulnerabilities to look for current attempts to exploit these vulnerabilities, and then they trigger an alarm if an attempt is found. Most IDSs today are knowledge-based, and the accuracy of knowledge-based intrusion detection systems is considered good.

The advantages of a knowledge-based ID system are:

The disadvantages of knowledge-based ID systems are:

Behavior-Based ID

Behavior-based ID systems dynamically detect deviations from the learned patterns of user behavior, and an alarm is triggered when an activity that is considered intrusive (outside of normal system use) occurs. Behavior-based ID systems are less common than knowledge-based ID systems.

Behavior-based ID systems learn the normal or expected behavior of the system or the users and assume that an intrusion can be detected by observing deviations from this norm.

The advantages of behavior-based ID systems are:

The disadvantages of behavior-based ID systems are:

Honey Pots

A honey pot is a system on the network intentionally configured to lure intruders. Honey pots simulate one or more network services, hoping that an attacker will attempt an intrusion. Honey pots are most successful when run on known servers, such as HTTP, mail, or DNS servers, because these systems advertise their services and are often the first point of attack. They are often used to augment the deployment of an IDR system.

A honey pot is configured to interact with potential hackers in such a way as to capture the details of their attacks. These details can be used to identify what the intruders are after, their skill level, and what tools they use.

Honey pots should be physically isolated from the real network and are commonly placed in a DMZ. All traffic to and from the honey pot should also be routed through a dedicated firewall.

A honey pot is usually configured by installing the operating system using defaults, no patches, and the application designed to record the activities of the intruder.

Evidence of an intrusion into a honey pot can be collected through:

A properly configured honey pot monitors traffic passively, doesn’t advertise its presence, and provides a preserved prosecution trail for law enforcement agencies.

Honey Pot Issues

It’s important to be aware of legal issues arising out of implementing a honey pot. Some organizations discourage the use of honey pots, citing the legal concerns of luring intruders, and feel that no level of intrusion should be encouraged.

Before the intrusion occurs, it’s advisable to consult with local law enforcement authorities to determine the type and amount of data they will need in order to prosecute and how to properly preserve the chain of evidence.

Also, because the honey pot must be vigilantly monitored and maintained, some organizations feel it is too resource-intensive for practical use.

Computer Incident Response Team

Response includes notifying the appropriate parties to take action in order to determine the extent of the severity of an incident and to remediate the incident’s effects. According to NIST, an organization should address computer security incidents by developing an incident-handling capability. The incident-handling capability should be used to:

As part of a structured incident-handling program of Intrusion Detection and Response, a Computer Emergency Response Team (CERT) or Computer Incident Response Team (CIRT) is commonly created. Because “CERT” refers specifically to the CERT Coordination Center located at Carnegie Mellon’s Software Engineering Institute (SEI), “CIRT” is used more often.

The main tasks of a CIRT are:

The prime directive of every CIRT is Incident Response Management, which manages a company’s response to events that pose a risk to its computing environment. This management often consists of the following:

Additional examples of CIRT activities are:

IDS and a Layered Security Approach

Computer security is most effective when multiple layers of security are used within an organization, and ID is best utilized when implemented in a layered security approach. This concept implies that multiple steps are taken to secure the data, thereby increasing the workload and time required for an intruder to penetrate the network.

Therefore, although a firewall is an excellent perimeter security device, it is just one element of an effective security strategy. The more elements, or layers, of security that can be added to protect the data, the more secure the infrastructure will remain.

Elements of an effective layered security approach include:

Each of these layers may be implemented independently of the others, yet they are interdependent when functioning. An IDS that alerts to unauthorized access attempts or port scanning is useless without a response plan to react to the problem. Since each layer provides elements of protection, the defeat of any one layer should not lead to a failure of protection.

IDS and Switches

One serious issue with IDS is the proper implementation of IDS sensors in a switched environment. This issue arises from the basic differences between standard hubs and switches. Hubs exclude only the port the packet came in on; otherwise, they echo every packet to every port on the hub. Therefore, in networks employing only hubs, IDS sensors can be placed almost anywhere in the infrastructure.

However, when a packet comes into a switch, a temporary connection in the switch is first made to the destination port, and then the packet is forwarded. This means more care must be exerted when placing IDS sensors in a switched environment to ensure that the sensor is able to see all of the network traffic. Figure 3-39 shows an IDS employed on its own subnet.

Figure 3-39: IDS on a subnet.

Some switches permit spanning port configuration, which configures the switch to behave like a hub only for a specific port. The switch can be configured to span the data from a specific port to the IDS port. Unfortunately, some switches cannot be guaranteed to pass all the traffic to the spanned port, and most switches allow only one port to be spanned at a time.

Another partial solution is to place a hub between the monitored connections, say between two switches, between a router and a switch, or between a server and a switch. This allows traffic to still flow between the switch and the target but with traffic to be copied off to the IDS. This solution, however, spells the beginning of the end for the switched network and removes the benefits of a switched solution.

IDS Performance

Another issue with the implementation of intrusion detection systems is the performance of the IDS when the network bandwidth begins to reach saturation levels. Obviously, there is a limit to the number of packets that a network intrusion detection sensor can accurately analyze in any given time period. The higher the network traffic level and the more complex the analysis, the more the IDS may experience high error rates, such as the premature discarding of copied network packets.

[*]Source: CERT Coordination Center (CERT/CC), www.cert.org.

Network Attacks and Abuses

Attacks against computers, networks, and cryptographic systems have a variety of motivations. Some attacks are aimed at disrupting service, others focus on illegally acquiring sensitive information, and others attempt to deceive or defraud. In general, such attacks target the C.I.A. components of information security. In this section the most common types of attacks on networks are explored.

The CISSP candidate will need to know, in general, the various types of attacks on and abuses of networked systems. In current practice, these attacks are constantly evolving. This is probably the most dynamic area of InfoSec today. Large teams and huge amounts of money and resources are dedicated to reacting to the latest twists and turns of intrusions into networked systems, particularly on the Internet. We describe attacks and abuses in almost every chapter; here we focus on those attacks and abuses that commonly apply to networked systems.

Logon Abuse

Logon abuse can refer to legitimate users accessing services of a higher security level that would normally be restricted to them. Unlike network intrusion, this type of abuse focuses primarily on those users who might be legitimate users of a different system or users who have a lower security classification.

Masquerading is the term used when one user pretends to be another user. An attacker socially engineering passwords from an ISP could be an example of masquerading.

Inappropriate System Use

This style of network abuse refers to the nonbusiness or personal use of a network by otherwise authorized users, such as Internet surfing to inappropriate content sites (travel, pornography, sports, and so forth). As per the (ISC) Code of Ethics and the Internet Advisory Board (IAB) recommendations, the use of networked services for other than business purposes can be considered abuse of the system. Although most employers do not enforce extremely strict Web surfing rules, occasional harassment litigation resulting from employees accessing pornography sites and employees operating private Web businesses using the company’s infrastructure can constitute unauthorized use.

Eavesdropping

This type of network attack consists of the unauthorized interception of network traffic. Certain network transmission methods, such as satellite, wireless, mobile, PDA, and so on, are vulnerable to eavesdropping attacks. Tapping refers to the physical interception of a transmission medium (such as the splicing of a cable or the construction of an induction loop to pick up electromagnetic emanations from copper).

Eavesdropping and probing are often the preliminary steps to session hijacking and other network intrusions. Covert channel eavesdropping refers to using a hidden, unauthorized network connection to communicate unauthorized information. A covert channel is a connection intentionally created to transmit unauthorized information from inside a trusted network to a partner at an outside, untrusted node. Covert channels are described in more detail in Chapter 6, “Operations Security.”

As previously noted, war walking (or war driving) refers to scanning for 802.11-based wireless network information by either driving or walking with a laptop, a wireless adapter in promiscuous mode, some type of scanning software such as NetStumbler or AiroPeek, and a Global Positioning System (GPS).[*]

Network Intrusion

This type of attack refers to the use of unauthorized access to break into a network primarily from an external source. Unlike a logon abuse attack, the intruders are not considered to be known to the company. Most common conceptions of hacks reside in this category. Also known as a penetration attack, it exploits known security vulnerabilities in the security perimeter.

Back doors are very hard to trace, as an intruder will often create several avenues into a network to be exploited later. The only real way to be sure these avenues are closed after an attack is to restore the operating system from the original media, apply the patches, and restore all data and applications.

Piggybacking in the network domain refers to an attacker gaining unauthorized access to a system by using a legitimate user’s connection. A user may leave a session open or log off incorrectly, enabling an unauthorized user to resume the session.

Denial of Service (DoS) Attacks

The DoS attack might use some of the following techniques to overwhelm a target’s resources:

Specific DoS attacks are discussed in Chapter 2, “Access Control.”

Session Hijacking Attacks

Unauthorized access to a system can be achieved by session hijacking. In this type of attack, an attacker hijacks a session between a trusted client and network server. The attacking computer substitutes its IP address for that of the trusted client, and the server continues the dialog believing it is communicating with the trusted client.

Some examples of session highjacking attacks are:

Fragmentation Attacks

IP fragmentation attacks use varied IP datagram fragmentation to disguise their TCP packets from a target’s IP filtering devices. Two examples of these types of attacks are:

We describe various TCP fragmentation attacks later in the chapter.

