这是用户在 2024-5-11 17:42 为 https://app.immersivetranslate.com/pdf-pro/4f7b6a5d-92c5-4354-9bfc-c1e6296a26a5 保存的双语快照页面，由 沉浸式翻译 提供双语支持。了解如何保存？
2024_05_11_072634e3639a0a0ee606g

CSEC5616 - Cybersecurity Engineering S1 2024
Assignment - 3
CSEC5616 - 2024 年第一学期网络安全工程作业 - 3

This is an individual assignment.
这是一项个人作业。
This assignment is worth of the final marks of the course.
这项作业占课程最终成绩的 。
Submit your final report as a PDF file in Canvas.
将最终报告以 PDF 文件形式提交到 Canvas。
Final Report Due by Week 11, Sunday the 12th of May 11:59 PM
最终报告截止日期为第 11 周，5 月 12 日星期日晚上 11:59

1 Public Key Infrastructure (20 marks)
1 公钥基础设施（20 分）

You are given two Wireshark (https://www.wireshark.org/) traces taken while the homepage of The University of Sydney. The two traces are in pcapng (https://pcapng.com/) format. Your task is to install Wireshark software in you computer, inspect the traces, and answer the following questions.
你被提供了两个 Wireshark（https://www.wireshark.org/）跟踪，这些跟踪是在悉尼大学主页时获取的。这两个跟踪以 pcapng（https://pcapng.com/）格式呈现。你的任务是在你的计算机上安装 Wireshark 软件，检查这些跟踪，并回答以下问题。
a) Study the given trace file 1.pcapng and answer the following questions
a) 研究给定的跟踪文件 1.pcapng 并回答以下问题
i What are the source and destination IP addresses of the given communication? (2 marks)
i 给定通信的源 IP 地址和目的地 IP 地址是什么？（2 分）
ii Which one of these is a private IP address? Explain why a private IP address is used in this setting. ( 2 marks)
ii 这两者中哪一个是私有 IP 地址？解释为什么在这种情况下使用私有 IP 地址。（2 分）
iii Explain the functionality of the first three packets of the trace file. (2 marks)
解释跟踪文件的前三个数据包的功能。(2 分)
iv Draw and annotate a protocol diagram using the first five TLS packets of the trace (An example protocol diagram can be found in Slide 55 of Week 8 lecture slides). (2 marks)
绘制并注释使用跟踪文件的前五个 TLS 数据包的协议图表（可以在第 8 周讲座幻灯片第 55 页找到示例协议图表）。(2 分)
What is the agreed cipher suite between the client and the server. (1 marks)
客户端和服务器之间达成的密码套件是什么。(1 分)
vi Explain what cryptographic scheme/methods are used in the selected cipher stream for; Key Exchange, Authentication, Encryption, Encryption/Bock Mode, Message Authentication. (2 mark)
用于所选密码流中的密钥交换、身份验证、加密、加密/块模式、消息认证的加密方案/方法进行解释。 (2 分)
vii What are the last four bytes of the server's Diffie-Hellman public key. (1 marks)
服务器的 Diffie-Hellman 公钥的最后四个字节是什么？ (1 分)
viii Export the three certificates in the Server's Certificate Message and fill the blanks in Figure 1. Here you will have to do your own search and find how to export certificates from Wireshark and and view them using openssl you learned during tutorials. (6 marks)
导出服务器证书消息中的三个证书，并填写图 1 中的空白。在这里，您将不得不自行搜索并找出如何从 Wireshark 导出证书，并使用您在教程中学到的 openssl 查看它们。 (6 分)
b) Study the given trace file 2.pcapng. You will notice that the TLS protocol flow is different here. Explain why some TLS messages such as Server Certificate are not visible in plaintext format in this trace ( 2 marks).
b) 研究给定的跟踪文件 2.pcapng。您会注意到 TLS 协议流在这里是不同的。解释为什么一些 TLS 消息，如服务器证书，在此跟踪中不以明文格式可见（2 分）。

