Home / Summaries / Computer Networking: A Top-down Approach / alice-bob-packets

Security threats

6 important questions on Security threats

What is the difference between a virus, a worm and a trojan horse?

a) Virus: requires some form of human interaction to spread. Classic example: E-mail viruses.
b) Worms: No user replication needed. Worm in infected host scans IP addresses and port numbers, looking for vulnerable processes to infect.
c) Trojan horse: Hidden, devious part of some otherwise useful software.

Suppose Alice and Bob are sending packets to each other over a computer network. Suppose Trudy positions herself in the network so that she can capture all the packets sent by Alice and send whatever she wants to Bob; she can also capture all the packets sent by Bob and send whatever she wants to Alice. List some of the malicious things Trudy can do from this position.

Trudy can pretend to be Bob to Alice (and vice-versa) and partially or completely modify the message(s) being sent from Bob to Alice. For example, she can easily change the phrase “Alice, I owe you $1000” to “Alice, I owe you $10,000”. Furthermore, Trudy can even drop the packets that are being sent by Bob to Alice (and vice-versa), even if the packets from Bob to Alice are encrypted.

Internet entities (routers, switches, DNS servers, Web servers, user end systems, and so on) often need to communicate securely. Give three specific example pairs of Internet entities that may want secure communication.

1. User’s laptop and a web server 2. Two routers
3. Two DNS name servers.

What is the purpose of a nonce in an end-point authentication protocol

A nonce is used to ensure that the person being authenticated is “live.” Nonces thus are used to combat playback attacks.

What does it mean to say that a nonce is a once-in-a-lifetime value? In whose lifetime?

Once in a lifetimes means that the entity sending the nonce will never again use that value to check whether another entity is “live”.

Is the message integrity scheme based on HMAC susceptible to playback attacks? If so, how can a nonce be incorporated into the scheme to remove this susceptibility?

In a man-in-the-middle attack, the attacker puts himself between Alice and Bob, altering the data sent between them. If Bob and Alice share a secret authentication key, then any alterations will be detected.