It is an indisputable fact that security is of great importance in computer networks. In this article, you can find the attacks you may encounter in computer systems and the ways to protect against them. A more content-rich version of the report as a Word file and the PowerPoint presentation have been added at the end of the article.

 

 

 

 

Security in Computer Networks

A.Veysel TOPLU

 

Table of Contents

1) Why security?

2) Effects

3) Attack methods

3.1) DDoS

3.2) What Is ARP (Address Resolution Protocol)?

3.3) Sniffing

3.4)Trojan & Keylogger

3.5) Injection

3.6) Phishing

3.7) Viruses

4) Causes

5) General Precautions

6) Wi-Fi Network Precautions

7) Applications for Network Security

7.1) IBM Qradar

7.2) ForeScout NAC (Network Access Control)

8) References

 

1) Why Security?

If we consider that there are wireless network systems in every environment we are in now, that we all have smartphones in our hands, and that there is a computer in almost every home, you can see that we are inside a very large network system at every moment of our lives. Today, as technology has become widespread and access to information has become much easier, the malicious use of this information has increased. For the following reasons, it has become both attractive and easier for malicious people with a little computer knowledge to carry out attacks that affect many users in a short time. With the spread of computer networks, we are all included in a network system at every moment. With the spread of e-commerce, we shop with our credit cards using these network systems. As much information is now stored digitally, very serious data can be accessed through a vulnerability in the system. With the transition from wired environments to wireless environments, we have moved from physical networks, which are somewhat more secure, to networks that can now be accessed anywhere via radio signals. In a Wi-Fi network you are currently on, perhaps a hacker may be watching you. With many applications moving to the Cloud (Luca, Google Drive), a lot of data has begun to be kept in a shared area on the internet, and you have to trust the security policies of the company you receive service from. With everyone’s easy access to harmful information, you can reach detailed information about a newly emerged security vulnerability, and you can even download applications that make it easier to exploit this vulnerability. Software that can harm people, such as viruses, keyloggers, Trojans, sniffing, and injection programs, has been made very easy and accessible. Because of this and many other technological conveniences too numerous to list here, we are now under more threat than ever. Let’s share a few headlines to show the scale of this threat.

2) Effects

If an attack has been carried out on your system, you may be affected in many ways depending on the attacker’s goal. Some of these effects are;

· High-cost network outage.

If you interrupt the network of a bank or a manufacturing company even temporarily, it can cause very high financial damage for that company.

· Information / identity theft.

Recently, with the hacking of Apple’s cloud area, the photos and contact information of many famous names appeared on the internet, which is one of the quite dangerous situations.

· Service disruption.

Service-disrupting attacks are carried out especially against technology companies, and the aim is for their customers to be affected collectively. In this way, many users can be harmed with one stone. For example, a successful attack on one server of a hosting company can cause approximately 100-500 websites to become unable to provide service.

· Loss of money and reputationSome cyberattacks are carried out not so much for financial gain as to make victims lose reputation, and also as a kind of show of power. In this way, the attacker or groups gain reputation while the victim loses reputation.

3) Attack Methods

3.1) DDoS

This type of attack is still one of the most common and effective methods, and it consists of four stages. First, the hacker installs a master program on a server on the internet; this program will later be used to send commands to devices known as zombies. The hacker then infects the computers of innocent end users on the internet with the application they wrote, using various methods. These users will become accomplices to the crime without knowing anything. This software may have infected thousands of computers. After that, the hacker sends the command that will carry out the attack to the server. The server then commands these zombie devices, and thousands of computers suddenly make requests to the victim that require high bandwidth, and the victim can no longer respond, resulting in a service outage. Because of this attack, the global giant Twitter suffered a service outage.

Main ways to protect against DDoS

· With protection at the Router level, since all packets sent by the attacker will first be forwarded to the router and logged, you can use filters to analyze them and block these packets.

· With protection at the Firewall level, you can again use various filters and log monitoring to eliminate many attacks; in addition, by adjusting client packet sizes, which is one of the firewall features, you can block packets large enough to render the system unable to provide service.

