(Still) Exploiting TCP Timestamps
|
|
|
- Elaine Amberly Benson
- 5 years ago
- Views:
Transcription
1 (Still) Exploiting TCP Timestamps Veit N. Hailperin 1 1 scip AG Hack in Paris, June 2015 Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
2 About Me Security Consultant & scip Bug in the matrix Disclaimer I will use IP on the slides synonym to IP address for space reasons. Timestamps allows refer to TCP timestamps if not otherwise noted. Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
3 Outline 1 What are TCP Timestamps? 2 A History of Exploitation and Failed Remediation 3 More Fun with TCP Timestamps 4 What Now? Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
4 TCP Timestamps Introduced in 1992 Described in RFC1323 Extension to provide PAWS and improved RTTM A constant, strictly monotonous increasing number Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
5 A TCP Timestamp Kind: 8 Length: 10 bytes Kind=8 10 TS Value (TSval) TS Echo Reply (TSecr) Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
6 Attack Vector - Timestamp Uptime Calculation Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
7 Attack Vector - Timestamp 2001: Uptime Calculation Timestamp!= Uptime Multiple timestamps frequency of host timestamp & frequency uptime Uptime related to patch level Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
8 Attack Vector - Timestamp 2001: Uptime Calculation - Remediation Disable timestamps (bad idea) Randomize timestamps at boot (problems: lack of entropy, determination of initial value easy) Start each new TCP Connection with 0 (problem: still PAWS) Timestamp per IP/port pair (problem: only a question of time) More problems: Might break syn flood protection under linux Timestamp counter for each IP Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
9 Attack Vector - Timestamp 2015: Uptime Calculation Still possible 1... Also: timestamps observed over a longer period also lets us know their habits, e.g. when shutting down, when booting,... 1 It s a tiny bit more tricky for a small group of systems Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
10 Attack Vector - Timestamp Host Identification Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
11 Attack Vector - Timestamp 2005: Host Identification = Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
12 Attack Vector - Timestamp 2005: Host Identification - Remediation Randomizing/Zeroing timestamps (loss of functionality) Use a different counter for each connection and initialize with 0 (problem: PAWS) Like above but with randomized start (problem: PAWS) Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
13 Attack Vector - Timestamp 2015: Host Identification Still possible It s a tiny bit more tricky for a small group of systems Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
14 Attack Vector - Clock Skew Let s assume we did fix the aforementioned issues, are we done? no :( (Mainly) due to physical properties (heat, fabrication,... ) clock isn t exact This slight imperfection of clock can be used as identifier (clock skew) Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
15 Attack Vector - Clock Skew Host Identification Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
16 Attack Vector - Clock Skew 2005: Host Identification Possible even if host/port tuple TCP timestamp solution got implemented Multiple IPs virtually hosted not possible with timestamp (because TS per OS) With clock skew not a problem, because they share hardware Interesting to track users Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
17 Attack Vector - Clock Skew 2005: Host Identification - Remediation Reduce device s clock skew (difficult!) Mask clock skew by multiplying timestamp with random value (breaks RFC) mod skewmask: Mask clock skew with constant Encrypt timestamps (breaks RFC) Table mapping between random 32-bit values and internal representation of real timestamps (breaks RFC) Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
18 Attack Vector - Clock Skew 2015: Host Identification Still possible Some honeypots try to avoid it Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
19 Attack Vector - Clock Skew Network Layout Information Gathering Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
20 Attack Vector - Clock Skew 2005: Network Layout Information Gathering Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
21 Attack Vector - Clock Skew 2005: Network Layout Information Gathering - Remediation Same as for host identification Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
