CRYPTOGRAPHY,

NETWORK SECURITY AND

CYBER LAW

SEMESTER – VI

1
 Module – 1
<Chapter 1>
Introduction
•Cyber Attacks,
•Defence Strategies and Techniques,
•Guiding Principles,

2
 <Chapter 3>
Mathematical Background for Cryptography –
•Modulo Arithmetic’s,
•The Greatest Comma Divisor,
•Useful Algebraic Structures,
•Chinese Remainder Theorem

3
 <Chapter 4>
Basics of Cryptography –
•Preliminaries
•Elementary Substitution Ciphers,
•Elementary Transport Ciphers,
•Other Cipher Properties

4
 <Chapter 5>
Secret Key Cryptography –
•Product Ciphers,
•DES Construction,
•Modes of Operation,
•MAC and Other Applications,
•Attacks
•Linear Cryptanalysis.

5
 Chapter 1: Introduction
•Introduction - Cyber Attacks, Defence Strategies and
Techniques, Guiding Principles,

6
What is Security about (in the
technical sense)
•(Goals of the hacker/attacker/adversary)
•Attacks
•Vulnerabilities
•Defence

7
 Chapter 1: Introduction

•Cyber security is a study of attacks and know about

defense against attacks.
–Motives:
•The main goal of an attackers is thrill of mounting successful cyber
attacking mechanism.
•Most hackers are young programmers, teens- who dropped out schools but
intelligent and focused.
•Most traditional hackers are obsessive programmers
•Script kiddies- who use scripts and attack kits designed by other.
•Company insiders- disgruntled (dissatisfied) employees.
•Cyber terrorists- who adopt extreme religious or political causes.

8
 Main aim is to cripple the information and
communication systems of the financial and business
institutions of their enemies.
The goal of the attackers is to impersonate victim.
Attackers then can perform unauthorized logins , make
online purchases, initiating banking transactions.

9
 Some Attack Goals
•Theft of sensitive information
–(example: credit card information)
•Disruption of service
–(rendering a service inaccessible or unavailable)
•Information Warfare
–(attacking infrastructure of an “enemy” country)
•Illegal access to or use of resources
–(circumventing controls so as to gain unauthorized access)

10
Attacks, Attacks, Attacks!

11
 Attacks …..
•Phishing is the attempt to obtain sensitive information
such as usernames, passwords, and credit card details,
often for malicious reasons, by disguising as a
trustworthy entity in an electronic communication.

12
13
•In computer security, a side-channel attack is
any attack based on information gained from the
physical implementation of a computer system, rather
than weaknesses in the implemented algorithm itself
(e.g. cryptanalysis and software bugs)

14
15
•Skimming can also occur at merchants (such as gas
stations) when a third-party card-reading device is installed
either outside or inside a fuel dispenser or other card-
swiping terminal. This device allows a thief to capture a
customer's card information, including their PIN, with each
card swipe.

16
17
•A dictionary attack is an attack that tries to
guess at the key of a cipher text by attempting
many different common passwords and possible
passwords that are likely to be used by humans.

18
19
•Pharming is a cyber attack intended to redirect a
website's traffic to another, fake site.
•Pharming can be conducted either by changing the
hosts file on a victim's computer or by exploitation of a
vulnerability in DNS server software.
•(DNS cache poisoning )
•Vulnerabilities : DNS

20
 How Pharming works?
•The attacker targets the
DNS service used by the
customer and adds/alters
the entry for
www.mybank.com –
changing the stored IP
address from 150.10.1.21
to the attackers fake site
IP address (200.1.1.10).
•The customer queries
21
the DNS server – “What is
•Session hijacking, sometimes also known as
cookie hijacking is the exploitation of a valid
computer session—sometimes also called a
session key—to gain unauthorized access to
information or services in a computer system
•MiM (Man in the Middle attack)
•ARP cache poisoning
•Vulnerabilities : Crypto protocols,ARP

22
23
•DNS Cache poisoning (also called DNS cache
poisoning) is the process of corrupting an
Internet server’s domain name system table by
replacing an Internet address with that of a
rogue address.

