DISTRIBUTED DENIAL OF SERVICE DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS ARE A SUBCLASS OF DENIAL OF SERVICE (DOS) ATTACKS. A DDOS ATTACK INVOLVES MULTIPLE CONNECTED ONLINE DEVICES, COLLECTIVELY KNOWN AS A BOTNET, WHICH ARE USED TO OVERWHELM A TARGET WEBSITE WITH FAKE TRAFFIC.

 

What are the types of DDoS attacks?

DDoS attacks are divided into several types:

1. Application layer attacks
2. Protocol attacks
3. Volumetric attacks

Some common DDoS attacks are listed below:

1. UDP Flood
2. ICMP Flood
3. SYN Flood
4. Ping of Death
5. NTP Amplification
6. HTTP Flood
7. Slowloris

Explain the different types of DDoS attacks?

1. Application layer attacks are sometimes been known as layer 7 attacks to destruct the resources available in the target area. The DDoS attack is mainly in the area where webpages are created and transmitted through requests (HTTPS). An HTTP request can be too small on the client side but the response from the server is too large as it may hold multiple files and queries to build a webpage. Mostly this type of attack is difficult to protect as the traffic may be a concern to determine as malicious.

The HTTP flood is an example of applying the press button again and again in a web engine browser on many systems at a time making the server flood with requests and occurring denial of service to users. The HTTPS flood attacks range from one to many, i.e. simple implementations access one URL and complex implementations access many URLs with attacking IP addresses.

2. Protocol attacks mainly utilize layers 3 and 4 of the protocol stack to make the target not been accessed. These attacks consume the state capacity of web servers and firewalls etc.

Here is an example of SYN Flood where requests are being unanswered and the process continues. For example, labor in a supply room gets a request from outside of the storeroom for a package. By hearing this, the labor goes and gets the package and waits for the final confirmation before he takes the package out of the storeroom. By the time the labor gets many more requests and without confirmation, the process goes unanswered and waits for the final step to closed.

3. Volume attacks consume to use the bandwidth of target and internet networks. To succeed in this attack, attackers overflow the website with malicious traffic. This results in the stoppage of legitimate traffic and results in denial of service.

Some DDoS attacks are mentioned below:

1. UDP or User Datagram Protocol is a DDoS attack that is initiated by forwarding a huge number of UDP packets to other ports. The far distance host will reply accordingly as :

• Checking for application or no application listens at that port.
• Replying with ICMP packets
• Usually, UDP flood attacks tools are of 2 types as Low Orbit Ion Cannon and UDP unicorn
• These attacks can be handled by implementing firewalls at end networks to filter out malicious traffic. It attacks the end networks with a packet having static or random Internet protocol addresses.

2. ICMP Flood or Ping Flood follows the same principle as UDP Flood and it is a common DDoS attack where the striker ruins down the victim’s system by continuously sending requests called pings. There are several ping commands like n,l,t where the n command is the number of times requests are being sent, the l command tells us the amount of data sent in a packet, and the t command is used to ping data.
3. TCP SYN Flood is a DDoS attack where client and server establish a three-way handshake which is described below:

First of all, the client is requesting for connection by sending an SYN message to the server-side. Once the server receives the connection request, it sends back an acknowledgment message to the client, to which the client responds with acceptance, and thereby the connection has been established.

Here the striker sends continuous messages (SYN) to the server, mostly having a false IP address. The server receives being unknown lots of requests for connections. Either way the server attacked with malicious requests sends the acknowledgment, but it waits from the client-side for the same.

4. Slowloris is a high-level attack where one server takes down others without hampering services on the same networks. Slowloris by its name creates a connection to the target server by sending only partial requests. The server keeps this connection open which later overflows and leads to denial of service.
5. Those attackers are mainly focused on attacks due to some ideology, Extortion, Business rivalry, etc.
6. Zero Based DDoS attacks include unknown attacks and have no patch left behind.

Conclusion

DDoS attacks have been a challenge to target servers and by that solutions are to be made. DDoS attacks are evolving as a cyber threat and focusing on short target duration. For protection against these attacks, we need to build solutions outside networks where only genuine traffic gets in after being filtered. It should not only filter out but also detect threats and come with a remedy for those attacks. DDoS attacks were a threat as firewalls and routers fail to prevent these attacks and malicious traffic.

