OSI Security Concern

I have a few questions based on the OSI model and security.
----
For reference:

7-Application
6-Presentation
5-Session
4-Transport
3-Network
2-Data-Link
1-Physical
--------

I am no where near an expert in the topic, but have begun to closley study the open-systems interface face model, and have been very interested in what I have found.

My first question would be, to any one who may be willing to participate in this open-ended discussion... What security risks/issues are commonly associated with what layers?

Thus far, I have found that data encryption resides @ the Layer 6 (Presentation) layer. This concerns me. While this is data manipulation is done very early on the system building the data frames, it is consequently not recognized or 'decrypted' until very late on the recieving system, or the system that is 'un-packing' the information.

I am interested in hearing if anyone is familiar with a Layer 1, or PHYSICAL device, that encrypts information @ lower layers, such as @ the bit level. If it were necessary for any computer to be able to recognize that a data 'group' was indeed a legitimate packet, then this device would not be able to be a layer 1 device, as fields, as well as data fields would be altered(processed) with the encryption algorithm. In this case, the device would need to be a physical, but 'thinking' device (i.e, a layer 2 device).

However, if individual computers were configured with similiar or corresponding devices, then the header fields, as well as data fields, could necesarily be included in the encryption process, and only the computer(s) fitted with the appropriate physical mechanisms would be able to comprehend that these 'information groups' were even legitimate packets. Anyone else, (i.e., unauthenticated or remote users), would simply discard the information, and if used under some sort of connectionless (say, udp-like) standards, would move on, as if the data were never recieved.

If this were so, the only hurdle we would be facing now would be actually using this system in a switched, or rather, routing orientated network topology, as the router interfaces, using the example above, if not fitted properly, would not be able to comprehend the encrypted header fields, and would discard the information.

Please let me hear any thoughts one may have on what I have said.

Thank you.
comJo

Quote:

---

I am interested in hearing if anyone is familiar with a Layer 1, or PHYSICAL device

---

I'm familiar with it - its just cable, be it cat 5/co-ax/serial/whatever, its just cable.

Seriously though, kudos to you for wanting to discuss such an in depth topic - i just don't think this is the place to try and redesign the osi model.

I remember doing this back in the 80's with Telebit modems on direct connections, the modems themselves actually took care of the encryption of the uucp data being transmitted.

I would imagine that the encryption being performed by todays wireless devices would classify as the same.

I think the problem arises that devices not understanding the encryption methods would probably just discard the packets as bad. It would probably only work on point to point links.

cheers

Sorry Petemcevoy, but I happen to like this stuff ;)

Quote:

---

My first question would be, to any one who may be willing to participate in this open-ended discussion... What security risks/issues are commonly associated with what layers?
Thus far, I have found that data encryption resides @ the Layer 6 (Presentation) layer. This concerns me. While this is data manipulation is done very early on the system building the data frames, it is consequently not recognized or 'decrypted' until very late on the recieving system, or the system that is 'un-packing' the information.

---

You're right about the data encryption residing at Layer 6. It indeed is the only 'security' layer...
Data compression for example is a Layer 6 process (be it Compress, GZIP, PKZIP,..)
Encryption / Authentication are the other Layer 6 processes. Different computers handle data in a different way; the function of Layer 6 is to make an abstraction of the data, and provide a key to encode that data on the wire.

The lower Layers are just interested in moving data...

Quote:

---

I am interested in hearing if anyone is familiar with a Layer 1, or PHYSICAL device, that encrypts information @ lower layers, such as @ the bit level.

---

No encryption at Layer 1, only encoding/decoding, modulation/demodulation ...
May I suggest this link on the TLS protocol: " This document specifies Version 1.0 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications privacy over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery"

Quote:

---

If it were necessary for any computer to be able to recognize that a data 'group' was indeed a legitimate packet, then this device would not be able to be a layer 1 device, as fields, as well as data fields would be altered(processed) with the encryption algorithm. In this case, the device would need to be a physical, but 'thinking' device (i.e, a layer 2 device).

