Evaluating Web Protocol Threats: DNS Spoofing & TLS Weaknesses

At present, there are a large number of parked domains, which seriously affect online users when surfing. To identify parked domains effectively, a new technique was proposed based on authoritative Domain Name Server (DNS). In this way, suspected authoritative DNS servers of typosquatting domains were extracted, which commonly used in domain parking service. Then these DNS servers were clustered by semi-supervised clustering method, to identify whether they were associated with domain parking service. When detecting a parked domain, we can identify it by judging whether its authoritative DNS applied in domain parking service and whether its mapping IP addresses concluded in the set od IP addresses of parking web servers. With existing detecting method by using webpage's features to analyze the accuracy of the proposed method, the experimental results show the proposed method achieves a high accuracy rate of 92.8%, avoids crawling the webpages, has a good performance on parked domains detection in real time.

There is no question the Internet has revolutionalized the world. Many of the things we take for granted today were not even possible a few years ago. Will the Internet continue to push the boundar...

CHAPTER 8 - Installing, Configuring as a Server

The Secure Sockets Layer (SSL) protocol and its standards-track successor, the Transport Layer Security (TLS) protocol, were developed more than a decade ago and have generally withstood scrutiny in that the protocols themselves haven't been found to have security flaws. Marsh Ray and Steve Dispensa discovered a design flaw in the TLS protocol that affects all versions of the protocol up to and including the current version.Whereas the vulnerability itself is serious, it need not affect many deployments once administrators apply suitable patches to disable renegotiation, leaving TLS sufficiently secure in most cases because exploiting the vulnerability requires the attacker to be an active man-in-themiddle, redirecting traffic between victims (for example, a browser and a Web server). However, because security problems only ever get worse, a change to the protocol is required. The vulnerability is an interesting attack in itself, but perhaps more interesting is the question, why didn't we see this earlier? In this article, the author explore this question but, unfortunately, can't answer it. Hopefully, simply asking the question might prompt developers to re-examine assumptions they've forgotten they've even made.

System security is the most important aspect in an information system, weak system security increases the risk of attacks that can cause system damage. One of the attacks that often occurs is an attack on a web server, this is because the web server is connected to the internet network and is accessed by many users widely, so the risk of attack increases. For example, the New Student Admission web site of Universitas Muhammadiyah Bengkulu, which manages data on prospective new students who have registered themselves. So that a web server security system is needed to avoid potential attacks and to increase data security. One method of securing a web server is by using the Secure Socket Layer (SSL). SSL is often used to secure communication between client and server. The stages carried out in this study are scanning web servers that have not used SSL and those that have used SSL. This research aims to determine the security of web servers and anticipate various potential attacks on web servers.

To provide secure content delivery, Transport Layer Security (TLS) has become a de facto standard over a couple of decades. However, TLS has a long history of security weaknesses and drawbacks. Thus, the security of TLS has been enhanced by addressing security problems through continuous version upgrades. Meanwhile, to provide fast content delivery globally, websites (or origin web servers) need to deploy and administer many machines in globally distributed environments. They often delegate the management of machines to web hosting services or content delivery networks (CDNs), where the security configurations of distributed servers may vary spatially depending on the managing entities or locations. Based on these spatial differences in TLS security, we find that the security level of TLS connections (and their web services) can be lowered. After collecting the information of (web) domains that exhibit different TLS versions and cryptographic options depending on clients' locations, we show that it is possible to redirect TLS handshake messages to weak TLS servers, which both the origin server and the client may not be aware of. We investigate 7M domains with these spatial differences of security levels in the wild and conduct the analyses to better understand the root causes of this phenomenon. We also measure redirection delays at various locations in the world to see whether there are noticeable delays in redirections.

As the largest country code Top Level Domain (ccTLD) name service, .CN receives billions of queries every day. Under the threat of Distributed Denial-of-Service (DDoS) attacks, effective mechanism for client classification is especially important for such busy ccTLD service. In this paper, by analyzing the query log of .CN name service, we propose a novel client classification method based on client query entropy and global recursive DNS service architecture. By checking with the query frequencies of the clients, we validate the effectiveness of the proposed method on both busy and long-tailed clients. We find that 2.32% clients can cover the most important web spiders, recursive servers, and well-known internet services, etc. The results indicate that, our method can bring significant benefits for creating the client whitelist, which is useful for mitigating DDoS attack towards Top Level Domain (TLD) name service.

This paper presents the results of work by the author on application and comparative performance of IP Security (IPSec) and Secure Socket Layer (SSL) protocols in a Microsoft .NET 3-tier client-server network. To evaluate the performance of each security protocol, the author created a typical 3-tier client-server e-commerce model in which data communication passed through three distinct pathways: (1) channel between client and Web server over Internet, (2) channel between the Web server and application server, (3) channel between the application server and database server. The primary focus in this paper remains on the third channel where IPSec and SSL were used to connect the application server to the database server. A preliminary analysis of the collected data sheds light on performance of IPSec and SSL in Microsoft .NET environment. It also suggests that in pathways where SSL and IPSec could be used interchangeably, the selection of the most suitable security protocol ought to be dynamic.

