Reti di Calcolatori II - UniNa STiDuE: l'universita a casa ...unina.stidue.net/Computer Networks...

1

Dipartimento di Informatica e Sistemistica, Università di Napoli Federico II Corso di Reti di Calcolatori II – Anno accademico 2007/2008

Reti di Calcolatori II

Introduction to

Information WarfareParte I

Giorgio VentreDipartimento di Informatica e Sistemistica

Università di Napoli Federico II


Nota di Copyright

Quest’insieme di trasparenze è stato ideato e realizzato dai ricercatori del Gruppo di Ricerca sull’Informatica Distribuita del

Dipartimento di Informatica e Sistemistica dell’Università di Napoli e del Laboratorio Nazionale per la Informatica e la Telematica Multimediali. Esse possono essere impiegate

liberamente per fini didattici esclusivamente senza fini di lucro, a meno di un esplicito consenso scritto degli Autori. Nell’uso dovrà essere esplicitamente riportata la fonte e gli Autori. Gli

Autori non sono responsabili per eventuali imprecisioni contenute in tali trasparenze né per eventuali problemi, danni o

malfunzionamenti derivanti dal loro uso o applicazione.

2

Dipartimento di Informatica e Sistemistica, Università di Napoli Federico II Corso di Reti di Calcolatori II – Anno accademico 2007/2008 3

L’unico calcolatore sicuro!


Purtroppo la realtà è ben differente

Asp Asp

11

Asp Asp

22

Cittadini e impreseCittadini e imprese

MILANOMILANOTT

OO

RIRI

NN

OO

GENOVAGENOVAANCONAANCONA

L’AQUILAL’AQUILACAMPOBASSOCAMPOBASSO

BARIBARI

CATANZAROCATANZARO

PALERMOPALERMO

CAGLIARICAGLIARI

NAPOLINAPOLI

TRIESTETRIESTE

InternetInternet

Provider 1Provider 1



……


IP BE 2Mbps xIP BE 2Mbps x€€IP BE 100 Mbps IP BE 100 Mbps yy€€….….Provider 2Provider 2IP HQ 2Mbps IP HQ 2Mbps kk€€IP HQ 100 IP HQ 100 Mbps zMbps z€€

LISTINO LISTINO

SERVIZISERVIZI

Asp Asp

33

PACPACRUPARRUPAR

PALPALPACPAC

RUPARRUPARPALPAL

PACPAC

RUPARRUPAR

PALPAL

Struttura di gestioneStruttura di gestione

della qualitàdella qualità

ISP NazionaleISP NazionaleISP RegionaleISP Regionale

ISP LocaleISP Locale

Internet qualificataInternet qualificata

TT

33

VENEZIAVENEZIABOLOGNABOLOGNA

PERUGIAPERUGIAFIRENZEFIRENZE

ROMAROMA

Struttura di gestioneStruttura di gestione

della sicurezzadella sicurezza

PROVIDER PROVIDER

QUALIFICATIQUALIFICATI

3


Tipi di e-Crime

� Virus or malicious code

� Spyware

� Phishing

� Illegal generation of Spam

� Unauthorized access

� DoS attacks

� Rogue WAP

� Exposure of private or sensitive data

� Fraud

� Identity theft

� Password sniffing

� Theft of intellectual property

� Zombie machines on network

� Theft of other proprietary info.

� Sabotage

� Web site defacement

� Extortion

� Other


Qualche dato statistico2005 e-Crime Watch Survey

� Sources of e-Crime:

» 82% Virus or Malicious Code

» 61% Spyware

» 57% Phishing (era il 31% nel 2004)

» 48% Illegal Spam Generation

� Losses from Crimes:

» 55% Operational

» 28% Financial ($506,670 – media)

» 12% Harm to reputation

� Culprit: 80% Outsiders; 20% Insiders

4


Gruppi a rischio Cyber Threat*

� Hackers – 37%

� Current employees –18%

� Foreign entities – 6%

� Former employees – 5%

� Information brokers – 3%

� Current service providers/consultants/contractors – 2%

� Terrorists – 2%

� Customers – 2%

� Suppliers/business partners – 1%

� Competitors – 1%

� Former service providers/consultants/contractors – 1%

� Not sure – 21%

* 2005 E-Crime Watch Survey


US-CERT Cyber Security Incident Categories

5


US-CERT: Dec. 2007 data


Computer Viruses & File Stripping

0

1,000,000

2,000,000

3,000,000

4,000,000

5,000,000

6,000,000

7,000,000

8,000,000

9,000,000

10,000,000

1st-00 2nd-00 1st-01 2nd-01 1st-02 2nd-02 1st-03 2nd-03 1st-04 2nd-04 1st-05 2nd-05

