COIT20262 - Advanced Network Security, Term 2, 2018 Assignment

Code- COIT20262 

Subject : COIT20262 - Advanced Network Security, Term 2, 2018 

 

Instructions Attempt all questions. This is an individual assignment, and it is expected students answer the questions themselves. Discussion of approaches to solving questions is allowed (and encouraged), however each student should develop and write-up their own answers. See CQUniversity resources on Referencing and Plagiarism. Guidelines for this assignment include: • Do not exchange files (reports, captures, diagrams) with other students. • Complete tasks with virtnet yourself – do not use results from another student. • Draw your own diagrams. Do not use diagrams from other sources (Internet, textbooks) or from other students. • Write your own explanations. In some cases, students may arrive at the same numerical answer, however their explanation of the answer should always be their own. • Do not copy text from websites or textbooks. During research you should read and understand what others have written, and then write in your own words. • Perform the tasks using the correct values listed in the question and using the correct file names.

File Names and Parameters Where you see [StudentID] in the text, replace it with your actual student ID. If your student ID contains a letter (e.g. “s1234567”), make sure the letter is in lowercase. Where you see [FirstName] in the text, replace it with your actual first name. If you do not have a first name, then use your last name. Do NOT include any spaces or other nonalphabetical characters (e.g. “-“). Marking Scheme A separate spreadsheet lists the detailed marking criteria.


COIT20262 Assignment 1 Questions Term 2, 2018


Advanced Network Security Page 2 of 8
Question 1. Cookie Stealing Attack For this question you must use virtnet (as used in the workshops) to perform a cookie stealing attack. This assumes you have already setup and are familiar with virtnet. See Moodle and workshop instructions for information on setting up and using virtnet, deploying the website, and performing the attack. The tasks and sub-questions are grouped into multiple phases. You must complete all phases, in order. Phase 1: Setup 1. Create topology 7 in virtnet. 2. Add a new normal student user to the MyUni grading system. The user must have: a. Username: [StudentID] b. Password: [FirstName] 3. Add a new malicious student user to the MyUni grading system. The user must have: a. Username: 12345678 b. Password: [StudentID] 4. Add a grade for the normal student user for unit/course ‘coit20262’ with a grade of what you expect to receive this term, e.g. HD, D, C, P or F. 5. Change the title of the MyUni website by editing header_footer.php and changing theline to:6. Change the domain of the MyUni website to www.[StudentID].edu by editing the /etc/hosts files. 7. Test that the existing users and new student can access the grading website. The roles of nodes in topology 7 are: • node1: Web browser (lynx) of normal student user. • node2: Web browser (lynx) of malicious student user. • node3: Capture of packets with tcpdump. • node4: MyUni grading website. • node5: not used in this question.

Phase 2: Capture Cookies

8. Start capturing on node3 using tcpdump. 9. The normal student user must do the following on node1: a. Visit the MyUni grading website, e.g. as below or with any options: lynx http://www.[StudentID].edu/grades/ b. Follow the “Login” link and login c. Follow the “View grades” link and enter their username and ‘coit20262’ to view the course/unit grade, and submit. d. Follow the “Logout” link. e. Exit lynx by pressing q for quit.

COIT20262 Assignment 1 Questions Term 2, 2018


Advanced Network Security Page 3 of 8
10. Stop capturing on node3. Note that it is important that the start of the TCP connection (i.e. 3 way handshake), as well as all HTTP requests/responses are included in the capture. Save the capture file as normal-student.pcap.

Phase 3: Masquerade Attack Using information from the capture in part 2, the malicious student user must now perform a cookie stealing attack to masquerade as the normal student user. Although the capture may have recorded the normal student users’ password, you MUST NOT use it in the cookie stealing attack (e.g. assume the password was encrypted). Your cookie stealing attack must only use the cookie information (not the password). 11. Setup for the cookie stealing attack on node2. 12. Start capturing on node 3 using tcpdump. 13. The malicious student user must do the following on node2: a. Visit the MyUni grading website, e.g. lynx http://www.[StudentID].edu/grades/ b. Follow the “View grades” link and enter the username of the normal user, leaving the course/unit field empty (see you see all grades), and submit. c. Follow the “Logout” link. d. Exit lynx by pressing q for quit. 14. Stop capturing on node3. Note that it is important that the start of the TCP connection (i.e. 3 way handshake), as well as all HTTP requests/responses are included in the capture. Save the capture file as malicious-student.pcap.

Phase 4: Analysis Answer the following sub-questions regarding the previous phases and cookie stealing attack. (a) Submit normal-student.pcap. (b) Submit malicious-student.pcap. (c) Draw a message sequence diagram that illustrates all the HTTP messages for the normal student user viewing the grades (i.e. the HTTP messages from normal-student.pcap from step 7 above). Do not draw any packets generated by other applications or protocols, such as ARP, DNS or SSH, and do not draw TCP connection setup or ACKS. Only draw HTTP messages. A message sequence diagram uses vertical lines to represent events that happen at a computer over time (time is increasing as the line goes down). Addresses of the computers/software are given at the top of the vertical lines. Horizontal or sloped arrows are used to show messages (packets) being sent between computers. Each arrow should be labelled with the protocol, packet type and important information of the message. Examples of message sequence diagrams are given in


