Computer Security

The protection afforded to an automated information system in order to attain the applicable
objectives of preserving the confidentiality, integrity, and availability of information system
resources.

Confidentiality
Data confidentiality – private or confidential information and resources are not disclosed or
made available to unauthorized party.
Privacy – Assure that user can control what information related to them can be collected, stored,
and whom this information can be disclosed to.

Integrity
Data integrity – assure that information is changed only in authorized manner.
System integrity – assure that system work as intended or free from unauthorized manipulation.

Availability
Availability can ensure the system works promptly and authorized users can enjoy services
without being denied.

Authenticity – the property of being genuine and be able to being verified and tested.
Accountability – A security goal that generates the requirements for actions of an individuals to
be traced uniquely to that particular entity.
Threat – a potential for violation of security, which exists when there is a system vulnerability
that might be exploited. Threat is a potential danger that might be exploited vulnerability.
Attack – an assault on system security that derives from a threat. Attack is a deliberate attempt
to evade security services and violate the security policy.
Risk – The probability of a vulnerability being exploited. In cybersecurity, risks refer to the
potential of an organization experiencing a data breach or cyber-attack.
1. Mitigate. 2. Avoid. 3. Transfer. 4. Accept.
Authentication – Assuring genuine communication.
Peer entity authentication – provides the corroboration of the identity of the parties involving in
the communication.
Data origin authentication – provides the corroboration of the source of a data unit.

Access control – An ability to limit and control right and permission to access resources.

Non-repudiation – Prevent either send or receive of the message from denying a transmitted
message. A receiver can prove that the message was sent by the sender. A sender can also prove
that the message was received by the intended receiver.
Security Mechanism
Security mechanism designed to prevent, detect, and recovery from a security attack. Security
mechanism incorporated into protocol layers provide some OSI security services. Cryptographic
techniques underline most of the security mechanism.

Separation of privilege
Multiple privilege attributes are required to achieve access to a resource.

Confusion – makes relationship between a plaintext and its corresponding ciphertext as complex
as possible.
Diffusion – a small changes in plaintext should cause many changes in ciphertext.
Digital Signature
A digital signature is a cryptographic technique used to verify the authenticity and integrity of
digital messages, documents, or software. It provides a way to ensure that the sender of a
message is who they claim to be and that the message has not been changed during transit.

Least Privilege – every process should require only the least amount of privilege needed to
perform the task. E.g., RBAC.

Zero Trust – Never trust, always verified. Zero implicit trust. Trust is something to be earned.
Every single transaction will be verified. ZTA give us an ability granularly control of access to
the resource.

Cryptography
A study of algorithm used for enciphering and deciphering of the message. It allows the user to
transmit the confidential information through insecure channel without being revealed.

Symmetric-Key Encryption
Use the same secret key for both encryption and decryption process. Encryption and decryption
are used the same set of parameters to control the transformation. Sender and receiver shared a
common key. All classical encryption algorithm is symmetric key encryption. Computationally
fast, required less computing resources compared to asymmetric key encryption. Very efficient if
implement correctly.

Asymmetric Key encryption

Asymmetric key encryption also called public key encryption. The most significant advancement
of cryptography as the name suggested asymmetric. Use clever application of number theoretic
concepts that is easy to calculate but much harder to reverse without sufficient information. Use
as a complement rather than replacing symmetric key encryption.
Steganography
The art of data hiding. Need a carrier media like photo, video, documents, Audio, etc.,
Steganography is the practice of concealing a message, file, image, or video within another file
in order to hide its existence. Suspect can hide information on image or text document files. Very
hard to spot without prior knowledge.

Pseudo random number generator

Often use the deterministic algorithmic technique to create random numbers known as
pseudorandom numbers. PRNGs requires pre-determine fixed value seed as an input.

True random number generator

Use the data from the source that is effectively random as input. The source is referred to as an
entropy source. The entropy source is usually come from the physical environment of the
computer. TRNG may involve the conversion of analog information into binary output.
Sometimes require the additional process to reduce the bias in the source.

(To read RC4, CBC, ECB, CFE, OFB, CTR, etc.,)

Cryptographic Hash Functions

Message authentication
Mechanism of service used to identify the integrity of message. Assure that data received exactly
as sent. Hash value is sometimes referred to as message digest.