· With protection at the Intrusion Prevention System (IPS) level, physical devices developed for this purpose can analyze your system in real time and detect and prevent behavior that matches previously defined attack patterns.

3.2) What Is ARP (Address Resolution Protocol)?

It matches IP addresses with the physical machine address (MAC address), and all MAC addresses and the IP addresses matched to them are stored in the ARP Cache table. Every device keeps its own ARP Cache table. When a new device connects to the network, the other devices add the new device’s MAC-IP information to the ARP table.

3.3) Sniffing:

There are two types of sniffing methods: Active Sniffing and Passive Sniffing. In Passive Sniffing, packets traveling in the network environment are monitored and collected with the help of various applications without any intervention. If our security is not sufficient, these collected packets may contain a lot of our private information. In Active Sniffing, however, the situation is normally a bit more complicated. Switches are protected against this type of sniffing method. Against this, the switch is overloaded with excessive traffic, causing it to broadcast packets everywhere; this process is called ARP Poison, and in this way the packets are collected. This situation is more likely to be detected.

Main ways to protect against Sniffing

• Preventing physical access to network ports helps prevent a sniffer from being installed on your system without your knowledge.

• By using static IP addresses, ARP poison attacks will be prevented from assigning idle IP addresses to attackers.

• By using tools that check whether there is a sniffer on the network, you can detect attacks against your system.

• Using features that provide port security on network switches

• By creating subnets with subnetting, you restrict the area that can be sniffed. This will also reduce the impact.

• By encrypting traffic, you can make sniffed data unreadable.

3.4) Keylogger-Trojan

As the name suggests, keyloggers record every key you press on the keyboard and create a serious security vulnerability. A Trojan, on the other hand, is an even more dangerous piece of software. On a computer with a Trojan installed, the hacker takes full control and rules it as if it were their own computer. In the screenshot below, it will be clearer what a Trojan can do. Trojans run as two different applications: one server and one client. The hacker prepares the client application for themselves; this application communicates with the server application and can make the victim do whatever the hacker wants.

Protection from Keylogger-Trojan

• First of all, do not open any email you think is unsafe, and do not run the application.• Using antivirus software

3.5) Injection

The injection method is perhaps one of the simplest but most effective hacking methods. It is basically used to access and tamper with the database by exploiting vulnerabilities in code written on the server side. Even though it may sound simple when described, if I tell you that MySQL.com was hacked with this method, I will have better conveyed how serious the situation is. When server-side websites are built, there is generally a script like ekle.php that processes code and a form page like UserForm.html that sends data to this script. This may vary, but I wanted to put it this way for clarity. If the webmaster does not implement controls for injection in ekle.php, SQL codes can be written into the fields in UserForm.html and the admin password in the database can be obtained as in the example below.

https://youtu.be/FQJ5jiU0N-Y

This process takes only four minutes.

Protection against injection attacks

• You should design your script code so that the values you receive from forms cannot execute SQL commands, so that an attacker cannot send you an executable SQL command from the form page.

• The fields you create in your database should not be generic, so that when an attacker tries to perform SQL injection, they cannot send queries such as username, pass.

3.6) Phishing

This is also one of the simple but effective attack methods that sits on the dark side of the internet. In fact, we can call it hunting rather than an attack, because as its name suggests, Phishing is a method of luring. You design an exact copy of a website the victim uses regularly (facebook.com), upload it to a different but similar domain (facebook.tk), and then send this link to the victim and wait for them to log in. Even though the domain is different, HTML code can make it look like the original. If the victim does not notice the difference, getting their username and password will not be difficult at all.

Protection against phishing attacks

• Do not visit any address you think is unsafe

• Check whether the address you click and the address you land on are the same

3.7) Virus:

Viruses are pieces of code written by hackers and designed to make a computer stop working. The most recent of these, CryptoLocker, has brought a new dimension to the concept of viruses. After this virus enters the computer, it encrypts all your files at a high level, making them impossible to open, and then redirects you to a page asking you to make a payment. Of course, to get you to run this virus, it sends you an email similar to the phishing method and waits for you to run this application.

