ECE-8843http://www.csc.gatech.edu/copeland/jac/8843/

Prof. John A. Copelandjohn.copeland@ece.gatech.edu

404 894-5177fax 404 894-0035

Office: GCATT Bldg 579email or call for office visit, or call Kathy Cheek, 404 894-5696

Chapter 9 - Network Intrusion

2

Network IntrudersMasquerader: A person who is not authorized to use a computer, but gains access appearing to be someone with authorization (steals services, violates the right to privacy, destroys data, ...)

Misfeasor: A person who has limited authorization to use a computer, but misuses that authorization (steals services, violates the right to privacy, destroys data, ...)

Clandestine User: A person who seizes supervisory control of a computer and proceeds to evade auditing and access controls.

Hacker: generic term for someone who does unauthorized things with other peoples’ computers (also a poor golfer, tennis player, or programmer good at quick and dirty code).

3

Access ControlToday almost all systems are protected only by a simple password that is typed in, or sent over a network in the clear.Techniques for guessing passwords:

1. Try default passwords.2. Try all short words, 1 to 3 characters long.3. Try all the words in an electronic dictionary(60,000).4. Collect information about the user’s hobbies, family names, birthday, etc.5. Try user’s phone number, social security number, street address, etc.6. Try all license plate numbers (123XYZ).

Prevention: Enforce good password selection (“c0p31an6” - not great, “wduSR-wmHb365” - better).

4

Password Gathering

Look under keyboard, telephone etc.

Look in the Rolodex under “X” and “Z”

Call up pretending to from “micro-support,” and ask for it.

“Snoop” a network and watch the plaintext passwords go by.

Tap a phone line - but this requires a very special modem.

Use a “Trojan Horse” program to record key stokes.

5

UNIX Passwords

User’s password ( should be required to have 8 characters, some non-letters)

Random 12-bit number (Salt)

DES Encrypted to 11 viewable characters

User ID Salt Value Hash User ID Salt Value Hash User ID Salt Value Hash

Storing UNIX PasswordsUntil a few years ago, UNIX password hashes were kept in in a publicly readable file, /etc/passwords. Now they are kept in a “shadow” directory only visible by “root”.

This helps prevent a “reverse-lookup dictionary” attack.

“Salt”:• prevents duplicate passwords from being easily seen as such.• prevents use of standard reverse-lookup dictionaries ( a different dictionary would have to be generated for each value of Salt).• does not “effectively increase the length of the password.”

6

7

The Stages of a Network Intrusion 1. Scan the network to:

• locate which IP addresses are in use, • what operating system is in use, • what TCP or UDP ports are “open” (being listened to by Servers).

2. Run “Exploit” scripts against open ports 3. Get access to Shell program which is “suid” (has “root” privileges). 4. Download from Hacker Web site special versions of systems files that will let Cracker have free access in the future without his cpu time or disk storage space being noticed by auditing programs. 5. Use IRC (Internet Relay Chat) to invite friends to the feast.

# nmap -sS -P0 -vv -p 21,22,25,110,443 209.162.185.100

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )Host jacsw (209.162.185.100) appears to be up ... good.Initiating SYN Stealth Scan against victim (209.162.185.100)Adding open port 22/tcpAdding open port 443/tcpThe SYN Stealth Scan took 4 seconds to scan 5 ports.Interesting ports on jacsw (209.162.185.100):Port State Service21/tcp filtered ftp [response blocked by firewall] 22/tcp open ssh [tcp port 22 open]25/tcp filtered smtp 110/tcp filtered pop-3 443/tcp open https

Nmap run completed -- 1 IP address (1 host up) scanned in 5 seconds

# telnet 209.162.185.100 22 [telnet can connect to any port]Trying 209.162.185.101... [here we specified port 22]Connected to 209.162.185.100.SSH-2.0-OpenSSH_3.1p1 [response shows SSH version]

