EMV

If not redirected, please click here https://www.thesecuritybuddy.com/online-banking-security/what-is-emv-chip-card/

Traditionally, a debit or credit card contains magnetic stripes that hold data necessary for performing a transaction. But, the system had a number of security flaws. Many a times those cards used to get compromised or forged. And, to address that concern, EMV is developed.

What is EMV actually? How is it different from using debit or credit cards containing magnetic stripes only? And, how does it enhance security?

Let’s understand that in more details.

What is EMV

EMV is a global technology standard that deals with processing of credit and debit card payments using a card that contains a smart chip, instead of magnetic stripes.

The word ‘EMV’ stands for Europay, MasterCard and Visa – the three companies that originally created the standard. The standard is now managed by EMVCo with its six member organizations – American Express, Discover, JCB, MasterCard, UnionPay and Visa.

EMV cards use a smart chip instead of magnetic stripes to hold data that is required to process a transaction. The smart chip is basically a microprocessor that can run applications to perform authentication and hold encrypted data. It can also generate a unique code for each transaction which cannot be used for more than one transaction and thus prevent fraud.

Why EMV

Until the introduction of EMV cards, credit or debit cards used to use magnetic stripes to verify a transaction. Magnetic stripes in a card would typically contain data like card number, expiry date etc and a signature from the cardholder used to be used to verify the authenticity of the cardholder.

Customers would typically give the card to a clerk in the POS, who would swipe it through a magnetic reader. Information stored in the magnetic stripes of the card would get accessed which would verify the account details. Then the cardholder would sign a printed slip to verify its authenticity.

But, this system had a numb er of security flaws. Criminals can read and write magnetic stripes with technology available in the black market. Magnetic stripe cards can easily be cloned and used without the user’s knowledge. Moreover, signature on the card also can be forged. And, to address all these security flaws, EMV is used.

How does EMV work

A payment transaction using EMV typically follows the following steps:

• After a crad is read by an appropriate device terminal, an application is selected using which the payment is processed. Application Identifier for an application typically consists of a registered application provider identifier, which is issued by a registered authority and a proprietary application identifier extension which differentiates the different applications offered by the application provider.
  
  
  
• The terminal then send some commands to the card asking for a list of functions to perform in processing the transaction. The card also provides a list of files and records that the terminal needs to read from the card in order to obtain data necessary for the transaction. This list of files contain the EMV data.
  
  
  
• Next, it is checked whether the card can be used. Information like application version number, application usage control that specifies whether the card is for domestic use only etc and application expiration dates are checked. Based on these information, the transaction can be declined later.
  
  
  
• Next, the card is validated using public key cryptography. There can be three types of authentication for this purpose:
  
  Static Data Authentication or SDA – It ensures the data read from the card is signed by the card issuer, which can prevent fraudulent modification of data. However, it cannot prevent cloning.
  
  Dynamic Data Authentication or DDA – It can protect against modification of data and cloning.
  
  Combined DDA/Application Cryptogram Generation or CDA – It combines DDA with the generation of a card’s application cryptogram to assure card validity.
  
  
  
  
• Next, it is checked whether the person holding the card is the legitimate cardholder. This can be done in a number of ways:
  
  - using Signature of the cardholder
  - using a PIN
  - using PIN as well as signature
  
  The terminal reads data from the card to determine the type of verification it needs to perform.
  
  
  
  
• Next, terminal risk management is performed to determine whether a transaction should be authorized on-line or offline. If the transactions ate always carried out online or always offline, this step cam be skipped.
  
  
  
  
• Next, it is checked whether a transaction should be approved offline, sent online for authorization or declined offline.
  
  
  
• Next, appropriate data along with the transaction amount is sent to the card to make a decision on whether to approve or decline the transaction.
  
  
  
  
• The card generates a digital signature of the transaction. This provides a strong cryptographic check that the card is genuine.
  
  
  
• The card issuer then sends a response code indicating acceptance or declination of the transaction. It can optionally send a issuer script also. An issuer script is basically a set of commands sent by the issuer to the card and it can be used to block cards or change card parameters. The issue scripts are encrypted and hence, cannot be read by the terminal.

Acceptance of EMV

EMV has been implemented in more than 80 countries worldwide. As of 2015, 40% of US consumers have EMV cards and roughly 25% of merchants are EMV compliant. American Express, Discover, Maestro, MasterCard and Visa have implemented their liability shift for POS terminals. And, by 2017 the liability shift will be implemented at various places like pump, gas stations and ATMs.

So, let’s not debate on whether EMV can make card payments completely secure, but this technology no doubt can prevent frauds up to a great extent. So, be aware of various technology and stay safe, stay secured.

