Network security — DDoS, man-in-the-middle, replay attacks, countermeasures

4.3.31 · Coding › Computer Networks

1. Denial-of-Service & DDoS

YEH KAAM KYUN KARTA HAI: har server ke paas ek finite resource $R$ hoti hai (jaise ki half-open TCP connections ki sankhya). Agar attacker ke requests server ko attacker se zyada kharcha karaate hain, toh attacker asymmetry se jeet jaata hai.

Worked example SYN flood (classic DoS)

Setup: TCP handshake hai SYN → SYN-ACK → ACK. Server state (ek transmission control block) allocate karta hai SYN ke baad aur ACK ka wait karta hai.

Attacker bahut saare SYN packets spoofed source IPs ke saath bhejta hai. Yeh step kyun? Spoofing ka matlab hai real owner kabhi final ACK nahi bhejta, toh connection half-open rehta hai.
Server SYN-ACK reply karta hai aur apne backlog queue mein size $B$ ka ek slot reserve karta hai. Yeh step kyun? Server ko pending connections yaad rakhni padti hain taaki unhe complete kar sake.
ACK kabhi nahi aata; slot timeout $T$ tak held rehta hai. Yeh step kyun? Yahi woh resource hai jo exhaust ho rahi hai.
Agar attacker rate $λ$ SYNs/sec se bhejta hai, toh occupied slots $\approx min (B, λ T)$ . Jab $λ T \geq B$ toh queue full ho jaati hai → legitimate users reject ho jaate hain.

Yahaan $c_{a}$ = ek tiny SYN packet, $c_{s}$ = $T$ seconds ke liye held memory → bada $A$ .

Recall (D)DoS ke liye Countermeasures

SYN cookies: server connection state ko memory allocate karne ki jagah initial sequence number mein encode karta hai → koi state nahi jab tak ACK client ka real hona prove na kare. Asymmetry remove hoti hai.
Rate limiting / traffic shaping, ingress filtering (BCP 38) edge pe spoofed source IPs drop karne ke liye.
Scrubbing centers / CDNs / Anycast volumetric floods ko absorb aur disperse karte hain.
CAPTCHAs / proof-of-work $c_{a}$ badhate hain taaki $A$ gir jaaye.

2. Man-in-the-Middle (MITM)

Recall MITM countermeasures

TLS with certificates: server apni identity ek CA-signed certificate ke zariye prove karta hai; public key domain name se bound hoti hai. Extra safety ke liye certs pin karo.
HSTS HTTPS force karta hai taaki attacker use HTTP mein strip na kar sake.
Mutual authentication, DNSSEC, dynamic ARP inspection switches pe.
General rule: encrypt + authenticate. Encryption akela (koi identity check nahi) phir bhi MITM allow karta hai.

3. Replay Attacks

Figure — Network security — DDoS, man-in-the-middle, replay attacks, countermeasures

4. Comparison table (80/20 core)

Attack	Toodi gayi assumption	Core fix
DDoS	Server resources kaafi hain	Rate limit / verify hone tak koi state nahi (SYN cookies, scrubbing)
MITM	Mein real party se baat kar raha hoon	Authentication (TLS certs, signed DH)
Replay	Ek valid msg ek baar valid hota hai	Freshness (nonce, timestamp, challenge)

Common mistake Common errors ko steel-man karna

"HTTPS/encryption replay attacks rok deta hai." Kyun sahi lagta hai: encryption confidentiality aur (MAC ke saath) integrity protect karta hai, toh complete lagta hai. Fix: ek replayed valid ciphertext phir bhi verify karta hai — tumhe freshness ke liye nonce/timestamp/sequence number bhi chahiye. (TLS internally sequence numbers ke zariye yeh add karta hai; raw encryption nahi karta.)
"Diffie–Hellman akele ek secure channel deta hai." Kyun sahi lagta hai: yeh ek shared secret produce karta hai jo koi eavesdropper nahi padh sakta. Fix: yeh secrecy deta hai lekin authentication nahi → MITM. Tumhe DH values sign karni hongi.
"DDoS rokne ke liye bas attacker ka IP block karo." Kyun sahi lagta hai: ek source → ek block. Fix: DDoS hazaaron spoofed/botnet IPs aur reflection use karta hai; per-IP blocking scale nahi kar sakta aur innocent reflectors ko block kar sakta hai.
"Bada SYN backlog $B$ SYN floods solve karta hai." Kyun sahi lagta hai: zyada slots = fill karna mushkil. Fix: attacker sirf $λ$ badha leta hai kyunki $λ \geq B / T$ phir bhi hold karta hai; real fix hai state allocate hi na karna (SYN cookies).

