Network Security

Attacks

Technical Solutions

ObjectivesThe student should be able to:

Define attacks: script kiddy, social engineering, logic bomb, Trojan horse,

phishing, pharming, war driving, war dialing, man-in-the-middle attack, SQL

injection, virus, worm, root kit, dictionary attack, brute force attack, DOS,

DDOS, botnet, spoofing, packet reply.

Describe defenses: defense in depth, bastion host, content filter, packet filter,

stateful inspection, circuit-level firewall, application-level firewall, de-

militarized zone, multi-homed firewall, IDS, IPS, NIDS, HIDS, signature-

based IDS, statistical-based IDS, neural network, VPN, network access

server (RADIUS/TACACS), honeypot, honeynet, hash, secret key encryption,

public key encryption, digital signature, PKI, vulnerability assessment

Identify techniques (what they do): SHA1/SHA2, MD2/MD4/MD5, DES, AES,

RSA, ECC.

Describe and define security goals: confidentiality, authenticity, integrity, non-

repudiation

Define service‟s & server‟s data in the correct sensitivity class and roles with

access

Define services that can enter and leave a network

Draw network Diagram with proper zones and security equipment

The Problem of Network Security

The Internet allows an

attacker to attack from

anywhere in the world

from their home desk.

They just need to find one

vulnerability: a security

analyst need to close

every vulnerability.

Hacking NetworksPhase 1: Reconnaissance

Physical Break-In

Dumpster Diving

Google, Newsgroups, Web sites

Social Engineering Phishing: fake email

Pharming: fake web pages

WhoIs Database & arin.net

Domain Name Server Interrogations

Registrant:

Microsoft Corporation

One Microsoft Way

Redmond, WA 98052

US

Domain name: MICROSOFT.COM

Administrative Contact:

Administrator, Domain domains@microsoft.com

One Microsoft Way

Redmond, WA 98052

US

+1.4258828080

Technical Contact:

Hostmaster, MSN msnhst@microsoft.com

One Microsoft Way

Redmond, WA 98052 US

+1.4258828080

Registration Service Provider:

DBMS VeriSign, dbms-support@verisign.com

800-579-2848 x4

Please contact DBMS VeriSign for domain updates, DNS/Nameserver

changes, and general domain support questions.

Registrar of Record: TUCOWS, INC.

Record last updated on 27-Aug-2006.

Record expires on 03-May-2014.

Record created on 02-May-1991.

Domain servers in listed order:

NS3.MSFT.NET 213.199.144.151

NS1.MSFT.NET 207.68.160.190

NS4.MSFT.NET 207.46.66.126

NS2.MSFT.NET 65.54.240.126

NS5.MSFT.NET 65.55.238.126

Hacking Networks

Phase 2: Scanning

War Driving: Can I find a wireless network?

War Dialing: Can I find a modem to connect to?

Network Mapping: What IP addresses exist, and what

ports are open on them?

Vulnerability-Scanning Tools: What versions of software

are implemented on devices?

Passive Attacks

Eavesdropping: Listen to packets from other parties = Sniffing

Traffic Analysis: Learn about network from observing traffic patterns

Footprinting: Test to determine software installed on system = Network Mapping

Bob

JennieCarl

Hacking Networks:

Phase 3: Gaining Access

Network Attacks:

Sniffing

(Eavesdropping)

IP Address Spoofing

Session Hijacking

System Attacks:

Buffer Overflow

Password Cracking

SQL Injection

Web Protocol Abuse

Denial of Service

Trap Door

Virus, Worm, Trojan

horse, Login: Ginger Password: Snap

Some Active Attacks

Denial of Service: Message did not make it; or service could not run

Masquerading or Spoofing: The actual sender is not the claimed sender

Message Modification: The message was modified in transmission

Packet Replay: A past packet is transmitted again in order to gain access or otherwise cause damage

Denial of Service

Joe

Ann

Bill SpoofingJoe (Actually Bill)