IoT Security

If not redirected, please click here https://www.thesecuritybuddy.com/iot-security/iot-security-concerns-and-solutions/

IoT technology is growing at a dangerously fast pace. Digitally connected devices are touching every aspect of our lives, including our homes, offices or cars. But, as with every good thing, there is a downside of IoT also.

With the increase in the number of digitally connected devices, more and more data is being collected. And, that in turn is increasing the attack vectors. Attackers are exploiting vulnerabilities in IoT devices to steal our sensitive data and invade our privacy.

But, can we prevent that? Can we ensure the security of the sensitive data collected from us by the IoT devices?

Let’s understand in more detail what the security concerns of IoT devices are and how best we can address them.

Security Concerns of IoT Devices

Cybercriminals can attack the IoT devices in a number of ways. They can exploit vulnerabilities of insecure web interfaces, cloud interfaces, lack of encryption or they can take advantage of weak authentication mechanism to enumerate user accounts and steal sensitive data or make DoS attacks.

Let’s understand each of them in more detail.

Insecure Authentication

If the authentication mechanism is not secure enough, attackers can exploit that to gain unauthorized access of user accounts and steal sensitive data. There are a number of ways that can happen. For example,

• If default usernames and passwords are not changed properly, attackers can take advantage of that to gain unauthorized access of user accounts.
• Attackers can take advantage of weak passwords to gain unauthorized access of the devices.
• If the collected user credentials are not encrypted properly, attackers can take advantage of that and capture them for malicious purposes.
• Attackers can enumerate user accounts to access the IoT devices.

No doubt, this can lead to data loss or data corruption. It can even result in denial of access or complete device takeover.

Prevention

We can take a couple of steps to prevent this type of attacks:

• Make sure to change default credentials at the time of initial setup of the devices.
• Passwords need to be kept sufficiently strong. Users should not be allowed to set weak passwords.
• Credentials, whenever they are collected from users, should be encrypted using sufficiently strong encryption algorithm. Plaintext credentials should never be transmitted across the network.
• Account lockout should be implemented, so that user account gets locked immediately after a certain number of failed login attempts.
• We need to make sure password recovery mechanisms are made secure.
• We need to make sure, when a device is plugged into the network, it authenticates itself before it starts sending or receiving data.

Vulnerable Web Interfaces, Mobile Interfaces and Cloud Interfaces

Attackers can exploit insecure web interfaces, mobile interfaces and cloud interfaces to steal sensitive data in a number of ways:

• Attackers can exploit security vulnerabilities in the mobile, web or cloud interfaces to perpetrate SQL Injection, Cross Site Scripting or CSRF attacks and steal sensitive user data.
• If the web interface does not properly implement HTTPS, attackers can exploit that to steal transmitted unencrypted sensitive data.
• Attackers can exploit vulnerabilities in the mobile app, cloud interfaces or web interfaces to enumerate user accounts and gain unauthorized access of the devices.
• Attackers can use the insecure mobile, web or cloud interfaces to gain unauthorized access to user accounts exploiting weak passwords or default credentials.

Prevention

Couple of steps can be takes to prevent this:

• Web, Cloud and mobile interfaces should be properly tested so that they do not contain any SQL Injection, XSS or CSRF vulnerabilities.
• Web interfaces should implement HTTPS wherever possible.
• Web Application Firewalls should be used to protect the web interfaces.
• Web, cloud and mobile interfaces should make sure weak passwords are not allowed and default credentials are changed during the initial setup.
• Web, cloud and mobile interfaces should also implement account lockout mechanism so that it creates much difficulty for the attackers to enumerate user accounts.
• 2 Factor Authentication should be implemented wherever possible.
• Web, mobile or cloud interfaces should use proper transport encryption for transmitted data.
• It is always better to implement firewalls and IPS.

Vulnerable Network Services

Attackers can exploit vulnerable network services in the following way:

• Attackers can exploit security vulnerabilities in the network services to perpetrate attacks like buffer overflow or DoS attacks.
• Attackers can take advantage of open ports to collect information on the devices, so that they can plan for more attacks.
• Attackers can even exploit open ports via UPnP or exploit UDP services.

Prevention

We can prevent this type of attacks in a number of ways:

• We need to ensure only the necessary ports are open and exposed outside.
• We need to make sure network ports or services are not exposed to the internet via UpnP.
• A number of automated tools can be used to make sure the vulnerabilities in the network services are detected and mitigated.

Lack of Transport Encryption

If the data in transit are not encrypted properly, attackers can take advantage of that to steal sensitive data.

• Usually, local network traffic does not get exposed outside the network. But, if the wireless network is not configured properly, it can make the traffic visible to anyone within the range of the wireless network. And, that can lead to complete compromise of the devices or user accounts.
• If proper encryption protocols like SSL/TLS are not used, attackers can easily capture the data in transit and exploit that for malicious purposes.

