UNIT 1

PART – B
1) Identify the categories of Security Services and attacks.
Security Definitions
Computer Security - generic name for the collection of tools
designed to protect data and to thwart hackers
Network Security - measures to protect data during their transmission
Internet Security - measures to protect data during their transmission
over a collection of interconnected networks
our focus is on Internet Security
which consists of measures to deter, prevent, detect, and correct security
violations that involve the transmission & storage of information
ASPECTS OF SECURITY
consider 3 aspects of information security:
 Security Attack
 Security Mechanism
 Security Service

SECURITY SERVICES
It is a processing or communication service that is provided by a system to
give a specific kind of production to system resources. Security services implement
security policies and are implemented by security mechanisms.
Confidentiality

Confidentiality is the protection of transmitted data from passive attacks. It is used to

prevent the disclosure of information to unauthorized individuals or systems. It has
been defined as “ensuring that information is accessible only to those authorized to have
access”.The other aspect of confidentiality is the protection of traffic flow from analysis.
Ex: A credit card number has to be secured during online transaction.

Authentication
This service assures that a communication is authentic. For a single message
transmission, its function is to assure the recipient that the message is from
intended source. For an ongoing interaction two aspects are involved. First, during
connection initiation the service assures the authenticity of both parties. Second,
the connection between the two hosts is not interfered allowing a third party to
masquerade as one of the two parties. Two specific authentication services defines
in X.800 are

Peer entity authentication: Verifies the identities of the peer entities involved in
communication. Provides use at time of connection establishment and during data
transmission. Provides confidence against a masquerade or a replay attack
Data origin authentication: Assumes the authenticity of source of data unit, but
does not provide protection against duplication or modification of data units. Supports
applications like electronic mail, where no prior interactions take place between communicating
entities.
Integrity
Integrity means that data cannot be modified without authorization. Like
confidentiality, it can be applied to a stream of messages, a single message or
selected fields within a message. Two types of integrity services are available.
They are
Connection-Oriented Integrity Service: This service deals with a
stream of messages, assures that messages are received as sent, with no
duplication, insertion, modification, reordering or replays. Destruction of data is
also covered here. Hence, it attends to both message stream modification and
denial of service.
Connectionless-Oriented Integrity Service: It deals with individual messages
regardless of larger context, providing protection against message modification only.

An integrity service can be applied with or without recovery. Because it is related to

active attacks, major concern will be detection rather than prevention. If a violation is
detected and the service reports it, either human intervention or automated
recovery machines are required to recover.
Non-repudiation
Non-repudiation prevents either sender or receiver from denying a
transmitted message. This capability is crucial to e-commerce. Without it an
individual or entity can deny that he, she or it is responsible for a transaction,
therefore not financially liable.
Access Control
This refers to the ability to control the level of access that individuals or
entities have to a network or system and how much information they can receive. It
is the ability to limit and control the access to host systems and applications via
communication links. For this, each entity trying to gain access must first be
identified or authenticated, so that access rights can be tailored to theindividuals.

Availability
It is defined to be the property of a system or a system resource being
accessible and usable upon demand by an authorized system entity. The
availability can significantly be affected by a variety of attacks, some amenable to
automated counter measures i.e authentication and encryption and others need
some sort of physical action to prevent or recover from loss of availability of
elements of a distributed system.

SECURITY ATTACK
any action that compromises the security of information owned by an
organization information security is about how to prevent attacks, or
failing that, to detect attacks on information-based systems often threat &
attack used to mean same thing have a wide range of attacks can focus of
generic types of attacks
 Passive
 Active
Passive Attack

30

Active Attack

INTERRUPTION
An asset of the system is destroyed or becomes unavailable or unusable. It is
an attack on availability.
Examples:

Destruction of some hardware

Jamming wireless signals
Disabling file management systems
INTERCEPTION
An unauthorized party gains access to an asset. Attack on confidentiality.
Examples:
Wire tapping to capture data in a network.
Illicitly copying data or programs
Eavesdropping
MODIFICATION
When an unauthorized party gains access and tampers an asset. Attack is
on Integrity
Examples:
Changing data file
Altering a program and the contents of a message
FABRICATION
 An unauthorized party inserts a counterfeit object into the system. Attack on
Authenticity. Also called impersonation
Examples:
Hackers gaining access to a personal email and sending
message Insertion of records in data files
Insertion of spurious messages in a network

2) Explain the model for network security.

MODEL FOR NETWORK SECURITY
Data is transmitted over network between two communicating parties, who must cooperate
for the exchange to take place. A logical information channel is established by defining a
route through the internet from source to destination by use of communication protocols by
the two parties. Whenever an opponent presents a threat to confidentiality, authenticity of
information, security aspects come into play.
Two components are present in almost all the security providing techniques.
A security-related transformation on the information to be sent
making it unreadable

by the opponent, and the addition of a code based on the contents of the message,
used to verify the identity of sender.