Ann

Bill

Message

Modification

Joe

Ann

Packet Replay

Joe

Ann

Bill

Bill

Man-in-the-Middle Attack

10.1.1.1

10.1.1.2

10.1.1.3

(1) Login

(3) Password

(2) Login

(4) Password

SQL Injection Java Original: “SELECT * FROM

users_table WHERE username=” + “‟” + username + “‟” + “ AND password = “ + “‟” + password + “‟”;

Inserted Password: Aa‟ OR „‟=‟

Java Result: “SELECT * FROM users_table WHERE username=‟anyname‟ AND password = „Aa‟ OR „ „ = „ „;

Inserted Password: foo‟;DELETE FROM users_table WHERE username LIKE „%

Java Result: “SELECT * FROM users_table WHERE username=‟anyname‟ AND password = „foo‟; DELETE FROM users_table WHERE username LIKE „%‟

Inserted entry: „|shell(“cmd /c echo “ & char(124) & “format c:”)|‟

Login:

Password:

Welcome to My System

NIST SP 800-118 Draft

Password Cracking:

Dictionary Attack & Brute ForcePattern Calculation Result Time to Guess

(2.6x1018/month)

Personal Info: interests, relatives 20 Manual 5 minutes

Social Engineering 1 Manual 2 minutes

American Dictionary 80,000 < 1 second

4 chars: lower case alpha 264 5x105

8 chars: lower case alpha 268 2x1011

8 chars: alpha 528 5x1013

8 chars: alphanumeric 628 2x1014 3.4 min.

8 chars alphanumeric +10 728 7x1014 12 min.

8 chars: all keyboard 958 7x1015 2 hours

12 chars: alphanumeric 6212 3x1021 96 years

12 chars: alphanumeric + 10 7212 2x1022 500 years

12 chars: all keyboard 9512 5x1023

16 chars: alphanumeric 6216 5x1028

Hacking Networks:

Phase 4: Exploit/Maintain Access

Backdoor

Trojan Horse

Spyware/AdwareBots

User-Level Rootkit

Kernel-Level Rootkit

Replaces system

executables: e.g.

Login, ls, du

Replaces OS kernel:

e.g. process or file

control to hide

Control system:

system commands,

log keystrokes, pswd

Useful utility actually

creates a backdoor.

Slave forwards/performs

commands; spreads,

list email addrs, DOS

attacks

Spyware: Collect info:

keystroke logger,

collect credit card #s,

AdWare: insert ads,

filter search results

Botnets

AttackerHandler

Bots: Host illegal movies,

music, pornography,

criminal web sites, …

Forward Spam for

financial gain

China Hungary

Botnets: Bots

Zombies

Distributed Denial of Service

Zombies

VictimAttacker

Handler

Can barrage a victim

server with requests,

causing the network

to fail to respond to anyone

Russia Bulgaria United

States

Zombies

Network Security

Network Defense

Encryption

Security: Defense in Depth

Border Router

Perimeter firewall

Internal firewall

Intrusion Detection System

Policies & Procedures & Audits

Authentication

Access Controls

Bastion Host

Computer fortified

against attackers

Applications turned

off

Operating system

patched

Security configuration

tightened

Attacking the NetworkWhat ways do you see of getting in?

The Internet

De-Militarized

Zone

Private Network

Border Router/Firewall

Commercial Network

Private NetworkWLAN

Filters

Route Filter: Verifies sources and destination of IP addresses

Packet Filter: Scans headers of packets and discards if ruleset failed (e.g., Firewall or router)

Content Filter: Scans contents of packets and discards if ruleset failed (e.g., Intrusion Prevention System or firewall)

The good, the bad &

the ugly…Filter

The bad &

the ugly

The Good

Packet Filter Firewall

Web Request

Ping Request

FTP request

Email Connect Request

Web Response

Telnet Request

Email Response

SSH Connect Request

DNS Request

Email Response

Web

Response

Illegal Source IP Address

Illegal Dest IP Address

Microsoft NetBIOS Name Service

Firewall

Configurations

A A

terminal

firewall

host

Router Packet Filtering:

Packet header is inspected

Single packet attacks caught

Very little overhead in firewall: very quick

High volume filter

A A

terminal

firewall

host

A

Stateful Inspection

State retained in firewall memory

Most multi-packet attacks caught

More fields in packet header inspected

Little overhead in firewall: quick

Firewall

Configurations

A B

terminal

firewall

host

Circuit-Level Firewall:

Packet session terminated and recreated

via a Proxy Server

All multi-packet attacks caught

Packet header completely inspected

High overhead in firewall: slow

A B

terminal

firewall

host

A

Application-Level Firewall

Packet session terminated and recreated

via a Proxy Server

Packet header completely inspected

Most or all of application inspected

Highest overhead: slow & low volume

A B

B

Router

External

DNSIDS Web

Server

E-Commerce VPN

Server

IDS

Protected

Internal

Network

Zone

IDSDatabase/File

Servers

Internet

Multi-Homed Firewall:

Separate Zones

Demilitarized ZoneWith Proxy

Interface

Screened

Host

The router serves as a screen for the

Firewall, preventing Denial of Service

attacks to the Firewall.

Screening

Device

Firewall

Writing Rules

Policies Network Filter Capabilities

Write Rules

Protected Network

Audit Failures

Corrections

Services and ServersWorkbook

Service Sensitivity Roles Server

Grades Confidential For Graduates: Transcripts

For Current Students:

Advising, Students, Faculty

StudentScholastic

Billing Confidential, For Current Students:

Registration, Accounting, Advising

Payment: Students

StudentBilling

Web Pages Public Students, Employees, Public

Web services

Path of Logical AccessHow would access control be improved?

The Internet

De-Militarized

Zone

Private Network

Border Router/

Firewall

Router/FirewallWLAN

Protecting the Network

The Internet

De-Militarized

Zone

Private Network

Border Router: Packet Filter

Bastion Hosts

Proxy server firewallWLAN

Serviced ApplicationsWorkbook

Applicatio

ns

Sources of

Entry

Servers Required Controls (e.g.,

Encryption)

Grades -Graduates

University Registration

Graduate Scholastic

Confidentiality, Integrity, Authentication

Grades –Current Students

United States Student Scholastic

Confidentiality, Integrity, Authentication

Billing Payment: International

Reports: Univ.

Student Scholastic

Confidentiality, Authentication, Integrity, Non-repudiation

Web Pages International DMZ:

PublicFace

Router

External

DNSEmail Public

Web

Server

E-Commerce

Firewall

Zone 1:

Student

Labs &

Files

Internet

Network DiagramWorkbook

Demilitarized Zone

Zone 2:

Faculty

Labs &

Files

Student

Records

Student

Billing

Transcripts

Student

Scholastic

Student

History

Zone 3:Student Data

Student

Billing

Intrusion Detection Systems (IDS)

Intrusion Prevention Systems (IPS)

Network IDS=NIDS

Examines packets for attacks

Can find worms, viruses, org-defined attacks

Warns administrator of attack

IPS=Packets are routed through IPS

Host IDS=HIDS

Examines actions or resources for attacks

Recognize unusual or inappropriate behavior

E.g., Detect modification or deletion of special files

Router

Firewall

IDS

IDS Intelligence Systems

Signature-Based:

Specific patterns are recognized as attacks

Statistical-Based:

The expected behavior of the system is understood

If variations occur, they may be attacks (or maybe not)

Neural Networks:

Statistical-Based with self-learning (or artificial intelligence)

Recognizes patterns

Attacks:

NastyVirusBlastWorm

NastyVirus NIDS:

ALARM!!!

0

10

20

30

40

50

60

70

80

90

Mon. Tues. Wed. Thurs.

