Cyber Security & Systems (CSS)

Assignment – 2 | Notes

Module 3: Cryptographic Hashes, Message Digests and Digital Certificates

Q1. Differentiate between MD5 and SHA-1

Point MD5 SHA-1

Full Form Message Digest 5 Secure Hash Algorithm 1

Output Length 128 bits 160 bits

Security Level Weak (easily breakable) Stronger than MD5 but now also weak

Collision Resistance Very Low Low (better than MD5 but broken)

Speed Faster Slightly slower

Current Use Not recommended Not recommended

Q2. Explain X.509 Certificate Format

X.509 is the standard format for digital certificates used in public key infrastructure (PKI). It defines the
structure and content of a digital certificate.
• Version: Specifies the X.509 version (v1, v2, or v3).
• Serial Number: Unique identifier for the certificate.
• Signature Algorithm: Hashing & signing algorithm used.
• Issuer Name: Name of the Certificate Authority (CA).
• Validity Period: Start & end date of validity.
• Subject Name: Name of the website or owner.
• Public Key: Public key of the certificate holder.
• Digital Signature: Signature of the Certificate Authority.
• Extensions: Extra information (optional) — present from v3 onwards.

X.509 Certificate Structure (versions):

Field v1 v2 v3

Version ✓ ✓ ✓

Serial Number ✓ ✓ ✓

Signature Algorithm ✓ ✓ ✓

Issuer Name ✓ ✓ ✓

Validity Period ✓ ✓ ✓

Subject Name ✓ ✓ ✓

Public Key ✓ ✓ ✓

Digital Signature ✓ ✓ ✓

Extensions — — ✓
Q3. What is PKI? List its components.
Public Key Infrastructure (PKI) is a standard framework used for managing, storing, generating, and
revoking digital certificates. It follows asymmetric key cryptography.
PKI is a combination of the following services:
• Message Digest (Integrity): Ensures that the message content is not changed during transmission.
• Digital Signatures (Authentication): Verifies the identity of the sender.
• Encryption Service (Confidentiality): Protects data from unauthorized access.
Components of PKI:
Certificate Repository:
Stores all certificate information. Contains details such as: when to revoke, when to give access, all kinds of
information — their ID, Name, Owner.

Entity:
It is a user of PKI. It can be a Router, Single Person, Group, or Organization who is trying to access PKI or
ever use PKI.

Registration Authority (RA):

It is for registration and verification purpose. If any device is raising a request for accessing a certificate,
then it registers the request and verifies the user.

Certificate Authority (CA):

It decides to whenever give certificate to users. It is responsible for issuing, revoking, and distributing
certificates.

Q4. Illustrate cryptographic hash function with properties of secure hash function.
→ A hash function is a mathematical function that converts any size of input data into a fixed-length
output.
Input (n-bit message, variable length) → Hash Function H → Hash Value h (Fixed Length)

Properties of a Secure Hash Function:

• Deterministic: Same input always gives the same hash output. Ex: "Hello" will always produce the
same hash.
• Fixed Output Size: Regardless of input size, output length is constant. Ex: SHA-256 hash function
always produces a 256-bit hash.
• Pre-image Resistance (One-way): It is computationally infeasible to reverse the hash. You cannot
get the original input from the hash.
• Collision Resistance: It is extremely difficult to find two different inputs that produce the same hash.
Ensures uniqueness.
• Avalanche Effect: A small change in input causes a large change in output. Ex: "Hello" vs "Hella" →
completely different hash.
• Fast Computation: Hash function should be quick to compute for efficiency.

