Problems with IP reassembly in intermediate routers

Auditing, Monitoring, Intrusion Prevention, Intrusion Detection, and Penetration Testing

"Unlike IP fragmentation (which can be done by intermediate devices), IP reassembly can be done only at the final destination. What problems do you see if IP reassembly is attempted in intermediate devices like routers?" [ ]

IP fragmentation is defined as the IP (Internet Protocol) that breaks datagrams into smaller fragment to assist packets passing through links and forming a smaller MTU (maximum transmission unit) than its original size. However, the fragments reassemble themselves when reaching the receiving hosts. After the receiving hosts have received the fragmented IP packet, they have to reassemble the datagram before passing it to the higher layer. In practices, the reassembly happens in the receiving hosts, however, a reassembly may be carried out by the intermediate router. For example, the NAT (network address translation) is designed to reassemble the fragments to the translate data streams. Several problems can occur if IP reassembly is carried out by the intermediate device such a router. A packet loss is one of the major problems, which will lead to poor performances. It is essential to realize that a loss of fragment can be attributed to the idiosyncratic gateway behavior, link errors, and congestion resulting to the segment retransmission, and a continuous loss of a packet.

Moreover, the router will slow the reassembly process since routers are not capable to reassembly efficiently. Another problem is that it will lead the smaller fragments to travel over a long route, which increases the chances of fragments got missing and entire message can be discarded through this process.

The IP reassembly by the intermediate device can also lead to bottlenecks. Essentially, routers are designed to process a large number of packets, easily and quickly. Mandating them to reassemble the packets will increase the complexity of their functions, which will slow down the process. Moreover, a reassembly by the intermediate device can lead to inefficient use of resources. If a bad intermediate device is chosen for reassembly, it can make the router to process a large number of the packet header, which can cause a slowdown in the transmission process. For example, if 1010 datagrams are fragmented over 1000 MTU size, the downstream nodes will receive twice the number fragments and packets than its original size of 1000. Reassembly through the routers can lead to an inefficient reassembly, which can lead to a reassembly deadlocks where a large number of packets or fragments are partially reassembled. In most cases, the intermediate devices are not designed to perform the reassembly process, however, when the intermediate devices are required to perform the reassembly process, they slow down the reassembly process.

(Kozierok, 2005).

b. "Let's assume that Host A (receiver) receives a TCP segment from Host B (sender) with an out-of-order sequence number that is higher than expected as shown in the diagram. Then, what do Host A (receiver) and host B (sender) do"? [ ]

Answer:

When the Host B, the sender, sends the TCP higher than the expected to the Host A (receiver), the result is that the receiver will not be able to receive the TCP segments as being detected by TCP/IP protocol. Typically, the individual packets within a single stream can traverse different paths right from the sources to the destination. In this case, packets may be corrupted or get lost, which may prevent them reaching their final destination. In this case, the TCP handles the potential problems using the strategy of assigning each byte to the sequence number. The segments are 100 bytes in length, and if Host A receives segment 01 ~ 100, it will automatically respond to Host B. using the ACK that contains the missing segment sequence 101. After the missing segment is detected, Host A (the receiver) will send an ACK 301 to indicate to the Host B (sender) that segments 201 ~ 300 and 101 ~200 were received.

2. "Describe or propose a way to detect ARP spoofing attack. What could be a possible weakness in your proposed method? Please do not discuss any prevention method (e.g., port security is an example of a preventive method)."[ ]

Answer

The ARP (Address Resolution Protocol) spoofing arises when there is the absence of authentication mechanism that can be used to verify the identity of the sender. In the contemporary IT environment, ARP spoofing has been widely susceptible to attack such as sophisticated Dos (denial of service) attack, and session hijacking. Moreover, the attackers send the ARP message to LAN (local area network) to intercept the data frame over the network systems. The passive approach that involves the ARP monitoring is one of the effective methods to detect the ARP spoofing by looking for the network inconsistency in the corporate Ethernet. The downside of the passive approach is that the time lag to detect the ARP spoofing is long, which sometimes lead to damage being already done before the attacks being detected. To address this shortcoming, specialized tools can be used to monitor the ARP spoofing attacks. For example, the Arpwatch is a highly effective monitoring tool to carry out the IP mapping. The tool has the ability to dump information to Syslog as well as sending an email to the network administrators when a suspicious event occurs in the systems.

The IDSs (Intrusion Detection Systems) are the other tools to detect the ARP spoofing, and has the ability to inform the security administrator through an appropriate alarm or alert. A major setback of the IDSs is that they can generate a significant number of false alarms that devoid of attacks. Moreover, their ability to detect the ARP attack is limited. ARP-Guard is another system to detect the ARP spoofing that involves delegating the detection task to one of the detection station. The ARP-Guard is an effective tool to detect the ARP poisoning, however, attackers may hide behind a large volume of traffic for a long time and remain undetected. (Abad, & Bonilla, 2007).

