Intercepting SNC-protected traffic
|
|
|
- Sherman Barber
- 6 years ago
- Views:
Transcription
1 Intercepting SNC-protected traffic Martin Gallo Penetration Testing SME March 2017
2 Agenda Introduction Problem SAP Protocols SAP SNC (Secure Network Connections) Attack vectors Vulnerable scenarios Demo / Tools Defense Conclusions
3 Introduction Problem SAP Protocols SAP SNC (Secure Network Connections)
4 Problem: Secure network connections I need to secure my SAP network connections! I need to test if my SAP network connections are secure!
5 Problem: Secure network connections I need to secure my SAP network connections! Critical business processes SAP protocols don t offer strong security by default Strong security Authentication Integrity Encryption Move passwords out of the game (MFA, SSO,..) Regulations, compliance, etc. Encrypt all the things!
6 Solution: Secure network connections I need to secure my SAP network connections! HTTP, HANA SQL, OData,.. SSL/TLS: Standard, (almost) well understood, supported,.. GUI/Diag, RFC, Router,.. SNC (Secure Network Connections) Single Sign-on
7 Problem: Secure network connections I need to test if my SAP network connections are secure! Part of the critical attack surface External exposure Security before application-level authentication Increased deployment rates Crypto library offered for free Shipping of crypto library by default Seen BASIS admins do terrible things
8 Solution: Secure network connections I need to test if my SAP network connections are secure! SSL/TLS Tons of tools, guidance and literature,.. SNC (Secure Network Connections) No tools available Undocumented protocol???
9 SAP protocols: RFC Communications on the application layer Netweaver Application Server Gateway service External/third-party services Other SAP servers Interfaces and actions Execution of remote functions Trigger business logic Authentication Connection based Username/password based Unencrypted by default SAP NW App Server External system RFC RFC RFC SAP NW App Server
10 SAP protocols: Diag/GUI Communications between presentation and application layer GUI <-> Netweaver Application Server Dispatcher service UI components and actions Screens, items, actions, interaction RFC embedded calls Authentication Connection based Application-level login Username/password based Compressed by default LZC/LZH algorithm Unencrypted by default SAP GUI DIAG SAP NW App Server
11 SAP protocols: Router Diag/RFC/.. Application level proxy GUI Netweaver Application Server External/third-party services Other SAP servers Proxy communications to other services Unauthenticated by default Supports route passwords SAP GUI NI SAP Router NI SAP NW App Server Unencrypted by default
12 SNC: Architecture Security layer Provides security properties Strong authentication Integrity protection Data encryption Wraps supported protocols DIAG RFC CPIC SAPlpd SAP Router.. SNC DIAG/RFC/Router/.. User s data
13 SNC: Architecture Implements GSS-API Generic Security Service Application Program Interface version 2 Cryptographic primitives implemented via external libraries GSS-API version 2 SNC Adapters SECUDE 5 gssapi Kerberos 5 GSS-API SAPNTLM gssapi Build custom adapters for implementing custom crypto
14 SNC: Architecture CommonCryptoLib Standard SAP s crypto library Replaces SAPCRYPTOLIB, SAPSECULIB Implementation using GSS-API version 2 Features SNC for server-to-server and client-to-server X.509 certificates and Kerberos FIPS compatible Intel AES-NI feature set.. Central Note for CommonCryptoLib 8 (replacing SAPCRYPTOLIB)
15 SNC: Implementation scenarios Server-to-server SNC with X.509 certificates Each app server has its X.509 certificate Mutual authentication RFC (SNC) SAP NW App Server SAP NW App Server
