CNS - Unit - 10 - Web Security Threats and Approaches

Web Security threats and approaches, SSL architecture and protocol, Transport layer security, HTTPS and SSH

1. Cryptography and Network Security
UNIT - 10

Web Security

2. Outline...

+ Web Security Threats and Approaches
* SSL Architecture and Protocol

* Transport Layer Security

« HTTPS and SSH

3. Web Security Threats

*The World Wide Web is fundamentally a client/server application
running over the Internet and TCP/IP intranets.

* The Web presents new challenges not generally appreciated in the
context of computer and network security.

+ The Internet is two-way. Unlike traditional publishing environments
even electronic publishing systems involving teletext, voice response,
or fax-back the Web is vulnerable to attacks on the Web servers over
the Internet.

* The Web is increasingly serving as a highly visible outlet for corporate
and product information and as the platform for business
transactions. Reputations can be damaged and money can be lost if
the Web servers are subverted.

4. Web Security Threats

* Although Web browsers are very easy to use, Web servers are relatively
easy to configure and manage, and Web content is increasingly easy to
develop, the underlying software is extraordinarily complex. This complex
software may hide many potential security flaws.

+ A Web server can be exploited as a launching pad into the corporation’s or
agency’s entire computer complex. Once the Web server is subverted, an
attacker may be able to gain access to data and systems not part of the
Web itself but connected to the server at the local site.

+ Casual and untrained (in security matters) users are common clients for
Web-based services. Such users are not necessarily aware of the security
risks that exist and do not have the tools or knowledge to take effective
countermeasures.

5. Web Security Threats

* The types of security threats faced when using the Web. One way to
group these threats is in terms of passive and active attacks.

* Another way to classify Web security threats is in terms of the
location of the threat: Web server, Web browser, and network traffic
between browser and server.

* Issues of server and browser security fall into the category of
computer system security.

6. Web Security Threats

Threats Consequences ‘Countermeasures
Integrity + Modification of user data Loss of information Cryptographic
+ Trojan horse browser ‘Compromise of machine Geer
+ Modification of memory Vulnerabilty to all other
+ Modification of message threats
traffic in transit
[Confidentiality | + Eavesdropping on the net Loss of information Encryption, Web
+ Theft of info from server Loss of privacy HORS
+ Theft of data from client
+ Info about network
configuration
+ Info about which client
talks to server
Denial of + Killing of user threads Disruptive Difficult to prevent
a + Flooding machine with Annoying
bogus requests Prevent user from getting
+ Filling up disk or memory work done
+ Isolating machine by DNS
attacks.
Authentication | + Impersonation of legitimate | + Misrepresentation of user Cryptographic
users Belief that false information unas.
+ Data forgery is valid

7. Web Security Threats

EZ
Dune | ree | SMTP SSL or TLS

IP/IPSec

* One way to provide Web security is to use IP security (IPsec).

* The advantage of using IPsec is that it is transparent to end users and
applications and provides a general-purpose solution.

» IPsec includes a filtering capability so that only selected traffic need
incur the overhead of IPsec processing.

8. Web Security Threats

+ Another relatively general-purpose solution is to implement security
just above TCP.

* The foremost example of this approach is the Secure Sockets Layer
(SSL) and the follow-on Internet standard known as Transport Layer
Security (TLS).

+ Application-specific security services are embedded within the
particular application.

* The advantage of this approach is that the service can be tailored to
the specific needs of a given application.

9. SSL Architecture

+ SSLis developed by Netscape communication.

* This first published version of TLS can be viewed as essentially an
SSLv3.1 and is very close to and backward compatible with SSLv3.

* SSL is an internet layer protocol used for securely exchanging the
information between client’s web browser and the web server.

+ SSL ensures that authentication, integrity and confidentiality between
web browser and web server.

« SSL is designed to make use of TCP to provide a reliable end-to-end
secure service.

* It creates tunnel between client and server.

10. SSL Architecture

* The SSL Record Protocol provides basic security services to various
higher layer protocols. In particular, the Hypertext Transfer Protocol
(HTTP), which provides the transfer service for Web client/server
interaction, can operate on top of SSL.

* Three higher-layer protocols are defined as part of SSL: the
Handshake Protocol, The Change Cipher Spec Protocol, and the Alert
Protocol.

* SSL encrypt the data received from application layer of client machine
and add its own header (SSL header) into the encrypted data and
send encrypted data to the server side.