Sales

Personnel

Factory

Norm

al

Honeypot & HoneynetHoneypot: A system with a special software application

which appears easy to break into

Honeynet: A network which appears easy to break into

Purpose: Catch attackers

All traffic going to honeypot/net is suspicious

If successfully penetrated, can launch further attacks

Must be carefully monitored

External

DNSIDS Web

Server

E-Commerce VPN

Server

Firewall

Honey

Pot

Data Privacy

Confidentiality: Unauthorized parties cannot access information (->Secret Key Encryption

Authenticity: Ensuring that the actual sender is the claimed sender. (->Public Key Encryption)

Integrity: Ensuring that the message was not modified in transmission. (->Hashing)

Nonrepudiation: Ensuring that sender cannot deny sending a message at a later time. (->Digital Signature)

Confidentiality

Joe

Ann

Bill AuthenticityJoe (Actually Bill)

Ann

Bill

Integrity

Joe

Ann

Non-Repudiation

Joe

Ann

Bill

Encryption – Secret KeyExamples: DES, AES

Encrypt

Ksecret

Decrypt

Ksecret

plaintextciphertext

plaintext

P = D(Ksecret, E(Ksecret,P))

NIST Recommended: 3DES w. CBC

AES 128 Bit

Symmetric encryption: each participant uses the same (shared secret) key.

In the equation, P=Plaintext, E=Encryption, D=Decryption

NIST = National Institute for Standards and Technology, an American department of

recommendations.

Public Key EncryptionExamples: RSA, ECC, Quantum

Encrypt

Kpublic

Decrypt

Kprivate

Key ownerJoe

Encryption

(e.g., RCS)

Decrypt

Kpublic

Encrypt

Kprivate

Message,

private key

Digital

Signature

Key

owner

Authentication,

Non-repudiationJoe

P = D(kPRIV, E(kPUB,P))

P = D(kPUB, E(kPRIV,P))NIST Recommended:

RSA 1024 bit

2011: RSA 2048 bit

Public Key Encryption

Asymmetric encryption: each user has a public key and a

private key. They are not easily mathematically related;

that is, having the public key will not enable someone to

calculate the private key. However a message encrypted

with one can be decrypted with the other. The private key

can also be used as a digital signature (next slide).

This encryption technique can be used to send encrypted

information or to authenticate a packet as originating from

the sender, as shown above in the top and bottom

examples, respectively.

Public key encryption is a wonderful technique. However, it

is processor-intensive, and not useful for longterm data

communications sessions. Therefore, it is often used to

provide a Secret key between two endpoints, and then the

Secret key is used thereafter.

Remote Access Security

Virtual Private Network (VPN) often implemented with IPSec

Can authenticate and encrypt data through Internet (red line)

Easy to use and inexpensive

Difficult to troubleshoot, less reliable than dedicated lines

Susceptible to malicious software and unauthorized actions

Often router or firewall is the VPN endpoint

The Internet

Firewall

VPN

Concentrator

Secure Hash FunctionsExamples: SHA1, SHA2, MD2, MD4, MD5

Message

H H E

Message HMessage H

D

HH

H

Compare

Message Authentication Code

Message

H

Message Message

H

H H H

H

Compare

One Way Hash

K K

KK

Ensures the message was not modified during transmission

NIST Recommended: SHA-1, SHA-2

2011: SHA-2

Encrypted

K(Sender’s Private)

Digital Signature

Electronic Signature

Uses public key

algorithm

Verifies integrity of

data

Verifies identity of

sender: non-

repudiation

Message

Msg Digest

Public Key Infrastructure (PKI)

Digital

Certificate

User: Sue

Public Key:

2456

1. Sue registers with

CA through RA

Certificate Authority

(CA)

Register(Owner, Public Key) 2. Registration Authority

(RA) verifies owners

3. Send approved

Digital Certificates

5. Tom requests Sue‟s DC

6. CA sends Sue‟s DC

Sue

Tom

4. Sue sends

Tom message

signed with

Digital Signature

7. Tom confirms

Sue‟s DS

Network Access Server

NAS: Network Access Server Handles user authentication, access control and accounting