22 Attack Vector - Clock Skew 2015: Network Layout Information Gathering Still possible... Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
23 Attack Vector - Clock Skew Reveal Hidden Services Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
24 Attack Vector - Clock Skew 2006: Reveal Hidden Services Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
25 Attack Vector - Clock Skew 2006: Reveal Hidden Services - Remediation Dummy Traffic Fixed QoS for all connections No anonymous stream affects another (problem: potential DoS if connections idle) Oven Controlled Crystal Oscillators (OCXO) Always run at maximum CPU load Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
26 Attack Vector - Clock Skew 2015: Reveal Hidden Services Still possible... Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
27 Possible Targets Users Servers Conclusion More or less everyone/everything is affected Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
28 More Fun with TCP Timestamps Reveal Active-Active Loadbalancing Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
29 More Fun with TCP Timestamps 2015 Load-Balanced Check! Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
30 More Fun with TCP Timestamps 2015 Load-Balanced Check! Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
31 More Fun with TCP Timestamps 2007/ Network Layout Information Gathering Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
32 More Fun with TCP Timestamps 2015: Network Layout Information Gathering DEMO Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
33 More Fun with TCP Timestamps 2015: Network Layout Information Gathering Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
34 More Fun with TCP Timestamps 2015: Network Layout Information Gathering Count IPs behind a NAT (if you are the receiving end of connections) (2007) Identify hosts behind a NAT (if you have multiple ports open) (2015) TCP timestamp is the same services on same host TCP timestamp is different services on different hosts Some ports answer with no timestamp Can t tell Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
35 More Fun with TCP Timestamps 2015: Network Layout Information Gathering No tool that exploits this knowledge Does someone want to write a Nmap script? Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
36 More Fun with TCP Timestamps 2007/2015: Network Layout Information Gathering - Remediation Increment randomly (defeats RTTM) Rewrite timestamp on NAT device Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
37 More Fun with TCP Timestamps Improve OS Fingerprints of NAT-ed Devices Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
38 More Fun with TCP Timestamps 2015 Improve OS Fingerprints Repeat: What is a OS Fingerprint? Nmap doesn t assume aforementioned scenario, but direct fingerprinting Use knowledge which ports belong together Don t use closed ports Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
39 More Fun with TCP Timestamps 2015 Improve Fingerprints! DEMO Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
40 Proposed Solutions Terminate TCP connection at firewall Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
41 Why Haven t We Fixed This? Quote: Kohno et al. [... ] it is possible to extract security-relevant signals from data canonically considered to be noise. There are other ways to gather the same intel -excuse Not considered important Not many good solutions so far Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
42 More Timestamps ICMP Timestamp (CVE ) TLS Timestamp (Tor Bug #7277) HTTP Timestamp (Murdoch, 2013)... Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
43 Summary of (presented) Attacks TCP Timestamps Uptime Calculation Host Identification Network Layout Information Gathering Reveal Active-Active Loadbalancing Improve OS Fingerprints of NAT-ed Devices Clock Skew Host Identification / User Tracking Network Layout Information Gathering Reveal Hidden Services Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
44 What Now? Good solutions/suggestions welcome! Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
45 For Further Reading B. Ransford and E. Rosensweig. SkewMask: Frustrating ClockSkew Fingerprinting Attempts. December, 2007 T. Kohno, A. Broid and K. Claffy. Remote physical device fingerprinting IEEE Transactions on Dependable and Secure Computing, vol. 2, no. 2, pp , May S. Sharma, A. Hussain and H. Saran. Experience with heterogenous clock-skew based device fingerprinting Proceeding LASER 12 Proceedings of the 2012 Workshop on Learning from Authoritative Security Experiment Results, Pages B. McDanel. TCP Timestamping - Obtaining System Uptime Remotely March 14, 2001 Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