Prevention

• We need to make sure communications between the devices and the internet are encrypted using proper encryption protocols like SSL/TLS.
• It is always better to use accepted encryption standards and avoid proprietary encryption protocols.
• It is always better to use firewalls with the devices.

Privacy Concerns

Due to lack of proper protection of data, attackers can capture sensitive and personal data collected by the devices, which no doubt raises privacy concerns. To prevent this, we can take a couple of steps:

• We need to identify all the data types that are being collected by the devices, mobile app, web interfaces or cloud interfaces. We need to make sure to only collect data that is necessary.
• Collected data should be properly protected using encryption while at rest or in transit.
• Only authorized individuals should have access to personal data.
• We need to make sure proper data retention policy is in place and individuals are given a choice to collect data beyond what is necessary for the operation of the devices.

Insufficient Security Configurability

This vulnerability exists if the devices have limited or no ability to alter security controls or the web interfaces have no options for creating granular user permissions and cannot enforce use of strong passwords. Attackers can take advantage of this to exploit the vulnerabilities in the devices to steal sensitive data or make more attacks.

Prevention

We can take a couple of steps to address this.

• We need make sure normal users are separated from administrative users and principle of least privileges is enforced. Password security options should be made available.
• Encryption options should be made available to encrypt sensitive data collected by the devices.
• We should enable logging of security events.
• Users should be notified about security events.

Insecure Software/Firmware

IoT devices should have the ability to be updated when vulnerabilities are discovered. But, if the update files are not protected, they can be captured by attackers and exploited for malicious purposes. Attackers can capture unencrypted update files or can perform their own malicious updates via DNS Hijacking.

This type of attacks can happen because of a number of reasons, like:

• update files are not encrypted
• updates are not verified before they are applied
• firmware contains sensitive information like hardcoded credentials
• there is no proper update functionality

Prevention

We can prevent this in a number of ways:

• All the devices should have the ability to be updated.
• Update files should be encrypted.
• Update files should not contain any sensitive data.
• We need to make sure updates are signed and verified before they are applied.
• We should ensure the update server is secure.
• We need to make sure, when power is first introduced to the devices, the authenticity and integrity of the software on the devices are verified using cryptographically generated digital signatures.

Poor Physical Security

Attackers can exploit physical access of the system also to perpetrate attacks. They can use USB ports, SD cards or other storage means to access the Operating Systems and data stored in the devices and exploit that for malicious purposes.

Prevention

We can make sure the following:

• We need to make sure data storage medium cannot be easily removed.
• Only the external ports and USB ports that are necessary should be used.

No doubt, with sufficient efforts we can address these security concerns and make our devices more secure. So, be aware of various security concerns and prevention mechanisms, so that devices and collected data are protected in a better way. And, stay safe, stay secured.




Read More

What is IoT Botnet and how is it used to make DDoS attacks ?

How can Fog Computing improve security and privacy of IoT ?

How to create a strong password that can be remembered easily ?

What is an Intrusion Detection System and how does it work ?

Infographic : Do's and Don'ts of Passwords

What are the security concerns of Cloud Computing ?

How does Web Application Firewall work ?

How to prevent DoS and DDoS attacks ?

What is Blockchain and how can it be used in IoT ?

Network Segmentation and VLAN

If not redirected, please click here https://www.thesecuritybuddy.com/network-security/network-segmentation-and-vlan/

We all know, absolute security is a myth. And, many a times, even though we try to enforce security to our best, attackers manage to gain unauthorized access to the network. Attackers, once they gain unauthorized access to a network, try to move across the network, so that they can gain access to the required systems to obtain sensitive data.

So, once the attackers manage to gain unauthorized access to the network in spite of all the security measures, the best way to thwart them is to restrict their movements across the network. And, that is the main motivation behind network segmentation.

Network segmentation is splitting the network into smaller sub-networks, mainly for the purpose of boosting performance and improving security. If attackers manage to gain unauthorized access to a network, network segmentation can limit further movement of the attackers across the network.

Advantages of Network Segmentation

There are a number of advantages of using network segmentation. A number of them are mentioned below:

Reducing Congestion

More the number of devices in a network, more is the collision while transmission of data. And so, if the number of devices in a network keeps increasing, the performance of the network reduces. One way to reduce the collision is to reduce the number of devices in the sub-network, so that the chances of collision reduces.

Using network segmentation, a network can be split into different smaller sub-networks, so that the number of devices in a single sub-network reduces. And thus, there will be less chance of collision within a sub-network, which in turn can increase the performance of the network.

