20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

How Internet/Application works, Network Architecture Concepts,

Understanding Vulnerabilities in different OSI layers and protocols

1. How Internet/Application works (Security aspects – end-to-end packet path):

The Internet, sometimes called simply "the Net," is a worldwide system of computer networks -- a
network of networks in which users at any one computer can get information from any other computer (and
sometimes talk directly to users at other computers). Computers connected to the internet are called clients and
servers. A simplified diagram of how they interact might look like this:

• Clients are the typical web user's internet-connected devices (for example, your computer connected to your
Wi-Fi, or your phone connected to your mobile network) and web-accessing software available on those
devices (usually a web browser like Firefox or Chrome).
• Servers are computers that store webpages, sites, or apps. When a client device wants to access a webpage, a
copy of the webpage is downloaded from the server onto the client machine to be displayed in the user's web
browser.

How the Internet works

The Internet can be seen as having two major components: Network protocols and
Hardware. The protocols, such as the TCP/IP suite, present sets of rules that devices must follow in order to
complete tasks. Without this common collection of rules, machines would not be able to communicate.
The protocols are also responsible for translating the alphabetic text of a message into electronic signals that
can be transmitted over the Internet, and then back again into legible, alphabetic text. Hardware, the second
major component of the Internet, includes everything from the computer or smartphone that is used to access
the Internet to the cables that carry information from one device to another. Additional types of hardware
include satellites, radios, cell phone towers, routers and servers.
These various types of hardware are the connections within the network. Devices such as computers,
smartphones and laptops are end points, or clients, while the machines that store the information are the
servers. The transmission lines that exchange the data can either be wireless signals from satellites or 4G and
cell phone towers, or physical lines, such as cables and fiber optics.
The process of transferring information from one device to another relies on packet switching. Each computer
connected to the Internet is assigned a unique IP address that allows the device to be recognized. When one
device attempts to send a message to another device, the data is sent over the Internet in the form of
manageable packets. Each packet is assigned a port number that will connect it to its endpoint.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 1|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

A packet that has both a unique IP address and port number can be translated from alphabetic text into
electronic signals by travelling through the layers of the OSI model from the top application layer to the
bottom physical layer. The message will then be sent over the Internet where it is received by the Internet
service provider's (ISP) router. The router will examine the destination address assigned to each packet and
determine where to send it.
Eventually, the packet reaches the client and travels in reverse from the bottom physical layer of the OSI model
to the top application layer. During this process, the routing data -- the port number and IP address -- is
stripped from the packet, thus allowing the data to be translated back into alphabetic text and completing the
transmission process.

2. Network Architecture Concepts

Computer Network Architecture

Computer Network Architecture is defined as the physical and logical design of the software, hardware,
protocols, and media of the transmission of data. Simply we can say that how computers are organized and how
tasks are allocated to the computer.

The two types of network architectures are used:

o Peer-To-Peer network o Client/Server network

Peer-To-Peer network o Peer-To-Peer network is a network in which all the computers are linked together with
equal privilege and responsibilities for processing the data.
o Peer-To-Peer network is useful for small environments, usually up to 10 computers.
o Peer-To-Peer network has no dedicated server. o Special permissions are assigned to each computer for sharing
the resources, but this can lead to a problem if the computer with the resource is down.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 2|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Client/Server Network o Client/Server network is a network model designed for the end users called clients, to
access the resources such as songs, video, etc. from a central computer known as Server.
o The central controller is known as a server while all other computers in the network are called clients.
o A server performs all the major operations such as security and network management.
o A server is responsible for managing all the resources such as files, directories, printer, etc.
o All the clients communicate with each other through a server. For example, if client1 wants to send some data
to client 2, then it first sends the request to the server for the permission. The with the client 2.

3. Vulnerabilities in Different OSI Layers:

1. Physical Layer Vulnerabilities:

Network vulnerability which occurs in this layer is,

1. Access Control: Permitting only authorized personnel to access. Physical security keeps safe from
unauthorized access. Restricting access to critical servers and using strong passwords can prevent many
attacks.
2. Damage data bits.
3. Environmental issues: Environmental issues at the Physical layer include fire, smoke, water, Less control
over environmental factors such as temperature, humidity, dust, and ventilation can cause frequent failures.
4. Disconnection of Physical Links.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 3|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

2. Data Link Layer Vulnerabilities

1. ARPs/ARP spoofing
ARP spoofing is targeted to rogue switch to forward packets to a different VLAN. Security vulnerability occurs
at the lower layer of OSI model but affects upper layer security. To prevent these attack, configuration is
performed to ignore gratuitous ARPs. Edge VLAN (Private VLANs) segregation and ARP inspection to mitigate
this threat.

2. MAC Flooding
MAC flooding is the attack on the network [Link] Flooding occurs when the MAC table of a switch
reaches its capacity and then floods. A malicious user can sniff the flooded traffic to gather network sensitive
information.

3. Spanning Tree Attacks

Occurs when an attacker inserts itself into a data stream and causes a DoS attack. STP attack begins with a
physical attack by a malicious user who inserts an unauthorized switch. Attacker assigns a lower root priority.
Assigning the lower root priority causes the network connection between two switches to be dropped. The
attacker’s switch thereby becomes the root switch, and the attacker get full control to data transmitted between
all switches. One-way of mitigating this problem is configuring a network’s root switch with Root Priority = 0.
Other Data Link attacks are –
a. Private VLAN attack
b. Multicast brute force attack
c. Random frame stress attack

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 4|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

3. Network Layer Vulnerabilities

1. Route attacks - propagation of false network topology.
2. IP Address Spoofing- false source addressing on malicious packets or IP address forgery.
3. Black Hole/Selective Forwarding - Malicious node acts like Black hole it discards the packets.

4. Transport Layer Vulnerabilities

1. Overloading of transport-layer mechanisms such as port numbers limit the ability to effectively filter and qualify
traffic.
2. Smurf arrack is a DoS Attack in which a system is flooded with spoofed ping messages. Attacker generates
lots of ICMP Packets with the intended victims IP Address and Broadcasts those packets. As a result, most of
devices in network respond.
3. Transmission mechanisms can be subject to spoofing and attack based on crafted packets and the educated
guessing of flow and transmission values, allowing the disruption or seizure of control of communications.

5. Session Layer Vulnerabilities

1. Weak or non-existent authentication mechanisms
2. Passing of session credentials such as user ID and password in the clear, allowing intercept and unauthorized
use.
3. Session identification may be subject to spoofing and hijack Leakage of information based on failed
authentication attempts Unlimited failed sessions allow brute-force attacks on access credentials
4. Session Hijacking
5. Security attack on a user session. A session hijacking attack works when it compromises the token by guessing
what an authentic token session will be, thus acquiring unauthorized access to the Web server.

6. Presentation Layer Vulnerabilities

1. Phishing attack: attempt to acquire sensitive data.
2. SSL hijacking : it is a process to get user encrypted data
3. Poor handling of unexpected input can lead to application crashes or surrender of control to execute arbitrary
instructions.
4. Cryptographic flaws may be exploited to circumvent privacy protections

7. Application Layer Vulnerabilities

There are different attacks on application layer and some of them are: –
Virus, Worm, Phishing, Key Loggers, Backdoors, Program logic flaws, Bugs, Trojan Horses, Keystroke & Other
Input Logging
1. Open design issues allow free use of application resources by unintended parties Backdoors and application
design flaws bypass standard security controls
2. Inadequate security controls force “all-or-nothing” approach, resulting in either excessive or insufficient access.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 5|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

4. OSI Model Protocols

TCP/IP is a large family of protocols that is named after its two most important members. Figure 1 shows the
TCP/IP protocols used by CICS. TCP/IP, in terms of the layered Open Systems Interconnection (OSI) model,
which is widely used to describe data communication systems. For CICS users who might be more accustomed
to SNA, the left side of figure shows the SNA layers, which correspond very closely to the OSI layers.

• Transmission Control Protocol (TCP)

In terms of the OSI model, TCP is a transport-layer protocol.

It provides a reliable virtual-circuit connection between applications; that is, a connection is established
before data transmission begins.
Data is sent without errors or duplication and is received in the same order as sent. it is No boundaries are
imposed on the data;
TCP treats the data as a stream of bytes.

• Use r Datagram Protocol (UDP)

UDP is also a transport-layer protocol and is an alternative to TCP.
It provides an unreliable datagram connection between applications. Data is transmitted link by link; there is
no end-to-end connection. The service provides no guarantees. Data can be lost or duplicated, and datagrams
can arrive out of order.

• Internet Protocol (IP)

In terms of the OSI model, IP is a network-layer protocol. It provides a datagram service between applications,
supporting both TCP and UDP.

• Internet Control Message Protocol (ICMP)

The Internet Control Message Protocol (ICMP) is a network layer protocol used by network devices to
diagnose network communication issues.
ICMP is mainly used to determine whether or not data is reaching its intended destination in a timely manner.
Commonly, the ICMP protocol is used on network devices, such as routers. ICMP is crucial for error reporting
and testing, but it can also be used in distributed denial-of-service (DDoS) attacks.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 6|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

FIREWALL

Almost every medium and large-scale organization has a presence on the Internet and has an organizational network
connected to it. Network partitioning at the boundary between the outside Internet and the internal network is essential
for network security. Sometimes the inside network (intranet) is referred to as the “trusted” side and the external Internet
as the “untrusted” side.

