Analyzing Vulnerabilities in DNS, WEP, and SMTP Protocols

Desklib provides solved assignments and past papers to help students succeed.

Network Security
1

Table of Contents
Task 1...............................................................................................................................................3
Question 1....................................................................................................................................3
Task 2...............................................................................................................................................6
References......................................................................................................................................13
2

Task 1
Question 1
Identify the vulnerabilities involved in the following network application protocol
1. DNS- Domain Name Service
There are several issues of vulnerability that were found and exploited. One of the major
vulnerability in DNS is the DNS cache poisoning. In this the distribution of data takes
place and it is distributed among the caching resolvers. They pollute the data by storing
the false data and a long time to live. The request is made by the legitimate application
which is redirected to the hosts of the network. It does not have the cryptographic
signature which possibly leads to many kinds of attacks. The DNSSEC has modified the
DNS and in addition, has added the support for the responses of cryptographic signatures
(DNS and Security: A Vulnerability, Yes. But Also A Safeguard, 2019). The second
vulnerability is with the server of the internal DNS server to hold the names of the server
and also the addresses of IP for their domains. It allows being shared with anyone. This
makes the DNS, a place for attacking the information at the time when they are struggling
to do internal reconnaissance. The caches of DNS are not authoritative and can be easily
manipulated. The servers of the DNS are poisoned with false information of records and
the computers are fooled to go in places that are bad. The information of the query is
relayed by the DNS to the outside server from the internal workstations. This makes the
attacker learn to use the behavior for creating covert channels for data to exfiltrate. The
lack of protection and openness makes the DNS a target for the attacks like a phishing
attack, malware attack, and ransom ware attack. The targeted threats are connected to the
endpoints that are infected with a CnC (Command and Control) server which is
controlled mainly by the cybercriminal. It also spreads the malware to many more
endpoints on the network. The attacker is able to steal the PID (personally identifiable
information), sensitive data of the company and the customer, intellectual property and
many more such sensitive information that needs to remain secure and confidential.
Tracking and privacy issues are also the main vulnerability issues and sometimes leaks
3

the connections that are private and secure. For countering such an issue, the proxies and
VPNs are used to reroute the inquiries of DNS to mask the IP address of source.
4

2. WEP- Wireless Equivalent Protocol
WEP has many vulnerabilities but the main weaknesses of WEP are the key size and the
key management, the initialization vector is way too small, the WEP use for RC4 is also
weak, the algorithm for integrity check value is also not appropriate, the forging of the
authenticated messages can be easily done. These weaknesses are explained one by one:
 Key size and key management: it is not given in the standards of WEP because
without it the keys will be of poor quality and might live long. The networks
having the wireless technology and use WEP have a single WEP key that has to
be shared between the network’s node. The client stations and the access points
must have the same key (2019).
 Small initialization vector: the initialization vector of WEP is 24 bits that are
provided to different RC4 ciphers streams.
 WEP use of RC4 is weak: RC4 is having the keys which are weak means that the
correlation is more between the keys and the output is of good security.
Determining the encrypted packets with the use of the weak key is easy but later it
can be exploited by passive attacks.
 Algorithm for integrity check value is not appropriate: the algorithm for the
integrity check value is based on the CRC-32. It is good for detecting errors but is
also an awful choice for the cryptographic hash. The main problem is that they do
not depend on the size of the key and the key look the same. Therefore the efforts
taken for the attack is the same (2019).
 Forging of authenticated messages: for doing the authentication of the access
points, the open system and shared key authentication are used. As compared to
no authentication, the authentication is considered to be the best as the knowledge
of the shared key of WEP has to be proved (WEP vulnerabilities -- wired
equivalent privacy?, 2019).
3. SMTP- Simple Mail Transfer Protocol
This protocol has various vulnerabilities and is at high risk of the cybersecurity breach.
Some of the popular vulnerabilities in SMTP are:
 Unauthorized data access: this is the most vulnerability in which the perpetrator
bypasses the procedure of the authentication to get the data access. For this, the
5

strong passwords are recommended which is helpful in preventing the cracking of
the password.
 Data leakage threats: for hackers, the target is personal data. The email sent using
the internet passes through the channels that are unprotected. The messages, user
names, and passwords are intercepted. For preventing this issue, the ongoing and
incoming mails need to be encrypted (User, 2019).
 Spam: it is divided into two categories namely sending the messages to own client
and sending to other clients. For removing such threat and preventing the mails
can be done using the content filters. These need to be installed on the proxy
application or the proxy server.
 DoS threat: the damage is very big by this threat and can lead to unsent and
unreceived emails. By this, the company’s reputation can be suffered. For
preventing this, the limit must be set for the connections and simultaneous
connections to the server of SMTP.
 The threat of malware: both the email clients and servers are malware suspected.
The infected server of email can affect the stability of the entire system. Privacy
and integrity of the data are threatened. The protection can be done using the
antivirus software of third part and built-in tools (User, 2019).
6

Task 2
Testing HTTPS with Apache
To test the HTTPS connection with Apache, there is a first need to create the server Keystore and
the client truststore for the project on which the test is to be implemented and run. The file of the
server Keystore contains the private key of the server. This is the key which is used by the client
to verify that it is connecting to the correct server and not the imposter when client negotiates
with the server for the connection. The client truststore has the number of certificate entries that
the client trusts. When the connection is negotiated by the client to the server, then the server’s
identity is verified. After it, the mock server configuration is created. The mule configuration
code should be included in the project file.
7

Figure 1: mule configuration file
The above code for mule configuration contains:
 The connector of HTTPS named “HTTPSNoClientCert”.
 A flow “https-noclientcert-flow”
 Input endpoint is contained in the flow
 The flow also contains the test-component
 In the end, the flow includes the processor that is responsible for setting the payload of
the message.
After this, the HTTPS server can be tested by doing a right-click on the file of the mule
configuration. Then, open the browser and enter the URL. After this, the warning box will
8

appear that it might be an untrusted certificate, but you need to confirm the certificate and
ensure that the certificate is the trusted one. Now to observe the mule logs, add the file of
Log4J configuration.
Figure 2: Log4J configuration file
Then the test is implemented which connects to the server. The test looks like this:
9

10

11

Figure 3: implemented test
The code contains:
 The test-class inherited from the FunctionalTestCase class.
 The getConfigFiles method returns the file of mule configuration that needs to be
loaded in the instances of the mule.
 The method setup configures and creates the Apache HttpClient instance that makes
use of truststore to authenticate the server’s identity.
 The testSuccessfulConnection is the test method that tests the expected successful
connection to the server.
12