4) Reasons

The main reason so many attacks succeed is end users who are unaware of the danger and untrained IT staff.

• Technical staff with insufficient training.

Companies employ untrained staff due to budget constraints, and this creates major security vulnerabilities.

• Untrained, careless users.

No matter what precautions we take, users who store their credit card passwords on their computers need to be made aware of the dangers.

• Limited IT budget.

Companies not giving enough importance to their IT budgets and a lack of investment can create security vulnerabilities.

• Insufficient physical protection.

• Wrong technical hardware choices.

• Social engineering.

Attacks do not always come from cyberspace; a hacker can dig through your trash and obtain very serious information about you.

• Systems that have not been updated.

Systems that do not receive regular and necessary updates are the structures most vulnerable to being hacked.

• Weak encryption techniques.

No matter how many precautions we take, while we are so intertwined with technology, we must know that we can never be completely safe and act accordingly.

5) General Precautions

• Authorization only as needed.

Every user who logs into our system should have limited permissions determined according to need.

• Physical reporting, firewall systems.

Systems with firewalls installed can detect and block many attacks before they happen.

• Continuous training of IT staff and end users.

Trained staff will achieve great success in preventing and blocking attacks.

• Continuous system updates.

Systems patched against vulnerabilities will always be more secure.

• Periodic password changes.

It will be especially effective against password cracking by trial and error, sniffing, and keylogger attacks.

• Fewer cloud applications.

The more systems are exposed to the outside, the harder they will be to defend.

• Continuous scanning/reporting of Network, Server, and Client.By doing regular reporting and monitoring, we can detect possible attacks that may occur in our system in advance.

6) Wi-Fi Network Measures

• Passwords for devices such as modems, routers, etc. should be complex and changed at regular intervals.

• It is recommended to hide the SSID of the wireless modem and Access Point.

This way, not everyone will know the device you are broadcasting from. You won’t be vulnerable to attack.

• It is recommended to segment networks using subnetting.

This will be useful for protection against sniffing attacks.

• Details such as IP range and access time range should be configured.

• Unnecessary protocol permissions in the wireless network should be removed (http, ftp, telnet, etc.).

• Extra authentication protocols can be used. (e.g., Maltepe).

• WPA(48bit) should be used as the highest encryption in wireless networks.

7) Applications for Network Security

7.1) IBM Qradar

IBM Qradar and ForeScout NAC are examples of products that physically audit the system. Qradar scans the system regularly and reports possible attacks. NAC, on the other hand, is used to detect unauthorized access to the network and block devices. The screenshots of the products and the descriptions taken from the manufacturers’ websites are below.

IBM QRadar Security Intelligence Platform products provide the following:

• A single architecture for log, flow, vulnerability, user, and asset data analysis.

• Near real-time anomaly detection in relationships and behaviors to identify high-risk threats.

• Identifying high-priority events among billions of data points.

• Complete visibility into network, application, and user activity.

…

..

7.2) ForeScout NAC (Network Access Control)

It is a technology aimed at combining end-user security technologies, user or system authentication and the implementation of network security policies. NAC is a technology that authorizes the data each user in the system can access, organizes and restricts users within the framework of their roles, performs network security auditing, and ensures user system security.

All assets within the corporate network can be identified; systems that do not comply with corporate policies or are misconfigured are detected, prevented from being included in the corporate network, or, if any exist, removed from the corporate network.

8) References

 

bilgiguvenlik.net

cozumpark.com

TechNet.com

Wikipedia.org

Chip.com

Sabah.com.tr

Hurriyet.com.tr

Fatih.edu.tr

Bianet.org

İtu.edu.tr

Dijitalturk.com

Ulakbim.gov.tr

If you are going to use it in different publications, please cite the source.

---