Dial Up Attacks

[*]Source: “War Driving by the Bay,” by Kevin Poulsen, The Register, April 13, 2001.

[*]Source: Hacking Exposed, Stuart McClure, Joel Scambray, and George Kurtz (Osborne, 1999).

Probing and Scanning

Probing is an active variation of eavesdropping, usually used to give an attacker a road map of the network in preparation for an intrusion or a DoS attack. Attackers use it to discover what ports are open, what services are running, and what system software is being used. Probing enables an attacker to more easily detect and exploit known vulnerabilities within a target machine.

Scanning, or traffic analysis, uses a “sniffer” to scan the hosts of various enabled services to document what systems are active on a network and what ports are open.

Both of these can be performed either manually or automatically. Manual vulnerability checks are performed using tools such as Telnet to connect to a remote service to see what is listening. Automated vulnerability scanners are software programs that automatically perform all the probing and scanning steps and report the findings back to the user. As a result of the free availability of such software on the Internet, the amount of this type of automated probing has increased.

Vulnerability Scanning

Vulnerability scanning should be implemented by the security professional to help identify weaknesses in a system. It should be conducted on a regular periodic basis to identify compromised or vulnerable systems. The scans directed at a target system can either be internal, originating from within the system, or external, originating from outside the target system.

Because scanning activity is often a prelude to a system attack, monitoring and analysis of the logs and blocking of unused and exposed ports should accompany the detection of malicious scans.

Conducting scans inside the enterprise on a regular basis is one way to identify and track several types of potential problems, such as unused ports that respond to network requests. Also, uncontrolled or unauthorized software may be located using these scanning techniques.

A common vulnerability-scanning methodology may employ several steps, including an IP device discovery scan, workstation vulnerability scan, and server vulnerability scan.

Discovery Scanning

The intent of a discovery scan is to collect enough information about each network device to identify what type of device it is (e.g., workstation, server, router, firewall), its operating system, and whether it is running any externally vulnerable services such as Web services, FTP, or e-mail. The discovery scan contains two elements: inventory and classification. The inventory scan provides information about the target system’s operating system and its available ports. The classification process identifies applications running on the target system, which aids in determining the device’s function.

Workstation Scanning

A full workstation vulnerability scan of the standard corporate desktop configuration should be implemented regularly. This scan helps ensure that the standard software configuration is current with the latest security patches and software, and it helps locate uncontrolled or unauthorized software.

Server Scanning

A full server vulnerability scan will determine whether the server OS has been configured to the corporate standards and whether applications are kept current with the latest security patches and software. All services must be inspected for elements that may compromise security, such as default accounts and weak passwords. Also, unauthorized programs such as Trojans may be identified.

Port Scanning

Port scanning is the process of sending a data packet to a port to gather information about the state of the port. This is also called a probe. Port scanning makes it possible to find what TCP and UDP ports are in use. For example, if ports 25, 80, and 110 are open, the device is running the SMTP, HTTP, and POP3 services.

A cracker can use port-scanning software to determine which hosts are active and which are inactive (down) in order to avoid wasting time on inactive hosts. A port scan can gather data about a single host or hosts within a subnet (256 adjacent network addresses).

A scan may first be implemented using the ping utility. Then, after determining which hosts and associated ports are active, the cracker can initiate different types of probes on the active ports.

Examples of probes are:

TCP/UDP Scanning Types

Many types of TCP/UDP scanning techniques exist. Some are simple and easily detectable by firewalls and intrusion detection systems, whereas some are more complicated and harder to detect.

Stealth Scans

Certain types of scans are called stealth scans because they try to evade or minimize their chances of detection. Several of the scans outlined later, such as the TCP SYN or TCP FIN scan, can be described as stealth scans.

Another example of a stealth scan is implemented through fragmenting the IP datagram within the TCP header. This will bypass some packet filtering firewalls because they don’t get a complete TCP header to match the filter rules.

Spoofed Scans

Although the term spoofing comes up often in any discussion of security, it can be applied here to conceal the true identity of an attacker. Spoofing allows an attacker to probe the target’s ports without revealing the attacker’s own IP address. The FTP proxy bounce attack described subsequently is an example of a spoofed scan that compromises a third-party FTP server.

The HPing network analysis tool, also described later, hides the source of its scans by using another host through which to probe the target site. Also, NMap provides spoofing capability by allowing the operator to enter an optional “source” address for the scanning packet.

The following are some TCP-based scanning techniques:

Determining the OS Type

Determining the type of OS is also an objective of scanning, because this will determine the type of attack to be launched.

Sometimes a target’s operating system details can be found very simply by examining its Telnet banners or its File Transfer Protocol (FTP) servers, after connecting to these services.

TCP/IP stack fingerprinting is another technique to identify the particular version of an operating system. Since OS and device vendors implement TCP/IP differently, these differences can help in determining the OS.

Some of these differences include:

Table 3-11shows some common Time To Live values. Remember that the TTL will decrement each time the packet passes through a router. This means that the TTL of a router 6 hops away will be 249 (255 – 6).

Table 3-11: Time To Live (TTL) Values

Open table as spreadsheet

TIME TO LIVE

OPERATING SYSTEM OR DEVICE TYPE

255

Many network devices, Unix and Macintosh systems

128

Many Windows systems

60

Hewlett-Packard Jet Direct printers

32

Some versions of Windows 95B/98

Another type of OS identification technique is TCP initial sequence number sampling. After the target host responds to a connection request, information about the operating system can be inferred from the pattern of the sequence numbers.

Scanning Tools

Many of these tools are used by crackers and intruders, but they also help the security administrator detect and stop malicious scans. Used with intrusion detection systems, these tools can provide some level of protection by identifying vulnerable systems, and they can provide data about the level of activity directed against a machine or network. Since scanning is a continuous activity (that is, all networked systems are being scanned all of the time), it’s very important that the security professional know what can be compromised. Some common scanning tools are:

NMap

NMap scans for most ports from 1 to 1024 and a number of others in the registered and undefined ranges. This helps identify software such as PCAnywhere, SubSeven, and BackOrifice. Now that a Windows interface has been written, it no longer has to be run only on a Unix system.

NMap allows scanning of both TCP and UDP ports, with root privilege required for UDP. While NMap doesn’t have signature or password-cracking capabilities, like L0phtcrack, it will estimate how hard it will be to hijack an open session.

Vulnerable Ports

Although the complete listing of well-known and registered ports is extensive, some ports are attacked more often than others. In Table 3-12, we’ve listed the ports that are the greatest risk to networked systems.

Table 3-12: Commonly Attacked Ports

Open table as spreadsheet

PORT #

SERVICE NAME

SERVICE DESCRIPTION

21

ftp

File Transfer Protocol

23

telnet

Telnet virtual terminal

25,109,110 143

smtp, pop3, imap

Simple Mail Protocol, POP2, POP3, and IMAP Messaging

53

dns

Domain Name Services

80, 8000, 8080

http

Hyper-Text Transfer Protocol and HTTP proxy servers

118

sqlserv

SQL database service

119

nntp

Network News Transfer Protocol

161

snmp

Simple Network Management Protocol

194

irc

Internet Relay Chat

389,636

ldap

Lightweight Directory Access Protocol

2049

nfs

Networking File Systems

5631

PCAnywhere

PCAnywhere Remote Control

Issues with Vulnerability Scanning

Some precautions need to be taken when the security administrator begins a program of vulnerability scanning on his or her own network. Some of these issues could cause a system crash or create unreliable scan data.

HOW DO WE GET WINDOWS NT PASSWORDS?

The NT Security Accounts Manager (SAM) contains the usernames and encrypted passwords of all local (and domain, if the server is a domain controller) users. The SAM uses an older, weaker LanManager hash that can be broken easily by tools such as L0phtcrack. Physical access to the NT server and the rdisks must be controlled. The “Sam” file in the repair directory must be deleted after creation of an rdisk. Pwdump and pwdump2 are utilities that allow someone with Administrator rights to target the Local Security Authority Subsystem, lsass.exe, from a remote system:

Malicious Code

Malicious code is the name used for any program that adds to, deletes, or modifies legitimate software for the purpose of intentionally causing disruption and harm or to circumvent or subvert the existing system’s function. Examples of malicious code include viruses, worms, Trojans, and logic bombs. Newer malicious code is based on mobile ActiveX controls and Java applets.

Viruses

Viruses are a type of malicious code that attaches to a host program and propagates when an infected program is executed.

A virus infects the operating system in two ways: by completely replacing one or more of the operating system’s programs or by attaching itself to existing operating system programs and altering functionality. Once a virus has changed OS functionality, it can control many OS processes that are running.

To avoid detection, the virus usually creates several hidden files within the OS code or in “unusable” sectors. Since infections in the OS are difficult to detect, they have deadly consequences on systems relying on the OS for basic functions. Jerusalem, Cascade, and Form are some viruses that infect the boot sector.

The Virus Life Cycle

There are two main phases in the life cycle of a virus: replication and activation. In the first phase, replication, viruses typically remain hidden and do not interfere with normal system functions. During this time, viruses actively seek out new hosts to infect by attaching themselves to other software programs or by infiltrating the OS, for example.

During the second phase, activation, the virus’s payload gradually or suddenly inflicts damage on the host system. Typically, the decision to activate is based on a mathematical formula with criteria such as date, time, number of infected files, and others. The possible damage at this stage could include destroyed data, software or hardware conflicts, space consumption, and abnormal behavior.

