Question 1. Analysis of Protocols with Wireshark [10 marks]

For this question you must use virtnet (as used in the workshops) to study Internet applications with Wireshark. This assumes you have already setup and are familiar with virtnet. See Moodle and workshop instructions for information on setting up and using virtnet, deploying the website, and performing the attack.

Your task is to:

• Create topology 5 in virtnet where:
  • node1 will be referred to as the client
  • node2 will be the router
  • node3 will be the server
• Start capturing packets using tcpdump on the router (node2)
• While capturing, perform the following operations in order:

1. Start netcat TCP server using assigned port on the server (node3)
2. Start netcat TCP client on the client (node1)
3. On the client (node1) type:

COIT20262 Assignment 1<press ENTER>

My ID is <type in your actual student ID><press ENTER>

4. On the server (node3) type:

Hello <type in your actual student ID>. I am the server.<press ENTER>

5. On the client (node1) type:

Goodbye server.<press ENTER>

<Ctrl-D>

You need to perform steps 3-5 in the correct sequence, switching from client to server to client.

• Stop the capture and save the file as pcap

Server port numbers must be assigned based on the last three (3) digits of your student ID, xyz, as defined below. Examples are given for a student ID of 12345678.

• For netcat TCP server use port 6xyz. Example port: 6678

After performing and understanding the above steps, answer the following sub-questions

• Submit your capture file as pcap on Moodle. The single file must contain all packets of the TCP exchange using your assigned port and using your ID and name. [3 marks]

• Draw a message sequence diagram that illustrates all the TCP packets generated by using netcat (do not draw any packets generated by other applications or protocols, such

as ARP, DNS or SSH). A message sequence diagram uses vertical lines to represent events that happen at a computer over time (time is increasing as the line goes down). Addresses of the computers/software are given at the top of the vertical lines. Horizontal or sloped arrows are used to show messages (packets) being sent between computers. Each arrow should be labelled with the protocol, packet type and important information of the message. Examples of message sequence diagrams are given in workshops. Note that you do not need to show the packet times, and the diagram does not have to be to scale. [3 marks]

• Based on your capture only, identify the following information, and give the packet that the information is found If the information is found in multiple packets, give the first packet from the capture. For example, if the information is found in packet numbers 3, 5 and 7, you would give the packet as 3. [4 marks]

Question 2. Web Application Attacks [12 marks]

Use virtnet, perform an SQL injection attack on the demo grading website www.myuni.edu. The general steps for performing an SQL injection attack with virtnet are described at:

https://sandilands.info/sgordon/sql-injection-csrf-cookie-stealing-in-a-virtual-network However you must follow these specific steps when performing the attack:

1. Before performing the attack, add two new student users to the database with the following details:
   1. New student 1: username is your ID, password is your ID
   2. New student 2: username is 12037777, password is hacker
2. For both of the new students add the following courses and grades:
   1. New student 1: coit20262, D
   2. New student 1: coit20263, C
   3. New student 2: coit20262, HD
   4. New student 2: coit20263, F
3. Perform the SQL injection attack as new student 2, e. logged in as 12037777
4. Take a screenshot of the attacker web browser showing the form the attacker uses to perform the Make sure the screenshot clearly shows the fields/data entered by the attacker. Save the screenshot as screenshot-attack.png.
5. Take a screenshot of the attacker web browser showing a successful attack, e. the

grades of other students. Save the screenshot as screenshot-success.png.

Answer the following questions.

• Give a general explanation of an SQL injection (This explanation should NOT reference the attack you performed in virtnet; it should be for any SQL injection attack). [1 marks]

• Explain two general approaches that can be used to avoid or minimise SQL injection (This explanation should NOT reference the attack you performed in virtnet; it should be for any SQL injection attack). [2 marks]

For this specific attack on www.myuni.edu:

• Explain the limitation/weakness in the MyUni website that allowed the SQL injection attack to be In your explanation refer to the file(s) and line(s) of code, and give samples of the code in your answer. [2 marks]

• Explain what the attacker, 12037777, had to do in their web browser to perform the In your explanation include the screenshot screenshot-attack.png and refer to the information shown in that screenshot. [2 marks]

• Submit your screenshot screenshot-attack.png as a separate That is, you must both embed the screenshot in the report AND submit the file separately. The reason for this is that it makes it easier for the marker in reading the report to have an embedded image, but sometimes the quality is hard to read (hence the additional file submission). [1 mark]

• Explain what the attacker, 12037777, could learn or gain from performing the SQL injection In your explanation include the screenshot screenshot-success.png and refer to the information shown in that screenshot. [1 mark]

• Submit your screenshot screenshot-success.png as a separate [1 mark]

• Explain what the website developer could do to prevent this SQL injection In your explanation, give exact code or steps the developer should use. [2 marks]

Question 3. Cryptography Concepts [7 marks]

 A simple symmetric encryption algorithm can be written as follows:

1: Input message M and 64 bit key K

2: Divide M into 64 bit size blocks B1…Bn

3: Get first block B1 and perform bit-wise XOR with K

to produce encrypted block E1

4: Repeat

Get next block Bi and perform bit-wise XOR with

Ei-1 to produce encrypted block Ei

5: Until End of message

Based on the above algorithm, answer the following questions:

• Explain the weaknesses of the above algorithm if the first input block is identical to the key. [3.5 marks]

• Give a modified algorithm that corrects the problem(s) identified in part (a). [3.5 marks]

Question 4. Network Attacks Research [6 marks]

  Recent progress in artificial intelligence (AI) technologies have prompted massive growth in innovation and automation and their potentialities have expanded from smart buildings, smart transportation, smart grids, smart governances to smart anything. These technologies are already being used to defend network attacks; however, they can be used maliciously. For example, DeepLocker has shown the intentional use of AI for a harmful purpose. Threat actors are constantly changing and enhancing their attack approach with a unique emphasis on the application of AI-driven techniques inside the attack process which can be used in conjunction with traditional attack techniques to cause greater damage. Your task is to study how AI technologies can be used maliciously to perform network attacks and what measures should be taken to mitigate these attacks.

You must write a short report that answers the following questions:

• As a network security analyst, why is it important that you have knowledge of AI- based network attacks? [1]

• Select three examples of AI-based network attacks and describe [3]

• What are the defensive strategies you can take to prevent any two of the these attacks? [2]

You should structure your report into a section for each of the above parts.

There is no minimum/maximum length of the report. Support you finding by quoting reputable sources of information. You may draw diagrams if needed. Including pictures from other sources, or including pictures that do not help with the explanation will not gain marks and may lead to reduced marks.

You may assume the audience of the report has a similar background on network security as you. You should give sufficient technical detail to demonstrate you understand the issues.