8

# less /var/log/secureOct 15 13:45:30 lc1 sshd[12538]: Could not reverse map address 199.77.146.103.Oct 15 13:46:26 lc1 sshd[12538]: Accepted password for root from 199.77.146.103 port 52388 ssh2Oct 15 15:05:44 lc1 sshd[12591]: Could not reverse map address 199.77.146.103.Oct 15 15:05:48 lc1 sshd[12591]: Accepted password for root from 199.77.146.103 port 52438 ssh2Oct 17 07:34:10 lc1 sshd[13409]: Accepted password for root from 130.207.226.152 port 52613 ssh2Oct 17 07:49:33 lc1 sshd[13460]: Accepted password for root from 130.207.226.152 port 52615 ssh2Oct 17 08:02:37 lc1 sshd[13503]: Accepted password for root from 130.207.237.139 port 52616 ssh2Oct 17 08:10:40 lc1 sshd[13542]: Accepted password for root from 130.207.237.148 port 52617 ssh2Oct 17 08:26:16 lc1 sshd[13584]: Accepted password for root from 130.207.237.158 port 52618 ssh2Oct 17 11:52:18 lc1 sshd[13640]: Could not reverse map address 199.77.146.103.Oct 17 11:52:27 lc1 sshd[13640]: Accepted password for root from 199.77.146.103 port 52639 ssh2

9

10

Protection from a Network Intrusion1. Use a “Firewall” between the local area network and the world-wide Internet to limit access (Chapter 10).

2. Use an IDS (Intrusion Detection System) to detect Cracker during the scanning stage (lock out the IP address, or monitor and prosecute).

3. Use a program like TripWire on each host to detect when systems files are altered, and email an alert to Sys Admin.

4. On Microsoft PC’s, a program like BlackIce or Zone Alarm is easier to install (and more fun) than learning how to reset all of the Windows default parameters to make the system safe.

12

Anomaly-Based Intrusion Detection

High statistical variation in most measurable network behavior parameters results in high false-alarm rate

Detection Threshold

UndetectedIntrusions

FalseAlarms

13

“Base-Rate” FallacySuppose the accuracy of an IDS is 99%.

This means that for every 100 normal events, there will be 1 false positive. Also for every 100 intrusion events, there will be 99 detects (true positives) and 1 missed detection (false negative).

If there are 300,000 normal connections a day, there will be 3000 false alarms.

If there is one intrusion per week, there will be a 99% chance of detecting it (if the IDS is still turned on).

For detailed math, see Appendix 9A of the textbook (edition 2).

14

Distributed Host-Based IDS

Modules must be installed and configured on hosts.

Highly recommended for critical servers

Examples: Okena (Cisco), ISS Desktop

Proventia

Data Packets are compared to a growing library of known attack signatures. These include port numbers or sequence numbers that are fixed in the exploit application, and sequences of characters that appear in the data stream.

Packet streams must be assembled and searched, which reduces the maximum possible data rate on the link being observed.

Signature-Based IDS

15

alert tcp $EXTERNAL_NET any -> $HOME_NET 7070 (msg: "IDS411 - RealAudio-DoS"; flags: AP; content: "|fff4 fffd 06|";)

alert udp $EXTERNAL_NET any -> $HOME_NET any (msg: "IDS362 - MISC - Shellcode X86 NOPS-UDP"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|";)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS359 - OVERFLOW-NOOP-HP-TCP2";flags:PA; content:"|0b39 0280 0b39 0280 0b39 0280 0b39 0280|";)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS345 - OVERFLOW-NOOP-Sparc-TCP";flags:PA; content:"|13c0 1ca6 13c0 1ca6 13c0 1ca6 13c0 1ca6|";)

alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS355 - OVERFLOW-NOOP-Sparc-UDP2"; content:"|a61c c013 a61c c013 a61c c013 a61c c013|";)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "IDS291 - MISC - Shellcode x86 stealth NOP"; content: "|eb 02 eb 02 eb 02|";)

Six “Signatures” from the Snort Database www.snort.org

16

Other systems: “Dragon”, ISS RealSecure, Arbor

Signature-Based Intrusion Detection SystemsMay Not Detect New Types of Attack

Back Orifice

Win Nuke

Trino

IP Blob

Land Attack

Attacks with Names Alarm on Activitiesin these areas.