TRANSFORMING A PLAIN TEXT MESSAGE TO CIPHER TEXT,There are various types of ciphers, including: Substitution ciphers. ... Transposition ciphers. ... Polygraphic ciphers. ... Permutation ciphers. ... Private-key cryptography. ... Public-key cryptography.

 There are two primary ways in which a plain text can be modified to obtain cipher text: Substitution Technique and Transposition Technique. 

1. Substitution Technique: 
Substitution technique involves the replacement of the letters by other letters and symbols. In a more straightforward way, the characters of plaintext are replaced, and other substitute characters, numbers and symbols are used at their place. 

Types of Substitution Technique: 

• Caesar Cipher – 
  In this all characters of plain text is replaced by other characters with same pattern. For example, a replaced with D, B replaced with E.
• Mono Alphabetic Cipher – 
  Major disadvantage of caesar cipher is that all elements are substituted with same technique, it make easy for cryptanalyst to crack it. In Mono Alphabetic Cipher, There is no relation between Substitution of characters. Therefore it makes harder for cryptanalyst to crack it. For example, a can be replaced with B-Z, B can be replaced with A, C-Z.
• Homophonic Substitution Cipher – 
  In this technique, one plain text alphabet can map to more than one cipher text alphabet. This is the best substitution technique with maximum security. For example, a can be replaced with D and E.
• Polygram Substitution Cipher – 
  In this rather than replacing one alphabet, block of alphabet is replaced. For example,

     Polygram substitution
HELLO -------------------> YUQQW
HELL --------------------> TEUI 

• Vigenere Cipher – 
  This technique uses multiple character keys. Each of the keys encrypts one single character. Each character is replaced by a number (A=0, B=1, …Z=25). After all keys are used, they are recycled. For encryption, Formula used : E=(M+K)mod 26

Plaintext:  ATTACKATDAWN
Key:        LEMONLEMONLE
Ciphertext: LXFOPVEFRNHR 

2. Transposition Technique: 
In transposition technique, the identity of the characters remains unchanged, but their positions are changed to create the ciphertext. 

Types of Transpositional Techniques: 

(i) Rail Fence Technique – It uses a simple algorithm:

1. Write down plain text message as sequence of diagonals.
2. Read the plain text written in step 1 as sequence of rows.

Plain text: come home
c       m        h        m
o       e        o        e
Cipher text : (READ ROW BY ROW) cmhmoeoe 

(ii) Simple Columnar Transposition Technique – It uses a simple algorithm: 

1. Write the plain text message row by row in predefined columns.
2. Read the message column by column. It can be in any order.
3. Message thus obtained is cipher text message.

Plain text: come niki (suppose we have 4 columns )
C1    C2    C3    C4
c     o     m      e
n     i     k      i 

Now we can read in any order of columns. Lets read it by 3 -> 2 -> 4 ->1

Cipher text : mkoieicn 

(iii) Vernam Cipher – It uses a simple algorithm: 

1. Treat each plain text character as a number in the increasing sequence (A=0, B=1, …Z=25).
2. Do the same for each character of the key.
3. Add each number corresponding to plain text alphabet and key.
4. If the sum produced is greater than 26, subtract 26 from it.
5. Translate each number of sum back to alphabet, it gives our ciphertext.

Plain text:  HOW ARE YOU
Key :  NCBTZQARX
 H   O   W   A   R   E   Y  O  U
 7  14  22   0  17   4   24 14 20  
+
 N   C   B   T   Z   Q   A  R  X 
 13  2   1   19  25  16  0  17 23
------------------------------------
 20   16  23  19  42  20  24 31  43

Subtract 26 if >26: 20   16  23  19  16  20  24  5  17
Cipher text :      U    Q   X   T    Q   U   Y  F   R
Cipher text : UQXTQUYFR 

Weakness of each technique, 

In the case of Substitution: 

1. Because it’s based on the substitution of one letter with another based on a translation table. Once the translation table is known, the code is broken.
2. Short words, words with repeated patterns, and common initial and final letters all give clues for guessing the pattern of the encryption.
3. An encryption algorithm must be regular for it to be algorithmic and for cryptographers to be able to remember it. Unfortunately, the regularity gives clues to the cryptanalyst to break a substitution.