Some secret information shared by the two principals and, it is hoped,

unknown to the opponent. An example is an encryption key used in conjunction with
the transformation to scramble the message before transmission and unscramble it
on reception

A trusted third party may be needed to achieve secure transmission. It is

responsible for distributing the secret information to the two parties, while keeping
it away from any opponent. It also may be needed to settle disputes between the
two parties regarding authenticity of a message transmission. The general model
shows that there are four basic tasks in designing a particular security service:
1. Design an algorithm for performing the security-related transformation.
The algorithm should be such that an opponent cannot defeat its purpose
2. Generate the secret information to be used with the algorithm
3. Develop methods for the distribution and sharing of the secret information
4. Specify a protocol to be used by the two principals that makes use of the
security algorithm and the secret information to achieve a particular security
service Various other threats to information system like unwanted access still
exist. The
existence of hackers attempting to penetrate systems accessible over a network
remains a concern. Another threat is placement of some logic in computer system
affecting various applications and utility programs. This inserted code presents two
kinds of threats.
Information access threats intercept or modify data on behalf of users who should
not have access to that data

Service threats exploit service flaws in computers to inhibit use by legitimate

users Viruses and worms are two examples of software attacks inserted into the
system by means of a disk or also across the network. The security mechanisms
needed to cope with unwanted access fall into two broad categories.
 3) Analyze the transposition techniques.
Introduction to Transposition Techniques
The transposition technique is a cryptographic technique that converts the plain text to
cipher text by performing permutations on the plain text, i.e., changing each character of
plain text for each round. It includes various techniques like the Rail Fence technique,
Simple columnar transposition technique, simple columnar transposition technique with
multiple rounds, Vernam cipher, and book Cipher to encrypt the plain text in a secure way.

Transposition Techniques
Below is the list of transposition techniques.

1. Rail-Fence Technique
Rail-Fence is the simple Transposition technique that involves writing plain text as a
sequence of diagonals and then reading it row by row to produce the ciphertext.
Algorithm

Step 1: Write down all the characters of plain text message in a sequence of diagnosis.

Step 2: Read the plain text written in step 1 as a sequence of rows.

To understand it in a better manner, let’s take an example.

Example: Suppose plain text corporate bridge, and we want to create the ciphertext of the
given.
First, we arrange the plain text in a sequence of diagnosis, as shown below.

Now read the plain text by row-wise, i.e. croaerdeoprtbig.

So, here the plain text is a corporate bridge, and ciphertext is croaerdeoprtbig.

The Rail-Fence technique is quite easy to break.

2. Simple columnar transposition techniques

The simple columnar transposition technique can be categorized into two parts – Basic
technique and multiple rounds.

Simples columnar transposition technique – basic technique. The simple columnar

transposition technique simply arranges the plain text in a sequence of rows of a rectangle
and reads it in a columnar manner.
How does this algorithm work?
Step 1: Write all the characters of plain text message row by row in a rectangle of
predefined size.

Step 2: Read the message in a columnar manner, i.e. column by column.

Note: For reading the message, it needs not to be in the order of columns. It can happen in
any random sequence.

Step 3: The resultant message is ciphertext.

Example: Let’s assume that Plain text is a corporate bridge, and we need to calculate the
cipher text using a simple columnar transposition technique.

Let’s take 6 columns and arrange the plain text in a row-wise manner.

Column 1 Column 2 Column 3 Column 4 Column 5 Column 6

c o r p o r

a t e b r i

d g e

Decide the column order for reading the message – let’s assume 1,3,5,2,4,6 is an order.

Now read the message in a columnar manner using the decided order. – cadreeorotgpbri
cadreeorotgpbri is a ciphertext.

3. Simple columnar transposition technique – Multiple rounds

Simple columnar transposition technique with multiple rounds is the same as basic; only
the difference is that we iterate the process multiple times in multiple rounds.

Working of an algorithm
Step 1: Write all the characters of plain text message row by row in a rectangle of
predefined size.

Step 2: Read the message in a columnar manner, i.e. column by column.

Note: For reading the message, it needs not to be in the order of columns. It can happen in
any random sequence.

Step 3: The resultant message is ciphertext.

Step 4: Repeat the procedure from step 1 to step 3 many times as desired.
Example: Let’s assume that Plain text is a corporate bridge, and we need to calculate the
cipher text using a simple columnar transposition technique.

Let’s take 6 columns and arrange the plain text in a row-wise manner.

Column 1 Column 2 Column 3 Column 4 Column 5 Column 6

c o r p o r

a t e b r i

d g e

Decide the column order for reading the message – let’s assume 1,3,5,2,4,6 is an order.

Now read the message in a columnar manner using the decided order. – cadreeorotgpbri

cadreeorotgpbri is a ciphertext.

Let’s perform step 1 to step 3 one more time.

Column 1 Column 2 Column 3 Column 4 Column 5 Column 6

c a d r e e

o r o t g p

b r i

In the second iteration, the order of the columns will be the same.

Ciphertext – cobdoiegarrrtep

Continue the same procedure if more iteration is required.

4. Vernam Cipher
A subset of Vernam cipher is called a one-time pad because it is implemented using a
random set of nonrepeating characters as an input ciphertext.