16 SNC: Implementation scenarios Client-to-server SNC with Kerberos User mapping between SAP-AD Single-sign-on Kerberos Kerberos Active Directory Diag (SNC) SAP GUI SAP NW App Server
17 SNC: Implementation scenarios Hybrid implementation Server-to-server using X.509 certificates Client-to-server using Kerberos Active Directory Kerberos Kerberos SAP GUI Diag (SNC) RFC (SNC) SAP NW App Server SAP NW App Server
18 SNC: Protocol overview Versions 1993 SAPCRYPTOLIB, CommonCryptoLib 2010_1_0 CommonCryptoLib 2010_1_1 CommonCryptoLib >= 8.5 Messages structure SNC Frame Main header Frame Type, protocol version, lengths, QoP, etc. Extensions fields Variable, according to the type of message Token Variable, according to the type of message Data
19 SNC: Protocol overview SNC Frame types REVERSE_REQ, INIT_REQ, INIT, INIT_ACK, ACCEPT, ACCEPT_ACK, ACCEPT_FAILED, DATA_OPEN, DATA_MIC/DATA_SIGNED, DATA_WRAP/DATA_SEALED, SHUTDOWN, SHUTDOWN_MSG, REJECTED, ERROR, UNKNOWN Handshake protocol version 1993 Messages 1993ClientHello 1993ServerHello 1993Finished Wrapped data Key exchange RSA (default) Kerberos Client 1993ClientHello 1993ServerHello 1993Finished Wrapped data Server
20 SNC: Protocol overview Handshake protocol version 2010_1_0 Messages ClientHello KeyExchangeKey AuthRequest ServerHello KeyTransport AuthResponse Finished Wrapped data Key exchange RSA (default) Kerberos Client ClientHello KeyExchangeKey AuthRequest ServerHello KeyTransport AuthResponse Finished Finished Wrapped data Server
21 SNC: Protocol overview Handshake protocol version 2010_1_1 Messages ClientHello KeyExchangeKey AuthRequest ServerHello KeyTransport AuthResponse Finished Wrapped data Key exchange RSA Kerberos ECDHE (default) Client ClientHello KeyExchangeKey AuthRequest ServerHello KeyExchangeKey AuthRequest KeyTransport AuthRequest AuthResponse Finished AuthResponse Finished Wrapped data Server
22 SNC: Protocol overview Cipher suite Strength Protocol 1993 Protocol 2010_1_0 Protocol 2010_1_1 SNC_CL_RSA_AES128_RIPEMD160 MEDIUM X SNC_CL_RSA_AES128_SHA1 MEDIUM X SNC_CL_RSA_DES3_RIPEMD160 MEDIUM X SNC_CL_RSA_DES3_SHA1 MEDIUM X SNC_CL_RSA_AES256_SHA256 HIGH X X X SNC_CL_RSA_AES128_SHA256 HIGH X X SNC_KERBEROS_AES256_SHA256 HIGH X X SNC_KERBEROS_AES128_SHA256 HIGH X X SNC_SR_RSA_AES256_SHA256 HIGH X SNC_SR_RSA_AES128_SHA256 HIGH X SNC_ECDHE_P256_AES256_SHA256 HIGH X SNC_ECDHE_P384_AES256_SHA512 HIGH X SNC_ECDHE_P521_AES256_SHA512 HIGH X
23 SNC: Quality of Protection GSS-API Quality of protection GSS-API RFC introduces QOP concept Let implementations decide protection levels Parties should be able to negotiate SNC QoP levels Authentication only (level 1) Integrity Protection (level 2) Privacy Protection (level 3)
24 SNC: Quality of Protection Application Server specifies QOP on different parameters snc/data_protection/min Minimum requirement on protection level Values from 1 to 3 snc/data_protection/max Maximum protection level for connections initiated by the SAP system Values from 1 to 3 snc/data_protection/use Recommended level of protection Values from 1 to 9 (>= min, <= max) In order to negotiate, other values were implemented Default protection (level 8): Use the value from snc/data_protection/use. Maximum protection (level 9): Use the value from snc/data_protection/max.
25 Attack vectors Vulnerable scenarios Demo Tools
26 Vulnerable scenario: Eavesdropping / sniffing Passive attacker Able to sniff on the traffic Wireless network Controls one hop in the network Attacker only needs to unwrap traffic Setup SAP AS ABAP Server configured in default SNC mode SAP GUI client using QOP = 2 (integrity only) Demo time!