In the case of Transposition: 

Just as there are characteristic letter frequencies, there are also characteristic patterns of pairs of adjacent letters, called diagrams (groups of 2 letters) and trigrams (groups of 3 letters). The frequency of appearance of letter groups can be used to match up plaintext letters that have been separated in a ciphertext. 

VIRUSES, INTRUSION DETECTION SYSTEM......................

IP SECURITY, WEB SECURITY

RSA,DIFFIE HELLMAN KEY EXCHANGE, Design of Hashing Algorithms(MD5,SHA,RIPMED......) SOON I WILL EXPLAIN WITH EXAMPLES

Public Key Encryption

 

When the two parties communicate to each other to transfer the intelligible or sensible message, referred to as plaintext, is converted into apparently random nonsense for security purpose referred to as ciphertext. 

Encryption:
The process of changing the plaintext into the ciphertext is referred to as encryption. 
The encryption process consists of an algorithm and a key. The key is a value independent of the plaintext. 
 
The security of conventional encryption depends on the major two factors: 

1. The Encryption algorithm
2. Secrecy of the key

Once the ciphertext is produced, it may be transmitted. The Encryption algorithm will produce a different output depending on the specific key being used at the time. Changing the key changes the output of the algorithm. 
Once the ciphertext is produced, it may be transmitted. Upon reception, the ciphertext can be transformed back to the original plaintext by using a decryption algorithm and the same key that was used for encryption. 

Decryption: 
The process of changing the ciphertext to the plaintext that process is known as decryption. 

Public Key Encryption :  Asymmetric is a form of Cryptosystem in which encryption and decryption are performed using different keys-Public key (known to everyone) and Private key (Secret key). This is known as Public Key Encryption.

Difference between Encryption and Public-key Encryption:

basis	Encryption	Public-Key Encryption
Required for Work:	Same algorithm with the same key is used for encryption and decryption. The sender and receiver must share the algorithm and key.	One algorithm is used for encryption and a related algorithm decryption with pair of keys, one for encryption and other for decryption. Receiver and Sender must each have one of the matched pair of keys (not identical) .
Required for Security:	Key must be kept secret. If the key is secret, it is very impossible to decipher message. Knowledge of the algorithm plus samples of ciphertext must be impractical to determine  the key.	One of the two keys must be kept secret. If one of the key is kept secret, it is very impossible to decipher message. Knowledge of the algorithm plus one of the keys plus samples of ciphertext must be impractical to determine the other key.

Characteristics of Public Encryption key: 

• Public key Encryption is important because it is infeasible to determine the decryption key given only the knowledge of the cryptographic algorithm and encryption key.
• Either of the two key (Public and Private key) can be used for encryption with other key used for decryption.
• Due to Public key cryptosystem, public keys can be freely shared, allowing users an easy and convenient method for encrypting content and verifying digital signatures, and private keys can be kept secret, ensuring only the owners of the private keys can decrypt content and create digital signatures.
• The most widely used public-key cryptosystem is RSA (Rivest–Shamir–Adleman). The difficulty of finding the prime factors of a composite number is the backbone of RSA.

Example: 
Public keys of every user are present in the Public key Register. If B wants to send a confidential message to C, then B encrypt the message using C Public key. When C receives the message from B then C can decrypt it using its own Private key. No other recipient other than C can decrypt the message because only C know C’s private key. 