Note: Once the input ciphertext is used for transposition, it never used for any other
message. The length of input ciphertext must be equal to the length of plain text.
Working of Algorithm
Step 1: Arrange all characters in the plain text as a number i.e. A = 0, B = 1, ….. Z = 25.
Step 2: Repeat the same procedure for all characters of the input ciphertext.
Step 3: Add each number corresponding to the plain text characters to the corresponding
input ciphertext character number.
Step 4: If the sum of the number is greater than 25, subtract 26 from it.
Step 5: Translate each number of the sum into the corresponding characters.
Step 6: The output of step 5 will be a ciphertext.

In Vernam cipher, once the input ciphertext is used, it will never be used for any other
message; hence it is suitable only for short messages.

Example: The plain text is educba and ciphertext is ntcbar

Plain text e d u c b a

4 3 20 2 1 0

Input n t c b a r
ciphertext

13 19 2 1 0 17

Addition of 17 22 22 3 1 17
plain text
and input
ciphertext

Ciphertext r w w d b r

Hence, the ciphertext is rwwdbr.

4) Explain how gateway works in internetwork security model.

Introduction of Gateways
Gateways as the name suggest are one kind of gate (passage) that connects smart objects to the
servers by application of fog computing. 
In IoT, Gateways are network hardware that an application/system uses for interacting with
the server. 
1. Gateways make communication between the application and the server feasible by
connecting them altogether through a network tube, an imaginary tube that is
believed to exist between the application and the server and constituted by network
waves through which data transmission takes place.
2. A request about a certain amount of data is made by the user end and then the server
finds and processes data accordingly with the request.
3. The transmission is made via network tubes through the server to the gateway and
then the gateway to the application that made a request for data.
4. Gateways are considered to be the backbone for preserving the intelligence as well
as the storage capacity of the Smart device altogether without compromising on the
loss of the duo.
5. Gateways do this by application of Fog computing, on which a brief is provided
below that helps you to get an overview of the deal between Gateways and Fog
Computing and the whole data processing thing.
Features Of Gateways :
Gateways provide a wide variety of features. Some of which are:
1. Gateways work as a network bridge for data transmission as it makes the
transmission of data possible to transmit with more ease and does not demand high
storage capacity.
2. Gateways create a structural temporary storeroom for the data transmitted by the
server and data requests made by the user end.
3. Gateways made the transmission more feasible as it queued up all the data and
divide it into small packets of data rather than sending it bulk. Data transmitted
through Gateway is divided into various useful and small packets each having its
individual significance and a role to play while processing data.
4. Gateways made the data more secure if the modifications to the gateway could be
done which then could create more reliability over smart devices.
5. Gateways optimize the data for search engines, applications, and servers by
implanting better readability to the content so that a machine could understand and
optimize data with ease.
Types Of Gateways :
There is not any specification of gateways in the commercial market other than being brand
specific. But on the feasibility, performance, speed, and workability gateways can be classified
in a broad manner as:
1. High Bandwidth Gateways –
These Gateways are meant for a more complex and intelligent Internet of Things or
when there are lots of data to be processed and transmitted and a lot of smart devices
to be handled once a time. These gateways could process data with more speed and
flexibility and are able to handle more data at a time. Gateways basically are not
categorized as such in the market, but various brands have certain specifications
through which it could be decided either the gateway is of high bandwidth or not.
2. Low Bandwidth Gateway –
These Gateways are really the best choice while choosing a simple smart object or
when you want to handle a single device once at a time. These Gateways are usually
cheap and are easy going with simple smart devices, and usually need a sink* for
more feasibility. They are really awesome if want a cheap solution to your data
transmission.
NOTE: sink*- A sink is a device that connects various gateways to it and then the sink to the
server for easy facilitation of the networking. It is a kind of gateway to gateways.    
 