Attacks without Names(not analyzed yet)

17

Flow-Based Technology -An approach that recognizes normal trafficcan detect new types of intrusions.

Back Orifice

Win Nuke

Trino

IP Blob

Land Attack

Attacks with Names Normal Network Activities

Attacks without Names(not analyzed yet)

FTP

NetBIOS

Email

Web

Alarm on Activitiesin this areas.

18Example: Lancope’s “StealthWatch”

A “Flow” is the stream of packets from one host to another related to the same service (e.g., Web, email, telnet, …). Data in packet headers is used to build up counts (leads to high speed).

After the flow is over, counters are analyzed and a value is derived for the probability that the flow was crafted, perhaps for probing the network for vulnerabilities or for denial of service.

Flow-based Statistical Analysis

Counters

Flow- Statistics Counters

Flow- Statistics Counters

Number of Packets

Number of Total Bytes

Number of Data Bytes

Start Time of Flow

Stop Time of Flow

Duration of Flow

Flag-Bit True-False Combo

Fragmentation BitsICMP Packet Responses to

UDP Packets

19

Zone ProtectionZone Protection

VPN

FINANCE

A B

C D

Alarm: Server Ahas crossedzones to Server D.

SW

20

Host-Based

Signature-Based

Anomaly-Based

Flow-Based

Can detect misuse of OS access and file permissions.

Can detect attacks embedded in network data -if signature is known

On host or network. Can detect new types, but high false alarm rate.

Can detect new types of attacks by network activity. Should be used with

Host-Based and/or Signature Based

IDS Types Should be Combined

21

22

The Stages of a Network Intrusion1. Scan the network to:

• locate which IP addresses are in use, • what operating system is in use, • what TCP or UDP ports are “open” (being listened to by Servers).

2. Run “Exploit” scripts against open ports3. Get access to Shell program which is “suid” (has “root” privileges).4. Download from Hacker Web site special versions of systems files that will let Cracker have free access in the future without his cpu time or disk storage space being noticed by auditing programs.5. Use IRC (Internet Relay Chat) to invite friends to the feast.

Flow-based* "CI", signature-based?

Signature?, Flow-Based Port Profile*

Signature?, "Port-Profile*", Forbidden Zones*, Host-based

Signature?, "Port-Profile*", Forbidden Zones*, Host-based

Host-based

Vulnerability Scan

* StealthWatch

Type "A" Probes (detected by John Copeland in Dec. 1999)

The first three UDP probes, which started my investigation, had a single character in the data field, an 'A'. The UDP port numbers were identical, 31790->31789.

They stimulate the 1500-byte ICMP Echo-Request packet and the normal 58-byte ICMP Destination_Unreachable-Port Packets. The Echo-Request is never answered.

Date Time EST Source IP (Place) Destination (Place)

1999-12-28 18:40 151.21.82.251 (Italy) to 24.88.48.47 (Atlanta, GA)

1999-12-10 18:28 152.169.145.206 ( AOL ) to 24.88.48.47 (Atlanta, GA)

1999-12-16 03:34 212.24.231.131 (Saudi Arabia) to 24.88.48.47 (Atlanta, GA)

UDP packets with an empty data field, like those generated by the "nmap" scan program, do not stimulate the 1500-byte ICMP packets from an OS-9 Macintosh.

23

Detection of the “Mac Attack” DDoS Plan

"Double-zero" Probes (James Bond, "00" -> "license to kill"), detected in Dec. 1999.

