Typical scenario Considerations for Alice and Bob.pdfVIP

Uni Innsbruck Informatik - 1 Internet Technology Security Michael Welzl michael.welzl@uibk.ac.at DPS NSG Team http://dps.uibk.ac.at/nsg Institute of Computer Science University of Innsbruck, Austria Uni Innsbruck Informatik - 2 Scope ? Note: only interested in communication related attacks! – not: exploitation of OS vulnerabilities (software flaws)! ? assumption: software bug-free :) ? Examples of attacks based on software flaws: – viruses (flaw in email tool, ..), worms (flaw in web servers, ..), rlogin, .. ? Very common attack (related to network programming): Buffer Overflow – Assumption 1: (e.g., C) program writes into buffer without proper checks data source: Internet packet content – Assumption 2: knowledge of OS, compilers, .. ? memory layout – Idea: write malicious code into buffer, overwrite function return address ? make system execute desired code (e.g., shell with root rights) ...thus, be careful with memory operations! Uni Innsbruck Informatik - 3 Typical scenario Uni Innsbruck Informatik - 4 Alice Bob Trudy What could Trudy do? - eavesdrop - claim to be Alice (to hear Bob‘s answer) - change message (e.g. have Bob call Carlos on the phone) - deny the service (break the telephone) Carlos Uni Innsbruck Informatik - 5 Considerations for Alice and Bob ? Confidentiality – encryption / decryption using private or public keys – prevent eavesdropping: only sender and receiver should understand ? Authentication – ensure correct identity of sender and receiver ? Message integrity and nonrepudiation – malicious third person should not have a chance to change the content! – should be possible to prove that message X was sent by sender Y. ? Availability and access control – Common Denial-of-service (DoS) attacks make a system unavailable Uni Innsbruck Informatik - 6 Security and layers ? Confidentiality – Layer-independent; can be implemented at a very high layer! – Consider: packet sniffing - common link layer threat (WLAN) ? Authentication – relevant at all laye