Please enable JavaScript.

Coggle requires JavaScript to display documents.

System Security - Coggle Diagram

- - - - Man in the middle attack
        
        drop redirections and impersonate the server . http connection between client - adversary . https connection between adversary - server
    - - 5.4Strict Transport Security(HSTS)
        
        Including the HSTS header in the website HTTPS response and tells which the browser to always use the HTTPS when communicating with the website
      - 5.5HTTP public key pining(HPKP)
        
        website specific the server's public key by including the Public -key-pins header, browser will reject any cert that don't match the pinned public key
      - TOFU (trust on first use)model
        
        user connect to the server for the first time, user should trust the server without needing to rely on a third party like CA, the sverer's public key stores on the user, and user can detect the server public key change and refuse connection
  - - - users create new contents . javascript express the webpage
    - - The adversary cause the user visit a URL for a website . The URL contains the malicious JS code . The user clicks on the url link and executes the code. The code is executed within the website's origin
    - - Input validation
        
        Whitelist . Escape data before putting it into HTML . Secure tool and framework
      - content secure policy(CSP)
        
        Inline scripts can be disallowed
        
        Web operator specifies scripts that allowed to be executed on its page
  - - - Whitelist . no trust client - side validation
      - 5.9SQL injection
        
        Browser . web server . database
        
        Prevention
        
        Do not build raw queries
        
        use secure tools and framework . consider using abstractions
        
        validate user input on the server side
        
        reject special character . escape input string . site specific input
  - - - Secure the HTTP called HTTPS
    - - All data are encrypted using the secert key that is specific to browsing session, the key os agreed during the initial connection handshake
        
        not provide the authentication
        
        Certificate Authorities(CA)
        
        Verifying that whoever registers the public key is indeed affiliated with the claimed identity. If validated, the CA issues a certificate that asserts that a public key is owned to a certain entity
        
        get certified by another CA
        
        Chain of trust
        
        Attacks
        
        CA is hacked or erroneously issues a certificate to the wrong entity
        
        MonPass . DigiNotar . Digicert
        
        Prevent
        
        DANE . CAA
        
        Detection
        
        5.2Certificate Transparency(CT)
        
        4 more items...
  - - - Flow
        
        Reques
        
        Method . Path . Version of the protocol . Headers
        
        Response
        
        Version of the protocol . Status code . Status message . Headers
    - - Hypertext Markup language(HTML)
        
        create webpage
        
        document . objects . images . forms
      - Cascading Style Sheets(CSS)
        
        describing the presentation of webpage
      - Javascript
        
        manipulate the webpage
    - - HTML . JS . CSS . Media
    - - Malicious websites should not be able to
        
        modify the not-related inforamtion of the computer or other websites
        
        steal confidential information from the computer or other websites
        
        spy on the computer activites or other websites
      - 3.6Same - origin policy
        
        Isolation mechanism
        
        The scripts from the webpage can access the data form another webpage only if both webpages have the same origin
        
        origin . protocol . hostname . port
        
        Cros - origin communciation . Cross origin Resource Sharing(CORS)
        
        If the server explicitly allows cross origin requests by including the specifc HTTP headers in the response, the browser will allow the request to be processed
- - - - DNS resolvers / servers / clients / iterators
        
        DNS Caching
    - - Does not provide the security properties
      - On-path adversary
      - Off-path adversary
        
        4.1Kmainsky attack
        
        DNS packet
        
        IP header / UDP header / DNS data
        
        Visit this website "http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.htm"
        
        Prevention
        
        Randomization of the query ID field and the source port
        
        Do not expose the resolvers
        
        4.2DNS Security Extension(DNSSEC)
        
        Some KPI for the DNSSEC . .
        
