1. Network and System Security Risk Assessment
--Introduction

2. Outline Why to begin this subject? What is in this course? 知己知彼，百战不殆。
Network Security
System Security
What is in this course?
Network protocols and problems
System security configuration and programming
知己知彼，百战不殆。

3. some interesting examples
Conan
Kevin Mitnick
And other hackers

4. An interesting movie clip
Phreaking
is a slang term coined to describe the activity of a culture of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks.

5. An interesting interview
Kevin Mitnick interview
Kevin Mitnick attack in 1994
From the material we know, unlike most other hackers, Kevin Mitnick is quite social.

6. Purpose of the Course
provide a basic introduction on common network and system security vulnerabilities;
Cultivate basic networking and system programming skills;

7. Content of the Course Analysis of packet structure
Packet sniffing
Port scanning…. ….
Introduction to a number of threats and vulnerabilities of TCP/IP protocol stack:
ARP poison…
TCP SYN Flooding

8. Content of the Course
Cover some computer system security problems and programming
Firewall: iptables & netfilter
Kernel module
Rootkit ….

9. Experiments Write simple programs: backdoor; sniffer; Firewall;
Rootkit; ….

10. Expectation: Get an in-depth understanding of TCP/IP protocol stack
Familiarize with usage of various network commands and tools
Master socket programming, netfilter, etc.

11. Contents of Network Security
Protocols, Vulnerabilities, Attacks & Defences
ARP Protocol and ARP cache poisioning
IP protocol, packet sniffering, IP spoofing, IP fragmentation attacks
ICMP protocol and ICMP misbehaviors
TCP protocol, TCP session hijacking, SYN flooding attacks, DoS attacks, and DDoS attacks
IP Routing protocols and Attacks
DNS and Pharming
Port scanning and signature identification.

12. Skills to be mastered
Various commands
Various tools

13. Grading (subject to change)
Final Exam: 60%
Labs and Projects: 30%
Class Attendance: 10%

14. Demo: Security Tricks ARP Poisoning
Attackers use spoofed ARP message in LAN to associate MAC address and IP address in a malicious way to poison victim’s ARP cache
Netwox 80 –eth –ip –eth-dst --ip-dst

15. Demo: Security Tricks ICMP Redirect Attack
Attackers sends ICMP redirect message to user, spoofing as default route, to change the best routing to attacker itself
netwox 86 –gw –src-ip

16. Demo: Security Tricks SYN Flooding Attacks:
Perform denial of service attack, attacker sends packets of SYN request message to target and never sends ACK message.
Netwox 76 –dst-ip --dst-port

17. Demo: Security Attacks
Backdoor
Based on socket programming, this program will bind to a port and waits for a password
The program is with root priviledge

18. Demo: Security Tricks A packet sniffer:
Write a program to sniff packets on the local machine with libpcap
Compile self-defined rules

19. Demo: security tricks A simple packet filter:
Which will filter packets on lo interface， UDP packets, etc.

20. Demo: Security Tricks A simple rootkit to hide a process
When using ps, a process can be kept from shown

21. Reference http://baike.baidu.com/view/165032.htm