27 Vulnerable scenario: Interception and tampering Active attacker Able to perform a man-in-the-middle attack Spoofing ARP, DNS Wireless network Controls one hop in the network Attacker needs to unwrap, tamper, rewrap data Unwrap data, tamper application level protocol, update modified lengths and then wrap data again Setup SAP AS ABAP Server configured in default SNC mode SAP GUI client using QOP = 1 (authentication only)
28 Attack vectors: SNC/CommonCryptoLib Big attack surface Memory leaks SPNego in AS ABAP / security note Timing attacks Padding oracles Memory corruption lack of RELRO / security note Downgrade/disabling attacks Certificate/signature validation XML security / security note
29 Attack vectors: SNC/CommonCryptoLib Big attack surface Off-line password/key attacks usage of SHA-1 as default in X.509 signature / security note XML, ASN.1 and general parsing certificate parsing / security note Cryptographic flaws NTLM/Kerberos attacks..
30 Tools pysap Python library to craft/parse network packets Added SNC Support Open Source (GPL) SAP Wireshark plug-in Plug-in for Wireshark that dissects SAP s protocols Added SNC Support Diag and Router protocols Open Source (GPL) New releases soon!
31 Defense Conclusions
32 Defense Patch, patch, patch Kernel & CommonCryptoLib up-to-date Reduce attack window and exposure Review, test Architecture review Penetration testing Prepare for the worst scenario Patch procedures Forensic capabilities
33 Defense Use CommonCryptoLib > 8.5 ECDHE, PFS when working with Single Sign-on 3.0 Secure ALL paths Client-to-server Server-to-server Internal connections When protocol not supported, use SAP Router with SNC routes Disallow unencrypted connections SAP Note Option: Blocking unencrypted SAPGUI/RFC connections
34 Defense Set all QOP levels to maximum level Parameters snc/data_protection/(min/max/use) Value 3 = privacy protection Use the latest protocol available in the environment Parameters ccl/snc/(client/server)_protocol 1993 (supported by SAPCRYPTOLIB and CommonCryptoLib) 2010_1_0 (supported by CommonCryptoLib) 2010_1_1 (supported by CommonCryptoLib 8.5 and newer) Configuration parameters: SAP Note CommonCryptoLib 8.5: Configuration Profile Parameters
35 Defense Set good cipher suites Parameters ccl/snc/(client/server)_cipher_suites Client: value HIGH Server: value HIGH or select particular cipher suites Enable certificate revocation Parameters ccl/pkik/* and ccl/(snc/ssf/ssl)/pkix_revocation_check So far only CRL supported Planned Support for OSCP in CCL/Single Sign-On Configuration parameters: SAP Note CommonCryptoLib 8.5: Configuration Profile Parameters
36 Conclusions Crypto is hard Good crypto is harder Attacks against SNC are practical They re already among us! Bad implementation not necessarily better than nothing Lax controls (because it s protected!) False sense of security Lack of accountability Opportunistic encryption might not be enough in most cases Assess risk
37 Thank you! thanks to the Troopers crew! and thanks Joris, Euge!
Hunting crypto secrets in SAP systems. Martin Gallo, Product Owner/Security Researcher
Hunting crypto secrets in SAP systems Martin Gallo, Product Owner/Security Researcher AGENDA Problem definition Cryptographic material Personal Security Environment (PSE) SSO credentials (cred_v2) Local
Uncovering SAP vulnerabilities: Reversing and breaking the Diag protocol
Uncovering SAP vulnerabilities: Reversing and breaking the Diag protocol Martin Gallo Core Security Defcon 20 July 2012 P A G E Agenda Introduction Motivation and related work SAP Netweaver architecture
SAP Single Sign-On 2.0 Overview Presentation
SAP Single Sign-On 2.0 Overview Presentation June 2014 Public Legal disclaimer This presentation is not subject to your license agreement or any other agreement with SAP. SAP has no obligation to pursue
Encrypt all the things; don t forget your SAP communication!
