ARP RFC 826 Used by one host to find the MAC of another on the same LAN • Host looking for another host or default gateway • Router looking for a host on the subnets it’s connected to
IP (Internet Protocol)
Address Resolution Protocol •
Very straightforward: • “Who has 192.168.0.2?” • “Tell 192.168.0.3” !
•
We can have a security problem here: • ARP cache poisoning
IP (Internet Protocol)
ARP Cache Poisoning • •
•
“Fool” a host into sending data to the wrong MAC ARP sends a broadcast • Goes to everything on the subnet ARP accepts the first response it gets without any kind of authentication • An attacker can “race” all of the other hosts with a false ARP response
IP (Internet Protocol)
ARP Cache Poisoning • • • •
An OS might be set to accept “gratuitous” ARPs An attacker can try to just send an ARP response to a target and see if it just accepts it Once the cache is poisoned, an attacker can impersonate another system on the subnet What can “give away” an attacker?
IP (Internet Protocol)
Domain Name System • • •
DNS Allows us to use easy to remember names for IP addresses Which would you rather use? • cs.wmich.edu • 141.218.143.20
IP (Internet Protocol)
Domain Name System •
Two ways to resolve IPs • Host tables • Static • ex: “cat /etc/hosts” (Linux, Mac) •
•
Windows: %systemroot%\system32\drivers\etc\hosts
Used to be the only way this was done
IP (Internet Protocol)
Historical Note. . . •
InterNIC • Organization that was the central store of Internet naming information (for decades) • Kept a master host file of all computers on the Internet • Admins would download the file periodically to keep current • Single point of failure for all naming (not good) IP (Internet Protocol)
Domain Name System • •
Distributed, hierarchical database Root-‐level servers for top domains • .com, .net, .org, .edu, etc. !
•
Can also have country codes • .us, .ca, .au, .jp, etc.
IP (Internet Protocol)
Domain Name System
IP (Internet Protocol)
Domain Name System •
You can do a lookup both ways • gethostbyname • Map FQDN to IP address • gethostbyaddr • Map IP address to FQDN • You can play with this with tools like “nslookup” (round-‐robin demo)
IP (Internet Protocol)
DNS Cache Poisoning • • •
Hosts “remember” DNS responses (cache) If an attacker can “poison” that cache, traffic can go to the wrong place DNS servers have their own cache !
•
How can an attacker profit from this?
IP (Internet Protocol)
DNS Security • • • • •
Keep software up to date Randomize Query IDs Limit recursive lookups Split DNS (private, DMZ) Limit zone transfers
IP (Internet Protocol)
IPv6 • • •
Next generation IP addressing Needed because we are running out of IPv4 addresses (primarily) Expressed as 8 groups of 4 hexadecimal digits •
•
2001:0db8:85a3:0042:1000:8a2e:0370:7334
Several benefits can be gained . . .
IP (Internet Protocol)
IPv6 •
•
IPv4 addresses are 32 bits long • Allows for about 4.29 billion addresses IPv6 addresses are 128 bits long • Allows 3.8 x 1038 addresses • That’s 380 undecillion (or 48 octillion addresses for each of the 7 billion people on earth)
IP (Internet Protocol)
IPv6 •
There are several other differences (these are a few): • Simplified packet header • Simplified routing • Allows jumbograms (more on this later) • Options extensibility (next slide) • Better mobility
IP (Internet Protocol)
Options Extensibility • •
•
The packet header has a fixed length (40 octets) Extra options can be defined after the header • Limits size to the size of the entire packet Makes IPv6 extensible without re-‐design of the basic protocol
IP (Internet Protocol)
Jumbograms • •
IPv4 limits the size of a datagram to 216 -‐ 1 octets IPv6 jumbograms can be as large as 232 -‐ 1 octets • Could work better over links that allow higher Maximum Transmission Units
IP (Internet Protocol)
Mobility •
•
Mobile IPv6 avoids some problems with mobile IPv4 • The specifics on this are beyond the scope of this class, but you could look at “Triangular Routing” if you’re curious Mobile IPv6 is just as efficient as native IPv6
IP (Internet Protocol)
Transition • •
•
IPv6 and IPv4 don’t directly “talk” to each other Transitioning requires a way for what is essentially two independent networks (IPv4 and IPv6) to exchange traffic This involves implementing translation gateways (Network Address Translation) or tunneling protocols