Module 5: System Security

Q1. Explain concepts of database reliability and integrity and its importance for secure
database management with examples.
1. Database Reliability
Database reliability is the ability of a database system to operate correctly and continuously without failure,
and to recover quickly if any failure occurs.
It ensures that the database:
• Is always available when users need it
• Performs operations accurately
• Can recover lost data using backups and logs
Explanation: In real-world systems, failures like power cuts, system crashes, or network issues can occur.
A reliable database uses techniques like backup, replication, and transaction logs to prevent permanent
data loss and to restore the system to a correct state.
Example: In an ATM system, if money is deducted but the system crashes before confirmation, reliability
mechanisms ensure that either the transaction is completed, OR the amount is restored (rollback). This
avoids incorrect balances.

Importance in security:
• Prevents data loss and system failure
• Maintains continuous service availability
• Reduces risk of data exposure during crashes
• Supports disaster recovery
2. Database Integrity
Database integrity refers to the accuracy, consistency, and correctness of data stored in a database over
time.
It ensures that data:
• Is not corrupted or altered improperly
• Remains consistent across tables
• Follows defined rules and constraints
Types of Integrity:
1. Entity Integrity: Every table must have a unique primary key and it cannot be NULL. Ex: Each employee
has a unique employee ID.
2. Referential Integrity: A foreign key must match an existing primary key in another table. Ex: An order
must be linked to a valid customer ID.
3. Domain Integrity: Data must follow valid data types and ranges. Ex: Age cannot be negative.
4. User-defined Integrity: Custom rules based on business logic. Ex: Bank balance should not be less
than zero.

Importance in security:
• Prevents unauthorized or accidental data modification
• Protects against data corruption and inconsistency
• Ensures reliable and correct information
• Maintains trust in the database system
3. Role in Secure Database Management
Both reliability and integrity are essential for maintaining database security. Together they protect against
data loss, data corruption, and unauthorized changes. They also support the CIA Triad:
• Confidentiality – Protecting data from unauthorized access
• Integrity – Maintaining correctness of data
• Availability – Ensuring access when needed
Q2. Explain various memory and address protection mechanisms used in modern
operating systems.
Memory and address protection mechanisms are techniques used by operating systems to prevent
unauthorized access to memory and ensure that each process operates within its own allocated space.

1. Process Isolation
Each process is given a separate memory space, so one process cannot access another process's
memory.
Example: If a web browser crashes, it does not corrupt data of other applications like a text editor.

2. Base and Limit Registers

These registers define the starting address (base) and maximum size (limit) of a process's memory. The
CPU checks every memory access; if the address is outside the limit, access is denied.
Example: If a process tries to access memory beyond its allocated range, the OS generates an error (trap),
preventing illegal access.

3. Paging
Paging divides memory into fixed-size blocks: Pages (logical memory) and Frames (physical memory).
Logical addresses are mapped to physical addresses using a page table.
Example: A process can only access its assigned pages, not others, ensuring protection.

4. Segmentation
Memory is divided into logical segments like code, data, and stack. Each segment has a base address and
limit. Access is allowed only within segment boundaries.
Example: A program cannot modify its code segment accidentally, protecting it from errors or attacks.

5. Virtual Memory
Virtual memory allows processes to use more memory than physically available using disk space. Uses
techniques like paging and swapping. Each process has its own virtual address space.
Example: Even if RAM is limited, multiple applications can run securely without interfering with each other.

6. Access Control (Read/Write/Execute Permissions)

Each memory region has access permissions — Read (R), Write (W), Execute (X). The OS restricts
operations based on permissions.
Example: A program cannot execute data memory, preventing attacks like code injection.

7. Address Space Layout Randomization (ASLR)

ASLR randomly arranges memory addresses of processes, making it difficult for attackers to predict
memory locations.
Example: Prevents buffer overflow attacks by randomizing stack and heap locations.

8. Protection Rings (Privilege Levels)

Operating systems use different privilege levels (user mode and kernel mode). User programs run in
restricted mode; OS kernel runs in full-access mode.
Example: A user application cannot directly access hardware or critical memory.

Q3. Discuss different file protection mechanisms in operating systems.

File protection mechanisms control access to files and ensure that only authorized users can read, write,
or modify data.