Encrypt all the things; don t forget your SAP communication! Encryption is the word recently, especially in the post-snowden time we live in. And there is good reason for that; Your SAP system stores your
SAP Security in a Hybrid World. Kiran Kola
SAP Security in a Hybrid World Kiran Kola Agenda Cybersecurity SAP Cloud Platform Identity Provisioning service SAP Cloud Platform Identity Authentication service SAP Cloud Connector & how to achieve Principal
TLS 1.1 Security fixes and TLS extensions RFC4346
F5 Networks, Inc 2 SSL1 and SSL2 Created by Netscape and contained significant flaws SSL3 Created by Netscape to address SSL2 flaws TLS 1.0 Standardized SSL3 with almost no changes RFC2246 TLS 1.1 Security
Overview of SSL/TLS. Luke Anderson. 12 th May University Of Sydney.
Overview of SSL/TLS Luke Anderson luke@lukeanderson.com.au 12 th May 2017 University Of Sydney Overview 1. Introduction 1.1 Raw HTTP 1.2 Introducing SSL/TLS 2. Certificates 3. Attacks Introduction Raw
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
Network Access Flows APPENDIXB
APPENDIXB This appendix describes the authentication flows in Cisco Identity Services Engine (ISE) by using RADIUS-based Extensible Authentication Protocol (EAP) and non-eap protocols. Authentication verifies
WAP Security. Helsinki University of Technology S Security of Communication Protocols
WAP Security Helsinki University of Technology S-38.153 Security of Communication Protocols Mikko.Kerava@iki.fi 15.4.2003 Contents 1. Introduction to WAP 2. Wireless Transport Layer Security 3. Other WAP
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway Applying Application Delivery Technology to Web Services Overview The Cisco ACE XML Gateway is the newest
(2½ hours) Total Marks: 75
(2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.
Security Association Creation
1 Security Association Creation David L. Black November 2006 2 The Big Picture: Three Proposals Framework: 06-369 specifies Security Associations (SAs) Connect key generation to key usage (and identify
SAP NetWeaver 04 Security Guide. Network and Communication Security
SAP NetWeaver 04 Security Guide Network and Communication Security Document Version 1.00 May 11, 2004 SAP AG Neurottstraße 16 69190 Walldorf Germany T +49/18 05/34 34 24 F +49/18 05/34 34 20 www.sap.com
XenApp 5 Security Standards and Deployment Scenarios
XenApp 5 Security Standards and Deployment Scenarios 2015-03-04 20:22:07 UTC 2015 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement Contents XenApp 5 Security Standards
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 24a December 2, 2013 CPSC 467, Lecture 24a 1/20 Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management and Trusted
U.S. E-Authentication Interoperability Lab Engineer
Using Digital Certificates to Establish Federated Trust chris.brown@enspier.com U.S. E-Authentication Interoperability Lab Engineer Agenda U.S. Federal E-Authentication Background Current State of PKI
Understanding Traffic Decryption
The following topics provide an overview of SSL inspection, describe the prerequisites for SSL inspection configuration, and detail deployment scenarios. Traffic Decryption Overview, page 1 SSL Handshake
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed
Application Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
Server Tailgating A Chosen- Plaintext Attack on RDP. - Eyal Karni - Yaron Zinar - Roman Blachman
Server Tailgating A Chosen- Plaintext Attack on RDP - Eyal Karni - Yaron Zinar - Roman Blachman Speaker Info Eyal Karni Security Researcher @ Preempt Yaron Zinar Lead Security Researcher @ Preempt Roman
Wi-Fi Security for Next Generation Connectivity. Perry Correll Aerohive, Wi-Fi Alliance member October 2018
Perry Correll Aerohive, Wi-Fi Alliance member October 2018 1 Value of Wi-F1 The value Wi-Fi provides to the global economy rivals the combined market value of Apple Inc. and Amazon. The fact that Wi-Fi
