CS ASSIGNMENTS
1) what is the concept of non-repudiation in Cyber Security? How is it achieved using asymmetric
encryption? Assume that a banking application has not implemented the non-repudiation security concept
in it. Give an example security issue that may arise due to this flaw in the banking application.
ANS)Non-repudiation in cyber security is the assurance that someone cannot deny the validity of their
signature on a document or the sending of a message. It ensures that the parties involved in a
communication cannot later claim they did not send or receive the information. This is crucial in transactions,
especially in banking, to prevent disputes over actions taken.
Non-repudiation is achieved using asymmetric encryption through the use of digital signatures. In this
process, a sender creates a hash of the message and encrypts it with their private key, creating a digital
signature. The recipient can then decrypt the signature using the sender's public key, verifying that the
message was indeed sent by the sender and has not been altered. This process ensures that the sender
cannot deny having sent the message since only their private key could have created that specific signature.
If a banking application does not implement non-repudiation, a potential security issue could arise where a
user transfers funds to another account but later denies having authorized the transaction. This could lead to
disputes between the bank and the user, resulting in financial losses for the bank and undermining trust in
the banking system. Without non-repudiation, it becomes challenging to prove whether a transaction was
genuinely authorized by the user.
2) The SeImpersonate privilege of Windows token allows the user to impersonate other user’s token.
Give an example application of this security concept.
ANS)The SeImpersonate privilege in Windows allows a user to impersonate another user's security token,
which can be useful in various scenarios. One common application of this security concept is in client-server
architectures, particularly in web applications or services that need to access resources on behalf of a user.
For example, consider a web application that allows users to access their files stored on a server. When a
user logs into the application, the server may need to access the user’s files in a secure manner. By using the
SeImpersonate privilege, the web server can impersonate the user’s token, allowing it to access the file
system with the same permissions as the user. This ensures that the server can only access files that the user
is authorized to view, maintaining security and privacy.
If the application did not use this privilege, the server might have to run with elevated privileges, potentially
exposing sensitive data or allowing unauthorized access to files that belong to other users. Thus,
SeImpersonate helps enforce proper access controls while providing the necessary functionality for the
application.
3)Explain the six security concepts of information assurance. How authentication is implemented using
asymmetric encryption? How a secret key can be shared using asymmetric encryption?
ANS)The six security concepts of information assurance are:
1. Confidentiality: Keeping sensitive information private and accessible only to authorized users, often
through encryption.
2. Integrity: Ensuring that information remains accurate and unaltered during storage or transmission,
typically verified using hashing.
3. Availability: Making sure that information and resources are available to authorized users when needed,
protected from attacks like denial-of-service.
4. Authentication: Verifying the identity of users or systems before granting access, using methods like
passwords or cryptographic techniques.
5. Non-repudiation: Ensuring that a user cannot deny their actions, often achieved through digital signatures.
6. Accountability: Tracking actions back to the responsible user or system through logging and monitoring.
### Authentication Using Asymmetric Encryption
Authentication with asymmetric encryption works through digital signatures. Here’s a simple breakdown:
1. The sender creates a hash of their message.
2. They encrypt this hash with their private key, creating a digital signature.
3. The sender sends the original message along with the digital signature to the recipient.
4. The recipient decrypts the signature with the sender's public key to get the hash.
5. The recipient also hashes the received message. If both hashes match, it confirms the message's
authenticity and the sender's identity.
### Sharing a Secret Key Using Asymmetric Encryption
To share a secret key using asymmetric encryption, follow these steps:
1. The recipient generates a public-private key pair.
2. The recipient shares their public key with the sender.
3. The sender creates a secret key and encrypts it using the recipient's public key.
4. The sender sends the encrypted secret key to the recipient.
5. The recipient uses their private key to decrypt the secret key.
This method ensures that only the intended recipient can access the secret key, keeping it secure.
4)What prevents the attacker to decipher the cipher text in RSA algorithm?
ANS)In RSA encryption, the strength lies in the difficulty of factoring large numbers. Here’s a breakdown of
why this prevents attackers from deciphering the ciphertext:
1. Public and Private Keys: RSA uses a pair of keys—public for encryption and private for decryption. The
public key includes a large modulus n (the product of two primes, p and q) and an exponent e. The private
key requires knowing p and q, which remain secret.
