About the Module
The core book is:
 Computer Security: Principles and
Practices
International Edition, 3/E
William Stallings and Lawrence Brown
Pearson,
 Least important part is Section III
Content Covered in Class
Class Notes
Book Chapter(s)
1. Overview & Crytographic Tools
2. Database Security & Malicious Software
3. DoS , Intrusion detection & Firewalls
4. Buffer overflow & Software Security
5. Operating Systems Security
6. Symmetric Encryption & Message Confidentiality
7. Public Key Cryptography & Message Authentication
8. Internet Security Protocols & Standards
9. User Authentication, Access Control & Internet Apps
10. Wireless Network Security
11. Trusted Computing & Multilevel Security
12. HR security, Security Auditing & Legal/Ethical
1, 2
5, 6
7, 8, 9
10, 11
12, 25, 26
20
21
22
3, 4, 23
24
13
17, 18, 19
Content Covered in labs Week 1
1. Kali Basics
1.1 Finding your way around Kali
1.2 Kali Services
1.2.1 SSHD
1.2.2 Apache
1.2.3 FTP
1.3 The Bash Environment
1.3.1 Linux basic commands
1.3.2 Gathering Server Names from a Site
1.3.3 Sample Solution
1.3.4 Additional Resources
1.4 Netcat
1.4.1 Connecting to a TCP/UDP port with Netcat
1.4.2 Listening on a TCP/UDP port with Netcat
1.4.3 Transferring files with Netcat
1.4.4 Remote Administration with Netcat – Bind Shell
1.5 Wireshark for Sniffing Packets
1.5.1 Wireshark & Packet Sniffing Background
1.5.2 Wireshark Step by Step
1.6 Cross-site scripting
1.6.1
1.6.2
1.6.3
1.6.4
A basic example
Persistent XSS payload
Reflected XSS
Preventing XSS Attacks
1.7 Creating a Keylogger to Snoop (on your home PC)
Content Covered in labs Week 2
2. Information Gathering Techniques
2.1 Open Web Information Gathering
2.1.1 Google Hacking
2.2. Miscellaneous Web Resources
2.2.1 Other search engines
2.2.2 Netcraft
2.2.3 Whois Reconnaissance
2.2.4 Searching for a Person's Profile
2.3 OWASP (Open Web Application Security Project) Joomla! Scanner
2.3.1 Joomla! Command Line Scan
2.3.2 Joomla Security Scanner CMS Vulnerabilities
2.3.3 WPScan-Wordpress Security Scanner
2.3.4 Plecost
2.3.5 WhatWeb
2.3.6 BlindElephant-Web Application Fingerprinter
2.3.7 Intrusion Detection Systems Detection
2.4 How to Change Your MAC Address
2.4.1 How to change your MAC address on Windows
2.4.2 How to change your MAC address on Linux
2.5 Documentation of Penetration Tests
Content Covered in labs Week 3
3. Open Services Information Gathering
3.1 DNS Reconnaissance
3.1.1 Interacting with a DNS server
3.1.2 Automating lookups
3.1.3 Forward & reverse lookup brute force
3.1.4 DNS Zone Transfers
3.2 SNMP reconnaissance
3.2.1 Enumerating Windows Users:
3.2.2 Enumerating Running Services
3.2.3 Enumerating open TCP ports
3.2.4 Enumerating installed software
3.3 Microsoft Netbios Information Gathering
3.3.1 Null sessions
3.3.2 Scanning for the Netbios Service
3.3.3 Enumerating Usernames/ Password policies
3.4 Gathering Host Information with Dmitry
3.5 Load Balancing Detection
3.6 Maltego
3.6.1 Infrastructure Reconnaissance
3.6.2 Infrastructure Personal Reconnaissance
3.7 FOCA
Content Covered in labs Week 4
4
Metasploit
4.1 Metasploit Fundamentals
4.1.1 Msfcli
4.1.2 Msfconsole
4.1.3 Exploits
4.1.4 Payloads
4.1.5 Databases
4.1.6 Metasploit Meterpreter
4.2 Information Gathering
4.2.1 Port Scanners
4.2.2 Service Identification
4.2.4 Password Sniffing
4.2.5 SNMP Sweeping
4.3 Vulnerability Scanning
4.3.1 VNC Authentication
4.3.2 WMAP Web Scanner
4.4 Hacking Apache Tomcat
4.5 Dictionary Attack on Metasplotable FTP & DVWA
Content Covered in labs Week 5
5. Port Scanning
5.1 TCP Port Scanning Basics
5.2 UDP Port Scanning Basics
5.3 Port Scanning Pitfalls
5.4 Nmap
5.4.1 Network Sweeping
5.4.2 Fingerprinting
5.4.3 Banner Grabbing / Service Enumeration
5.4.4 Nmap Scripting Engine
5.5 PBNJ
5.6 Unicornscan
