Class 2 - Internet security¶
For this assignments, I have used AI ( Chat gpt and Gemini) to get the answers for my understanding as the terms are quite unfamiliar to me. The terms like IP, DNS, and MAC are familiar as I used to do some settings of Wifi networds, assingning IP, DNS and using the MAC filtering .
1. PGP (Pretty Good Privacy) — End-to-End Email Security¶
What Threat Does It Address?
Eavesdropping and Mass Surveillance: Encrypts email content and attachments so network intermediaries (ISPs, email providers) cannot read them.
Data Tampering: Employs digital signatures to ensure message integrity in transit.
Spoofing and Impersonation: Validates the identity of the sender, ensuring the email originated from the holder of the specific private key.
What’s the Trust Model?
Web of Trust (WoT): A decentralized model with no central Certificate Authority (CA). Users digitally sign each other’s public keys to vouch for identities.
Out-of-Band Verification: Modern implementations often rely on direct, manual verification of key fingerprints or automated lookups like Web Key Directory (WKD).
What’s the Residual Risk?
Metadata Leakage: PGP does not encrypt email headers. Attackers can still see the sender, recipient, subject line, timestamp, and message size.
No Forward Secrecy: If an attacker steals a user’s private key, they can decrypt all historical emails previously captured.
Client-Side Vulnerabilities: Implementation flaws in email clients (e.g., historical EFAIL exploits) can inadvertently leak decrypted text.
2. SSH (Secure Shell) — Secure Remote Access¶
What Threat Does It Address?
Plaintext Credential Theft: Replaces insecure legacy protocols (like Telnet) by encrypting passwords and session data.
Man-in-the-Middle (MitM) Attacks: Prevents attackers from hijacking an active terminal session or redirecting a connection to a rogue server.
What’s the Trust Model?
Trust on First Use (TOFU): The first time a client connects to a server, the server’s public key fingerprint is displayed. The user must manually accept and save it (known_hosts). Future connections rely on this cached key.
Certificate Authority (Alternative): In enterprise environments, SSH can be configured to trust host and user certificates signed by a central, internal CA.
What’s the Residual Risk?
Human Error during TOFU: Users routinely blind-click “yes” when connecting to a server for the first time, exposing themselves to an initial MitM attack.
Compromised Private Keys: If a client’s private SSH key is stolen (especially if passphrase-unprotected), the attacker gains immediate access to the target systems.
Brute-Force Attacks: Publicly exposed SSH ports (port 22) are constantly targeted by automated credential-stuffing bots.
3. VPN / IPsec — Network-Layer Tunneling¶
What Threat Does It Address?
Insecure Transit Networks: Protects data routing over untrusted infrastructure (like public Wi-Fi or the open internet) by creating an encrypted tunnel.
IP Spoofing: Ensures that packets entering the tunnel cannot be forged or altered by unauthorized external parties.
What’s the Trust Model?
Centralized / Peer-to-Peer Gateways: Relies on a pre-established cryptographic trust between endpoints. This is achieved either through Pre-Shared Keys (PSKs) or a Public Key Infrastructure (PKI) with x.509 digital certificates.
Network-Wide Trust: Once authenticated, the network behind the gateway often inherently trusts the traffic originating from the VPN tunnel.
What’s the Residual Risk?
Lateral Movement: If a remote user’s endpoint is compromised, an attacker can use the active VPN tunnel to pivot directly into the internal corporate network.
Concentration of Failure: The VPN gateway becomes a high-value target; vulnerabilities in the gateway software itself (e.g., edge-device exploits) can compromise the entire enterprise network.
Traffic Analysis: Network observers can still see the VPN endpoints, connection timing, and data volumes, potentially mapping out corporate infrastructure patterns.
4. MACsec (802.1AE) — Link-Layer Encryption¶
What Threat Does It Address?
Physical Layer Interception: Protects point-to-point Ethernet links (e.g., a wire connecting a switch to a router or server) against physical wiretapping.
Layer 2 Attacks: Defends against ARP spoofing, MAC flooding, and man-in-the-middle attacks occurring directly on the local area network (LAN) layer.
What’s the Trust Model?
Hop-by-Hop / Node-to-Node: Trust is strictly localized between directly connected physical ports. The hardware devices authenticate each other at the data-link layer using a Pre-Shared Key or via 802.1X (EAP-TLS).
What’s the Residual Risk?
Cleartext Exposure inside Nodes: Because MACsec encrypts on a hop-by-hop basis, packets are fully decrypted inside the memory of the switch or router before being re-encrypted for the next hop. A compromised switch exposes all traffic.
