Assignment Code: MSEL-032/TMA/2022-23

Course Code: MSEL-032

Assignment Name: Cyber Attacks, Cloud Security and Data Analytics and Recovery Lab

Year: 2022

Verification Status: Verified by Professor

This assignment has two Questions, answer all questions. Each Question is of 20 marks. Your Lab Records will carry 40 Marks (20 Marks for each Question). Rest 20 marks are for viva voce. You may use illustrations and diagrams to enhance the explanations. Please go through the guidelines regarding assignments given in the programme guide for the format of presentation.

Note: You must execute the program and submit the program logic, sample input and output along with the necessary documentation. Assumptions can be made wherever necessary.

Q1) Discuss the Deployment of OpenStack using DevStack with all steps.

Ans) OpenStack is an open-source cloud computing platform that provides Infrastructure as a Service and allows for the deployment and management of large-scale virtual machines and other resources. DevStack is a tool that enables the deployment of OpenStack on a single machine, making it ideal for testing and development purposes. Here are the steps to deploy OpenStack using DevStack:

1. Prerequisites: Before installing OpenStack using DevStack, ensure that your machine meets the minimum hardware requirements for OpenStack and that the required software packages are installed. At a minimum, the machine should have at least 4GB of RAM and a 64-bit processor. To install the required software packages, run the following commands:

   
   

   sudo apt-get update

   
   

   sudo apt-get install git curl python-pip

    

2. Clone DevStack: The next step is to clone the DevStack repository from GitHub using the following command:

   git clone https://github.com/openstack-dev/devstack.git

   This will create a directory called ‘devstack’ in your current working directory.

    

3. Configure DevStack: The next step is to configure DevStack by creating a local configuration file. DevStack comes with a sample configuration file called ‘local.conf’, which you can use as a starting point. To create a new configuration file, copy the samples/local.conf file to a new file called local.conf using the following command:

   cd devstack

   cp samples/local.conf local.conf

   Edit the ‘local.conf’ file and configure the necessary settings such as the IP address, hostname, and passwords. The ‘local.conf’ file is well-documented, and you can refer to the comments in the file for guidance.

    

4. Run DevStack: Once the ‘local.conf’ file is configured, run the following command to start the installation process:

   ./stack.sh

   This will start the installation process and may take some time to complete. DevStack will download the necessary packages and components required for OpenStack and configure them on the machine.  

5. Verify the Installation: Once the installation is complete, verify that OpenStack is running correctly by accessing the OpenStack dashboard at http://<IP address>/dashboard using the credentials specified in the configuration file. You should see a login screen, and upon logging in, you should be able to access.

   
   

6. Use OpenStack: You can now use OpenStack to create and manage virtual machines, volumes, and other resources through the dashboard or using OpenStack command-line tools such as nova, glance, neutron, and cinder.

   
   
   
   

 Deploying OpenStack using DevStack involves cloning the DevStack repository, configuring the installation settings in a ‘local.conf’ file, running the stack.sh script, and verifying that OpenStack is running correctly. This process provides a simple and quick way to set up an OpenStack environment for development and testing purposes.

Q2) Explain Man in the middle attack (MITM) using Ettercap.

Ans) A Man in the Middle attack is a form of cyberattack that allows an attacker to intercept and modify communications between two parties who believe they are communicating directly with each other. Ettercap is a free and open-source tool that can be used to perform a MITM attack. In this attack, the attacker can eavesdrop on the communication, modify the messages, or even inject new messages, making it a dangerous threat to data security.

Ettercap is a popular open-source tool that is often used to perform MITM attacks. It can be used to sniff network traffic, capture passwords, and alter or inject data into packets. Here is an example of how an attacker can use Ettercap to perform a MITM attack:

1) ARP Spoofing: The first step in the MITM attack is to perform ARP spoofing, which involves sending out forged Address Resolution Protocol messages to the target network. ARP is used to map a device's IP address to its MAC address, and ARP spoofing tricks the devices on the network into believing that the attacker's machine has the IP address of the target device. This allows the attacker to intercept the traffic between the target device and the router.

To perform ARP spoofing using Ettercap, run the following command:

ettercap -T -M arp /target IP/ /router IP/

2) Sniffing: Once the ARP spoofing is successful, the attacker can start sniffing the network traffic using Ettercap. This allows the attacker to capture and view the communication between the target device and the router.

To start sniffing, press the "s" key in the Ettercap console.

3) Packet Manipulation: With the sniffing in progress, the attacker can now modify the intercepted packets using Ettercap. This can be done in real-time, allowing the attacker to alter the contents of the packets before they are received by the target device.

To perform packet manipulation, press the "m" key in the Ettercap console.

4) Injecting Malicious Packets: In addition to modifying the packets, the attacker can also inject new packets into the communication between the target device and the router. These packets can contain malicious code or commands that can compromise the security of the target device.

To inject a malicious packet, press the "i" key in the Ettercap console.

5) Clean-up: Once the attack is complete, the attacker can exit Ettercap and restore the ARP tables to their original state. This can be done by running the following command:

arp -a -d

This will delete all the ARP entries in the table.

A MITM attack is a serious threat to data security, as it allows an attacker to intercept and modify communications between two parties. Ettercap is a powerful tool that can be used to perform this type of attack, and it is important to take steps to protect against it, such as using encryption and implementing network security measures. It is also important to be aware of the risks and to take steps to mitigate them, such as monitoring network traffic for suspicious activity and using a VPN to encrypt communications.