Controlling Network Access

Network segmentation can be used to control what all users should access which part of the network. For example, in an organization, different groups of employees like HR, server administrators, executives etc may need to access their own segregated networks. Even third-parties also should have their own segregated network, so that attackers cannot gain access to sensitive data within the network via a less protected and compromised third-party site.

Network segmentation can be used to segregate a network into different zones, so that certain group of users have access to certain zone of the network only.

Enforcement of Policy

PCI-DSS (Payment Card Industry Data Security Standard) and similar standards provide guidelines for separating cardholders data from the rest of the network, so that even if a part of the network gets compromised, attackers cannot gain access to cardholders sensitive data so easily. Segmenting the network can provide multiple zones, with varying security level, which in turn can help in rigorous enforcement of the policy.

Limiting Network Problems

As network segmentation segments the network into different sub-networks, a local failure in one part of the network does not affect the other parts of the network.

Improved Security

As network segmentation controls the access of different parts of the network, it can restrict the lateral movement of the attackers across the network, in case the attackers manage to gain unauthorized access of a part of the network, thus increasing the security of the sensitive part of the network.

Different ways of segmenting a network

A network can be segmented using bridges, routers and switches. Let’s understand how that can be done.

Network Segmentation using Bridges

Bridging is a technology using which two or more local area networks that use same protocols, like Ethernet or token ring, can be aggregated together. A bridge monitors each message on a LAN. It passes the messages that are destined within the same LAN and forwards those which are destined for a different interconnected LAN.

Bridges learn which addresses are in which network and develops a table, using which it decides on whether a message should be forwarded to a different interconnected LAN. They work in layer 2 of the OSI reference model.

Advantages of network segmentation using bridges

Bridges can segment traffic in a network, and thereby reducing the traffic seen in each sub-network. This improves network response time. It can also compensate for speed discrepancies of two different networks using its buffering capabilities.

Network Segmentation using Routers

When we need to aggregate two or more networks that use different protocols, we can use routers. A router can interconnect two or more networks, enabling communication between them.

Routers function in layer 3 of the OSI reference model. It looks at the destination IP address of each network packet passing through it and consults a table to determine in which network it should be forwarded. Routers can also implement broadcast filters and logical firewalls.

Advantages of network segmentation using routers

There are a number of advantages of using routers in segmenting a network :

• Routers can interconnect two or more networks that use different protocols.
• Routers can control broadcasts within the network.
• Routers can filter inbound and outbound packets between LAN and WAN segments.
• Routers can fragment large packets into smaller pieces and send them across the network, while bridges discard those.

Network Segmentation using Switches

Switches, like bridges, can enable two or more networks to be interconnected together. But, switching is performed in hardware, instead of software, which makes the communication between the interconnected networks much faster.

A switch learns about the Ethernet addresses of devices of each network, and based on that it creates a table. It examines the source and destination hardware addresses of each fragment passing through it and forwards them to appropriate sub-network consulting the table.

Basic switches function in layer 2 of the OSI reference model. But, there can be layer 3, layer 4 or layer 7 switches also.

Advantages of network segmentation using switches

Switching technology enables a network to be separated into different collision domains, which can improve the network performance significantly. Switches can connect different network types like Ethernet and Fast Ethernet.

Moreover, switches can be used to create VLANs, which can increase security of a network to a great extent.

What is VLAN ?

As discussed earlier, switches can segment a network into different interconnected smaller networks. A basic switch work in layer 2 of the OSI reference model. If we look closely, here is how it works :

When a frame destined for a MAC address enters a switch, such that the destination MAC address is not present in the MAC table of the switch, the switch broadcasts the frame to devices connected to all the ports, except for the port in which the frame was received. The device with the specific MAC address responds to the switch. The switch then stores the MAC address in its MAC table, so that next time a frame arrives with the same destination MAC address, the switch can forward it accordingly. This MAC table is usually stored in a temporary memory in the switch and is rebuilt every time the switch is powered on.

But, broadcast messages like this can eat up considerable bandwidth in a network and raise security concerns also. An attacker can take advantage of the broadcast messages to learn the MAC address of a sensitive device and perpetrate attacks thereafter. And, to prevent that VLANs are used.

Using a smart switch, a network can be segmented into multiple VLANs, such that broadcasts can propagate inside a VLAN, but not outside of it.

A VLAN uses a set of ports of a switch and creates a virtual network, such that devices within the virtual network can talk to each other, but they cannot communicate outside the network. For example, if server 1, server 2 and server 3 of a company are connected to ports 1, 3 and 5 of a switch, and we create a VLAN taking those ports, then the devices connected to those three ports can communicate with each other. But, they cannot communicate to any other device which is not part of the VLAN.