Kukoleca, Zdravkovic, & Ivanovic, (2014) argue that Syslog is an effective strategy to detect the ARP spoofing because logs contain valuable information, which can assist to know when the system has been compromised by the ARP spoofing. Moreover, logs provide critical forensic data to detect vulnerability and can be used in mapping out the events that lead to the security breach. Despite the benefits associated with Syslog, its shortcoming is that an attacker may inject false information into the system to deceive the security administrator.

3." [Wireless LAN Security-WEP] What is the main difference between the FMS attack and Chopchop attack?" Clearly explain your answer [ ]

Answer:

In the IT environment, different vulnerabilities and flaws have been associated with the WEP (Wired Equivalent Privacy). While the goal of WEP is to achieve a high level of data confidentiality, however, WEP face challenges to guarantee data confidentiality in the network systems because of the associated number of attacks. The chopchop and FMS are two most common forms of attacks on WEP. The nature of the FMS attack is that the attackers transmit a large number packets, which can be up to millions to the WAP (wireless access point) in order to collect a response packet. In the WEP attack, the attackers listen passively to WEP protect traffic to record encrypted packets as well as vectors of these packets. Since it is possible to predict the first bytes of most packets, the attacker is able to recover the first bytes of the encrypted keystream of these packets. Afterward, the attacker transmits the unprotected initialization vector of the packets, which assists the attacker to discover the first three bytes per packet key. Thus, the attacker exploits the weakness of RC4 by performing the RC4 manipulation, which allowing the attacker to guess 5% probability of the byte of the security key. By using the voting system, the attacker will be able to guess the probability of the right key and test it. If the key does not work, he would try another key until a correct key is obtained. The working protocol of the attack is as follows: The attacker can stimulate the first steps of RC4-KSA. However, the attacker needs between 4 million and 6 million packets to achieve his aim with the success probability of at least 50%.

On another hand, the chopchop attack exploits the WEP encryption using the trial and error to determine the PSK. Typically, the chopchop attack uses the AP (access point) to decipher wireless and ARP (Address Resolution Protocol). The major difference between the WEP attack chopchop attack is that the chopchop attacker guesses the last byte by assuming the last encrypted byte is equal to zero. On the other hand, the FMS attacker starts with the first byte to start an attack. In the chopchop attack, the attacker re-encrypt the packet and transmit to the AP since the attacker is using the multicast packet making the guess to be correct. However, the chance of success is 50-50 in the case of the FMS attack. While FMS can reveal the WEP key in the process, the chopchop attack will not reveal its WEP key by allowing the attacker to bypass the WEP encryption and decrypt the packet without actually supplying the key.

4. "A large enterprise decides to use a symmetric encryption to protect routing update messages between its own routers (i.e. entire routing update messages are encrypted by a strong shared symmetric key). They think this will prevent routing table modification attacks. Do you think their decision is appropriate? Do you see any problems or issues with their decision"?

Answer:

The decision of the enterprise is appropriate because the Symmetric encryption offers an effective and viable security mechanism for the integrity checking. A high effective symmetric encryption consists of SEAD protocol that is based on one-to-one way hash chains, which is efficient for updating the vector-based routing. Moreover, the hash tree chain is used for the tree authentication and distance vector security. The shortest path protocols also help in achieving a cumulative authentication encryption protocol, and one-way chains are able to secure the systems through the authentication. Thus, the symmetric solutions are efficient in eliminating the hash processing for in-line routers. Distributed and centralized symmetric approach are the other symmetric models where the Centralized key distribution are lengthy in size to the routers, however, distributed key distribution is the most efficient way of implementing the symmetric approach.

Moreover, asymmetric encryption also assists in protecting routing update messages and securing the BGP messages using the two types of symmetric security distribution protocols. The first strategy is to establish the appropriate keys between the routers using the centralized key distribution approach. However, the centralized controller is assumed to be non-existence since each AS distributes the appropriate keys to the BGP routers since the goal of the BGP is make a routing path towards the path information for the IP prefixes. A major drawback of symmetric keys is that an attacker can compromise the key using the brute force attack especially the key with weaker key generation mechanism. Moreover, man-in-the-middle may expose the key, which may compromise the update session. (Bruhadeshwar, Kulkarni, & Liu, 2011).

5. "An ACK scan does not provide information about whether a target machine's ports are open or closed, but rather whether or not access to those ports is being blocked by a firewall. If there is no response or an ICMP "destination unreachable" packet is received as a response, then the port is blocked by a firewall. If the scanned port replies with an RST packet, then ACK packet reached its intended host. So the target port is not being filtered by a firewall. Note, however, that port itself may be open or closed."

"Describe a rule (or a set of rules) that could be used by Snort to detect an ACK scan. Cleary express your assumption and explain your rules. Do you think Bro can do a better job detecting an ACK scan"? "Explain your answer. [ ]

Part A)

"As you can see from the diagram above, the text message sender and receiver have been compromised by the adversary and the Trojan, respectively. However, the router with Snort IDS installed (router/snort) is securely protected and can be fully trusted."