Types of Firewall

Firewall is a network device that isolates organization’s internal network from larger outside network/Internet. It can be a
hardware, software, or combined system that prevents unauthorized access to or from internal network.

All data packets entering or leaving the internal network pass through the firewall, which examines each packet and blocks
those that do not meet the specified security criteria.

Deploying firewall at network boundary is like aggregating the security at a single point. It is analogous to locking an
apartment at the entrance and not necessarily at each door.

Firewall is considered as an essential element to achieve network security for the following reasons − • Internal network
and hosts are unlikely to be properly secured.
• Internet is a dangerous place with criminals, users from competing companies, disgruntled ex-employees,
spies from unfriendly countries, vandals, etc.
• To prevent an attacker from launching denial of service attacks on network resource.
• To prevent illegal modification/access to internal data by an outsider attacker.

Firewall is categorized into three basic types −

• Packet filter (Stateless & Stateful)

• Application-level gateway
• Circuit-level gateway
These three categories, however, are not mutually exclusive. Modern firewalls have a mix of abilities that may place them
in more than one of the three categories.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 7|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Stateless & Stateful Packet Filtering Firewall

In this type of firewall deployment, the internal network is connected to the external network/Internet via a router
firewall. The firewall inspects and filters data packet-by-packet.

Packet-filtering firewalls allow or block the packets mostly based on criteria such as source / destination IP addresses,
protocol, source/destination port numbers, and various other parameters within the IP header.

The decision can be based on factors other than IP header fields such as ICMP message type, TCP SYN and ACK bits, etc.

Packet filter rule has two parts −

• Selection criteria − It is a used as a condi on and pa ern matching for decision making.
• Action field − This part specifies ac on to be taken if an IP packet meets the selec on criteria. The ac on
could be either block (deny) or permit (allow) the packet across the firewall.
Packet filtering is generally accomplished by configuring Access Control Lists (ACL) on routers or switches. ACL is a table of
packet filter rules.

As traffic enters or exits an interface, firewall applies ACLs from top to bottom to each incoming packet, finds matching
criteria and either permits or denies the individual packets.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 8|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Stateless firewall is a kind of a rigid tool. It looks at packet and allows it if its meets the criteria even if it is not part of any
established ongoing communication.

Hence, such firewalls are replaced by stateful firewalls in modern networks. This type of firewalls offer a more in-depth
inspection method over the only ACL based packet inspection methods of stateless firewalls.

Stateful firewall monitors the connection setup and teardown process to keep a check on connections at the TCP/IP level.
This allows them to keep track of connections state and determine which hosts have open, authorized connections at any
given point in time.

They reference the rule base only when a new connection is requested. Packets belonging to existing connections are
compared to the firewall's state table of open connections, and decision to allow or block is taken. This process saves time
and provides added security as well. No packet is allowed to trespass the firewall unless it belongs to already established
connection. It can timeout inactive connections at firewall after which it no longer admit packets for that connection.

Application Gateways

An application-level gateway acts as a relay node for the application-level traffic. They intercept incoming and outgoing
packets, run proxies that copy and forward information across the gateway, and function as a proxy server, preventing any
direct connection between a trusted server or client and an untrusted host.

The proxies are application specific. They can filter packets at the application layer of the OSI model.

Application-specific Proxies

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 9|Page

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

An application-specific proxy accepts packets generated by only specified application for which they are designed to copy,
forward, and filter. For example, only a Telnet proxy can copy, forward, and filter Telnet traffic.

If a network relies only on an application-level gateway, incoming and outgoing packets cannot access services that have
no proxies configured. For example, if a gateway runs FTP and Telnet proxies, only packets generated by these services can
pass through the firewall. All other services are blocked. Application-level Filtering
An application-level proxy gateway, examines and filters individual packets, rather than simply copying them and blindly
forwarding them across the gateway. Application-specific proxies check each packet that passes through the gateway,
verifying the contents of the packet up through the application layer. These proxies can filter particular kinds of commands
or information in the application protocols.

Application gateways can restrict specific actions from being performed. For example, the gateway could be configured to
prevent users from performing the ‘FTP put’ command. This can prevent modification of the information stored on the
server by an attacker.

Transparent
Although application-level gateways can be transparent, many implementations require user authentication before users
can access an untrusted network, a process that reduces true transparency. Authentication may be different if the user is
from the internal network or from the Internet. For an internal network, a simple list of IP addresses can be allowed to
connect to external applications. But from the Internet side a strong authentication should be implemented.

An application gateway actually relays TCP segments between the two TCP connections in the two directions (Client ↔
Proxy ↔ Server).

For outbound packets, the gateway may replace the source IP address by its own IP address. The process is referred to as
Network Address Translation (NAT). It ensures that internal IP addresses are not exposed to the Internet.

Circuit-Level Gateway

 It helps in providing the security between UDP and TCP

 It work at session layer of the OSI model
 It monitors TCP data handshaking and session fulfilment of firewall rules and policies.

The circuit-level gateway is an intermediate solution between the packet filter and the application gateway. It runs at the
transport layer and hence can act as proxy for any application.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 10 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Similar to an application gateway, the circuit-level gateway also does not permit an end-to-end TCP connection across the
gateway. It sets up two TCP connections and relays the TCP segments from one network to the other. But, it does not
examine the application data like application gateway. Hence, sometime it is called as ‘Pipe Proxy’.

SOCKS
SOCKS (RFC 1928) refers to a circuit-level gateway. It is a networking proxy mechanism that enables hosts on one side of a
SOCKS server to gain full access to hosts on the other side without requiring direct IP reachability. The client connects to
the SOCKS server at the firewall. Then the client enters a negotiation for the authentication method to be used, and
authenticates with the chosen method.

The client sends a connection relay request to the SOCKS server, containing the desired destination IP address and
transport port. The server accepts the request after checking that the client meets the basic filtering criteria. Then, on
behalf of the client, the gateway opens a connection to the requested untrusted host and then closely monitors the TCP
handshaking that follows.

The SOCKS server informs the client, and in case of success, starts relaying the data between the two connections. Circuit
level gateways are used when the organization trusts the internal users, and does not want to inspect the contents or
application data sent on the Internet.

Firewall Deployment with DMZ

A firewall is a mechanism used to control network traffic ‘into’ and ‘out’ of an organizational internal network. In most
cases these systems have two network interfaces, one for the external network such as the Internet and the other for the
internal side.

The firewall process can tightly control what is allowed to traverse from one side to the other. An organization that wishes
to provide external access to its web server can restrict all traffic arriving at firewall expect for port 80 (the standard http
port). All other traffic such as mail traffic, FTP, SNMP, etc., is not allowed across the firewall into the internal network. An
example of a simple firewall is shown in the following diagram.

In the above simple deployment, though all other accesses from outside are blocked, it is possible for an attacker to
contact not only a web server but any other host on internal network that has left port 80 open by accident or otherwise.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 11 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Hence, the problem most organizations face is how to enable legitimate access to public services such as web, FTP, and e-
mail while maintaining tight security of the internal network. The typical approach is deploying firewalls to provide a
Demilitarized Zone (DMZ) in the network.

In this setup (illustrated in following diagram), two firewalls are deployed; one between the external network and the DMZ,
and another between the DMZ and the internal network. All public servers are placed in the DMZ.

With this setup, it is possible to have firewall rules which allow public access to the public servers but the interior firewall
can restrict all incoming connections. By having the DMZ, the public servers are provided with adequate protection instead
of placing them directly on external network.

INTRUSION DETECTION / PREVENTION SYSTEM

The packet filtering firewalls operate based on rules involving TCP/UDP/IP headers only. They do not attempt to establish
correlation checks among different sessions.

Intrusion Detection/Prevention System (IDS/IPS) carry out Deep Packet Inspection (DPI) by looking at the packet contents.
For example, checking character strings in packet against database of known virus, attack strings.

Application gateways do look at the packet contents but only for specific applications. They do not look for suspicious data
in the packet. IDS/IPS looks for suspicious data contained in packets and tries to examine correlation among multiple
packets to identify any attacks such as port scanning, network mapping, and denial of service and so on.

Difference between IDS and IPS

IDS and IPS are similar in detection of anomalies in the network. IDS is a ‘visibility’ tool whereas IPS is considered as a
‘control’ tool.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 12 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

Intrusion Detection Systems sit off to the side of the network, monitoring traffic at many different points, and provide
visibility into the security state of the network. In case of reporting of anomaly by IDS, the corrective actions are initiated
by the network administrator or other device on the network.

Intrusion Prevention System are like firewall and they sit in-line between two networks and control the traffic going
through them. It enforces a specified policy on detection of anomaly in the network traffic. Generally, it drops all packets
and blocks the entire network traffic on noticing an anomaly till such time an anomaly is addressed by the administrator.