Macro Viruses

Macro viruses are the most prevalent computer viruses in the wild, accounting for the vast majority of virus encounters. A macro virus can easily infect applications such as Microsoft Excel and Word.

To infect the system, macro viruses attach themselves to the application’s initialization sequence, and then when the application is executed, the virus’s instructions execute before control is given to the application. Thus the virus replicates itself, infecting more and more of the system. If the application has e-mail capabilities, the virus uses these to mail copies of itself to contacts it finds in the victim’s address book.

These macro viruses move from system to system through e-mail file sharing, demonstrations, data sharing, and disk sharing. Today’s widespread sharing of macro-enabled files, primarily through e-mail attachments, is rapidly increasing the macro virus threat.

Well-known macro viruses from recent years include:

Polymorphic Viruses

Polymorphic viruses are difficult to detect because they hide themselves from antivirus software by altering their appearance after each infection. Some polymorphic viruses can assume over two billion different identities.

There are three main components of a polymorphic virus: a scrambled virus body, a decryption routine, and a mutation engine. The process of a polymorphic infection is:

  1. The decryption routine first gains control of the computer and then decrypts both the virus body and the mutation engine.

  2. The decryption routine transfers control of the computer to the virus, which locates a new program to infect.

  3. The virus makes a copy of itself and the mutation engine in RAM.

  4. The virus invokes the mutation engine, which randomly generates a new decryption routine capable of decrypting the virus yet bearing little or no resemblance to any prior decryption routine.

  5. The virus encrypts the new copy of the virus body and mutation engine.

  6. The virus appends the new decryption routine, along with the newly encrypted virus and mutation engine, onto a new program.

As a result, not only is the virus body encrypted, but also the virus decryption routine varies from infection to infection. No two infections look alike, confusing the virus scanner searching for the sequence of bytes that identifies a specific decryption routine.

Stealth Viruses

Stealth viruses attempt to hide their presence from both the OS and the antivirus software by:

They are similar to polymorphic viruses in that they are very hard to detect.

Spyware

Generally, spyware is any technology that aids in gathering information about a person or organization without their knowledge or consent - a software category that covers any program that secretly tracks or records your personal information. There are benign versions, such as adware, which largely only irritate the user by displaying targeted ads and hogging resources. Obviously, law enforcement has a use for spyware, and employers or parents may have a legal right to know what’s going on with a PC in their business or home.

But now spyware is becoming far more dangerous than adware and can cause more long-lasting problems than most viruses. The newest versions of spyware have become remarkably self-sufficient and potent, not only accessing sensitive information stored on the computers they infect but, in some recent cases, surreptitiously intercepting financial data as it’s being transmitted. They can also auto-update themselves, alter system configurations, and download and install additional software at will.[*]

The types of information gathered by spyware can include:

Spyware comes in many flavors: some merely annoying, some dangerous, and some that lead to identity theft. Some spyware presents the user with a deceptive pop-up window to trick the user into accepting its installation. Other types, such as drive-by downloads, don’t even need your consent or knowledge to jump onto your machine.

IN THE BEGINNING

The word spyware first surfaced in a Usenet post in October 1995. The post was making fun of the Microsoft business model and inferred that some elements of Windows were designed to keep an eye on users’ computing behavior. Zone Labs, the company that makes the Zone Alarm Personal Firewall, then used the term in a press release in 1999. It’s been in the lexicon ever since.

Adware

Adware is software designed to serve advertising and marketing. It qualifies as spyware because it almost invariably includes components for tracking and reporting user information; the user may or may not know it’s even there.

Keyloggers

Keyloggers are a form of spyware that records user keystrokes. They can be either hardware devices or software programs. They record every key typed on a computer, sending this information to the person who installed it or saving it to be read later.

The software versions may be delivered by Trojan horse e-mail attachments or installed directly to the PC. The hardware version must be physically installed on the target machine, usually without the user’s knowledge. Although keyloggers are sometimes used in the payloads of viruses, they are more commonly delivered by a Trojan horse program or remote access Trojan (RAT), discussed later.

Since keylogging programs record every keystroke typed in via the keyboard, they can capture a wide variety of confidential information, including passwords, credit card numbers, private e-mail correspondence, names, addresses, phone numbers, and other sensitive documents. Sometimes these logging files are e-mailed to the person who planted the logging software. On PCs accessed by the public in areas such as copy shops, cyber cafes, and university computer labs, the spy simply accesses the log file from the compromised machine at a later date.

Once installed on the target machine, either direct through interaction with the user or through a more stealthy means, the keylogger program runs continually in the background. After the keystrokes are logged, they can be hidden in the machine for later retrieval or transmitted to the attacker via the Internet.

The attacker then examines the reports for passwords or information that can be used to compromise the system or engineer an attack. A keylogger may reveal the contents of e-mail composed by the victim.

Some rare keyloggers include routines that secretly turn on video or audio recorders and transmit what they capture over your Internet connection. Other products, such as Spector and PCSpy, capture screens rather than keystrokes. However, most criminal keyloggers are hoping to steal bank account numbers or other financial data.

As an example, look at everything one commercial software keylogger, ISpyNow, claims it can do:

Hardware Keyloggers

Some hardware keystroke loggers consist of an AA battery-sized plug that connects between the victim’s keyboard and computer. The device collects each keystroke as it is typed and saves it in a text file on its own tiny hard drive. Later, the keystroke logger owner returns, removes the device, and downloads and reads the keystroke information. These devices have memory capacities between 8KB and 2MB, which, according to manufacturer’s claims, is enough memory to capture a year’s worth of typing. Figure 3-40 shows the small size of the keyboard plug device.

Figure 3-40: Balun keylogger device. Courtesy of Allen Concepts, Inc. (www.keykatcher.com).

Manufacturers now offer hardware keyloggers that are complete keyboards with hardware keyloggers built in. For example, KeyGhost, a New Zealand company, offers a keyboard with the logging hardware built into the case. They claim to have a variety of bugged keyboards ready-made to match many brands of computers. If your existing keyboard is unique, KeyGhost will modify it and return it with the keylogger hardware hidden inside.

To get an idea of how small the circuit board can be in a keylogger hardware device, Figure 3-41 shows the board next to a U.S. quarter.

Figure 3-41: The tiny hardware keylogger circuitry. Courtesy of Keylogger.com/Amecisco Inc.

Software Keyloggers

A software keystroke logger program does not require physical access to the user’s computer. It can be installed intentionally by someone who wants to monitor activity on a particular computer or downloaded unwittingly as spyware and executed as part of a rootkit or a RAT.

ROOTKITS

A rootkit is a collection of software tools that a cracker uses to obtain administrator-level access to a computer or computer network. The intruder installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or by cracking a password. The rootkit then collects userids and passwords to other machines on the network, thus giving the hacker root or privileged access.

A rootkit may consist of utilities that also monitor traffic and keystrokes, create a back door into the system for the hacker’s use, alter log files, attack other machines on the network, and alter existing system tools to circumvent detection.

A powerful rootkit called “Hearse” recently funneled many millions of dollars out of major U.S. financial institutions and into Russian criminal accounts. You can read more about it here: http://rdvgroup.blogspot.com/ 2006/03/new-trojan-named-rootkithearse.html

The software keylogger normally consists of two files: a DLL that does all the recording and an EXE that installs the DLL and sets the activation trigger. The two files must be present in the same directory. Then the keystroke logger program records each keystroke the user types and uploads the information over the Internet periodically to the installer.

Software keyloggers are often delivered as a Trojan payload through e-mail. This area of malicious code is growing exponentially as well-financed criminal groups find holes in financial networks. One advantage software keyloggers have over hardware keyloggers is that the program can often remain undetected and be continually initiated every time the computer is turned on. Also, software keyloggers are cheaper than hardware keyloggers, with many free versions on the Internet.

As mentioned, many software keystroke loggers are integrated with other surreptitious recording software, such as screen capture software, remote control software, or audio and video recorders.

Web Bugs

Web bugs are little bits of code embedded in Web pages or HTML e-mail to monitor the reader. Most users aren’t aware that these bugs exist, because they hide within tiny (one-pixel) image tags, although any graphic on a Web page or in an e-mail can be configured to act as a Web bug.

Common information sent to the Web bug’s owner includes:

Advertising networks commonly use Web bugs to gather and store information on users’ personal profiles. Web bugs are also used to count the numbers of people visiting particular sites and to gather information regarding browser usage.

Spambots

A spambot is a program designed to collect, or harvest, e-mail addresses from the Internet in order to build mailing lists for sending spam. A number of programs and approaches have been devised to foil spambots, such as munging, in which an e-mail address is deliberately modified so that a human reader can decode it but a spambot cannot. This has led to the evolution of sophisticated spambots that can recover e-mail addresses from character strings that appear to be munged.

SYMPTOMS OF A SPYWARE IINFECTION

Spyware infection may be causing more visits to the repair shop than any other single cause. Generally the user is not aware of the existence of spyware and initially assumes that the system performance, stability, or connectivity issues relate to hardware, Windows installation problems, or a virus.

Here are some symptoms that indicate a computer may be infested with spyware:

Pop-Up Download

A pop-up download is a pop-up window that asks users to download a program to their computer’s hard drive. Some spyware pop-ups use recognized branding, like Adobe or Macromedia, to make us feel comfortable clicking. The dialog box pops up and claims you need to install a plug-in to view special characters. The window may feature a security warning or some other type of message that is likely to baffle or confuse the user into compliance.