How Gateways Work :
This is a sequential description of the working of gateway that will guide you through how
data rolls in and out through the gateway:
1. The user end’s application made a request for a certain amount of data via its portal
to the gateway. For example, A smart door made a request for the data type:
“password” and send this request to the gateway.
2. The gateway sends this request for a password to the server.
3. The server receives the request and search for the data type: “password” for a certain
“id” and made the data “password” transfer to the gateway.
4. The data is then sent to the smart door interface where it is matched with the data
entered for data type: “password”. If these two data matches then the door gets
unlocked.
Advantages Of Gateways :
The gateways provide the following advantages to the user:
1. It is possible through gateways that smart objects rely on fog computing for data
transfer between user and server.
2. Gateways provide a way for the feasibility of smart objects without reducing the
intelligence of objects as there is no need to transfer the intelligence of objects on
the server-side hence preserving performance and accessibility
3. Gateways make the use of smart objects energy-efficient as data transfers do not
rely on the smart device and transfers between devices and gateways are possible
through low energy options like BLE, ZigBee, or Bluetooth.
4. Gateways open a new technology to the world, i.e., fog computing.
5. Gateways could add an extra layer of security to the data if certain modifications
added to them.
6. Gateways make data encryption, data analysis, and handling possible so that a new
phase of smart objects is available to users.
7. Gateways drive industries to innovate and make it possible for industries to grow
more.
8. Gateways led industry and set up an employment opportunity as if development to
gateways is made there are more people brainstorming to make gateways more
feasible and overcome limitations.
Limitations Of Gateways :
There are few limitations of gateways as well. Here are some of them:
1. Gateways need to device-specific as multiple attachments are not possible to single
gateways and there is a need for a sink for this purpose.
2. Gateways are not data handling master but just are used for data transfers.
3. Gateways do not validate the sources of data request and user and also could not
predict the behavior from the data.
4. Gateways are just task-specific and not learners.
5. Gateways add an unavoidable expense to your daily life if you want your lifestyle
IoT-driven.
6. Gateways need extra space in your space.
7. They want special attention for maintenance sometimes.
8. More featured gateways could even make a hole in your pocket if you are looking
for something cheap.
9. A sink is needed for the feasibility of a lot of gateways.
Conclusion :
Gateways are the backbone for the future of Smart objects and computing. Through gateway
design, one could make smart objects more accessible, secure, and relevant. Gateways, as
seen, are not that much simple and holds some major breakthrough in their design. Gateways
could be the reason for the popularity of smart objects and a building block for a smart world.
These could be the leaders of emerging technologies and their design could make the smart
objects stand in a long run.  Gateways if combined with modern era technologies could turn
the tables and make the witness of a new era.
5)Explain various types of cryptanalytic attacks.
Attacks On Cryptosystems
In the present era, not only business but almost all the aspects of human life are driven by information.
Hence, it has become imperative to protect useful information from malicious activities such as
attacks. Let us consider the types of attacks to which information is typically subjected to.
Attacks are typically categorized based on the action performed by the attacker. An attack, thus, can
be passive or active.

Passive Attacks
The main goal of a passive attack is to obtain unauthorized access to the information. For example,
actions such as intercepting and eavesdropping on the communication channel can be regarded as
passive attack.
These actions are passive in nature, as they neither affect information nor disrupt the communication
channel. A passive attack is often seen as stealing information. The only difference in stealing physical
goods and stealing information is that theft of data still leaves the owner in possession of that data.
Passive information attack is thus more dangerous than stealing of goods, as information theft may go
unnoticed by the owner.

Active Attacks
An active attack involves changing the information in some way by conducting some process on the
information. For example,
 Modifying the information in an unauthorized manner.
 Initiating unintended or unauthorized transmission of information.
 Alteration of authentication data such as originator name or timestamp associated with
information
 Unauthorized deletion of data.
 Denial of access to information for legitimate users (denial of service).
Cryptography provides many tools and techniques for implementing cryptosystems capable of
preventing most of the attacks described above.

Cryptographic Attacks
The basic intention of an attacker is to break a cryptosystem and to find the plaintext from the
ciphertext. To obtain the plaintext, the attacker only needs to find out the secret decryption key, as the
algorithm is already in public domain.
Hence, he applies maximum effort towards finding out the secret key used in the cryptosystem. Once
the attacker is able to determine the key, the attacked system is considered as broken or compromised.
Based on the methodology used, attacks on cryptosystems are categorized as follows −
 Ciphertext Only Attacks (COA) − In this method, the attacker has access to a set of
ciphertext(s). He does not have access to corresponding plaintext. COA is said to be
successful when the corresponding plaintext can be determined from a given set of
ciphertext. Occasionally, the encryption key can be determined from this attack. Modern
cryptosystems are guarded against ciphertext-only attacks.
 Known Plaintext Attack (KPA) − In this method, the attacker knows the plaintext for
some parts of the ciphertext. The task is to decrypt the rest of the ciphertext using this
 information. This may be done by determining the key or via some other method. The
best example of this attack is linear cryptanalysis against block ciphers.
 Chosen Plaintext Attack (CPA) − In this method, the attacker has the text of his
choice encrypted. So he has the ciphertext-plaintext pair of his choice. This simplifies
his task of determining the encryption key. An example of this attack is differential
cryptanalysis applied against block ciphers as well as hash functions. A popular public
key cryptosystem, RSA is also vulnerable to chosen-plaintext attacks.
 Dictionary Attack − This attack has many variants, all of which involve compiling a
‘dictionary’. In simplest method of this attack, attacker builds a dictionary of ciphertexts
and corresponding plaintexts that he has learnt over a period of time. In future, when an
attacker gets the ciphertext, he refers the dictionary to find the corresponding plaintext.
 Brute Force Attack (BFA) − In this method, the attacker tries to determine the key by
attempting all possible keys. If the key is 8 bits long, then the number of possible keys
is 28 = 256. The attacker knows the ciphertext and the algorithm, now he attempts all the
256 keys one by one for decryption. The time to complete the attack would be very high
if the key is long.
 Birthday Attack − This attack is a variant of brute-force technique. It is used against
the cryptographic hash function. When students in a class are asked about their
birthdays, the answer is one of the possible 365 dates. Let us assume the first student's
birthdate is 3rd Aug. Then to find the next student whose birthdate is 3 rd Aug, we need to
enquire 1.25*√365 ≈ 25 students.
Similarly, if the hash function produces 64 bit hash values, the possible hash values are
1.8x1019. By repeatedly evaluating the function for different inputs, the same output is
expected to be obtained after about 5.1x109 random inputs.
If the attacker is able to find two different inputs that give the same hash value, it is
a collision and that hash function is said to be broken.
 Man in Middle Attack (MIM) − The targets of this attack are mostly public key
cryptosystems where key exchange is involved before communication takes place.
o Host A wants to communicate to host B, hence requests public key of B.
o An attacker intercepts this request and sends his public key instead.
o Thus, whatever host A sends to host B, the attacker is able to read.
o In order to maintain communication, the attacker re-encrypts the data
after reading with his public key and sends to B.
o The attacker sends his public key as A’s public key so that B takes it as if
it is taking it from A.
 Side Channel Attack (SCA) − This type of attack is not against any particular type of
cryptosystem or algorithm. Instead, it is launched to exploit the weakness in physical
implementation of the cryptosystem.
 Timing Attacks − They exploit the fact that different computations take different times
to compute on processor. By measuring such timings, it is be possible to know about a
particular computation the processor is carrying out. For example, if the encryption
takes a longer time, it indicates that the secret key is long.
 Power Analysis Attacks − These attacks are similar to timing attacks except that the
amount of power consumption is used to obtain information about the nature of the
underlying computations.
 Fault analysis Attacks − In these attacks, errors are induced in the cryptosystem and
the attacker studies the resulting output for useful information.
Practicality of Attacks
The attacks on cryptosystems described here are highly academic, as majority of them come from the
academic community. In fact, many academic attacks involve quite unrealistic assumptions about
environment as well as the capabilities of the attacker. For example, in chosen-ciphertext attack, the
attacker requires an impractical number of deliberately chosen plaintext-ciphertext pairs. It may not be
practical altogether.
Nonetheless, the fact that any attack exists should be a cause of concern, particularly if the attack
technique has the potential for improvement.
 6) Discuss the man in the middle attack.
Man-in-the-middle (MITM) Attacks
What is MITM Attack
A MITM attack is a form of cyber-attack where a user is introduced with some kind of
meeting between the two parties by a malicious individual, manipulates both parties and
achieves access to the data that the two people were trying to deliver to each other. A man-
in-the-middle attack also helps a malicious attacker, without any kind of participant
recognizing till it's too late, to hack the transmission of data intended for someone else and
not supposed to be sent at all. In certain aspects, like MITM, MitM, MiM or MIM, MITM
attacks can be referred.