46 For Further Reading 2 V. Jacobson, R. Braden and D. Borman. TCP Extensions for High Performance. Network Working Group, Request for Comments: 1323, May 1992 S. Bellovin. Defending Against Sequence Number Attacks. Network Working Group, Request for Comments: 1948, May 1996 M. Silbersack. Improving TCP/IP security through randomization without sacrificing interoperability. University of Wisconsin Milwaukee, 2005 S. Murdoch. Hot or not: revealing hidden services by their clock skew. Proceeding CCS 06 Proceedings of the 13th ACM conference on Computer and communications security, Pages Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
47 So Long and Thanks For All The Fish Thanks to people who inspired or helped: Krzysztof Kotowicz, Stefan Friedli, Max Hailperin Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP / 47
Improving TCP/IP Security Through Randomization Without Sacrificing Interoperability. Michael J. Silbersack. November 26th, 2005
Improving TCP/IP Security Through Randomization Without Sacrificing Interoperability Michael J. Silbersack November 26th, 2005 http://www.silby.com/eurobsdcon05/ What does that title mean? TCP was not
CIT 480: Securing Computer Systems
CIT 480: Securing Computer Systems Scanning CIT 480: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting CIT 480: Securing Computer
Covert channels in TCP/IP: attack and defence
Covert channels in TCP/IP: attack and defence The creation and detection of TCP/IP steganography for covert channels and device fingerprinting Steven J. Murdoch and Stephen Lewis http://www.cl.cam.ac.uk/users/{sjm217,
Application Presence Fingerprinting for NAT-Aware Router
Application Presence Fingerprinting for NAT-Aware Router Jun Bi, Lei Zhao, and Miao Zhang Network Research Center, Tsinghua University Beijing, P.R. China, 100084 junbi@cernet.edu.cn Abstract. NAT-aware
System-Level Failures in Security
System-Level Failures in Security Non linear offset component (ms) 0.0 0.5 1.0 1.5 2.0 Variable skew De noised Non linear offset Temperature 26.4 26.3 26.2 26.1 26.0 25.9 25.8 Temperature ( C) Fri 11:00
INF5290 Ethical Hacking. Lecture 3: Network reconnaissance, port scanning. Universitetet i Oslo Laszlo Erdödi
INF5290 Ethical Hacking Lecture 3: Network reconnaissance, port scanning Universitetet i Oslo Laszlo Erdödi Lecture Overview Identifying hosts in a network Identifying services on a host What are the typical
inside: THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN
THE MAGAZINE OF USENIX & SAGE April 2002 Volume 27 Number 2 inside: SECURITY A Remote Active OS Fingerprinting Tool Using ICMP BY OFIR ARKIN & The Advanced Computing Systems Association & The System Administrators
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
What this talk is about?
On the Current State of Remote Active OS Fingerprinting Tools Ofir Arkin CTO ofir.arkin@insightix.com Defcon 13 1 What this talk is about? This talk examines different aspects of remote active operating
Scanning. Course Learning Outcomes for Unit III. Reading Assignment. Unit Lesson UNIT III STUDY GUIDE
UNIT III STUDY GUIDE Course Learning Outcomes for Unit III Upon completion of this unit, students should be able to: 1. Recall the terms port scanning, network scanning, and vulnerability scanning. 2.
TCP TCP/IP: TCP. TCP segment. TCP segment. TCP encapsulation. TCP encapsulation 1/25/2012. Network Security Lecture 6
TCP TCP/IP: TCP Network Security Lecture 6 Based on IP Provides connection-oriented, reliable stream delivery service (handles loss, duplication, transmission errors, reordering) Provides port abstraction
On Reliability of Clock-Skew-Based Remote Computer Identification
On Reliability of Clock-Skew-Based Remote Computer Identification Libor Polčák 1 and Barbora Franková 1 1 Faculty of Information Technology, Brno University of Technology, Božetěchova 2, 612 66 Brno, Czech
Pwn ing you(r) cyber offenders
Pwn ing you(r) cyber offenders Presented by: Piotr Duszynski @drk1wi ;WHOAMI;#? Senior Security Consultant @Trustwave OSCP, OSCE, CEH In security field for the past 6 years, hacking since 9 Enjoys security
ECE 435 Network Engineering Lecture 10
ECE 435 Network Engineering Lecture 10 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 28 September 2017 Announcements HW#4 was due HW#5 will be posted. midterm/fall break You
