Title Page

I. Institute Name: Australian College Of Business And Technology

II. Degree Program: Diploma In IT

III. Semester: Semester 3, 2007

IV. Unit Code: CSI1101

V. Unit Name: Computer Security

VI. Lecture Name: Mr. Sunimal Wickramasinghe

VII. Assignment No: 02

VIII. Assignment Title: Security Analysis

IX. Assignment Due Date: 13th January 2008

X. Date Of Submission: 13th January 2008

XI. Word Count:

My Details

I. ID No: VISRI73

II. Name: Vignarasa Sriganan

III. Mobile No: 0773431866

 Table Of Contents
Hardware And Data Security--------------------------------------------------4
Executive Summary.............................................................................................. ...4
Introduction.......................................................................................... ...................5
Confidentiality................................................................................. ........................5
Portable Data Storage Devices................................................................................5
Table Of Present Portable Storage Devices .............................................................6
Hardware Keyloggers............................................................................................. ..8
USB Storage Devices ............................................................................... ...............9
Pen Drives................................................................................... .........................9
External Hard Disks............................................................................. .................9
Mobile Phones With USB Connectivity..................................................................9
Mobile And Camera Memory Cards....................................................................10
Some Common Features Which We can Use To Avoid Breach Of Data
Confidentiality............................................................................... ........................10
Conclusion.............................................................................................. ...............11
List Of Reference...................................................................................................12
Bibliography............................................................................. .............................13

Operating Systems-------------------------------------------------------------15
Executive Summary............................................................................................ ...15
Introduction........................................................................................ ...................17
Operating System............................................................................................. .....17
Different Approach To An Operating System.........................................................17
Mandatory Access Controls In An Operating System.............................................18
 When And Where This Approach Of Mandatory Access Controls Is Appropriate?. .19
Discretionary Access Controls In An Operating System.........................................19
When And Where This Approach Of Discretionary Access Control is Appropriate? 20
Conclusion.............................................................................................. ...............20
Reference List............................................................................................... .........21
Bibliography............................................................................. .............................22

Network Security----------------------------------- -----------------------------24

Executive Summary............................................................................................ ...24
Introduction........................................................................................ ...................27
Network................................................................................................. ................27
Packet Spoofing.................................................................................... .................27
Applying Packet Spoofing To Attack.......................................................................28
Man-In-The-Middle Attack......................................................................................28
Non – Blind Attack.................................................................................................29
Why Packet Spoofing Occurs.................................................................................29
How Can We Defend From Packet Spoofing...........................................................29
Conclusion.............................................................................................. ...............30
Reference List............................................................................................... .........31
Bibliography............................................................................. .............................32
 Hardware And Data Security
Executive Summary
Data Confidentiality and how portable storage devices can be applied to breach
Data Confidentiality are going to be discussed in this topic. Meanings of Data
Confidentiality and portable storage devices will be discussed at first to give you all
a clear idea of what we are going to talk further in this topic. Some examples for
portable storage devices will be given next. Many kinds of portable storage devices
are available at present as all of us know. Then a table of current Portable Data
Storage Devices with its storage capacity and current price is given to you all to get
an idea of its market popular.

To breach the Data Confidentiality portable storage devices are mostly been used
these days. As it is an easier way to steal a data from a computer. Also nower days
USB storage devices are available in market in various designs and sizes.
Sometimes we find hard to realize a Pen Drive as it is in a design which we daily use
to day to day life. For example at present Pen Drives are made with a design of a
normal pen, key tags, clocks etc. This could help a hacker to breach Data
Confidentiality using the Portable Data Storage Device. Also in this following session
different ways to apply Portable Storage Devices to breach Data Confidentiality is
discussed. Different ways to breach Data Confidentiality with the help of USB Pen
Drive , Hardware Keylogger, USB enabled mobile phones and Mobile / Camera
memory cards are been discussed in the following session. Also solution to prevent
the breach of Data Confidentiality by those hardwares are too been discussed.
Finally some common tips are given to protect our important datas in our computer.

You can get a brief idea about Portable Hardware and how they are used to breach
Data Confidentiality in this assignment. Also you can also get some information
about how to protect our data from those breaching methods too. All methods and
information discussed in the following session is well referenced.
 Hardware And Data Security

Introduction

In this session we are going to discuss about different forms of portable storage
devices and how we can use them to breach Data Confidentiality. Also we are going
to discuss about how we can stop the breach of Data Confidentiality. The table with
the list of some information about the portable devices would help us to their
current price levels too. Threats of portable storage devices for Data Confidentiality
will also be discussed. And solutions to prevent that also will be given below.

Confidentiality
Keeping an information or a message private and secret and also without the hands
of the unauthorized people is meant by Confidentiality.

“Confidentiality is a legal protection and assurance of your right to privacy to the

fullest extent allowable by Oregon State statutes.” (Mentor Research Institute,
2000).

Portable Data Storage Devices

External Storage devices which are used to store any form of data from a computer
is known as the Portable Data Storage Device.
Eg: Usb Storage Devices
External Hard Disks
Mobile / Camera Memory Cards
Table Of Present Portable Storage Devices

Latest products of storage devices available in the world market are shown in the
following table.