2. Trapdoor Function: RSA’s security relies on a trapdoor function that is easy to compute in one direction
(encryption with the public key) but hard to reverse without the private key.
3. Difficulty of Factoring: An attacker would need to factor n to find p and q. For sufficiently large n, this
factorization is computationally infeasible with current technology.
4. Choice of Exponent e: A small e (e.g., 3 or 65537) makes encryption efficient, but knowing e alone doesn’t
allow decryption without the private exponent d, which depends on p and q.
Overall, the combination of these factors ensures that even if the public key is known, the private key
remains secure, making it extremely difficult for attackers to decipher the ciphertext without access to the
private key.
5) The DNS has the weakness of allowing the attackers to implement phishing attack. Elaborate on this
weakness and the ill-effects of this phishing attack.
ANS) The Domain Name System (DNS) helps turn website names into numbers that computers understand.
However, it has some weaknesses that attackers can use to trick people, especially through phishing attacks.
Here’s a simpler explanation of how this happens and its effects:
1. DNS Spoofing: Attackers can change the information in DNS to send users to fake websites instead of the
real ones. This is often done by tricking the system that stores DNS information.
2. Fake Websites: When users are sent to these fake sites, they look very similar to the real ones. These sites
are designed to steal your information, like passwords or credit card numbers, by tricking you into entering
them.
3. Loss of Personal Information: The main problem with phishing attacks is that attackers can get your
personal and financial information. This can lead to identity theft, where someone pretends to be you to
steal your money or commit fraud.
4. Damage to Reputation: For businesses, if they get attacked, it can hurt their reputation. Customers may
lose trust in them, which can lead to fewer sales and long-lasting damage to their image.
5. Financial Loss: Both individuals and companies can lose a lot of money because of phishing. This includes
stolen money, costs to recover from the attack, and potential legal issues.
6. Spread of Malware: Sometimes, phishing attacks can also spread harmful software. If users accidentally
download this software, it can damage their devices and lead to more security problems.
In short, weaknesses in DNS can lead to phishing attacks that result in stolen information, financial losses,
damage to reputation, and the spread of harmful software. It’s important for everyone to be careful and use
security measures to protect themselves from these risks.
6) Encrypt the message ‘G-20 summit’ using Caesar Cipher (ROT13 algorithm)
ANS)To encrypt the message "G-20 summit" using the Caesar Cipher with a ROT13 algorithm, you shift each
letter by 13 places in the alphabet. Here’s how it works:
1. G** becomes **T
2. -* remains *- (punctuation stays the same)
3. 2** remains **2 (numbers stay the same)
4. 0** remains **0
5. s** becomes **f
6. u** becomes **h
7. m** becomes **z
8. m** becomes **z
9. i** becomes **v
10. t** becomes **g
Putting it all together, "G-20 summit" becomes "T-20 fhzzvg" after applying ROT13.
7) How the attacker may exploit the frequency of letters in the English language to break the key used in
Caesar Cipher.
ANS) Attackers can break the Caesar Cipher by looking at how often letters appear in the English language.
Here's a simpler way to understand it:
1. Common Letters: In English, some letters are used more than others. For example, 'E' is the most common
letter, followed by 'T', 'A', and 'O'.
2. Counting Letters: The attacker looks at the encrypted message and counts how many times each letter
shows up. This gives them a list of which letters are most common in the encrypted text.
3. Making Guesses: They compare this list to the common letters in English. If they see that a certain letter,
like 'X', appears a lot, they might guess that it stands for 'E'.
4. Finding the Shift: Once they have a guess, they can figure out how many places the letters were shifted.
For example, if 'X' is guessed to be 'E', they can see how far 'X' is from 'E' in the alphabet to find the shift
number.
5. Decrypting the Message: With the shift number known, they can change all the letters back to their
original forms, revealing the message.
This method works well, especially if the message is long enough for patterns to show up. That's why using a
simple Caesar Cipher isn't very secure.
8) How does the ‘Cipher Block Chaining (CBC)’ mode of encryption overcomes the weakness of stream
cipher?
ANS) Cipher Block Chaining (CBC) mode of encryption is better than stream ciphers for a few simple reasons:
1. Blocks of Data: Instead of dealing with one bit or small piece of data at a time, CBC works with larger
chunks called blocks. This makes it harder for attackers to guess what the data is.