Recall Feynman: ek 12-saal ke bachche ko explain karo

Ek dukaan (server) imagine karo. DDoS ek flash mob jaisa hai jo darwaaze par bheed laga deta hai taaki real customers andar na aa sakein — tum isse fix karte ho ek quick ticket check karke pehle kisi ko darwaaza block karne dene se. Man-in-the-middle ek cheater messenger jaisa hai jo tumhare aur tumhare dost ke beech notes le jaata hai, unhe secretly padh aur badal raha hota hai — tum use ek aisi seal se harate ho jo sirf tumhara dost verify kar sakta hai. Replay koi hai jo tumhara "mujhe ek cookie do" wala note photocopy karke kal phir se de deta hai — tum use rok dete ho har note pe aaj ka secret password likhke taaki purani copies kaam na aayein.

Flashcards

(D)DoS ko effective banane wali asymmetry kya hai?

Attacker ka cost per packet

c_{a}

server ke forced cost

c_{s}

se bahut kam hota hai, toh amplification

A = c_{s} / c_{a} ≫ 1

SYN flood mein kaunsa resource exhaust hota hai aur kaise?

Half-open connection backlog: spoofed SYNs server ko timeout

T

tak slots reserve aur hold karaate hain; rate

λ

se, held slots

\approx λ T

SYN-flood collapse condition aur uski derivation batao.

λ \geq B / T

, Little's Law

L = λ T

se jo backlog size

B

se exceed kare.

SYN cookies SYN floods ko kaise defeat karte hain?

Server connection state ko memory allocate karne ki jagah initial sequence number mein encode karta hai, toh koi state nahi rakhi jaati jab tak ek valid ACK client ka real hona prove na kare.

DNS amplification spoofed source IPs kyun use karta hai?

Taaki bada reply (reflection) victim ke paas jaaye, aur visible source ek innocent resolver ho, attacker nahi.

Plain Diffie–Hellman MITM ke liye vulnerable kyun hai?

Yeh ek shared secret provide karta hai lekin koi identity proof nahi; Eve do DH exchanges run karti hai aur har party ke saath ek key share karti hai. Fix: DH public values sign/authenticate karo.

MITM ek hi kaun si property exploit karta hai aur kya fix karta hai?

Missing authentication; certificates/signatures (TLS) se fix hota hai jo identity ko keys se bind karta hai.

Encryption akela replay attack kyun nahi rokta?

Attacker genuine ciphertext bina padhe phir bhej deta hai; tumhe freshness (nonce/timestamp/sequence number) chahiye, sirf secrecy nahi.

Replay defense mein nonce aur timestamp ka role kya hai?

Nonce: ek once-only value jo ek "seen" set mein track hoti hai taaki repeats reject ho; timestamp: sirf tab accept karo agar window

Δ

ke andar ho taaki purane captures expire ho jaayein.

Nonce ko MAC ke saath combine kyun karna chahiye?

Warna attacker sirf nonce change kar leta; MAC

t = MAC_{K} (m ∥ n)

freshness ko integrity se tie karta hai.

Har attack ko uski toodi gayi assumption se map karo.

DDoS: enough resources; MITM: real party se baat ho rahi hai; Replay: ek valid message sirf ek baar valid hota hai.

Challenge–response replay ko kaise prevent karta hai?

Server ek fresh random

r

issue karta hai; client

MAC_{K} (r)

return karta hai; ek purana response naye challenge ke against verify nahi karega.

Connections

Transport Layer — TCP three-way handshake (SYN flood target)
Diffie–Hellman key exchange aur TLS handshake (MITM defense)
Message Authentication Codes (MAC) & HMAC (replay + integrity)
Public Key Infrastructure & Certificates (authentication)
Little's Law (SYN-flood capacity mein use ki gayi queueing math)
Firewalls, NAT & Ingress Filtering (BCP 38) (anti-spoofing)