Calls back to pre-stored number based on user ID

Prone to hackers, DOS, misconfigured or insecure devices

RADIUS: Remote Access Dial-in User Service

TACACS: Terminal Access Control Access

1. Dial up and authenticate

2. Call back

RADIUS or

TACACS

3. Connect

Web Page Security

SQL Filtering: Filtering of web input for SQL

Injection

Encryption/Authentication: Ensuring

Confidentiality, Integrity, Authenticity, Non-

repudiation

Web Protocol Protection: Protection of

State

Vulnerability Assessment

Scan servers, work stations, and control

devices for vulnerabilities

Open services, patching, configuration

weaknesses

Testing controls for effectiveness

Adherence to policy & standards

Penetration testing

Serviced ApplicationsWorkbook

Applicatio

ns

Sources of

Entry

Servers Required Controls (e.g.,

Encryption)

Grades –Current Students

United States Student Scholastic

Confidentiality: Encryption

Integrity: Hashing, IDS

Authentication: VPN/IPsec, secure passwords

Billing Payment: International

Reports: Univ.

Student Scholastic

Confidentiality: Encryption, HTTPs

Authentication: VPN/IPsec

Integrity, Hashing, IDS

Non-repudiation: Digital Signature

Summary of Network Controls

Network Security Techniques

Encryption: Public and Private key, Wireless WPA2

Virtual Private Network (VPN): Secure communications tunnel

Secure Hashing

Digital Signature

Bastion Host Configuration

Certificate Authority: PKI

Network Protection Devices

Firewall: Packet, Stateful, Circuit, Application-Level

Proxy server

Demilitarized Zone (DMZ)

Intrusion Detection System

Intrusion Prevention System

Network access server (RADIUS or TACACS)

Honeypot, honeynet

Secure Protocols

SSL: Secure web

SSH: Secure telnet/rlogin or file transfer

S/MIME: Secure email

Secure Information Mgmt: Log mgmt

HEALTH FIRST CASE STUDY

Designing Network Security

Jamie Ramon MD

Doctor

Chris Ramon RD

Dietician

Terry

Licensed

Practicing Nurse

Pat

Software Consultant

Define Services & Servers

Which data can be grouped together by

role and sensitivity/criticality?

Service

Name

Sensitivity

Class.

Roles with

Access

Server Name

Confidential –

Management

Public –

Web Pages

Privileged –

Contracts

Defining Services which can

Enter and Leave the Network

Service Source

(e.g., home,

world, local

computer)

Destination

(local server,

home, world,

etc.)

Defining Zones and Controls

Compartmentalization:

Zone = Region (E.g., DMZ, wireless,

internet)

Servers can be physical or virtual

Zone Service Server Required Controls

(Conf., Integrity, Auth., Nonrepud.,

with tools: e.g., Encryption/VPN)

Router

External

DNSEmail Public

Web

Server

E-Commerce

Firewall

Zone 1:

Student

Labs &

Files

Internet

Draw the Network Diagram

Demilitarized Zone

Zone 2:

Faculty

Labs &

Files

Student

Records

Student

Billing

Transcripts

Student

Scholastic

Student

History

Zone 3:Student Data

Student

Billing

ReferenceSlide # Slide Title Source of Information

7 Passive Attacks CISA: page 331,333, 352

9 Some Active Attacks CISA: page 330, 332, 352

10 Man-in-the –Middle Attack CISA: page 331

12 Password Cracking: dictionary Attack & Brute Force CISA: page 330

14 Botnets CISA: page 330

15 Distributed Denial of Service CISA: page 330

23 Packet Filter Firewall CISA: page 353, 354

24 Firewall Configurations CISA: page 353 – 355

25 Firewall Configurations CISA: page 354

26 Multi-Homed Firewall: Separate Zones CISA: page 355

33 Intrusion Detection Systems (IDS)

Intrusion Prevention System (IPS)

CISA: page 355, 356

34 IDS Intelligence Systems CISA: page 356

35 Honeypot & Honeynet CISA: page 356, 357

37 Encryption – Secret Key CISA: page 357

38 Public Key Encryption CISA: page 357, 358

39 Remote Access Security CISA: page 361

40 Secure Hash Functions CISA: page 359, 361, 362

41 Digital Signature CISA: page 359

42 Public Key Infrastructure (PKI) CISA: page 359, 360