Message Authentication Code

MAC is using an algorithm generating a fixed size block. Appended to the message as a
signature. Receiver performs same computation the received message and check whether it
matches with the given MAC or not. MAC provides assurance that the message is unchanged
and comes from the sender. MAC provides authentication and use for encryption secrecy. MAC
is not a digital signature.

HMAC
MAC based on the hash function. Hash function are generally faster and cryptographic hash
function code is widely available. Hash the key along with the message, eventually lead to the
development of the HMAC and easy replaceability of embedded hash function. Preserve original
performance of hash function. Well-understood cryptographic analysis of its strength.

Elliptic Curve Digital Signature Algorithm (ECDSA)

All those participating in the digital signature scheme use the same global domain parameters,
which define an elliptic curve and a point of origin on the curve. A signer must first generate a
public, private key pair. A hash value is generated for the message to be signed; using the private
key, the domain parameters, and the hash value, a signature is generated. To verify the signature,
the verifier uses as input the signer’s public key, the domain parameters, and the integer.
RSA-PSS
RSA Probabilistic Signature Scheme is the latest of the RSA schemes and the one that RSA
laboratories recommend as the most secure of the RSA schemes. For all schemes developed prior
to PSS it has not been possible to develop a mathematical proof. unlike the other RSA-based
schemes, introduces a randomization process that enables the security of the method to be shown
closely related to the security of the RSA algorithm.

PKI
PKI is defined as the set of hardware, software, people, policies and procedures needed to create,
manage, store, distribute and revoke digital certificates based on asymmetric encryption. The
objective is to enable secure, convenient and efficient acquisition of public-keys.

User Authentication
There are four general means of authenticating a user’s identity,
Something the individual knows
Examples include a password, a personal identification number (PIN), or answers to a
prearranged set of questions.
Something the individual possesses
Examples include cryptographic keys, electronic keycards, smart cards, and physical keys. This
is referred to as a token
Something the individual is (static biometrics)
Examples include recognition by fingerprint, retina, and face.
Something the individual does (dynamic biometrics)
Examples include recognition by voice pattern, handwriting characteristics, and typing rhythm.

Mutual Authentication
Protocols which enable communicating between parties to satisfy themselves mutually about
each other’s identity and to exchange session keys.

Replay Attack
A replay attack is a type of network attack in which a malicious actor intercepts and retransmits
data that was validly exchanged between two parties. The goal of a replay attack is to
impersonate the legitimate user or system by replaying the captured data, thereby gaining
unauthorized access or causing other malicious effects.

Suppress replay attack

The attacker can intercept a message from the sender and replay it later when the timestamp in
the message becomes at the recipient’s site. Such attacks are referred to as suppress-replay
attacks.
Kerberos
A workstation cannot be trusted to identify its users correctly to network services. So, Kerberos
provides a centralized authentication server whose function is to authenticate users to servers and
servers to users.

One way authentication

Have public-key approaches for e-mail. For confidentiality, encrypt message with onetime secret
key, public-key encrypted. If authentication is the primary concern, a digital signature may
suffice.

Federated Identity Management

Relatively new concept deal with the use of a common identity management scheme across
multiple enterprise and numerous applications and supporting many users.

The Extensible Markup Language (XML)

A markup language that uses sets of embedded tags or labels to characterize text elements within
a document so it can indicate their appearance, function, meaning, or context.

The Simple Object Access Protocol (SOAP)

Enables applications to request services from one another with XML-based requests and receive
responses as data formatted with XML.

WS-Security
A set of SOAP extensions for implementing message integrity and confidentiality in Web
services.

Security Assertion Markup Language (SAML)

An XML-based language for the exchange of security information between online business
partners.

Personal Identity Verification

User authentication based on the possession of a smart card is becoming more widespread. A
smart card contains microprocessor, including processor, memory, and I/O ports. A smart card
includes three types of memory like read only memory (ROM), electronically erasable
programmable ROM (EEPROM), random access memory (RAM).