However, if individual computers were configured with similiar or corresponding devices, then the header fields, as well as data fields, could necesarily be included in the encryption process, and only the computer(s) fitted with the appropriate physical mechanisms would be able to comprehend that these 'information groups' were even legitimate packets. Anyone else, (i.e., unauthenticated or remote users), would simply discard the information, and if used under some sort of connectionless (say, udp-like) standards, would move on, as if the data were never recieved. If this were so, the only hurdle we would be facing now would be actually using this system in a switched, or rather, routing orientated network topology, as the router interfaces, using the example above, if not fitted properly, would not be able to comprehend the encrypted header fields, and would discard the information

---

Hehe, I like your thinking...
I guess what you suggest would indeed, as Petemcevoy stated, redesign the OSI-model, and that's exactly what the TLS model is about ;)

The wireless medium is coming up in the security world. That is where Layer 1 and 2 security should prove most interesting at this time. An example is the frequency switching schemes that the military and intelligence organizations use being implemented with infrared NICs.

The other thing you could look into is eavesdropping. That is deffinitely classified under the physical layer.

Don't let anyone tell you that fiber optic is secure in any way, it isn't. Give me twenty minutes with a soldering iron, some parts and my trusty schematic notebook and I'll show you how to circumvent Fiber security without downgrading the signal too much.

You've get 20 minutes, a soldering iron, some parts and your trusty schematic notebook, tell us how to circumvent "fiber" optic security without downgrading the signal too much.

Im typing up my notes right now, hold on.

Why do you need to type up notes? If you could do it in 20 minutes then surely you could give us an idea of the methods employed off the top of your head.

Fiber phototransistor Q1 recieves the input signal. It recieves its DC bias through R1(3.9k). Since the wire impeadance and the tap arises problems to signal reception a simple one-transistor amplifier has been added. The amplifier must be configured for the frequency being tapped. This is done through two 5k pots to replace the standard resistors so the device is re-useable. After amplification the signal is sent through the 10k:600 Transformer loaded by R4. The output signal through labeld leads 3 and 4 are connected to another fiber LED to be sent to the mux and recorded. From T1(note to antionline that this is the transformer) the signal should go through a buffer to remove static and further enhace the signal, unfortunately I do not have access to such a schematic so a overly strong signal should suffuce.

Parts include
2 fiber leds (Motorola MFOE71 Ir leds in coupler)
1 fiber phototransistor (Motorola MFOD72 IR in coupler)
2 5k pots or 2 tested resistors

resistors
1 10k
1 3.9k
1 1.2k

capacitors
3 .1 uF coupling
22 pF ceramic
10 uF aluminum electrolyte or tantalum

600:10k trans (Mouser p/n 42TL019)

battery, electronic cutter, pc board..etc.






this is directly from my notes, this stuff comes from a few electronic books such as the amplifier from 'The Encyclopedia of electronic circuits' I'm not sure what volume but I only have the first two. I used 'The Circuit Designers companion' for the layout with some help from a published author(paladin-press) when he was doing an IRC discussion forum.

I will not post the schematics because
1. it will look like crap similar to the old phreaking manuals and
2. I don't want anyone to go around hacking up T1s and it leading back to me

Disclaimer
I am not responsible for anything, including my own actions.

The method is simple and straight-foreward. You woud not belive me unless I posted details.

Granted that a custom pc board takes close to four hrs to burn but this is assuming that you do not need to hide the tap and you can use a generic board. This circuit will, theoretically, have serious problems when frequency, amplitude and...arggh..i cant remember the third type of modulation..ahh anyway when all three types of modulation are used it experiences problems. It, theoretically, works great with digital and even acts as a repeater so with long connections it would probably improve the speed.

The wires have to be electronically cut, then both ends stripped and connected to the couplings. Also note that unless you have a way to configure your mux the same as the other two, the output will look scrambled most of the time. The ideal connection would be baseband that is a few miles long. I didn't say it is perfect.

Hmm. Looking back at my last posts I do see that I got a little excited. It has been a long time since I went over my electronics library. Thank you petemcevoy for making me prove myself, it was kinda fun.

You are so lame.
Didn't you see what happened to KaKasomebody!
You said you could circumnavigate a fibre optic networks's security in 20 mins, from this statement i can extrapolate 2 things - 1: you heard/read somewhere that fibre optic networks were more secure than other networks, and 2:you haven't got the first clue about network security.
Allow me to explain why.
The true reason fibre optic networking is secure has nothing to do with it being more resistant to intruders having local access to the network, its more to do with it being unsniffable - what the hell would you do with a soldering iron and "some parts"?
And also you didn't know how to set a network card to use dhcp in linux - it just doesn't add up.