If an attacker puts himself between a client and a webpage, a Man-in-the-Middle (MITM)

attack occurs. This form of assault comes in many different ways.

For example, In order to intercept financial login credentials, a fraudulent banking website
can be used. Between the user and the real bank webpage, the fake site lies "in the middle."

How does MITM work

There are several reasons and strategies for hackers to use a MITM attack. Usually, like credit
card numbers or user login details, they try to access anything. They also spy on private
meetings, which may include corporate secrets or other useful information.

The feature that almost every attack has, in general, is that the attacker pretends to be
somebody you trust (or a webpage).
Real life Instances of MITM attack

In the above diagram, you can see that the intruder positioned himself in between the client
and server to intercept the confidential data or manipulate the incorrect information of them.

Another Instance of MITM attack

As shown in the above picture, to obtain access to banking, the attacker is trying to imitate
both sides of the discussion. This instance is accurate for the client and the server discussions
and also person-to-person discussions. Shown in this instance, the attacker retrieves a public
key and can modulate his own passwords to manipulate the audience to accept that they are
safely communicating with each other at either end.

Types of MITM Attack

 o Wi-fi Eavesdropping
o DNS Spoofing
o IP Spoofing
o HTTPS Spoofing
o ARP Spoofing
o E-mail Hacking
o Session Hacking
o SSL Stripping
o MITB attack

The Two Phases of a Man-in-the-Middle Attack  

A successful MITM attack involves two specific phases: interception and decryption.  

1. Interception
Interception involves the attacker interfering with a victim’s legitimate network by intercepting it with
a fake network before it can reach its intended destination. The interception phase is essentially how
the attacker inserts themselves as the “man in the middle.” Attackers frequently do this by creating a
fake Wi-Fi hotspot in a public space that doesn’t require a password. If a victim connects to the
hotspot, the attacker gains access to any online data exchanges they perform.
Once an attacker successfully inserts themselves between the victim and the desired destination, they
may employ a variety of techniques to continue the attack:

 IP Spoofing: Every Wi-Fi-connected device has an internet protocol (IP) address that is central to how
networked computers and devices communicate. IP spoofing involves an attacker altering IP packets in
order to impersonate the victim’s computer system. When the victim tries to access a URL connected to
that system, they’re unknowingly sent to the attacker’s website instead.
 ARP Spoofing: With Address Resolution Protocol (ARP) spoofing, the attacker uses falsified ARP
messages to link their MAC address with a victim’s legitimate IP address. By connecting their MAC
address to an authentic IP address, the attacker gains access to any data sent to the host IP address.
 DNS Spoofing: Domain Name Server (DNS) spoofing, also known as DNS cache poisoning, involves
an attacker altering a DNS server in order to redirect a victim’s web traffic to a fraudulent website that
closely resembles the intended website. If the victim logs in to what they believe is their account,
attackers can gain access to personal data and other information.

