SEC 572 Week 1 iLab Network Attacks 0

iPremier, a Seattle based company, was founded in 1996 by two students from Swathmore College. iPremier had become one of a few success web-based commerce, selling luxury, rare, and vintage goods over the Internet. Most of iPremier’s goods sell between fifty and a few hundred dollars, and the customer buys the products online with his or her credit card. iPremier’s competitive advantage is their flexible return policies which allows the customer to thoroughly check out the product and make a decision to keep the product or return it. The majority of iPremier customers are high end, and credit limits are not a problem.

Vulnerability 2: Broken Authentication and Session Management: User authentication credentials, session Id’s are not protected when stored by using hashing or encryption techniques.

The attack is carried out on a closed environment using a local web server to host the

4.1 OPENSSL: OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get and use it for commercial and non-commercial purposes subject to some simple license conditions.

In 15 October, 2014 this attack was identified by Google security team under the vulnerability CVE-2014-3566 in SSLv3 protocol. In this POODLE attack the bug has been found that exploited the intercept data that is supposed to be encrypted between system and the server. According to the researchers who found the bud, an attacker/Hacker interferes between the computer and the server with the handshake process. This handshake process is used to verify which cryptography protocol the server can accept using a “protocol downgrade dance”. By doing this the computers are forced to use the older SSL 3.0 protocol to protect data that is being sent. Hackers can then easily exploit the bug by carrying out a man-in-the-middle (MITM) attack to decrypt secure HTTP cookies, which could let them steal information or take control of the victim’s online accounts. The information to test websites weather they are affected with POODLE was given by the

For the actual attack that took place there are changes that need to be performed on both the client's side as well as the server's side. These changes involve limiting the quantities of request either side can make. For the client's I would recommend a firewall placed between them and the server which would be configured to limit the amount of requests to be made to any outside source and either notify and administrator or outright blocking additional requests beyond the threshold.

Heartbleed is a security bug named after the Heartbeat request that is used for communication between computers. This bug was present in OpenSSL that is used in implementation of Transport Layer Security (TLS). It was first noticed in 2012 and was confirmed in 2014. This was registered under Common Vulnerability Exposure (CVE) databases as CVE-2014-0160. This was also known as “buffer over read vulnerability”, condition in which more data is being exposed than required. Heartbleed patch was released on April 7, 2014 and on that day only Heartbleed was disclosed publicly.

The purpose of the Change Cipher Spec record is to show that the subsequent SSL records sent by the client will be encrypted. The record is 6 bytes long.

TECHNICAL IMPACTS: SEVERE. The severity of this attack is based on the authentication solution unable to detect the user performing an action request. Log audit won’t be available to authentication solution and solution won’t be able to prevent future attacks.

By request, the developer amended the SSL Certificate request to address the medium vulnerabilities on 6 WDS servers.

On Sunday 11/22/15 at 0739 hrs, Resident Miguel Herrera informed Security Monitor Rasheen Davis that he found resident SHAFER unresponsive and not breathing in room 3-2B (417) of the Adappt Group Home.

The early version of the worm functioned as a man-in-the-middle attack. It sat between the engineering software and the Siemens controllers for the input and output valves feeding into each centrifuge. The worm would accept commands from the engineering software and give false responses to indicate that these commands were being processed by the controllers. In reality, the worm was regularly allowing the centrifuges to be over-pressurized, which had the effect of causing the centrifuges to wear out and break more quickly. The later version of the software was much more crude. It would take over the centrifuges and refuse to acknowledge signals from the engineering software while an attack was active. The attack operated about once a month and worked by slowing down the centrifuges and then spinning them back up to past their normal full speed. This would cause damage as the centrifuges passed through what was known as a resonance speed, which would destabilize the rotor. Stuxnet managed to increase the rotor speeds at Iran’s Natanz nuclear facility from a normal speed of 63,000 rpm to 84,600 rpm. The worms were carefully designed so that it would not be obvious to someone in the facility that their mechanical systems were being sabotaged. For example, the worm would randomly affect different centrifuges at

Dougherty, C., Householder, A., & Houle, K. (2002). Computer attack trends challenge Internet security. Computer, 35(4), 0005-7.

Interconnection Security Agreements (ISA) are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices. The AMCOM Interconnection Security Agreement Standard Operating Procedures (ISA SOP) defines the procedures to be used when developing ISAs. While AMCOM’s ISA Template, Section 2: System Security Considerations provides examples of security concerns to be negotiated during the ISA process, every interconnection is different and additional attributes may be discovered and will be documented during the ISA

Users of systems with the OpenSSL command line utility can view certificate properties using "openssl x509 -text" or a similar utility. Certificates listed as md5RSA or similar are affected. Such certificates that include strange or suspicious fields or other anomalies may be fraudulent since there are no reliable signs of tampering it must be noted that this workaround is error-prone and impractical for most users.