Types of IDS

types of IDS.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 13 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

• Signature-based IDS
 It needs a database of known attacks with their signatures.
 Signature is defined by types and order of packets characterizing a particular attack.
 Limitation of this type of IDS is that only known attacks can be detected. This IDS can also throw up a false
alarm. False alarm can occur when a normal packet stream matches the signature of an attack.
 Well-known public open-source IDS example is “Snort” IDS.
• Anomaly-based IDS
 This type of IDS creates a traffic pattern of normal network operation.
 During IDS mode, it looks at traffic patterns that are statistically unusual. For example, ICMP unusual load,
exponential growth in port scans, etc.
 Detection of any unusual traffic pattern generates the alarm.
 The major challenge faced in this type of IDS deployment is the difficulty in distinguishing between normal
traffic and unusual traffic.
 Host based IDS
 Network based IDS
What Is a VPN? - Virtual Private Network

A virtual private network, or VPN, is an encrypted connection over the Internet from a device to a network. The encrypted
connection ensure that sensitive data is safely transmitted.
It prevents unauthorized people from eavesdropping on the traffic and allows the user to conduct work remotely. VPN
technology is widely used in corporate environments.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 14 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 1: Network Security: Concepts- Firewall, IDS, IPS,VPN

VPN creates an encrypted connection that is called VPN tunnel, and all Internet traffic and communication is passed
through this secure tunnel.

How does a virtual private network (VPN) work?

A VPN extends a corporate network through encrypted connections made over the Internet. Because the traffic is
encrypted between the device and the network, traffic remains private as it travels. An employee can work outside the
office and still securely connect to the corporate network. Even smartphones and tablets can connect through a VPN.

What is secure remote access?

Secure remote access provides a safe, secure way to connect users and devices remotely to a corporate network. It
includes VPN technology that uses strong ways to authenticate the user or device. VPN technology is available to check
whether a device meets certain requirements, also called a device’s posture, before it is allowed to connect remotely.
Is VPN traffic encrypted?
Yes, traffic on the virtual network is sent securely by establishing an encrypted connection across the Internet known as a
tunnel.
VPN traffic from a device such as a computer, tablet, or smartphone is encrypted as it travels through this tunnel. Offsite
employees can then use the virtual network to access the corporate network.

Tunneling and Virtual Private Networks (Figure ) are also implicated in OSI Layer 2. Tunneling is a method using the Internet
framework to transfer data from one network to another. Tunneling encapsulates packets in a base protocol format within
some other protocol over the Internet. Virtual Private Networks (VPN) encapsulates packets within an IP packet. Virtual
Private Networks exist on OSI Layers 2 and 3 and are dependent on what VPN protocols are used. OSI Layer 5 also supports
a VPN protocol (Figure 5). VPNs work hard to prevent hackers from gaining access to data crossing the Internet.

Figure 5 VPN Connection [5] At the Data layer of the OSI model, Point-to-Point Tunneling Protocol (PPTP) and Layer Two
Tunneling Protocol (L2TP) are implemented. PPTP is popular because Microsoft was one of the developers of this protocol
and PPTP is used on their OS platforms. PPTP supports non-IP standards but does not support a single standard that will
work across platforms. L2TP was created by Cisco to improve upon PPTP. L2TP also supports non-IP standards but includes
Frame Relay, ATM, and Sonet. Like PPTP, L2TP does not support a single standard. IPsec VPN protocol is more popular with
less expensive routers and will be discussed further in the next section. Because the appliances normally used to implement
VPNs are routers and firewalls, further discussion will occur in the next section under Layer 3 (Router/Firewall Security).

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 15 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

TYPES OF VPN
1. Remote Access VPN
Remote Access VPN permits a user to connect to a private network and access all its services and
resources remotely. The connection between the user and the private network occurs through the Internet
and the connection is secure and private. Remote Access VPN is useful for home users and business
users both. An employee of a company, while he/she is out of station, uses a VPN to connect to his/her
company’s private network and remotely access files and resources on the private network. Private users
or home users of VPN, primarily use VPN services to bypass regional restrictions on the Internet and
access blocked websites. Users aware of Internet security also use VPN services to enhance their Internet
security and privacy.
2. Site to Site VPN
A Site-to-Site VPN is also called as Router-to-Router VPN and is commonly used in the large
companies. Companies or organizations, with branch offices in different locations, use Site-to-site VPN
to connect the network of one office location to the network at another office location.
 Intranet based VPN: When several offices of the same company are connected using Site-to-Site
VPN type, it is called as Intranet based VPN.
 Extranet based VPN: When companies use Site-to-site VPN type to connect to the office of another
company, it is called as Extranet based VPN.
3. Cloud VPN
A Cloud VPN is a virtual private network that allows users to securely connect to a cloud-based
infrastructure or service. It uses the internet as the primary transport medium to connect the remote users
to the cloud-based resources. Cloud VPNs are typically offered as a service by cloud providers such as
Amazon Web Services (AWS) and Microsoft Azure. It uses the same encryption and security protocols
as traditional VPNs, such as IPsec or SSL, to ensure that the data transmitted over the VPN is secure.
Cloud VPNs are often used by organizations to securely connect their on-premises resources to cloud-
based resources, such as cloud-based storage or software-as-a-service (SaaS) applications.
4. Mobile VPN
Mobile VPN is a virtual private network that allows mobile users to securely connect to a private
network, typically through a cellular network. It creates a secure and encrypted connection between the
mobile device and the VPN server, protecting the data transmitted over the connection. Mobile VPNs
can be used to access corporate resources, such as email or internal websites, while the user is away
from the office. They can also be used to securely access public Wi-Fi networks, protecting the user’s
personal information from being intercepted. Mobile VPNs are available as standalone apps or can be
integrated into mobile device management (MDM) solutions. These solutions are commonly used by
organisations to secure their mobile workforce.
5. SSL VPN
SSL VPN (Secure Sockets Layer Virtual Private Network) is a type of VPN that uses the SSL protocol
to secure the connection between the user and the VPN server. It allows remote users to securely access
a private network by establishing an encrypted tunnel between the user’s device and the VPN server.
SSL VPNs are typically accessed through a web browser, rather than through a standalone client. This
makes them easier to use and deploy, as they don’t require additional software to be installed on the
user’s device. It can be used to access internal resources such as email, file servers, or databases. SSL
VPNs are considered more secure than traditional IPsec VPNs because they use the same encryption
protocols as HTTPS, the secure version of HTTP used for online transactions.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 16 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

6. PPTP (Point-to-Point Tunneling Protocol) VPN

PPTP (Point-to-Point Tunneling Protocol) is a type of VPN that uses a simple and fast method for
implementing VPNs. It creates a secure connection between two computers by encapsulating the data
packets being sent between them. PPTP is relatively easy to set up and doesn’t require any additional
software to be installed on the client’s device. It can be used to access internal resources such as email,
file servers, or databases. PPTP is one of the oldest VPN protocols and is supported on a wide range of
operating systems. However, it is considered less secure than other VPN protocols such as L2TP or
OpenVPN, as it uses a weaker encryption algorithm and has been known to have security vulnerabilities.
7. L2TP (Layer 2 Tunneling Protocol) VPN
L2TP (Layer 2 Tunneling Protocol) is a type of VPN that creates a secure connection by encapsulating
data packets being sent between two computers. L2TP is an extension of PPTP, it adds more security to
the VPN connection by using a combination of PPTP and L2F (Layer 2 Forwarding Protocol) and it uses
stronger encryption algorithm than PPTP. L2TP is relatively easy to set up and doesn’t require additional
software to be installed on the client’s device. It can be used to access internal resources such as email,
file servers, or databases. It is supported on a wide range of operating systems, but it is considered less
secure than other VPN protocols such as OpenVPN, as it still has some vulnerabilities that can be
exploited.
8. OpenVPN
OpenVPN is an open-source software application that uses SSL and is highly configurable and secure.
It creates a secure and encrypted connection between two computers by encapsulating the data packets
being sent between them. OpenVPN can be used to access internal resources such as email, file servers,
or databases. It is supported on a wide range of operating systems and devices, and can be easily
configured to work with various network configurations and security settings. It is considered one of the
most secure VPN protocols as it uses the industry standard SSL/TLS encryption protocols and it offers
advanced features such as two-factor authentication and kill switch.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 17 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

What Is IPsec?

Internet Protocol Security (IPsec) is a suite of protocols and services that provide security for IP
networks. It is a widely used virtual private network (VPN) technology. IP packets lack effective security
mechanisms and may be forged, stolen, or tampered with when being transmitted on a public
network, such as the Internet. To solve this problem, the communicating parties establish an IPsec
tunnel for encrypted transmission of IP packets. This ensures secure transmission of IP packets on an
insecure network, such as the Internet.

What Is an IPsec VPN?

Virtual private network (VPN) is a technology for establishing a private network on a public network.
It is a logical network over a public network such as the Internet, allowing user data to be transmitted
through a logical link. This is different from a traditional private network, where user data is
transmitted through an end-to-end physical link.
Common VPN protocols include IPsec, Secure Sockets Layer (SSL), Generic Routing Encapsulation
(GRE), Point-to-Point Tunneling Protocol (PPTP), and Layer 2 Tunneling Protocol (L2TP). IPsec is a
commonly used VPN technology and applies to multiple network access scenarios.
IPsec VPN is a VPN technology that uses IPsec for remote access. The technology allows establishing
an IPsec tunnel between two or more private networks on a public network and using encryption and
authentication algorithms to ensure the security of VPN connections.