5.7 Root Kit Hunter
5.7.1 Root Kit Hunter
5.7.2 Check Rootkit
5.8 Shodan
5.8.1 The Basics
5.8.2 Filters
Content Covered in labs Week 6
6. ARP Spoofing & Tunnelling
6.1 Ettercap on BackTrack Introduction
6.2 Ettercap Snooping on other traffic in Lab through ARP Poison Attack
6.3 Tunneling : I2P Anonymous Network
6.4 SSL Man in the Middle
6.5 Denial of Service Attacks
Content Covered in labs Week 7
7. Web Application Attack vectors
7.1 Abusing File Upload on a Vulnerable Web Server
7.2 Cross-site Request Forgery
7.3 SQL & Cross-Site Scripting Vulnerabilities
7.3.1 SQL Injection Vulnerabilities
Content Covered in labs Week 8
8. Web Application Testing
8.1 Web Application Testing with Burpsuite
8.1.2 Proxy
8.1.2 Spider
8.1.3 Intruder
8.1.4 Repeater
8.1.5 Sequencer
8.1.6 Comparer
8.1.7 Decoder
8.2 Cross Site Scripting (XSS) Reflected Attack
8.3 Generating a PHP Shell with Weevely
Content Covered in labs Week 9
9. Password Attacks
9.1 Online Password Attacks
9.2 Hydra
9.2.1 FTP Brute force
9.2.2 POP3 Brute force
9.3 Password profiling
9.3.1 CeWL
9.4 GPU Password Cracking
9.4.1 Password Cracking with CPU
9.4.2 Password Cracking with GPU
9.5 Dictionary Attack with Burp Suite
Content Covered in labs Week 10
10. Steganography
10.1 Hiding an image inside an image
10.2 Hiding information inside files
10.2.1 Encoding information inside a PDF file
10.2.2 Decoding the stego file
10.3 Breaking Steganography – Detecting hidden information
10.4 Network Steganography
Content Covered in labs Week 11
11. Wireless
11.1 Cracking WEP with BackTrack
11.2 Cracking WPA with Reaver
11.3 WPA-PSK Encryption
11.4 NetStumbler
11.5 Tool: Kismet
11.6 Tool: Aircrack-ng Suite
11.7 Tool: Airodump-ng
11.8 DOS: Deauth/disassociate attack
11.9 RAPIDS Rogue AP Detection Module
Content Covered in labs Week 12
12. Debugging and Exploit Development
12.1 Debugging Fundamentals
12.1.1 Opening and Attaching to the debugging target application
12.1.2 The OllyDbg CPU view
12.1.3 The 20 second guide to X86 assembly for exploit writers
12.2
Exploit Development with OllyDbg
12.2.1
12.2.2
12.2.3
12.2.4
12.2.5
12.2.6
12.2.7
Methods for directing code execution in the debugger
The SEH Chain
Searching for commands
Searching through memory
Working in the memory dump
Editing code, memory and registers
Help in calculating relative address differences
Practicals and Slides
COM353 Home page:
http://scisweb.ulster.ac.uk/~kevin/com535/index.htm
Course Notes:
http://scisweb.ulster.ac.uk/~kevin/com535/notes.htm
Please remember optional means optional.
Practicals:
Placed on Blackboard each week.
Examination:
Coursework 50% - Only examines what is in the notes each week – in two
class tests. Exam 50% - 5 questions – choose 4 based entirely on book.
Bonus Link:
in class only
Chapter 1
Overview
Computer Security Overview
The National Institute of Standards and
technology (NIST) Computer Security Handbook
defines the term Computer Security as:
“The protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the integrity,
availability and confidentiality of information
system resources” (includes hardware, software,
firmware, information/data, and
telecommunications).
The CIA Triad
Confidentiality
- data confidentiality
- privacy
Integrity
- data integrity
- system integrity
Availability
Key Security Concepts
Confidentiality
• preserving
authorized
restrictions on
information access
and disclosure,
including means for
protecting personal
privacy and
proprietary
information
Integrity
• guarding against
improper
information
modification or
destruction,
including ensuring
information
nonrepudiation
and authenticity
Availability
• ensuring timely
and reliable access
to and use of
information
Computer Security Challenges
 computer security is not as