I am new to linux. And if you havent noticed I am into electronics. Fiber is a much more secure medium. And have you ever heard of FiberLANs it is an IEEE standard. This means that fiber NICs are used and fiber optic cable instead of coax or tp. How can what the medium be made out of determine how sniffable a network is. What makes fiber usually unsiffable is MULTIPLEXING spell it with me now M-U-L-T-I-P-L-E-X-I-N-G. All that you need to undo that nasty max-bandwidth using scheme that is also good for security is what is known as a multiplexer. Then the last thing you need is a way to get at the signal. With any other medium it is simple. But with fiber it is nearly unprecedented that a civilian can tap it, and yet it is fairly simple. Light is more ceseptible to dampeningg than electric signals across wire so you can easily be caught or the line can go down unless you amlify it.


So tell me again why I am lame and fiber is unsiffable. I was talking about Layer 1 security THE ORIGINAL TOPIC, in conjunction with long range connections like T1 lines.

You see that fiber security does not go past the physical layer so I dont know how you could thinlk that it is 'unsiffable' when the medium has nothing to do with that type of behavior since sniffing is higer up in the layers.

Lol, your a quick learner - beaverishly reading away at every website you could find on fibre optic networking.
I do know a bit about fibre optic lans, i helped fit one for a large govermental corporation when i was contracting.
If you'd like to meet in irc antionline for a little realtime chat (without the aid of search engines) i'd be only too happy to discuss the topic further.

This is really quite enjoyable. Sure I'll go on irc some time, I don't have it now though. I have not been beaverishly reading away at every website I could find on fibre optic networking. I'm working on my CCNA and CNE right now. I'm actually ashamed that I could not remember the number for the IEEE standard, since I was studying that last week.

If you want to check out those part numbers or paladin-press for that matter go ahead. It is all quite real. That author did produce a book, that is what the IRC forum was about. Before you even ask this was way back in '97 when I was barely getting into network security so dont bother me about not having irc anymore.

By the way

Quote:

---

govermental corporation

---

Now isn't that contradictory considering corporations are out for profit and governments provide services to the people who so diligently pay taxes without any want of profit.

nevermind they have a nice little java system for irc im on now.

Quote:

---

Originally posted by prof3ssor
This circuit will, theoretically, have serious problems when frequency, amplitude and...arggh..i cant remember the third type of modulation..ahh anyway when all three types of modulation are used it experiences problems

---

Phase...Amplitude, Frequency and Phase... And don't forget Echo Cancellation...

I agree that sniffing has nothing to do with it, being a higher Layer process. But can't 'sniffing' also refer to the physical sniffing of a communication line? Electrical power through a conductor generates an electromagnetic field, which isn't that hard to 'sniff', I guess. We WERE talking about Layer 1, remember? I don't see how you physically can sniff a Fiber line, though... Doesn't that implement cutting the wire?

Quote:

---

Originally posted by Petemcevoy
The true reason fibre optic networking is secure has nothing to do with it being more resistant to intruders having local access to the network

---

Damn, there goes my theory...

Quote:

---

govermental corporation

---

A paradox indeed...But let me remind you, prof3ssor, that a paradox seems incorrect, but it actually IS TRUE... If it weren't true, it wouldn't be a paradox... So there's nothing wrong with 'governmental corporation'...

Quote:

---

Negative:
Phase...Amplitude, Frequency and Phase... And don't forget Echo Cancellation...

I agree that sniffing has nothing to do with it, being a higher Layer process. But can't 'sniffing' also refer to the physical sniffing of a communication line? Electrical power through a conductor generates an electromagnetic field, which isn't that hard to 'sniff', I guess. We WERE talking about Layer 1, remember? I don't see how you physically can sniff a Fiber line, though... Doesn't that implement cutting the wire?

---

The easiest way is to simply use a fiber optic splitter, I'm not going to get into the argument between the two of them, but I will say that when we ran the fiber between our two offices underground, we had to use one on the other end to sniff traffic because of communication problems after it was installed. We didn't know if it was the equipment or the fiber. We later found out it was the equipment (thank goodness, ever seen that gross crap you have to put on the line to make sure it goes through the underground pipes smoothly :( ) Can you sniff a fiber? Yes. What layer is that suppose to be? I'm staying out of that one :)

It seems that nobody is going to take me at my word on this, here's a link giving some details

http://www.boran.com/security/it10-l...html#Heading18

I could find more but its not my style to run around doing searches to seem knowledgable.

