Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1188 Thanks!
Now we have
the next talk introduction to network
security by no master.
No master is part of the
staff here.
And he also is active
member of the fray from Community.
And he likes to take a proactive
approach to things.
And so I think we all have a very
practical introduction
to network security now.
Beckham, no master.
Well, thank you.
This is my very first talk at the
Congress, I'm so excited, I'm
I hope I'm not to
solving myself somewhere in the middle.
Also, I'm glad you're all
here.
I've been asked to give some introduction
that is probably more for the beginners,
so I hope that you can enjoy
what I'm speaking about.
That's neither the problem
that you don't get what I'm talking about
or that you all heard of that before.
So let's see where we can take this
here.
So my idea was like, I'm
practical. As you said, how can I
get you some idea about
what the actual issue about network
security is?
We get it, not we get question
a lot about if this network really
secured to connect to.
And the usual answer is
the network is in itself
not secure.
It's your system, your laptop
that should be secure.
But what is actually
a realistic thing that can happen here?
So that's the what I'm wanting to show
you. I have brought to you three
examples for that.
I hope that gives us some insight.
So but first, before we start,
because we need some mindset
for that, the networks stack we have,
here's a totally oversimplified
version of that relies
on different layers as if it hurts.
So every computer has some
media access control.
Address the Mac address.
It's not about Apple computers.
We have the Internet Protocol address,
which is additional to that.
And on top of this, we have
the application that uses some TCP
or UDP socket and the protocol defined
for that. You know, that's
OK. So what really matters to
us is the two layers here,
because this is the network that you're
using, this is the protocols that
are involved with it.
The other stuff is on the systems,
the client on the server.
And this is where the
data goes.
Of course, what we want to
accomplish here is that no one
can look into the application
other than the client and the server.
So your privacy is compromised
when third parties have access to that.
You probably see the SCA in the end.
We would talk about that later.
So first, that we know what
we're talking about.
The easy example to your IP address
have seen that IP before, which
is typically your home routers address
maybe and IPV six.
I have brought you a very simple example
of that, which is just a longer
version, usually written on hexadecimal.
So that's the IP address.
And then we have to make dress.
This is a very unique address
that every computer has on the network.
So this is usually
burns in on your device.
You just started up.
It has the Mac address and uses that
make address to communicate on the
network. So, for example, to get an
IP address and this is where
the bad things can happen then.
So my first example is
our spoofing who
has heard of IP spoofing?
So no one can explain them,
but I guess the rows in the back
didn't raise their hand, so I get to
that and
I usually like using whiteboards.
I don't have one here, so I used my
computer last night to to make some
whiteboard notes.
I hope you can read that my my
handwriting is really bad.
So what we use here for
the resolution of our
addresses of Mac
addresses two IP addresses is the our
protocol.
As you know, as I told you, the Mac
addresses burned in on your device and
the IP address, which uses the
computer uses to communicate on the
internet, is then assigned to
the computer.
We need this address to
be able to know Typekit through to your
computer. It needs to travel probably
all over the world and reach
its destination.
So this is why we have totally two
different address spaces,
one which just gives your computer
a unique address which is always used
and the which is the Mac address and
the other one, the IP address
to which is always
individual for the location.
Your own
smart people know that the IPv4
address I showed you is not really
unique, but we are simplifying
things here. OK.
So on
the other Nokia network, your router
has to give the
network packets to your clients,
to your computer and to be
able to do that.
It's each one
of these needs to know the address
of the computer that has the
IP address for which the
packet intestines.
In this case, here are the client asks
for the IP address of the root
of the router.
It sends the broadcast frame to the
network, which is an up
frame, and asks for
who has the IP address
and the road to answers the IP address.
It's my Mac address.
So what happens here if you look closely?
Is this the router sends the pickets?
It says this IP
address is it's this Mac
address.
They're getting that you.
So what happens if someone tries
to to steal your traffic?
They can
sense a reply,
saying someone asks for
the mega address of the router and
the mega address is their address.
And what they do is they send a false
mega address, which is their address and
not really the routers through into
the network so that your client
learns the address and says, OK,
well, then the router has to address this
and that and sends its packets
through to you.