Encryption Everywhere
Encryption Everywhere Adapting to a New Reality that favors Security and Privacy Kathleen Moriarty EMC Office of CTO IETF Security Area Director (Speaking for myself, not the IETF) 1 Agenda Protocol and
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Final Exam Review Instructor: Dr. Kun Sun Topics covered by Final Topic before Midterm 10% Topic after Midterm 90% Date: 12/13/2017 7:30am 10:15am Place: the same
Network Encryption 3 4/20/17
The Network Layer Network Encryption 3 CSC362, Information Security most of the security mechanisms we have surveyed were developed for application- specific needs electronic mail: PGP, S/MIME client/server
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
Summary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1415/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1415/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
MTAT Applied Cryptography
MTAT.07.017 Applied Cryptography Transport Layer Security (TLS) Advanced Features University of Tartu Spring 2016 1 / 16 Client Server Authenticated TLS ClientHello ServerHello, Certificate, ServerHelloDone
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Web Security Web is now widely used by business, government, and individuals But Internet and Web are
review of the potential methods
Mandatory iscsi Security review of the potential methods IPS Interim Meeting Nashua NH, May 01 2001 Ofer Biran Thanks to: IBM Research Lab in Haifa Bernard Aboba, David Black, Julian Satran, Steve Senum
The case for ubiquitous transport-level encryption
1/25 The case for ubiquitous transport-level encryption Andrea Bittau, Michael Hamburg, Mark Handley, David Mazières, and Dan Boneh Stanford and UCL November 18, 2010 Goals 2/25 What would it take to encrypt
Findings for
Findings for 198.51.100.23 Scan started: 2017-07-11 12:30 UTC Scan ended: 2017-07-11 12:39 UTC Overview Medium: Port 443/tcp - NEW Medium: Port 443/tcp - NEW Medium: Port 443/tcp - NEW Medium: Port 80/tcp
Syllabus: The syllabus is broadly structured as follows:
Syllabus: The syllabus is broadly structured as follows: SR. NO. TOPICS SUBTOPICS 1 Foundations of Network Security Principles of Network Security Network Security Terminologies Network Security and Data
Preventing vulnerabilities in HANAbased MARCH TROOPERS SECURITY CONFERENCE
Preventing vulnerabilities in HANAbased deployments MARCH 2016 - TROOPERS SECURITY CONFERENCE Disclaimer This presentation contains references to the products of SAP SE. SAP, R/3, xapps, xapp, SAP NetWeaver,
Hacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK
Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for
About the company. What we do? Cybersecurity solutions adapted to protect enterprise business applications (SAP & Oracle).
About the company 2 What we do? Cybersecurity solutions adapted to protect enterprise business applications (SAP & Oracle). Agenda 3 Building a business case for SAP Vulnerability Management How to start
Coming of Age: A Longitudinal Study of TLS Deployment
Coming of Age: A Longitudinal Study of TLS Deployment Accepted at ACM Internet Measurement Conference (IMC) 2018, Boston, MA, USA Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G. Paterson,
CIP Security Phase 1 Secure Transport for EtherNet/IP
CIP Security Phase 1 Secure Transport for EtherNet/IP Brian Batke, Rockwell Automation Dennis Dubé, Schneider Electric Joakim Wiberg, HMS Industrial Networks October 14, 2015 The Need for a Secure Transport
jk0-022 Exam Questions Demo CompTIA Exam Questions jk0-022
CompTIA Exam Questions jk0-022 CompTIA Academic/E2C Security+ Certification Exam Voucher Only Version:Demo 1.An attacker used an undocumented and unknown application exploit to gain access to a file server.