24
•Man-in-the-middle (MiM) attacks, where a
malicious actor goes between two parties &
gains access to private information

25
•Man-in-the-middle (MiM) attacks, where a
malicious actor goes between two parties &
gains access to private information

26
27
•A replay attack is a form of network attack in
which a valid data transmission is maliciously or
fraudulently repeated or delayed.
•This is carried out either by the originator or by
an adversary who intercepts the data and re-
transmits it, possibly as part of a
masquerade attack by IP packet substitution

28
29
•A privilege escalation attack is a type of
network intrusion that takes advantage of
programming errors or design flaws to grant the
attacker elevated access to the network and its
associated data and applications

30
•A Distributed Denial ofService (DDoS) attack is
an attempt to make an online service unavailable
by overwhelming it with traffic from multiple
sources

31
32
•A SQL injection attack consists of insertion or
"injection" of a SQL query via the input data
from the client to the application. A
successful SQL injection exploit can read
sensitive data from the database, modify
database data (Insert/Update/Delete), execute
administration operations on the database

33
•A buffer is a temporary area for data storage.
When more data (than was originally allocated
to be stored) gets placed by a program or system
process, the extra data overflows. It causes
some of that data to leak out into other buffers,
which can corrupt or overwrite whatever data
they were holding.

34
•A buffer is a temporary area for data storage.
When more data (than was originally allocated
to be stored) gets placed by a program or system
process, the extra data overflows. It causes
some of that data to leak out into other buffers,
which can corrupt or overwrite whatever data
they were holding.

35
36
•Cross-site Scripting (XSS) refers to client-side
code injection attack wherein an attacker can
execute malicious scripts (also commonly
referred to as a malicious payload) into a
legitimate website or web application.

37
38
 Nature of cyber /security attacks
•Theft of sensitive information.
–Stealing information new products before its grand release.
•Theft of Military plans by adversaries <opponents>
•Political espionage<spying>-targeting at government ministries
and national intelligence.
•Identity theft : Leakage of personal information such as PIN,
password, personal spending habits
•Target of security attacks are banks, military, intelligence and
individuals.
•Disruptive of service : leads to servers become unavailable or
inaccessible.
•Illegal access or use of resources- obtaining free access or service
to paid services

39
 Common Attacks
•1. Attempts to retrieve personal information
of individual.
–Phishing
•Attractions of victims towards fake website –an online
bank. The fake site has same look and feel as that of
authentic or original.
•Victim is then induced to reveal sensitive information
such as login name and password.
•These information are then passed to fake website.

40
•Pharming
–Pharming is a cyber attack intended to redirect a
website's traffic to another, fake
site. Pharming can be conducted either by
changing the hosts file on a victim's computer or
by exploitation of a vulnerability in DNS server
software.

41
42
•Eavesdropping is the unauthorized real-time
interception of a private communication, such as
a phone call, instant message, videoconference
or fax transmission.
•The term eavesdrop derives from the practice
of actually standing under the eaves of a house,
listening to conversations inside.

43
Fake site

44
•2. Skimming attacks
–Leaking of information from ATM, smart cards,
credit cards
–Different techniques varies from fake terminal to
sophisticated channels.
–In channel attacks , information are retrieved from
lost of stolen cards.

45
•Spoofing or eavesdropping –leakage of
information takes place between two
communicating parties.

46
•Dictionary attacks- password guessing attacks
is a special case dictionary attacks.
•DoS attacks: interruption or disruptions of the
computing services of the victim.
–These exhaust computing power, memory
capacity, communication bandwidth of their targets
•Example: website defacement <damage>
•Usually targeted for high profile personalities.

47
•Malware: Worm and viruses
–These replicate themselves.
–Viruses usually infects a file, it spreads from one file
to another.
–Worm is a standalone program that infects a
computer, it spreads from one computer to another.
–These spread via various techniques like BlueTooth,
MMS, web pages, e-mail ,Internet Messages.