Pen Drives And Mobile / Camera Memory Cards

Storage Current Price

Brand Name Capacity (In USD)
Kingston USB 2.0 DataTraveler USB Flash Drive
DTMFP 2GB $27 - $35
King Max U-Drive USB 2.0 Flash Drive 8GB $108.65
King Max U-Drive USB 2.0 Flash Drive 2GB $29.95
King Max U-Drive USB 2.0 Flash Drive 1GB $17.85
Kingston USB 2.0 DataTraveler Mini Fun USB
Flash Drive 1GB $21.95
(USB-ED2) Aluminium USB 2.0 Flash Drive 512MB $89.95
(USB-ED2) Aluminium USB 2.0 Flash Drive 256MB $68.00
(USB-ED2) Aluminium USB 2.0 Flash Drive 128MB $29.95
1 G Aluminium (USB-ED2) USB 2.0 Flash Drive 1GB $269.00
Sandisk Cruzer Titanium 4G U3 Flash Drive
SDCZ7-4096 4GB $65 - $79
Sandisk Ultra II SD Plus USB Card SDSDPH-
2048 2GB $41 - $54
Corsair Flash Voyager USB 2.0 Drive 8GB $105 - $275
CMFUSB2.0
SanDisk Cruzer Micro U3 USB Flash Drive
(SDCZ6-2048) 2GB $27 - $40
Corsair Flash Voyager USB 2.0 Drive
CMFUSB2.0 16GB $203 - $211
Kingston Data Traveler USB 2.0 DTI 1GB $9 - $17

External Hard Disks

Storage Current Price

Brand Name Capacity (In USD)
Western Digital MyBook WDG1U2500 - External
Hard Drive 250GB $117 - $145
Western Digital WDE1U2500 USB2.0 External
Hard Drive 250GB $127.95
Macpower M9 Mini Pod M9-DX External Hard
Drive 400GB $319 - $759
Omni External Hard Drive 80GB $99.00
Seagate ST68022U-RK External 1inch Pocket
Hard Drive 8GB $71 - $299
LaCie 301161A Gigabit Ethernet Disk RAID Hard
Drive 2TB $1,659 - $1,999
LaCie 301160A Gigabit Ethernet Disk RAID Hard
Drive 1TB $506 - $1,519
Maxtor STM303204EHE Basics External USB 2.0
Hard Drive 320GB $157.46
Seagate ST940801U2-RK Portable External Hard
Drive 40GB $188 - $223
MacPower M9-DX External Hard Drive 500GB $399 - $419
Transcend TS250GSJ35 StoreJet External Hard 250GB $159 - $200
Drive
2.5" SATAII MINI USB External Hard Drive 160GB $159.95
MacPower IceCube Generation II External Hard
Drive 160GB $199.00
Lacie 300988A d2 external SATAII Hard Drive 320GB $189.00
LaCie 300963A Ethernet Disk 1TB $523.60

This above table of prices are referred from www.myshopping.com.au .

Hardware Keyloggers

To steal a data from a computer Hardware keyloggers can be used. All the
keystrokes are provided to us by them. This is a good way to breach data
confidentiality. Also this is a physical device and our computer won’t detect this
device unless we realize it physically or firewall is enabled. But still this can be used
by disabling the firewall in a computer and adding it. Beyond these hardware
keyloggers doesn’t need any software to be installed.

“Over $120 billion was lost in the USA due to employee fraud last year. And this
figure is growing.” (Keyghost).
By locking their CPU with an appropriate lock after adding their recommended
components to it, people can avoid from the above breaching method. And also
checking the computer physically in a daily basis too would help to avoid the above
threat. But now for Windows XP some softwares are available to detect keyloggers.
Also in Windows XP firewall would also do the above job unless it’s disabled.

USB Storage Devices

Pen Drives
To transfer datas from one computer to the other Pen Drives are mostly used.
Nower days installation of pen drive software is not needed to use it. It is
already installed in the operating system by the creators of it. Also nower
days in various designs and sizes Pen Drives are released where some times
we cannot realize that it is a pen drive. Its available in the shape of normal
components which we use in day to day activities such as pen, key tag etc. To
get and access your personal information in their pen drives without your
attention this could help the hackers.

There are ways to avoid the above situation too. First our personal datas in
computer must kept encrypted. So hackers cannot read them if they took
those from your computer to another using pen drives. Also by disabling the
USB port in our system with the help of our operating system too will help us
to avoid the above situation. Also we can physically block of close the USB
ports in our computer using some specified tools available.

External Hard Disks

External Hard Disks too have the same using techniques as pen drives.

But external hard disks are mostly released in a unique design. It doesn’t
have various designs. Also it is in a big size. These are some disadvantages of
external hard disks. Also to protect data confidentiality we can use the same
methods which we used to protect from pen drive access.