WEB-202: Building End-to-end Security for XML Web Services Applied Techniques, Patterns and Best Practices
WEB-202: Building End-to-end Security for XML Web Services Applied Techniques, Patterns and Best Practices Chris Steel, Ramesh Nagappan, Ray Lai www.coresecuritypatterns.com February 16, 2005 15:25 16:35
Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
About FIPS, NGE, and AnyConnect
About FIPS, NGE, and AnyConnect, on page 1 Configure FIPS for the AnyConnect Core VPN Client, on page 4 Configure FIPS for the Network Access Manager, on page 5 About FIPS, NGE, and AnyConnect AnyConnect
Configuring OpenVPN on pfsense
Configuring OpenVPN on pfsense Configuring OpenVPN on pfsense Posted by Glenn on Dec 29, 2013 in Networking 0 comments In this article I will go through the configuration of OpenVPN on the pfsense platform.
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA CTO Office www.digi.me another Engineering Briefing digi.me keeping your data secure at all times ALL YOUR DATA IN ONE PLACE TO SHARE WITH PEOPLE WHO
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003 A system or combination of systems that enforces a boundary between two or more networks - NCSA
Security Engineering. Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings)
Security Lecture 16 Network Security Fabio Massacci (with the courtesy of W. Stallings) Lecture Outline Network Attacks Attive Attacks Passive Attacks TCP Attacks Contermeasures IPSec SSL/TLS Firewalls
Security issues: Encryption algorithms. Threats Methods of attack. Secret-key Public-key Hybrid protocols. CS550: Distributed OS.
Security issues: Threats Methods of attack Encryption algorithms Secret-key Public-key Hybrid protocols Lecture 15 Page 2 1965-75 1975-89 1990-99 Current Platforms Multi-user timesharing computers Distributed
Evaluating the Security Risks of Static vs. Dynamic Websites
Evaluating the Security Risks of Static vs. Dynamic Websites Ballard Blair Comp 116: Introduction to Computer Security Professor Ming Chow December 13, 2017 Abstract This research paper aims to outline
Scope Statement For Shared Key Authentication and Encryption in Lustre 2.X
For Shared Key Authentication and Encryption in Lustre 2.X Revision History Date Revision Author 2012-07-10 Created Andrew Korty 2012-11-10 Version 2 Stephen Simms Table of Contents Introduction... 2 Problem
Foreword by Katie Moussouris... Acknowledgments... xvii. Introduction...xix. Chapter 1: The Basics of Networking... 1
Brief Contents Foreword by Katie Moussouris.... xv Acknowledgments... xvii Introduction...xix Chapter 1: The Basics of Networking... 1 Chapter 2: Capturing Application Traffic... 11 Chapter 3: Network
Crypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Single Sign-On Showdown
Single Sign-On Showdown ADFS vs Pass-Through Authentication Max Fritz Solutions Architect SADA Systems #ITDEVCONNECTIONS Azure AD Identity Sync & Auth Timeline 2009 2012 DirSync becomes Azure AD Sync 2013
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
CompTIA Security+ (Exam SY0-401)
CompTIA Security+ (Exam SY0-401) Course Overview This course will prepare students to pass the current CompTIA Security+ SY0-401 certification exam. After taking this course, students will understand the
AN IPSWITCH WHITEPAPER. The Definitive Guide to Secure FTP
AN IPSWITCH WHITEPAPER The Definitive Guide to Secure FTP The Importance of File Transfer Are you concerned with the security of file transfer processes in your company? According to a survey of IT pros
CS 161 Computer Security
Raluca Ada Popa Spring 2018 CS 161 Computer Security Discussion 6 Week of February 26, 2018 Question 1 TLS threats (10 min) An attacker is trying to attack the company Boogle and its users. Assume that
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
CompTIA E2C Security+ (2008 Edition) Exam Exam.
CompTIA JK0-015 CompTIA E2C Security+ (2008 Edition) Exam Exam TYPE: DEMO http://www.examskey.com/jk0-015.html Examskey CompTIA JK0-015 exam demo product is here for you to test the quality of the product.