I have now seen 3 UDP type "00" probes, and had another "00" probe reported from Kansas.These probes use a single UDP packet, two bytes of data (ascii zeroes) and identical UDP port numbers, 60000->2140. They stimulate the 1500-byte ICMP Echo-Request packet and the normal 58-byte ICMP Destination_Unreachable-Port Packets. The Echo-Request is never answered.

1999-12-20 07:04 195.229.024.212 (Arab Emirates*) to 24.88.48.47 (Atlanta, GA)

1999-12-21 08:04 195.229.024.213 (Arab Emirates*) to 24.88.48.47 (Atlanta, GA) *DNS name: cwa129.emirates.net.ae1999-12-25 09:39 212.174.198.29 (Turkey) to 24.94.xxx.xxx (Wichita, Kansas) *DNS: none1999-12-31 05:35 195.99.56.179 (Manchester, UK*) to 14.88.xx.xx (Atlanta, GA) *DNS name: manchester_nas11.ida.bt.net2000-01-04 05:08 24.94.80.152 (Road Runner, Hawaii) to 24.94.xxx.xxx (Wichita, Kansas) *DNS name: a24b94n80client152.hawaii.rr.com2000-01-06 04:48 195.44.201.41 (cwnet, NJ) to 24.88.xx.xxx (Atlanta, GA) *DNS name: ad11-s16-201-41.cwci.net

24

2nd Generation, “Mac Attack” Scanning

Drawing from Atlanta Journal-

Constitution article, Dec. 1999.

Full details at www.csc,gatech.edu

/macattack/

25

Start: 11/21/99 11:07:40 PMFind route from: 24.88.48.47 to: www.orbicom.com. (196.28.160.129), Max 30 hops, 40 byte packetsHost Names truncated to 32 bytes 1 24.88.48.1 (24.88.48.1 ): 17ms 17ms 16ms 2 24.88.3.21 (24.88.3.21 ): 18ms 19ms 18ms 3 24.93.64.69 (24.93.64.69 ): 17ms 18ms 17ms 4 24.93.64.61 (24.93.64.61 ): 19ms 17ms 18ms 5 24.93.64.57 (24.93.64.57 ): 25ms 25ms 23ms 6 sgarden-sa-gsr.carolina.rr.com. (24.93.64.30 ): 26ms 27ms 27ms 7 roc-gsr-greensboro-gsr.carolina. (24.93.64.17 ): 28ms 28ms 30ms 8 roc-asbr-roc-gsr.carolina.rr.com (24.93.64.6 ): 30ms 32ms 30ms 9 12.127.173.205 (12.127.173.205 ): 40ms 39ms 39ms 10 gbr2-a30s1.wswdc.ip.att.net. (12.127.1.30 ): 38ms 40ms 39ms 11 gr2-p3110.wswdc.ip.att.net. (12.123.8.246 ): 278ms 40ms 39ms 12 att-gw.washdc.teleglobe.net. (192.205.32.94 ): 41ms 43ms 42ms 13 if-7-2.core1.newyork.teleglobe.n (207.45.222.145 ): 45ms 46ms 45ms 14 if-0-0-0.bb3.newyork.teleglobe.n (207.45.221.69 ): 45ms 47ms 49ms 15 ix-1-1-1.bb3.newyork.teleglobe.n (207.45.199.202 ): 50ms 46ms 50ms 16 196.30.121.243 (196.30.121.243 ): 44ms 48ms 45ms 17 fe0-0.cr3.ndf.iafrica.net. (196.31.17.26 ): 635ms 632ms 633ms 18 atm6-0sub300.cr1.vic.iafrica.net (196.30.121.81 ): 641ms 640ms 644ms 19 196.30.200.6 (196.30.200.6 ): 643ms 640ms 643ms 20 196.4.162.86 (196.4.162.86 ): 662ms 659ms 664ms 21 www.orbicom.com. (196.28.160.129 ): 663ms 658ms 664ms • Trace completed 11/21/99 11:08:25 PM •

Traceroute to find location of IP Address

26