Timestamps and sequence numbers act as countermeasures against which of the following types of
attacks?
A.
Smurf
B.
DoS
C.
Vishing
D.
Replay
Explanation:
A replay attack (also known as playback attack) is a form of network attack in which a valid data
transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator
or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by
IP packet substitution (such as stream cipher attack).
For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of
identity, which Alice dutifully provides (possibly after some transformation like a hash function);
meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the
interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends
Alice’s password (or hash) read from the last session, which Bob accepts thus granting access to Eve.
Countermeasures: A way to avoid replay attacks is by using session tokens: Bob sends a one-time token to
Alice, which Alice uses to transform the password and send the result to Bob (e.g. computing a hash
function of the session token appended to the password). On his side Bob performs the same
computation; if and only if both values match, the login is successful. Now suppose Eve has captured this
value and tries to use it on another session; Bob sends a different session token, and when Eve replies
with the captured value it will be different from Bob’s computation.
Session tokens should be chosen by a (pseudo-) random process. Otherwise Eve may be able to pose as
Bob, presenting some predicted future token, and convince Alice to use that token in her transformation.
Eve can then replay her reply at a later time (when the previously predicted token is actually presented by
Bob), and Bob will accept the authentication.
One-time passwords are similar to session tokens in that the password expires after it has been used or
after a very short amount of time. They can be used to authenticate individual transactions in addition to
sessions. The technique has been widely implemented in personal online banking systems.
Bob can also send nonces but should then include a message authentication code (MAC), which Alice
should check.
Timestamping is another way of preventing a replay attack. Synchronization should be achieved using a
secure protocol. For example Bob periodically broadcasts the time on his clock together with a MAC.
When Alice wants to send Bob a message, she includes her best estimate of the time on his clock in her
message, which is also authenticated. Bob only accepts messages for which the timestamp is within a
reasonable tolerance. The advantage of this scheme is that Bob does not need to generate (pseudo-)
random numbers, with the trade-off being that replay attacks, if they are performed quickly enough i.e.
within that ‘reasonable’ limit, could succeed.Incorrect Answers:
A: A smurf attack is a type of network security breach in which a network connected to the Internet is
swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet
broadcast address. These are special addresses that broadcast all received messages to the hosts
connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request
can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the
attacker’s victim. All the hosts receiving the PING request reply to this victim’s address instead of the real
sender’s address. A single attacker sending hundreds or thousands of these PING messages per second
can fill the victim’s T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees.
Smurfing falls under the general category of Denial of Service attacks — security attacks that don’t try to
steal information, but instead attempt to disable a computer or network. Timestamps are not used to
defend against this type of attack.
B: DoS, short for denial-of-service attack, a type of attack on a network that is designed to bring the
network to its knees by flooding it with useless traffic. Many DoS attacks, such as the Ping of Death and
Teardrop attacks, exploit limitations in the TCP/IP protocols. For all known DoS attacks, there are
software fixes that system administrators can install to limit the damage caused by the attacks. But, like
viruses, new DoS attacks are constantly being dreamed up by hackers. Timestamps are not used to
defend against this type of attack.
C: Vishing is the telephone equivalent of phishing. Vishing is the act of using the telephone in an attempt
to scam the user into surrendering private information that will be used for identity theft. The scammer
usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit.
Timestamps are not used to defend against this type of attack.http://en.wikipedia.org/wiki/Replay_attack
http://www.webopedia.com/TERM/S/smurf.html
http://www.webopedia.com/TERM/D/DoS_attack.html
http://www.webopedia.com/TERM/V/vishing.html