Transport Layer Security
Transport Layer Security TRANSPORT LAYER SECURITY PERFORMANCE TESTING OVERVIEW Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL), are the most popular cryptographic protocols
Moving Targets: Assessing the Security of Mobile Devices. March 3 rd, 2016 Kevin Johnson, CEO Secure Ideas
Moving Targets: Assessing the Security of Mobile Devices March 3 rd, 2016 Kevin Johnson, CEO Secure Ideas Conflict of Interest Kevin Johnson Has no real or apparent conflicts of interest to report. Kevin
Switched environments security... A fairy tale.
Switched environments security... A fairy tale. Cédric Blancher 10 july 2002 Outline 1 Network basics Ethernet basics ARP protocol Attacking LAN Several ways to redirect network
Int ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Securing Mainframe File Transfers and TN3270
Securing Mainframe File Transfers and TN3270 with SSH Tectia Server for IBM z/os White Paper October 2007 SSH Tectia provides a versatile, enterprise-class Secure Shell protocol (SSH2) implementation for
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake Mathy Vanhoef - @vanhoefm imec-distrinet, KU Leuven Black Hat, 27 July 2017 Introduction More and more Wi-Fi network
Overview of TLS v1.3 What s new, what s removed and what s changed?
Overview of TLS v1.3 What s new, what s removed and what s changed? About Me Andy Brodie Solution Architect / Principal Design Engineer. On Worldpay ecommerce Payment Gateways. Based in Cambridge, UK.
CYBER ATTACKS EXPLAINED: WIRELESS ATTACKS
CYBER ATTACKS EXPLAINED: WIRELESS ATTACKS Wireless networks are everywhere, from the home to corporate data centres. They make our lives easier by avoiding bulky cables and related problems. But with these
Cryptographic Protocols 1
Cryptographic Protocols 1 Luke Anderson luke@lukeanderson.com.au 5 th May 2017 University Of Sydney Overview 1. Crypto-Bulletin 2. Problem with Diffie-Hellman 2.1 Session Hijacking 2.2 Encrypted Key Exchange
VMware, SQL Server and Encrypting Private Data Townsend Security
VMware, SQL Server and Encrypting Private Data Townsend Security 724 Columbia Street NW, Suite 400 Olympia, WA 98501 360.359.4400 Today s Agenda! Compliance, standards, and best practices! Encryption and
Wireless LAN Security. Gabriel Clothier
Wireless LAN Security Gabriel Clothier Timeline 1997: 802.11 standard released 1999: 802.11b released, WEP proposed [1] 2003: WiFi alliance certifies for WPA 2004: 802.11i released 2005: 802.11w task group
Defeating All Man-in-the-Middle Attacks
Defeating All Man-in-the-Middle Attacks PrecisionAccess Vidder, Inc. Defeating All Man-in-the-Middle Attacks 1 Executive Summary The man-in-the-middle attack is a widely used and highly preferred type
Certified Secure Web Application Secure Development Checklist
www.certifiedsecure.com info@certifiedsecure.com Tel.: +31 (0)70 310 13 40 Loire 128-A 2491 AJ The Hague The Netherlands About Certified Secure Checklist Certified Secure exists to encourage and fulfill
Authenticated Encryption in TLS
Authenticated Encryption in TLS Same modelling & verification approach concrete security: each lossy step documented by a game and a reduction (or an assumption) on paper Standardized complications - multiple
Ken Agress, Senior Consultant PlanNet Consulting, LLC.
Elements of a Vulnerability Assessment Ken Agress, Senior Consultant PlanNet Consulting, LLC. Defining a Vulnerability Assessment Agenda Types of Vulnerability Assessments Are You Ready for an Assessment?
