CST 620 Project

ADDITIONAL LAB GUIDANCE

Below is a list of additional guidance and/or recommendations for your lab experience report:

· Completing the labs: All sections or parts of the labs should be completed as required.

· Answering the lab questions: You are required to answer all the lab questions (if any).

· Taking screenshots: While taking screenshots is recommended in your lab, try to limit them, and only focus on the applicable ones to support your lab report.

· Writing your lab experience report: You are required to write a summary of the lab experience report based on your findings and incorporate them into your final deliverables.

· Using a file name convention: Please change the generic file name of this template to reflect part of your name, the course ID, or the project/lab title.

· e.g. 1: CST620 Project 3 Lab-Security Assessment in Wireless Communications

· e.g. 2: CST620 Project 3 Lab-Security Assessment in Wireless Communications—John Doe

· e.g. 3: CST620 -Project 3 Lab_Security Assessment in Wireless Communications (7/15/22)

In compiling your findings, think of how your experience performing the labs is related to the overall project goals. You are required to collect information from the lab to understand potential security challenges, analyze, develop your lab experience report, and incorporate key components in the final project report.

Please do well to pay attention to each item above and use it as a supplemental guide in addition to the project requirements. Finally, note that successfully completing the lab is important for achieving the overall project goals.

Your employer was concerned about potential Wireless Local Area Network (WLAN) attacks that were likely to impact the organization's internal security posture. As a proactive measure, you were called in to assess the situation based on your expertise and offered a mitigation strategy. Acting as an Information System Security Officer (ISSO) Level 1, you have been able to analyze the network packets that were captured and investigated the potential target rogue access points, (APs), hosts, inbound and outbound traffic, and any indications of malicious attacks or suspicious activities on the wireless network. You will be able to provide recommendations to improve the existing WLAN security policy. Based on the knowledge and experience gained from the lab, answer the following questions.

PART 3: FILTERING, INSPECTING, AND ANALYZING THE PCAP FILE— Analysis of the Packet Details, Using the Statistics Tool and the Flow Graph Tool to Analyze the PCAP File, Analyzing Firewall Rules, etc.

1. By analyzing the packet details of the loaded PCAP file, determine the nature of communications occurring between the source and destination endpoints (or IP addresses). What differentiates the DNS query from the TCP ACK segment?

The first thing you will see is the DSN query. That is the computer requesting the IP address from the DNS server. Once the DNS server translates the web address to the IP address it will respond back with the IP address for the web address. Then you will begin to see the three-way handshake (SYN-SYN/ACKACK) TCP traffic. After that has completed the user will be granted access to the website. The primary difference between the DNS query and TCP ACK segment is the flags that are included within the data. The DNS query will include such data as ID flags and the number of inquiries. The TCP ACK segment will include such data as source and destination information and IPs.

2. What can you infer from the statistical information in the Destination and Ports window as far as a wireless threat is concerned?

The destination and port windows can be a key indication of a wireless threat. This can help you determine where the potential threat is coming from (if it isn’t being spoofed), and what ports that they have an interest in. For example, you may see a lot of traffic going in and out of the FTP port (21). This may be an indication that the hacker is depositing or removing files from the server. With the hacker depositing files, this may allow them to establish a reverse shell and further traverse through the network.

3. What is your point of view on the Rate and Percent columns of the Statistics output with respect to the Count column? Does this information indicate any possibility of a compromise? If so, why?

The rate and percent columns of the statistic output with respect to the count column indicates the total number of items within the data and the percent that raises a flag of being compromised. This does not necessarily indicate any possibility of a compromise but should be a cause of concern and should be investigated and/or investigate securing the dataset better.

4. What useful information can you determine from the flow graph based on your analysis w.r.t. any IOC of the wireless/mobile communications?

Some of the useful information that you can determine from the flow graph based on my analysis of the wireless/mobile communication is the data rate, the error rate, and the throughput traffic.