48
 Vulnerabilities
•Behind every attack there is a vulnerability.
•Vulnerability is a weakness in a procedure ,
protocol , hardware or software within an
organization

49
•Few types Vulnerability classes:
–Human vulnerabilities
•These are induced by human behavior or action.
–User click over a link in an e-mail message received from a
questionable source. ( Cross site scripting attack or phishing attack)
–Protocol vulnerabilities
•Networking protocols are used in unanticipated ways
•ARP is used to sniff passwords from a LAN
–Software vulnerabilities
•Vulnerabilities caused by sloppy<disordered> written
software and applications
–Configuration vulnerabilities
•Relate to Vulnerabilities settings on newly installed
50
51
 Vulnerability Types

•Human Vulnerabilities
–Induced by careless/unthinking human behavior
–Ex. clicking on a link in an e-mail message from a
questionable source
–Related to phishing and cross-site scripting attacks

52
 Vulnerability Types (contd.)

•Protocol Vulnerabilities
–Attacks on commonly used networking protocols such as
TCP, IP, ARP, ICMP and DNS
–Ex. Connection hijacking caused by ARP spoofing, etc.
–Denial of Service Attacks (DoS) which exploit the 3-way TCP
handshake
–Pharming attacks exploit vulnerabilities in DNS

53
 Vulnerability Types (contd.)
•Software Vulnerabilities
–Caused by sloppy software

–Software may perform as expected under normal

conditions but when provided with a specific input, it turns
malicious

–Examples include Buffer Overflow vulnerability, Cross-site

Scripting (XSS) vulnerability and SQL Injection vulnerability

54
 Vulnerability Types (contd.)
•Configuration Vulnerabilities
–relate to settings on system/application software, on files,
etc.
–Read-write-execute (and other) permissions on files (and
other objects) may be too generous.
–Privilege level assigned to a process may be higher than
what it should be to carry out a task.
–Often lead to “privilege escalation” attacks.

55
Defense Strategies and techniques
•Access control-Authentication and Authorization
•Data protection
•Prevention and detection
•Response , Recovery and Forensics

56
Access control –Authentication and
Authorization
•Use of third parties that mediates access to a
protected system.
•The trusted third party is usually implemented
in software or may be part of OS, application.
•The authentication denies or permits entry to
system. Example: use of password.
–User first enters login and the system challenges
user to prove identity
–In this case it is a prompts for password.

57
 Data protection
•Data in transit or storage must be protected.
•It must adopt
–Data confidentiality –the data should not be
readable by an intruder.
–Data integrity- the data in transit should not be
tampered with or modified
–Cryptographic techniques – such as
encryption/decryption mechanism are used

58
 Examples of Detection

•Integrity checks on messages, files

–Simple CRC-type checksums not effective for security
applications
–Use of the Message Authentication Code (MAC)

•Intrusion detection systems based on

–Anomaly detection
–Signature detection

59
 Examples of Preventive Strategies

•Code Auditing and Testing (against software flaws)

–Blackbox
–Whitebox

•Access Control (against unauthorized access)

–Authentication
–Authorization

•Encryption (against eavesdropping)

60
 Advice to a Security Designer

“ You can’t make something secure if you don’t

know how to break it”
- Marc Weber Tobias

61
Responses, Recovery and Forensics
•Shutting down all or part of system when an
attack or infection detected.
•In case worm epidemic, infected part of the
system should be quarantined and necessary
patches should be applied
•Cyber forensics is a set of tools that help trace
back the perpetrators <culprits> of cyber crime

62
•Guiding principles
–Security is as much a human problem than a
technological problem and must be addressed at
different levels.
–Security should be factored in at inception, not as
an afterthoughts.
–Security by obscurity is often bogus.
–Always consider the Default Deny policy for
adoption in access control.
–An entity should be given least amount of
permission/ privilege to accomplish a given task.
–Use “Defence in depth” to enhance security of an 63
 Assignment Questions
Module 1_ Chapter 1
1. What is cyber attack ? Explain different types
of attacks.
2. Explain different defense strategies.

64