simple as it might first appear
to the novice
potential attacks on the
security features must be
considered
procedures used to provide
particular services are often
counterintuitive
physical and logical placement
needs to be determined
additional algorithms or
protocols may be involved
 attackers only need to find a




single weakness, the
developer needs to find all
weaknesses
users and system managers
tend to not see the benefits of
security until a failure occurs
security requires regular and
constant monitoring
is often an afterthought to be
incorporated into a system
after the design is complete
thought of as an impediment
to efficient and user-friendly
operation
Table 1.1
Computer
Security
Terminology
RFC 2828, Internet
Security Glossary,
May 2000
Vulnerabilities, Threats
and Attacks
 categories of vulnerabilities
 corrupted (loss of integrity)
 leaky (loss of confidentiality)
 unavailable or very slow (loss of availability)
 threats
 capable of exploiting vulnerabilities
 represent potential security harm to an asset
 attacks (threats carried out)
 passive – does not affect system resources
 active – attempt to alter system resources or affect their operation
 insider – initiated by an entity inside the security parameter
 outsider – initiated from outside the perimeter
Table 1.2 Threat Consequences
Table 1.3
Computer and Network Assets
Examples of Threats
Table 1.3 Computer and Network Assets, with Examples of Threats.
Passive and Active Attacks
 Passive attacks attempt to learn or make use of information
from the system but does not affect system resources
 eavesdropping/monitoring transmissions
 difficult to detect
 emphasis is on prevention rather than detection
 two types:
 release of message contents
 traffic analysis
 Active attacks involve modification of the data stream
 goal is to detect them and then recover
 four categories:




masquerade
replay
modification of messages
denial of service
Security Requirements
Security Functional Requirements
functional areas that
primarily require computer
security technical measures
include:
• access control;
identification &
authentication; system &
communication protection;
and system & information
integrity
functional areas that
primarily require
management controls and
procedures include:
functional areas that overlap
computer security technical
measures and management
controls include:
• awareness & training; audit
& accountability;
certification, accreditation,
& security assessments;
contingency planning;
maintenance; physical &
environmental protection;
planning; personnel
security; risk assessment;
and systems & services
acquisition
• configuration management;
incident response; and
media protection
Figure
1.4
Security
Trends
Figure 1.5
Security
Technologies
Used
Security Implementation
response
response
prevention
detection
• secure encryption
•algorithms
intrusion detection
systems
• prevent
•unauthorized
detection of denial
of service
access
to attacks
encryption keys
detection
recovery
• intrusion detection
•systems
use of backup
systems of denial
• detection
of service attacks
• upon detection,
•being
uponable
detection,
to halt
being
able
to halt
an attack and
an attack
and
prevent
further
prevent
further
damage
damage
involves four
complementary
courses of
action:
prevention
involves four
• secure encryption
complementary
algorithms
courses of
• prevent
action:
unauthorized
access to
encryption keys
Chapter 2
Cryptographic Tools
Symmetric Encryption
 the universal technique for providing confidentiality for
transmitted or stored data
 also referred to as conventional encryption or single-key
encryption
 two requirements for secure use:
 need a strong encryption algorithm
 sender and receiver must have obtained copies
of the secret key in a secure fashion and must
keep the key secure
Figure 2.1
Attacking Symmetric
Encryption
Cryptanalytic Attacks
 rely on:
 nature of the algorithm
 some knowledge of the
general characteristics of the
plaintext
 some sample plaintextciphertext pairs
 exploits the characteristics of the
algorithm to attempt to deduce a
specific plaintext or the key being
used
 if successful all future and past
messages encrypted with that
key are compromised
Brute-Force Attack
 try all possible keys on some
ciphertext until an intelligible
translation into plaintext is
obtained
 on average half of all possible
keys must be tried to achieve
success
Table 2.1
Average Time Required for Exhaustive Key Search
Why Bits matter…..
It is all down to !
Factorial……
see here for why each bit
doesn’t just double the
keyspace….
Table 2.2
Comparison of Three Popular Symmetric
Encryption Algorithms
Data Encryption Standard
(DES)
the most widely used encryption
scheme
• FIPS PUB 46
• referred to as the Data Encryption Algorithm
(DEA)
• uses 64 bit plaintext block and 56 bit key to
produce a 64 bit ciphertext block
strength concerns:
• concerns about algorithm
• DES is the most studied encryption algorithm in
existence
• use of 56-bit key
• Electronic Frontier Foundation (EFF) announced in
July 1998 that it had broken a DES encryption
Figure 2.2 Time to Break a Code (assuming 106 decryptions/ms) The
graph assumes that a symmetric encryption algorithm is attacked using
a brute-force approach of trying all possible keys
Triple DES (3DES)
 repeats basic DES algorithm three times using either two or
three unique keys
 first standardized for use in financial applications in ANSI
standard X9.17 in 1985
 attractions:
 168-bit key length overcomes the vulnerability to brute-force
attack of DES
 underlying encryption algorithm is the same as in DES
 drawbacks:
 algorithm is sluggish in software
 uses a 64-bit block size
Advanced Encryption Standard
(AES)
needed a
replacement for
3DES
NIST called for
proposals for a
new AES in 1997
selected
Rijndael in
November 2001
should have a security
strength equal to or better
than 3DES
3DES was not
reasonable for
long term use
significantly improved
efficiency
symmetric block cipher
128 bit data and
128/192/256 bit keys
published as FIPS
197
Practical Security Issues
 typically symmetric encryption is applied to a unit of data
larger than a single 64-bit or 128-bit block
 electronic codebook (ECB) mode is the simplest approach
to multiple-block encryption
 each block of plaintext is encrypted using the same key
 cryptanalysts may be able to exploit regularities in the plaintext
 modes of operation
 alternative techniques developed to increase the security of
symmetric block encryption for large sequences
 overcomes the weaknesses of ECB
Block Cipher
Encryption
Stream
Encryption
Block & Stream Ciphers
Block Cipher
•
•
•
•
processes the input one block of elements at a time
produces an output block for each input block
can reuse keys
more common
Stream Cipher
• processes the input elements continuously
• produces output one element at a time
• primary advantage is that they are almost always faster and use far
less code
• encrypts plaintext one byte at a time
• pseudorandom stream is one that is unpredictable without knowledge
of the input key
Message Authentication
protects against
active attacks
verifies received
message is
authentic
can use
conventional
encryption
• contents have not been altered
• from authentic source
• timely and in correct sequence
• only sender & receiver share a
key
Message Authentication Codes
Secure Hash
Functions
Figure 2.6
Message
Authentication
Using a
One-Way
Hash Function
Ideal Hash Function

A cryptographic hash function is a hash function which is considered practically
impossible to invert, that is, to recreate the input data from its hash value alone. The
input data is often called the message, and the hash value is often called the message
digest or simply the digest.

The ideal cryptographic hash function has four main properties:





it is easy to compute the hash value for any given message
it is infeasible to generate a message that has a given hash
it is infeasible to modify a message without changing the hash
it is infeasible to find two different messages with the same hash.
Cryptographic hash functions have many information security applications, notably
in digital signatures, message authentication codes (MACs), and other forms
of authentication. They can also be used as ordinary hash functions, to index data
in hash tables, for fingerprinting, to detect duplicate data or uniquely identify files, and
as checksums to detect accidental data corruption. Indeed, in information security
contexts, cryptographic hash values are sometimes called
(digital) fingerprints, checksums, or just hash values, even though all these terms stand
for more general functions with rather different properties and purposes.
Hash Function Requirements
 can be applied to a block of data of any size
 produces a fixed-length output
 H(x) is relatively easy to compute for any given x
 one-way or pre-image resident
 computationally infeasible to find x such that H(x) = h
 second pre-image resistant or weak collision resistant
 computationally infeasible to find y ≠ x such that
H(y) = H(x)
 collision resistant or strong collision resistance
 computationally infeasible to find any pair (x, y) such that
H(x) = H(y)
Security of Hash Functions
 there are two approaches to attacking a secure hash
function:
 cryptanalysis
 exploit logical weaknesses in the algorithm
 brute-force attack
 strength of hash function depends solely on the length of the hash code
produced by the algorithm
 SHA most widely used hash algorithm
 additional secure hash function applications:
 passwords