 

Components of Public Key Encryption: 

• Plain Text: 
  This is the message which is readable or understandable. This message is given to the Encryption algorithm as an input.
• Cipher Text: 
  The cipher text is produced as an output of Encryption algorithm. We cannot simply understand this message.
• Encryption Algorithm: 
  The encryption algorithm is used to convert plain text into cipher text.
• Decryption Algorithm: 
  It accepts the cipher text as input and the matching key (Private Key or Public key) and produces the original plain text
• Public and Private Key: 
  One key either Private key (Secret key) or Public Key (known to everyone) is used for encryption and other is used for decryption

Weakness of the Public Key Encryption: 

• Public key Encryption is vulnerable to Brute-force attack.
• This algorithm also fails when the user lost his private key, then the Public key Encryption becomes the most vulnerable algorithm.
• Public Key Encryption also is weak towards man in the middle attack. In this attack a third party can disrupt the public key communication and then modify the public keys.
• If user private key used for certificate creation higher in the PKI(Public Key Infrastructure) server hierarchy is compromised, or accidentally disclosed, then a “man-in-the-middle attack” is also possible, making any subordinate certificate wholly insecure. This is also the weakness of Public key Encryption.

Applications of the Public Key Encryption: 

• Encryption/Decryption:  
  Confidentiality can be achieved using Public Key Encryption. In this the Plain text is encrypted using receiver public key. This will ensures that no one other than receiver private key can decrypt the cipher text.
• Digital signature:  
  Digital signature is for senders authentication purpose. In this sender encrypt the plain text using his own private key. This step will make sure the authentication of the sender because receiver can decrypt the cipher text using senders pubic key only.
• Key exchange: 
  This algorithm can use in both Key-management and securely transmission of data.

PGP – Authentication and Confidentiality, (E-MAIL SECURITY), KERBEROS(user to server , server to user authentication)

 In 2013, when the NSA (United States National Security Agency) scandal was leaked to the public, people started to opt for the services which can provide them a strong privacy for their data. Among the services people opted for, most particularly for Emails, were different plug-ins and extensions for their browsers. Interestingly, among the various plug-ins and extensions that people started to use, there were two main programs that were solely responsible for the complete email security that the people needed. One was S/MIME which we will see later and the other was PGP. 

As said, PGP (Pretty Good Privacy), is a popular program that is used to provide confidentiality and authentication services for electronic mail and file storage. It was designed by Phil Zimmermann way back in 1991. He designed it in such a way, that the best cryptographic algorithms such as RSA, Diffie-Hellman key exchange, DSS are used for the public-key encryption (or) asymmetric encryption; CAST-128, 3DES, IDEA are used for symmetric encryption and SHA-1 is used for hashing purposes. PGP software is an open source one and is not dependent on either the OS (Operating System) or the processor. The application is based on a few commands which are very easy to use. 

The following are the services offered by PGP: 
 

1. Authentication
2. Confidentiality
3. Compression
4. Email Compatibility
5. Segmentation 

In this article, we will see about Authentication and Confidentiality. 

1. Authentication: 
Authentication basically means something that is used to validate something as true or real. To login into some sites sometimes we give our account name and password, that is an authentication verification procedure. 

In the email world, checking the authenticity of an email is nothing but to check whether it actually came from the person it says. In emails, authentication has to be checked as there are some people who spoof the emails or some spams and sometimes it can cause a lot of inconvenience. The Authentication service in PGP is provided as follows: 

 

As shown in the above figure, the Hash Function (H) calculates the Hash Value of the message. For the hashing purpose, SHA-1 is used and it produces a 160 bit output hash value. Then, using the sender’s private key (KPa), it is encrypted and it’s called as Digital Signature. The Message is then appended to the signature. All the process happened till now, is sometimes described as signing the message . Then the message is compressed to reduce the transmission overhead and is sent over to the receiver. 

At the receiver’s end, the data is decompressed and the message, signature are obtained. The signature is then decrypted using the sender’s public key(PUa) and the hash value is obtained. The message is again passed to hash function and it’s hash value is calculated and obtained. 

Both the values, one from signature and another from the recent output of hash function are compared and if both are same, it means that the email is actually sent from a known one and is legit, else it means that it’s not a legit one. 

2. Confidentiality: 
Sometimes we see some packages labelled as ‘Confidential’, which means that those packages are not meant for all the people and only selected persons can see them. The same applies to the email confidentiality as well. Here, in the email service, only the sender and the receiver should be able to read the message, that means the contents have to be kept secret from every other person, except for those two. 