Quote:

---

from http://www.boran.com/security/it10-l...html#Heading18
==========================
If confidentialiyt is a major concern, use fibre optics, they are very dificult to interrupt or sniff.
==========================
Because FDDI is a fibre optic ring, it is impossible to "listen" by detection of magnetic fields and if someone tries to connect to the ring, they need specialist equipment and the ring would be disturbed - it should not go unnoticed.
==========================

---

Remember that nothing is impossible, which is what I thought you two were talking about, I must be wrong. Now provided someone who wants to sniff your network is going to spend that kind of money on that kind of equipment, I think the only people that could would be a government of some nation. So provided the large cost of equipment to purchase or produce to do this, would outweigh what gains you could achieve. This is of course to go unnoticed. If you knew what was going on with your network, then the cheap stuff (actually still expensive) works just as well. I think it's safe to say that *one* person wouldn't go through all this trouble to tap a fiber when he/she could find other ways into a network.

I am talinkg about wiretapping. In most situations there is no reason for it but the spiffy little device negates the security of fiber lines. In most instances fiber can be approached just like any other medium.

The way to cut into a line that is outlined here is the least expensive option. If the line isn't being multiplexed then it can be done for under $50 if you can borrow someone's cutter.

Apparently petemcevoy does not know what network sniffing is in the software sense.

Quote:

---

if someone tries to connect to the ring, they need specialist equipment and the ring would be disturbed - it should not go unnoticed.

---

This is what my device tries to limit-connection disruption, while still tapping the line.

You're a joker prof3ssor, you haven't got a clue.

I might bore you guys, but I'd like to come back to 'Because FDDI is a fibre optic ring, it is impossible to "listen" by detection of magnetic fields and if someone tries to connect to the ring, they need specialist equipment and the ring would be disturbed - it should not go unnoticed' (from http://www.boran.com/security/it10-l...html#Heading18 ). Now, FDDI consist of two REDUNDANT concentric rings, meaning if one ring (the primary) goes down, the other (the secundary) takes it over. Correct me if I'm wrong, but I don't think you, as a user of that network, would notice that... Of course your administrator would notice it, but it could be too late by that time...
And Prof3ssor, is this the kind of multiplexing you were talking about? Just curious ;)

sorry for my absence from this thread i started.

physical tapping of fiber optics? not impossible, but to the utmost impractical and certainly there exists a multitude of much easier ways for sniffing a network or individual host ( trojans, modification of routing tables, modification of routers and/or switches, etc). That, at least, is my input.

--
So, to further the original intent of my discussion, i move on>

It came to my attention after some time of thought to ask anyone the following..

Seeing as the Session Layer (osi layer 5) provides a virtual data stream to the transport layer (osi layer 4) from the Higher levels, data, after being sent below the presentation layer (osi layer 6), that originates @ the Application layer, may not be modified. Like wise, on a recieving system, data that is coming up the stack may not be modified UNTIL it has been 'unpacked' by the mid layers and sent on to the higher layers. This is @ least my assumption. Can anyone else add to this statement? (disprove, add, or approve).

Inquiry #2: If data is to be neither encoded, encrypted, nor compressed, does it still pass through the presentation layer, under some type of 'null' flag or something?

OverandOut.
comJo

i need more detailed source so please send me a data about OSI Security maybe i can arraged it to be book for us...
are any body agree :)

Quote:

---

Originally posted by comJo

Inquiry #2: If data is to be neither encoded, encrypted, nor compressed, does it still pass through the presentation layer, under some type of 'null' flag or something?

---

OSI layers are "theorical" (hence the OSI "Model" appellation), it's up to the developpers to decide what layers they will implement depending on the purpos of the stack/application... So no, it isn't passed up to the next layer with a "null flag", since that next "unused" layer just doesn't exist...

For example, you could write a really basic chat program where you exchange text character by character over a tcp connection. In this example you would use the 4 layers already implemented in the tcp/ip stack (Pysical, data link, network, transport) and would go right to the application layer ie: where your program takes the input from the tcp socket and prints it to the screen.

Hope this helps..

Ammo

I don't know why you guyz decided most encryption is done at layer 6?.
Most modern (Checkpoint, Mircosoft, IPsec) VPN's encrypt at layer 3 or 4 (FWZ, IKE, SKIP) which is as low as you can go on a routed/natted network obviosly. as for Wireless Encryption, 802.11b does come with 40 or 128 wep encryption (which would be Layer 2 ).