2. Linking Blocks Together: In CBC, each block of data is mixed with the block that came before it before
being encrypted. This means that if the same piece of data appears again, it will look different when
encrypted because it’s mixed with different previous data. This helps hide patterns that attackers might look
for.
3. Random Start: CBC uses a random starting point called an initialization vector (IV) for the first block. This
means that even if the same data is encrypted multiple times, it will look different each time because of this
random start. This adds extra security.
4. Error Handling: If there’s a mistake during the process, it affects not just the block with the mistake but
also the next one. This makes it harder for someone to change the data without being noticed.
These features make CBC mode more secure than stream ciphers, helping to keep the data safe from attacks.
9) The disadvantage of stream cipher is that it leaves patterns in the cipher text which the attacker can
exploit to understand the same key used throughout the encryption process of whole message. How does
the ‘Cipher Block Chaining (CBC)’ mode of encryption overcomes this weakness of symmetric encryption?
ANS) Cipher Block Chaining (CBC) mode of encryption helps overcome the weakness of stream ciphers, which
can leave patterns in the ciphertext that attackers might exploit. Here’s how CBC addresses this issue:
1. Linking Blocks: In CBC, each block of plaintext is combined with the previous block of ciphertext before
being encrypted. This means that even if the same plaintext block appears multiple times, it will look
different in the ciphertext because it’s affected by the previous block. This linking makes it hard for attackers
to find patterns.
2. Random Initialization Vector (IV): CBC uses a random starting point called an initialization vector (IV) for
the first block of data. This IV is different each time you encrypt, so even if you encrypt the same plaintext
with the same key, the output will be different. This randomness helps to hide any patterns that could be
detected in the ciphertext.
3. Fixed Block Size: By working with fixed-size blocks, CBC ensures that the encryption process is consistent.
Each block is processed in the same way, but because of the chaining and the IV, the overall output looks
very different, making it harder for attackers to analyze.
These features make CBC more secure against attacks that try to exploit patterns in the ciphertext, helping to
protect the data better than stream ciphers.
10)How to address the issues of malicious use of Windows messages? What type of malware can the
attackers develop using the malicious use of Windows messages?
ANS) To address the issues of malicious use of Windows messages, here are some strategies:
1. Input Validation: Always validate the input coming from Windows messages. This means checking if the
data is what you expect before processing it. By ensuring that only valid messages are handled, you can
reduce the risk of attacks.
2. Access Control: Implement strict access control measures. Only allow trusted applications to send and
receive Windows messages. This can help prevent unauthorized programs from exploiting Windows
messaging.
3. Use of Security Features: Utilize security features provided by the Windows operating system, such as
User Account Control (UAC) and Windows Defender. Keeping the system updated with the latest security
patches is also crucial.
4. Monitoring and Logging: Set up monitoring and logging to track Windows messages. This can help identify
any unusual activity that might indicate an attack or misuse of Windows messages.
5. Code Review and Testing: Regularly review and test your code for vulnerabilities related to Windows
messages. This includes looking for buffer overflows or improper handling of messages.
As for the types of malware that attackers can develop using the malicious use of Windows messages, here
are a few examples:
1. Keyloggers: Malware that captures keystrokes by intercepting Windows messages can be used to steal
sensitive information like passwords.
2. Remote Access Trojans (RATs): Attackers can use Windows messages to control a victim's computer
remotely, allowing them to perform actions without the user’s consent.
3. Denial of Service (DoS): By flooding a target application with a large number of Windows messages,
attackers can cause it to crash or become unresponsive.
4. Spyware: Malware can use Windows messages to gather information about the user's activity and send it
back to the attacker.
By implementing these strategies and being aware of the potential threats, you can better protect against
the malicious use of Windows messages.
11)A key logger is a malware that keeps records of your keystrokes secretly. What is the weakness in
Windows Operating System that allows the attacker to develop the key loggers?
ANS) The weakness in the Windows Operating System that allows attackers to develop keyloggers primarily
revolves around the way Windows handles input and messaging. Here are some key points:
1. Windows Message System: Windows uses a message-passing system for communication between
applications. This system can be exploited by keyloggers to intercept keystrokes before they reach the
intended application. If the keylogger can hook into the message queue, it can capture keystrokes easily.