11. SSL Architecture

*Two important SSL concepts are the SSL session and the SSL
connection, which are defined in the specification as follows.

* Connection: A connection is a transport (in the OSI layering model
definition) that provides a suitable type of service. For SSL, such
connections are peer-to-peer relationships. The connections are
transient. Every connection is associated with one session.

* Session: An SSL session is an association between a client and a
server. Sessions are created by the Handshake Protocol. Sessions
define a set of cryptographic security parameters which can be
shared among multiple connections.

12. SSL Architecture

SSL | ssi Chang]
SSL Alert
Handshake | Cipher Spec Do
Protocol Protocol

SSL Record Protocol

13. SSL Handshake Protocol

* The first sub protocol of SSL called handshake protocol used for
secure communication between client and the server using an SSL
enable connection.

* The handshaking is done 4 phases:
Establishing security capabilities

. Server Authentication and key exchange
. Client authentication and key exchange

. Finalizing and finishing

14. SSL Handshake Protocol

15. SSL Handshake Protocol

* Phase 1: Establishing security capabilities
1. Client Hello:

1,
ra
3:

The highest SSL version number which the client can support.

A session ID that defines the session.

There is a cipher suite parameter that contains the entire
cryptographic algorithm which supports client’s system.

A list of compression methods that can be supported by client
system.

16. SSL Handshake Protocol

2. Server Hello:

1. The highest SSL version number which the server can support.

2. Asession ID that defines the session.

3. A cipher suite contains the list of all cryptographic algorithms
that is sent by the client which the server will select the
algorithm.

4. A list of compression method sent by the client from which the
server will select the method.

17. SSL Handshake Protocol

* Phase 2: Server Authentication and Key Exchange

* In this phase, the server authenticates itself if it is needed. The server
sends its certificate, public key and request of client’s digital
certificate.

1. Certificate: The server sends a certificate message to authentication
itself to the client. If the key exchange algorithm is Diffie-Hellman
than no need of authentication.

2. Server key exchange: This is optional. It is used only if the server
doesn’t sends its digital certificate to client.

3. Certificate Request: The server can request for the digital certificate of
client. The client’s authentication is optional.

18. SSL Handshake Protocol

4. Server Hello Done: The server message hello done is the last message
in phase 2, this indicates to the client that the client can now verify
all the certificates received by the server. After this hello message
done, the server waits for the client side response in phase 3.

19. SSL Handshake Protocol

* Phase 3: Client Authentication and Key Exchange

* In this phase, the client authentication is needed. The client sends its

certificate, client key exchange and certificate verify to the server.

1. Certificate: It is optional, it is only required if the server had
requested for the client’s digital certificate. If client doesn’t have
certificate it can be send no certificate message. Then it is upto
server’s decision whether to continue with the session or to abort
the session.

2. Client key exchange: The client sends a client key exchange, the
contents in this message are based on key exchange algorithms
between both the parties.

20. SSL Handshake Protocol

3. Certificate Verify: It is necessary only if the server had asked for client
authentication. The client has already sent its certificate to the
server. Bit additionally if server wants then the client has to prove
that it is authorized holder of the private key. The sever can verify
the message with its public key already sent to ensure that the
certificate belongs to client.

21. SSL Handshake Protocol

* Phase 4: Finish

* The client and server send messages to finish the handshaking
protocol. It contains 4 steps. The first two messages are from the
client i.e. Change Cipher Specs, finished. The server responds back
with change cipher specs and finished.

1. Change cipher spec: It is a client side messages telling about the
current status of cipher protocols and parameters which has been
made active from pending state.

2. Finished: This message announce the finish of the handshaking
protocol from client side.

22. SSL Handshake Protocol

Change cipher spec: This message is sent by server to show that it has
made all the pending state of cipher protocols and parameters to
active state.

Finished: This message announce the finish of the handshaking
protocol from server and finally handshaking is totally completed.

23. SSL Record Protocol

SSL record protocol is second sub-protocol of SSL also called lower
level protocol.

After completion of successful SSL handshaking the keen role of SSL
record protocol starts now.

As defined earlier the SSL record protocol is responsible for
encrypted data transmission and encapsulation of the data sent by
the higher layer protocols also to provide basic security services to
higher layer protocols.

SSL records protocol provides different service like data
authentication; data confidentiality through encryption algorithm
and data integrity through message authentication to SSL enabled
connections.