So, if a computer sends a broadcast message requesting the MAC address of server 1, server 2 or server 3 and that computer is not part of the VLAN, then it will not be able to get MAC address of those servers. As a result, VLANs can enhance security of the devices in the network to a great extent.

As I said, absolute security is a myth. But, we can always try our best to thwart the attackers as much as possible. So, be aware of various security measures and stay safe, stay secured.




Read More

What is DHCP Snooping and how does it improve security ?

What is DNSCrypt and how does it encrypt DNS traffic ?

What is Next Generation Firewall ?

What is Dynamic DNS and how can TSIG or Transaction Signature make it more secure ?

What is SSL Inspection and how can it detect malicious contents in encrypted traffic ?

What is DNSSEC and how does it work ?

What is Next Generation of Anti Virus or NGAV and how is it different from traditional anti-virus programs ?

What is DNS Cookies and how does it improve security ?

What is Deep Packet Inspection ?

What is IoT Botnet ?

What is Web Application Firewall and how does it work ?

What is Web Application Firewall ?

If not redirected, please click here https://www.thesecuritybuddy.com/firewall/what-is-web-application-firewall/

What is Web Application Firewall ?

If a firewall filters traffic based on IP addresses, ports or connection state alone, it will not be possible to detect intrusions like whether an unwanted protocol is trying to bypass the firewall in an allowed port or any protocol is being abused. Many a times, we need to understand application layer protocols like HTTP, FTP, DNS etc and filter traffic based upon that. Web Application Firewalls are developed for that purpose.

A Web Application Firewall or WAF is an appliance, server plugin or filter that monitors the incoming and outgoing traffic from an application or service and filters them as per some predefined rules. Web Application Firewall can look through certain traffic upto layer 7 of the OSI reference model and filter traffic based on that.

Types of Web Application Firewalls

There are mainly two types of Web Application Firewalls :

• Network-based Web Application Firewalls
• Host-based Web Application Firewalls

Network-based Web Application Firewalls

Network-based Web Application Firewalls act on the application layer of the OSI reference model and can inspect the contents of traffic and block specific traffic such as certain websites. It can also look through the traffic to detect presence of malware or possible network intrusions, offload encryption from internal servers, manage and consolidate authentication and block traffic which violates policies.

Network-based Web Application Firewalls are also known as Proxy-based Firewalls.

A Forward Proxy server intercepts all the traffic from or to an internal network behind it and can filter them based on policies. For an allowed traffic, it changes the source IP address of the outgoing traffic to its own IP address and sends it to external servers. The external server sends the response to the Forward Proxy server and the Forward Proxy server then forwards the packets to appropriate internal client. A Reverse Proxy, on the other hand, intercepts all the traffic coming from external clients to the internal servers behind it. The outside requesting clients cannot see the IP address of the requested internal server behind the Reverse Proxy Server, thus providing security. You can find more on how Forward Proxy Servers and Reverse Proxy Servers work here : How do Proxy servers work ?

Just like Proxy servers, a Proxy-based Web Application Firewall intercepts the traffic between the requesting clients and requested servers and filters them as per some predefined set of rules. It can use stateful inspection technology or Deep Packet Inspection (What is Deep Packet Inspection ? ) to monitor and analyze the incoming and outgoing network traffic. It can understand a number of application layer protocols like HTTP and FTP and detect signs of malware or network intrusions.

A Proxy-based Firewall prevents the outside network to directly communicate with the inside network. Information packets do not pass through the Proxy Firewalls. Instead, the Web Application Firewall acts as an intermediary. A Proxy-based Firewall has its own IP address. The outside computers first make a connection to the Proxy-based Firewall and the firewall makes a separate connection to the requested computers after carefully inspecting the network packets. And thus, it can provide strong security.

A Proxy-based Firewall can also help in the following ways :

• Caching – It can cache regularly requested web contents and thus reduce the load on the web servers by reducing repeated requests to back end servers.
• Compression – Proxy-based Web Application Firewall can compress certain web contents that can be decompressed later by the browser.
• SSL Acceleration – Proxy-based Web Application Firewalls can speed up SSL processing and reduce the burden on back-end web servers by using hardware based SSL decryption.
• Load Balancing – Proxy-based Web Application Firewalls can distribute the incoming requests to multiple servers behind it and thus improve performance and reliability.
• Connection Pooling – Proxy-based Web Application Firewalls can reduce back end server TCP overhead by allowing multiple requests to use the same back-end connection.

Host-based Web Application Firewalls

A Host-based Web Application Firewall can examine the information that pass through the system calls through the network stack and filter traffic based on that. It can hook into socket calls and filter the connections between the application layer and the lower layers in the OSI reference model based on some predefined rules. It applies the filtering rules on a per process basis instead of per port basis.