Drive-By Download

A drive-by download installs its junk on a computer without even the courtesy of first generating a pop-up window, most likely without the user’s knowledge or consent. Unlike a pop-up download, which asks for permission, a drive-by download is invisible. It can be initiated when you simply visit a Web site or view an HTML e-mail message. Sometimes a drive-by download is installed along with another useful application.

Bogus Spyware Removal Programs

Bogus spyware removal programs are particularly heinous because they prey on fear and punish the user who’s trying to do the right thing. Victims think they are protecting themselves from spyware, but, in some cases, they are actually paying good money to install spyware on their PCs.

Here are some programs that do more than they let on:

Multistage and Blended Threats

Blended threats are new infections that mark the beginning of a new era of spyware, pushing the limits of what used to be the separate worlds of virus and spyware infections. These new infection mechanisms combine multiple activities to create a multistage or blended threat.

Often the payload of these new exploits is a keylogging Trojan designed to steal banking information. Brazilian crackers, especially, have been creating an army of these Trojans. But what makes them especially scary is that their payload can be programmed to carry out any instructions, and quite successfully. Using drive-by downloads and blended threats, these exploits are increasing spyware infections exponentially.

Trojan Horses

Generically, the term Trojan horse refers to a program in which malicious or harmful code is contained inside apparently harmless programming or data. The harmful code gains control and does its chosen form of damage, such as ruining the file allocation table on your hard disk. Trojan horses hide malicious code inside a host program that seems to do something useful. When the host program is executed, the virus, worm, or other type of malicious code hidden in the Trojan horse program is released to attack the workstation, server, or network, or to allow unauthorized access to those devices.

Spyware often employs Trojans to monitor computer usage and glean confidential information. The payload may be delivered by various attack vectors, such as e-mail attachments, downloaded worms, or direct installation by crackers. Trojans often spoof their origin so that their attacks can’t be traced to the actual perpetrator.

In the network world, Trojans are commonly used to create back doors into the network for later exploitation by crackers.

Here are some common Trojans:

Some Trojans are programmed to open specific ports to allow access for exploitation. When a Trojan is installed on a system, it often opens a high-numbered port. Then the open Trojan port can be scanned and located, enabling an attacker to compromise the system.

Remote Access Trojans (RATs)

A program that surreptitiously allows access to a computer’s resources (files, network connections, configuration information, and so on) via a network connection is sometimes referred to as a remote access Trojan (RAT).

Such functionality is often included in legitimate software design and intended to allow such access. For example, software that allows remote administration of workstations on a company network or that allows help desk staff to take over a machine to remotely demonstrate how a user can achieve some desired result, are genuinely useful tools. These tools are designed into a system and installed and used with the knowledge and support of the system administrator and the other support staff.

RATs generally consist of two parts: a client component and a server component. In order for the Trojan to function as a back door, the server component has to be installed on the victim’s machine. This may be accomplished by disguising the program in such a way as to entice victims into running it. It could masquerade as another program altogether (such as a game or a patch), or it could be packaged with a hacked, legitimate program that installs the Trojan when the host program is executed.

After the server file has been installed on a victim’s machine, often accompanied by changes to the registry to ensure that the Trojan is reactivated whenever the machine is restarted, the program opens a port so that the hacker can connect. The hacker can then utilize the Trojan via this connection to issue commands to the victim’s computer. Some RATs even provide a message system that notifies the hacker every time a victim logs onto the Internet.

Logic Bombs

Logic bombs are malicious code added to an existing application to be executed at a later date. Every time the infected application is run, the logic bomb checks the date to see whether it is time to run the bomb. If not, control is passed back to the main application and the logic bomb waits. If the date condition is correct, the rest of the logic bomb’s code is executed, and it can attack the system.

In addition to the date, there are numerous ways to trigger logic bombs: counter triggers; replication triggers, which activate after a set number of virus reproductions; disk space triggers; and video mode triggers, which activate when video is in a set mode or changes from set modes.

Worms

Instead of attaching themselves to a single host program and then replicating like viruses, a worm is a malicious self-replicating computer program designed to infect multiple remote computers in attempt to deliver a destructive payload. Worms attack a network by moving from device to device. Worms are constructed to infiltrate legitimate data processing programs and alter or destroy the data. Most worms can infect and corrupt files, degrade overall system performance and security, steal user sensitive information or install other dangerous parasites such as back doors or Trojans.

Because of their replicating nature, unchecked worms can be exceptionally dangerous to networking infrastructure. There are several thousand varieties of worm in the “wild,” and some common worms are:

Malicious Code Prevention

Although policies and procedures help the spread of malicious code, currently malicious code prevention is mostly centered on scanning, prevention, and detection products.

Virus Scanners

Most virus scanners use pattern-matching algorithms that can scan for many different signatures at the same time. These algorithms include scanning capabilities that detect known and unknown worms and Trojan horses.

Most antivirus scanning products search hard disks for viruses, detect and remove any that are found, and include an auto-update feature that enables the program to download profiles of new viruses so that it will have the profiles necessary for scanning.

Virus Prevention

Virus infection prevention products are used to prevent malicious code from initially infecting the system and stop the replication process. They either reside in memory and monitor system activity or filter incoming executable programs and specific file types. When an illegal virus accesses a program or boot sector, the system is halted and the user is prompted to remove the particular type of malicious code.

Virus Detection

Virus detection products are designed to detect a malicious code infection after the infection occurs. Two types of virus detection products are commonly implemented: short-term infection detection and long-term infection detection. Short-term infection detection products detect an infection very soon after the infection has occurred. Short-term infection detection products can be implemented through vaccination programs or the snapshot technique.

Long-term infection detection products identify specific malicious code on a system that has already been infected for some time. The two different techniques used by long-term infection detection products are spectral analysis and heuristic analysis. Spectral analysis searches for patterns in the code trails that malicious code leaves. Heuristic analysis analyzes malicious code to figure out its capability.

Spyware Removers

Antivirus programs by themselves aren’t enough protection from spyware. For that you need another piece, spyware detection. Some decent freeware exists, use it to audit your PC and identify what spyware is resident. You can also use the same software to remove unwanted spyware. Some malware takes more than one tool to eliminate it.

A couple of our freebie favorites are Ad-Aware SE from Lava Soft (www .lavasoftusa.com/), and Spybot Search and Destroy (www.spybot.info/ en/index.html).

You can find a pretty comprehensive list of spyware detectors at: www.pcworld.com/downloads/browse/0,cat,1727,sortIdx,1,pg, 1,00.asp.

[*]Excerpted from: Phishing: Cutting the Identity Theft Line, Rachael Lininger and Russell Dean Vines (Wiley, 2005).

Web Security

With the transformation of the Internet from a network used primarily by universities and research laboratories to a worldwide communications medium, attacks on the World Wide Web and Internet can have serious consequences. These attacks can involve nuisance attacks, phishing, criminal exploits, and, in information warfare, incapacitation of a nation’s critical infrastructure. Thus, there is a need for protecting nodes on the Internet and for providing for the confidentiality, integrity, and availability of information utilizing these networks.

Phishing

Phishing is a term that refers to a large groups of exploits using the Internet to commit identity theft. Simply, phishing is the automated stealing of personal information for financial gain. Phishers use a variety of means to accomplish this, including:

Spyware and Trojans, in addition to viruses, are commonly distributed via phishing exploits also, although some of these aren’t specifically designed to perpetrate identity theft or financial loss.

Browser Hijacking

Browser hijackers change Web browser settings to switch home pages or hijack search functions. A browser hijacker is a type of malware program that alters your computer’s browser settings so that you are redirected to Web sites that you had no intention of visiting.

REDIRECTION

Redirection is a technique for moving visitors to a different site when its address has been changed and visitors are familiar with the old address. Redirection is used legitimately when users visit the Web site of a company whose name has changed or that has been acquired by another company. In either case, the website probably includes a new domain name and has a new Uniform Resource Locator (URL).

Redirection is often combined with browser hijackers to surreptitiously change the user’s browser settings and direct users to an inappropriate site.

For example, browser hijackers can set browser home pages and search settings to point to pornographic sites or generate pornographic pop-up windows faster than the user can shut them. Some browser hijackers have a financial incentive, altering default home pages and search pages to those of their customers, who pay for that service per referral or click-through. More virulent versions may redirect users to sites that install spyware.

Browser hijackers can create incidental problems because of the nature of the material they download, such as leaving pornography or other inappropriate material on the hard drive. Poorly coded browser hijackers may severely impact infected computer’s performance. Software may freeze and cause the computer to crash or reboot.

SSL TLS

The Secure Sockets Layer (SSL) Protocol was developed by Netscape in 1994 to protect the confidentiality of information transmitted between two applications, to verify the integrity of the communications, and to provide an authentication means in both directions. SSL implements these functions using public- and private-key encryption and a message authentication code (MAC).

Microsoft has developed a newer version of SSL, Transport Layer Security (TLS). As with SSL, TLS implements confidentiality, integrity, and authentication above the Transport Layer and is application independent. Because SSL and TLS ride on the Transport Layer protocol, they are independent of the application. Thus, SSL and TLS can be used with applications such as Telnet, FTP, HTTP, and e-mail protocols.