24. SSL Record Protocol - Format

Content | Major Compressed
Type | Version Length

encrypted

25. SSL Record Protocol - Operation

Application data
/ \
/ “1 \ \
Fragment
esi ZL,

Encrypt

Append SSL
record header

26. SSL Record Protocol

The record protocol provides two services in SSL connection:

. Confidentiality: This can be achieved by using secret key, which is
already defined by handshake protocol.

. Integrity: The handshake protocol defines a shared secret key that is
used to assure the message integrity.

Following are the operation performed in Record protocol after
connection is established and authentication is done of both client
and server.

. Fragmentation: The original message that is to be sent it broken
into blocks. The size of each block is less than or equal to 21 bytes.

27. SSL Record Protocol

. Compression: The fragmented blocks are compressed which is
optional. It should be noted that the compression process must not
result into loss of original data.

. Addition of MAC: A short piece of information used to authenticate
a message for integrity and assurance of message.

. Encryption: The overall steps including message is encrypted using
symmetric key but the encryption should not increase the overall
block size.

. Append Header: After all the above operation, header is added in
the encrypted block which contains following fields.

28. SSL Record Protocol

. Content type: It specifies which protocol is used for processing.

. Major version: It specifies the major version of SSL used, for
example if SSL version 3.1 is in use than this field contains 3.

Minor version: It specifies minor version of SSL used, for example
version 3.0 is in use than field contains 0.

. Compressed length: It specifies the length in bytes of the original
plain text block.

29. SSL Alert Protocol

The Alert Protocol is used to convey SSL-related alerts to the peer
entity. As with other applications that use SSL, alert messages are
compressed and encrypted, as specified by the current state.

The first byte takes the value warning (1) or fatal (2) to convey the
severity of the message. If the level is fatal, SSL immediately
terminates the connection.

Other connections on the same session may continue, but no new
connections on this session may be established.

The second byte contains a code that indicates the specific alert.

30. SSL Alert Protocol

Fatal alerts:

Unexpected message: It raised when inappropriate messages are
received.

Bad record MAC: It raised when message received with incorrect
MAC.

Handshake failure: It raised when the sender is unable to negotiate
an acceptable set of security parameters from options.
Decompression Failure: It raised when decompression function
cannot be completed.

Illegal parameters: It raised when the field in Handshake message is
out of range.

31. SSL Alert Protocol

Non-fatal alerts:

Certificate expired: It raised when certificate expired.

Certificate revoked: It raised when signer of certificate invoked it.
Certificate unknown: It raised when an unspecified error occurred
while processing certificate.

Bad certificate: It raised when a certificate is corrupted.

Unsupported certificate: It raised when Certificate types do not
support.

Close notify: This alert notifies that sender will not send any more
messages in this connection.

No certificate: It raised when appropriate certificate is not available.

32. Transport Layer Security

TLS is an IETF standardization initiative whose goal is to produce an
Internet standard version of SSL.

Transport Layer Security (TLS) is a feature of mail servers designed
to secure the transmission of E-mail from one server to another
using encryption.

TLS can reduce the risk of eavesdropping tampering and message
forgery mail communication.

The second byte contains a code that indicates the specific alert.

33. Transport Layer Security

For transmission of message on internet, a browser needs:

Make sure that server belongs to registered vendor.

Content of message are not modified during transmission.

Make sure that the impersonation does not interpret sensitive
information such as credit card number.

TLS has two protocols

Handshake: Responsible for negotiating security, authenticating the
server to the browser and defining other communication
parameters. The TLS handshake protocol allows authentication
between client and server and also communicate related to

encryption algorithm and key exchange before the application
transmit any data.

34. Transport Layer Security

2. Data exchange (Record Protocol): Record protocol uses the secret
key to encrypt the data for secrecy and to encrypt the message
digest for integrity. The TLS record protocol is designed to protect
confidentiality by using symmetric data encryption.

» There are two differences between the SSLv3 and TLS MAC
schemes: the actual algorithm and the scope of the MAC
calculation.

* TLS makes use of the HMAC algorithm:

HMAC,(M)= H[ (K* ® opad)| | H[(K* € ipad)| | M] ]

35. Hypertext Transfer Protocol Secure (HTTPS)

HTTPS (HTTP over SSL) refers to the combination of HTTP and SSL to
implement secure communication between a Web browser and a
Web server.

The principal difference seen by a user of a Web browser is that URL
(uniform resource locator) addresses begin with https:// rather than
http://.