Many modern botnet malwares use Domain Generation Algorithms (DGAs) to dynamically generate the domain names that resolve to their command and control (C2) centers. This approach allows these malwares to subvert traditional detection systems which rely on blacklists of known domains associated with malicious activities to block malware communications. Since the advent of DGA-based malwares, the efforts to prevent the said malwares from contacting their command and control centers (C2) server have been centered around detecting Algorithmically Generated Domain Names through lexicographic analysis, isolating entire infected devices or both. Recent research has emerged, which more accurately identifies infected devices in a network, by monitoring the volumes of domain resolution failures. While effective, these techniques are slow to identify DGA generated domain names. Even after the delayed identification, the only preliminary mitigation known today is a complete shutdown of a device that is suspected to be infected. In this paper, we present a new method to counter DGA-based malwares by limiting the impact of mitigation. Instead of isolating the entire infected device from the network we limit network activity of the malicious process alone. Our objective is to prevent DGA-based malwares from communicating with their C2 centers while allowing an infected device to maintain its normal functionality. We achieve this by tracking Domain Name Service (DNS) responses of individual processes and blacklisting those processes for which DNS traffic have abnormally large numbers of domain resolution failures. The blacklisting at a process level ensures that non-malicious processes in the infected device can continue functioning.

Communication is the important part in any type of network for making it possible to transfer data from one node to another. Communication needs quality and security for better performance and for acceptance of users and client companies. Data integrity is quite an issue in security and to maintain that integrity we tend to improve as to provide the better encryption processes for security. In our proposed work, an innovative and practical authentication system using Diffie-Hellman and AMA (Anonymous Micro payments Authentication) are designed for micropayments in mobile data network. Through AMA the customer and the merchant can authenticate each other indirectly, at the same time the merchant doesn't know the customer's real identity. A customer can get fast micropayments not only from his local domain but also from a remote domain without increasing any burden on his mobile phone/smartcard. Diffie-Hellman Encryption Algorithm adds more security to the proposed work. Keywords: AMA, Authentication, Diffie-Helman, Provate key, Public key I. INTRODUCTION The entire field of network security is vast and in an evolutionary stage. The range of study encompasses a brief history dating back to internet's beginnings and the current development in network security. In order to understand the research being performed today, background knowledge of the internet, its vulnerabilities, attack methods through the internet, and security technology is important and therefore they are reviewed. Micropayments refer to low value financial transaction ranging from several pennies to a few dollars. At present, a large portion of electronic commerce occurring in the mobile data network belong to the category of micropayments, such as ringing tone download, news subscription, etc. Although the amount of each single transaction in micropayments is small, the number of users and transactions is large. A small percentage loss due to insecure transaction on fraud will be enlarged to a big sum. Thus, an important issue of micropayments is security. Many achievements on micropayment and its security are gained by researchers and cryptographers (3). All these can be classified into script-based, hashchain-based and macropayment-based categories. Millicent (4)(5), a scriptbased micropayment, introduces a kind of currency- scrip, which is digital money that is issued by a single vendor. It uses no public-key cryptography and is optimized for repeated micropayments to the same vendor. Its distributed approach allows a micropayment to be validated and double spending prevented without the overhead of contacting the broker online during purchase. Diffie-Hellman in SSL: Secure Sockets Layer (SSL) is a cryptographic protocol developed by Netscape in 1995. SSL V3.0 has since become the predominant method and defacto standard for securing information flow between web users and web servers. Diffie-Hellman in SSH: Secure Shell (SSH) is a protocol and program used to encrypt traffic between two computers. This is most commonly done as a secure replacement for tools like telnet, ftp and the Berkeley r commands (rlogin, rsh, etc,)

A distributed multiserver Web site can provide the scalability necessary to keep up with growing client demand at popular sites. Load balancing of these distributed Web-server systems, consisting of multiple, homogeneous Web servers for document retrieval and a Domain Name Server (DNS) for address resolution, opens interesting new problems. In this paper, we investigate the effects of using a more active DNS which, as an atypical centralized scheduler, applies some scheduling strategy in routing the requests to the most suitable Web server. Unlike traditional parallel/distributed systems in which a centralized scheduler has full control of the system, the DNS controls only a very small fraction of the requests reaching the multiserver Web site. This peculiarity, especially in the presence of highly skewed load, makes it very difficult to achieve acceptable load balancing and avoid overloading some Web servers. This paper adapts traditional scheduling algorithms to the DNS, proposes new policies, and examines their impact under different scenarios. Extensive simulation results show the advantage of strategies that make scheduling decisions on the basis of the domain that originates the client requests and limited server state information (e.g., whether a server is overloaded or not). An initially unexpected result is that using detailed server information, especially based on history, does not seem useful in predicting the future load and can often lead to degraded performance.

Despite the promise, Web services present network administrators with a thorny problem: as network security becomes an increasing concern, Web services open up networks by letting outside users access databases, applications, and internal users. Traditional security techniques - such as virtual private networks or secure sockets layer (SSL) technology - cannot secure the large number of transactions that Web services can perform in a short time. Meanwhile, basic Web services transactions are unencrypted and unsecured, which creates the potential for disaster. It is thus important for Web services technology to have its own security mechanisms. In fact, industry observers have said the biggest obstacle to wider adoption of Web services has been security concerns. With this in mind, researchers are developing and implementing several Web services security approaches.

Security of Computer Networks

In an age where data security and encryption is the highest priority in any kind of data communication, domain name services (DNS) are still vulnerable to various kinds of threats and attacks since domain names are still communicated in plaintext. Most of the attacks take place in the Top Level Domains (TLDs) that controls the DNS system. Given below is a study of the current situation and the possible solutions.KeywordsDNSPrivacySecurityMaliciousBlacklistingRandom forest

Chapter 8 - Attacking and Defending DNS