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning Last revised 10-4-17 KonBoot Get into any account without the password Works on Windows and Linux No longer free Link Ch 5r From the
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning
Hands-On Ethical Hacking and Network Defense Chapter 5 Port Scanning Last revised 1-11-17 KonBoot Get into any account without the password Works on Windows and Linux No longer free Link Ch 5r From the
Handbook. Step by step practical hacking training
HACKING SCHOOL Handbook Step by step practical hacking training Title: Hacking School - Handbook First English Edition, 2010. ISBN: 978-83-923745-3-4 Copyright 2010 by CSH Press. All rights reserved. The
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du. TCP Attacks. Chester Rebeiro IIT Madras
Some of the slides borrowed from the book Computer Security: A Hands on Approach by Wenliang Du TCP Attacks Chester Rebeiro IIT Madras A Typical TCP Client 2 A Typical TCP Server create a IPV4 stream socket
Security Enhancement by Detecting Network Address Translation Based on Instant Messaging
Security Enhancement by Detecting Network Address Translation Based on Instant Messaging Jun Bi, Miao Zhang, and Lei Zhao Network Research Center Tsinghua University Beijing, P.R.China, 100084 junbi@tsinghua.edu.cn
Computer Security and Privacy
CSE P 590 / CSE M 590 (Spring 2010) Computer Security and Privacy Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
A Robust Classifier for Passive TCP/IP Fingerprinting
A Robust Classifier for Passive TCP/IP Fingerprinting Rob Beverly MIT CSAIL rbeverly@csail.mit.edu April 20, 2004 PAM 2004 Typeset by FoilTEX Outline A Robust Classifier for Passive TCP/IP Fingerprinting
Firewall Identification: Banner Grabbing
Honey POt Firewall Identification: Banner Grabbing Banners are messages sent out by network services during the connection to the service. Banners announce which service is running on the system. Banner
ELEC5616 COMPUTER & NETWORK SECURITY
ELEC5616 COMPUTER & NETWORK SECURITY Lecture 17: Network Protocols I IP The Internet Protocol (IP) is a stateless protocol that is used to send packets from one machine to another using 32- bit addresses
CSC 574 Computer and Network Security. TCP/IP Security
CSC 574 Computer and Network Security TCP/IP Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) Network Stack, yet again Application Transport Network
Timing Attacks Made Practical
Timing Attacks Made Practical Timothy D. Morgan Blindspot Security Jason W. Morgan Ohio State Timothy D. Morgan Founder & Chief Pwner Blindspot Security Jason W. Morgan, Ph.D. Post-Doctoral Researcher
Configuring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
Change Management: DYNAMIC NETWORK MAPPING. LinuxWorld San Francisco Security Track. Presented by Joshua D. Abraham.
Change Management: DYNAMIC NETWORK MAPPING LinuxWorld San Francisco Security Track Presented by Joshua D. Abraham August 16th 2006 jabra@ccs.neu.edu Northeastern University Agenda How do we scan? What
EEC-682/782 Computer Networks I
EEC-682/782 Computer Networks I Lecture 16 Wenbing Zhao w.zhao1@csuohio.edu http://academic.csuohio.edu/zhao_w/teaching/eec682.htm (Lecture nodes are based on materials supplied by Dr. Louise Moser at
Clock-Skew-Based Computer Identification: Traps and Pitfalls
Journal of Universal Computer Science, vol. 21, no. 9 (2015), 1210-1233 submitted: 23/9/14, accepted: 18/8/15, appeared: 1/9/15 J.UCS Clock-Skew-Based Computer Identification: Traps and Pitfalls Libor
Building an IPS solution for inline usage during Red Teaming
Building an IPS solution for inline usage during Red Teaming Repurposing defensive technologies for offensive Red Team operations K. Mladenov A. Zismer {kmladenov,azismer}@os3.nl Master Students in System
Network Forensics Prefix Hijacking Theory Prefix Hijacking Forensics Concluding Remarks. Network Forensics:
Network Forensics: Network OS Fingerprinting Prefix Hijacking Analysis Scott Hand September 30 th, 2011 Outline 1 Network Forensics Introduction OS Fingerprinting 2 Prefix Hijacking Theory BGP Background
A Software Tool for Network Intrusion Detection
A Software Tool for Network Intrusion Detection 4th Biennial Conference Presented by: Christiaan van der Walt Date:October 2012 Presentation Outline Need for intrusion detection systems Overview of attacks
Introduction to Network. Topics