1. Access Control (Permissions)

OS assigns permissions — Read (R), Write (W), Execute (X) — to files that define what actions a user can
perform.
 Example: A file may allow Owner: Read, Write; Others: Read only.
Security role: Prevents unauthorized users from modifying or deleting files.

2. Access Control Lists (ACLs)

ACLs provide fine-grained control by specifying permissions for individual users or groups.
Example: User A → Read; User B → Read & Write; User C → No access.
Security role: Ensures only specific users can access sensitive data.

3. User Authentication
Before accessing files, users must prove their identity via passwords, biometrics, or security tokens.
Example: A user must log in to the system before accessing personal or system files.
Security role: Prevents unauthorized users from accessing the system.

4. File Encryption
Files are stored in encrypted form; data cannot be read without a key. Only authorized users with a key can
decrypt it.
Example: Sensitive files (like financial data) are encrypted to prevent misuse.
Security role: Protects data confidentiality even if files are stolen.

5. File Ownership
Each file has an owner who controls its permissions. The OS enforces ownership rules.
Example: Only the creator of a file can change its permissions.
Security role: Ensures accountability and controlled access.

6. Password Protection for Files

Some systems allow files to be protected with individual passwords.
Example: A document requires a password before opening.
Security role: Adds an extra layer of protection for sensitive files.

7. Backup and Recovery

Regular backups protect files from loss, corruption, or attacks.
Example: If a file is deleted accidentally, it can be restored from backup.
Security role: Ensures data availability and recovery after failures or attacks.

8. Auditing and Logging

The system keeps a record of file access and operations. Tracks who accessed or modified a file; helps
detect suspicious activities.
Example: Logs show if an unauthorized user tried to access a secure file.
Security role: Helps in monitoring and detecting security violations.

Q4. Describe the importance of user authentication in operating systems. Compare

different authentication techniques.
User authentication is the process of verifying the identity of a user before allowing access to an operating
system.

Importance:
• Prevents unauthorized access: Only valid users can use the system
• Protects sensitive data: Personal and system files remain secure
• Ensures accountability: User actions can be tracked
• Supports access control: Different users get different permissions
• Improves system security: Reduces risk of hacking and misuse
Example: While logging into Gmail, the system checks your credentials before granting access.
1. Single-Factor Authentication (SFA)
Uses only one factor, usually a password. The user enters login credentials (username and password). If
correct, access is granted.
Example: Login into Facebook using only a password.
Advantages: Simple and fast; Easy to implement
Disadvantages: Low security; Vulnerable to hacking

2. Two-Factor Authentication (2FA)

Uses two different factors for verification. After entering the password, the user must provide a second
factor such as an OTP or verification code.
Example: Login into Google Account using password and OTP generated via Google Authenticator.
Advantages: More secure than SFA; Reduces risk of unauthorized access
Disadvantages: Requires additional step; Depends on device availability

3. Multi-Factor Authentication (MFA)

Uses two or more factors: Something you know (password), Something you have (OTP/device), Something
you are (biometric).
Example: Unlocking an Apple iPhone using Face ID and passcode, or banking apps using password + OTP
+ fingerprint.
Advantages: Very high security; Strong protection against attacks
Disadvantages: More complex; Slightly time-consuming

Module 6: Web Security

Q1(a). Packet Sniffing

Definition: Packet sniffing is the process of intercepting and monitoring data packets that are transmitted
over a network. These packets contain information such as emails, web requests, passwords, and other
data.

Explanation:
• All communication over a network is divided into small units called packets.
• Packet sniffers are tools that can capture, inspect, and record these packets.
• While network administrators use sniffing to analyze and troubleshoot network traffic, attackers use it
maliciously to steal sensitive information.
• Data transmitted in plaintext (without encryption) is particularly vulnerable.
Example: A hacker connected to an unsecured Wi-Fi network can capture login credentials, messages, or
credit card details sent by other users using a packet sniffing tool like Wireshark.

