CHAPTER ONE
INTRODUCTION
1.1 Introduction
Security on the Internet and on Local Area Networks is now at the forefront of computer network related issues. The evolution of networking and the Internet, the threats to information and networks have risen dramatically. Many of these threats have become cleverly exercised attacks causing damage or committing theft. The Internet continues to grow exponentially. As personal, government and business-critical applications become more prevalent on the Internet, there are many immediate benefits. However, these network-based applications and services can pose security risks to individuals as well as to the information resources of companies and government. In many cases, the rush to get connected comes at the expense of adequate network security. Information is an asset that must be protected. Without adequate protection or network security, many individuals, businesses, and governments are at risk of losing that asset. Network security is the process by which digital information assets are protected, the goals of security are to protect confidentiality, maintain integrity, and assure availability. With this in mind, it is imperative that all networks be protected from threats and vulnerabilities in order fora business to achieve its fullest potential. Typically, these threats are persistent due to vulnerabilities, which can arise from mis-configured hardware or software, poor network design, inherent technology weaknesses, or end-user carelessness. A router is similar to many computers in that it has many services enabled by default. Many of these services are unnecessary and may be used by an attacker for information gathering or for exploitation. All unnecessary services should be disabled in the router configuration to prevent the attacker from using it to damage the network or to stealing the important information, or network devices configuration. In this project a review of attacks on routers, and how can prevent, or mitigating it will be described. Routers and firewall are very critical parts of network operations and network security. Careful management and diligent audit of router and firewall operations, can reduce network downtime, improve security, prevent the attacks and hackers, network threats decrease, and aid in the analysis of suspected security breaches.
1.2Background of the Study
Security has one purpose, to protect assets. With the advent of personal computers, LANs, and the wide-open world of the Internet, the networks of today are more open. As e-business and Internet applications continue to grow, finding the balance between being isolated and being open will be critical. With the increased number of LANs and personal computers, the Internet began to create untold numbers of security risks. Firewall devices, which are software or hardware that enforce an access control policy between two or more networks, were introduced. This technology gave businesses a balance between security and simple outbound access to the Internet, which was mostly used, for e-mail and Web surfing. Network security is the most vital component in information security because it is responsible for securing all information passed through networked computers. Network security refers to all hardware and software functions, characteristics, features, operational procedures, accountability measures, access controls, administrative and management policy required to provide an acceptable level of protection for hardware, software, and information in a network. Network security, in order for it to be successful in preventing information loss, must follow three fundamental precepts. First, a secure network must have integritysuch that all of the information stored therein is always correct and protected against fortuitous data corruption as well as willful alterations. Next, to secure a network there must be confidentiality, or the ability to share information on the network with only those people for whom the viewing is intended. Finally, network security requires availabilityof information to its necessary recipients at the predetermined times without exception. The three principles that network security must adhere to evolved from years of practice and experimentation that make up network history.
Real-world security includes prevention, detection, and response. If the prevention mechanisms were perfect, you wouldn’t need detection and response. But no prevention mechanism is perfect. Without detection and response, the prevention mechanisms only have limited value. Detection and response are not only more cost effective but also more effective than piling on more prevention. On the Internet, this translates to monitoring. In Network Protection,there are fortunately many preventative techniques to properly secure network against threats. The first method of protection is to address the actual physical layer of the network to assure that it is properly equipped. Next, three network administrative guidelines should be adhered to.Additionally, firewalls and encryption should be incorporated into a network to heighten its security.
Finally, several other passwords, variations of capital and small letters further increase the strength of a password. Proper authentication is an integral part of the administrative step in securing a network. Firewalls are yet another measure used in increasing the level of security in a network. A firewall is in essence a portal through which information enters and exits.
On one side of the portal is the internal network that must remain secure, and on the other is the information needed from the outside world combined with the undesirable threats of external networks. Three of the major types of firewalls, listed in order of increasing quality and price, are packet-filtering routers,
application-level gateways, and circuit-level gateways. Although it is not the best available firewall, a positive step in increasing network security is the use of packet-filtering routers. A packet filtering router allows the network to determine which connections can pass through the router into the local area network and which connections will be denied. The application-level gateway is designed specifically as a firewall that authenticates the user for individual applications. Its primary function is to identify and validate the user and then provide access to specific applications such as E-Mail or file browsers depending on which one the user is requesting. Finally, a circuit-level gateway performs all of the packet-filtering that a router does and a bit more. The primary enhancement is the use ofidentification and authentication before an insider can access your in-house network.
Emerging applications like electronic commerce and secure communications over open networks have made clear the fundamental role of public key cryptography as unique security solutions. On the other hand, these solutions clearly expose the fact that the protection of private keys is a security bottleneck in these sensitive applications. This problem is further worsened in the cases where a single and unchanged private key must be kept secret for very long time (such is the case of certification authority keys, and e-cash keys).