Introduction to Network Security Chapter 7 Transport Layer Protocols 1 TCP Layer Topics Responsible for reliable end-to-end transfer of application data. TCP vulnerabilities UDP UDP vulnerabilities DNS
A Rate-Limiting System to Mitigate Denial of Service Attacks
Emmanuel Guiton TKK:n Tietoverkkolaboratorio Instructor: L.Sc. Jarmo Mölsä Supervisor: Prof. Jorma Jormakka A Rate-Limiting System to Mitigate Denial of Service Attacks Contents Overall information Intents
A quick theorical introduction to network scanning. 23rd November 2005
A quick theorical introduction to network ASBL CSRRT-LU (Computer Security Research and Response Team Luxembourg) http://www.csrrt.org/ 23rd November 2005 IP protocol ACK Network is not exact science When
Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2009 Lecture 8 Announcements Plan for Today: Networks: TCP Firewalls Midterm 1: One week from Today! 2/17/2009 In class, short answer, multiple choice,
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
n Given a scenario, analyze and interpret output from n A SPAN has the ability to copy network traffic passing n Capacity planning for traffic
Chapter Objectives n Understand how to use appropriate software tools to assess the security posture of an organization Chapter #7: Technologies and Tools n Given a scenario, analyze and interpret output
Pwn ing you(r) cyber offenders
Pwn ing you(r) cyber offenders Presented by: Piotr Duszynski @drk1wi ;WHOAMI;#? Senior Security Consultant @Trustwave (OSCE, OSCP, ) In security field for the past 6 years, hacking since 9 Enjoys security
Practical security scanning for busy network administrators. Jim Davis D7: Data Science Institute
Practical security scanning for busy network administrators Jim Davis D7: Data Science Institute jjdavis@email.arizona.edu Security scanning tries to find problems before bad actors do A network security
Information Network 1 TCP 1/2. Youki Kadobayashi NAIST
Information Network 1 TCP 1/2 Youki Kadobayashi NAIST 1 Transport layer: a birds-eye view Hosts maintain state for each transport-layer endpoint Routers don t maintain per-host state H R R R R H Transport
Network Forensics and Covert Channels Analysis in Internet Protocols
School of Computer Science North Haugh KY16 9SX Scotland, UK Network Forensics and Covert Channels Analysis in Internet Protocols #1 Covert Channels in Internet Protocols PhD Student Email david@dcs.st-andrews.ac.uk
SinFP3. More Than a Complete Framework for Operating System Fingerprinting v1.0. Patrice
SinFP3 More Than a Complete Framework for Operating System Fingerprinting v1.0 Patrice Auffret @PatriceAuffret @networecon `whoami` Patrice Auffret 10+ years of InfoSec experience www.gomor.org
Outline. What is TCP protocol? How the TCP Protocol Works SYN Flooding Attack TCP Reset Attack TCP Session Hijacking Attack
Attacks on TCP Outline What is TCP protocol? How the TCP Protocol Works SYN Flooding Attack TCP Reset Attack TCP Session Hijacking Attack TCP Protocol Transmission Control Protocol (TCP) is a core protocol
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
Category: Informational May 1996
Network Working Group S. Bellovin Request for Comments: 1948 AT&T Research Category: Informational May 1996 Status of This Memo Defending Against Sequence Number Attacks This memo provides information
Host Identity Sources
The following topics provide information on host identity sources: Overview: Host Data Collection, on page 1 Determining Which Host Operating Systems the System Can Detect, on page 2 Identifying Host Operating
Version 2.6. Product Overview
Version 2.6 IP Traffic Generator & QoS Measurement Tool for IP Networks (IPv4 & IPv6) -------------------------------------------------- FTTx, LAN, MAN, WAN, WLAN, WWAN, Mobile, Satellite, PLC Distributed
Avi Networks Technical Reference (16.3)
Page 1 of 7 view online A TCP/UDP profile determines the type and settings of the network protocol that a subscribing virtual service will use. It sets a number of parameters, such as whether the virtual
Denial of Service, Traceback and Anonymity
Purdue University Center for Education and Research in Information Assurance and Security Denial of Service, Traceback and Anonymity Clay Shields Assistant Professor of Computer Sciences CERIAS Network
A Study on Intrusion Detection Techniques in a TCP/IP Environment
A Study on Intrusion Detection Techniques in a TCP/IP Environment C. A. Voglis and S. A. Paschos Department of Computer Science University of Ioannina GREECE Abstract: The TCP/IP protocol suite is the
Module 19 : Threats in Network What makes a Network Vulnerable?