IPsec VPN protects point-to-point communication by establishing secure tunnels between hosts,
between hosts and network security gateways, or between network security gateways (such as routers
and firewalls). It operates at the IP layer to encrypt and authenticate data packets.
Compared with other VPN technologies, IPsec VPN is more secure because data is encrypted for
transmission in IPsec tunnels. However, the configuration and networking deployment of IPsec VPN
are more complex.

IPsec VPN
In the following figure, the IPsec sender uses the encryption algorithm and encryption key to encrypt
an IP packet, that is, it encapsulates the original data. Then the sender and receiver use the same
authentication algorithm and authentication key to process the encrypted packets to obtain the
integrity check value (ICV). If the ICVs obtained at both ends are the same, the packet is not tampered
with during transmission, and the receiver decrypts the packet. If the ICVs are different, the receiver
discards the packet.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 18 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

(** This hash, an integrity check value (ICV), can be either Message Authentication Code (MAC) or a
digital signature.)

What is an SSL Certificate?

SSL stands for Secure Sockets Layer and, in short, it's the standard technology for keeping an internet
connection secure and safeguarding any sensitive data that is being sent between two systems,
preventing criminals from reading and modifying any information transferred, including potential
personal details. The two systems can be a server and a client (for example, a shopping website and
browser) or server to server (for example, an application with personal identifiable information or with
payroll information).

It does this by making sure that any data transferred between users and sites, or between two systems
remain impossible to read. It uses encryption algorithms to scramble data in transit, preventing
hackers from reading it as it is sent over the connection. This information could be anything sensitive
or personal which can include credit card numbers and other financial information, names and
addresses.

TLS (Transport Layer Security) is just an updated, more secure, version of SSL. We still refer to our
security certificates as SSL because it is a more commonly used term, but when you are buying SSL
from DigiCert you are actually buying the most up-to-date TLS certificates with the option of ECC, RSA
or DSA encryption.

HTTPS (Hyper Text Transfer Protocol Secure) appears in the URL when a website is secured by an SSL
certificate. The details of the certificate, including the issuing authority and the corporate name of the
website owner, can be viewed by clicking on the lock symbol on the browser bar.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 19 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

IPsec VPN vs SSL VPN

IPsec and SSL are the most commonly used VPN technologies. Both of them have encryption and
authentication mechanisms to ensure remote access security. The following compares IPsec VPN and
SSL VPN:

• Working layers of the OSI reference model

OSI defines a seven-layer framework for network interconnection: physical layer, data link
layer, network layer, transport layer, session layer, presentation layer, and application
layer. IPsec works at the network layer and directly runs over the Internet Protocol (IP).
SSL, working at the application layer, is an application-layer protocol that encrypts
HTTP traffic instead of IP packets.

Working layers of IPsec and SSL

• Configuration and deployment

IPsec VPN is applicable to site-to-site networking. In this networking, VPN gateways must
be deployed at each site, or remote users need to install dedicated VPN clients. Therefore,
the configuration and deployment are complex, and the maintenance cost is high. SSL VPN
is applicable to client-to-site networking. In this networking, remote users only need to
install the specified plug-in on the standard SSL-supporting browser. A VPN gateway is
deployed in a data center for centralized management and maintenance. Therefore, the
configuration and deployment are simple, and the maintenance cost is low.

IPsec VPN

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 20 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

SSL VPN
• Security
IPsec works at the network layer to protect all data transmitted between sites. IPsec VPN
requires remote users to install a dedicated VPN client or deploy a VPN gateway at the site.
User access is checked by the client or gateway in terms of user authentication rules,
security policy rules, or content security filtering. Therefore, IPsec VPN is more secure. SSL
VPN does not require dedicated clients or gateways at access sites. Therefore, SSL VPN is
more vulnerable to security threats.
• Access control
IPsec works at the network layer and cannot implement fine-grained access control based
on applications. SSL VPN is more flexible in fine-grained access control. Network
administrators can classify network resources into different types based on application
types. Each type of resources has different access permissions.

Introduction to Wireless Security

Wireless networks are complex; there are many technologies and protocols required to offer a
stable wireless network to end-users. It also sounds scary to transmit data through the air, where
everyone can listen to it.

Wired networks feel secure; after all, you can’t easily listen to this traffic. You could connect to a
switchport, but the only unicast traffic you’ll see is the traffic between your computer and the
switch. You will see multicast and broadcast traffic from within the VLAN, though.

Anyone can see the data that travels through the air, which is why wireless security is so important.
Someone can monitor wireless traffic, and you won’t even notice that it’s happening.

Wireless Topologies

The 802.11 standard identifies two main wireless topology modes: infrastructure mode and
Independent Basic Service Set (IBSS). IBSS is also knows as ad hoc mode. With the ubiquity of
wireless networks, mesh topologies are now common.

Infrastructure Mode

With infrastructure mode, wireless clients interconnect via an AP. Figure 22-4 illustrates
infrastructure mode terminology. Notice that the configuration of the APs to share the same SSID
allows wireless clients to roam between BSAs.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 21 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

Figure 22-4 Example of ESS Infrastructure Mode

Infrastructure mode terminology includes the following:

• Basic service set (BSS): This consists of a single AP interconnecting all associated wireless
clients.
• Basic service area (BSA): This is the area that is bound by the reach of the AP’s signal. The
BSA is also called a cell (the gray area in Figure 22-4).
• Basic service set identifier (BSSID): This is the unique, machine-readable identifier for the
AP that is in the format of a MAC address and is usually derived from the AP’s wireless MAC
address.
• Service set identifier (SSID): This is a human-readable, non-unique identifier used by the
AP to advertise its wireless service.
• Distribution system (DS): APs connect to the network infrastructure using the wired DS,
such as Ethernet. An AP with a wired connection to the DS is responsible for translating
frames between 802.3 Ethernet and 802.11 wireless protocols.
• Extended service set (ESS): When a single BSS provides insufficient coverage, two or more
BSSs can be joined through a common DS into an ESS. An ESS is the union of two or more
BSSs interconnected by a wired DS. Each ESS is identified by its SSID, and each BSS is
identified by its BSSID.

IBSS, or Ad Hoc Mode

In the 802.11 standard, Independent Basic Service Set (IBSS) is defined as two devices connected
wirelessly in a peer-to-peer (P2P) manner without the use of an AP. One device takes the role of
advertising the wireless network to clients. The IBSS allows two devices to communicate directly
without the need for any other wireless devices, as shown in Figure 225. IBSSs do not scale well
beyond 8 to 10 devices.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 22 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

Figure 22-5 802.11 Independent Basic Service Set

Mesh

Having a wired DS connecting all APs is not always practical or necessary. Instead, APs can be
configured to connect in mesh mode. In this mode, APs bridge client traffic between each other, as
shown in Figure 22-6.

Figure 22-6 Example of a Wireless Mesh Network

Each AP in the mesh maintains a BSS on one channel used by wireless clients. Then the APs bridge
between each other using other channels. The mesh network runs its own dynamic routing protocol
to determine the best path to the wired network.

wireless traffic has to go through the AP, instead of directly between the sender and receiver.
Anyone in range of the AP or other wireless clients can receive the signal.

This can be a problem. For example, imagine we have a user who sends a password to a

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 23 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

Remote Server: The wireless user transmits a password to the remote server. Because the attacker
is in range of our wireless network, he can capture the password.

How can we securely transmit data through the air and ensure that it remains private and is not
tampered with? The 802.11 standard offers security mechanisms that
provide authentication, encryption, and integrity. In this lesson, I’ll give you an overview of these
three items.

Authentication

To use a wireless network, the wireless client has to discover a BSS(Basic service set (BSS): This
consists of a single AP interconnecting all associated wireless clients).

APs advertise beacons(Management Packets) with their SSID, and the wireless client selects the
wireless network it wants to connect to and associates with the AP. By

default, authentication is open, which means everyone is welcome.

You probably want to authenticate your wireless clients, though. If you have a corporate network,
you don’t want just anyone to join the network. Only legitimate users should be able to use your
wireless network. After all, the wireless network might be connected to the wired network where you
can access all corporate resources.

What if you have guest users? If you want to offer a guest wireless network, you should configure a
second SSID, linked to a VLAN with restricted access.

APs can authenticate wireless clients before they associate with the AP. This keeps rogue clients
away from our wireless network.

There are many options for wireless authentication. You are probably familiar with the most
common choice, a pre-shared key. We configure the pre-shared key on the AP. Any wireless client
that wants to join

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 24 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

the wireless network has to enter the pre-shared key.

What happens when someone steals one of the wireless clients? That’s a problem because of two
main reasons:

• The attacker has access to your pre-shared key:

o And can now connect to the wireless network from any device. o And
can decrypt traffic from other clients connected to the same wireless network.
• You need to configure a new pre-shared key on the AP and all wireless clients.

There are stronger authentication options where we ask users for a username and password instead.
This helps. When a device is stolen, at least you can pinpoint which username was compromised and
reset the password for that username. You don’t have to reset the preshared key and configure it on
all wireless clients.

Wireless Security Protocols

Wireless traffic is inherently different from traffic traveling over a wired infrastructure. Any wireless
device operating in the same frequency can hear the frames and potentially read them. Therefore,
WLANs need to be secured to allow only authorized users and devices and to prevent eavesdropping
and tampering of wireless traffic.