2 Key Exchange (20 marks)
2 密钥交换（20 分）

Consider the following protocol, designed to let and decide on a fresh, shared session key . We assume they already share a long-term key .
考虑以下协议，旨在让 和 决定一个新的共享会话密钥 。我们假设他们已经共享一个长期密钥 。
Figure 1: Server Certificate Chain
图 1：服务器证书链
a) Answer the following questions regarding the protocol designer's reasoning ( 8 marks).
a) 回答以下关于协议设计者推理的问题（8 分）。
  • Why would and believe after the protocol ran that they share with the other party.
    为什么 和 在协议运行后会相信他们与对方共享 。
  • Why would they believe that this shared key is fresh?
    为什么他们会相信这个共享密钥是新的？
In both cases, you should explain both the reasons of both A and B, so your answer should complete the sentences.
在这两种情况下，你应该解释 A 和 B 的原因，所以你的答案应该完成这两个句子。
A believes that she shares with B since ...
A 相信她与 B 共享 ，因为...
B believes that he share with A since ...
B 相信他与 A 分享 ，因为...
A believes that is fresh since ...
A 相信 是新鲜的，因为...
B believes that is fresh ...
B 相信 是新鲜的...

b) Person in the middle ( 8 marks)
b) 中间人 (8 分)

Assume now that A starts a run of this protocol with B. However, the connection is intercepted by the adversary C. Show how C can start a new run of the protocol using reflection (i.e., C sending a message back to A based on what it received from A), causing A to believe that she has agreed on a fresh key with B (in spite of the fact that she has only been communicating with C). Thus, in particular, the belief in (a) is false.
现在假设 A 与 B 开始运行此协议。然而，连接被对手 C 拦截。展示 C 如何使用反射开始协议的新运行（即，C 根据从 A 收到的内容向 A 发送消息），导致 A 相信她已经与 B 达成了新密钥协议（尽管她只与 C 通信）。因此，特别是（a）中的信念是错误的。
c) Modifying the protocol (4 marks)
c) 修改协议 (4 分)
Propose a modification of the protocol that prevents this attack.
提出修改协议以防止这种攻击。

3 IP Security (IPSec) (20 marks)
3 IP 安全（IPSec）（20 分）

i Explain why IPSec is required. (2 marks)
i 解释为什么需要 IPSec。（2 分）
ii Explain the AH and ESP modes of IPSec highlighting the differences between them. (4 marks)
ii 解释 IPSec 的 AH 和 ESP 模式，突出它们之间的区别。(4 分)
iii Explain the difference between transport and tunnel mode of IPSec. (2 marks)
iii 解释 IPSec 的传输模式和隧道模式之间的区别。(2 分)
iv Describe and explain each of the entries in the table shown in Figure 2. For example row 1 can be explained as "Traffic between this host and any other host, both using port 500, and using UDP, bypasses IPsec. This is used for IKE traffic.". (12 marks)
iv 描述并解释图 2 中显示的表中的每个条目。例如，第 1 行可以解释为“此主机与任何其他主机之间的流量，两者均使用端口 500，并使用 UDP，绕过 IPsec。这用于 IKE 流量。”(12 分)
Protocol Local IP Port Remote IP Port Action Comment
UDP 1.2 .3 .101 500 500 BYPASS IKE
ICMP 1.2 .3 .101 BYPASS Error messages 错误消息
1.2 .3 .101
PROTECT: ESP
intransport-mode
Encrypt intranet traffic
加密内部网络流量
TCP 1.2 .3 .101 1.2 .4 .10 80
PROTECT: ESP
intransport-mode
Encrypt to server 加密到服务器
TCP 1.2 .3 .101 1.24 .40 443 BYPASS TLS: avoid double encryption
TLS：避免双重加密
1.2 .3 .101 DISCARD Others in DMZ DMZ 中的其他内容
1.2 .3 .101 BYPASS Internet
Figure 2: Host SPD Example
图 2：主机 SPD 示例

4 Firewalls (20 marks)
4 个防火墙（20 分）

We will configure firewalls in this task. Figure 3 shows a possible firewall setup. Your goals are:
在这项任务中，我们将配置防火墙。图 3 显示了可能的防火墙设置。您的目标是：
  • Outgoing traffic is only allowed to TCP ports 80 (HTTP), 443 (HTTPS), and 25 (SMTP); plus UDP ports 53 (DNS), 123 (NTP).
    只允许出站流量访问 TCP 端口 80（HTTP）、443（HTTPS）和 25（SMTP）；以及 UDP 端口 53（DNS）、123（NTP）。
  • Incoming traffic is always allowed if there is an established connection, i.e. if the connection has been established from a host in the local network.
    如果建立了连接，即如果连接是从本地网络中的主机建立的，则始终允许传入流量。
  • Host 129.78.1.1 is reachable (incoming connection) from everywhere on port 80.
    主机 129.78.1.1 在端口 80 上从任何地方可达（传入连接）。
  • Host 129.78.1.2 is reachable (incoming connection) on port 22 (SSH) from 129.78.0.0/16.
    主机 129.78.1.2 在端口 22（SSH）上从 129.78.0.0/16 可达（传入连接）。
  • Incoming and outgoing ping packets are allowed
    允许进出的 ping 数据包
  • No other incoming traffic is allowed.
    不允许其他进入的流量
Figure 3: Firewall setup.
图 3：防火墙设置

