Microsoft PowerPoint - 0-Overview.ppt [兼容模式]

Size: px

Start display at page:

Download "Microsoft PowerPoint - 0-Overview.ppt [兼容模式]"

筒围郜
7 years ago
Views:

1 Network Security ( 网络安全原理与技术 ) Instructor: Di Wu ( 吴迪 ) Sun Yat-Sen University Introduction 1

2 Question Computer Security Network Security Difference? Sun Yat-Sen University Introduction 2

3 Answer Computer Security Protect data itself. Especially for a shared computer system Network Security Protect data transmission Sun Yat-Sen University Introduction 3

4 Networks under attack What can be wrong? How are computer networks vulnerable? What are some of the more prevalent attacks today? Acknowledgement: Part of the slides are adopted from Prof. Keith Ross lecture notes. Sun Yat-Sen University Introduction 4

5 The bad guys can put malware into your host via the Internet We connect our hosts to the Internet to get good stuff: , web pages, mp3s, video clips, search results, etc. But along with the good stuff, comes the malware: Delete files Install spyware that collects private info Enroll our compromised host in a botnet Sun Yat-Sen University Introduction 5

But along with the good stuff, comes the malware: Delete files Install spyware that

6 Malware: self-replicating Once it infects one host: seeks entry it into other hosts and then into yet more hosts Virus ( 病毒 ) Worms ( 蠕虫 ) Trojan horse ( 木马 ) Difference? Sun Yat-Sen University Introduction 6

7 Difference Virus Requires some form of human interaction to spread Classic example: viruses Worms No user replication needed Worm in infected host scans IP addresses and port numbers, looking for vulnerable processes to infect Trojan horse Hidden, devious part of some otherwise useful software Sun Yat-Sen University Introduction 7

addresses and port numbers, looking for vulnerable processes to infect Trojan horse

8 Case Study Virus: ILOVEYOU 以电子邮件消息的形式发来, 主题是 ILOVEYOU, 附件名为 LOVE-LETTER-FOR-YOU.TXT.vbs E E 向被感染者 Outlook 通讯簿名单发出自动信件, 藉以连锁性的大规模散播, 造成企业 mail server 瘫痪 Worm:Code Red "Hacked by Chinese! Trojan horse ( 木马 ): 盗版软件可通过 QQ/ 网游外挂传播 Sun Yat-Sen University Introduction 8

9 The bad guys attack servers & network infrastructure: DoS attacks Denial of Service: Diminishes usability of network host, network, or network infrastructure. Vulnerability attack: Attacker sends well-crafted messages to a vulnerable app or OS, crashing service or host. Bandwidth flooding: Attacker sends a deluge of packets to the targeted host. Target s access link becomes clogged.. Connection flooding: The attacker establishes large number of half- or fully-open TCP connections at the target host. Target becomes incapable of accepting legitimate connections. Sun Yat-Sen University Introduction 9

Bandwidth flooding: Attacker sends a deluge of packets to the targeted host. Target s access link becomes clogged.

10 Case Study: 暴风影音事件暴风影音 5.19 事件 :2009 年 5 月日, 我国多个省市网络出现瘫痪堵塞的现象, 这是继 2006 年 12 月 27 日台湾地震导致海底光缆中断以来, 国内最严重的一次网络事故原因 : 某游戏私服网站使用僵尸网络对国内最大的免费域名服务提供商 DNSPod 进行 DDoS 攻击暴风影音用户 (1.2 亿 ) 无法解析 baofeng.com, 而转向 ISP 的 DNS 服务器, 使各 ISP 的 DNS 瘫痪 Sun Yat-Sen University Introduction 10

11 The bad guys can sniff packets Passive sniffers near wireless transmitters Wired environments too. Many LANs broadcast Residential cable access systems broadcast Bad guys with access with internal network infrastructure can install sniffers. Packet sniffers are passive and therefore difficult to detect. t Sun Yat-Sen University Introduction 11

Many LANs broadcast Residential cable access systems broadcast Bad guys with access

12 Case Study: 无线蹭网卡使用蹭网卡 ---- 享受永久免费无线上网! 教你如何在外租房或经常搬家时, 想上网而不方便时轻松免费无线上网教你如何节省昂贵的网费, 随时随地接收到附近的无线网络您出差在外是否遇到没有网络而无法给客户发邮件而焦虑? 现在, 您已经不必担忧了!! 因为有了蹭网卡, 你就能蹭网无线上网! Sun Yat-Sen University Introduction 12