Wireless Authentication Methods

For wireless devices to communicate over a network, they must first associate with the AP. An
important part of the 802.11 process is discovering a WLAN and subsequently connecting to it.
During this process, transmitted frames can reach any device within range. If the wireless connection
is not secured, then others can read the traffic, as shown in Figure 22-11.

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 25 | P a g e

20CS54I – Cyber Security Week 3 Day 2 Session 2: Protocols IPSec, SSL, TLS

Figure 22-11 Open Wireless Network

The best way to secure a wireless network is to use authentication and encryption systems.

Two types of authentication were introduced with the original 802.11 standard:

• Open system authentication: Should only be used in situations where security is of no concern. The
wireless client is responsible for providing security such as by using a virtual private network (VPN) to
connect securely.
• Shared key authentication: Provides mechanisms shown in Table 22-3 to authenticate and encrypt data
between a wireless client and an AP. However, the password must be pre-shared between the parties to
allow connection.

Table 22-3 Shared Key Authentication Methods

Authentication
Description Method

Department of Collegiate & Technical Education, Bengaluru, Karnataka-560001 26 | P a g e

 Department of Collegiate and Technical Education Diploma in CS&E

The original 802.11 specification designed to secure the data using the require the use of Protected
Wired Equivalent Rivest Cipher 4 (RC4) encryption method with a static key. However, the key Management
Privacy (WEP) never changes when exchanging packets. This makes WEP easy to hack. WEP Frames (PMF).
is no longer recommended and should never be used. However, devices
A Wi-Fi Alliance standard that uses WEP but secures the data with the much with WPA3 are not
Wi-Fi Protectedstronger Temporal Key Integrity Protocol (TKIP) encryption algorithm. yet readily available.
WPA and WPA2
Access (WPA) TKIP changes the key for each packet, making it much more difficult to hack.
Home routers
typically have two
The current industry standard for securing wireless networks. It uses the
choices for
WPA2 Advanced Encryption Standard (AES) for encryption. AES is currently
authentication: WPA
considered the strongest encryption protocol.
and WPA2. WPA2 is
The next generation of Wi-Fi security. All WPA3-enabled devices use the
the stronger of the
latest security methods, disallow outdated legacy protocols, and
WPA3 two. WPA2
authentication
methods included the following:

• Personal: Intended for home or small office networks, users authenticate using a preshared key (PSK). Wireless
clients authenticate with the wireless router using a preshared password. No special authentication server is
required.
• Enterprise: Intended for enterprise networks but requires a Remote Authentication Dial-In User Service (RADIUS)
authentication server. Although more complicated to set up, it provides additional security. The device must be
authenticated by the RADIUS server, and then users must authenticate using the 802.1X standard, which uses
Extensible Authentication Protocol (EAP) for authentication.

802.1X/EAP

With open and WEP authentication, wireless clients are authenticated locally at the AP without further intervention. The
scenario changes with 802.1X: The client uses open authentication to associate with the AP, and then the client
authentication process occurs at a dedicated authentication server. Figure 22-11 shows the three-party 802.1X
arrangement, which consists of the following entities:

• Supplicant: The client device that is requesting access.

• Authenticator: The network device that provides access to the network. In Figure 22-
11, the AP forwards the supplicant’s message to the WLC.
• Authentication server (AS): The device that permits or denies network access based on a user database and
policies (usually a RADIUS server).

WPA3

WPA3 includes four features:

• WPA3-Personal: In WPA2-Personal, threat actors can listen in on the “handshake” between a wireless client and
the AP and use brute-force attacks to try to guess the PSK. WPA3-Personal thwarts such attacks by using
Simultaneous Authentication of Equals (SAE), a feature specified in the IEEE 802.11-2016. The PSK is never
exposed, making it impossible for the threat actor to guess.
• WPA3-Enterprise: WPA3-Enterprise still uses 802.1X/EAP authentication. However, it requires the use of a 192-
bit cryptographic suite and eliminates the mixing of security protocols for previous 802.11 standards. WPA3-

[Cyber Security-20CS541] Page 27

 Department of Collegiate and Technical Education Diploma in CS&E

Enterprise adheres to the Commercial National Security Algorithm (CNSA) suite, which is commonly used in high-
security Wi-Fi networks.
• Open networks: Open networks in WPA2 send user traffic in unauthenticated plaintext. In WPA3, open or public
Wi-Fi networks still do not use any authentication. However, they do use Opportunistic Wireless Encryption (OWE)
to encrypt all wireless traffic.
• IoT onboarding: Although WPA2 included Wi-Fi Protected Setup (WPS) to quickly onboard devices that were not
previously configured, WPS is vulnerable to a variety of attacks and is not recommended. Furthermore, IoT
devices are typically headless, meaning they have no built-in GUI for configuration and need any easy way to get
connected to the wireless network. Device Provisioning Protocol (DPP) was designed to address this need. Each
headless device has a hard-coded public key. The key is typically stamped on the outside of the device or its
packaging as a Quick Response (QR) code. The network administrator can scan the QR code and quickly onboard
the device. Although DPP is not strictly part of the WPA3 standard, it will replace WPS over time.

Wireless Encryption Methods

Encryption is used to protect data. An intruder may be able to captured encrypted data, but he or she would not be able
to decipher it in any reasonable amount of time. The following encryption protocols are used with wireless authentication:

• Temporal Key Integrity Protocol (TKIP): TKIP is the encryption method used by WPA. It provides support for
legacy WLAN equipment and addresses the original flaws associated with the 802.11 WEP encryption method. It
makes use of WEP but encrypts the Layer 2 payload using TKIP and carries out a message integrity check (MIC) in
the encrypted packet to ensure that the message has not been altered.
• Advanced Encryption Standard (AES): AES is the encryption method used by WPA2. It is the preferred method
because it is a very strong method of encryption. It uses Counter Cipher Mode with Block Chaining Message
Authentication Code Protocol (CCMP), which allows destination hosts to recognize if the encrypted and
nonencrypted bits have been altered.
• The Galois/Counter Mode Protocol (GCMP): This is a robust authenticated encryption suite that is more secure
and more efficient than CCMP. GCMP is used in WPA3.

Table 4 summarizes the basic differences between WPA, WPA2, and WPA3. Each successive version is meant to replace
prior versions and offer better security features. You should avoid using WPA and use WPA2 instead—at least until WPA3
becomes widely available on wireless client devices, APs, and WLCs.

Wireless Authentication and Encryption Comparison

Feature WPA WPA2 WPA3
Authentication with pre-shared keys? Yes Yes Yes
Authentication with 802.1X? Yes Yes Yes
Encryption and MIC with TKIP? Yes No No
Encryption and MIC with AES and CCMP? Yes Yes No
Encryption and MIC with AES and GCMP? No No Yes

[Cyber Security-20CS541] Page 28

 Department of Collegiate and Technical Education Diploma in CS&E

Web Security: Concepts – HTTP, HTML, Frames, Browser Design

Web Security: Concepts

Three basic security concepts important to information on the Internet are confidentiality, integrity, and
availability.

 Integrity
Integrity has two facets:

Data Integrity: This property, that data has not been altered in an unauthorized manner while in storage, during
processing or while in transit. Another aspect of data integrity is the assurance that data can only be accessed and
altered by those authorized to do so. Often such integrity is ensured by use of a number referred to as a Message
Integrity Code or Message Authentication Code. These are abbreviated as MIC and MAC respectively.

System Integrity: This quality that a system has when performing the intended function in an unimpaired manner,
free from unauthorized manipulation.

Integrity is commonly an organizations most important security objective, after availability. Integrity is particularly
important for critical safety and financial data used for activities such as electronic funds transfers, air traffic control,
and financial accounting.

 Confidentiality

Confidentiality is the requirement that private or confidential information should not to be disclosed to unauthorized
individuals. Confidentiality protection applies to data in storage, during processing, and while in transit.

For many organizations, confidentiality is frequently behind availability and integrityin terms of importance. For some
types of information, confidentiality is a very important attribute. Examples include research data, medical and
insurance records, new product specifications, and corporate investment strategies. In some locations, there may be a
legal obligation to protect the privacy of individuals.

 Availability

Availability is a requirement intended to assure that systems work promptly and service is not denied to authorized
users. This objective protects against:

Intentional or accidental attempts to either:

 Perform unauthorized deletion of data or

 Otherwise cause a denial of service or data.
 Attempts to use system or data for unauthorized purposes.

[Cyber Security-20CS541] Page 29

 Department of Collegiate and Technical Education Diploma in CS&E

Availability is frequently an organizations foremost security objective. To make information available to those who
need it and who can be trusted with it, organizations use authentication and authorization.

Authentication

Authentication is proving that a user is whom s/he claims to be. That proof may involve something the user knows
(such as a password), something the user has (such as a “smartcard”), or something about the user that proves the
person’s identity (such as a fingerprint).

Authorization

Authorization is the act of determining whether a particular user (or computer system) has the right to carry out a
certain activity, such as reading a file or running a program. Authentication and authorization go hand in hand. Users
must be authenticated before carrying out the activity they are authorized to perform.