Part of Year

6


Un quadro un po’ fosco…


Certo una realtà complessa

7


Come sono cambiate le coseHardware

Component 1970s Now

User Interface Mainframe terminals Desktops, Laptops, PDAs, Cell

Phones

Connection Direct Connection Direct connection, LANs, WAN,

wireless, ISDN, DSL

Monitors Monochrome character display

using vacuum tubes

Full color pixel-based matrix display,

PDAs

Unit of storage

capacity

Kilobytes and megabytes Gigabytes and terabytes

Processor Speed Kilobytes per second Gigabits per second

Processor Sequential processing Multitasking/multiprocessing

Storage

interface

80-column hole-punch cards Desktops, workstations, terminals,

laptops, wireless devices

Storage Media Magnetic Tapes Floppy disks, Hard drives, CDs,

CDRs, CDRW, DVDR, Zip drives,

Dongle


Area of Concern 1970s Now

Operating System Mainframe Specific: IBM, Unisys,

Honeywell, HP, etc.

Microsoft (2000/XP), UNIX (e.g. Solaris,

SGI, AIX), Linux, MAC OS X

Type of Data Characters/Text Text, graphics, audio, video, IM,

IRC, VOIP, etc.Word Processor N/A – Manual typewriter Word, WordPerfect, AmiPro

Calculations N/A - Paper, Calculators Spreadsheet (e.g. Excel, Lotus 1-2-3)

Scheduling N/A – Paper calendar Outlook, GroupWise

Presentations N/A - Special order clear

slides

PowerPoint

Music N/A - Radio MP3 files

Architecture design N/A - Paper blueprints used CAD software

Video N/A – TV Stored and real-time AVI, WAV files;

cameras on desktop, doorways, etc.

Pictures N/A – Camera Digital files, Cell phones, Web Cams

Programming

Language

COBOL Visual Basic, Java, HTML, etc.

Come sono cambiate le coseSoftware & Dati

8


Subject/Topic 1970s NowUsers Limited to those with direct connect

terminals

Anyone on the Internet

System

architecture

Single mainframe (terminals in star

configuration)

Many interconnected networks of various

configurations

System Access Only required a terminal with

direct wiring

Network access with User ID, password,

authentication, single sign-on

Data Connection Clear text Clear and encrypted

Data Availability By request Available on the Internet

Access Concerns Internal access via terminal at desk Internal access, anyone on LAN, Internet

users

Data security Tape library Data on disks, CDs, hard drive, laptops,

PDAs, and other media

Data storage Clear text Compressed, encrypted, large volume

Communications

protocols

Vendor specific for terminal access Many: HTTP, FTP, SSL, Telnet, SSH,

IMAP, IDENT, UDP, TCP, etc.

Environment

protection

Building, rooms, lock boxes, fire

suppressors

Same plus firewalls (network and personal),

IDS, routers, anti-virus software

Come sono cambiate le coseLa Sicurezza IT


Subject/Topic 1970s Now

System

software

Mainframe specific Various operating systems, utilities,

software packages

Software problem

resolutionMainframe vendors Anyone who supplies software

[upgrades, patches, help desk]

Access methods Power up terminal Direct connection to network, dial-in,

hacker attacks via Internet, DSL,

VPNsAwareness Primarily limited to computer

center staff

Everyone must be diligent

Security

software

Mainframe utilities Operating system configuration, anti-virus,

vulnerability scanners, IDS,

communications monitoring

Security audit

activities

Audit computer center Audit network, computer center,

applications, communication servers,

Internet activity, penetration testing, etc.

Threat Source Anyone who has access to the

computer center

Anyone who has access to the computer

center, desktop, and the Internet.