COIT20262 Assignment 1 Questions Term 2, 2018


Advanced Network Security Page 4 of 8
workshops. Note that you do not need to show the packet times, and the diagram does not have to be to scale. (d) Based on your captures only, identify the following information. If the information is found in multiple packets, give the first packet from the capture. For example, if the information is found in packet numbers 3, 5 and 7, you would give the packet number as 3. a. Packet number from normal-student.pcap that contains the normal students’ password b. Packet number from normal-student.pcap in which the server originally sends the cookie to the browser c. Last 4 HEX digits of the id_hash in the cookie (give the value of the last 4 digits, not the packet number) d. Packet number from malicious-student.pcap that contains the normal students grade for coit20262. e. Packet number from malicious-student.pcap in which the client originally sends the stolen cookie

(e) Explain how the id_hash is calculated, giving both the equation/algorithm for calculating it, as well as a description of the values used in calculating it (for example, where do the values come from? How are they set?). (f) Explain how the id_hash provides security on the context that it is used in the grading web application. (g) Explain a weakness or vulnerability of how the id_hash is calculated or used. For example, how could the security it provides be broken? (h) In this question, the username and password of the normal student user are sent as plaintext from browser to server. This is an obvious weakness, as an attacker that intercepts the packets between browser and server immediately learns the password. A possible solution is for the client browser to calculate a hash of the password using JavaScript, and sending the hash of the password to the server, instead of the actual password. Discuss the strengths or weaknesses of such a scheme with respect to preventing an attacker from logging in using the normal student users’ password. (i) In this question, the malicious student performing the cookie stealing attack uses lynx as a web browser. Explore how to edit or create cookies in common graphical web browsers (Firefox, Chrome, IE, Edge or Safari). Give a brief explanation of what you need to do to modify/create cookies (e.g. which options of the browser, or what software needs to be installed) and take a screenshot of a cookie you modified or created. The cookie in the screenshot MUST include your [StudentID] (e.g. put your [StudentID] in any field of the cookie).

Question 2. Cryptography For this question you must use openssl to perform a set of cryptographic operations. When performing cryptographic operations you must be very careful, as a small mistake (such as a typo) may mean the result is an insecure system. Read the instructions carefully, understand the examples, and where possible, test your approach (e.g. if you encrypt a file, test it by decrypting it and comparing the original to the decrypted). It is recommended you use virtnet to perform the operations. The tasks and sub-questions are grouped into multiple phases. You must complete all phases. Phase 1: Download Normally in public key cryptography you generate your own public/private key pair. However in this assignment to simplify the tasks, the Unit Coordinator has generated a key pair for you. Your key pair will be available to you on Moodle to download, with filename: • [StudentID]-keypair.pem In addition to your key pair, a number of files will be available to all students on Moodle to download. Each file starting with [StudentID] must be downloaded by you. You may also need to download files with other student’s IDs (see the next phase). The download URL will be published on Moodle.

Phase 2: Read the Messages The files for download have been created by another student, denoted as the sender: 1. Sender student created a message to you [StudentID]-message[N].txt, where [N] is an integer, e.g. 1, 2, 3, … 2. The sender signed the message to produce [StudentID]-message[N].sgn. 3. The sender wrote their student ID into a text file [StudentID]-sender[N].txt. 4. The sender signed the sender file to produce [StudentID]-sender[N].sgn. 5. The sender used openssl to generate a random 256-bit secret key, in Hex, and saved it in [StudentID]-key[N].txt. 6. The sender generated a random Initialisation Value (IV), in Hex, and saved it in [StudentID]-iv[N].txt. 7. The sender encrypted the message using symmetric key encryption, the random secret key, and the random IV, producing [StudentID]-message[N].enc. 8. The sender encrypted the random secret key file using public key encryption, producing [StudentID]-key[N].enc. The sender then sends to you the necessary files from above. Note that the files were actually created by the Unit Coordinator, but in this assignment you can assume they were created by a student. The “sending” of files to you is performed by the sender (Unit Coordinator) uploading them to Moodle, and you downloading them from Moodle.
COIT20262 Assignment 1 Questions Term 2, 2018
Advanced Network Security Page 6 of 8
Your task is, for every message, decrypt and verify the files. Be careful: there may have been attacks on some messages! The algorithms used in this question are: • Public key: RSA, 2048 bit • Symmetric key: AES-256-CBC • Hash: SHA256

Phase 3: Report Your Results After downloading, decrypting and verifying all messages, you need to create a summary of the results for each message. The summary must be in a text file called [StudentID]summary[N].txt. The summary must contain exactly two lines, of the format: ResultType Message where ResultType is one of the following strings: • Success – means all files successfully decrypted and successfully verified. • FailDecryptKey – means the decryption of secret key was unsuccessful. • FailDecryptMessage – means the decryption of message was unsuccessful. • FailVerifySender – means the verification of sender file was unsuccessful. • FailVerifyMessage – means the verification of message was unsuccessful. If ResultType is Success, then include the contents of the message on the next line. If ResultType is another value, then include “NoMessage” on the next line. Examples of possible summary files are: Example 1: Success 12345678-3-hello

Example 2: FailDecryptMessage NoMessage

Example 3: FailVerifySender NoMessage

You must sign each summary file, producing [StudentID]-summary[N].sgn.

 

COIT20262 Assignment 1 Questions Term 2, 2018
Advanced Network Security

Share this post