Auth. Key Exchange. Dan Boneh
Auth. Key Exchange Review: key exchange Alice and want to generate a secret key Saw key exchange secure against eavesdropping Alice k eavesdropper?? k This lecture: Authenticated Key Exchange (AKE) key
This Security Policy describes how this module complies with the eleven sections of the Standard:
Vormetric, Inc Vormetric Data Security Server Module Firmware Version 4.4.1 Hardware Version 1.0 FIPS 140-2 Non-Proprietary Security Policy Level 2 Validation May 24 th, 2012 2011 Vormetric Inc. All rights
FIPS Security Policy. for Marvell Semiconductor, Inc. Solaris 2 Cryptographic Module
FIPS 140-2 Security Policy for Marvell Semiconductor, Inc. Solaris 2 Cryptographic Module Hardware Version: 88i8925, 88i8922, 88i8945, and 88i8946 Firmware Version: Solaris2-FIPS-FW-V1.0 Document Version:
CS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
Advanced iscsi Management April, 2008
April, 2008 Gene Nagle, istor Networks SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individuals may use this material in presentations and
IPv6 Security Vendor Point of View. Eric Vyncke, Distinguished Engineer Cisco, CTO/Consulting Engineering
IPv6 Security Vendor Point of View Eric Vyncke, evyncke@cisco.com Distinguished Engineer Cisco, CTO/Consulting Engineering 1 ARP Spoofing is now NDP Spoofing: Threats ARP is replaced by Neighbor Discovery
ITCertMaster. Safe, simple and fast. 100% Pass guarantee! IT Certification Guaranteed, The Easy Way!
ITCertMaster Safe, simple and fast. 100% Pass guarantee! http://www.itcertmaster.com Exam : C_AUDSEC_731 Title : SAP Certified Technology Associate - SAP Authorization and Auditing for SAP NetWeaver 7.31
Office 365 and Azure Active Directory Identities In-depth
Office 365 and Azure Active Directory Identities In-depth Jethro Seghers Program Director SkySync #ITDEVCONNECTIONS ITDEVCONNECTIONS.COM Agenda Introduction Identities Different forms of authentication
Security Protocols. Professor Patrick McDaniel CSE545 - Advanced Network Security Spring CSE545 - Advanced Network Security - Professor McDaniel
Security Protocols Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011 CSE545 - Advanced Network Security - Professor McDaniel 1 Case Study: Host Access The first systems used telnet
Persistent key, value storage
Persistent key, value storage In programs, often use hash tables - E.g., Buckets are an array of pointers, collision chaining For persistant data, minimize # disk accesses - Traversing linked lists is
Understanding Cisco Cybersecurity Fundamentals
210-250 Understanding Cisco Cybersecurity Fundamentals NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-250 Exam on Understanding Cisco
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Release Notes. NCP Android Secure Managed Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3.
NCP Android Secure Managed Client can be commissioned for use in one of two environments: NCP Secure Enterprise Management, or NCP Volume License Server. Release: 2.32 build 067 Date: May 2013 1. New Features
1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and
Real-time protocol. Chapter 16: Real-Time Communication Security
Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication
Host Website from Home Anonymously
Abstract Host Website from Home Anonymously Prerna Mahajan 1 and Kashish Gupta 2 1 Professor, Department of Computer Science, IITM Janakpuri, New Delhi, India 2 Research Scholar, Department of Computer
Using the MyProxy Online Credential Repository
Using the MyProxy Online Credential Repository Jim Basney National Center for Supercomputing Applications University of Illinois jbasney@ncsa.uiuc.edu What is MyProxy? Independent Globus Toolkit add-on
Actifio Data Security
Actifio Tech Brief Actifio Data Security All components of Actifio Copy Data Virtualization have been designed from the ground up with security in mind and the IP interfaces as traditional attack vectors
Wireless Network Security
Wireless Network Security Why wireless? Wifi, which is short for wireless fi something, allows your computer to connect to the Internet using magic. -Motel 6 commercial 2 but it comes at a price Wireless
SSL/TLS. Pehr Söderman Natsak08/DD2495
SSL/TLS Pehr Söderman Pehrs@kth.se Natsak08/DD2495 1 Historical problems No general purpose security wrapper Kerberos doesn't cut it! Each protocol has it's own security layer SNMP, Ktelnet Or none at