Prevention:
• Always use encrypted communication like HTTPS, SSL/TLS
• Avoid using public Wi-Fi for sensitive transactions
• Use VPN (Virtual Private Network) to secure network traffic
• Implement strong network security measures
Importance in web security: Packet sniffing can lead to data theft, identity theft, and privacy breaches,
making it a critical threat to secure web communications.

Q1(b). SQL Injection

Definition: SQL Injection is a type of web application attack where an attacker inserts malicious SQL code
into a web form, URL, or input field to manipulate the backend database.

Explanation:
• Happens when web applications do not validate or sanitize user input properly.
• Allows attackers to bypass authentication, access confidential data, or modify/delete database
records.
• Commonly targets login forms, search boxes, or URL query strings.
Example: A login form asks for username and password. An attacker enters: ' OR '1'='1 — The system
interprets the query as true, granting unauthorized access.

Prevention:
• Use prepared statements or parameterized queries to prevent injection
• Validate and sanitize all user inputs
• Limit database user privileges to only necessary operations
• Implement web application firewalls to detect attacks
Importance in web security: SQL Injection can lead to unauthorized access, data theft, data corruption,
and complete compromise of the web application, making it one of the most dangerous web security
threats.

Q2. Discuss IPsec protocol in detail. Also state its applications.

IPsec (Internet Protocol Security) is a suite of protocols used to secure Internet Protocol (IP)
communications by authenticating and encrypting each IP packet in a data stream.

Purpose:
• Provides confidentiality, integrity, and authentication for IP packets.
• Protects data transmitted over public networks like the Internet.
Key Features:
• Works at the network layer, so it can secure all traffic between hosts, networks, or gateways.
• Can be used in both IPv4 and IPv6 networks.
Components of IPsec:
1. Protocols for Security Services:
• AH (Authentication Header): Provides authentication and integrity but does not encrypt the payload.
• ESP (Encapsulating Security Payload): Provides encryption, authentication, and integrity.
2. Security Associations (SA): Defines the parameters and keys used for secure communication.
Includes encryption algorithms, keys, and protocols.
3. Key Management: Uses protocols like IKE (Internet Key Exchange) to automatically negotiate keys
and security parameters.

Modes of IPsec:
1. Transport Mode: Only the payload of the IP packet is encrypted/authenticated. The IP header is left
intact. Used for end-to-end communication between two hosts.
2. Tunnel Mode: The entire IP packet is encrypted and encapsulated inside a new IP packet. Used for
VPNs to connect networks securely over the Internet.

Security Services Provided:

• Confidentiality: Encrypts data to prevent eavesdropping
• Authentication: Verifies the identity of communicating parties
• Data Integrity: Ensures that data is not tampered with during transmission
• Anti-Replay Protection: Prevents attackers from re-sending captured packets
Applications of IPsec:
1. Virtual Private Networks (VPNs): Secure connection between remote offices or users over the Internet.
2. Secure Host-to-Host Communication: Encryption of traffic between servers or devices in sensitive
environments.
3. Protecting IP Telephony (VoIP): Ensures confidentiality and integrity of voice data.
4. Secure Remote Access: Allows employees to securely access corporate networks from home or mobile
devices.
5. Network-to-Network Security: Secures traffic between firewalls or gateways in different locations.

Advantages of IPsec:
• Transparent to applications (works at network layer)
• Strong security with authentication, encryption, and integrity
• Flexible: supports multiple encryption and authentication algorithms
• Widely used for secure Internet communications

Q3. Explain Buffer Overflow Attack

Definition: A buffer overflow attack occurs when a program writes more data into a buffer (a temporary
storage area in memory) than it can hold. This overwrites adjacent memory, potentially allowing attackers
to inject malicious code or crash the system.