Mobile Phones With USB Connectivity

Latest mobile phones at present are released with USB connectivity to
computer. We can transfer files from computer to mobile and also from
mobile to computer. So these types of mobile phones too can be used as data
storage device to breach data confidentiality. One can copy the wanted file
from his computer to his mobile phone via USB cable. Even the file system
doesn’t support in the phone the transferred file still exists. Then he can
transfer the particular file from mobile to another computer.
 Ways are still there to avoid the above activity and save data. First of all the
software of the specified mobile phone must have to be installed in the
computer to connect that with computer. So we can protect by disabling new
software installations in our computer by using our operating systems’ group
policies. Also unsupportable files will be automatically deleted from some
mobile phones.

Mobile And Camera Memory Cards

Today most of the mobile phones are released with memory cards in it. Also
cameras too. Both the mobile and camera memory cards are mostly the
same. Most of the people use memory card adapters to transfer datas from
their mobile / camera memory card to computer and from computer to it.
Memory card adapters are mostly configured with USB connectivity. So as
discussed in the previous section we can breach the data confidentiality. But
in this case softwares of the memory card adapter are not required to be
installed to use it. And it is an additional advantage to this.

But still we can break this activity by blocking or locking the USB ports in our
computer physically and with the help of our operating system too.

Some Common Features Which We can Use To Avoid Breach Of Data

Confidentiality

 Always keep your important datas encrypted in your computer

 Keep your Firewall and Anti Virus Guard enabled
 Add a password to your computer and make sure you log off from your
account after using the computer
 Add a CCTV camera in the computer room and monitor it
 Get a back up of your computer in a daily basis and store it in an another
place
Conclusion

We talked about Hardware and Data Security in this assignment. First of all meaning
of Confidentiality and Portable Hardware Storage Device were discussed. Also table
of current USB drives available in the market was also discussed. Then following
those steps we discussed how we can apply data storage devices to breach Data
confidentiality. With those the steps to protect data from those breaching methods
too were discussed. These were discussed in a clear way and with reference. And
finally some common tips were given to protect our data from breaching methods.
The methods and information discussed in this topic were well referenced. Also this
could give you a clear idea about Data confidentiality and hardwares used to breach
data confidentiality.
List Of Reference

Anderson. R. Michael. An Armor Forensics Division. Available WWW:

http://www.forensics-intl.com/art22.html. [2008, 1 January].

Mentor Research Institute. (2000). Oregon Counselling. Available WWW:

http://www.oregoncounseling.org/Consumer/WhatIsConfidentiality.htm.
[2008,
2 January].

Unknown. KEY GHOST – The Hardware Keylogger. Available WWW:

http://www.keyghost.com/. [2008, 1 January].

Unknown. Memory Suppliers. Available WWW:

http://www.memorysuppliers.com/usbflashdrives.html. [2008, 2
January].

Unknown. My shopping.com.au. Available WWW:

http://www.myshopping.com.au/1S--
search?Find=usb+drives&Where=PT--
81_Flash_Memory. [2008, 1 January].

Unknown. My shopping.com.au. Available WWW:

http://www.myshopping.com.au/1S--
search?Find=external+hard+disks&Where=PT--
57_Hard_Drives. [2008, 2 January].

Unknown. PC Guardian. Available WWW:

http://www.pcguardian.com/products/data.html.
[2008, 2 January].

Unknown. Vembu. Available WWW:

http://www.vembu.com/storegrid/external-hard-disk.html. [2008, 2
January].
Bibliography

Abeusher. Sharp Ideas. Available WWW:

http://sharp-ideas.net/ideas/2006/01/21/data-theft-stories-from-the-
news-and-
solutions/. [2008, 2 January].

Anderson. R. Michael. An Armor Forensics Division. Available WWW:

http://www.forensics-intl.com/art22.html. [2008, 1 January].

Mentor Research Institute. (2000). Oregon Counselling. Available WWW:

http://www.oregoncounseling.org/Consumer/WhatIsConfidentiality.htm.
[2008,
2 January].

Unknown. Bossier Parish Community College. Available WWW:

http://www.bpcc.edu/computerservices/encryption.html. [2008, 1
January].

Unknown. Device Lock. Available WWW:

http://www.devicelock.com/dl/pressfaq.html.
[2008, 1 January].

Unknown. KEY GHOST – The Hardware Keylogger. Available WWW:

http://www.keyghost.com/. [2008, 1 January].

Unknown. Memory Suppliers. Available WWW:

http://www.memorysuppliers.com/usbflashdrives.html. [2008, 2
January].

Unknown. My shopping.com.au. Available WWW:

 http://www.myshopping.com.au/1S--
search?Find=usb+drives&Where=PT--
81_Flash_Memory. [2008, 1 January].

Unknown. My shopping.com.au. Available WWW:

http://www.myshopping.com.au/1S--
search?Find=external+hard+disks&Where=PT--
57_Hard_Drives. [2008, 2 January].

Unknown. PC Guardian. Available WWW:

http://www.pcguardian.com/products/data.html.
[2008, 2 January].

Unknown. (2003). Soft 32. Available WWW:

http://www.soft32.com/download_8973.html.
[2008, 2 January].