a) Configuring a stateful firewall (10 marks)
a) 配置有状态防火墙（10 分）

Rule
Incoming
Interface
Src IP Dst IP Proto Src Port Dst Port State Action
A
B
C
D
F
G
Table 1: Template for stateful filtering.
表 1：有状态过滤模板。
Write stateful rules in table form as shown in the lecture. A template is given in Table 1. You are free to add more rows to the table, if required.
按照讲座中所示的表格形式编写有状态规则。表 1 中提供了一个模板。如有需要，您可以向表格添加更多行。
However, do not add too many unnecessary rules. Implement the policies using as less rules as possible.
然而，不要添加太多不必要的规则。尽量使用尽可能少的规则来实施政策。

b) Converting to stateless filtering ( 10 marks)
b) 转换为无状态过滤（10 分）

Convert your rules to stateless filtering rules. A template is given in Table 2. Again you are free to add more rows to the table, if required.
将您的规则转换为无状态过滤规则。表 2 中提供了一个模板。如果需要，您可以自由地向表中添加更多行。
However, do not add too many unnecessary rules. Implement the policies using as less rules as possible.
然而，不要添加太多不必要的规则。尽量使用尽可能少的规则来实施政策。

5 Incident Analysis: Optus Data Breach (20 marks)
5 事件分析：Optus 数据泄露（20 分）

Read about the Optus Data Breach that happened in 2022 and answer the following questions. There have been many new reports and expert commentary on this - you should be able to find many resources online.
阅读关于 2022 年发生的 Optus 数据泄露的信息，并回答以下问题。关于此事已经有许多新闻报道和专家评论 - 你应该能够在网上找到许多资源。
a) Briefly explain what happened ( 12 marks).
a) 简要解释发生了什么（12 分）。
Include the following in your answer.
在你的答案中包括以下内容。
  • What data was breached? (2 marks)
    泄露了哪些数据？（2 分）
  • How did the attacker obtain access to data? (2 marks)
    攻击者如何获取数据访问权限？（2 分）
Rule Iface Src IP Dst IP Proto Src Port Dst Port ACK Action
A
B
C
G
Table 2: Template for stateless filtering.
表 2：无状态过滤模板。
  • How did Optus respond when they came to know about the breach? This answer should cover not only technical aspects but also legal, customer relations, and public relations aspects. (4 marks)
    Optus 在得知有数据泄露时做出了怎样的回应？这个答案应该涵盖技术、法律、客户关系和公共关系等方面。（4 分）
  • What are the possible risks (i.e., to the impacted users) associated with this data breach? (4 marks)
    这次数据泄露可能对受影响的用户造成哪些潜在风险？（4 分）

b) Storing personal information (4 marks)
b) 存储个人信息（4 分）

What makes this attack significant is the fact that driver's licence numbers and passport numbers were breached for a fraction of Optus customers.
这次攻击之所以重要的原因是部分 Optus 客户的驾照号码和护照号码遭到泄露。
  • Explain why Optus was storing such information. (2 marks)
    解释 Optus 为什么要存储这样的信息。(2 分)
  • Explain a better method of storing such information to avoid this type of data breach happening. (2 marks)
    解释一种更好的存储此类信息的方法，以避免发生此类数据泄露。(2 分)

c) The aftermath (4 marks)
c) 事件后果 (4 分)

The repercussions of this attack will linger for several years, impacting all stakeholders. These include Optus customers, whose data was compromised, Optus as a corporate entity, and the Australian government along with other regulatory bodies.
这次攻击的后果将持续数年，影响所有利益相关者。这些利益相关者包括遭受数据泄露的 Optus 客户、Optus 作为一个公司实体，以及澳大利亚政府和其他监管机构。
  • Explain two steps taken by Optus (in collaboration of other stakeholders) to protect some of the impacted users? (4 marks)
    请解释 Optus 采取的两项措施（与其他利益相关者合作）来保护部分受影响用户？（4 分）