No End-to-End Security: It does not protect data if an intermediate router miles away is misconfigured or compromised.
5. DNS Security (DNSSEC & DNS Spoofing)¶
What Threat Does It Address?
DNS Cache Poisoning / Spoofing: Prevents attackers from injecting fake DNS records into a resolver’s cache to redirect users to malicious websites.
Data Alteration: Ensures that the IP addresses returned by a DNS query have not been tampered with in transit.
What’s the Trust Model?
Hierarchical PKI Chain: Relies on a strict top-down chain of trust. The Internet Root Zone (.) signs the keys for Top-Level Domains (like .com), which in turn sign the keys for individual second-level domains.
Trust Anchors: Resolvers are pre-configured with a public root key (Trust Anchor) to validate the cryptographic signatures accompanying the DNS records.
What’s the Residual Risk?
No Confidentiality: Standard DNSSEC does not encrypt DNS queries or responses; it only signs them. Attackers can still see what websites a user is looking up (unless paired with DoH or DoT).
Amplification Attacks: DNSSEC responses are significantly larger than standard DNS packets, making DNSSEC-enabled servers prime targets for reflection/Distributed Denial of Service (DDoS) attacks.
Zone Walking: Certain DNSSEC implementations allow attackers to systematically enumerate every single subdomain listed within a DNS zone.
6. IDS / IPS (Intrusion Detection vs. Prevention)¶
What Threat Does It Address?
Malicious Network Activity: Scans for known exploit signatures, abnormal traffic spikes, protocol anomalies, and unauthorized lateral movement.
IDS (Passive): Alerts administrators to ongoing or past attacks.
IPS (Active): Actively blocks or drops malicious traffic in real time.
What’s the Trust Model?
Signature and Baseline Trust: Relies on the integrity of the vendor-supplied signature database and the accuracy of the baseline network behavioral profile configured by administrators.
In-Line vs. Promiscuous Placement: An IPS is trusted inline to make immediate automated decisions on packet survival, whereas an IDS is trusted off to the side (SPAN/TAP) to read copies of the data.
What’s the Residual Risk?
Encrypted Traffic Blindness: If the network traffic is encrypted (e.g., via TLS 1.3), an IDS/IPS cannot inspect the payload for signatures unless intrusive TLS decryption/interception proxies are deployed.
False Positives/Negatives: Highly sophisticated “Zero-Day” attacks without existing signatures will bypass detection (False Negative), while normal but erratic business traffic might cause disruptions by getting blocked accidentally (False Positive).
7. TLS Handshake Trace¶
What Threat Does It Address?
Cryptographic Weakness & Incompatibility: Negotiates encryption protocols to ensure both parties use modern, secure algorithms, preventing “downgrade attacks” (where an attacker forces a connection to use obsolete, breakable ciphers).
Identity Spoofing: Validates the identity of the server (and optionally the client) before any sensitive application data is sent.
What’s the Trust Model?
Centralized Public Key Infrastructure (PKI): Operating systems and browsers come pre-installed with a list of trusted Root Certificate Authorities (CAs). The client trusts the server because the server presents a certificate cryptographically signed by an authority in that trusted root store.
What’s the Residual Risk?
CA Compromise or Rogue Certificates: If a single trusted Certificate Authority is breached or coerced, an attacker can issue a legitimate-looking certificate for any domain on earth to conduct flawless MitM attacks.
End-User Bypass: Users frequently click through “Invalid Certificate” warnings on browsers, rendering the entire trust model useless.
8. Port Scan & Firewall¶
What Threat Does It Address?
Reconnaissance (Port Scan): Firewalls can detect or hinder automated mapping tools (like Nmap) used by attackers to discover active hosts and open, vulnerable network ports.
Unauthorized Access: Blocks unwanted incoming network connections based on a defined security policy (IP addresses, ports, or protocols).
What’s the Trust Model?
Perimeter Defense (Implicit Trust): Historically assumes an “Inside vs. Outside” model. Traffic originating from the internal network is generally trusted by default, while traffic originating from the internet is untrusted.
Rule-Based Trust: Operates strictly on explicit access control lists (ACLs) created by network administrators.
What’s the Residual Risk?
Application-Layer Tunneling: Standard stateful firewalls only look at ports (e.g., blocking port 21 for FTP but keeping port 443 open for web traffic). Attackers can easily tunnel malicious data over allowed open ports (like HTTPS or DNS).
The “Castle and Moat” Fallacy: If an attacker bypasses the firewall perimeter (via phishing, a compromised VPN user, or physical access), the firewall offers little to no protection against internal lateral movement.