Come sono cambiate le coseLa Sicurezza IT (2)

9


La Cooperazione Applicativa

SPCC - SICA

Porta di dominio

Dominio di servizi

Sistema informativo locale

Porta di dominio

Dominio di servizi

Porta di dominio

Dominio di servizi

PAC 1

PAC 2

PAL 1

Dominio di serviziPAL 2

Dominio diCooperazione 1

Dominio di Cooperazione 2

Dominio di serviziPAL 3

Porta di Dominio

PAL3

Porta di Dominio

PAL2

Sistema informativo locale

Sistema informativo localeSistema informativo locale


I problemi aperti

� Siamo di fronte ad uno scenario di notevole complessità e rischio

» Molteplicità di sistemi

» Molteplicità di tecnologie

» Molteplicità di responsabilità

� … con due problemi da risolvere

» Security Awareness

» Gestione della complessità

10

Dipartimento di Informatica e Sistemistica, Università di Napoli Federico II Corso di Reti di Calcolatori II – Anno accademico 2007/2008XXIII Assemblea ANCI, 26 ottobre 2006 19

Security Awareness

Esempio 1: Social Engineering

Esempio 2: Phishing

Esempio 3: Terminali mobili


Social Engineering

Ma perchè usare un Ma perchè usare un hacker per scoprire hacker per scoprire

username e username e password quando password quando

basta una basta una telefonata?telefonata?

� Salta gli Intrusion Detection Systems

� Praticamente gratis

� Basso rischio di essere scoperto

� Nessun log

� Efficace al 100%

� Nessuno se lo aspetta

11


Gestione della complessità

• Firewalls - automated virus scanning

• Physical security systems

• Spyware/adware detection software

• Intrusion detection systems

• Patch management

• Configuration management

• Controllo dell’accesso

• Wireless monitoring

• Encryption

• Autenticazione


Nature of Cyber Attacks

� How bad is it?

� Who does it and why?

� What do they do?

� Why so many attacks?

� What about the future?

12


Incident Trends

Incidents Reported to CERT/CC

0

10000

20000

30000

40000

50000

60000

90 91 92 93 94 95 96 97 98 99 00 01


Riptech Threat Reports

� Reports issued in Jan 02 and July 02 for preceding 6 months

� Data obtained from monitoring over 400 companies in over 30 countries

� Over 11 billion firewall logs and IDS alerts analyzed in 2nd

report

� Over 180,000 cyber attacks investigated in 2nd report

� Events characterized by severity level» informational – scans for vulnerabilities

» warning – bypassed firewall, but did not compromise system

» critical – required action by Riptech or client to prevent compromise

» emergency – security breach occurred

13


Intent of Attack

Source: Riptech, Inc.


Attack Intensity Jul 01 – Jun 02

Riptech Internet Security Threat Report, July 2002

28% higher in 2nd

6 month period

14


Attacks by Industry Jan – Jun 02



Severe Attacks by Industry Jan – Jun 02


15


54

39 3844

24

54

31

18

70

47

35

52 51

28

57

38

22

59

0

10

20

30

40

50

60

70

80

1996

1997

1998

1999

2000

2001

Point of Attack

INTERNALSYSTEMS

REMOTEDIAL-IN

INTERNET

CSI/FBI 2001 Computer Crime and Security SurveySource: Computer Security Institute

2001: 384 Respondents/72%






Percentage of Respondents


Financial Losses

CSI/FBI 2002 Computer Crime and Security Survey

Of those willing and able to quantify losses:

1997: 249 respondents (59%), $ 100,119,555

1998: 241 respondents (42%), $ 136,822,000

1999: 163 respondents (31%), $ 123,779,000

2000: 273 respondents (42%), $ 265,589,940

2001: 196 respondents (37%), $ 377,828,700

2002: 223 respondents (44%), $ 455,848,000

Source: Computer Security Institute

16


Actions Taken in Response to Intrusions

48

2316

11

44

26

1711

50

26

17 16

96

48

32 29

85

44

2520

94

38 3628

0

20

40

60

80

100

120

Patched holes Did not report Reported to law

enforcement

Reported to legal

counsel

1996

1997

1998

1999

2000

2001


2001: 345 Respondents/64%2000: 407 Respondents/63%1999: 295 Respondents/57%1998: 321 Respondents/72%1997: 317 Respondents/56%1996: 325 Respondents/76%