Unknown. Vembu. Available WWW:

http://www.vembu.com/storegrid/external-hard-disk.html. [2008, 2
January].
 Operating Systems
Executive Summary

In this following assignment we are going to talk about operating systems in

a security perspective way. Also we are going to research and discuss the
concepts of Mandatory and Discretionary Access Controls in operating
systems. Also discussion of situations in which each approach would be
appropriate is also included.

First of all meaning of Operating System is given. Then different approach to

operating system which is known as Mandatory Access Controls (MAC)and
Discretionary Access Controls (DAC) are been discussed. Meanings of
Mandatory Access and Discretionary Access too have been given in following
pages.

Mandatory access is mainly known as Administrator manages access

controls. And Discretionary access controls are known as specific user
managing access controls. In MAC methods administrator will be managing
and will be giving permissions to the other users to use some specific object
in the operating system. Administrator will be the owner of all the files in this
method. Administrator would control a set of computers using server
operating system in a domain network too. But in DAC methods specified
users will be permitted to create object and those users will be the owner of
that object. They have the power to manage those objects and they allow
the other users to access those objects. Other users are given access power
discretionally by the creator for that specific object created by him.

MAC and DAC methods are then briefly discussed. MAC methods are used to
protect privacy and personal data in an organization. Administrator will have
the full control of the computer available. By this users cannot steal or delete
or change any of the data available in the operating system. Also some MAC
methods are implemented with Mandatory profiles. Mandatory profile will let
the users to do any change in it. But when they log off and log into the
operating system all their changes will be lost and the unique profile
designed by the Administrator will appear. But if any of the user wants to add
any object to his profile as compulsory the administrator have to allow
permission to do so. In domain networks sometimes it might be difficult to
give different form of permissions to different users. This was found as a
disadvantage of the MAC methods in operating systems.

DAC methods are managed by a specified user. It means that administrator

permitted users can create any objects in their profile. And he will be the
owner for that created profile. He will then give permissions to other users to
access it. By these too data can be protected. But protection won’t be much
powerful like MAC method. Any full controlled user can easily delete or make
any changes to it. This was found as a disadvantage of this method.

In some organization they use both MAC and DAC methods simultaneously.
During these session from the MAC method administrator must allow the
user to create a project and then the user will protect it using DAC method.
More information of these is delivered in the below pages.
 Operating Systems
Introduction
In this session we are going to look briefly about operating systems in a security
perspective way. Also with those we are going to talk about Mandatory and
Discretionary access to a computer. Advantages and disadvantages of those
accessing methods too will be discussed. Also we will be viewing that how those
access methods used in various organizations for different purposes.

Operating System

Bridges the gap between applications / users and hardware are called as an
Operating System.

“The most important program that runs on a computer. Every general-purpose

computer must have an operating system to run other programs. Operating
systems perform basic tasks, such as recognizing input from the keyboard, sending
output to the display screen, keeping track of files and directories on the disk, and
controlling peripheral devices such as disk drives and printers.” (Webopedia, 2002).

Different Approach To An Operating System

The operating system in our computer can be approached in two different ways
mainly. They are
1. Mandatory Access
2. Discretionary Access
The above are the two main approaches to an operating system in a computer. First
of all we shall try to get brief meaning of those two main approaches.

1. Mandatory Access Controls In Operating Systems

 Access controls in which Administrator manage access control are known as
Mandatory Access Controls in an operating system.

“In computer security Mandatory Access Control (MAC) is a type of access

control in which only the administrator manages the access controls. The
administrator defines the usage and access policy, which cannot be modified
or changed by users, and the policy, will indicate who has access to which
programs and files. MAC is most often used in systems where priority is
placed on confidentiality.” (Webopedia, 2007).

2. Discretionary Access Controls In Operating Systems

Access control owned by a specified individual user is called as Discretionary

Access Controls In Operating Systems.

“In computer security, Discretionary Access Control (DAC) is a type of access

control in which a user has complete control over all the programs it owns
and executes, and also determines the permissions other users have those
those files and programs. Because DAC requires permissions to be assigned
to those who need access, DAC is commonly called described as a "need-to-
know" access model..” (Webopedia, 2007).

Mandatory Access Controls In An Operating System

As we found earlier, access controls which are managed by the administrator is

called as Mandatory Access Control. In this access control administrator has all the
rights to a computer or to a set of computers which is in a domain environment. He
can define which users to use the computer and also after logging in, the
administrator could restrict a user from accessing some particular documents too. In
this method administrator is found as the boss for all files, and he has the power to
allocate which user to do what.

In mandatory access profile the administrator will first create an access control
matrix in which he defines the user statistics. Access control matrix is most
important to mandatory access control. Access control matrix helps the
administrator to define user powers in a particular computer. Also the administrator
can restrict users from accessing some main features such as in Windows “My
Computer”, “Control Panel”. Group policies would help the administrator to restrict a
user.

Also in Microsoft Operating System, there is an option named Event Viewer which
only can be viewed by the administrator. This will help him by showing who are the
users who tried to do any prompt actions in a particular document / application.
When And Where This Approach Of Mandatory Access Controls
Is Appropriate?

