Title: INTROSEC / network_security
Tags: network_sec tcp_spoofing bgp_issues dns_attack firewall tunneled_networks amplification_attacks arp_spoofing port_scanning

Q: Name the layers of the network topology. (4)
A: - Network Access Layer (Cable, WiFi, MAC, ARP)
- Network Layer (BGP, IP, etc.)
- Transport Layer (TCP, UDP, Ports, etc.)
- Application Layer (DNS, HTTP, VPN, etc.)

Q: Name threats for each layer of the Network Topology.
A: - Network Access Layer
  - Sniffing
  - ARP Spoofing
- Network Layer
  - BGP Issues
  - MITM
- Transport Layer
  - TCP Spoofing
  - SYN Flooding
  - Port Scans
- Application Layer
  - DNS Spoofing

Q: What is the Address Resolution Protocol (ARP).
A: ARP (Address Resolution Protocol) is a network protocol used to map IP addresses to MAC addresses on a local network. To find out the MAC address, a broadcast is sent out asking who has a certain IP. The device then responds by declaring its MAC address.

Q: How does ARP spoofing work?
A: ARP is not authenticated, so any device can respond to the request. If an attacker manages to convince a client and the router that the respective other device has the MAC address of the attacker, they can insert themselves in the path enabling Machine-in-the-middle (MITM) attacks. This impersonation is called ARP spoofing, however, the timing is critical as most implementations ignore unsolicited responses.

Q: How is ARP Spoofing detected?
A: If single IP seemingly is connected to multiple ports, an intelligent switch can simply detect spoofing if for a single IP, multiple MAC addresses are announced.

Q: What is an Autonomous System (AS)?
A: Autonomous systems (AS) form a sequence of network domains through which data traverses, with each AS responsible for managing a portion of the IP address range, aiming to establish the shortest path for communication between two hosts.

Q: How does the Border Gateway Protocol (BRP) work?
A: - every as has a BGP routing table
- internal (iBGP) for routing within AS
- external (eBGP) routes between ASes

Q: Explain BGP Hijacking
A: BGP hijacking is the malicious takeover of IP address prefixes by announcing false routing information, diverting traffic intended for those prefixes to an unauthorized destination.

Q: Name defenses against BGP Hijacking.
A: - Route filtering
  - Route advertisements are checked against access control lists
  - Policies specify that traffic meant for certain IP addresses must be routed via X.
- S-BGP (Secure BGP)
  - -Adds authentication and authorization capabilities
- Route Origin Authorization (ROA)

Q: Explain BGP with Route Origin Authorization (ROA)
A: - Idea: use PKI to authorize some AS to announce a prefix
- High-level content of a ROA:
  - AS number: number of the originating AS
  - IP prefix to be announced
  - Single-BIt identifier to allow for more specific prefixes
  - Signature with known key
- Whenever a BGP announcement is received (from origin AS), it is checked against known ROAs for this AS, which protects against fake origin announcements

Q: Explain TCP.
A: TCP works on the transport layer. It uses a three-way handshake to make sure, that the states of the sender and reciever are syncrhonized.

Q: What happens if data is lost while using TCP?
A: Lost segments are retransmitted.

Q: How does the TCP handshake work?
A: 1. initiator: SYN
2. host: SYN-ACK
3. initiator: ACK

Q: What is SYN-Flooding?
A: Attacker sends a large amount of SYN packets, so that the other end won't be able to manage all connections, missing legitimate ones (host has open connections and waits for ACK from initiator).

Q: Name a defense against SYN Flooding
A: SYN Cookies - use TCP sequence number to save state, verify cookie when ACK (with a cookie) is received, then establish the connection. Thus we can not have half open connections.

Q: What is TCP Injection / Hijacking?
A: If an attacker can predict the sequence number, packets can be injected because there is no authentication. E.g. a FIN can close the connection.

Q: Explain the User Datagram Protocol (UDP).
A: UDP uses a query-response pattern, where the response just swaps source/destination IPs and ports. Also, it is simple and stateless, such that packages have a low-overhead transmission of data. It has no identity validation (IP spoofing possible), and has no acknowledgement mechanism and thus unreliable data transmission. Notably, the loss of data should be tolerable (e.g., streaming, VoIP, …)

Q: How does the Domain Name System (DNS) work?
A: The Domain Name System (DNS) is resolving domains to IP addresses. Queries work iteratively, asking the root-servers first, then following the delegations until an authoritative answer is obtained, or recursively, asking the DNS servers to forward the query.
DNS responses can contain various records for IPv4 (A), IPv6 (AAAA), mail servers (MX), etc.

