Assignment 5
Assignment 5 is due 11/26/18 on or before 11:59:59pm MST.
Part 1 — Mobile Asset Management Policy (40 points)
You are the CISO of a company called Cyberdyne.
Recently, you have realized that your company lackes a policy on managing your mobile assets: employees are connecting their personal devices to your network and systems.
One of your direct reports has given you a draft of a management policy (posted in the course Piazza).
You need to: write a critique of the current draft, identifying what aspects the policy does not cover, why those aspects should be covered, and how to address that within the policy.
Submission Instructions
You will need to submit your critque as a text file (assume that it is a plain text email that you are writing). This means no pictures or diagrams, only writing. Also no PDF, DOCX, or other file types, just a text file.
Submit a file called critique.txt. This file should contain your
name and ASU ID at the top of the page.
Part 2 — Data Exfiltration (60 points)
When compromising a system, an adversary needs to get data back out from the system. Typically, massive data transfers of entire credit card databases are flagged and caught. Therefore, quietly and secretly exfiltrating data is incredibly important.
Your goal will be to create, in any language, a program that exfiltrates data using the IP datagram.
Your program will be a single executable, called secret_sender.
Interface
You must implement the following command-line interface for your program:
./secret_sender <ip_address> <interface> <type> <message>
Your program will then send the <message>, encoded as described
below, to the IP address specified by <ip_address> on physical
interface <interface>. <type> specifies the type of packet that
the IP datagram will hold, where <type> will be one of:
- 0: ICMP Echo Request Message
- 1: TCP SYN packet to port 80
Exfiltration Protocol
From the IP Datagram RFC 791:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Our protocol for exfiltration data is as follows:
Each byte of the message will be sent in the IP layer of a packet (so one packet will be sent for every byte of the message).
The message byte will be encoded in the high 8 bits of the Identification field of the IP datagram. The lower 8 bits of the Identification field should be consistent, as they will serve as the identifier of this message (and not all 1s, as noted below).
The byte number (the number of the byte from the message being sent) will be encoded into the lower 8 bits of the Fragment Offset field (note this means that at most we can send 28 - 1 size messages). Finally, when there are no more bytes to send, the highest bit of the Fragment Offset should be set to 1 and the lower 8 bits of the Fragment Offset field will be set to the length of the message (total bytes sent).
Example
When your program is executed with the following commands:
./secret_sender 192.168.1.10 eth0 0 test
Let’s say our random ID is 0x41 for this exfiltration:
Then your program will send the following five packets (note that we’re only showing the IP header here, not the ICMP echo request message):
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x74 0x41 |Flags| 0x000 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x65 0x41 |Flags| 0x0001 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x73 0x41 |Flags| 0x0002 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x74 0x41 |Flags| 0x0003 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0x00 0x41 |Flags| 0x1004 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Protocol | Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Options | Padding |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Implementation
For this project, while you can choose any language you wish, I highly
recommend that you use Scapy. I will make sure that the
submission server has the python-scapy package installed.
Another option is to use libnet. You are free to use whatever library you want, however it must allow arbitrary packet creation. It is your responsibility to do the research about an unsupported library (it will also be more difficult for us to help you).
Note that you must run your program as root to be able to get access to the raw sockets. This means that the submission system will be running your code as root, so please do not attempt anything malicious.
Your program must work on Ubuntu 18.04 64-bit with the default packages installed. Here is a list of installed packages. You’ll probably need to set up a virtual machine to do the development.
If you wish to use packages that are not installed on Ubuntu 18.04
64-bit by default, please submit a file entitled packages, with a
list of the Ubuntu 18.04 64-bit packages that you would like installed
before calling make. Each line of packages must be a
valid package name, one package per line. The
submission system will automatically install all the dependencies that
the package lists.
For example, if you were going to write your assignment in Haskell,
you could install the GHC compiler with the following packages file:
ghc
ghc-dynamic
Server
I will provide a server implementation for your to test your client. This will be posted in the course Piazza.
Submission Instructions
You will need to submit your source code, along with a Makefile and
README. The Makefile must create an executable called secret_sender when
the command make is ran. Your README file should contain your name,
ASU ID, and a description of how your program works.
A prior TA compiled some resources on how to write a Makefile:
Submission Site
Create an account to submit your homework on the course submisison site.
Please don’t forget your password.