Module 19 : Threats in Network What makes a Network Vulnerable? Sharing Unknown path Many points of attack What makes a network vulnerable? Unknown perimeter Anonymity Complexity of system Categories of
Discovering Mac OS X Weaknesses and Fixing Them with the New Bastille OS X Port
Discovering Mac OS X Weaknesses and Fixing Them with the New Bastille OS X Port Jay Beale Slides v1.1 updated at www.bastille-linux.org/dc14.pdf Jay Beale Jay Beale is a security consultant working for
TCP /IP Fundamentals Mr. Cantu
TCP /IP Fundamentals Mr. Cantu OSI Model and TCP/IP Model Comparison TCP / IP Protocols (Application Layer) The TCP/IP subprotocols listed in this layer are services that support a number of network functions:
CMSC 332 Computer Networks Transport Layer
CMSC 332 Computer Networks Transport Layer Professor Szajda Announcements Project I - I ll test against various clients (still possibly an issue in spec). Project 2 will be posted soon (but first, I want
THERE are now a number of powerful techniques for
IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 2, NO. 2, APRIL-JUNE 2005 93 Remote Physical Device Fingerprinting Tadayoshi Kohno, Andre Broido, and K.C. Claffy Abstract We introduce the area
ANALYSIS AND EVALUATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS IDENTIFICATION METHODS
ANALYSIS AND EVALUATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS IDENTIFICATION METHODS Saulius Grusnys, Ingrida Lagzdinyte Kaunas University of Technology, Department of Computer Networks, Studentu 50,
Internet-Wide Port Scanners Some history behind the development of high performance port scanners. Things to consider, and necessary preparations
Internet-Wide Port Scanners Some history behind the development of high performance port scanners. Things to consider, and necessary preparations before using these tools. Internet Vulnerability masscan,
Multimedia! 23/03/18. Part 3: Lecture 3! Content and multimedia! Internet traffic!
Part 3: Lecture 3 Content and multimedia Internet traffic Multimedia How can multimedia be transmitted? Interactive/real-time Streaming 1 Voice over IP Interactive multimedia Voice and multimedia sessions
Part 3: Lecture 3! Content and multimedia!
Part 3: Lecture 3! Content and multimedia! Internet traffic! Multimedia! How can multimedia be transmitted?! Interactive/real-time! Streaming! Interactive multimedia! Voice over IP! Voice and multimedia
Network Security: Scan
Network Security: Scan Seungwon Shin, KAIST some slides from Dr. Brett Tjaden More about Scan Scan Techniques Network scanning where is a target? which service is available on a target? can I have more
this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities
INFRASTRUCTURE SECURITY this security is provided by the administrative authority (AA) of a network, on behalf of itself, its customers, and its legal authorities Goals * prevent or mitigate resource attacks
Configuring IP Services
CHAPTER 8 Configuring IP Services This chapter describes how to configure optional IP services supported by the Cisco Optical Networking System (ONS) 15304. For a complete description of the commands in
FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6
FOCUS on Intrusion Detection: Intrusion Detection Level Analysis of Nmap and Queso Page 1 of 6 Intrusion Detection Level Analysis of Nmap and Queso by Toby Miller last updated Wednesday, August 30, 2000
Index. Note: Page numbers followed by f and t indicate figures and tables respectively
Index Note: Page numbers followed by f and t indicate figures and tables respectively A ABCD parameters, 33, 37 Access points (APs), 23 wireless, 132 Access Vector Cache (AVC), 165 ACP scan, 120 Acquisition
On the Origins of a Thesis
STM 2008 On the Origins of a Thesis Steven J. Murdoch 1 University of Cambridge Computer Laboratory Cambridge, United Kingdom Abstract A PhD thesis typically reads as an idealised narrative: how would
Measuring and Characterizing IPv6 Router Availability
Measuring and Characterizing IPv6 Router Availability Robert Beverly, Matthew Luckie, Lorenza Mosley, kc claffy Naval Postgraduate School UCSD/CAIDA March 20, 2015 PAM 2015-16th Passive and Active Measurement
Ambiguity Resolution via Passive OS Fingerprinting
Ambiguity Resolution via Passive OS Fingerprinting Greg Taleck NFR Security, Inc., 5 Choke Cherry Rd, Suite 200, Rockville, MD 20850 taleck@nfr.com http://www.nfr.com/ Abstract. With more widespread use
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security. Linux Operating System and Networking: LINUX
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security HTML PHP Database Linux Operating System and Networking: LINUX NETWORKING Information Gathering:
NAVAL POSTGRADUATE SCHOOL THESIS
NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS DETECTING A MULTI-HOMED DEVICE USING CLOCK SKEW by Bryan J. Martin September 2016 Co-Advisor: Co-Advisor: Murali Tummala John C. McEachen Approved
Proxy server is a server (a computer system or an application program) that acts as an intermediary between for requests from clients seeking
NETWORK MANAGEMENT II Proxy Servers Proxy server is a server (a computer system or an application program) that acts as an intermediary between for requests from clients seeking resources from the other
ECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 30 November 2017 HW#11 will be posted Announcements Don t forget projects next week Presentation
This release of the product includes these new features that have been added since NGFW 5.5.