"Write efficient Snort rules and access control lists which will be implemented on the router/snort to detect or block confidential information leakage from High to Low. Write your rationale for writing your rules and access control lists. For example, if the text message receiver (Trojan at High LAN) attempts to send a text message (confidential information) to the text message sender (the adversary at Low LAN), the attempt will be either blocked by your access control list(s) or detected by your snort rule(s)".

"Do not write more than 5 rules and lists in total. At least one access control list must be included." [ ]

Answer

The following rules assists in enhancing the access control and will fire every failed login attempt:

"drop tcp 10.1.2.100 any > 10.1.1.100 22 (

msg:"SSH Brute Force Attempt";

flow:established,to_server;

content:"SSH"; nocase; offset:0; depth:4;

detection_filter:track by_src, count 30, seconds 60;

sid:1000001; rev:1;)"

Moreover, the following access control list and rules should be implemented:

"access-list 101 allow tcp 192.168.3.3 0.0.0.0 9999 192.168.2.2 0.0.0.0 9898 log

access-list 101 deny ip 192.168.3.3 0.0.0.0 225 192.168.2.0 0.0.0. any log"

The Snort rule sends signal an alert when a receiver of text message attempt to write the text from the open port (9999), which prevents the higher security at a lower security device.

The first rule allows the text message send to be received by the correct port 9999 and the second will block all the unclassified LAN traffic and assist in preventing the "No Read Up" violations as well as reducing the risk of Unclassified LAN devices being compromised by the Trojan horse.

Moreover, the following stated ACL entry is to be implemented on the interface:

"access-list 102 deny ip 192.168.3.3 0.0.0.0 any log 192.168.2.0 0.0.0.255 any log access"

The rule is to prevent the traffic from going to Unclassified LAN devices.

"Part B) Describe a way for the Trojan to covertly transmit 4 characters (e.g., A, B, C and D) to the adversary without being detected or blocked by your rules and access control lists provided in Part A." [ ].

Answer

The Trojan horse is able to transmit information over the ICMP, and this can arise because the ICMP uses a different protocol different from IP, thus, it does not use the TCP ports. In part A, the ACL entries are only able to restrict the TCP traffic and IP. However, the Trojan horse is able to hide 4 characters within the payload and reach the victim's devices.

8. "[9 points: IPsec VPN] "What do you think are the advantages & disadvantages of using both AH and ESP protocols on the same end to end IPsec connection (transport mode)? In addition, it is recommended that the ESP protocol should be performed before the AH protocol. Why is this approach recommended rather than authentication (AH) before encryption (ESP)"?

The ESP (Encapsulating Security Payload) and AH (Authentication Header) are the wire-level protocols which are used by the IPsec to authenticate and encrypt data flow within the network connection. However, AH assists in the authenticating however, not to encrypt the IP traffic, and the system is used to guide against the relay forward by the attackers. The authentication is carried out using the computing cryptographic code. However, the ESP delivers one or both packet authentication and encryption. The ESP can also provide the authentication, unlike AH, the authentication strategy is for the encrypted payload and ESP header. Moreover, the ESP can be implemented with or without the AH packet authentication. However, if the encryption is devoid of the authentication, the encryption is vulnerable to the attack.

The AH (Authentication Header) performs a major function for IPsec. Through the use of ICV (integrity check value), the AH is able to provide the integrity checking for the systems. On the other hand, the ESP (Encapsulating Security Payload) is able to deliver the authentication to enhance the data confidentiality through compression and encryption. Moreover, the ESP deliver the integrity, confidentiality and authentication to the system because the ESP authentication portion encrypts the payload and authenticate the data properly after being encrypted. Thus, both the AH and ESP increases the security protocol assisting in authenticating the encrypted payload. However, the security protocols have some shortcomings. First, there will be an increase in resources usage because of an increased processing. Moreover, IP header and packets encrypted can be manipulated causing the integrity errors.

Reference

Abad, C. L., & Bonilla, R. (2007). An analysis of the schemes for detecting and preventing ARP cache poisoning attacks. In Proceedings of the 27th International Conference on Distributed Computing Systems.

Bruhadeshwar, B., Kulkarni, S. S., & Liu, A. X. (2011). Symmetric key approaches to securing BGP: A little bit trust is enough. In Parallel and Distributed Systems, IEEE Transactions on, 22(9), 1536-1549.

Kozierok, C.M. (2005). The TCP/IP Guide: A Comprehensive, Illustrated Internet Protocols Reference. San Francisco.No Starch Press Series.

Kukoleca, M., Zdravkovic, M., & Ivanovic, I. (2014). Securing Linux Servers: Best Practice Document. AMRES/RCUB.

Rehman, R.U. (2003). Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, Mysql, PHP, and ACID. Indianapolis, Prentice Hall.

Security Site (2016). Snort Analyzer. Retrieved 23 November 2016 from http://asecuritysite.com/forensics/snort?fname=nmap.pcap&rulesname=rulesportscan.rules

Tews, E., & Beck, M. (2009). Practical attacks against WEP and WPA. In Proceedings of the second ACM conference on Wireless network security, 79-86.