Both SSL and TLS use certificates for public-key verification that are based on the X.509 standard.

SSL 3.0

The design goals of SSL 3.0 were to provide:

Session keys generated during SSL private-key cryptography transactions are either 40 bits or 128 bits in length. Newer browsers support 128-bit encryption.

The SSL Protocol comprises two layers: the SSL Record Protocol and the SSL Handshake Protocol. The SSL Record Protocol is layered above a transport protocol, such as TCP. This Record Protocol is used for encapsulation of higher-level protocols, such as the SSL Handshake Protocol. The latter protocol is used for client/server mutual authentication, negotiation of a cryptographic algorithm, and exchange of cryptographic keys.

Thus, through these mechanisms, SSL provides:

TLS 1.0

Similar to SSL, the TLS Protocol comprises the TLS Record and Handshake Protocols. The TLS Record Protocol is layered on top of a transport protocol such as TCP and provides privacy and reliability to the communications. The privacy is implemented by encryption using symmetric-key cryptography such as DES or RC4. The secret key is generated anew for each connection; however, the Record Protocol can be used without encryption. Integrity is provided through the use of a keyed Message Authentication Code (MAC) using hash algorithms such as SHA or MD5.

The TLS Record Protocol is also used to encapsulate a higher-level protocol such as the TLS Handshake Protocol. The server and client use this Handshake Protocol to authenticate each other. The authentication can be accomplished using asymmetric-key cryptography such as RSA or DSS. The Handshake Protocol also sets up the encryption algorithm and cryptographic keys to enable the application protocol to transmit and receive information.

HTTP/S

URLs of Web pages using the SSL Protocol start with HTTPs, denoting the Hypertext Transfer Protocol with SSL.

Since TLS is based on SSL, they have similar functionality and goals; however, SSL and TLS have enough differences that they cannot interoperate. In order to address this situation, TLS has a built-in mechanism that can be used to make TLS compatible with SSL 3.0.

S HTTP

Secure HTTP (S-HTTP) is a communications protocol designed to provide secure messaging over HTTP. S-HTTP provides equal and symmetric capabilities to both client and server, but one entity that is S-HTTP-enabled can communicate with another entity that is not S-HTTP capable. In that instance, the security features would not be operable. S-HTTP implements secure, end-to-end transactions.

S-HTTP supports a symmetric-key encryption-only mode and, therefore, does not require public-key encryption for key exchanges. It is flexible, however, and permits the clients and servers to use different forms of transactions related to the signing of messages, encryption of messages, algorithms used, and types of certificates.

In summary, S-HTTP is a protocol that supports:

Instant Messaging Security

Instant messaging supports the real-time exchange of messages between two parties using the Internet. In order to use this service, the user has to have instant messaging client software on his or her computer. The client software then communicates with an instant messaging server. The user provides the server with a contact or “buddy” list of people with which he or she desires to set up instant messaging.

To use instant messaging, the user logs on to the instant messaging server with the user’s ID and password. The server authenticates the user. Then the client sends to the server the user’s IP address and the port number on the user’s computer that is being used by the instant messaging client. The server stores this information as well as identical information from any other individuals on the user’s contact list that are logged in at that time. An important point to note is that once an individual, A, is logged on to the server, the server sends the IP addresses and port numbers of all the others logged on to the server at that time to A’s client software. Thus, all people on the contact list who are logged on to the instant messaging server at that time are notified of the online presence and contact information of the others who are also logged on.

A user can send a message to another individual on the contact list who is logged on, and that message will instantly appear on the screen of the receiving individual. Because a user’s client knows the IP address and port number of the receiving individual, the user’s message is sent directly to the intended recipient and does not have to go through the instant messaging server.

With instant messaging, communication takes place between only two individuals. If the situation requires instant conferencing among more than two individuals, a chat room can be set up. A chat room is similar to instant messaging, but everyone logged on to the “room” can see a message that is sent by any individual.

When an individual, A, wants to terminate the instant messaging session, A closes his or her message window and exits the instant messaging client. The client then sends a message to the instant messaging server indicating that A has logged off. The server, in turn, sends a message to all the active participants of the contact list that A has exited the session. The members of the contact list still logged on will see the status of A on their windows change from “online” to “offline.”

Instant messaging software packages also offer other services, including chat room setup, image and sound transmission, voice communication, and streaming content.

Some of the more popular instant messaging utilities are the freeware ICQ (for “I seek you” at www.icq.com), AIM (America Online’s Instant Messenger), Microsoft’s instant messaging utility in MSN Explorer, and Yahoo Instant Messenger.

One problem with instant messaging is the lack of interoperability. An individual with an instant messaging utility from one source or vendor may not be able to communicate with a person using a different instant messaging package. In order to address this situation, the Internet Engineering Task Force (IETF) has developed a standard protocol for instant messaging - the Instant Messaging Presence Protocol (RFC2779).

IM Vulnerabilities

IM brings with it a variety of security risks by providing a fertile ground for developing smarter worms, sophisticated enough to deliver Trojan horses or even chat with you in your native language. IDC Research estimates that the nearly 12 billion IMs sent every day offer a potent malware transmission vector, with IM Trojans and worms increasing from 21 in 2004 to over 300 in 2005.

Messages sent by means of instant messaging are not inherently secure and safe from prying eyes. The instant messaging server is particularly vulnerable because it contains both the messages and the connection information of the participants.

Corporate users have often installed IM clients without the IT departments’ authority on their companies’ computers, thereby opening their corporate infrastructure to a myriad of security threats, such as:

Since consumer IM clients bypass corporate security defenses, they don’t provide encryption or message auditing, logging, and archiving, functions an organization requires to maintain its security posture. IM worms can hijack buddy lists, spread much more rapidly than e-mail-borne viruses or worms, and are similar to phishing because they appear to be coming from a trusted source (social engineering). Some examples of recent IM worms are:

Some of the older IM worms that are still circulating are:

IM Solutions

All of this can add up to enormous potential for organizational liability. When determining the impact IM use may have on an organization, it’s important to consider:

If it’s determined that the organization absolutely needs IM, Information Systems Security Officers (ISSO) or other corporate security personnel should take definite steps:

Also, if the organization decides that the IM risk is not very high, third-party instant messaging software utilities may provide adequate additional security features, including:

Enterprise IM

In seeking security solutions for IM, several vendors offer a strategy called Enterprise Instant Messaging (EIM). EIM allows an organization to provide integration with commercial IM services while combining firewall-type security features with e-mail-type scanning. Today’s EIM products offer a lot of advantages over using a public IM network by itself. Some products manage the use of public IMs, while others offer a proprietary solution.

Many corporations and agencies are employing EIM management tools to improve their security posture and meet ever-stricter regulations for storing communications. Most secure EIM systems offer the ability to easily capture and store IM communications, keeping the company compliant with federal information retention regulations.

Naming Conventions

The Microsoft New Technology File System (NTFS) has the capability to generate file names in the DOS 8.3 naming convention for the use of 16-bit applications that access files that do not conform to DOS 8.3 naming. Windows 2000, Windows NT Server, and Windows NT Workstation support the NTFS file system. Windows 95 and 98 support the earlier File Allocation Table (FAT) file system along with the newer version, FAT 32. The NTFS enhancements over FAT and FAT 32 include optimization of available disk space, fault tolerance, and improved security features.

Web servers that respond to requests for files in their DOS 8.3 file names are vulnerable to attacks that can cause the server to reveal source code. A fix to this problem is to disable DOS 8.3 file name creation on the NTFS server, but this may lead to difficulties in using 16-bit applications.

Assessment Questions

You can find the answers to the following questions in Appendix A.

1. 

Which of the following is not an element of a fiber-optic cable?

  1. Core

  2. BNC

  3. Jacket

  4. Cladding

2. 

To what does 10Base5 refer?

  1. 10 Mbps thinnet coax cabling rated to 185 meters maximum length

  2. 10 Mbps thicknet coax cabling rated to 500 meters maximum length

  3. 10 Mbps baseband optical fiber

  4. 100 Mbps unshielded twisted pair cabling

3. 

Which of the following LAN transmission methods describes a packet sent from a single source to multiple specific destinations?

  1. Unicast

  2. Multicast

  3. Broadcast

  4. Anycast

4. 

Which part of the 48-bit, 12-digit hexadecimal number known as the Media Access Control (MAC) address identifies the manufacturer of the network device?

  1. The first three bytes

  2. The first two bytes

  3. The second half of the MAC address

  4. The last three bytes

5. 

Which of the following best describes coaxial cable?

  1. Coax consists of two insulated wires wrapped around each other in a regular spiral pattern.

  2. Coax consists of a hollow outer cylindrical conductor surrounding a single, inner conductor.

  3. Coax does not require the fixed spacing between connections that UTP requires.

  4. Coax carries signals as light waves.

6. 

Which of the following is not one of the legal IP address ranges specified by RFC1976 and reserved by the Internet Assigned Numbers Authority (IANA) for nonroutable private addresses?

  1. 10.0.0.0–10.255.255.255

  2. 127.0.0.0–127.0.255.255

  3. 172.16.0.0–172.31.255.255

  4. 192.168.0.0–192.168.255.255

7. 

Which of the following statements about the difference between analog and digital signals is incorrect?