TLS Architecture
Two important TLS concepts are:
TLS Connection –
• provides a suitable type of service
• connections are peer-to-peer relationships
• Connections are temporary
• connection is associated with one session
TLS Session –
• association between a client and a server
• Created by the Handshake Protocol
• Define a set of cryptographic security parameters
• used to avoid the expensive negotiation of new security parameters

TLS Handshake protocol

Establish security capabilities including protocol version, session ID, cipher suite, compression
method and initial random numbers.
Server send certificate, key exchange, and request certificate. Server signal end of hello message
phase.
Client send certificate if requested. Client sent key exchange. Client may send certificate
verification.
Change cipher suite and finish handshake protocol.

Heartbeat Protocol
Heartbeat protocol is a periodic signal generated by hardware or software to indicate normal
operation or to synchronize other parts of a system. It runs on top of the TLS record protocol. It
consists of two message types such as heartbeat request and heartbeat response. The use of the
heartbeat protocol is established during phase 1 of the handshake protocol. The heartbeat serves
two purposes – It assure the sender that the recipient is still alive and the heartbeat generate
activity across the connection during the idle periods. The requirement for the exchange of a
payload was designed into the Heartbeat protocol to support its use in a connectionless version of
TLS known as Datagram Transport Layer Security.

SSL/TLS Attacks
The attacks can be grouped into four general categories:
Attacks on the handshake protocol
Attacks on the record and application data protocols
Attacks on the PKI
Other attacks
The constant back-and-forth between threats and countermeasures determines the evolution of
internet-based protocols.

HTTPS
Refers to the combination of HTTP and SSL to implement secure communication between a
Web browser and a Web server. The HTTPS capability is built into all modern Web browsers.

Port Forwarding
One of the most useful features of SSH. Provides the ability to convert any insecure TCP
connection into a secure SSH connection. Incoming TCP traffic is delivered to the appropriate
application on the basis of the port number. An application may employ multiple port numbers.
Local Forwarding
Allows the client to set up a “hijacker” process. This will intercept selected application-level
traffic and redirect it from an insecure TCP connection to a secure SSH tunnel. SSH is
configured to listen on selected ports. SSH grabs all traffic using a selected port and sends it
through an SSH tunnel. The SSH server sends the incoming traffic to the destination port
dictated by the client application.

IP Security
Security in internet architecture. Identify key area for security mechanisms – need to secure the
network infrastructure and end-to-end user traffic.

Application of IPSec
IPsec provides the capability to secure communications across a LAN, private and public WANs,
and the Internet. Principal feature of IPsec is that it can encrypt and authenticate all traffic at the
IP level.

Benefits of IPSec
When IPsec is implemented in a firewall or router, it provides strong security that can be applied
to all traffic crossing the perimeter. IPsec in a firewall is resistant to bypass when all traffic from
the outside must use IP and the firewall is only the entrance from the Internet into the
organization. IPsec is below the transport layer (TCP, UDP) and so is transparent to applications
and end users.

IPSec Transport Mode

Provides protection primarily for upper-layer protocols. Typically used for end-to-end
communication between two hosts. ESP in transport mode encrypts and optionally authenticates
the IP payload but not the IP header. AH in transport mode authenticates the IP payload and
selected portions of the IP header.

IPSec Tunnel Mode

Provides protection to the entire IP packet. Used when one or both ends of a security association
(SA) are a security gateway. A number of hosts on networks behind firewalls may engage in
secure communications without implementing IPsec. ESP in tunnel mode encrypts and
optionally authenticates the entire inner IP packet and inner IP header. AH in tunnel mode
authenticates the entire inner IP packet and selected portions of the outer IP header.

Security Association
A one-way logical connection between a sender and a receiver that affords security services to
the traffic carried on it. In any IP packet, the SA is uniquely identified by the destination address
in the IPv4 or IPv6 header.
Encapsulation Security Payload
Used to encrypt the Payload Data, Padding, Pad Length, and next header fields. If the algorithm
requires cryptographic synchronization data, then these data may be carried explicitly at the
beginning of the Payload Data field. An optional ICV field is present only if the integrity service
is selected and is provided by either a separate integrity algorithm or a combined mode algorithm
that uses an ICV. ICV is computed after the encryption is performed. This order of processing
facilitates reducing the impact of DoS attacks.

