Question

Alice wants to communicate with the www.vunl Web site, but the entry for this domain in her name server was poisoned so that the packets end up at an attacker-controlled machine. To what extent is the attacker able to compromise Confidentiality, Integrity, and Authenticity in the following cases: (a) unencrypted (http) communication between Alice and www.vu.nl, (b) encrypted (https) communication between Alice and www.vu.nl when the Web site uses a self-signed certificate, (c) encrypted (https) communication between Alice and www.vu nl when the Web site uses a certificate signed by a legitimate certificate authority?

Short answer

(a) Complete compromise of CIA. (b) Confidentiality maintained, but integrity and authenticity compromised. (c) CIA generally protected, but DNS hijacking remains a risk.

Step-by-step solution

Understand the Terms

Confidentiality ensures that data is only accessible to authorized parties. Integrity ensures that the data hasn't been altered in an unauthorized way. Authenticity ensures that the communication parties are who they claim to be.

Case (a) - HTTP Communication

In unencrypted HTTP communication, the attacker can intercept and read all the data, compromising confidentiality completely. The attacker can also modify the data, compromising integrity. Since there's no verification of identity in HTTP, authenticity is also not ensured.

Case (b) - HTTPS with Self-Signed Certificate

An HTTPS connection using a self-signed certificate provides encryption, so confidentiality is maintained as data between Alice and the attacker is encrypted. However, without a trusted certificate authority, authenticity is compromised as the attacker can impersonate the www.vu.nl website. Integrity could also be compromised if the attacker provides a fake self-signed certificate.

Case (c) - HTTPS with Trusted Certificate Authority

With a legitimate certificate authority, the attacker faces challenges. Confidentiality is generally maintained with encryption, integrity is preserved since alteration can be detected, and authenticity is verified through the trusted authority. However, if the attacker has already hijacked the DNS, they might attempt a man-in-the-middle attack, yet this is much more complicated.

Key concepts

DNS Spoofing

DNS Spoofing is a malicious activity where an attacker alters the DNS records to redirect internet traffic to a different destination than intended. This can happen when an attacker "poisons" the DNS cache, leading users to illegitimate sites unknowingly. Imagine walking through a doorway expecting to enter a grocery store, but instead, you find yourself in a junkyard due to a swapped sign.

• During DNS Spoofing, attackers can trick users into divulging sensitive information or infect their systems with malware.
• The information is redirected to attackers, making it appear legitimate at the outset.
• It is a major threat to internet security, especially since it targets the foundational layer of internet communication—the DNS.

Preventative measures include implementing DNS security extensions (DNSSEC) and regularly updating DNS server configurations. DNSSEC can authenticate the origin and integrity of DNS data, helping to protect against spoofing.

Confidentiality

Confidentiality in the context of network security refers to keeping information secret from unauthorized users. In simple terms, it ensures that sensitive data is accessed only by those with the right permissions. For Alice trying to communicate with a website, confidentiality is crucial to keep her data safe from attackers.

• From our exercise, without encryption (HTTP), attackers can easily eavesdrop and steal sensitive information like passwords and personal data.
• However, using HTTPS encrypts data in transit, enhancing confidentiality. It ensures that even if packets are intercepted, they are unreadable to those without the key.
• Self-signed certificates provide some level of encryption, but the trustworthiness can be questioned since they aren't validated by an external authority.

Adopting strong encryption methods, like TLS, and using reputable certificate authorities are effective ways to secure confidential information.

Integrity

Integrity ensures that information remains unaltered during transmission. In network security, data integrity means maintaining the accuracy and consistency of data over its entire lifecycle.

• For example, if Alice sends data but it's altered by an attacker due to DNS Spoofing, the integrity is compromised.
• With unencrypted HTTP, modifications can be made easily, misleading the parties involved.
• HTTPS helps by using cryptographic hash functions to detect any alterations.
• When using a trusted certificate authority, pop-ups or warnings are issued if changes occur, alerting users to potential tampering.

Maintaining integrity is essential for building trust in communications and preventing malicious activities. This can involve mechanisms like checksums and digital signatures to verify that data remains untouched.

Authenticity

Authenticity is about confirming that the entities we communicate with are who they claim to be. It involves verifying identities to ensure users do not fall victim to deceitful activities.

• Under HTTP, there’s no mechanism to validate the identity, leaving users vulnerable to DNS Spoofing.
• A self-signed certificate doesn't suffice for authenticity as it lacks external verification, making impersonation straightforward for attackers.
• Conversely, a certificate from a trusted authority authenticates the identity, helping users recognize legitimate sites.
• It also employs cryptographic techniques to ensure that communications have not been altered en route.

To genuinely secure authenticity, one should rely on HTTPS connections verified by a trusted certificate authority, which helps confirm the legitimacy of the communication endpoint before any data transactions.