PGP provides that Confidentiality service in the following manner: 

The message is first compressed and a 128 bit session key (Ks), generated by the PGP, is used to encrypt the message through symmetric encryption. Then, the session key (Ks) itself gets encrypted through public key encryption (EP) using receiver’s public key(KUb) . Both the encrypted entities are now concatenated and sent to the receiver. 

As you can see, the original message was compressed and then encrypted initially and hence even if any one could get hold of the traffic, he cannot read the contents as they are not in readable form and they can only read them if they had the session key (Ks). Even though session key is transmitted to the receiver and hence, is in the traffic, it is in encrypted form and only the receiver’s private key (KPb)can be used to decrypt that and thus our message would be completely safe. 

At the receiver’s end, the encrypted session key is decrypted using receiver’s private key (KPb) and the message is decrypted with the obtained session key. Then, the message is decompressed to obtain the original message (M). 

RSA algorithm is used for the public-key encryption and for the symmetric key encryption, CAST-128(or IDEA or 3DES) is used. 

Practically, both the Authentication and Confidentiality services are provided in parallel as follows : 

 

Note: 
M – Message 
H – Hash Function 
Ks – A random Session Key created for Symmetric Encryption purpose 
DP – Public-Key Decryption Algorithm 
EP – Public-Key Encryption Algorithm 
DC – Asymmetric Encryption Algorithm 
EC – Symmetric Encryption Algorithm 
KPb – A private key of user B used in Public-key encryption process 
KPa – A private key of user A used in Public-key encryption process 
PUa – A public key of user A used in Public-key encryption process 
PUb – A public key of user B used in Public-key encryption process 
|| – Concatenation 
Z – Compression Function 
Z-1 – Decompression Function

Kerberos

Kerberos provides a centralized authentication server whose function is to authenticate users to servers and servers to users. In Kerberos Authentication server and database is used for client authentication. Kerberos runs as a third-party trusted server known as the Key Distribution Center (KDC). Each user and service on the network is a principal. 

The main components of Kerberos are: 
 

• Authentication Server (AS): 
  The Authentication Server performs the initial authentication and ticket for Ticket Granting Service. 
   
• Database: 
  The Authentication Server verifies the access rights of users in the database. 
   
• Ticket Granting Server (TGS): 
  The Ticket Granting Server issues the ticket for the Server 
   

Kerberos Overview: 

• Step-1: 
  User login and request services on the host. Thus user requests for ticket-granting service. 
   
• Step-2: 
  Authentication Server verifies user’s access right using database and then gives ticket-granting-ticket and session key. Results are encrypted using the Password of the user. 
   
• Step-3: 
  The decryption of the message is done using the password then send the ticket to Ticket Granting Server. The Ticket contains authenticators like user names and network addresses. 
   
• Step-4: 
  Ticket Granting Server decrypts the ticket sent by User and authenticator verifies the request then creates the ticket for requesting services from the Server. 
   
• Step-5: 
  The user sends the Ticket and Authenticator to the Server. 
   
• Step-6: 
  The server verifies the Ticket and authenticators then generate access to the service. After this User can access the services. 

Kerberos Limitations

• Each network service must be modified individually  for use with Kerberos
• It doesn’t work well in a timeshare environment
• Secured Kerberos Server
• Requires an always-on Kerberos server
• Stores all passwords are encrypted with a single key
• Assumes workstations are secure
• May result in cascading loss of trust.
• Scalability

Is Kerberos Infallible?

No security measure is 100% impregnable, and Kerberos is no exception. Because it’s been around for so long, hackers have had the ability over the years to find ways around it, typically through forging tickets, repeated attempts at password guessing (brute force/credential stuffing), and the use of malware, to downgrade the encryption.  

Despite this, Kerberos remains the best access security protocol available today. The protocol is flexible enough to employ stronger encryption algorithms to combat new threats, and if users employ good password-choice guidelines, you shouldn’t have a problem!

What is Kerberos Used For?

Although Kerberos can be found everywhere in the digital world, it is commonly used in secure systems that rely on robust authentication and auditing capabilities. Kerberos is used for Posix, Active Directory, NFS, and Samba authentication. It is also an alternative authentication system to SSH, POP, and SMTP.