How Buffer Overflow Happens:

• Programs allocate a fixed-size memory buffer to store data (e.g., user input).
• If the program does not check the input size, an attacker can input excess data.
• This extra data may overwrite: Other variables, Return addresses on the stack, Control structures of
the program.
Result: The attacker can execute arbitrary code, gain unauthorized access, or cause a system crash.

Types of Buffer Overflow Attacks:

1. Stack-based overflow: Overwrites the stack memory, including return addresses.
2. Heap-based overflow: Overwrites dynamically allocated memory (heap).
3. Integer overflow: Occurs when arithmetic operations exceed the maximum value for a variable,
affecting buffer allocation.

Q4. What is DDoS attack? Explain how it is launched.

Definition: A DDoS (Distributed Denial of Service) attack is a cyberattack in which multiple systems are
used to flood a target server, website, or network with excessive traffic, making it slow or completely
unavailable to legitimate users.

Explanation:
• In a normal situation, a server handles a limited number of user requests.
• In a DDoS attack, thousands or millions of requests are sent simultaneously from different sources.
• This overloads the server's resources (CPU, memory, bandwidth), causing it to crash or become
unresponsive.
How DDoS Attack is Launched:
Step 1: Creation of Botnet: The attacker infects many computers/devices with malware. These infected
devices are called bots or zombies. The collection of these devices is called a botnet.
Example: Computers, smartphones, or IoT devices (like cameras) can become bots without the owner's
knowledge.
 Step 2: Command and Control (C&C): The attacker uses a command-and-control server to control all
bots. Bots wait for instructions from the attacker.
Step 3: Sending Attack Requests: The attacker sends a command to all bots to target a specific server or
website. All bots start sending a large number of requests at the same time.
Step 4: Server Overload: The target server becomes overwhelmed due to excessive traffic. Legitimate
users cannot access the service → Denial of Service.

Types of DDoS Attacks:

• Volume-based attacks: Flood bandwidth (e.g., UDP flood)
• Protocol attacks: Exploit server resources (e.g., SYN flood)
• Application-layer attacks: Target web applications (e.g., HTTP flood)
Example: A popular website is targeted by a botnet sending millions of requests per second, causing the
website to crash and become unavailable to real users.

Q5. What is ICMP Flood Attack? Explain in detail.

Definition: An ICMP Flood Attack is a type of Denial of Service (DoS) or Distributed Denial of Service
(DDoS) attack in which an attacker sends a large number of ICMP (Internet Control Message Protocol)
echo request packets (ping requests) to a target system to overwhelm it and make it unavailable.

Explanation:
• ICMP is normally used for network diagnostics (e.g., the ping command).
• When a system receives an ICMP echo request, it replies with an echo reply.
• In an ICMP flood attack, the attacker sends massive numbers of ping requests.
• The target system tries to respond to all requests, which consumes bandwidth and system resources.
• As a result, the system becomes slow or completely unresponsive.
How ICMP Flood Attack Works:
Step 1: Sending ICMP Requests: The attacker (or botnet in DDoS) sends a large number of ICMP echo
request packets to the target.
Step 2: Target Responds: The target system replies to each request with an ICMP echo reply.
Step 3: Resource Exhaustion: Continuous request-response traffic consumes Network bandwidth, CPU
and memory.
Step 4: Denial of Service: The system cannot handle legitimate user requests and becomes unavailable.
Example: An attacker sends thousands of ping requests per second to a web server. The server becomes
overloaded and cannot respond to real users trying to access the website.

Types of ICMP Flood Attacks:

1. Direct ICMP Flood: Attacker directly sends ICMP requests to the target.
2. Distributed ICMP Flood (DDoS): Multiple infected devices (botnet) send ICMP packets simultaneously,
making the attack more powerful.

Effects of ICMP Flood Attack:

• Network congestion
• Slow system performance
• Service unavailability
• Possible system crash

Viva Institute of Technology | CSS Assignment-2 Notes | For Educational Use