2. Low-Level Keyboard Hooks: Windows allows the installation of low-level keyboard hooks, which are
functions that can intercept keyboard input at a low level. While this feature is intended for legitimate
applications (like accessibility tools), it can also be abused by malware to log keystrokes.
3. Lack of Proper Security Measures: While Windows has introduced several security features over the years,
many older versions of Windows lacked robust security measures to prevent unauthorized access to system
resources. This made it easier for malicious software to operate undetected.
4. User Privileges: If a user runs applications with administrative privileges, malware can gain higher access
levels, allowing it to install keyloggers without being detected by standard security software.
5. Insecure APIs: Some APIs in Windows do not have adequate security checks, allowing malicious software
to exploit them to gain access to sensitive information, including keystrokes.
To mitigate these weaknesses, it's essential to keep the operating system updated, use strong security
software, and practice safe browsing habits.
12) The major issue with symmetric encryption is sharing of the secret key between the sender and
receiver. How does this problem addressed by asymmetric encryption?
ANS)The problem of sharing a secret key in symmetric encryption is addressed by asymmetric encryption
through the use of a pair of keys: a public key and a private key. Here’s how it works:
1. Key Pair Generation: In asymmetric encryption, each user generates a pair of keys. The public key is
shared with anyone who wants to send encrypted messages to that user, while the private key is kept secret
and known only to the user.
2. Public Key Encryption: When someone wants to send a secure message, they use the recipient's public key
to encrypt the message. This means that anyone can encrypt a message using the public key, but only the
recipient can decrypt it using their private key.
3. Secure Key Exchange: Because the public key can be shared openly, there is no need for the sender and
receiver to share a secret key in advance. This eliminates the risk of the key being intercepted during
transmission, which is a significant vulnerability in symmetric encryption.
4. Digital Signatures: Asymmetric encryption also allows for digital signatures, where a sender can use their
private key to sign a message. The recipient can then verify the signature using the sender's public key,
ensuring the message's authenticity and integrity.
5. No Need for Pre-Shared Keys: Since the public key can be distributed freely, there is no need for a secure
channel to share a secret key beforehand, making asymmetric encryption more convenient for secure
communications over open networks.
In summary, asymmetric encryption resolves the key sharing issue of symmetric encryption by allowing users
to share a public key while keeping their private key confidential, thus enhancing security in communication.
13) One of the security principles of information assurance is “availability”. How do the attackers
implement the Denial of Service (DoS) attack? What are the ill-effects of this attack?
ANS)Attackers implement a Denial of Service (DoS) attack by overwhelming a targeted server, service, or
network with a flood of traffic or requests, rendering it unable to respond to legitimate users. Here are some
common methods used in DoS attacks:
1. Flooding: Attackers send an overwhelming number of requests to the target, such as ICMP (ping) requests
or TCP SYN packets. This flood of traffic consumes the target's resources, causing it to slow down or crash.
2. Application Layer Attacks: These attacks target specific applications by sending requests that exploit
vulnerabilities in the application layer, such as HTTP requests that consume excessive server resources,
leading to service unavailability.
3. Resource Exhaustion: Attackers may exploit system vulnerabilities to consume resources like CPU,
memory, or bandwidth. For example, sending malformed packets that require the server to allocate
resources to process them can lead to exhaustion.
4. Botnets: In more sophisticated attacks, attackers use a network of compromised computers (botnets) to
launch distributed denial of service (DDoS) attacks. This involves coordinating multiple devices to flood the
target with requests, making it harder to mitigate the attack.
The ill effects of a DoS attack can be significant, including:
- Service Outage: Legitimate users are unable to access the service, leading to frustration and loss of trust in
the service provider.
- Financial Loss: Businesses may suffer financial losses due to downtime, lost sales, and the costs associated
with mitigating the attack.
- Reputational Damage: Repeated service outages can harm a company's reputation, leading to a loss of
customers and market share.
- Increased Security Costs: Organizations may need to invest in additional security measures and
infrastructure to defend against future attacks.
Overall, DoS attacks undermine the principle of availability in information assurance, disrupting access to
critical services and causing various negative impacts on organizations and users.
14) What is Domain Name System (DNS)? What is the purpose of using cache in DNS? How is DNS cache
poisoning attack executed by attacker? What are the ill-effects of this attack?