Internet Key Exchange

The key management portion of IPsec involves the determination and distribution of secret keys.
The IPsec Architecture document mandates support for two types of key management:
 A system administrator manually configures each system with its own keys and with the
keys of other communicating systems. This is practical for small, relatively static
environments.
 Enables the on-demand creation of keys for SAs and facilitates the use of keys in a large
distributed system with an evolving configuration.

IPSec Tunneling:
Utilizes the IP Security protocol. IPSec has a mode called Tunneling mode, where the original IP
packet is encapsulated and placed into a new IP packet.

TLS/SSL Tunneling:
Tunneling done outside the kernel, at the application level. Idea is to put each VPN-bound IP
packet inside a TCP or UDP packet. The other end of the tunnel will extract the IP packet from
the TCP/UDP payload. To secure the packets, both ends will use TLS/SSL protocol on top of
TCP/UDP.

TUN/TAP Interface
Most OSs have two types of network interfaces:
Physical: Corresponds to the physical Network Interface Card (NIC)
Virtual: It is a virtualized representation of computer network interfaces that may or may not
correspond directly to the NIC card.

TUN Virtual Interface

Work at OSI layer 3 or IP level
Sending any packet to TUN will result in the packet being delivered to user space program

TAP Virtual Interfaces

Work at OSI layer 2 or Ethernet level
Used for providing virtual network adapters for multiple guest machines connecting to a physical
device of the host machine
TCP three ways handshake
The TCP three-way handshake is a process used to establish a reliable and connection-oriented
communication between two devices over a TCP/IP network.
1. Client (SYN): Initiates the connection by sending a segment with the SYN flag.
2. Server (SYN-ACK): Responds with a segment that has both the SYN and ACK flags set.
3. Client (ACK): Acknowledges the server's response by sending a segment with the ACK
flag.
Once the three-way handshake is completed, data transmission can begin between the client and
server with the assurance.

SYN Flooding attack

It is one of DoS attacks. To fill the queue storing the half-open connections so that there will be
no space to store TCB for any new half-open connection, basically the server cannot accept any
new SYN packets. If attacks can fill up this queue quickly, there will be no space to store the
TCB for any new half-open connection.

Closing the TCP Connection

“Civilized” and “non-civilized” methods can be used to close TCP connection. “Civilized”
method is TCP FIN protocol. "Non-civilized" approach, one party simply sends a single TCP
RST packet to the other side, immediately breaking the connection.

TCP Reset Attack

To break up a TCP connection between A and B. Spoofed RST Packet: The following fields
need to be set correctly: Source IP address, Source Port, Destination IP address, Destination Port,
Sequence number.

TCP Reset attack on SSH connection

If the encryption is done at the network layer, the entire TCP packet including the header is
encrypted, which makes sniffing or spoofing impossible. But as SSH conducts encryption at
Transport layer, the TCP header remains unencrypted. Hence, the attack is successful because
only header is required for RST packet.

TCP Session Hijacking Attack

Session hijacking, also known as session stealing or session sniffing, is a type of attack where an
unauthorized user takes over a valid user's session. In a web context, this typically involves the
attacker gaining access to a user's session token, allowing them to impersonate the user and
perform actions on their behalf.
To launch a successful this attack, an attacker needs to know the sequence numbers of the
targeted TCP connection, as well as the other essential parameters. We need to find out the
sequence number in the next packet from a client to a server. This number is the sum of the data
length and the sequence number in the capture packet. If the data length is not 0, Wireshark will
calculate this “next sequence number” for us.
Buffer Overflow Attack
A buffer overflow attack is a type of security vulnerability that occurs when a program or
process tries to store more data in a buffer than it was allocated for. This excess data can
overflow into adjacent memory, corrupting or overwriting the contents of that memory. If
properly exploited, a buffer overflow can lead to serious security issues, such as unauthorized
access to sensitive information, execution of malicious code, or even a system crash.

Shell Variables & Environment Variables

Shell variables and environment variables are different. When a shell program starts, it copies the
environment variables into its own shell variables. Changes made to the shell variable will not
reflect on the environment variables. When we type env in shell prompt, shell will create a child
process.

Domain Vs Zone
A DNS zone only contains a portion of the DNS data for a domain. If a domain is not divided
into subdomains, the zone and domain are essentially the same, because the zone contains all the
DNS data for the domain. When a domain is divided into subdomains, their DNS data can still be
put in the same zone, so domain and zone are still the same. But subdomains can have their own
zones.

