The answersDownload the PDF
Worksheet

A12.7 Internet security

Networks and the web · A level · OCR H446 1.3.3, AQA 7517 4.9.3.2 · about 30 min

BugBotLab
NameClassDate

What this lesson is about

Firewalls, packet filtering, proxies and stateful inspection; encryption, certificates and signatures; worms, trojans and viruses.

Questions 6 marks in all

  1. [1 mark]Which kind of firewall allows an incoming packet only if it belongs to a connection that was properly started from inside?

    1. AStateful inspection
    2. BStatic packet filtering
    3. CA proxy server's cache
    4. DA MAC address allow list

  2. [1 mark]What does a proxy server do that a packet filter does not?

    1. AMakes requests on behalf of internal clients, hiding their addresses, and can inspect content and cache pages
    2. BChecks only the source and destination ports
    3. CEncrypts all traffic with the receiver's public key
    4. DAssigns IP addresses to clients

  3. [1 mark]Ada wants to send Ben a message only Ben can read. Which key should she encrypt it with?

    1. ABen's public key
    2. BBen's private key
    3. CAda's private key
    4. DAda's public key

  4. [1 mark]Put the steps of creating and checking a digital signature in order.

    Number the lines 1 to 5 to put them in the right order.

    1. The receiver decrypts the signature with the sender's public key
    2. The receiver compares the two digests
    3. The receiver hashes the received message
    4. The sender hashes the message to make a digest
    5. The sender encrypts the digest with their private key

  5. [1 mark]Which kind of malware spreads through a network by itself, exploiting vulnerabilities, with no host file or user action?

    1. AWorm
    2. BVirus
    3. CTrojan
    4. DProxy

  6. [1 mark]What is the purpose of a digital certificate?

    1. ATo show, with a certificate authority's signature, that a public key really belongs to a named owner
    2. BTo store a user's private key on a website
    3. CTo speed up symmetric encryption
    4. DTo list the ports a firewall blocks

The task: a stateful firewall

Each packet is a tuple (direction, source IP, source port, destination IP, destination port), where direction is "out" (leaving the network) or "in" (arriving). Check each packet against these rules in order, and use the first that matches: 1. If its source IP is 203.0.113.9 (a blocked address), the verdict is drop blocked. 2. If it is going out, record the connection (its source IP, source port, destination IP and destination port) and the verdict is allow outbound. 3. If it is coming in and is a reply to a recorded connection (its source is that connection's destination, and its destination is that connection's source, IP and port both), the verdict is allow reply. 4. If it is coming in to IP 192.168.4.10 port 443 (the school's web server), the verdict is allow service. 5. Otherwise the verdict is drop. Print <packet number> <verdict> for each packet, numbering from 1. Then print allowed <a>, dropped <d>, counting verdicts that begin allow and drop. That is 8 lines. The robot does not drive.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

BLOCKED = "203.0.113.9"
SERVER = ("192.168.4.10", 443)
packets = [
    ("out", "192.168.4.23", 49152, "203.0.113.80", 443),
    ("in", "203.0.113.80", 443, "192.168.4.23", 49152),
    ("in", "203.0.113.80", 443, "192.168.4.23", 49153),
    ("in", "203.0.113.9", 443, "192.168.4.23", 49152),
    ("in", "198.51.100.7", 51000, "192.168.4.10", 443),
    ("in", "198.51.100.7", 51000, "192.168.4.10", 22),
    ("in", "203.0.113.80", 443, "192.168.4.23", 49152),
]
connections = []

Plan your program here, then type it in and press Run.

QR code
Do it on the robot
www.bugbotlab.com/learn/a12-7-internet-security/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

  1. Packet 3 looks like a reply but was dropped. Explain what a static packet filter that allows all traffic from port 443 would have done with it.
  2. Add a rule before rule 2 that drops outgoing packets to port 23 (Telnet), and a test packet that shows it working.
  3. In the signature cell, find a different message with the same toy digest as forward 20. What does that tell you about the hash functions real signatures need?