2. Decryption
A MITM attack doesn’t stop at interception. After the attacker gains access to the victim’s encrypted
data, it must be decrypted in order for the attacker to be able to read and use it. A number of methods
might be used to decrypt the victim’s data without alerting the user or application:

 HTTPS Spoofing: HTTPS spoofing is a method for tricking your browser into thinking a certain
website is safe and authentic when it’s not. When a victim attempts to connect to a secure site, a false
certificate is sent to their browser which leads them to the attacker’s malicious website instead. This
gives the attacker access to any data the victim shares on that site.

 SSL Hijacking: Any time you connect to an unsecure website, indicated by “HTTP” in the URL, your
server automatically reroutes you to the secure HTTPS version of that site. With SSL hijacking, the
attacker uses their own computer and server to intercept the reroute, allowing them to interrupt any
information passed between the user’s computer and server. This gives them access to any sensitive
information the user uses during their session.
 SSL Stripping: SSL stripping involves the attacker interrupting the connection between a user and a
website. This is done by downgrading a user’s secure HTTPS connection to an unsecure HTTP version
of the website. This connects the user to the unsecure site while the attacker maintains a connection to
the secure site, rendering the user’s activity visible to the attacker in an unencrypted form.

Real-World Examples of a MITM Attack

There have been a number of well-known MITM attacks over the last few decades. 

 In 2015, an adware program called Superfish, which was pre-installed on Lenovo machines since
2014, was discovered to be scanning SSL traffic and installing fake certificates that allowed third-party
eavesdroppers to intercept and redirect secure incoming traffic. The fake certificates also functioned to
introduce ads even on encrypted pages. 
 In 2017, a major vulnerability in mobile banking apps was discovered for a number of high-profile
banks, exposing customers with iOS and Android to man-in-the-middle attacks. The flaw was tied to
the certificate pinning technology used to prevent the use of fraudulent certificates, in which security
tests failed to detect attackers due to the certificate pinning hiding a lack of proper hostname
verification. This ultimately enabled MITM attacks to be performed.

Detection of Man-in-the-middle attack

It is harder to identify a MITM attack without taking the appropriate measures. A Man-in-the-
middle assault will theoretically proceed unchecked till it's too late when you do not
consciously need to evaluate if your interactions have been monitored. Usually, the main
technique for identifying a potential-attacks are always searching for adequate page
authorization and introducing some kind of temper authentication; however, these
approaches may need further forensic investigation after-the-fact.
Instead of trying to identify attacks when they are operational, it is necessary to manage
precautionary measures to avoid MITM attacks whenever they occur. To sustain a safe
environment, being mindful of your surfing habits and identifying possibly hazardous
environments can be important.

Preventions of Man-in-the-middle attack

Here, we have discussed some prevention techniques to avoid the interactions being
compromised by MITM attacks.

1. Wireless access point (WAP) Encryption

Creating a strong protection feature on access points eliminates legitimate access just from
being closer from accessing the system. A vulnerable system of protection will enable an
intruder to brute-force his way into the system and start attacking the MITM.

2. Use a VPN

o Use a Virtual Private Network (VPN)

To encrypt your web traffic, an encrypted VPN severely limits a hacker's ability to read or
modify web traffic.
Be prepared to prevent data loss; have a cybersecurity incident response plan.
o Network Security
Secure your network with an intrusion detection system. Network administrators should be
using good network hygiene to mitigate a man-in-the-middle attack.
Analyze traffic patterns to identify unusual behavior.

3. Public Key Pair Authentication

MITM attacks normally include something or another being spoofed. In different layers of the
protocol stack, public key pair authentication such as RSA is used to ensure that the objects
you communicate with that are essentially the objects you want to communicate with.

4. Strong Network User Credentials

Ensuring that the primary email login is modified is extremely important. Not only the login
credentials for Wi-Fi but the password hashes for your router. When a hacker detects the
wireless router login details, they can switch the fraudulent servers to the DNS servers. Or, at
worst, hack the modem with harmful malware.

5. Communication security

Communication security help the users to protect from unauthorized messages and provides
secure data encryption.

Enabling two-factor authentication is the most powerful way to avoid account hacking. It
implies that you'll have to give another protection factor, in contrast with your login
credentials. One instance is the conjunction of a login credential and a text to your device
from Gmail.
6. Using proper hygiene for network protection on all platforms, such as smartphone
apps.

o Since phishing emails are the most popular attack vector when lookout a spam email. Analyze
the references cautiously before opening.
o Just mount plug-ins for the browser from trusted sources.
o Reduce the chance of exploits to disprove persistent cookies by logging out inactive accounts.
o Avoid what you're doing and execute a security scan if you anticipate a secure link but do not
have one.

7. Avoid using public wi-fi

Configure your phone to require a manual link if you're using public wi-fi.

It can be hard to identify MITM attacks as they are occurring. The easiest way to remain
secure is to regularly incorporate all of the above prevention for security.

Be conscious that such attacks are a part of social engineering. Take a couple of minutes to
dig deeper if anything doesn't seem normal about social media and email.

7) Give an example to explain the concept of transposition ciphers in detail.