Many big firms use the mandatory access control so that any of their data won’t be
changed or lost by an action of their user. It helps an organization or a particular
user to protect his file from some culprits. Mainly mandatory access controls are
provided with mandatory profiles for each user. Mandatory profiles created to the
users will let the user to change any settings, but when they log off and log in again
all their changed settings will be lost and the unique profile designed by the
administrator will appear.

So this access method is mainly used in many Government Firms and Departments.
Administrator can restrict a user from copying a document. So in the above firms, all
their personal data won’t be changed or lost. Also nowadays Net Browsing Cafe’s
too use this technology. Also this would help an individual user too to protect his
data.

But on the other hand there are some disadvantages by these too. When a user
must add any application to his particular computer / User Account the
administrator must have to allow him, like this for every setting that had to be
changed by several other users, the administrator have to unblock the particular
user. This was found hard in some organizations. Those organizations then used the
next method called Discretionary Access Control method.

Discretionary Access Controls In An Operating System

As we read earlier this access allow a particular user to control the access control.
This was mainly introduced to reduce the work of administrator. The user will be the
owner for his particularly created object here. But in mandatory access
administrator will be the owner for all. The particular user must have to define the
other users who can access his document and also he has the power to restrict
them to read only access or read and write access and also he can give another
user full control of his particular object.

“Discretionary access control is commonly defined in opposition to mandatory

access control (sometimes termed non-discretionary access control). Occasionally a
system as a whole is said to have "discretionary" or "purely discretionary" access
control as a way of saying that the system lacks mandatory access control. On the
other hand, systems can be said to implement both MAC and DAC simultaneously,
where DAC refers to one category of access controls that subjects can transfer
among each other, and MAC refers to a second category of access controls that
imposes constraints upon the first.” (Wikipedia, 2007).

The above statement clearly shows us that we can use both controls simultaneously
and how they work in a simultaneous manner.
But if these two access controls are simultaneously running in an operating system
from the mandatory access controlling system the administrator must have to allow
permission to a particular user to create a document. And then from the use of
discretionary access controlling system the particular user can give permissions to
other users in a discretionary manner to access his document. He can give full
control to any other user too.

When And Where This Approach Of Discretionary Access Control is

Appropriate?

As we got to know in this access control all the other users access to a particular
user’s object is determined discretionally by the object creator user. In this method
too data can be protected by its creator by giving permitted access to the other
users. This will also helpful in many organizations and also to some personals too.

Mostly this access method will be used in some organizations where the worker of it
too needs to run any program in his allocated computer. Nowadays in many IT firms
both access controls are running simultaneously so that administrator do not need
to unblock every particular user to do an action, as IT firms will be having a large
amount of workers in it. In this method too data can be protected by the creator of it
by giving restricted permissions to other users. Also some other government
organizations too use this particular method nowadays.

But as for the above method there are some disadvantages to this method too. In
this method permissions are given to other users in a discretionary manner.
Sometimes some user would have been given full control to that particular
document. So there is no guarantee that the full controlled user might protect the
data himself. When he resigns his work from an organization he might make some
bad attempts in that document.

Conclusion

We talked about operating systems in this assignment in a security perspective way.

We talked about different approach to operating systems which are mostly known
as Mandatory and Discretionary accessing methods. We discussed their advantages,
disadvantages and also how they are used in firms nowadays too. Also we included
a discussion of situations in which each approach would be appropriate. This could
give people who read this a good knowledge about operating systems and
accessing methods. Also this would help then to choose with accessing method they
could use in their organization.

Reference List

Jordan, S. (1987). Guide to Understanding Discretionary Access Control in

Trusted Systems.
New York: DIANE Publishing.

Microsoft. (2006). Microsoft – Help And Support. Available WWW:

http://support.microsoft.com/kb/307800. [2008, 4 January].

Unknown. (2002). UnixWare. Available WWW:

http://uw713doc.sco.com/en/SEC_admin/IS_DiscretionaryAccCntlDAC.html.
[2008, 3 January].
Unknown. (2007). Webopedia. Available WWW:
http://www.webopedia.com/TERM/M/Mandatory_Access_Control.html.
[2008, 5 January].

Unknown. (2002). Webopedia. Available WWW:

http://www.webopedia.com/TERM/O/operating_system.html. [2008, 3
January].

Unknown. (2007). Wikipedia. Available WWW:

http://en.wikipedia.org/wiki/Discretionary_access_control. [2008, 4
January].

Virijevich, P. (2005). Linux.com. Available WWW:

http://www.linux.com/feature/113941.
[2008, 5 January].

Bibliography

Jolson. (2007). Developer Meet Server. Available WWW:

http://blogs.msdn.com/jolson/archive/2007/11/12/what-s-mandatory-
integrity-
control.aspx. [2008, 5 January].

Jordan, S. (1987). Guide to Understanding Discretionary Access Control in

Trusted Systems.
New York: DIANE Publishing.