Host-based Web Application Firewalls can examine the process ID of data packets and match them against a pre-defined rulesets for that process. They can also have complex rulesets for the standard services, such as sharing services.

AppArmor, TrustedBSD MAC Framework are examples of some commonly used Host-based Web Application Firewalls.

The benefits of an application layer firewall is, as already said, it can understand certain application layer protocols like FTP, HTTP, DNS or web browsing and filter network traffic of an unwanted protocol. It can also look through non-standard ports to detect if any protocol is being abused.

Host-based Web Application Firewalls can protect against threats like SQL Injection, Cross Site Scripting or XSS, Session Hijacking, Parameter or URL tampering, buffer overflows etc.

Some commercial Web Application Firewalls and vendors

A list of some commercially used Web Application Firewalls is mentioned below :

• Trustwave Web Application Firewall
• Deny All Web Application Firewall
• F5 Web Application Firewall
• Imperva SecureSphere Web Application Firewall
• Citrix NetScaler AppFirewall
• Applicure DotDefender
• A10 Networks Web Application Firewall
• AppWall - Web Application Firewall (WAF)
• Barracuda Web Application Firewall
• Brocade Virtual Web Application Firewall
• FortiWeb Web Application Firewall (WAF)
• NSFOCUS Web Application Firewall
• Qualys Web Application Firewall
• Sonicwall SRA Web Application Firewall
• Incapsula Web Application Firewall
• Bee Ware Web Application Firewall

You can also find a comparison between various Web Application Firewalls here : Comparing the best Web application firewalls in the industry

So, be aware of various security vulnerabilities and their defenses, so that you can protect your systems in a better way. And stay safe, stay secured.



Read More

What is Deep Packet Inspection ?

What is Next Generation Firewall and how is it different from traditional firewalls ?

What is SSL Inspection ?

How does Network Segmentation improve security and what is VLAN ?

What is Intrusion Detection System and how does it work ?

What is Honeypot ?

What is DNSCrypt ?

What is Identity Based Encryption ?

If not redirected, please click here https://www.thesecuritybuddy.com/encryption/what-is-identity-based-encryption/

Encryption technology like DSA, RSA etc use public key cryptography. Every user gets his own public-private keypair using which anyone can start encrypted communication with the user. But, there is a major drawback in these technologies. They mostly depend on public key distribution infrastructure. Every user gets his keypair from a trusted Certificate Authority. And, anyone who wants to start an encrypted communication, has to obtain the public key certificate from the user and verify it with the Certificate Authority before the encrypted communication starts. This process is time consuming, error-prone and causes much inconvenience at times. Identity Based Encryption or IBE is an encryption technology which is developed to reduce these barriers up to a great extent and yet provide secure communications.

Identity Based Encryption or IBE is a type of public key encryption, in which the public key of a user is some unique information based on the identity of the user, such as an email address. Anyone who wants to send an encrypted message to the user, can encrypt it with the text value of the identity based public key, such as the text value of an email address, and send it across. The user can decrypt the message using the private key associated with the identity based public key.

How does Identity Based Encryption work ?

IBE works in the following way :

• A trusted third party called Private Key Generator or PKG first generates his own public-private keypair. It published its public key, called Master Public Key and keeps the private key, called Master Private Key or Master key secret to itself.
• A user who wants to generate a IBE keypair, first obtains the public key of the PKG. The user then combines his identity value, such as his email address, with the Master Public Key and generates the actual public key.
• The user then contacts the PKG with the public key. The PKG combines the user’s public key along with its own Master Private Key to generate the private key of the user.
• Anyone who wants to send an encrypted message to the user can encrypt it with the identity based public key, for example his email address. The user can decrypt it using his private key obtained from the PKG.

Can a user expire his Identity Based Encryption Keys?

Technically, one user can expire his IBE keys.

Suppose, a user named Bob wants to expire his IBE keys every year and he wants to use his email address bob@example.com for that purpose. To do that, Bob can append the current year with his email address, i.e. he can use ‘ bob@example.com | <current year> ‘ as the identity based public key, based upon which the PKG will generate his private key. The private key will be valid for that current year only. After the end of the year, Bob can again change the value of the current year in the identity based public key and obtain the corresponding new private key from the PKG.

Please note that, even if Bob changes his private key, a sender who wants to send encrypted message to Bob need not worry much. He will just change the value of the current year in the identity based public key, here ‘bob@example.com | <current year>’ and encrypt the message with that. Once a user gets his private key from the PKG, neither the user nor the sender need to communicate with the PKG further. And, this is one of the most significant advantages that IBE has.

What if a user’s Identity Based Encryption Keys are lost or stolen ?

Well, this problem also can be handled.

A user can append the current date instead of the current year with his identity, for example email address, to obtain his identity based public key and corresponding private key, as described above.