Web Security

• HTTP
• HTML
• Frames
• Browser Design

HTTP Web Security:

HTTP is a protocol that has survived longer than 20 years without changing much.
Browsers interact with web applications through the HTTP protocol, If users would enter their credit card details on a
website and an attacker would be able to intercept the data before it reaches the server, we would definitely be in
trouble.
A web client can authenticate a user to a web server using one of the following mechanisms:

 HTTP Basic Authentication

 HTTP Digest Authentication
 Form Based Authentication
 HTTPS Client Authentication

HTTP Basic Authentication

HTTP Basic Authentication, which is based on a username and password, is the authentication mechanism defined in
the HTTP/1.0 specification. A web server requests a web client to authenticate the user. As a part of the request, the
web server passes the realm (a string) in which the user is to be authenticated.

Basic Authentication is not a secure authentication as user passwords are sent in simple base64 ENCODING (not
ENCRYPTED !), and there is no provision for target server authentication.

[Cyber Security-20CS541] Page 30

 Department of Collegiate and Technical Education Diploma in CS&E

HTTP Digest Authentication

Similar to HTTP Basic Authentication, HTTP Digest Authentication authenticates a user based on a username and a
password. However, the authentication is performed by transmitting the password in an ENCRYPTED form, which is
much MORE SECURE than the simple base64 encoding used by Basic Authentication, e.g., HTTPS Client Authentication.

Form Based Authentication

This form based authentication mechanism allows a developer to CONTROL the look and feel of the login
authentication screens by customizing the login screens and error messages.

When a user attempts to access a protected web resource, the container checks the user’s authentication. If the user
is authenticated and possesses authority to access the resource, the requested web resource is activated and a
reference to it is returned.

HTTPS Client Authentication

End user authentication using HTTPS (HTTP over SSL) is a strong authentication mechanism. This mechanism requires
the user to possess a Public Key Certificate (PKC).

Client-certificate authentication is a more secure method of authentication than either BASIC or FORM authentication.
It uses HTTP over SSL, in which the server and, optionally, the client authenticate one another with Public Key
Certificates.

HTML Web Security:

HTML security consists of three different security measures:

• HTML encryption to ensure web content cannot be accessed by unauthorized users.
• The use of digital certificates to validate a domain and ensure content is coming from a trusted location (the URL in
the browser address bar).
• Encryption of content as it travels from the server to the client and back again (SSL).

What exactly is HTML security?

The definition of security is very complicated. Technology purists will tell you that is concerns the Confidentiality,
Integrity and Availability (CIA) of information.

WEB / HTML SECURITY

1. Web Page Security
2. Web Page Encryption
3. Html Security
4. Html Encryption
5. Html Password Protection
6. Web Page Login
7. Web Login
8. Web Access Login

[Cyber Security-20CS541] Page 31

 Department of Collegiate and Technical Education Diploma in CS&E

9. Web Page Access Control

Frames:

Web sites contain content from sources of varying trustworthiness. For example, many web sites contain
third-party advertising supplied by advertisement networks or their sub-syndicates. Other common aggregations of
third-party content include Flickr albums, Facebook badges, and personalized home pages offered by the three major
web portals.

More advanced uses of third-party components include Yelp's use of Google Maps to display restaurant locations and
the Windows Live Contacts gadget .

A web site combining content from multiple sources is called a mashup, with the party combining the content called
the integrator and integrated content called a gadget.

In simple mashups, the integrator does not intend to communicate with the gadgets and requires only that the
browser isolate frames. In more complex mashups, the integrator does intend to communicate with the gadgets and
requires secure inter-frame communication.

Browser Design web security:

Browser security is the application of Internet security to web browsers in order to protect networked data
and computer systems from breaches of privacy or malware.

Security exploits of browsers often use JavaScript, sometimes with cross-site scripting (XSS) with a secondary
payload using Adobe Flash.

Security exploits can also take advantage of vulnerabilities (security holes) that are commonly exploited in all browsers
(including Mozilla Firefox, Google Chrome, Opera, Microsoft Internet Explorer, and Safari.

Web browsers can be breached in one or more of the following ways:

• Operating system is breached and malware is reading/modifying the browser memory space in privilege mode
• Operating system has a malware running as a background process, which is reading/modifying the browser memory
space in privileged mode
• Main browser executable can be hacked
• Browser components may be hacked
• Browser plugins can be hacked
• Browser network communications could be intercepted outside the machine

Web Security Solutions Virtual Browser

An alternative to a device-based browser, which can help mitigate web-based threats, is a virtual browser. This is a web
browser hosted in a virtual environment, completely isolated from the operating system of the end-user device. This
ensures that if the user comes across a malicious script or downloads malware, the script or malicious software executes
within the virtual machine, and cannot harm the underlying operating system or access the user’s data.
Remote Browser Isolation (RBI)

[Cyber Security-20CS541] Page 32

 Department of Collegiate and Technical Education Diploma in CS&E

To provide an extra layer of security when users surf the web, organizations can provide a web browser that is hosted
in the cloud. This is known as remote browser isolation. Remote browsing lets users take advantage of the public
internet, while maintaining physical isolation from the user’s workstation or mobile device.

Best Practices for Secure Browsers

• Keep Browsers Up-to-Date
• Use HTTPS
• Use Unique Passwords
• Disable Auto-Complete for Forms
• Block Pop-ups and Ads
• Limit the Use of Cookies

WIRELESS NETWORK

1. Wireless networks are computer networks that are not connected by any kind of cables.
2. WIRELESS NETWORK allows you to connect one or more computers or other devices such as mobiles,
laptops, printer so that you can share file and access to the internet it uses radio signals.

Advantages:

1. Can be easily installed.

2. Inexpensive
3. More scalable
4. More Flexibility: easy update
5. Making global call
6. Allows multiple devices to simultaneously use the same wireless connection.

• Wireless security is the prevention of unauthorized access or damage to computers or data using wireless
networks, which include Wi-Fi networks.

[Cyber Security-20CS541] Page 33

 Department of Collegiate and Technical Education Diploma in CS&E

• Wireless networks use radio waves to connect devices such as laptops to the Internet, the business network
and applications.
• There are two security standards that protect wireless networks:
• WPA (Wi-Fi Protected Access)
• WPA2 (Wi-Fi Protected Access 2)

There are four main types of wireless networks:

1. WLAN -WIRELESS LOCAL AREA NETWORK

2. WMAN – WIRELESS METROPOLITAN NETWORk
3. WWAN – WIRELESS WIDE AREA NETWORK
4. WPAN – WIRELESS PERSONAL AREA NETWORK

Wireless Local Area Network -WLAN

1. Provides internet access within a building floor, or a limited external area.
2. It is mostly used in offices and homes and nowadays used in stores and restaurants also.
3. The use of home networks has increased greatly during Covid-19 pandemic where people were forced to work
from homes or students required to study from homes.
4. Most home network wireless networks are simple in design, usually a modem connecting to cable or fibre from
a local service provider.

[Cyber Security-20CS541] Page 34

 Department of Collegiate and Technical Education Diploma in CS&E

5. A Wireless router connected to the modem receives the signal which is broadcasted using wireless protocol
such as 802.11 standard.

Wireless Metropolitan Area Networks – WMAN

1. Are installed in cities worldwide to offer access to people outside home and offices.
2. Their networks cover wide areas rather than office or home networks.
3. Access points are located on sides of buildings or on telephone poles across the coverage area.
4. Access points are connected to the internet via wired network and broadcast a wireless signal throughout the
area.
5. Users connect to their desired destination via the nearest access point which forwards the connection through
its internet connection.

[Cyber Security-20CS541] Page 35

 Department of Collegiate and Technical Education Diploma in CS&E

Wireless Personal Area Networks – WPAN

• They cover a very limited area usually 100 meters for most applications using Bluetooth and ZigBee protocols.

• Bluetooth enables hands free phone calls, connecting phones to earpieces and transmitting signals between
smart devices.

[Cyber Security-20CS541] Page 36

 Department of Collegiate and Technical Education Diploma in CS&E

Wireless Wide Area Networks – WWAN

• Use cellular technology to provide access outside the range of a wireless LAN or wireless MAN.
• These networks enable users to make phone calls to other users connecting via wireless WAN or wired
telephone systems.

TYPE RANGE APPLICATION STANDARD PERFORMANCE

Wireless local area Within a floor, Wireless extension of IEEE 802.11 HIGH
networks building or LAN
(WiFi)
campus

Wireless Within a city Wireless internetwork IEEE 802.15 HIGH

metropolitan area connectivity
(WiMAX)
networks

Wireless personal Within reach of a Peripherals cable Bluetooth, ZigBee, MODERATE

area networks replacement
person NFC

[Cyber Security-20CS541] Page 37

 Department of Collegiate and Technical Education Diploma in CS&E

Wireless wide area World wide Wireless network Cellular (UMTS, LOW
networks access cellular phones
LTE etc.)
etc.

CELLULAR NETWORK

 A cellular network or mobile network is a communication network where the link to and from end nodes is
wireless.
 A mobile or cellular network is a combination of mobile towers signals and connection of mobile tower
switching office (MTSO) with mobile sim data.

Cellular Network Diagram

MTSO:

• MTSO stands for mobile tower switching office.

• It stores all mobile sim data.
• All calls are directed to other cities and countries through MTSO.
• Every city has 1 MTSO that is connected to many mobile towers.

Mobile Tower or cell:

[Cyber Security-20CS541] Page 38

 Department of Collegiate and Technical Education Diploma in CS&E

 Mobile network is divided into different geographical areas known as cells.