Attacks Against Critical Infrastructures

� Swedish hacker jammed 911 in central Florida in 1997

� Juvenile hacker penetrated and disabled a telco computer servicing Worcester Airport in March 1997» phone service to FAA control tower, airport fire department, airport

security, … cut off for 6 hours

� Brisbane hacker used radio transmissions to create raw sewage overflows on Sunshine coast in 2000

� Hackers broke into Gazprom’s system controlling gas flows in pipelines in 1999» world’s largest as producer and supplier to Western Europe

� Hackers got into California Independent Service Operator (ISO) development network for regional power grid in spring 2001

� Numerous denial-of-service attacks against ISPs – some shut down

17


Attack on Sewage System

� Australian man (49) hacked into waste management system of Maroochy Shire, Queensland

� Laptop used to access and control the system

� Caused raw sewage overflows» millions of litres of sewage spilled into local parks,

rivers, and hotel grounds

» marine life died, creek turned black, stench unbearable

� Made at least 46 attempts in March, April 2000

� Attacks response to being rejected for job

� Was employed by firm that installed software

� Sentenced to 2 years in prison


Potential Attackers

� Hackers and script kiddies

� Insiders

� Criminals

� Activists

� Terrorists

� Governments

18


Perceived Threats

22 23

73

51

87

21

29

72

48

89

21

30

74

53

86

21

26

77

44

81

25

31

81

49

76

0

10

20

30

40

50

60

70

80

90

100

Foreign gov. Foreign corp. Independent

hackers

U.S. competitors Disgruntled

employees

1997

1998

1999

2000

2001


2001: 484 Respondents/91%2000: 583 Respondents/90%1999: 460 Respondents/88%1998: 428 Respondents/83%1997: 503 Respondents/89%



Hacker Quotes

“It’s really just a bunch of really smart kids trying to prove themselves. I know I was.”

– Splurge, sm0ked crew

“It’s power at your fingertips. You can control all these computers from the government, from the military, from large corporations. … That’s power; it’s a power trip.”

– anonymous

“You do get a rush from doing it – definitely.”

“I’m like your nosy neighbor on steroids, basically.”

– Raphael Gray (aka Curador)

[stole/posted 26,000 Cr. Card numbers]

19


Types of Attack

� Confidentiality

» host penetrations (user and root)

» network sniffers

� Integrity

» computer viruses, worms, and Trojan horses

» Web defacements

» domain redirection (DNS hacks)

» sabotage of information and systems

� Availability

» denial and disruption of service


Incident Types

FedCIRC Incident Activity 2001

0 50 100 150 200 250 300 350

Web defacement

Reconnaissance

User compromise

Malicous code

Root compromise

Unknown

Deception

20


Types of attack or misuse detected in the last 12 months (by percent)

20

14

11

20

68

12

82

40

27

3

58

18

14

9

23

77

14

83

44

16

1

64

24

25

13

14

30

97

14

90

55

17

2

69

31

20

17

7

25

79

11

85

71

11

1

60

27

26

18

10

40

91

12

94

49

10

2

64

36

0 20 40 60 80 100 120

Theft of proprietary info

Sabotage

Telecom eavesdropping

System penetration

Insider abuse of Net access

Financial fraud

Virus

Unauthorized access by insiders

Telecom fraud

Active wiretap

Laptop

Denial of Service

2001

2000

1999

1998

1997









Dollar Amount of Losses by TypeCSI/FBI 2001 Computer Crime and Security SurveySource: Computer Security Institute


$866.000

$5.183.100

$4.283.600

$35.001.650

$8.849.000

$45.288.150

$904.100

$6.064.000$151.230.100

$91.230.100

$19.066.600

Active wiretapping

Telecom eavesdropping

System penetration

Sabotage

Denial of service

Insider net abuse

Laptop theft

Virus

Financial fraud

Telecom fraud

Theft of proprietary info

Unauth. insider access

Reti di Calcolatori II - UniNa STiDuE: l'universita a casa ...unina.stidue.net/Computer Networks...

Documents

Transcript of Reti di Calcolatori II - UniNa STiDuE: l'universita a casa ...unina.stidue.net/Computer Networks...