Now, suppose the user stores his private keys in his laptop and the laptop gets lost for three days. In that case, the private keys corresponding to those three days only will be compromised. The fourth day onwards, he can keep obtaining his new private keys from the PKG as usual and continue with normal operations.

Advantages of Identity Based Encryption

IBE has several advantages :

• If a user Alice wants to send an encrypted message to Bob, who has an email address bob@example.com, she does not need to obtain Bob’s public key certificate or verify it with any Certificate Authority. She can just encrypt the message using the text value of Bob’s email address bob@example.com and send it across. It is much more simple, convenient and less time consuming than any public key encryption technology based on Public Key Infrastructure.
• IBE eliminates the need of Public Key Infrastructure. Authenticity of the public key is implicit as an identity based value is used for that purpose.
• As IBE eliminates the need of certificates, it removes the hurdles of PKI, certificate lookup, key life cycle management, certificate revocation or cross-certification issues. It makes the security system much more dynamic, lightweight and scalable.
• An organization can maintain its own PKG very efficiently. It can issue a private key to every employee based on his corporate email address. And, when an employee leaves the organization, it can simply instruct the PKG not to generate any private keys for that user anymore.
• IBE can be efficiently used in some complex use case scenarios also. For example, suppose an employee has several assistants like purchasing, HR etc, who can read a number of emails if they fall within their responsibilities. In that case, a user can send the encrypted emails using the employee’s email address as well as a subject line indicating the appropriate assistant who would read the email. The PKG can generate a separate private key for each assistant based on the employee’s email address appended with the appropriate assistant and distribute it. As a result, an assistant can read the emails which fall within his responsibility, but not those of the others. And, it will be convenient for the sender also.

Drawbacks of Identity Based Encryption

IBE has a couple of drawbacks. The major ones are given below :

• If a PKG gets compromised, the messages protected by the Master Private Key will also be compromised.
• A PKG generates private keys of all the users using its own Master Private Key. So, technically it can sign or decrypt any message of its users without authorization. But as said earlier, an organization can have its own PKG and trust its administrators to counter this problem.

This was just an introductory article on Identity Based Encryption to give some basic information. Hope you liked it.




Read More

How are S/MIME and PGP different from each other in encrypting emails ?

What is Public Key Infrastructure or PKI ?

What is the difference between Public Key Encryption and Symmetric Key Encryption ?

What is PGP or Pretty Good Privacy ?

How to encrypt and decrypt files using GPG ?

What is Bitmessage and how can it be used to send encrypted messages ?

How to sign and encrypt emails using GPG ?

PGP vs OpenPGP vs GPG - How are they different from each other ?

How to make Digital Signatures of documents using GPG ?

DNS Cookies

If not redirected, please click here https://www.thesecuritybuddy.com/securing-dns/what-is-dns-cookies-and-how-does-it-work/

When we type a URL in the address bar, our computer makes a DNS query to appropriate DNS servers and it gets the corresponding IP address, using which it accesses the target system. Protocols like SSL/TLS, HTTPS can ensure that the communication between the server and the client, after the domain name resolution is done for the server, is encrypted. But, what if an attacker takes advantage of the DNS communication between the client and the DNS server at the time of domain name resolution and affects that to transfer the traffic to malicious servers or make a DoS attack ? DNS Cookies is a security mechanism which is developed for that purpose.

DNS Cookies is a lightweight DNS transaction security mechanism that protects DNS servers and DNS clients from a variety of attacks like DoS attacks, DNS Amplification attacks, DNS Cache Poisoning etc. It is a lightweight mechanism and can work with other existing DNS transaction security mechanisms. It can even work in the presence of NAT and NAT – Protocol Transaction (NAT-PT).

Let’s understand what DNS Cookies is actually and how it works.

Security Concerns of DNS

There are a number of security concerns in the existing DNS system. Some of them are mentioned below :

DNS Server Denial of Service Attack 

 

When a DNS client makes a DNS request to DNS servers, it causes much computaional burden to the DNS serevers. A recursive server may issue one or more requests and process the responses, which takes muc computational resources. The situation may even get worse when DNSSEC is used, as DNSSEC performs many cryptographic computations to verify the authenticity of the DNS transation.

So, if an attacker forges source IP address and sends many DNS requests to the DNS servers, it would be very hard to identify that the requests are forged ones. Moreoevr, it is impossible to restrict IP addresses from which DNS requests should be honored and discarded otherwise.

As a result, an attacker can take advantage of that and send a large number of DNS requests to the DNS servers, so that the DNS servers get exhausted resulting in a DoS attack.

DNS Cache Poisoning

For the first time we type a URL in the addressbar, our computer will make a DNS query to appropriate DNS Server and once it gets a response, it will store the IP address in its DNS Cache, with a timestamp upto which the entry remains valid.