  1. An analog signal produces an infinite waveform.

  2. Analog signals cannot be used for data communications.

  3. An analog signal can be varied by amplification.

  4. A digital signal produces a square waveform.

8. 

Which of the following most accurately describes SSL?

  1. It’s a widely used standard of securing e-mail at the Application level.

  2. It gives a user remote access to a command prompt across a secure, encrypted session.

  3. It uses two protocols, the Authentication Header and the Encapsulating Security Payload.

  4. It allows an application to have authenticated, encrypted communications across a network.

9. 

Which IEEE protocol defines wireless transmission in the 5 GHz band with data rates up to 54 Mbps?

  1. IEEE 802.11a

  2. IEEE 802.11b

  3. IEEE 802.11g

  4. IEEE 802.15

10. 

Which protocol is used to resolve a known IP address to an unknown MAC address?

  1. ARP

  2. RARP

  3. ICMP

  4. TFTP

11. 

Which TCP/IP protocol operates at the OSI Network Layer?

  1. FTP

  2. IP

  3. TCP

  4. UDP

12. 

Which statement accurately describes the difference between 802.11b WLAN ad hoc and infrastructure modes?

  1. The ad hoc mode requires an Access Point to communicate to the wired network.

  2. Wireless nodes can communicate peer-to-peer in the infrastructure mode.

  3. Wireless nodes can communicate peer-to-peer in the ad hoc mode.

  4. Access points are rarely used in 802.11b WLANs.

13. 

Which of the following is true about the difference between TCP and UDP?

  1. UDP is considered a connectionless protocol, and TCP is connection-oriented.

  2. TCP is considered a connectionless protocol, and UDP is connection oriented.

  3. UDP acknowledges the receipt of packets, and TCP does not.

  4. TCP is sometimes referred to as an unreliable protocol.

14. 

Which of the following denotes a packet-switched connectionless wide area network (WAN) technology?

  1. X.25

  2. Frame Relay

  3. SMDS

  4. ATM

15. 

Which of the following answers is true about the difference between FTP and TFTP?

  1. FTP does not have a directory-browsing capability, whereas TFTP does.

  2. FTP enables print job spooling, whereas TFTP does not.

  3. TFTP is less secure because session authentication does not occur.

  4. FTP is less secure because session authentication does not occur.

16. 

Which of the following statements is correct regarding VLANs?

  1. A VLAN restricts flooding to only those ports included in the VLAN.

  2. A VLAN is a network segmented physically, not logically.

  3. A VLAN is less secure when implemented in conjunction with private port switching.

  4. A closed VLAN configuration is the least secure VLAN configuration.

17. 

Which of the following statements about a VPN tunnel is incorrect?

  1. It can be created by implementing only IPSec devices.

  2. It can be created by installing software or hardware agents on the client or network.

  3. It can be created by implementing key and certificate exchange systems.

  4. It can be created by implementing node authentication systems.

18. 

Which of the following can create a server-spoofing attack?

  1. DNS poisoning

  2. C2MYAZZ

  3. Snort

  4. BO2K

19. 

What is a server cluster?

  1. A primary server that mirrors its data to a secondary server

  2. A group of independent servers that are managed as a single system

  3. A tape array backup implementation

  4. A group of WORM optical jukeboxes

20. 

Which of the following attack types does not exploit TCP vulnerabilities?

  1. Sequence Number attack

  2. SYN attack

  3. Ping of Death

  4. land.c attack

21. 

What is probing used for?

  1. To induce a user into taking an incorrect action

  2. To give an attacker a road map of the network

  3. To use up all of a target’s resources

  4. To covertly listen to transmissions

22. 

Which of the following firewall types uses a dynamic state table to inspect the content of packets?

  1. A packet-filtering firewall

  2. An application-level firewall

  3. A circuit-level firewall

  4. A stateful-inspection firewall

23. 

To what does logon abuse refer?

  1. Breaking into a network primarily from an external source

  2. Legitimate users accessing networked services that would normally be restricted to them

  3. Nonbusiness or personal use of the Internet

  4. Intrusions via dial-up or asynchronous external network connections

24. 

What type of firewall architecture employs two network cards and a single screening router?

  1. A screened-host firewall

  2. A dual-homed host firewall

  3. A screened-subnet firewall

  4. An application-level proxy server

25. 

To what does covert channel eavesdropping refer?

  1. Using a hidden, unauthorized network connection to communicate unauthorized information

  2. Nonbusiness or personal use of the Internet

  3. Socially engineering passwords from an ISP

  4. The use of two-factor passwords

26. 

What is one of the most common drawbacks to using a dual-homed host firewall?

  1. The examination of the packet at the Network Layer introduces latency.

  2. The examination of the packet at the Application Layer introduces latency.

  3. The ACLs must be manually maintained on the host.

  4. Internal routing may accidentally become enabled.

27. 

Which is not a property of a bridge?

  1. It forwards the data to all other segments if the destination is not on the local segment.

  2. It operates at Layer 2, the Data Link Layer.

  3. It operates at Layer 3, the Network Layer.

  4. It can create a broadcast storm.

28. 

Which IEEE protocol defines the Spanning Tree protocol?

  1. IEEE 802.5

  2. IEEE 802.3

  3. IEEE 802.11

  4. IEEE 802.1D

29. 

What does the Data Encapsulation in the OSI model do?

  1. It creates seven distinct layers.

  2. It wraps data from one layer around a data packet from an adjoining layer.

  3. It provides best-effort delivery of a data packet.

  4. It makes the network transmission deterministic.

30. 

Which of the following choices is not an element of IPSec?

  1. Authentication Header

  2. Layer Two Tunneling Protocol

  3. Security Association

  4. Encapsulating Security Payload

31. 

Which of the following network attacks would not be considered a Denial of Service attack?

  1. Ping of Death

  2. Smurf

  3. Brute Force

  4. TCP SYN

32. 

Which statement is not true about the SOCKS protocol?

  1. It is sometimes referred to as an application-level proxy.

  2. It uses an ESP for authentication and encryption.

  3. It operates in the Transport Layer of the OSI model.

  4. Network applications need to be SOCKS-ified to operate.

33. 

Which of the following choices is not a way to get Windows NT passwords?

  1. Obtain the backup SAM from the repair directory.

  2. Boot the NT server with a floppy containing an alternate operating system.

  3. Obtain root access to the /etc/passwd file.

  4. Use pwdump2 to dump the password hashes directly from the registry.

34. 

Which type of routing commonly broadcasts its routing table information to all other routers every minute?

  1. Static

  2. Distance Vector

  3. Link State

  4. Dynamic Control Protocol

35. 

A back door into a network refers to what?

  1. Socially engineering passwords from a subject

  2. Mechanisms created by hackers to gain network access at a later time

  3. Undocumented instructions used by programmers to debug applications

  4. Monitoring programs implemented on dummy applications to lure intruders

36. 

What is the protocol that supports sending and receiving e-mail?

  1. SNMP

  2. SMTP

  3. ICMP

  4. RARP

37. 

Which of the following protocols does not pertain to e-mail?

  1. SMTP

  2. POP

  3. CHAP

  4. IMAP

38. 

Which of the following does not relate to analog dial-up hacking?

  1. War dialing

  2. War walking

  3. Demon dialing

  4. ToneLoc

39. 

Which of the following is the earliest and the most commonly found Interior Gateway Protocol?

  1. RIP

  2. OSPF

  3. IGRP

  4. EAP

40. 

What is the Network Layer of the OSI reference model primarily responsible for?

  1. Internetwork packet routing

  2. LAN bridging

  3. SMTP Gateway services

  4. Signal regeneration and repeating

41. 

Which of the following is not a true statement about Network Address Translation (NAT)?

  1. NAT is used when corporations want to use private addressing ranges for internal networks.

  2. NAT is designed to mask the true IP addresses of internal systems.

  3. Private addresses can easily be routed globally.

  4. NAT translates private IP addresses to registered “real” IP addresses.

42. 

In the DoD reference model, which layer conforms to the OSI Transport Layer?

  1. Process/Application Layer

  2. Host-to-Host Layer

  3. Internet Layer

  4. Network Access Layer

43. 

The IP address 178.22.90.1 is considered to be in which class of address?

  1. Class A

  2. Class B

  3. Class C

  4. Class D

44. 

What does TFTP stand for?

  1. Trivial File Transport Protocol

  2. Transport for TCP/IP

  3. Trivial File Transfer Protocol

  4. Transport File Transfer Protocol

45. 

Which IEEE protocol offers two different protocols to address security issues with 802.11 products?

  1. IEEE 802.11e

  2. IEEE 802.11f

  3. IEEE 802.11g

  4. IEEE 802.11i

46. 

Which new wireless IEEE protocol combines multiple input, multiple output (MIMO) technology with multiple antennas to achieve raw data rates from 100 Mbps to 600 Mbps?

  1. IEEE 802.11h

  2. IEEE 802.11i

  3. IEEE 802.11n

  4. IEEE 802.16

47. 

Which of the following choices is the best description of bluejacking?

  1. A shareware program for locating WLAN SSIDs

  2. A hacker determining an AP’s broadcast SSID

  3. A Bluetooth wireless hack that exploits BT’s discover mode

  4. HTML tailored to the small screens and limited resources of a wireless handheld

48. 

Which choice is not a common ability of a keylogger?

  1. Log all Web sites visited

  2. Interact with potential hackers in such a way as to capture the details of their attacks

  3. Record all keystrokes

  4. Log every application executed

49. 

