SIT735: Communications Network security
Trimester 2, 2015
Assignment 1&2
Due Date and Time: 5:00pm Friday, September 18,
2015.
General Requirements
• You must do this assignment individually. Your submission must be in a form readable by Microsoft Word or PDF/Acrobat format.
• Each question should be answered individually with the corresponding label to indicate the tasks completed e.g. Task 1 - Q1.
• Your submission must be not more than 12 pages long (including diagrams), must have margins no less than 2cm, and font size no less than 12 point.
Oversized assignments will be penalised.
• A cover page (outside the page limit) must be included and should contain relevant identifying information.
• Appropriate referencing must be used throughout the document with the bibliography not counted in the page limit.
• Total Marks: 100 (Individual Task)
• Weighting 15%
Task-1
Q1. [10 marks]
An affine cipher scheme (or algorithm) is the form – C(x) ? (ax+ß) MOD 26, where x is the numerical equivalent of the given plaintext letter, and a and ß are (appropriately chosen) integers. The numerical equivalents of the letters are as follows:
a b c d e f g h i j k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
a) Let a=5 and ß=7, encrypt the message “Deakin School of IT”
[Note: students need to show the step by step conversion]
Task-2
Q2. [21 marks]
What are the core components of a PKI? Briefly describe each component.
Task-3
Q3. [9 marks]
Explain the problems with key management and how it affects symmetric cryptography.
Task-4
Q4. [2+2+2 =6 marks]
Consider the following threats of Web security and describe how each is encountered by a particular feature of SSL.
a. Brute Force Cryptanalytic Attack an exhaustive search of the key space for a conventional encryption algorithms.
b. Man-in-Middle attack: An attacker interposes during key exchange, acting as client to the server and as the server to the client.
c. SYN Flooding: An attacker sends TCP SYN message to request connection but does not respond to the final message to establish the connection fully. The attack TCP module typically leaves the “half-open connection” around for a few minutes. Repeated SYN messages can clog the TCP module.
Task-5
Q5. [3 marks]
What is port forwarding? What are the different types of port forwarding supported by SSH?
Task-6
Q6. [3+3 =6 marks]
In IEEE 802.11, open system authentication simply consist of two communications. An authentication is requested by the client, which contains station ID (typically MAC address). This followed by an authentication response from the AP/router containing a success or failure message. An example of when a failure may occur is if the client’s MAC address is explicitly excluded in AP/router configuration.
a) What are the benefits of this authentication scheme?
b) What are the security vulnerabilities of this authentication scheme? Task-7
Q7. [12 marks]
Assume you have found a USB memory stick in your work parking area. What threats might this pose to your work computer should you just plug the memory stick in and examine its contents? In particular, consider whether each of the malware propagation mechanism we study in chapter 10 of our text book could use such memory stick for transport. What steps could you take to mitigate these threats and safely determine the contents of the memory stick?
Task-8
Q8. [8 marks]
Assume you receive an e-mail that appears to come from your bank, with your bank logo in it and with the following contents:
“Dear customer, our records show that your Internet Banking access has been blocked due to too many logging attempts with invalid information such as incorrect access number, password, or security number. We urge you to restore your account access immediately and avoid permanent closure of your account, by clicking on this link to restore your account. Thank you from your customer service team.”
What form of attack is this e-mail attempting? What is the most likely mechanism used to distributed e-mail? How should respond to such e-mails?
Task-9
Q9. [25 marks]
Write a comprehensive report (800 - 1000 words) on the following topic:
a) Bug Bunty and its programme.
[In your report at least you should highlight the following points:
? What is bug bounty?
? What is the benefit for an IT company to join in bug bounty program?
? Why people participate in bug bounties?
? Will you plan to participate? If your answer is yes or no then explain.
? List (minimum ten) common targets of bug bounties.
? Name some sector/company so far not interested in bug bounty. Why they are not interested in joining Bug Bounty programme? Give reasonable answers. ]
Important Notes:
1. The Faculty electronic plagiarism declaration must be included in a separate file (see plagiarism information on CloudDeakin).
2. All assignments must be submitted through CloudDeakin. Assignments will not be accepted through email attachment. Students should note that this means that email attachment submissions will ordinarily be rejected.
3. To apply for an assignment extension, the assignment extension form (found on CloudDeakin) must be completed and submitted to the lecturer responsible for your assessment prior to the due date. Applications on or after the due date, will only be considered where students can demonstrate that it was impractical to apply otherwise. Normal penalties will apply unless the extension is granted. Thus, you should submit any completed work prior to the due date in case your application is rejected.
Submission Details:
Assignment Submission: The assignment is to be submitted via electronic submission in CloudDeakin on or before 05:00 pm, Friday, September 18, 2015 Your submission will consist of the following:
1. Completed assignment declaration;
2. Completed answers to the assignment questions.
Late Submission Policy: Assignments submitted late will incur a penalty of 10% per day of the total marks for the assignment. NO assignment will be accepted after 3 days.
Electronic Submission: You are reminded to keep backup copies of any work you submit for assessment. Electronic submission is not foolproof! If we have any difficulties in accessing your submission (e.g. due to infected/corrupted files) we will request another copy from you. Therefore it is in your best interests to ensure you DO have another, readable copy!
Plagiarism: “Plagiarism is the copying of another person's ideas or expressions without appropriate acknowledgment and presenting these ideas or forms of expression as your own.”1
Deakin University, as well as the Faculty of Science, Engineering and Built Environment view plagiarism as a serious offence and impose heavy penalties on students found guilty of the offence. You must complete the assignment declaration, which is available from the SIT735 Assignments folder in CloudDeakin, and include it at the front of your submission. This asserts that your submission is your own work and nobody else’s except where duly cited. You must keep drafts of your work (both electronic and paper) as well as the source of any original materials cited in your submission (e.g. Deakin library, online at URL, etc.). If any student is suspected of plagiarism, their work will not be marked until they have provided evidence that their submission is their own work.
1 Faculty of Science, Engineering and Built Environment Plagiarism notice. The full text is available on CloudDeakin.
SIT735 Assignment#1&2, 2015