Kerr. K. (2004). Plural Sight. Available WWW:

http://www.pluralsight.com/wiki/default.aspx/Keith.GuideBook/WhatIsOwners
hip.html
[2008, 5 January].

Microsoft. (2006). Microsoft – Help And Support. Available WWW:

http://support.microsoft.com/kb/307800. [2008, 4 January].

Tavares. C. (2004). Plural Sight. Available WWW:

http://www.pluralsight.com/wiki/default.aspx/Keith.GuideBook/WhatIsDiscreti
onaryAc
cessControl.html. [2008, 5 January].

Unknown. UNISYS. Available WWW:

http://www.unisys.com/products/mainframes/security/secure__os__2200__sys
tems/
access__control_a_authorization.htm. [2008, 4 January].

Unknown. (2002). UnixWare. Available WWW:

http://uw713doc.sco.com/en/SEC_admin/IS_DiscretionaryAccCntlDAC.html.
[2008, 3 January].

Unknown. (2007). Webopedia. Available WWW:

http://www.webopedia.com/TERM/M/Mandatory_Access_Control.html.
[2008, 5 January].

Unknown. (2002). Webopedia. Available WWW:

http://www.webopedia.com/TERM/O/operating_system.html. [2008, 3
January].
Unknown. (2007). Wikipedia. Available WWW:
http://en.wikipedia.org/wiki/Discretionary_access_control. [2008, 4
January].

Virijevich, P. (2005). Linux.com. Available WWW:

http://www.linux.com/feature/113941.
[2008, 5 January].

Network Security
Executive Summary

In this assignment we are going to talk mainly about Network Security. We will be
researching and discussing the security implications of Packet Spoofing too. Also
malicious attacks that might be enabled by an attacker being able to spoof network
packets too will be discussed.
As the start of this assignment the meaning for network and packet spoofing is
given. Computer Network means computers interconnected in a particular area to
exchange data among them selves. Spoofing means to assume the character and
appearance of someone or something. Packet Spoofing means in the field of
networking steal a network packet from a sender and send another to the receiver.
Packet Spoofing is mainly handled by the hackers.

Then we will be talking about internet security breaches. If we consider this there
are mainly two different ways to attack a network. Sniffing and Spoofing are those
methods. Sniffing means intercepting and inspecting data packets using sniffers.
Sniffers are third party software used to do the above job. And about the other
method called spoofing, we had talked in the above paragraph. But here we are
going to discuss about packet spoofing most.

After this we will be talking about different ways of attacks using Packet Spoofing. In
a network area data to each computer is sent in packets through network cable.
Packet Spoofing means stealing those packets and sending the receiver a false
packet. But we cannot say where these packet spoofers occupy to steal the network
packets. IP spoofing is the main attack used in packet spoofing. IP Spoofing is
mainly used by the intruders to gain access in a network area. They send a
message to a computer with an IP address indicating that the message is coming
from a trusted host. This is how they start their attack and gain access in others
computers. There are many other kinds of packet spoofing attacks too. Man in the
middle attack, Denial of service attack, Non-blind spoofing, Blind spoofing and many
more.

Man in the Middle attack means when a network connection is implemented among
two or more than two people and if they have started exchanging data among
themselves this particular intruder will occupy in the middle and he will be receiving
all the packets of data which were used in exchanging. Then he can modify them
and send or he can just leave that without sending them to the receiver. All of us
know Windows Live Messenger. Also we know that this Live Messenger is now used
in business communication too. Traders and clients will be communicating through
this Messenger. Intruders apply the Middle Man Attack in this Live Messenger too.
Also they break the business transaction and they convert the client to their
business communication arena. This happens often nowadays. Non blind attacks
take place in a same network area. Attacker will be in the same network. A Non-
blind attack, where a source spoofs its IP but can still see the replies, is only
possible if the source and destination are on the same local network, so the attacker
can sniff the network and still see the reply packets as they travel to the spoofed
source or the gateway router. Also there are softwares which help the attackers to
create Packet Spoofing. “Dnshijack”, “Uso800d”, “Dnsattack” are some of the above
mentioned softwares.

Then we will be talking about why this packet spoofing occurs. Packet Spoofing
occurs due to weaknesses of poor design of the under lying protocols such as UDP,
TCP, IDMP and routing protocols and algorithms. The vulnerability is not in the
kernel of an operating system. These protocols were written 20 years ago when
Internet smaller and safer.

After this only the main part of the assignment arrives. Here we will be discussing
about how we can defend these packet spoofing and the attacks made with the help
of spoofing. Each packet has the source address containing the IP address and port
number from where it is coming from and also it will contain the destination IP
address and port number too. Sending system gets to create the packets, so it can
lie about it own source address. This can be hard to detect and also to defend. But
modern firewalls and routers had been configured to detect what range of IP
addresses should be from the inside and confirm the other should be from the
outside. When such a firewall or router sees a packet with an inside source address
coming from outside it knows that it is a spoofed packet and it will drop it. Also
beyond these there is a third party software called “Wireshark” which will help us to
detect spoofed packets.