Which choice is the best description of a spambot?

  1. A program designed to collect e-mail addresses from the Internet in order to send advertising messages

  2. A pop-up window that asks users to download a program to their computer’s hard drive

  3. A program in which malicious code is contained inside apparently harmless programming

  4. A program that surreptitiously allows access to a computer’s resources via a network connection

Answers

1. 

Answer: b

A BNC refers to a Bayonet Neil Concelman RG58 connector for 10Base2. Fiber-optic cable has three basic physical elements: the core, the cladding, and the jacket. The core is the innermost transmission medium, which can be glass or plastic. The next outer layer, the cladding, is also made of glass or plastic, but it has different properties and helps to reflect the light back into the core. The outermost layer, the jacket, provides protection from heat, moisture, and other environmental elements.

2. 

Answer: b

Answer a refers to 10Base2; answer c refers to 10BaseF; and answer d refers to 100BaseT.

3. 

Answer: b

Unicast (answer a) describes a packet sent from a single source to a single destination. Answer c (broadcast) describes a packet sent to all nodes on the network segment. Answer d (anycast) refers to communication between any sender and the nearest of a group of receivers in a network.

4. 

Answer: a

The first three bytes (or first half) of the six-byte MAC address is the manufacturer’s identifier. This can be a good troubleshooting aid if a network device is acting up, because it will isolate the brand of the failing device. The other answers are distracters.

5. 

Answer: b

Coax consists of a hollow outer cylindrical conductor surrounding a single, inner wire conductor. Answer a describes UTP. Answer c is false because coax requires fixed spacing between connections, and answer d describes fiber-optic cable.

6. 

Answer: b

The other three address ranges can be used for Network Address Translation (NAT). Although NAT is, in itself, not a very effective security measure, a large network can benefit from using NAT with Dynamic Host Configuration Protocol (DHCP) to help prevent certain internal routing information from being exposed. The address 127.0.0.1 is called the loopback address.

7. 

Answer: b

The other answers are all properties of analog or digital signals.

8. 

Answer: d

The Secure Sockets Layer (SSL) sits between higher-level application functions and the TCP/IP stack and provides security to applications. It includes a variety of encryption algorithms to secure transmitted data, but the functionality must be integrated into the application. Answer a refers to the Secure/Multipurpose Internet Mail Extension (S/MIME). Most major email clients support S/MIME today. Answer b describes Secure Shell (SSH). Answer c refers to IPSec. IPSec enables security to be built directly into the TCP/IP stack, without requiring application modification.

9. 

Answer: a

IEEE 802.11a specifies high-speed wireless connectivity in the 5 GHz band using Orthogonal Frequency Division Multiplexing with data rates up to 54 Mbps. Answer b, IEEE 802.11b, specifies high-speed wireless connectivity in the 2.4 GHz ISM band up to 11 Mbps. Answer c, IEEE 802.11g, is a proposed standard that offers wireless transmission over relatively short distances at speeds from 20 Mbps up to 54 Mbps and operates in the 2.4 GHz range (and is therefore expected to be backward-compatible with existing 802.11b-based networks). Answer d, IEEE 802.15, defines Wireless Personal Area Networks (WPAN), such as Bluetooth, in the 2.4-2.5 GHz band.

10. 

Answer: a

The Address Resolution Protocol (ARP) sends a broadcast asking for the host with a specified IP address to reply with its MAC, or hardware address. This information is kept in the ARP Cache. The Reverse Address Resolution Protocol (RARP), answer b, is commonly used on diskless machines when the MAC is known but not the IP address. It asks a RARP server to provide a valid IP address, which is somewhat the reverse of ARP. The Internet Control Message Protocol (ICMP), answer c, is a management protocol for IP. The Trivial File Transfer Protocol (TFTP), answer d, is a stripped-down version of the File Transfer Protocol (FTP).

11. 

Answer: b

IP operates at the Network Layer of the OSI model and at the Internet layer of the TCP/IP model. FTP operates at the Application layer of the TCP/IP model, which is roughly similar to the top three layers of the OSI model: the Application, Presentation, and Session Layers. TCP and UDP both operate at the OSI Transport Layer, which is similar to the TCP/IP host-to-host layer.

12. 

Answer: c

Nodes on an IEEE 802.11b wireless LANs can communicate in one of two modes: ad hoc or infrastructure. In ad hoc mode, the wireless nodes communicate directly with each other, without establishing a connection to an access point on a wired LAN. In infrastructure mode, the wireless nodes communicate to an access point, which operates similarly to a bridge or router and manages traffic between the wireless network and the wired network.

13. 

Answer: a

As opposed to the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP) is a connectionless protocol. It does not sequence the packets or acknowledge the receipt of packets and is referred to as an unreliable protocol.

14. 

Answer: c

Switched Multimegabit Data Service (SMDS) is a high-speed, connectionless, packet-switching public network service that extends LAN-like performance to a metropolitan area network (MAN) or a wide area network (WAN). It’s generally delivered over a SONET ring with a maximum effective service radius of around 30 miles. X.25, answer a, defines an interface to the first commercially successful connection-oriented packet-switching network, in which the packets travel over virtual circuits. Frame Relay, answer b, was a successor to X.25 and offers a connection-oriented packet-switching network. Asynchronous Transfer Mode (ATM), answer d, was developed from an outgrowth of ISDN standards and is a fast-packet, connection-oriented, cell-switching technology.

15. 

Answer: c

The Trivial File Transfer Protocol (TFTP) is considered less secure than the File Transfer Protocol (FTP) because authentication does not occur during session establishment.

16. 

Answer: a

A virtual local area network (VLAN) allows ports on the same or different switches to be grouped so that traffic is confined to members of that group only, and it restricts broadcast, unicast, and multicast traffic. Answer b is incorrect because a VLAN is segmented logically, rather than physically. Answer c is incorrect; when a VLAN is implemented with private port, or single-user, switching, it provides fairly stringent security because broadcast vulnerabilities are minimized. Answer d is incorrect, as a closed VLAN authenticates a user to an access control list on a central authentication server, where they are assigned authorization parameters to determine their level of network access.

17. 

Answer: a

IPSec-compatible and non-IPSec compatible devices are used to create VPNs. The other three answers are all ways in which VPNs can be created.

18. 

Answer: b

C2MYAZZ is a utility that enables server spoofing to implement a session hijacking or man-in-the-middle exploit. It intercepts a client LANMAN authentication logon and obtains the session’s logon credentials and password combination transparently to the user. DNS poisoning (answer a) is also known as cache poisoning. It is the process of distributing incorrect IP address information for a specific host with the intent to divert traffic from its true destination. Snort (answer c) is a utility used for network sniffing, is the process of gathering traffic from a network by capturing the data as it passes and storing it to analyze later. Back Orifice 2000 (BO2K), answer d, is an application-level Trojan horse used to give an attacker backdoor network access.

19. 

Answer: b

A server cluster is a group of servers that appears to be a single server to the user. Answer a refers to redundant servers.

20. 

Answer: c

The Ping of Death exploits the fragmentation vulnerability of large ICMP ECHO request packets by sending an illegal packet with more than 65K of data, creating a buffer overflow. A TCP sequence number attack (answer a) exploits the nonrandom predictable pattern of TCP connection sequence numbers to spoof a session. A TCP SYN attack (answer b) is a DoS attack that exploits the TCP three-way handshake. The attacker rapidly generates randomly sourced SYN packets filling the target’s connection queue before the connection can timeout. A land.c attack (answer d) is also a DoS attack that exploits TCP SYN packets. The attacker sends a packet that gives both the source and destination as the target’s address and uses the same source and destination port.

21. 

Answer: b

Probing is a procedure whereby the intruder runs programs that scan the network to create a network map for later intrusion. Answer a is spoofing, answer c is the objective of a DoS attack, and answer d describes passive eavesdropping.

22. 

Answer: d

A stateful-inspection firewall intercepts incoming packets at the Network level and then uses an Inspection Engine to extract state-related information from upper layers. It maintains the information in a dynamic state table and evaluates subsequent connection attempts. A packet-filtering firewall (answer a) is the simplest type of firewall commonly implemented on routers. It operates at the Network layer and offers good performance but is the least secure. An application-level firewall or application-layer gateway (answer b) is more secure because it examines the packet at the Application layer but at the expense of performance. A circuit-level firewall (answer c) is similar to the application-level firewall in that it functions as a proxy server, but it differs in that special proxy application software is not needed.

23. 

Answer: b

Logon abuse entails an otherwise proper user attempting to access areas of the network that are deemed off-limits. Answer a is called network intrusion, and d refers to backdoor remote access.

24. 

Answer: a

Like a dual-homed host, a screened-host firewall uses two network cards to connect to the trusted and untrusted networks, but it adds a screening router between the host and the untrusted network. A dualhomed host (answer b) has two NICs but not necessarily a screening router. A screened-subnet firewall, (answer c) also uses two NICs but has two screening routers with the host acting as a proxy server on its own network segment. One screening router controls traffic local to the network while the second monitors and controls incoming and outgoing Internet traffic. Answer d, application-level proxy, is unrelated to this question.

25. 

Answer: a

A covert channel is a connection intentionally created to transmit unauthorized information from inside a trusted network to a partner at an outside, untrusted node. Answer c is called masquerading.

26. 