Transposition Cipher
Transposition Cipher is a cryptographic algorithm where the order of alphabets in the plaintext is
rearranged to form a cipher text. In this process, the actual plain text alphabets are not included.

Example
A simple example for a transposition cipher is columnar transposition cipher where each character
in the plain text is written horizontally with specified alphabet width. The cipher is written vertically,
which creates an entirely different cipher text.
Consider the plain text hello world, and let us apply the simple columnar transposition technique as
shown below

The plain text characters are placed horizontally and the cipher text is created with vertical format as :
holewdlo lr. Now, the receiver has to use the same table to decrypt the cipher text to plain text.

Columnar Transposition Cipher

Given a plain-text message and a numeric key, cipher/de-cipher the given text using Columnar
Transposition Cipher
The Columnar Transposition Cipher is a form of transposition cipher just like Rail Fence
Cipher. Columnar Transposition involves writing the plaintext out in rows, and then reading
the ciphertext off in columns one by one.
Examples:
Encryption
Input : Geeks for Geeks
Key = HACK
Output : e kefGsGsrekoe_
Decryption
Input : e kefGsGsrekoe_
Key = HACK
Output : Geeks for Geeks

Encryption
Input : Geeks on work
Key = HACK
Output : e w_eoo_Gs kknr_
Decryption
Input : e w_eoo_Gs kknr_
Key = HACK
Output : Geeks on work
Encryption
In a transposition cipher, the order of the alphabets is re-arranged to obtain the cipher-text.
1. The message is written out in rows of a fixed length, and then read out again column
by column, and the columns are chosen in some scrambled order.
2. Width of the rows and the permutation of the columns are usually defined by a
keyword.
3. For example, the word HACK is of length 4 (so the rows are of length 4), and the
permutation is defined by the alphabetical order of the letters in the keyword. In this
case, the order would be “3 1 2 4”.
4. Any spare spaces are filled with nulls or left blank or placed by a character
(Example: _).
5. Finally, the message is read off in columns, in the order specified by the keyword.

Decryption
1. To decipher it, the recipient has to work out the column lengths by
dividing the message length by the key length.
2. Then, write the message out in columns again, then re-order the
columns by reforming the key word.
8) Discuss in detail about various types of Security attacks with
neat diagrams.
Repeated
9) Build a model for Network Security with a neat diagram.
Repeated
10) Explain various substitution techniques with suitable examples.

Substitution Technique in Cryptography

Substitution technique is a classical encryption technique where the characters
present in the original message are replaced by the other characters or numbers or
by symbols. If the plain text (original message) is considered as the string of bits,
then the substitution technique would replace bit pattern of plain text with the bit
pattern of cipher text.

We will discuss some of the substitution techniques which will help us to

understand the procedure of converting plain text o cipher text.  In this section, we
will study the following substitution techniques:

Substitution Technique:
1. Caesar Cipher
2. Monoalphabetic Cipher
3. Playfair Cipher
4. Hill Cipher
5. Polyalphabetic Cipher
6. One-Time Pad

Caesar Cipher
This the simplest substitution cipher by Julius Caesar. In this substitution
technique, to encrypt the plain text, each alphabet of the plain text is replaced by
the alphabet three places further it. And to decrypt the cipher text each alphabet of
cipher text is replaced by the alphabet three places before it.

Let us take a simple example:

Plain Text: meet me tomorrow

Cipher Text: phhw ph wrpruurz

Look at the example above, we have replaced, ‘m’ with ‘p’ which occur three places
after, ‘m’. Similarly, ‘e’ is replaced with ‘h’ which occurs in three places after ‘e’.
Note: If we have to replace the letter ‘z’ then the next three alphabets counted
after ‘z’ will be ‘a’ ‘b’ ‘c’. So, while counting further three alphabets if ‘z’ occurs it
circularly follows ‘a’.

There are also some drawbacks of this simple substitution technique. If the hacker
knows that the Caesar cipher is used then to perform brute force cryptanalysis, he
has only to try 25 possible keys to decrypt the plain text.
The hacker is also aware of the encryption and decryption algorithm.

Monoalphabetic Cipher
Monoalphabetic cipher is a substitution cipher, where the cipher alphabet for each
plain text alphabet is fixed, for the entire encryption.

In simple words, if the alphabet ‘p’ in the plain text is replaced by the cipher
alphabet ‘d’. Then in the entire plain text wherever alphabet ‘p’ is used, it will be
replaced by the alphabet ‘d’ to form the ciphertext.

Playfair Cipher
Playfair cipher is a substitution cipher which involves a 5X5 matrix. Let us discuss
the technique of this Playfair cipher with the help of an example:

Plain Text: meet me tomorrow

Key: KEYWORD

Now, we have to convert this plain text to ciphertext using the given key. We will
discuss the further process in steps.

Step 1: Create a 5X5 matrix and place the key in that matrix row-wise from left to
right. Then put the remaining alphabet in the blank space.

Note: If a key has duplicate alphabets, then fill those alphabets only once in the
matrix, and I & J should be kept together in the matrix even though they occur in
the given key.

