Assignment 10, due Apr 29

Always, on every assignment, please write your name legibly as it appears on your University ID and on the class list! All assignments will be due at the start of class on the day indicated (usually a Friday), and unless there is what insurance companies call "an act of God" - something outside your control; the only exceptions to this rule will be by advance arrangement.

1. Background: Consider an Internet router. It's job is to serve as a gateway between any of several network links. On receipt of a message with the ultimate address X, the routing tables are searched for advice about where to forward that message to get it closer to X.

   Some routers have static routing tables, typically forwarding all difficult routing problems to other routers they have been configured to use. Many routers are more dynamic, communicating with other routers to learn about changes in the network. The Internet is so big that links and machines, including routers, are constantly being added and subtracted. Without dynamic routing tables, this would never work.

   Most routers can not only forward messages but also apply rewrite rules top addresses. Such a rule might read "if you see a message addressed to X, send it to Y instead." Such a router allows the addressing scheme used in some local subnet to be different from the addressing scheme used elsewhere.

   a) Suppose an attacker was able to hack into the router connecting your local subnet to the rest of th Internet. The only thing the hacker can do is change the routing table. Your router has a static routing table with no rewrite rules. What damage could the hacker do? (0.5 points)

   b) How could you, a user of the local subnet, detect the damage discussed in part a? (0.5 points)

   c) Now suppose the router that the hacker attacks one that other routers consult to dynamically update their routing tables. Does this change the nature of the attacks or just the scale of their effects. (0.5 points)

2. Background: The RIES (Rijnland Internet Voting System) was designed to allow expatriate voters to vote by internet in Dutch national eletions. In order to stand up to attack, it had two separate web servers attached, and every hour during the election, test ballots were voted by Internet. Test ballots ended up in the regular ballot box, but they were "pre invalidated" so that, when it came time to count the votes, they would not be counted. The list of invalidated ballots was a closely held secret until after the polls closed, so attackers could not detect which ballots were test ballots and which were not. After the polls closed, the ballot box was inspected to make sure that all of the voted test ballots were in fact deposited in the ballot box.

   a) What kinds of attacks could test ballots detect? (0.5 points)

   b) In the 2006 Dutch Parliamentary elections, all of the test ballots were cast from the same PC in the offices used by the election administration. What vulnerability results from this? (0.5 points)

   c) For maximum effectiveness, how should the test ballots have been cast? (0.5 points)

3. Background: Many operating systems these days include the option of installing a firewall on the end-user's machine. Most of our discussion of firewalls focused on firewalls that were parts of routers, where the firewall function was an add-on to the routing function.

   It has been argued that such a firewall is unnecessary, as network services you don't want to offer to the world should simply be disabled. Nowdays, many systems come, out of the box, with all these services enabled, and it is easier to block them with a firewall than it is to properly disable the services you don't want to offer.

   Note that the "network stack" was presented as if all messages had to be pushed down to the physical layer for transport from sender to receiver. This is not really true. The exception occurs when the sender and receiver are on the same machine. In this case, the transport layer is likely to complete the message delivery without using any services from lower level layers. In the X-windows system (the public-domain window manager used by Linux), the window manager is a separate process, and all communication from application to window manager is done using the TCP/IP protocol stack. This allows use of remote window applications to be as efficient or even more efficient than local windows. Opening a window is done by making a network connection to the window manager. Drawing on a window involves using that connection, and closing a window involves breaking the network connection.

   a) Suppose you were running Linux with the X window manager. What security threat is posed by running on a machine with no local firewall. (0.5 points)

   b) Give other examples of local applications where the easy way to support them involves use of network protocols. (Hint: Consider any application that is useful over the network but where it might also be useful between local processes or between local users, even on a machine with just one keyboard and display.) (0.5 points)

4. Background: Disaster planning involves several components, including threat assessment for predictable disasters, and general preparedness for the unexpected. Here in Iowa City, we have had major floods in 1993 and 2008. The 1993 flood was comparable to the 1947 flood. We had hurricane-force straight-line winds in 1998 that knocked out all power to Johnson County and knocked over enough trees to block almost all of the roads in town. Power was not restored to many buildings for a week, although some lucky few had power within the first day. An F4 tornado hit Iowa City 2006, causing major damage on a path through downtown. The New Madrid seismic zone stretches is well south of St. Louis but it is likely that some people in this area felt the 1811-1812 New Madrid super-quakes as distant jolts. Many of Iowa City's taller buildings and church steeples are hit by lightning many times a year. MacLean Hall suffered one serious lightning strike a decade ago that destroyed many computers that were plugged directly into the wall without benefit of surge protectors. In 1985, a fire at the old sewage treatment plant in Cedar Rapids released a plume of hydrogen chloride gas that forced the evacuation of much of Cedar Rapids. This was the largest urban evacuation in US history. The Duane Arnold nuclear plant is in Palo, just west of Cedar Rapids.

   Assume you are involved in the design of a new data center in the Iowa City area.

   a) What threats would you treat as serious predictable risks and what defensive measures would you take to deal with those risks. (0.5 points)

   b) What defensive measures would you recommend as generally useful for a broad range of unpredictable disasters. For each, give examples of unpredictable disasters where they might prove useful. Some of your defenses may be listed in both a) and b). (0.5 points)