 Each cell has a transceiver (mobile tower) that make a wireless connection to the mobile device.
 Each mobile tower is also connected to MTSO (mobile tower switching office) through fibre optics.
 Our mobile has not enough signal powers to directly call a caller residing in another city.
 Our mobile sends signals to a mobile tower.
 The mobile tower then sends signals to MTSO.
 MTSO check our sim data and send a signal to another city MTSO.
 Then MTSO (mobile tower switching office) sends signals to mobile through the mobile tower.
 The data in our mobile is in digital form.
 Our mobile has an antenna that transmits data in the form of electromagnetic waves.
 The speed of data transfer rate depends upon which technology our mobile is using. Some mobile generations
are 2G, 3G, 4G and 5G.

SECUIRTY ISSUSES IN CELLULAR NETWORK

 Authentication
 Integrity
 Confidentiality
 Access control
 OS in mobile devices
 Location detection
 Viruses and malware

Wi fi full form of wi-fi is wireless fidelity

Wi-Fi is a wireless technology used to connect computers, tablets, smartphones and other devices to the internet.
Wi-Fi is the radio signal sent from a wireless router to a nearby device, which translates the signal into data you can
see and use.
The device transmits a radio signal back to the router, which connects to the internet by wire or cable.

It allows these devices--and many more--to exchange information with one another, creating a network.

What is a Wi-Fi network?

A Wi-Fi network is simply an internet connection that’s shared with multiple devices in a home or business via a
wireless router.

[Cyber Security-20CS541] Page 39

 Department of Collegiate and Technical Education Diploma in CS&E

The router is connected directly to your internet modem and acts as a hub to broadcast the internet signal to all your
Wi-Fi enabled devices.

This gives you flexibility to stay connected to the internet as long as you’re within your network coverage area.

Advantages of wi-fi
1. Increased efficiency
2. Better coverage
3. Flexibility
4. Cost savings
5. Hotspots

Disadvantages of wi fi
1. Installation problem
2. Security
3. Transmission speed
4. Coverage

[Cyber Security-20CS541] Page 40

 Department of Collegiate and Technical Education Diploma in CS&E

LAN SYSTEM:
A local Area network (LAN) is a group of computers or other devices interconnected within a single, limited area,
typically via Ethernet or Wi-Fi.

A LAN is a computer network that consists of access points, cables, routers , and switches that enable devices to
connect to web servers and internal servers within a single building, campus, or home network, and to other LANs
via Wide Area Networks (WAN) or Metropolitan Area Network (MAN). Devices on a LAN, typically personal
computers and workstations, can share files and be accessed by each other over a single Internet connection. A
router assigns IP addresses to each device on the network and facilitates a shared Internet connection between all
the connected devices.

How Does Local Area Network Work

The function of local Area networks is to link computers together and provide shared access to printers, files and
other services. Local area network is categorized as either peer-to-peer or client-server. On a client-server local
area network, multiple client-devices are connected to a central server, in which application access, device access,
file storage, and network traffic are managed. Applications running on the local Area Network server provide
services such as database access, document sharing, email and printing. Devices on a peer-to-peer local area
network share data directly to a switch or router without the use of a central server.

Advantages of Local Area Networks in business:

Reduced Costs: LANs present a significant reduction in Local Area Network hardware costs and efficient resource
pooling.

[Cyber Security-20CS541] Page 41

 Department of Collegiate and Technical Education Diploma in CS&E

Increased Storage Capacity: By pooling all data into a central data storage server, the number of storage servers
required is decreased and the efficiency of operations is increased.

Optimized Flexibility: Data can be accessed by any device from anywhere via Internet connection.

Streamlined Communication: Files and messages can be transferred in real time and accessed easily from anywhere
on any device.

RFID(RADIOFREQUENCYIDENTIFICATION)---

RFID (radio frequency identification) is a form of wireless communication that incorporates the use of electromagnetic
or electrostatic coupling in the radio frequency portion of the electromagnetic spectrum to uniquely identify an
object, animal or person.

How does RFID work?

Every RFID system consists of three components: a scanning antenna, a transceiver and a transponder. When the
scanning antenna and transceiver are combined, they are referred to as an RFID reader or interrogator.

There are two types of RFID readers -- fixed readers and mobile readers.

The RFID reader is a network-connected device that can be portable or permanently attached. It uses radio waves to
transmit signals that activate the tag.

Once activated, the tag sends a wave back to the antenna, where it is translated into data.

There are three main types of RFID systems: low frequency (LF), high frequency (HF) and ultra-high frequency
(UHF). Microwave RFID is also available.

 Low-frequency RFID systems- These range from 30 KHzto 500 KHz, though the typical frequency is 125 KHz.
LF RFID has short transmission ranges, generally anywhere from a few inches to less than six feet
 High-frequency RFID system -These range from 3 MHzto 30 MHz, with the typical HF frequency being 13.56
MHz. The standard range is anywhere from a few inches to several feet.
 UHF RFID systems-These range from 300 MHz to 960 MHz, with the typical frequency of 433 MHz and can
generally be read from 25-plus feet away.
 Microwave RFID systems- These run at 2.45 Ghzand can be read from 30-plus feet away.

If longer read ranges are needed, using tags with additional power can boost read ranges to 300-plus feet.

[Cyber Security-20CS541] Page 42

 Department of Collegiate and Technical Education Diploma in CS&E

Some common uses for RFID applications include:

 pet and livestock tracking

 inventory management
 asset tracking and equipment tracking
 inventory control
 cargo and supply chain logistics
 vehicle tracking
 customer service and loss control
 improved visibility and distribution in the supply chain
 access control in security situations
 shipping
 healthcare
 manufacturing
 retail sales
 tap-and-go credit card payments

REFERENCES

1. [Link]

2. [Link]

3. How hackers do it: Tricks, Tools, and Techniques

4. [Link]

5. [Link] : Cryptography and Network Security by Prof. Debdeep Mukhopadhyay, IIT

Kharagpur.

6. [Link]

[Cyber Security-20CS541] Page 43

 Department of Collegiate and Technical Education Diploma in CS&E

Attacks and vulnerabilities

Injection attack
An injection flaw is a vulnerability which allows an attacker to relay malicious code through an application to another system. This can
include compromising both backend systems as well as other clients connected to the vulnerable application.

The effects of these attacks include:

 Allowing an attacker to execute operating system calls on a target machine

 Allowing an attacker to compromise backend data stores
 Allowing an attacker to compromise or hijack sessions of other users
 Allowing an attacker to force actions on behalf of other users or services

Many web applications depend on operating system features, external programs, and processing of data queries submitted by users. When
a web application passes information from an HTTP request as part of an external request, set up a way to scrub and validate the message.
Otherwise an attacker can inject special (meta) characters, malicious commands/code, or command modifiers into the message.

While these attacks are not difficult to attempt, there are an increasing number of tools that scan for these flaws. An attacker can use these
techniques to obtain, corrupt, or destroy the contents of your database, compromise backend systems, or attack other users.

Successful injection attacks may completely compromise or destroy a system. It is important to test for and protect against these types of
attacks.

Examples

1. OS Command Injection - A malicious parameter could modify the actions taken by a system call that normally retrieves the
current user’s file to access another user’s file (e.g., by including path traversal ../ characters as part of a filename request).
Additional commands could be tacked on to the end of a parameter that is passed to a shell script to execute an additional shell
command (e.g., ; rm –r \*) along with the intended command.
2. SQL Injection - Is a particularly widespread and dangerous form of injection. To exploit a SQL injection flaw, an attacker needs
to find a parameter that the web application passes through to a database interaction. An attacker can then embed malicious SQL
commands into the content of the parameter, to trick the web application to forward a malicious query to the database. SQL
queries could be modified by adding additional ‘constraints’ to a where clause (e.g., OR 1=1) to gain access to or modify
unauthorized data.

SQL injection is a code injection technique that might destroy your database. SQL injection is one of the most common web hacking
techniques. SQL injection is the placement of malicious code in SQL statements, via web page input.

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A
successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute
administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file
system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL
commands are injected into data-plane input in order to affect the execution of predefined SQL commands.

[Cyber Security-20CS541] Page 44

 Department of Collegiate and Technical Education Diploma in CS&E

3. HTTP header

The HTTP host header injection is an attack in which a malevolent actor tampers with the host header in a client request. This misleads
the virtual host or intermediary system to serve poisoned content to the client in the response

HTTP header injection is a technique that can be used to facilitate malicious attacks such as cross-site scripting, web cache poisoning,
and more. These, in turn, may lead to information disclosure, use of your application in phishing attacks, and other severe consequences.

[Cyber Security-20CS541] Page 45

 Department of Collegiate and Technical Education Diploma in CS&E

1. Cross-Site Scripting (XSS) - A type of injection, in which malicious scripts are injected into otherwise benign and trusted
websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser
side script, to a different end user.1 Attacks of this type can hijack user sessions, log keystrokes, or perform malicious actions
on behalf of victim users.

Dos attacks
[Link]

What Is a Denial-of-Service (DoS) Attack?