So the attacker, you're looking at this
from a tax perspective.
Yeah.
So then the problem is
for the clients you don't see
on the client anything happening
other than the user
data flow is commencing.
The clients sends the traffic through
to the attacker, which just for once
that gets through to the router
and back.
So it's able, then, if it
has compromised, they also the address
of the client to observe any
traffic that happens on the network
transparently by just piping
it through. Yeah, and looking at it.
And I wrote, I guess observing,
of course, if you get hold of the packet,
you can also modify that.
So this is one very
old-school type of network.
Take him
and you getting on the impression
how that works.
Hopefully, you can then get also
an idea how to prevent that.
What we have on our networks nowadays
is switches that have security
features, but you must be aware
that on the usual network, this is not
always the case.
So every network you encounter
is probably vulnerable to that kind
of attack.
So the next thing would
be then the DNS hijacking,
this attack is
on a site on a somewhat different layer
of the protocol.
It uses the DNS system.
The DNS system is, of course,
for the resolution of a hostname
to an IP address.
So we have another layer here.
It's not the IP address, the mega
address, but the hostname to the IP
address that enables us to
do a similar attack, but not
only on our local network
but also on
every horse on the internet.
What we then do is we try
to get hold of the IP address of
the DNS server.
Usually the clandestine server
for its address
of the of the of the real server
it tries to connect to in this case,
and a record which is for IPv4 addresses
and the DNS server returns the IP
address of the server in question.
Then the client connects to the server
and gets the answer back.
Obviously, if we can get hold
somehow of the DNS
service address we can do, then
the same thing as before we can return
nodes or make address because we are not
on the same network. We can return our IP
address, which the clients connects to
its can be of any hosts on the internet.
Yeah. And then
the client since we returned
the IP address of ourselves instead,
and the client sends the traffic to
through us and we then again
transparently forward that traffic
through to the server and we see
every request happening there.
In that case, we don't observe
the traffic coming back from the server
to the client.
We should also attack the server for
that, but
always keep in mind that the payload
of the traffic is not very
interesting for an attacker.
Maybe they just want to know which
address you're really requesting.
So very much of the privacy
issues come for the metadata of
the packets, not
the with the metadata, and that kids see,
it's the additional data.
So which hostname are we requesting
him?
You can imagine some host names are worse
than others to to disclose.
Yeah.
So, yeah, that would
be two examples on the.
Networks, what we also have at the
Congress, what we get questions about is
how about the access points?
That is the more complicated thing
here.
Of course we have when
we connect to a computers to us, which
we see that we just took a
cable and just plug it into a switch
so the computer is connected to that
switch.
Very similar to the way our system works,
the engineers designs
wireless traffic, the the
Wi-Fi system to work.
It's a wireless ethernet.
So it's it's it works
as if I would plug in my computer
into a switch, but other wires,
it's connected to the access point.
So what
I have on my computer system
that chooses the access point
to connect to and does that
automatically.
So it works just like
if I had an assistant, that's
when you move. My computer takes
the cable from one smit's and plugs
into it another so
that I don't have to care about that.
It just makes sure that the connection
stays up.
When we think about this like that,
we can see that there are
issues.
What do we do?
What we need to know first is that the
network is identified by an
idea.
This just means that I know
which group of switches I
want to connect to on this
conference is the 35th C3
network and your home.
You have probably chosen your own cool
network name for that.
But you may not have thought about
that. See, at your home, you have
one access point.
Otherwise, we have here hundreds
of them and your computer changes
the connection to the access point all
the time.
So what would we have
to do to prevent that?
Your neighbors are connecting to your
network. We have this encryption
protocol.
In the past, that's been W
EP, which is just broken
and obsolete.
So we now have the WPA
protocol, and
for that we use appreciate key the
Wi-Fi passwords here.
So the usual thing you go to, it's
through your neighbor, to your friends,
to a cafe, and
you ask for them, what is the Wi-Fi
password? You just use that.
One issue here is that it's
only for preventing other
parties from using
your network.
Everyone who has hold of the preset,
he is able to connect
not only to your network, but potentially
able to decrypt all the traffic
that is running through it.