Q: Explain the domain levels. (4)
A: - . : root domain, administrates top-level domains (TLD)
  - knows delegate for at
- .at : TLD, administrates second-level domains (SLD)
  - knows delegate for ac.at
- .ac.at : SLD or eTLD+1, administrates third-level domains
  - knows deletgate for tuwien.ac.at
- tuwien.ac.at : fully-qualified domain name

Q: Explain the DNS Resolver types.
A: - Stub Resolver
  - DNS client
- Recursive Resolver
  - serve DNS clients (stub resolvers)
  - resolve any domain
  - iteratively query authoritative NSes
  - restricted to authorized users
- Authoritative Resolver
  - Serve recursive resolvers
  - resolve domains in their zone only
  - deny all recursive domain resolution
  - cannot restrict user base

Q: What is DNS Cache Poisoning?
A: Attack goal: inject attacker-specified Resolvers to cache.
Once the cache is poisoned, attacker can control the traffic to the domains of all clients using that resolver.
examples:
- Redirect clients to malicious (e.g., phishing) web sites
- Redirect mails to mail server under attacker control
- Disable domains entirely (censorship!)

Q: Name defenses for DNS.
A: - DNS Security Extensions (DNSSEC)
- DNS over TLS (DoT) / DNS over HTTPS (DoH)

Q: Explain SMURF.
A: SMURF is a type of DDoS attack where an attacker sends pings to an IP address, with the source IP address spoofed to be the victim's, causing multiple hosts to reply to the victim, overwhelming its network.

Q: Explain NTP Reflection.
A: NTP Refledtion is a DDoS attack exploiting the Network Time Protocol (NTP) by sending requests with the victim's IP address as the source to NTP servers, which then reply to the victim, amplifying the attack traffic.

Q: Explain DNS Amplification.
A: A DDoS attack leveraging misconfigured DNS servers to send a large volume of DNS response traffic to the victim, exploiting the DNS protocol's amplification characteristics.

Q: What are Ports?
A: Ports are numerical identifiers used by network protocols to distinguish between different types of traffic on a single network interface, allowing multiple services to run concurrently on a single device. This enables process-to-process insteaad of the undesired host-to-host communication.
A port number is a 16-bit unsigned integer (\(0-65535\))

Q: How does port scanning work?
A: We want to check which Ports are open at a specific host, thus we try to establish a TCP connection
to each Port number and see if we succeed.

Q: What is a firewall?
A: A firewall protects an organization (inside) from the Internet (outside.
All traffic between inside and outside needs to be checked by the firewall.
Only authorized traffic, as defined by policies, may pass.
Assumption : firewall cannot be compromised

Q: What are Package Filter Firewalls?
A: Package Filter Firewalls are rules/policies regarding packet headers:
- Source and destination IP
- IP protocol field (e.g., ICMP/TCP/UDP)
- Source and destination transport-level address (TCP/UDP ports)
Example IPTables Rule: (“Block incoming connections from this IP”)
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

Q: What are the advantages and disadvantages when using Package Filter Firewalls?
A: + Simple and fast
- Stateless decisions per packet & fail to identify "related" traffic

Q: Explain Stateful Inspection Firewalls.
A: - Specify rules based on packets and/or connections
- Maintain directory of connections/streams (connection tracking)
- Three connection states
  - NEW: packets starts new TCP/UDP connection/stream
  - ESTABLISHED: packet is associated with an existing connection
  - RELATED: starts new connection associated with an existing connection.
Example IPTables Rule: (“allow all incoming HTTP traffic to port 80”)
iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

Q: What are Demilitarized Zones, and what are they used for?
A: A demilitarized zone (DMZ) is a network segment that acts as a buffer zone between an organization's internal network and the internet, hosting public-facing services while providing an additional layer of security.
They ensure, that
- Web server must be reachable from the outside
- Clients must not be reachable from the outside
- Compromised Web server must not lead to access to clients

Q: Explain Virtual Private Network (VPN).
A: A Virtual Private Network (VPN) creates a encrypted tunnel between a device and a network, such that the device can access network resources even via insecure connections (public WiFis, Internet, etc.) though the secure tunnel.

Q: What does the VPN security model provide?
A: - Confidentiality: If the network traffic is sniffed at the packet level, attackers only see encrypted traffic.
- Sender Authentication: Only authorized users can access the VPN.
- Message Integrity: The VPN detects and reject any instances of tampering with transmitted messages.

Q: Explain the Onion Network.
A: The Onion Router Network directs Internet traffic via a worldwide volunteer overlay network, enabling anonymous communication.
To send a package in the Tor network, a random path of at least three relays is generated, and the message is encrypted sequentially with the public keys of each relay in the path. This way, each relay only knows the identity of the previous relay and the next hop in the path: the entry node knows the sender and one random node, while the exit node only knows one random node and the final destination.

Q: When is combining TOR & VPN meaningful?
A: When the access to the TOR network is blocked. Alternatively, you can also use TOR bridges.