5. Do you see any indication of any wireless vulnerabilities such as the use of default SSIDs and passwords and the use of vulnerable WEP protocol upon analyzing the WLAN traffic? Why or why not?

Upon analyzing the WLAN traffic, I do not see any indication of any wireless vulnerabilities such as the use of default SSIDs and passwords or the use of the vulnerable WEP protocol.

6. How is this indication different from the Statistics information retrieved earlier and from the perspective of this attack? Is there any Wireshark feature that can help you arrive at the same conclusion?

“Follow TCP Stream” is a Wireshark feature that can help you arrive to a conclusion of whether the traffic is malicious or not. The difference between the Statistics information that was retrieved earlier verse the perspective of this attack is that the previous statistics information retrieved did not seem to raise any flags and was just general information while now it appears to be a lot of DNS traffic and that can be utilized for data exfiltration or to increase the potency of DDoS attacks.

7. What legitimate or illegitimate role does the host/user with the 192.168.1.132 or 192.168.1.1 IP address play in the suspected WLAN traffic?

In the suspected WLAN traffic the legitimate IP address is most likely 192.168.1.132 which may be the actual address of the router while the 192.168.1.1 is the illegitimate IP address and is most likely the attackers attempt to hide in plain site and impersonate the router.

8. If malicious actors got into your network to access your network security logs, how could they use the packet details to their advantage? Specifically, what utilities within Wireshark can you count on?

If malicious actors got into my network and where able to access my security logs, they could use the packet details to their advantage to identify IP addresses on the network, and ports and protocols being used within the network. They could apply various filters to narrow down these details of things of interest.

9. Provide examples of IP addresses, hostnames, and mac addresses based on your analysis of the PCAP files in Wireshark. What do you think is happening so far in your view?

IP Address – 192.168.1.4

Hostname – www.google.com

MAC Address - 00:0c:29:da:59:c2

Based off of the view so far, it appears that the PCAP file contains data from a Google search.

10. From the perspective of access control and firewall rules, what are the components of an ACL and where can you place those rules on the network?

The components of an ACL are to restrict, allow, or block incoming and/or outgoing traffic based on the designated rules or filters. Those rules can be placed on a router, switch, or firewall on the network.

11. How do you implement ACL firewall rules on a firewall, router, or relevant network appliance?

ACL firewall rules are implemented by creating the access control list within the devices port configuration.

12. Do you think using any filter in the Apply a display filter box such as tcp, http, or icmp before retrieving the firewall rules has any impact? Why or why not?

Applying a display filter before retrieving the firewall rules has no impact because the filter will only be applied after the firewall rules have been implemented.

NOTE: Proceed to the next page and use the space provided to compile a summary of your lab experience report. Use additional space as necessary to complete the report.

SUMMARY OF THE LAB EXPERIENCE REPORT

Use the space below to summarize your lab experience report based on your findings from the lab, making sure to complete all required actions in each step of the lab and respond to all questions. Be sure to incorporate a key part of your findings in your final project report for submission to your professor. You may use additional space as necessary to complete the lab.

Once again, this lab utilized Wireshark to help expand upon the knowledge we have been learning throughout this course and previous courses. The course begins with loading various previously saved PCAP files into Wireshark. The results are reviewed through the three primary display panes (Packet List, Packet Details, and Packet Byte/Status). Utilizing the Statistics>IPv4 Statistics> Destination and Ports, we were able to exam the IP addresses, the ports being used, the number of times that port was used, and their rates. We then invoked the Statistics>Flow Graph to uncover additional information about the communication (this view was a little bit cluttered for my liking, but it does provide plenty of information). We also reviewed the Firewall ACL Rules within each of the PCAP files to review what information was being filtered out of the displayed results. This was down with each of the six different PCAP files for comparison. Overall, this lab was fun, quick, and informative. It allowed me to get my hands on Wireshark, which I know is an extremely valuable tool when it comes to networking and security.