Release Notes Revision B McAfee Next Generation Firewall 5.7.4 Contents About this release New features Enhancements Known limitations Resolved issues System requirements Installation instructions Upgrade
Onion services. Philipp Winter Nov 30, 2015
Onion services Philipp Winter pwinter@cs.princeton.edu Nov 30, 2015 Quick introduction to Tor An overview of Tor Tor is a low-latency anonymity network Based on Syverson's onion routing......which is based
CSC 4900 Computer Networks: Transport Layer
CSC 4900 Computer Networks: Transport Layer Professor Henry Carter Fall 2017 Last Time... Sockets programming API TCP and UDP look different. Remember, there is no connect() in UDP - just start sending
Capability Analysis of Internet of Things (IoT) Devices in Botnets & Implications for Cyber Security Risk Assessment Processes (Part One)
Capability Analysis of Internet of Things (IoT) Devices in Botnets & Implications for Cyber Security Risk Assessment Processes (Part One) Presented by: Andrew Schmitt Theresa Chasar Mangaya Sivagnanam
Improving PF's performance and reliability Lessons learned from bashing pf with DDoS attacks and other malicious traffic. By Kajetan Staszkiewicz,
Improving PF's performance and reliability Lessons learned from bashing pf with DDoS attacks and other malicious traffic. By Kajetan Staszkiewicz, Senior Network Enginneer @ InnoGames Let me introduce
Master Course Computer Networks IN2097
Chair for Network Architectures and Services Prof. Carle Department for Computer Science TU München Master Course Computer Networks IN2097 Chapter 7 - Network Measurements Introduction Architecture & Mechanisms
Sirindhorn International Institute of Technology Thammasat University
Name.............................. ID............... Section...... Seat No...... Sirindhorn International Institute of Technology Thammasat University Course Title: IT Security Instructor: Steven Gordon
New Approach towards Covert Communication using TCP-SQN Reference Model
ISSN 2278 0211 (Online) New Approach towards Covert Communication using TCP-SQN Reference Model Dhananjay M. Dakhane Department of Computer science & Engineering Sipna College of Engineering & Technology,
Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path. Review of TCP/IP Internetworking
1 Review of TCP/IP working Single Network: applications, client and server hosts, switches, access links, trunk links, frames, path Frame Path Chapter 3 Client Host Trunk Link Server Host Panko, Corporate
Dissecting Tor Bridges A Security Evaluation of their Private and Public Infrastructures
Dissecting Tor Bridges A Security Evaluation of their Private and Public Infrastructures Srdjan Matic, Carmela Troncoso, Juan Caballero Dublin 31 March 2017 Privacy in electronic communications Alice Bob
Results of a security assessment of the TCP and IP protocols and common implementation strategies
Results of a security assessment of the TCP and IP protocols and common implementation strategies Fernando Gont project carried out on behalf of UK CPNI DEEPSEC 2009 Conference November 17-20, 2009. Vienna,
Metrics for Security and Performance in Low-Latency Anonymity Systems
Metrics for Security and Performance in Low-Latency Anonymity Systems Tor user Entry node Tor Network Middle node Exit node Bandwidth per node (kb/s) (log scale) 1e+01 1e+03 1e+05 Encrypted tunnel Web
Remote physical device fingerprinting
Versions of this paper, copyright the IEEE, appear in IEEE Symposium on Security and Privacy 2005, IEEE Computer Society Press, May 2005 and IEEE Transactions on Dependable and Secure Computing, 2(2),
Ethical Hacking and Prevention