        The authentication for the resource records
        
        Sign use the private key and verify with the public key
        
        4.3RRSIG - contains the signature for another RR
        
        DNSkey - store a public key
        
        DS - hash the domain name and the DNSkey record
        
        4.4Zone signing key and the key signing key
        
        The process of DNSSEC - "https://blog.thousandeyes.com/introduction-dnssec-monitoring/"
        
        The NXdomain
  - - - The unique number associated(ASN)
    - - exchange routing information between the routers in different AS
        
        share the information about the best routes to other AS
    - - exchange routing information between the routers within the same AS
        
        Share the information about the best routes to external destinations
    - - Route origination
        
        Longest prefix match
        
        Valley - free routing
    - - prefix hijacking
      - announcement of unallocated address space
      - AS path modification
        
        Kapela-Pilosov attack
        
        replace a prefix in a received update with a more specific prefix
      - Proposals
        
        BGP origin validation(BGP - OV)
        
        ROA
        
        verify the ownership of the IP address prefix by AS
        
        RPKI - based prefix validation
        
        Challenges
        
        The size of RPKI
        
        Can be abused
        
        create and manage the ROAs
        
        BGP path validation(BGP - PV)
        
        BGPsec
        
        via a BGP path attribute that carries digital signature produced by each AS that propagates the Update message
        
        Challenges
        
        New infrastructure needed to facilitate it
        
        Not widely deployed
        
        Too complex for AS
        
        CPU / memory / storage and SW / HW upgrades
        
        SW
        
        1 more item...
        
        HW
        
        1 more item...
        
        Data plane prevention
        
        IPSEC, TCP MD5 field, Generalized TTL Security
        Mechanism (GTSM)
    - - TLS
        
        End - entity PKI
        
        identified by domain names
        
        Otrhogonal to DNSSEC
        
        Certification Authorities are trusted entities
        
        Certificates
        
        Domain - Validated Certificates(DV)
        
        provide the ownership over the domain name
        
        E-mail / HTTP / DNS
        
        Organization - Validated Certificates(OV)
        
        Domain ownership and checking organization
        
        Extended - Validated Certificates(EV)
        
        Domain ownership and checking organization and F2F meeting
        
        Downgrading attack
        
        force a server amd a client to use a weaker version of the TLS protocol, intercepting and manipulating the TLS handshake message between the server and the client
        
        Impersonation attack
        
        attacked CA . DigiNotar . Comodo
        
        intercepts the initial TLS handshake messages and replace the server's TLS/SSL certificate with a fake one that they control
        
        DNS based PKI enhancements
        
        4.6DNS based Authentication of named Entities(DANE)
        
        Specify keys they trust
        
        Their key
        
        CA key
        
        DNSSEC - TLSA(Transport Layer Security Authenciation) RR
        
        4.7Certification Authority Authorization(CAA)
        
        only the CAs listed in the record are authorized to issue certificate s for the domain
- - - - Assumptions about the adversary
      - 1.2.Some Terminology
      - Some key elements
        
        4+1 view model
        
        Logical view
        
        Development view
        
        Process view
        
        Physical view
        
        System environment Scenarios
        
        For designers/developers/integrators/operators/end users
      - Data Flow Diagram-DFD
      - 1.3.STRIDE
        
        Spoofing: authentication
        
        Tampering: Integrity
        
        Repudiation: non-repudiation
        
        Information disclosure: Confidentiality
        
        Denial of service: availability
        
        Elevation of Privilege: Authorization
      - 1.4.Attack tree
        
        harmful behavior
        
        Subpoints - Why Attacker can do this behavior?
        
        MITRE CAPEC (Common Attack Pattern Enumeration and Classification)
      - DREAD
        
        Damage - how bad would an attack be?
        
        Reproducibility - how easy it is to reproduce the attack?
        
        Exploitability - how much work is it to launch the attack?
        
        Affected users - how many people will be impacted?
        