Authoritative Name Servers

Each DNS zone has at least one authoritative nameserver that publishes information about the
zone. It provides the original and definitive answers to DNS queries. An authoritative name
server can be a master server (primary) or slave server (secondary). A master server stores the
master copies of all zone records whereas a slave server uses an automatic updating mechanism
to maintain an identical copy of the master records.

DNS Response
There are 4 types of sections in a DNS response:
Question section: Describes a question to a nameserver
Answer section: Records that answer the question
Authority section: Records that point toward authoritative nameservers
Additional section: Records that are related to the query.

DNS cache
When the local DNS server gets information from other DNS servers, it caches the
information.
Each piece of information in the cache has a time-to-live value, so it will be eventually
time out and removed from the cache.

DNS Attacks
 Denial-of-Service Attacks (DoS): When the local DNS servers and the authoritative
nameservers do not respond to the DNS queries, the machines cannot retrieve IP addresses which
essentially cuts down the communication.

DNS Spoofing Attacks: Provide a fraud IP address to users, tricking them to

communicate with a machine that is different from their intention.
(Example: If a user’s intention is to visit a bank’s web site to do online banking, but the
IP address obtained through the DNS process is attacker’s machine, the user machine will
communicate to the attacker’s web server.)

DNS cache poisoning attack - the attacker aims to inject malicious data into the DNS cache,
leading to incorrect or malicious IP address resolutions.

SAST is a white-box testing method that analyzes the source code of an application for security
vulnerabilities without executing the program.
DAST is a black-box testing method that analyzes a running application for security
vulnerabilities by actively testing it during runtime and providing a more realistic assessment of
an application's security.
DNSSEC
DNSSEC is a set of extension to DNS, aiming to provide authentication and integrity
checking on DNS data. With DNSSEC, all answers from DNSSEC protected zones are digitally
signed.
By checking the digital signatures, a DNS resolver is able to check if the information is
authentic or not. DNS cache poisoning will be defeated by this mechanism as any fake data will
be detected because they will fail the signature checking.

DNSSEC versus TLS/SSL

Both DNSSEC and TLS/SSL are based on the public key technology, but their chains of
trust are different. DNSSEC provides chain of trust using DNS zone hierarchy. TLS/SSL relies
on Public Key Infrastructure.

OWASP Top 10
1. Broken Access Control
2. Cryptographic failures
3. Injection
4. Insecure design
5. Security misconfiguration
6. Vulnerable and outdated components
7. Identification and authentication failures
8. Software and Data Integrity failures
9. Security logging and monitoring failures
10. Server-side request forgery
Cross Site Request Forgery
CSRF is an attack that forces an end user to execute unwanted actions on a web application in
which they are currently authenticated.

Secret Token
A popular idea is for a web server to use a secret token that can only be retrieved by its own web
pages. All the same-site requests should include this secret token. The secret is randomly
generated and is different for different users. So, there is no way for attackers to guess or find out
this secret. One approach is to embed a random secret value inside each web page. Another
method is to put a secret value in a cookie.

Cross Site Scripting (XSS)

XSS is a vulnerability that allows attackers indirectly execute the malicious code on victim’s
web browser via legitimate website or web application. Basically, attackers must find a way to
inject their malicious code to the victim's browser via the target website.
In both CSRF and XSS attacks, forged requests are sent out.
– In the CSRF attack, these forged requests are cross-site requests
– In the XSS attack, the forged requests are actually "same-site" requests.

Reflected XSS
If a website with a reflective behavior takes user inputs, it may have an XSS vulnerability.
Attackers can put JavaScript code in the input, so when the input is reflected back, the JavaScript
code will be injected into the web page.

Stored XSS
Attackers directly send their data to a target website server and stores the data in a persistent
storage. If the website later sends the stored data to other users, it creates a channel between the
users and the attackers.

SQL Injection Attack

SQL injection is a type of cyber-attack that occurs when an attacker inserts malicious SQL code
into input fields used by a web application. The goal of an SQL injection attack is to exploit
vulnerabilities in the application's code and database to gain unauthorized access to data, modify
data, or perform other malicious actions.