A denial-of-service attack is designed to slow or take down machines or networks making them inaccessible for the people who need
them. Information systems, devices or other resources on the network or machine — email, online accounts, ecommerce sites, and other
services — become unusable in a DoS condition. While direct theft or data loss may not necessarily be the goal of a DoS attack, one can
severely impact the targeted organization financially as it spends time and money getting back on its feet. Loss of business, frustrated
customers and reputational harm are additional costs.
DoS attacks have increased in recent months. Some 3 million DoS attacks occurred in the first quarter of 2021 — nearly a third more than
the same period the previous year — and January saw the largest number of DoS attacks ever recorded, with 972,000 attacks.[2] During
the pandemic, the number of DoS attacks rose as bad actors sought to take advantage of more vulnerable organizations operating in new
ways.
How Does a Denial-of-Service (DoS) Attack Work?
Denial-of-service attacks tend to target web servers of high-profile organizations, such as banking, e-commerce and media companies,
as well as government entities. Perpetrators go after organizations’ assets in one of two ways: either by overwhelming their networks
with large volumes of traffic or by sending nefarious data like bugs that will trigger a crash. No matter the method, the intended outcome
is the same: to take the network or machine down. Additional networks or assets not actually targeted by the DoS attackers may also be
impacted if the DoS victim is, say, an internet or cloud service provider for others.
A potentially more dangerous form of a DoS attack is known as a distributed denial-of-service attack (DDoS). In these commonly
attempted cases, an attack — perpetrated by multiple systems as opposed to a basic DoS attack — can impact or completely take out of
service any internet-facing service. DDoS attacks may also be used to distract organizations from other criminal activity, such as data
theft or network infiltration.
The biggest DDoS attack in history occurred in February 2020, when Amazon Web Services says it fended off a three-day DDoS attack
that peaked at a volume of 2.3 terabytes per second.
Difference between DoS & DDoS Attack
The key difference between a DoS and a DDoS attack is the number of devices used for the attack. A DoS attack uses only one system,
and a DDoS attack uses multiple systems. Since a DoS attack uses only a single system, it is much easier to detect and contain. A DDoS
attack, however, can use a large amount of infected botnets controlled by a command and control system, making these attacks much
more difficult to detect, and in turn, makes them much more impactful.

[Cyber Security-20CS541] Page 46

 Department of Collegiate and Technical Education Diploma in CS&E

Types of Denial-of-Service (DoS) Attacks

There are several overarching types of denial-of-service attacks:

 Volume-based attacks: These use large amounts of fake traffic to overwhelm an online resource, like a server or website. The volume
of the attack is measured in bits per second.
 Protocol or network-layer attacks: These send large numbers of packets to network infrastructure and infrastructure management
tools. Their size is measured in packets per second (PPS) and include Smurf DDoS attacks (network-layer attacks designed to flood a
targeted server with error messages) and SYN floods (which tie up networks with half-opened connection requests).
 Application-layer attacks: These are similar to volume-based attacks but are conducted by flooding applications with malicious
requests. Their size is measured in requests per second (RPS).

How to Identify if a DoS Attack has occured?

There is no single way to detect if a DoS Attack has occured. The best thing organizations can do is be on the lookout for the tell-tale
signs of a DoS Attack:

 A huge spike in traffic

 Servers responding with 503 errors due to service outages
 Pink requests time out
 Multiple requests from the same IP address are received in a short period of time

How to Prevent Denial-of-Service (DoS) Attacks

As the Cybersecurity and Infrastructure Security Agency (CISA), run by the U.S. Department of Homeland Security, notes, “the
symptoms of a DoS attack can resemble non-malicious availability issues, such as technical problems with a particular network or a
system administrator performing maintenance.”[4] However, CISA adds, “unusually slow network performance and unavailability of a
particular website can be strong signs of a DoS attack.”
Organizations can take the following actions toward denial-of-service attack protection and prevention:

 Monitor and analyze network traffic: Network traffic can be supervised via a firewall or intrusion detection system. Administrators
can set up rules that create alerts for unusual traffic, identify traffic sources or drop network packets that meet a certain criteria.
 Strengthen their security posture: This includes fortifying all internet-facing devices to prevent compromise, installing and
maintaining antivirus software, establishing firewalls configured to protect against DoS attacks and following robust security practices
to monitor and manage unwanted traffic.
 Monitor traffic: Organizations can enroll in a service that detects or redirects the abnormal traffic flows typically associated with a DoS
attack, while allowing normal traffic to proceed on the network.
 Establish a DoS attack response plan: The key is to create and also practice a disaster recovery plan for DoS attack that covers
communication, mitigation and recovery.

[Cyber Security-20CS541] Page 47

 Department of Collegiate and Technical Education Diploma in CS&E

How to know if a DoS attack is happening

It may be difficult to spot a DoS attack, as interferences may initially appear non-malicious. You can use several criteria to determine if
you are being attacked with a DoS. The three most common symptoms of an attack, according to the United States Computer
Emergency Readiness Team (US-CERT), include:

 Prolonged network performance (opening files or accessing websites)

 Unavailability of a particular website, or
 An inability to access any website
Denial of service attack examples

There are many different types of DoS attack techniques. Following are several different examples of how a DoS can be executed,
depending on the vulnerability of the target server. Some of them have fallen out of use because their vulnerabilities have been removed,
whereas others persist and are being used.

DoS attack: ACK scan, SYN scan, FIN scan

These scan techniques use similar approaches to check whether ports at the attack target are open and can be exploited. They are used to
gather information as well as deny service.

For example, the ACK scan technique is used by attackers to gather information about a target’s firewall or Access Control List (ACL)
configuration. It features a scan via a packet with an acknowledgment (ACK) flag that seeks to identify hosts or ports that are filtered or
cannot be scanned in another way. Attackers watch the response from the router to understand the setup.

The type of information that can be gleaned from this, particularly when combined with an SYN scan, is the target’s type of firewall, its
rule-set, and what kind of packets can get through to the host.

At the same time, while collecting vulnerability information via a scan, the attackers may also flood a router’s open UDP/TCP ports to
make it crash. By initiating a connection attempt but not acknowledging the server response from open ports, attackers can keep the
ports open and continuously flood the server with new requests (also known as an SYN flood).

DoS attack: Smurf

In a Smurf attack, the malicious party will target a network whose configuration allows packets to be sent to all devices (hosts) on the
network at once. That is accomplished by sending Internet Control Message Protocol (ICMP) packets to the IP broadcast address of the
network whereby they reach all computers.

These packets will have as their source address the IP address of the target (i.e., the source address will be fabricated). By default, the
devices on the network will then respond to the packets by replying to the spoofed source address. This will be to flood the target
machine with traffic and overload it or shut it down completely.

There are few differences between Smurf and what’s known as an ICMP flood or Ping of death.

DoS attack: SYN flood

An SYN flood, also known as a half-open attack, is a technique that exploits the Transmission Control Protocol (TCP)/IP three-way
handshake. During an SYN flood, an attacker repeatedly sends connection requests, i.e., SYN (synchronization) packets, to all ports on a
server. Typically, a server then responds with synchronization acknowledged (SYN/ACK) packets from every port that is currently
open. If a port is closed, it will respond with a reset (RST) packet.

Usually, a client responds to the SYN/ACK packet with an acknowledged (ACK) packet during the handshake. This is done to confirm
that it has received the server’s SYN/ACK, and then communication between them can commence.

[Cyber Security-20CS541] Page 48

 Department of Collegiate and Technical Education Diploma in CS&E

However, during an SYN flood, attackers use fake IP addresses to send the initial SYN packets. As a result, the server never gets a
response to its SYN/ACK packets, and its ports remain open (occupied), and it cannot reset them (hence the name “half-open”). Before
the connection attempt times out, further SYN packets are sent to these ports, prompting the server to keep them open and attempt to
establish a connection.

This is because ports are saturated with these requests, leading to a denial of service.

DoS attack: Teardrop

The Teardrop attack exploits a vulnerability associated with older operating systems and TCP/IP implementations. When packets are too
large for intermediary systems like routers, the IP specification allows packet fragmentation. Afterward, fragments are reassembled.

However, a TCP/IP fragmentation reassembly bug can be found in many older systems. The bug consists of their inability to reassemble
packets whose offset fields overlap. Attackers exploit this bug when launching a Teardrop attack by sending packets with overlapping
and oversized payloads, making it impossible for the receiving system to reassemble them and ultimately leading to its crash.

DoS attack: ARP attack

Also known as an ARP spoofing attack, this technique involves sending Address Resolution Protocol (ARP) messages over a network to
link the attacker’s MAC address to the IP address of its target (whether a server or gateway, such as a router).

When this is executed successfully, the traffic intended to lead to the target is instead received by the attacker, which leads to a denial of
service. This type of attack can only be performed on local area networks that use ARS.

DoS attack: Fraggle attack

The Fraggle attack, also known as a UDP flood, uses the same approach as the Smurf attack by exploiting a vulnerability associated
with sending traffic to the IP broadcast address of the target (such as a router). The main difference is that it uses User Datagram
Protocol (UDP) traffic to flood a router or server instead of ICMP.

The effect is to spoof the IP address of the source of the request and then direct the traffic from the network back to the router, thereby
flooding it.

Both the Fraggle and the Smurf attacks have largely been left behind as routers no longer forward packets sent to their broadcast
address.h

Fig spoof attack

[Cyber Security-20CS541] Page 49