hash of a password is stored by an operating system
 intrusion detection

store H(F) for each file on a system and secure the hash values
asymmetric
publicly
proposed by
Diffie and
Hellman in
1976
based on
mathematical
functions
• uses two
separate keys
• public key and
private key
• public key is
made public
for others to
use
some form of
protocol is
needed for
distribution
 plaintext

readable message or
data that is fed into
the algorithm as
input
 encryption algorithm

performs
transformations on
the plaintext
 public and private key

pair of keys, one for
encryption, one for
decryption
 ciphertext

***directed toward providing confidentiality
scrambled message
produced as output
 decryption key

produces the original
plaintext
 user encrypts data
using his or her own
private key
 anyone who knows the
corresponding public
key will be able to
decrypt the message
***directed toward providing authentication
Table 2.3
Applications for Public-Key Cryptosystems
computationally easy
to create key pairs
useful if either key
can be used for each
role
computationally easy
for sender knowing
public key to encrypt
messages
computationally
infeasible for
opponent to
otherwise recover
original message
computationally easy
for receiver knowing
private key to decrypt
ciphertext
computationally
infeasible for opponent
to determine private
key from public key
RSA (Rivest,
Shamir,
Adleman)
developed in 1977
most widely accepted and
implemented approach to
public-key encryption
Diffie-Hellman
key exchange
algorithm
enables two users to
securely reach agreement
about a shared secret that
can be used as a secret key
for subsequent symmetric
encryption of messages
limited to the exchange of
the keys
Digital
Signature
Standard (DSS)
provides only a digital
signature function with
SHA-1
cannot be used for
encryption or key
exchange
Elliptic curve
cryptography
(ECC)
security like RSA, but with
much smaller keys
block cipher in which the
plaintext and ciphertext
are integers between 0 and
n-1 for some n.
Digital Signatures
 used for authenticating both source and data integrity
 created by encrypting hash code with private key
 does not provide confidentiality
 even in the case of complete encryption
 message is safe from alteration but not eavesdropping
Digital
Envelopes
 protects a message
without needing to
first arrange for sender
and receiver to have
the same secret key
***equates to the same thing
as a sealed envelope
containing an unsigned
letter
Random
Numbers
Uses include
generation of:
 keys for public-key




algorithms
stream key for
symmetric stream
cipher
symmetric key for use
as a temporary
session key or in
creating a digital
envelope
handshaking to
prevent replay attacks
session key
Random Number Requirements
Randomness
 criteria:
 uniform distribution
 frequency of occurrence of
each of the numbers
should be approximately
the same
 independence
 no one value in the
sequence can be inferred
from the others
Unpredictability
 each number is statistically
independent of other numbers
in the sequence
 opponent should not be able
to predict future elements of
the sequence on the basis of
earlier elements
Random versus Pseudorandom
 cryptographic applications typically make use of algorithmic
techniques for random number generation
 algorithms are deterministic and therefore produce sequences of
numbers that are not statistically random
 pseudorandom numbers are:
 sequences produced that satisfy statistical randomness tests
 likely to be predictable
 true random number generator (TRNG):
 uses a nondeterministic source to produce randomness
 most operate by measuring unpredictable natural processes
 e.g. radiation, gas discharge, leaky capacitors
 increasingly provided on modern processors
Practical Application:
Encryption of Stored Data
common to encrypt transmitted data
much less common for stored data
there is often little protection
beyond domain
authentication and operating
system access controls
approaches to encrypt stored data:
data are archived for
indefinite periods
even though erased, until
disk sectors are reused data
are recoverable
use a commercially
available encryption
package
back-end appliance
library based tape
encryption
background laptop/PC
data encryption
Chapter 2 Summary
 symmetric encryption




conventional or single-key only type
used prior to public-key
five parts: plaintext, encryption
algorithm, secret key, ciphertext, and
decryption algorithm
two attacks: cryptanalysis and brute
force
most commonly used algorithms are
block ciphers (DES, triple DES, AES)
 hash functions


message authentication
creation of digital signatures
 public-key encryption



based on mathematical functions
asymmetric
six ingredients: plaintext, encryption
algorithm, public and private key,
ciphertext, and decryption algorithm
 digital signatures

hash code is encrypted with private
key
 digital envelopes

protects a message without needing
to first arrange for sender and
receiver to have the same secret key
 random numbers



requirements: randomness and
unpredictability
validation: uniform distribution,
independence
pseudorandom numbers