Networking & Network Attacks Engineering Secure Software Last - PowerPoint PPT Presentation

Networking & Network Attacks Engineering Secure Software Last Revised: August 28, 2020 SWEN-331: Engineering Secure Software Benjamin S Meyers 1

Why Do We Study Networks? Networks scans are the most prevalent method of ● understanding an environment, with the intent to use that information to run exploits To understand how to protect your system, you have to ● understand how the system works! Note: In a future lecture, we’ll learn about MITRE ATT&CK, a ● taxonomy of tactics/techniques for general pentesting knowledge Discovery: The adversary is trying to figure out your environment ○ SWEN-331: Engineering Secure Software Benjamin S Meyers 2

How Do Computers Communicate? The 7 layers of the classic OSI model Source: https://www.electronicdesign.com/unused/article/21800810/whats-the-difference-between-the-osi-sevenlayer-network-model-and-tcpip SWEN-331: Engineering Secure Software Benjamin S Meyers 3

OSI Model: Physical Layer Responsible for transmission of unstructured raw data ● between physical device and transmission medium Converts digital data to electrical/radio/optical signals ○ Defines characteristics of voltage levels, data transmission ● rates, physical connectors (pin layouts, signal frequency) Defines specifications for Bluetooth, Ethernet, and USB ● standards Controlled Area Network (CAN) ● Jaguar speed controllers in FIRST Robotics ○ SWEN-331: Engineering Secure Software Benjamin S Meyers 4

OSI Model: DataLink Layer Defines protocols for establishing/terminating physical ● connections and controls how data flows between physically connected devices Two sublayers ● Medium Access Control (MAC) -- controls hardware responsible ○ for interaction with wired/optical/wireless transmission mediums Error control (e.g. collisions) ■ MAC addresses for individual network interfaces ■ Logical Link Control (LLC) -- interface between MAC and OSI ○ Network Layer SWEN-331: Engineering Secure Software Benjamin S Meyers 5

OSI Model: Network Layer Responsible for transferring packets between nodes in ● different networks Routing packets through intermediate nodes ● IPv4 (32bit) and IPv6 (128bit) ○ Path determination ○ IP communication is connectionless (no response necessary) ● SWEN-331: Engineering Secure Software Benjamin S Meyers 6

OSI Model: Transport Layer Responsible for quality of service and data integrity ● e.g. packet loss, bit rate, throughput, transmission delay, ○ availability, jitter Transmission rates (e.g. phone vs. server) ● Packet splitting (segmentation & desegmentation) ● Retransmission ● User Datagram Protocol (UDP) is faster than TCP, but not as ● reliable e.g. post office inspections ● SWEN-331: Engineering Secure Software Benjamin S Meyers 7

OSI Model: Session Layer Responsible for establishing/managing/terminating ● connections between local and remote devices Remote Procedure Calls (RPC) ● One form of Inter-Process Communication (IPC) ○ Authentication and authorization happen here ● Transmission Control Protocol (TCP) spans the Transport and ● Session Layers API’s (e.g. NETBIOS) ● SWEN-331: Engineering Secure Software Benjamin S Meyers 8

OSI Model: Presentation Layer Translates between application-specific data formats and ● network packet formats e.g. conversion from packet to XML (and vice versa) ○ Sometimes called the “syntax” layer ● Some data compression functionality ● Data encoding ● ASCII (7-8 bits per character) vs. EBCDIC (8 bits per character) ○ EBCDIC is non-linear ○ Unicode (UTF8, UTF16) ○ SSL/TLS ● SWEN-331: Engineering Secure Software Benjamin S Meyers 9

OSI Model: Application Layer Interacts with applications that implement communication ● Responsible for displaying received data to the user and ● sending data from the user to the presentation layer (which then gets sent through the other OSI layers) Defines specifications for shared communication protocols ● e.g. HTTP, FTP, SMTP, DNS ○ Application specific protocols (e.g. RDP, LDAP) ○ SWEN-331: Engineering Secure Software Benjamin S Meyers 10 10

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session 4 Transport 3 Network 2 DataLink 1 Physical OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 11 11

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session 4 Transport 3 Network 2 DataLink 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 12 12

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session 4 Transport 3 Network 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 13 13

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session 4 Transport 3 Network Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 14 14

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session 4 Transport Responsible for quality of service and data integrity 3 Network Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 15 15

Crash Course in Network Communication Classic Model 7 Application 6 Presentation 5 Session Establishes connection between devices (also maintains, authenticates, etc.) 4 Transport Responsible for quality of service and data integrity 3 Network Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 16 16

Crash Course in Network Communication Classic Model 7 Application 6 Presentation Ensures compatibility between the data formats from lower to upper layers 5 Session Establishes connection between devices (also maintains, authenticates, etc.) 4 Transport Responsible for quality of service and data integrity 3 Network Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 17 17

Crash Course in Network Communication Classic Model 7 Application Works with applications to provide communications & functions 6 Presentation Ensures compatibility between the data formats from lower to upper layers 5 Session Establishes connection between devices (also maintains, authenticates, etc.) 4 Transport Responsible for quality of service and data integrity 3 Network Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 18 18

Crash Course in Network Communication Classic Model Modern Model 7 Application Works with applications to provide communications & functions Applications (FTP, 6 Presentation Ensures compatibility between the data formats from lower to upper layers HTTP, SMTP, etc.) 5 Session Establishes connection between devices (also maintains, authenticates, etc.) 4 Transport TCP Responsible for quality of service and data integrity 3 Network IP Packet routing (IP Address source/dest and port) to socket 2 DataLink Pack/unpack data frame (MAC source/dest) -- unique identifier Ethernet 1 Physical Physical connection, data rates, bit level handling OSI 7-Layer Model vs. Modern Network/Internet Model SWEN-331: Engineering Secure Software Benjamin S Meyers 19 19

TCP/IP Communications Application Application Transport Transport Router Router Source Destination Network Network Network Network Computer Computer DataLink DataLink DataLink DataLink In a typical network, computers are on subnets; routers transmit between subnets SWEN-331: Engineering Secure Software Benjamin S Meyers 20 20

TCP/IP Communications Client Server TCP Packet SEQ=1, LEN=700 TCP Packet ACK=1 TCP Packet SEQ=2, LEN=1000 ⋮ TCP Packet ACK=2 TCP Packet ⋮ SEQ=20, LEN=250 TCP Packet ACK=20 SWEN-331: Engineering Secure Software Benjamin S Meyers 21 21