        Discoverability - how easy it is to discover the threat?
      - CWE - CVE - CVSS
        
        Common Weakness Enumeration
        
        Common Vulnerabilities and Exposures
        
        Conmmon Vulnerability Scoring System
      - PASTA
        
        Process for attack simulation and Threat Analysis
    - - Tools that help to implement the security policy
    - - Security is a process
    - - Keep it simple and stupid . . .
      - Open design
      - Compartmentalization
        
        Organize resources into isolated groups of similar needs
      - Minimum Exposure
        
        Minimize the attack surface a system presents to the adversary
      - Least Privilege
        
        Using the lease set of privileges necessary to complete its job
      - Minimize Trust and Maximize Trustworthiness
      - Secure and Fail-Safe Defaults
        
        Whitelist vs blacklist access control
      - Complete Mediation
        
        Access to any object must be monitored and controlled
      - No Single Point of Failure
        
        If one mechanisms fails, there are others in place to prevent attacks
        
        SPOFs in Security
        
        SPOF in Availability
      - Traceability / Generating Secrets / Usability
    - - privilege model
        
        User
        
        Identified by user id and group id
        
        /etc/passwd, /etc/group, /etc/shadow
        
        Deines what privileges does a process have
        
        Process
        
        The uid and gid of the process
        
        Create, kill, debug, changign uid
        
        Object that the process may act on
        
        Files/Directories / Memory, Process, I/O, IPC
        
        -(document)(for owner : rwx)(for group : rwx)(for other : rwx)
        
        s - it will run with the permission of the file owner or goup owner
        
        When the dictionary has the t permission set, only the owner of a file can delete it
        
        Networking
        
        Listening, connecting, Read and write, send raw packets
- - - - static and dynamic allocation
      - Compiler does not check it
      - No garbage collector
    - - Contiguous sequence of characters terminated by null characters
      - Allocated memory / Other memory
      - Process Memory Layout
        
        Text
        
        Contains program instructions
        
        readable and executable
        
        Data
        
        Contains initalized global variables
        
        readable and writeable
        
        BSS
        
        Contains uninitialized global variables
        
        readable and writable
        
        Heap
        
        Contains dynamically allocated memory
        
        Heap grows to higher-memory addresses
        
        Stack
        
        Contains memory associated to function calls, including the static allocated memory
        
        Stack grows to lower-memory addresses
        
        Unused Menory
        
        Parameters and variables are stored on the stack, while dynamically allocated memory is stored in the heap
        
        Function calls
        
        2.2Stack Frame
        
        Added at the top of stack
        
        Top is the currently executed function and is removed when the function returns
        
        2.3Registers
        
        EIP Exented instruction pointer(扩展指令指针寄存器)
        
        EIP points to the memory address of the currently executing instruction.
        
        ESP Extended Stack Pointer(扩展栈指针寄存器)
        
        ESP points to the top of the stack
        
        EBP Extended Base Pointer(扩展基指针寄存器)
        
        EBP points to the bottom of the current stack
        
        For the stack of the memory, it puts the first value at the top of the stack, the high memory part
        
        Corrupted Stack and Exploit(Stack overflow)
        
        The DOS attack
        
        Inject the code to stack and modify the return address such that it points to the malicious code
        
        Protection
        
        2.5Stack Canaries
        
        5 more items...
        
        Other vulnerabilities
        
        2.8Integer Overflow
        
        Types and Bytes they takeup
        
        1 more item...
        
        Cal the avg of int a,b and avoid the integer overflow
        
        1 more item...
        
        Heap overflows
        
        Logic errors
        
        Double free()
        
        Use after free()
        
        Avoid memory vulnerabilities
        
        Fuzzing - Ranodm inputs to crash program
        
        1 more item...
        
        Do not use the unsafe language
        
        3 more items...
        