Within that time, if we type google.com again, our computer will look at its DNS Cache for the entry.

Suppose, our computer has made a DNS query and waiting for a response from the DNS Servers. But, instead of an authentic response it gets a response containing IP address of the attacker's website. So, its DNS Cache will be poisoned and next time onwards, whenever the computer will try to resolve the IP address of the same URL, it will end up being to the attacker's website.

In similar way, DNS Cache of any DNS Server also may get poisoned. Because, ISP's DNS Server gets response from other DNS Servers and it stores the responses in its cache. If that cache is poisoned, the same poisoned entry will spread to all home routers and from them to all computers.

DNS Amplification Attack

If an attacker sends lots of DNS queries to DNS servers, but forges the IP address of a victim machne as the source IP address of all the packets, lots of DNS responses will be generated by the servers and all of them will reach the victim machine. Normally without any security mechanism, DNS servers cannot find out if the source IP of a DNS request is a forged one. As a result, as DNS responses are much larger in size, the responses will end up flooding the victim machine with responses and consuming its bandwidth. And, it will cause a DoS attack to the victim machine.

Existing DNS Security

There are a number of existing security mechanisms which can be used to secure DNS transactions. But, each of them has its own disadvantages.

For example, DNSSEC (How does DNSSEC work ?) is a security extension which can be used to verify the authenticity of a DNS transaction. DNSSEC can ensure that the response coming from a DNS server is an authentic one and it no doubt protects us from attacks like DNS Hijacking and DNS Cache Poisoning.

But, as mentioned earlier, DNSSEC performs many cryptographic computations to ensure security, which increases the computaional burden on the DNS servers. As a result, if an attacker forges IP addresses and sends many DNS requests to the DNS servers, it will aggravate the situation and can easily cause a DoS attack.

Another security mechanism is Transaction Signature or TSIG (How does TSIG work ? ) It uses cryptographic keys to establish a trust relationship between a DNS client and a DNS server and secure the DNS transation. TSIG provides good security, but it is non-trivial to deploy. It imposes much burden to the existing DNS system like the burden of pre-agreement and distribution of cryptoraphic keys, keeping track of server side key state and synchronization between a DNS client and a DNS server.

DNS Cookies is a lightweight security mechanism, which can be implemented easily with the existing DNS system and can work together with other security mechanisms. It does not have much overhead of pre-configuration etc.

How does DNS Cookies work ?

In DNS Cookies mechanism, each DNS server and each DNS client maintain a cookie. Each of them maintains a different cookie which can be used at the time of DNS transaction to make sure that the DNS request has indeed come from an authentic DNS client and its source IP address is not forged.

A client cookie is 8 byte long and it is a pseudorandom function of client IP, server IP and a secret quantity known only to the client. This pseudorandom function is secret to the client and can be changed periodically. Each DNS client will have a different cookie, which can be used with the DNS request to verify its authenticity. As a DNS cookie is only returned to the IP address from which the request was generated, it cannot be used to track internet users.

Similarly, each DNS server with different IP will have a different server cookie. This server cookie is a pseudoransom function of client cookie, client IP and a secret quntity known only to the server. This pseudorandom function is secret to the server and can be changed periodically. A DNS server must send different cookies for different clients.

DNS Cookies mechanism works in the following way :

• A DNS client sends a DNS request and includes its client cookie along with the request. If it knows the server cookie, it sends the server cookie along with its own cookie.
• The server receives the DNS request from the client with the client cookie. If the DNS request contains only the client cookie and not any server cookie, the server calculates a server cookie using the secret pseudorandom function using the client IP, received client cookie and the secret quantity known to the server. The server then processes the request and sends its cookie to the client, so that the client can refer it in future communications.
  On the other hand, if the server receives a server cookie along with the client cookie, it will verify the cookie and then process the request. It will then generate a response and send that along with the new server cookie if it generates one.
• Different DNS clients behind a NAT box can use their own local IP addresses to have different client cookies. And, based upon these diferent client cookies, different server cookies can be generated which can be used in the DNS transactions without much confusion.

So, be aware of different security mechanisms so that you can protect your systems in a better way and stay safe, stay secured.

Read More

What is DNSCrypt and how does it work ?

What is DNSSEC and how does it work ?

What is Dynamic DNS and how can Transaction Signature or TSIG make it more secure ?

What is DNS Cache Poisoning ?

What is DNS Hijacking ?

How can attackers steal sensitive data transferred over unencrypted emails using DNS Hijacking ?

What are the security concerns of DNS ?

What is Web Application Firewall and how does it work ?

How does Network Segmentation improve security and what is VLAN ?