Then after this some common tips are given to tell us that how we can defend these
packet spoofing in a common way. And finally this assignment will surely help all to
get a brief idea about packet spoofing and its attacks. Also people can get to know
how to defend the packet spoofing. Read further article to gain more knowledge
about this particular topic.

Network Security
Introduction

In this below paragraphs we are going to discuss about Network Security. Also with
this we will be discussing about the meaning of Packet Spoofing and the
implementation of it and also how we can use that to several ways of Network
Attacks. Also we will be discussing why this spoofing occurs and the softwares
involved in implementing this packet spoofing too. Also in the end we would find a
solution to this packet spoofing attacks too.

Network

Network means connections between items to exchange any form of data. When it’s
come to computer, Computer Network means computers interconnected in a
particular area to exchange data among them selves.

“A computer network is an interconnection of a group of computers.” (Wikipedia).

Packet Spoofing

Spoofing means to assume the character and appearance of someone or

something. Packet Spoofing means in the field of networking steal a network packet
from a sender and send another to the receiver. This is a form of hacking method.

“Spoofing is the act of identity impersonation.” (Mehta, 2002).

As all of us know when computers are interconnected in a network mode, datas to

each computer is sent by packets through the network area. These packets go
through the network area and they deliver the particular data to the particular user
through the network cable. Packet spoofing means a particular 3rd party user who is
not connected in those transactions may interrupt the network and steal the
packets and may send a false data to the recipient. This mostly happen nowadays in
the network arena.

When we talk about internet and network security breach there are two common
ways in use. Sniffing and Spoofing are the ways which were mentioned above.
Sniffing means intercepting and inspecting data packets using sniffers. Sniffers are
third party software used to do the above jobs. And about the other method called
spoofing, we had talked in the above paragraph. But here we are going to discuss
about packet spoofing most.
Applying Packet Spoofing To Attack

As we said earlier in a network area data to each computer is sent in packets

through network cable. Packet Spoofing means stealing those packets and sending
the receiver a false packet. But we cannot say where these packet spoofers occupy
to steal the network packets. It’s pretty hard to find even for the network
Administrators too.

When we talk about implementation of packet spoofing it’s mainly about how to
manage it and how we could use this to different attacking methods. Almost many
of us would know about Packet Spoofing. But one article says that only some
Network Administrators knew this Packet Spoofing earlier days. And this had been a
great advantage to the packet spoofers to do their job easily and effectively those
days. But Network Administrators of nowadays are pretty good and also well
knowledged. So they could find and protect the data from packet spoofing.

When we come to talk about how we could apply them to an attacking method, we
can talk about several kinds of attacks. IP Spoofing is mainly used by the intruders
to gain access in a network area. They send a message to a computer with an IP
address indicating that the message is coming from a trusted host. This is how they
start their attack and gain access in others computers. For IP spoofing the intruder
uses many methods to get an IP address of a trusted host. Then the hackers modify
and change the packet headers of the IP so that it will appear that the IP is coming
from that trusted host.

“As IP being connectionless, routers use the "destination IP" address in order to
forward packets through the Internet, but ignore the "source IP" address which is
only used by the destination machine when it responds back to the source. This
makes the task of an attacker much easier to forge the identity by modifying the IP
Packets and becoming a part of the destination network.” (Mehta, 2002).

The above quotation clearly shows us how IP and packet spoofers are provided to
gain the access easier by the routers. How ever IP spoofing is necessary to make
many network attacks that do not need to see responses. These are called as Blind
Spoofing. With the help of current IP protocol technology it is really impossible to
eliminate IP spoofed packets. But still there are solutions to avoid this too.

There are many other kinds of packet spoofing attacks too. Man in the middle
attack, Denial of service attack, Non-blind spoofing, Blind spoofing and many more.

Man-In-The-Middle Attack

In normal English if we could say the meaning for the above word is, being in the
middle and attacking. It’s same the idea in attacking network packets too. That
means when a network is implemented among few computers in an area and if they
had started exchanging data through themselves with the help of packets these
intruder will be in the middle of the exchange line. Middle in the sense means not
physically. These intruders will break the encrypted public key so that they can read
and modify the datas send through that. They will intrude them invisibly, being
middle in the network line and if a sender sends any data to a receiver through
packets the intruder who is occupying in the middle will receive the packet first.
Then he could change and send the data to the receiver or he could just keep it with
him. So the receiver won’t get any data from the sender. The intruder had gained
his access successfully. If he modify and send the data and if the receiver gets the
modified data they think they are communicating through a secure connection. But
they aren’t.

All of us know Windows Live Messenger. Also we know that this Live Messenger is
now used in business communication too. Traders and clients will be communicating
through this Messenger. Intruders apply the Middle Man Attack in this Live
Messenger too. Also they break the business transaction and they convert the client
to their business communication arena. This happens often nowadays.

Non – Blind Attack

Non blind attacks take place in a same network area. Attacker will be in the same
network. A Non-blind attack, where a source spoofs its IP but can still see the
replies, is only possible if the source and destination are on the same local network,
so the attacker can sniff the network and still see the reply packets as they travel to
the spoofed source or the gateway router.

