ELEC5616 Computer & Network Security
Computer & Network Security
Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
Project :: Defeating SkyNet
Part 1: Security Essentials
ELEC5616 Computer & Network Security
Introduction
It’s 2022. Almost every device with a CPU in it has been connected to the
Internet. Whilst this is a stunning advance for humanity, the security for
these devices has come as an afterthought or not at all. Millions of computers
and devices, all with valuable information and processing power, are left
vulnerable to attack.
Blackhats, and even possibly governments, have created viruses, worms
and other dastardly schemes to mine for information and turn a profit using
these weaknesses. In this project, we’ll be specifically looking at botnets: how
they work, why they’re valuable and why it’s so difficult to defeat them.
Botnets perform various tasks including but not limited to:
• Stealing confidential information (passwords, banking details, etc.)
• Sending spam email
• Distributed Denial of Service (DDoS) against chosen websites
• Mining for Bitcoins
• Hold files for ransom by encrypting them and charging for decryption
1
• Providing a secure proxy network for other illegal enterprises
Of course, such a valuable network is not likely to go unnoticed for
long. You’ll be having well funded organisations, government agencies and
other hackers attacking you. For that reason, SkyNet will need advanced
cryptography to ensure your blackhat plans can’t be stopped.
Background & Disclaimer
This project has been created to help you gain an understanding of how prac-
tical a massive cyber attack is and how complex it can be to defend against
it. The basic technology of this project is pulled from the Conficker worm
that ravaged the Internet in November 2008. At its peak, Conficker controlled
up to 7 million computers across 200 countries. Conficker would only have
needed 2 million of those machines to overpower the top 500 supercomputers
at the time combined. To combat the threat, Microsoft formed an industry
group to counter Conficker, composed of numerous security and technology
companies. This group also conversed with government agencies around the
world.
To understand why it was so difficult to slow down or defeat, we’ll be
implementing key components of this botnet that utilise advanced crypto-
graphic techniques.
This is not an operational botnet nor do we intend you to create one.
To defeat blackhats, you must understand how they work and the techniques
they use. Recent botnets have used advanced computer science and crypto-
graphic methods in order to remain secure from both blackhats, whitehats,
well funded organisations and even governments. These advanced methods
are what we intend you to learn and what we believe will give you the skills
to detect, prevent and disassemble such attacks in the future.
2
Part 1 :: Securing the Channel
When you’re transferring secrets, be they banking details or Bitcoins, you
don’t want to be overheard. Additionally, communicating in the open makes
it easier for SkyNet to be detected via network analysis. Botnet authors don’t
like easy ways for computer admins to pinpoint infected machines.
An insecure skeleton framework written in Python 3 has been provided
for you as a starting point. If you wish to use another language, such as Java
with the Java Cryptography Extension (JCE), you may do so after seeking
permission from your tutor. Using a different language is highly discouraged
and we cannot provide technical support in this case. Python is easy to learn,
you are encouraged to use it.
Note: This code has been written for the purposes of teaching cryptog-
raphy and computer security. It is to be used as a demonstration only. No
attempt has been made to optimise the source code.
In Part 1, you will need to:
• Implement key exchange using the Diffie-Hellman algorithm, when peer-
to-peer connections are made between bots.
– Code controlling the Diffie-Hellman key exchange is in dh/ init .py
• Achieve confidentiality through encryption of the client-server commu-
nications with an appropriate block or stream cipher.
• Enforce integrity through the use of a MAC appended to all messages.
• Implement resistance against replay attacks using a mechanism which
you are to devise.
– Confidentiality, integrity and replay resistance should be acheived
through editing lib/comms.py.
See the README file for usage instructions!
1 Key Exchange
In order to strengthen SkyNet’s communications against eavesdropping, you
are to implement a method of key exchange for each possible connection. If
you leave your communications unencrypted, it would be trivial for network
3
analysis to indicate which machines are infected with your bot. It would also
be easy to steal secrets and confidential information you might be sending
back and forth.
For this project, you’ll be using the Diffie-Hellman key exchange method.
You’ll be implementing this yourself from two standards created by the Inter-
net Engineering Task Force (IETF). RFC 2631 describes how Diffie-Hellman
works and how the calculations are performed. RFC 3526 provides standard
parameters for use in Diffie-Hellman key exchange and an estimation on the
strength they provide for computing a shared key. A shortened version of
each of these RFCs has been provided with the source code.
The key that results from this key exchange should be used to compute
all the other settings, such as the the block cipher keys or seeds for the stream
cipher. Remember that you should hash the secret and use it as the seed for
a random number generator instead of using it directly.
Note: Each and every session should use a different key. This means a
new key exchange session must be run every time a new connection is made.
2 Confidentiality
The confidentiality of the channel should be achieved through encrypting
each message sent using either a block cipher or a stream cipher. An appro-
priate mode of operation for the cipher must also be considered. You may use
any block or stream cipher you wish, provided it would remain reasonably
secure against both government agencies and other hackers. The initialisa-
tion vector (IV), if used, and key must be derived through a key exchange
mechanism as described above.
3 Integrity
Message integrity is to be achieved through appending a MAC to each mes-
sage sent across the channel. This is to help prevent any active attacker from
modifying messages whilst in transit. The key to the MAC must be derived
from the key exchange. You may use any MAC that you wish as long as it
provides adequate level of security against any potential attackers.
4
4 Preventing Replay
You must devise a scheme where SkyNet is resistant to messages being re-
played by an active attacker. The exact mechanism by which this occurs is
up to you.
Imagine your bot could be told to perform a denial of service against a
website by sending the message [DDOS www.ebay.com]. If it was trivial for
others to resend that same message, others would be able to hold eBay to
ransom as they could control your botnet.
While the structure of code used to control encryption and integrity is
defined within the skeleton code, you must come up with your own method
for preventing replay attacks. Determine some method that will reject any
communication between bots that’s captured by an attacker and resent.
5 Documentation
You are to write a 2-3 page design document outlining the security you
implemented with your system. You should justify the choices you have made
for your implementation and specifically discuss:
• key exchange
• confidentiality
• integrity
• replay prevention
• authentication