When classified information is sent electronically from one individual to another, some form of encryption must be used to protect the information from prying eyes. Because internet technology relies on the transmission of data through the public domain, this encryption is absolutely essential to preserving the security of electronically-transmitted information. Public key encryption, which was first developed in the 1970s, has gradually come to dominate the “cryptology market” because of its innate advantages over private-key methods of encrypting data; unlike its counterpart, public key encryption does not require that individuals share a secret key.
Although public key encryption algorithms such as RSA (Rivest et al, 1977) have achieved universal acceptance in the modern cryptology arena, they remain vulnerable to many potential security threats. For example, because public key encryption involves the “receiver” providing a public key to any “senders” who wish to send him confidential information (the receiver uses a different, private key to decrypt the data), it is entirely possible for a devious individual to send an encrypted message to the receiver that appears to have been sent from someone else; after all, the public key used to encrypt this message is fully available to everyone. In other words, when constructed improperly, public encryption systems such as RSA do not intrinsically protect against false sender identification.
1.3Statement of the Problem
The Network-Based security problem includes lots of buggy and insecure applications. Attackers can infect your system with malware and steal credentials like credit card details, passwords etc. Example of this is a malware called SilentBanker. It appends itself to your computer and stays silent. Now anytime your computer makes a web request to port 80 or 443 it monitors the request. Though port 443 is encrypted using SSL it doesn’t bother the malware. The malware injects malicious javascript to the target page to change it so whenever you type your password for authentication the password would get sent to the attacker. This malware was used to steal a lot of passwords from UK banks.
An attacker can steal your IP address and use it to send spam messages. An attacker does this to protect himself and shift the blame to the person whose computer he uses to send the spam messages. There are organizations that provide Denial of Service as a service. That is they can attack a web page or web server for a fee you pay. They do this by bombarding either a web server or web page with a lot of requests than it can process.
Nowadays, we see the spread of war from physical space to the cyber space. An example of this is the Stuxnet virus (2008) which the NSA and Israeli Intelligence agencies used in shutting down Iran’s nuclear power plant. What the attackers did was that they use four zero day windows exploit to infect the computer of the administrator that maintains the nuclear facility. This exploits just sits on your windows computer and only functions if you have the Siemens PCS 7 SCADA control software on your windows computer. It will wait for your to connect the Siemens controller to the network then it will affect the network. This malware in the target computers serves as logic bombs. They used this to attack the nuclear plant thereby shutting down a billion dollar project with just a malware.
Snowden (2013), an NSA whistleblower released a top secret espionage carried out by US and British Intelligence agencies in which they intercept over 80% of web traffics from sites like Facebook, Google, Twitter etc. and store this information to be used for various activities. These revelations together with the ones from whistleblowing site WikiLeaks made aware of the insecurity of the web which we depend so greatly for our daily activities.
More recently, we were made aware that some Nigerian governors use the exploits of the malware firm Hacking Team. Hacking Team is a legal malware company that creates exploit used to attack varieties of devices ranging from web servers, computers and anything you can think of. This exposes the fact that in Nigeria today there are people who poses this weaponized- cyber tools that can be used to access virtually almost all devices and steal information, plant information for the purpose of implicating the target.
Noting these problems we face in this modern era, we turn to cryptography. Cryptography is used to encrypt data so it can only be read by the person who has the secret key. So, even though an attacker breaks into our system he cannot decode our information.
1.4 Research Question
The proliferation of Wi-Fi routers makes the researchers confident that a dense enough ad hoc networks could be created, but they noted that a lack of unsecured routers would require municipalities to work with citizens to allow for the devices to be easily switched into emergency mode. The big question is whether enough citizens would really allow such access, even if security was assured.
1.5 Purpose of Study
Many network security attack/threats today are spread over the Internet. The most common include:
Viruses, worms, and Trojan horses
Spyware and adware
Zero-day attacks, also called zero-hour attacks
Hacker attacks
Denial of service attacks
Data interception and theft
Identity theft etc
Several business activities are faced with disruption, which helps keep employees less productive. This is where Network Based security information system comes into play. Because network based security helps protect your customers' data, it reduces the risk of legal action from data theft.
over the years versions of RSA implemented in WEP, HTTP etc has been broken. This project analysis the security of RSA in WEB, HTTP etc and also covers attacks on RSA, and at the end designing and implement a version of RSA that is intrusion tolerant.
1.7 Scope of Study
This project covers ITTC (Boneh et al, 1999), an intrusion tolerant application that uses RSA for encryption. ITTC is a projects that protects the private keys of web servers and certificate authorities by splitting server into smaller share servers so that even if the attacker penetrates a few of the servers he cannot compromise the whole system. Also, I discussed about SITAR (Sargor et al, 2001) a DARPA-funded research project that investigates the intrusion tolerance in distributed system to provide reliable services. I showed some attacks on RSA like the binding attack, common modulus attack etc. and I also analyzed security problems of some versions of RSA like the PKCS1 etc. I also showed how to design and implemented RSA correctly