ANS)The Domain Name System (DNS) is like the phonebook of the internet. It helps translate easy-to-
remember website names (like www.example.com) into IP addresses (like 192.0.2.1) that computers use to
find each other.
### Purpose of Caching in DNS
Caching in DNS is important for a few reasons:
1. Speed: When you visit a website, your computer asks a DNS server for the IP address. If the server has
already looked it up before, it can quickly give you the answer from its memory (cache) instead of asking
again, which makes things faster.
2. Less Load: Caching means that the DNS servers don’t have to answer the same question over and over
again. This helps them work better and keeps the internet running smoothly.
3. Reliability: If the main DNS server goes down, cached information allows people to still access websites
they’ve visited recently, which is helpful.
### DNS Cache Poisoning Attack
DNS cache poisoning is a way that attackers can trick DNS servers. Here’s how it usually happens:
1. Target the DNS Server: The attacker picks a DNS server they want to attack.
2. Send Fake Information: The attacker sends a fake answer to the DNS server, pretending to be a legitimate
source. This fake answer includes a wrong IP address for a real website.
3. Cache the Fake Info: If the DNS server accepts this fake information, it stores it in its memory. Now,
whenever someone asks for that website, the server gives them the wrong IP address.
4. Redirect Users: Users trying to visit the real website are sent to the attacker’s site instead, which could be
a scam or harmful.
### Ill Effects of DNS Cache Poisoning
The problems caused by DNS cache poisoning can be serious:
- Phishing: Users might be sent to fake websites that look real, tricking them into giving away personal
information like passwords.
- Malware: Users could end up on sites that download harmful software to their devices.
- Loss of Trust: If people get tricked using a particular website, they might stop trusting that site, hurting its
reputation.
- Data Breaches:
Sensitive information could be stolen if users enter their details on fake sites.
In short, DNS helps us use the internet easily, caching makes it faster, but attacks like cache poisoning can
cause big problems for users and websites.
15) It is required to protect a Trusted Network from the Un-trusted Network. What technical tool do you
suggest to meet the above requirement? Give the technical details of such a tool.
ANS)To protect a Trusted Network from an Un-trusted Network, one effective technical tool you can use is a
Firewall.
### What is a Firewall?
A firewall is a security device that monitors and controls incoming and outgoing network traffic based on
predetermined security rules. It acts as a barrier between your trusted internal network and untrusted
external networks, such as the internet.
### Technical Details of a Firewall:
1. Types of Firewalls:
- Packet Filtering Firewall: This type checks the packets sent over the network and allows or blocks them
based on IP addresses, port numbers, and protocols.
- Stateful Inspection Firewall: This keeps track of the state of active connections and makes decisions based
on the context of the traffic, allowing for more sophisticated filtering.
- Proxy Firewall: This acts as an intermediary between users and the internet. It retrieves data on behalf of
the user and can provide additional security features.
- Next-Generation Firewall (NGFW): This includes features such as deep packet inspection, intrusion
prevention systems, and application awareness.
2. Key Features:
- Traffic Monitoring: Firewalls continuously monitor traffic to detect and block unauthorized access.
- Access Control: You can set rules to allow or deny access to specific networks, applications, or users.
- Logging and Reporting: Firewalls maintain logs of all traffic, which can help in analyzing potential threats
and understanding usage patterns.
- VPN Support: Many firewalls support Virtual Private Networks (VPNs), allowing secure remote access to
the network.
3. Deployment:
- Firewalls can be deployed as hardware devices (physical firewalls) or software applications (software
firewalls).
- A hardware firewall is typically placed between your network and the internet, while a software firewall
runs on individual devices within the network.
4. Configuration:
- To effectively protect your network, you need to configure the firewall with appropriate rules based on
your security requirements. This includes defining which types of traffic are allowed or blocked and setting
up alerts for suspicious activities.
5. Regular Updates:
- Keeping the firewall's software updated is crucial to protect against new vulnerabilities and threats.
Regular updates ensure that the firewall can effectively block the latest attacks.
### Conclusion
Using a firewall is a fundamental step in protecting a Trusted Network from an Un-trusted Network. It
provides essential security by controlling traffic, monitoring for threats, and enforcing access policies,
ensuring that your network remains secure from potential attacks.