Step 2: Now, you have to break the plain text into a pair of alphabets.
Plain Text: meet me tomorrow

Pair: me et me to mo rx ro wz

Note

 Pair of alphabets must not contain the same letter. In case, pair has the same
letter then break it and add ‘x’ to the previous letter. Like in our example
letter ‘rr’ occurs in pair so, we have broken that pair and added ‘x’ to the first
‘r’.
 In case while making pair, the last pair has only one alphabet left then we add
‘z’ to that alphabet to form a pair as in our above example, we have added ‘z’
to ‘w’ because ‘w’ was left alone at last.
 If a pair has ‘xx’ then we break it and add ‘z’ to the first ‘x’, i.e. ‘xz’ and ‘x_’.

Step 3: In this step, we will convert plain text into ciphertext. For that, take the first
pair of plain text and check for cipher alphabets for the corresponding in the
matrix. To find cipher alphabets follow the rules below.

Note

 If both the alphabets of the pair occur in the same row replace them with the
alphabet to their immediate right. If an alphabet of the pair occurs at extreme
right then replace it with the first element of that row, i.e. the last element of
the row in the matrix circularly follows the first element of the same row.
 If the alphabets in the pair occur in the same column, then replace them with
the alphabet immediate below them. Here also, the last element of the
column circularly follows the first element of the same column.
 If the alphabets in the pair are neither in the same column and nor in the
same row, then the alphabet is replaced by the element in its own row and
the corresponding column of the other alphabet of the pair.

Pair: me et me to mo rx ro wz

Cipher Text: kn ku kn kz ks ta kc yo

So, this is how we can convert a plain text to ciphertext using Playfair cipher. When
compared with monoalphabetic cipher Playfair cipher is much more advanced. But
still, it is easy to break.

Hill Cipher
Hill cipher is a polyalphabetic cipher introduced by Lester Hill in 1929. Let us
discuss the technique of hill cipher.

Plain text: Binary

Key: HILL
Choose the key in such a way that it always forms a square matrix. With HILL as
the key, we can form a 2×2 matrix.

Now, of plain text, you have to form a column vector of length similar to the key
matrix. In our case, the key matrix is 2×2 then the column vectors of plain text
would be 2×1.

The general equation to find cipher text using hill cipher is as follow:

C = KP mod 26

For our example, our key matrix would be:

And our plain text matrices of 2×1 will be as follow:

Now, we have to convert the key matrix and plain text matrices into numeric
matrices. For that number the alphabets such as A=0, B=1, C=2, …………, Z=25. So,
considering the alphabet numbering:

Key matrix will be:

Plain text matrices would be:

In the first calculation, we would get two cipher alphabets for plain text alphabet ‘B’
& ‘I’.
So, the cipher alphabet for plain text alphabet ‘B’ & ‘I’ is ‘T’ & ‘V’. Similarly, we have
to calculate ciphertext for remaining plain text. And then accumulate them to form
the ciphertext.

The calculated ciphertext for ‘Binary’ using hill cipher is ‘TVNNZJ’.

Polyalphabetic Cipher
Polyalphabetic cipher is far more secure than a monoalphabetic cipher. As
monoalphabetic cipher maps a plain text symbol or alphabet to a ciphertext symbol
and uses the same ciphertext symbol wherever that plain text occurs in the
message.
But polyalphabetic cipher, each time replaces the plain text with the different
ciphertext.

One-Time Pad
The one-time pad cipher suggests that the key length should be as long as the plain
text to prevent the repetition of key. Along with that, the key should
be used only once to encrypt and decrypt the single message after that the key
should be discarded.

Onetime pad suggests a new key for each new message and of the same length as
a new message. Now, let us see the one-time pad technique to convert plain text
into ciphertext. Assume our plain text and key be:

Plain text: Binary

Key: Cipher
Now again convert the plain text and key into the numeric form. For that number
the alphabets such as A=0, B=1, C=2, …………, Z=25. So, our plain text and key in
numeric form would be:

Plain text: 1 8 13 0 17 24

Key: 2 8 15 7 4 17

Now, you have to add the number of the plain text alphabet, to the number of its
corresponding key alphabet. That means, for this example, we will add:

B+C = 1+2 = 3

I+I = 8+8 = 16

N+P = 13+15 = 28

A+H = 0+7 = 7

R+E = 17+4 = 21

Y+R = 24+17 = 41

The resultant ciphertext numbers we get are (3, 16, 28, 7, 21, 41)

If the addition of any plain text number and the key number is >26, then subtract
only that particular number from 26. We have the addition of two pair of plain text
number and a key number, greater than 26, i.e. N+P=28 & Y+R=41.

Subtract them by 26.

N+P = 28 – 26 = 2

Y+R = 41 – 26 = 15

So, the final ciphertext numbers are (3, 16, 2, 7, 21, 15). Now convert this number
to alphabets assuming A to be numbered 0 and B to be 1…..Z to 25.

Ciphertext: dqchvp.

In this way, we can convert plain text to cipher text using a one-time pad.

So, this is all about the substitution cipher techniques. It has a monoalphabetic
cipher and polyalphabetic cipher technique. Substitution technique is also called
classical substitution technique.