Ethical Hacking and Prevention This course is mapped to the popular Ethical Hacking and Prevention Certification Exam from US-Council. This course is meant for those professionals who are looking for comprehensive
RFC 4301 Populate From Packet (PFP) in Linux
RFC 4301 Populate From Packet (PFP) in Linux Sowmini Varadhan (sowmini.varadhan@oracle.com) Linux IPsec workshop, March 2018, Dresden Germany Agenda Problem description: what is this and why do we need
Encrypted Traffic Security (ETS) White Paper
Encrypted Traffic Security (ETS) White Paper The rapid rise in encrypted traffic is changing the security landscape. As more organizations become digital, an increasing number of services and applications
Scan Report Executive Summary
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Vin65 ASV Company: Comodo CA Limited 08/28/2017 Scan expiration date: 11/26/2017 Part 2. Component
Transparent TCP Timestamps draft-scheffenegger-tcpm-timestampnegotiation-03
Transparent TCP Timestamps draft-scheffenegger-tcpm-timestampnegotiation-03 Richard Scheffenegger [rs@netapp.com] Mirja Kühlewind [mirja.kuehlewind@ikr.uni-stuttgart.de] 16. November 2011 82nd IETF, Taipei,
The Protocols that run the Internet
The Protocols that run the Internet Attack types in the Internet Seminarvortrag Sommersemester 2003 Jens Gerken Content Internet Attacks Introduction Network Service Attacks Distributed Denial of Service
AURA ACADEMY Training With Expertised Faculty Call Us On For Free Demo
ETHICAL HACKING (CEH) CURRICULUM Introduction to Ethical Hacking What is Hacking? Who is a Hacker? Skills of a Hacker? Types of Hackers? What are the Ethics and Legality?? Who are at the risk of Hacking
CS395/495 Computer Security Project #2
CS395/495 Computer Security Project #2 Important Dates Out: 1/19/2005 Due: 2/15/2005 11:59pm Winter 2005 Project Overview Intrusion Detection System (IDS) is a common tool to detect the malicious activity
P2P. 1 Introduction. 2 Napster. Alex S. 2.1 Client/Server. 2.2 Problems
P2P Alex S. 1 Introduction The systems we will examine are known as Peer-To-Peer, or P2P systems, meaning that in the network, the primary mode of communication is between equally capable peers. Basically
CIS 188 CCNP TSHOOT Ch. 2: Troubleshooting Processes for Complex Enterprise Networks
CIS 188 CCNP TSHOOT Ch. 2: Troubleshooting Processes for Complex Enterprise Networks Rick Graziani Cabrillo College graziani@cabrillo.edu Fall 2010 Troubleshooting Principles Troubleshooting is the process
Impact of Network Topology on Anonymity and Overhead in Low-Latency Anonymity Networks
Impact of Network Topology on Anonymity and Overhead in Low-Latency Anonymity Networks Claudia Diaz 1, Steven J. Murdoch 2, Carmela Troncoso 1 1 K.U.Leuven, ESAT/COSIC 2 University of Cambridge / The Tor
UDP-based Amplification Attacks and its Mitigations
UDP-based Amplification Attacks and its Mitigations Yoshiaki Kasahara kasahara@nc.kyushu-u.ac.jp 1/21/2014 APAN 37th in Bandung, Indonesia 1 Summary If you have servers with global IP addresses 1. Make
Anonymity With Tor. The Onion Router. July 21, Technische Universität München
The Onion Router Nathan S. Evans Christian Grothoff Technische Universität München July 21, 2011 Overview What is Tor? Motivation Background Material How Tor Works Hidden Services Attacks Specific Attack
ETHICAL HACKING & COMPUTER FORENSIC SECURITY
ETHICAL HACKING & COMPUTER FORENSIC SECURITY Course Description From forensic computing to network security, the course covers a wide range of subjects. You will learn about web hacking, password cracking,
CE Advanced Network Security Anonymity II
CE 817 - Advanced Network Security Anonymity II Lecture 19 Mehdi Kharrazi Department of Computer Engineering Sharif University of Technology Acknowledgments: Some of the slides are fully or partially obtained