The idea
Every earlier module assumed the network does what it is told. Security starts from the opposite assumption: somebody on the path wants the packets to do something else. They might read them, change them, replay them or stop them arriving.
To talk about that without naming real people, the lecture uses a fixed cast. Once you know who the cast are and what each can do, the list of attacks is short and each one maps onto one of three things you might want to protect.
How it works
The cast
Alice and Bob communicate over the Internet. Two other characters sit on the path between them.
- Alice is the legitimate sender.
- Bob is the legitimate receiver.
- Eve is an eavesdropper, a passive attacker.
- Mallory is a malicious active attacker.
Alice and Bob do not have to be people. The lecture’s examples are a web browser and server doing an online purchase, an online banking client and server, DNS servers, and BGP routers exchanging routing table updates.
How it works
What a bad guy can do
The lecture asks what a “bad guy” can do and answers “a lot”, then splits the list between the two attackers.
- Eavesdrop: intercept messages. This is Eve.
- Insert messages: actively put messages into a connection. This is Mallory.
- Impersonate: fake (spoof) the source address in a packet, or any other field in it. Mallory.
- Hijack: take over an ongoing connection by removing the sender or the receiver and inserting himself in their place. Mallory.
- Denial of service: prevent a service from being used by others, for example by overloading its resources. Mallory.
Only the first item is Eve’s. Everything else involves changing what happens on the network.
How it works
The three security goals
Each goal is the thing an attacker is trying to break.
- Confidentiality. Information is hidden from unauthorized access. It applies to both the storage and the transmission of information.
- Integrity. Information is protected from unauthorized change. Changes are made only by authorized entities and through authorized mechanisms.
- Availability. Information is made available to an authorized entity when it is needed. Information is useless if it is not available.
How it works
Passive and active attacks
The lecture sorts attacks by whether they touch the traffic.
| Type | What the attacker does |
|---|---|
| Passive | An unauthorized party eavesdrops on the communication between two parties but does not tamper with the messages. |
| Active | The attacker transmits tampered data to one or both of the parties, or blocks the data stream in one or both directions. |
The lecture has a slide titled “Attacks to Security Goals” and another that repeats it with the passive and active groups marked. Both are figures and extracted to no text. The grouping below follows the text slides that survive.
How it works
Attacks on each goal
Attacks threatening confidentiality
- Snooping is unauthorized access to, or interception of, data. The defence is to make the data non-intelligible to the interceptor using encipherment techniques.
- Traffic analysis is intercepting and examining messages to deduce information from patterns in the communication, for example pattern-of-life analysis. It can be performed even when the messages are encrypted.
Attacks threatening integrity
- Modification. The attacker modifies the information to make it beneficial to herself.
- Masquerading or spoofing. The attacker impersonates somebody else.
- Replaying. The attacker obtains a copy of a message sent by a user and later tries to replay it.
- Repudiation of action. The sender (or receiver) later denies that he sent (or received) the message. This is a threat against accountability.
Attacks threatening availability
- Denial of service (DoS). The attacker acts to deny resources or services to entities that are authorized to use them. The lecture gives two ways: send many bogus requests to overload a server, or intercept and delete a server’s response so the client believes the server is not responding.
Where marks get lost
Encryption does not close every confidentiality hole
Encryption defeats snooping because the interceptor cannot read the content. It does not defeat traffic analysis, which uses who talks to whom, when and how often. If a question asks which confidentiality attack survives encryption, the answer is traffic analysis.
Where marks get lost
Repudiation sits under integrity
Repudiation is a denial by a party, not a change to the data, but the lecture lists it with the integrity attacks as a threat to accountability. Expect it to be tested as an integrity attack and to be answered with a nonrepudiation service.
In the exam
- Cast: Alice sender, Bob receiver, Eve passive eavesdropper, Mallory active attacker.
- Goals: confidentiality, integrity, availability, each with the lecture’s one-line definition.
- Passive means no tampering. Active means tampering or blocking.
- Grouping: confidentiality has snooping and traffic analysis. Integrity has modification, masquerading, replaying and repudiation. Availability has DoS.
- Hijacking, spoofing and DoS are all listed as Mallory’s actions.
Aside
The lecture treats masquerading and spoofing as the same attack and files both under integrity. Its Mallory list also names spoofing a source address as impersonation. The terms are used interchangeably across the two slides.
Check yourself
- Eve listens and Mallory acts. Alice and Bob are the legitimate parties.
- The goals are confidentiality, integrity and availability.
- Passive attacks do not tamper with messages. Active attacks tamper or block.
- Traffic analysis works on encrypted traffic.
- Repudiation is an integrity-side threat against accountability.