Answer: d

A dual-homed host uses two NICs to attach to two separate networks, commonly a trusted network and an untrusted network. It’s important that the internal routing function of the host be disabled to create an Application-layer chokepoint and filter packets. Many systems come with routing enabled by default, such as IP forwarding, which makes the firewall useless. The other answers are distracters.

27. 

Answer: c

A bridge operates at Layer 2 and therefore does not use IP addressing to make routing decisions.

28. 

Answer: d

The 802.1D spanning tree protocol is an Ethernet link-management protocol that provides link redundancy while preventing routing loops. Because only one active path can exist for an Ethernet network to route properly, the STP algorithm calculates and manages the best loop-free path through the network. IEEE 802.5 (answer a) specifies a token-passing ring access method for LANs. IEEE 802.3 (answer b) specifies an Ethernet bus topology using Carrier Sense Multiple Access Control/ Carrier Detect (CSMA/CD). IEEE 802.11 (answer c) is the IEEE standard that specifies 1 Mbps and 2 Mbps wireless connectivity in the 2.4 MHz ISM (Industrial, Scientific, Medical) band.

29. 

Answer: b

Data Encapsulation attaches information from one layer to the packet as it travels from an adjoining layer. The OSI-layered architecture model creates seven layers. The TCP/IP protocol UDP provides best effort packet delivery, and a token-passing transmission scheme creates a deterministic network because it is possible to compute the maximum predictable delay.

30. 

Answer: b

The Layer Two Tunneling Protocol (L2TP) is a protocol that allows a host to establish a virtual connection. Although L2TP - an enhancement to Layer Two Forwarding Protocol (L2F), which supports some features of the Point to Point Tunneling Protocol (PPTP) - may coexist with IPSec, it is not natively an IPSec component. The Authentication Header (AH), answer a, is an authenticating protocol that uses a hash signature in the packet header to validate the integrity of the packet data and the authenticity of the sender. The Security Association (SA), answer c, is a component of the IPSec architecture that contains the information the IPSec device needs to process incoming and outbound IPSec packets. IPSec devices embed a value called the Security Parameter Index (SPI) in the header to associate a datagram with its SA and to store SAs in a Security Association Database (SAD). The Encapsulating Security Payload (ESP), answer d, is an authenticating and encrypting protocol that provides integrity, source authentication, and confidentiality services.

31. 

Answer: c

A brute force attack is an attempt to use all combinations of key patterns to decipher a message. The other three attacks are commonly used to create a Denial of Service (DoS). Ping of Death (answer a) exploits ICMP by sending an illegal ECHO packet of >65K octets of data, which can cause an overflow of system variables and lead to a system crash. SMURF (answer b) is a type of attack using spoofed ICMP ECHO requests to broadcast addresses, which the routers attempt to propagate, congesting the network. Three participants are required for a SMURF attack: the attacker, the amplifying network, and the victim. A TCP SYN flood attack (answer d) generates phony TCP SYN packets from random IP addresses at a rapid rate to fill up the connection queue and stop the system from accepting legitimate users.

32. 

Answer: b

The Encapsulating Security Payload (ESP) is a component of IPSec. Socket Security (SOCKS) is a Transport-layer, secure networking proxy protocol. SOCKS replaces the standard network systems calls with its own calls. These calls open connections to a SOCKS proxy server for client authentication, transparently to the user. Common network utilities, like Telnet or FTP, need to be SOCKS-ified or have their network calls altered to recognize SOCKS proxy calls.

33. 

Answer: c

The /etc/passwd file is a Unix system file. The NT Security Accounts Manager, SAM, contains the usernames and encrypted passwords of all local (and domain, if the server is a domain controller) users. The SAM uses an older, weaker LanManager hash that can be broken easily by tools like L0phtcrack. Physical access to the NT server and the rdisks must be controlled. The “Sam._” file in the repair directory must be deleted after creation of an rdisk. Pwdump and pwdump2 are utilities that allow someone with Administrator rights to target the Local Security Authority Subsystem, isass.exe, from a remote system.

34. 

Answer: b

Distance vector routing uses the Routing Information Protocol (RIP) to maintain a dynamic table of routing information that is updated regularly. It is the oldest and most common type of dynamic routing. Static routing (answer a) defines a specific route in a configuration file on the router and does not require the routers to exchange route information dynamically. Link state routers (answer c) function like distance vector routers but use first-hand information when building routing tables only by maintaining a copy of every other router’s Link State Protocol (LSP) frame. This helps to eliminate routing errors and considerably lessens convergence time. Answer d is a distracter.

35. 

Answer: b

Back doors are very hard to trace, as an intruder will often create several avenues into a network to be exploited later. The only real way to be sure these avenues are closed after an attack is to restore the operating system from the original media, apply the patches, and restore all data and applications. Social engineering (answer a) is a technique used to manipulate users into revealing information like passwords. An undocumented hook into an application to assist programmers with debugging (answer c) is known as a trap door. It serves as a back door into an application rather than a network. Although intended innocently, these can be exploited by intruders. Answer d is a “honey pot” or “padded cell.” A honey pot uses a dummy server with bogus applications as a decoy for intruders.

36. 

Answer: b

Simple Mail Transport Protocol (SMTP) queues and transfers e-mail. SNMP stands for Simple Network Management Protocol. ICMP stands for Internet Control Message Protocol. RARP stands for Reverse Address Resolution Protocol.

37. 

Answer: c

The Challenge Handshake Authentication Protocol (CHAP) is used at the startup of a remote link to verify the identity of a remote node. The Simple Mail Transfer Protocol (RFCs 821 and 1869), answer a, is used by a server to deliver email over the Internet. The Post Office Protocol (RFC 1939), answer b, enables users to read their email by downloading it from a remote server onto their local computer. The Internet Message Access Protocol (RFC 2060), answer d, allows users to read their email on a remote server without downloading the mail locally.

38. 

Answer: b

War walking (or war driving) refers to scanning for 802.11-based wireless network information by either driving or walking with a laptop, a wireless adapter in promiscuous mode, some type of scanning software such as NetStumbler or AiroPeek, and a Global Positioning System (GPS). War dialing (answer a) is a method used to hack into computers by using a software program to automatically call a large pool of telephone numbers to search for those that have a modem attached. Demon dialing, similar to war dialing (answer c) is a tool used to attack one modem using brute force to guess the password and gain access. Tone-Loc (answer d) was one of the first war-dialing tools used by phone phreakers.

39. 

Answer: a

The Routing Information Protocol (RIP) bases its routing path on the distance (number of hops) to the destination. RIP maintains optimum routing paths by sending out routing update messages if the network topology changes. For example, if a router finds that a particular link is faulty, it will update its routing table and then send a copy of the modified table to each of its neighbors. Open Shortest Path First (OSPF), answer b, is a link-state hierarchical routing algorithm intended as a successor to RIP. It features least-cost routing, multipath routing, and load balancing. The Internet Gateway Routing Protocol (IGRP), answer c, is a Cisco protocol that uses a composite metric as its routing metric, including bandwidth, delay, reliability, loading, and maximum transmission unit. The Extensible Authentication Protocol (EAP), answer d, is a general protocol for PPP authentication that supports multiple remote authentication mechanisms.

40. 

Answer: a

Although many routers can perform most of the functions above, the OSI Network Layer is primarily responsible for routing. Bridging (answer b) is a Data Link Layer function. Gateways (answer c) most commonly function at the higher layers. Signal regeneration and repeating (Answer d) are primarily Physical Layer functions.

41. 

Answer: c

Private addresses are not easily routable.

42. 

Answer: b

In the DoD reference model, the Host-to-Host layer parallels the function of the OSI’s Transport Layer. This layer contains the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). The DoD Process/Application layer, (answer a) corresponds to the OSI’s top three layers: the Application, Presentation, and Session Layers. The DoD Internet layer (answer c) corresponds to the OSI’s Network Layer, and the DoD Network Access layer (answer d) is the equivalent of the Data Link and Physical Layers of the OSI model.

43. 

Answer: b

The class A address range is 1.0.0.0 to 126.255.255.255. The class B address range is 128.0.0.0 to 191.255.255.255. The class C address range is from 192.0.0.0 to 223.255.255.255. The class D address range is 244.0.0.0 to 239.255.255.255 and is used for multicast packets.

44. 

Answer: c

The other acronyms do not exist.

45. 

Answer: d

The 802.11i standard addresses security flaws in 802.11 products and presents an approach offering two different protocols: the TKIP protocol and the CCM protocol (CCMP).

46. 

Answer: c

802.11n is a new standard operating in the 5GHz range, combining multiple antennas, faster encoding, and an optional doubling of spectrum to achieve raw data rates from 100 Mbps up to 600 Mbps. The standard employs multiple input, multiple output (MIMO) technology to achieve this speed.

47. 

Answer: c.

Bluejacking is a Bluetooth wireless hack that exploits BT’s discover mode to drop code unnoticed on the victim’s unit.

48. 

Answer: b.

A honey pot is configured to interact with potential hackers in such a way as to capture the details of their attacks. The other answers are all common uses for a keylogger.

49. 

Answer: a

A spambot is a program designed to collect, or harvest, e-mail addresses from the Internet in order to build mailing lists for sending spam. Choice b describes a pop-up download. Choice c describes a Trojan horse, and choice d describes a remote access Trojan.
Related

Категории