A normal HTTP connection uses port 80. If HTTPS is specified, port
443 is used, which invokes SSL.

36. Hypertext Transfer Protocol Secure (HTTPS)

When HTTPS is used, the following elements of the communication
are encrypted:

URL of the requested document

Contents of the document

Contents of browser forms (filled in by browser user)

Cookies sent from browser to server and from server to browser
Contents of HTTP header

There is no fundamental change in using HTTP over either SSL or
TLS, and both implementations are referred to as HTTPS.

37. HTTPS - Connection Initiation

For HTTPS, the agent acting as the HTTP client also acts as the TLS
client. The client initiates a connection to the server on the
appropriate port and then sends the TLS ClientHello to begin the TLS
handshake.

When the TLS handshake has finished, the client may then initiate
the first HTTP request. All HTTP data is to be sent as TLS application
data.

We need to be clear that there are three levels of awareness of a
connection in HTTPS.

At the HTTP level

At the level of TLS

At the level of TCP

38. HTTPS - Connection Closure

An HTTP client or server can indicate the closing of a connection by
including the following line in an HTTP record: Connection: close.
This indicates that the connection will be closed after this record is
delivered.

The closure of an HTTPS connection requires that TLS close the
connection. At the TLS level, the proper way to close a connection is
for each side to use the TLS alert protocol to send a close_notify
alert.

This should only be done when the application knows that it has
received all the message data that it cares about.

HTTP clients also must be able to manage with a situation in which
the underlying TCP connection is terminated without a prior
close_notify alert and without a Connection: close indicator.

39. HTTPS - Connection Closure

+ However, the unannounced TCP closure could be evidence of some
sort of attack. So the HTTPS client should issue some sort of security
warning when this occurs.

40. Secure Shell (SSH)

Secure Shell (SSH) is a protocol for secure network communications
designed to be relatively simple and inexpensive to implement.

The initial version, SSH 1 was focused on providing a secure remote
logon facility to replace

SSH also provides a more general client/server capability and can be
used for such network functions as file transfer and e-mail.

A new version, SSH2, fixes a number of security flaws in the original
scheme.

SSH client and server applications are widely available for most
operating systems.

It has become the method of choice for remote login and X
tunneling and is rapidly becoming one of the most pervasive
applications for encryption technique.

41. Secure Shell (SSH)

+ SSH is organized as three protocols that typically run on top of TCP

SSH User SSH
Authentication Protocol | Connection Protocol
Multiplexes the encrypted
tunnel into several logical
channels

Authenticates the client side
ser to the server.

ransport Layer Protocol

Provides server authentication, confidentiality, and integrity.
It may optionally also provide compression.

TCP
‘Transmission control protocol provides reliable, connection
oriented end-to-end delivery

Internet protocol provides datagram delivery across
multiple networks,

42. Secure Shell (SSH)

SSH Transport Layer Protocol: Provides server authentication, data
confidentiality, and data integrity with forward secrecy (i.e., if a key
is compromised during one session, the knowledge does not affect
the security of earlier sessions).The transport layer may optionally
provide compression.

SSH User Authentication Protocol: Authenticates the user to the
server.

The client sends a SSH_MSG_USERAUTH_REQUEST with a requested
method of none.

The server checks to determine if the user name is valid. If not, the
server returns SSH_MSG_USERAUTH_FAILURE with the partial
success value of false. If the user name is valid, the server proceeds
to step 3.

43. Secure Shell (SSH)

The server returns SSH_MSG_USERAUTH_FAILURE with a list of one
or more authentication methods to be used.

The client selects one of the acceptable authentication methods and
sends a SSH_MSG_USERAUTH_REQUEST with that method name
and the required method-specific fields. At this point, there may be
a sequence of exchanges to perform the method.

If the authentication succeeds and more authentication methods
are required, the server proceeds to step 3, using a partial success
value of true. If the authentication fails, the server proceeds to step
3, using a partial success value of false.

When all required authentication methods succeed, the server
sends a SSH_MSG_USERAUTH_SUCCESS message, and the
Authentication Protocol is over.

44. Secure Shell (SSH)

SSH Connection Protocol: The SSH Connection Protocol runs on top
of the SSH Transport Layer Protocol and assumes that a secure
authentication connection is in use.

That secure authentication connection, referred to as a tunnel is
used by the Connection Protocol to multiplex a number of logical
channels.