Then another problem is
that I can say
I place another access points,
which has the same society
as the currently existing
network, but it's not an official
access point.
But my own.
What then happens at this is the clients
just connect to that access
point, for example, because it's just
it's it's the reception of the
signals just stronger.
You can move it towards your
your
computer and then
send out just the same beacon
with the same SSD as the
attack network to the kind the client
connects to the access points
and sends the traffic through to
it.
And of course, the way back,
you could do that on the network here,
which strongly asks you not to do
that.
Just one reason is we don't
want too many access points running
around here with too many channels they
use. The other thing is, of course,
students shouldn't attack
other people computers and just
explaining here how that works
so that you get an idea how to prevent
that, OK?
We have
at this Congress, we have a system
that is used in enterprise environments
to prevent you from doing that, which
uses another layer of encryption.
It's that it works like that.
The access point needs a certificate
to make sure that there's no official
access point you connect to.
So what happens then is that in the
beacon, there are some encryption stuff,
and your computer can check out whether
the access point is really valid
when you set up with the Android
app, your wireless connection here.
There is some Android app in the Play
Store.
This one generates
a configuration in which a
certificate is written
down and only
the official access point here
on hold of the key for their connections
then. So your computer, which
just in that case, your smartphone can
make sure that the access point is
official on your laptop.
You have to configure it by hands
on. I would like you to to try
that out, skilled forward and look into
the wiki. There are details
how to configure that there's some
handshake protocol, some encryption
tunnel.
There's a domain name, a
fingerprint for the certificate
and you can say, please
make sure that the certificate is
valid.
Only then this attack doesn't work
anymore at your home.
You probably don't have these
enterprise authentication system,
which needs another server which needs
to be configured and running
and using the home networks don't have
that in the future with WPA
three.
There comes an extension which which
introduces that
kind of protection.
So what can you do about
that?
I would recommend to you to
make sure that you have a
basic knowledge about protocol
definition and the standards.
Just look at the internet.
There are cease the requests
for comment protocol
documents. You can read how that
stuff really works and you see
it when you when you read really
how it works and you get your
understanding of it, you're also getting
an imagination of everything
that can go wrong there.
So also
from the other side approaching that's
read through the internet, there's plenty
full of documentation, not
only more precisely
and more clearly explaining what I did to
you here, but also all kinds
of different other attacks.
And also, these give you a broader
imagination of how stuff works.
This also gives an inside how to really
protect yourself.
And I mean, if you only
want to do that, as I said, use
it's TDPs,
which is a secure protocol for the
application.
So the application Lyons makes
sure that it connects to a valid server
and encrypts all of the traffic between
that.
So the most of your traffic is not
observable even if these
attacks are in place
and that that is very important.
We have,
fortunately, a big increase of encrypted
FTP traffic in the past thanks
to the Let's Encrypt organization,
and they're always very grateful for
that.
Yeah, and if you want, you can try
that out.
Put your own WPA ERP
enterprise authentication protocol
system.
But that's, of course, also only
limited.
What you can do more practical, even
if just with your laptop
on your Congress network,
look at the traffic
type zero tcpdump, this,
this that and and you just see the
packets flowing in and out from your
computer.
You can check out the road
packets you're taking with the Trace Road
software, the simple trace road protocol
or the more sophisticated
program marketers helping with it.
And you can learn a lot by
using a program like Skype.
I can recommend that to you.
It's a simple Python
cell that enables you to forge packets.
You can say like, I want a packet that
has this source address this destination
address and looks like that.
Please be always respectful
to others. Be excellent to each other.
Use these tools to learn for
yourself and to learn how
traffic between your system
and maybe your other system or your
friends' system is working.
Maybe you can pair with another person
here with their computer and try that
out.
Yeah. So I hope I could spark
new interest.
And I guess my time is over now.
So no reaction.
I'm sorry.
Thank you.
Thank you for this very good
introduction.
And you were exactly in time, but
sorry, no time left for Q&A, but
I'm sure they can find you and
ask
you whether it's crossed off.
Everyone's OK, so
let's have a nice, warm
thank you. APPLAUSE for a.m.
again.