post for kim woods

t1.pdf

Home >Computer Science homework help >post for kim woods

Midterme ST: Security in Emerging Networks Due: July 13, 2018

Instructions:

I. This is a take home exam with strict due date/time. II. You have all the available resources to answer these questions. Use of any outside resources (web pages, books, etc.) must

be cited. The answers must be yours completely. III. Sharing your answerers with colleagues is considered plagiarism and will result in a grade ”F” for the course. IV. You must submit your homework electronically only in .pdf format to the Blackboard.

1. Briefly describe the following attacks, with an example.

(a) Control hijacking attack (say, due to a format string vulnerability).

(b) Web cache poisoning attack.

(d) Power analysis attack.

(e) How does traffic shaping improve the security of a local area network?

2. (a) In class we discussed Cross Site Request Forgery (CSRF) attacks against web sites that rely solely on cookies for session management. Briefly explain a CSRF attack on such a site.

(b) A common CSRF defense places a token in the Document Object Model (DOM) of every page (e.g. as a hidden form element) in addition to the cookie. An Hypertext Transfer Protocol (HTTP) request is accepted by the server only if it contains both a valid HTTP cookie header and a valid token in the POST parameters. Why does this prevent the attack from part (a)?

(c) One approach to choosing a CSRF token is to choose one at random. Suppose a web site chooses the token as a fresh random string for every HTTP response. The server checks that this random string is present in the next HTTP request for that session. Does this prevent CSRF attacks? If so, explain why. If not, describe an attack.

(d) Another approach is to choose the token as a fixed random string chosen by the server. That is, the same random string is used as the CSRF token in all HTTP responses from the server over a given time period. Does this prevent CSRF attacks? If so, explain why. If not, describe an attack.

(e) Why is the Same-Origin Policy important for the cookie-plus-token defense?

3. The IP protocol supports fragmentation, which allows a packet to be broken into smaller fragments as needed and re- assembled when the fragments reach their destination. When a packet is fragmented it is assigned a 16-bit packet ID; each fragment is identified by its offset within the original packet. The fragments travel to the destination as separate packets. At the destination they are grouped by their packet ID and assembled into a complete packet using the packet offset of each fragment. The IP packet format is often drawn with 32 bits per line:

Destination address

Source address

Time to live

Identification

IHLVersion Total length

Fragment offsetD F F

32 bits

Type of service

Header checksum

Options(0 or more words)

Potocol

Pad

Data

The Identification field is 16 bits and is a value assigned by the sender of an IP datagram to aid in reassembling the fragments of a datagram. The Protocol field specifies the next layer protocol (e.g., TCP, UDP, ICMP) and is ”byte 9” if we start the packet with ”byte 0”. The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a multiple of eight. In the flags field of the IP header, bit 1 is the DF bit (0 = ”may fragment,” 1 = ”don’t fragment”). Bit 2 is the MF bit (0 = ”last fragment,” 1 = ”more fragments”). If this is a TCP packet, for example, then the TCP header is contained in the portion of the packet shown here as ”Data”. A specification saying which higher level protocol (e.g., HTTP, SMTP) is used is also in the ”Data” portion of the IP format.

CS 4/69995 July 13, 2018 Page 1 of 2

Midterme ST: Security in Emerging Networks Due: July 13, 2018

(a) Suppose you want to install a stateless packet filter and block incoming Simple Mail Transfer Protocol (SMTP) packets but allow HTTP packets. Why is fragmenting a problem?

(b) Suppose you are building a possibly stateful or application layer filtering engine. Your goals include: (i) block incom- ing SMTP traffic, but (ii) allow HTTP traffic. Recall IP fragments received at the destination and reassembling occurs when the fragments arrive to the receiver. An attacker may carefully craft an offset that overwrites the value of the destination port from the first fragment. Give an example of how overlapping fragments can cause the filtering engine to incorrectly allow some SMTP traffic through.

(c) How should your filtering engine designed to meet the requirements stated in the part (b) handle overlapping frag- ments?

4. Carefully read the article in [1] and answer the following questions. Illustrate each by an example with details and step-by- step.

(a) How Onion routing works?

(b) How Onion routing works?

The intention is not not to re-write what presented in the class or what is written in the paper, rather an example to show the level of your understanding.

5. Consider a Web site xyz.com that implements a phone dialer. When the user enters a phone number to call, the browser opens a new window containing the following Javascript that defines a postMessage event listener:

function receiveMessage(event) { // event.data is a phone number from sender initiatePhoneCallTo(event.data);

} window.addEventListener("message", receiveMessage, false);

The parent page then sends a postMessage to this window to initiate the call. This activates the receiveMessage function which makes the call.

(a) Explain how an evil web site can cause a visitor to initiate phone calls to arbitrary phone numbers. Assume the visitor is logged in to her xyz.com account, but does not have xyz.com open in a window.

(b) if the function receiveMessage started with the following line:

if (event.origin !== "https://www.xyz.com") return;

Would this eliminate the problem you identified in part (a)? Recall that event.origin is the true origin that initiated the postMessage call.

https://bank.com/account?requestID=RID

where RID is an arbitrary string provided by evil.com. The response from bank.com contains the given RID, but the response is otherwise unaffected by the value of RID. Explain how evil.com can use this reflected argument to determine the exact response size from bank.com

(d) Looking more generally at the correct use of HTTPS, suppose that a page loaded over HTTP loads a login iframe as

Can an active network attacker steal the password entered into the login frame? Justify your answer.

References

[1] Jian Ren and Jie Wu 0001. Survey on anonymous communications in computer networks. Computer Communications, 33(4):420–431, 2010.

CS 4/69995 July 13, 2018 Page 2 of 2