Also there are softwares which help the attackers to create Packet Spoofing.
“Dnshijack”, “Uso800d”, “Dnsattack” are some of the above mentioned softwares.

Why Packet Spoofing Occurs

Packet Spoofing occurs due to weaknesses of poor design of the under lying
protocols such as UDP, TCP, IDMP and routing protocols and algorithms. The
vulnerability is not in the kernel of an operating system. These protocols were
written 20 years ago when Internet smaller and safer.

How Can We Defend From Packet Spoofing

Each packet has the source address containing the IP address and port number from
where it is coming from and also it will contain the destination IP address and port
number too. Sending system gets to create the packets, so it can lie about it own
source address. This can be hard to detect and also to defend.

Modern firewalls and routers had been configured to detect what range of IP
addresses should be from the inside and confirm the other should be from the
outside. When such a firewall or router sees a packet with an inside source address
coming from outside it knows that it is a spoofed packet and it will drop it.

Also beyond these there is a third party software called “Wireshark” which will help
us to detect spoofed packets.

“Packet Spoofing largely can be defended against with a good combination of the
following:
 Do not trust UDP source address except on very secure networks.
 Ensure that all of your systems have modern IP stacks that do not have
predictable TCP sequence numbers. (Linux had has this widespread problem
fixed since the 2.0.36 kernel).
 Use an encrypted tunnel to get through untrusted networks such as the
internet. This is necessary to avoid Sniffing and even TCP session hijacking.
SSH and various VPN software products such as FreeS/Wan are helpful.
“ (Toxen, 2001. p. 216).

These above are some ways to protect and prevent from Packet Spoofing attacks.

Conclusion

In this assignment we mainly discussed about Network security. We also discussed

about the different ways of network attacks. Then mainly we discussed about the
packet spoofing. We also discussed about the implementation of packet spoofing
and how we can use this to attack in a network area. Also we hardly discussed
about the other method called sniffing. Then we talked bout why these spoofing
happens. Finally we round up our project and we came to an end by finding a
solution to the above attacks.
Reference List

Encyclopedia. (2002). Security Warnings.Com. Available WWW:

http://www.securitywarnings.com/encyclopedia/?id=13. [2008, 6 January].

Mehta, P. (2002). Tech Targer Expert Answer Center. Available WWW:

http://expertanswercenter.techtarget.com/eac/knowledgebaseAnswer/0,295199,sid6
3_
gci974565,00.html. [2008, 7 January].

Templeton, J. , Levitt, E.K. Detecting Spoofed Packets. 1-12

Toxen, B. (2001). Real World Linux Security: Intrusion Prevention, Detection and
Recovery. Unknown:
Prentice Hall.

Unknown. (2007). Electronic Frontier Foundation. Available WWW:

http://www.eff.org/wp/detecting-packet-injection. [2008, 7 January].

Unknown. (2007). Newsvine. Available WWW:

http://minnieapolis.newsvine.com/_news/2007/12/07/1147420-detecting-
packet-spoofing-by-
isps-a-la-comcast-a-how-to-using-wireshark. [2008, 7 January].
Unknown. (2006). Webopedia. Available WWW:
http://www.webopedia.com/TERM/N/network.html. [2008, 8 January].

Bibliography

Encyclopedia. (2002). Security Warnings.Com. Available WWW:

http://www.securitywarnings.com/encyclopedia/?id=13. [2008, 6 January].

Mehta, P. (2002). Tech Targer Expert Answer Center. Available WWW:

http://expertanswercenter.techtarget.com/eac/knowledgebaseAnswer/0,295199,sid6
3_
gci974565,00.html. [2008, 7 January].

Nagel, J. (2005). Usability problem with non-RFC-compliant IP spoof protection

implementation.
Available WWW: http://lists.freebsd.org/pipermail/freebsd-bugs/2005-
January/011089.html.
[2008, 6 January].

Templeton, J. , Levitt, E.K. Detecting Spoofed Packets. 1-12

Toxen, B. (2001). Real World Linux Security: Intrusion Prevention, Detection and
Recovery. Unknown:
Prentice Hall.
Unknown. (2007). Electronic Frontier Foundation. Available WWW:
http://www.eff.org/wp/detecting-packet-injection. [2008, 7 January].

Unknown. (1999). Linux Blind TCP Spoofing. Available WWW:

http://www.ciac.org/ciac/bulletins/j-035.shtml. [2008, 6 January].

Unknown. (2007). Newsvine. Available WWW:

http://minnieapolis.newsvine.com/_news/2007/12/07/1147420-detecting-
packet-spoofing-by-
isps-a-la-comcast-a-how-to-using-wireshark. [2008, 7 January].

Unknown. (2006). Webopedia. Available WWW:

http://www.webopedia.com/TERM/N/network.html. [2008, 8 January].

Unknown. Wikipedia. Available WWW: http://en.wikipedia.org/wiki/Man-in-the-

middle_attack.
[2008, 8 January].