        2.4Callee rule
        
        prologue
        
        push ebp / mov ebp, esp / sub 12, esp
        
        epilogue
        
        mov esp , ebp / pop ebp / ret
- - - - Segment header
      - Transmission Control Protocol(TCP)
        
        Reliable
        
        handshake
        
        SYN / SYN-ACK / ACK
        
        Sequence numbers
      - User Datagram Protocol(UDP)
        
        Fast
        
        Unreliable
        
        Connectionless
      - Reflection and amplification attacks
      - Layer-4 attack
        
        DDos
        
        UDP Spoofing
        
        TCP hijacking
        
        Connection reset and slow-down
        
        3.5SYN flooding
        
        Layer-4 Prevention
        
        Random source port and sequence numbers
        
        3.6SYN cookie
        
        Other Defenses and Mechanisms
        
        Management
        
        Keep the system updated and cofigured to minimize the attack surface
        
        Fitering
        
        Use the firewalls to block the attacks
        
        Intrusion Detection and Prevention
        
        Monitor network to find the suspicious behavior
        
        Data protection
        
        Encryption and authentication
    - - Packet header
      - IP address
      - Routing Protocol
      - Layer-3 attacks
        
        Dynamic Host Configuration Protocol(DHCP) Starvation
        
        3.4DDos attack
        
        Smurf Attack
        
        prevent and mitigate
        
        3.3IP Spoofing
        
        Routing Attacks
    - - Frame header
      - PPP / SLIP / MPLS / ATM / Fraem relay
      - Ethernet
        
        Fairly simpel
        
        Frames as data units
        
        Hubs and switches
      - Ethernet Type 2 Frame
        
        MAC header
        
        Destination MAC address
        
        Source MAC address
        
        Ethertype
        
        Data
        
        CRC Checksum
      - Layer2-attack
        
        Hubs and Switches(CAM overflow)
        
        3.1Address Resolution Protocol(ARP) Sniffig and Spoofing
        
        Defend against ARP Spoofing attack
        
        Implementing the static ARP tables
        
        Using ARP spoofing detection tools
        
        Enable the port security
        
        Using VPNs, encrypting traffic between the network devices
        
        Risk assessment
        
        /intercept the network traffic
        
        Conduct DOS attack
        
        Steal the network credentials
        
        Breaking LTE on layer TWO
        
        Packet data Convergence Protocol(PDCP)
        
        No user plane Integrity protection
        
        Three attacks on Layer Two
        
        Identity Mapping
        
        Website Fingerprinting
        
        aLTEr Attack
        
        Three attacks Components
        
        Plaintext Modification
        
        Know plaintext attack
        
        Man in the Middle
        
        DNS Spoofing
        
        Risk assessment
        
        How to defend it
        
        Other Layer-2 attack
        
        VLAN attacks
        
        3.2MAC(Media Access control) Spoofing
        
        The main different between the MAC spoofing and ARP spoofing is that the MAC spoofin involves changing the MAC address of a deivce to impersonate another device on the network while ARP spoofing involves manipulating the ARP protocol to associate the attacker's MAC address with the IP address of another device on the network. Both techniques can be used to carry out similar attacks, but they differ in their methods of execution.
        
        MAC spoofing includes the changing MAC address of the device to impersomate another device on the network, allowing it to intercept or redirect network traffic intended for that device
    - - Raw bits
      - Layer-1 attack
        
        Physical attacks
        
        destruction / obstruction / mamipulation / malfunction / jamming / Eavesdropping
        
        Risk assessment
        
        How to defend it
      - PHY chip
        
        transmitting and receiving data
    - - Network and host-base firwalls
      - Packet Filtes 1st generation
        
        Allow / Reject / Drop
      - State Filters 2nd generation'
        
        Understand about Layer4 and make decision base on that
      - Application layer 3rd generation
        
        Understand the application and the protocols
        
        HTTP / DNS / SMTP
        
        3.8Intrusion detection and prevent system
        
        Monitor the network or the system for adversarial activites
        
        Network base
        
        Host base
        
        Differnet detection methods
        
        Signature-based detection
        
        Anomaly-based detection
        
        Protocol analysis detetcion
        
        Limation and issues
        
        false positive and false negative
        
        encryption can make them almost useless
        
        Many kinds of attack
        
        2 more items...