13 Case Study: 反蹭网器 Sun Yat-Sen University Introduction 13

14 The bad guys can masquerade as someone you trust Easy to create packet w/ arbitrary source address, packet content & dest address then transmit packet into the Internet which forwards the packet to its destination. Man-in-the-middle: bad guy inserted in path between two communicating entities Sniff, inject, modify, delete packets Compromise integrity of data sent btwn 2 entities Sun Yat-Sen University Introduction 14

15 Top 5 Hackers of All time No 1. Kevin Mitnick No 2. Adrian Lamo No. 3. Jonathan James No. 4. Robert Morris No. 5. Kevin Poulsen Sun Yat-Sen University Introduction 15

16 How did the Internet get to be such an insecure place? Originally for a group of mutually trusting users attached to a transparent network. By definition, no need for security Mutual trust By default, can send a packet to any other user No requested/granted capability in TCP/IP IP source address taken by default to be true Today, communication between trusted users is the exception rather than the rule Sun Yat-Sen University Introduction 16

By definition, no need for security Mutual trust By default, can send a packet to any other user No

17 Course Goals Become expert in Internet protocols Understand the types of problems Survey some attacks Become familiar with some attack tools Understand the basic network security tools to counter the attacks Become familiar with firewall, IDS, VPN configuration fg Focus on principles rather than technology trends, current events Sun Yat-Sen University Introduction 17

tools to counter the attacks Become familiar with firewall, IDS, VPN configuration fg Focus

18 Topics covered Network attacks Advanced d topics Cryptography Symmetric key, public key, integrity Secure protocols PGP, SSL, IPsec, etc Intrusion detection Firewalls Security issues in P2P IP traceback Secure WiFi Sun Yat-Sen University Introduction 18

IPsec, etc Intrusion detection Firewalls Security issues in P2P

19 Prerequisites Equivalent course on computer networking with a heavy dose of TCP/IP Proficiency in C programming and Linux Sun Yat-Sen University Introduction 19

20 Recommended Books Network Security Essentials, William Stallings, 2007, Prentice Hall; decent introduction to cryptography and secure protocols. Computer Networking, 4 th Edition, Kurose and Ross, 2007: for networking and TCP/IP background material, cryptography and secure protocols Counter Hack, 2nd Edition, Ed Skoudis, 2005, for material in first few lectures on attacks Network Security, Private Communication in a Public World, C. Kaufman, R. Perlman, M. Speciner, Prentice Hall, 1995; more advanced. Sun Yat-Sen University Introduction 20

Computer Networking, 4 th Edition, Kurose and Ross, 2007: for networking and TCP/IP background material, cryptography and secure

21 Grading Main course Homework 20% Mid Term 20% Final exam 60% Labs 5 labs, each 20% Sun Yat-Sen University 21

22 Policy Do it independently No copy Can use reference books Staple your solution Write your name also, For report, you could discuss with classmates then write your own report Sun Yat-Sen University 22

23 Personnel Instructor: Di Wu ( 吴迪 ), wudi.cuhk@gmail.com Office hours: Thursday, 1pm 3pm Office: Room 632E Teaching Assistant: Zhihui Zhan ( 詹志辉 ) zhanapollo@163.com. Office: Room 507 All questions about labs should be directed to Zhihui. Course Website: Sun Yat-Sen University Introduction 23

24 First lab assignment Started next Thursday 2 Wireshark assignments IP, TCP Max 10 pages; one document To be done individually Part of becoming an expert in Internet protocols Sun Yat-Sen University Introduction 24

2011 图年与 2010 年木马或僵尸程序控制服务器数据对比 % IP 图

2011 图年与 2010 年木马或僵尸程序控制服务器数据对比 % IP 图 2011 IP 253684 IP 46723 2010 4.6% 79.5% 2-1 15 / 131 2011 图 2-1 2011 年与 2010 年木马或僵尸程序控制服务器数据对比 2 100 1000 80.6% 1000-5000 5000-20000 2-5 5-10 10 IP 2010 1386 355 90 23 30 2-2 图 2-2 2011