SC04 Network Security Wrap-Up Version 3. Role of Network Security in SCinet ISP role/rule in...

QuickTime™ and aTIFF (Uncompressed) decompressor

are needed to see this picture.

SC04 Network Security Wrap-Up

Version 3



Role of Network Security in SCinet

• ISP role/rule in protecting network(1) Protect network infrastructure

(2) Protect the Internet from SCinet

(3) Help exhibitors and attendees

• Testbed new tools, techniques, systems



SCinet network architecture

• Simple campus architecture routed via Juniper T640, T320 and Cisco 6509

• Bandwidth Challenge 10G participants given connectivity via Force10

• WAN connections– OC3 commodity Internet service via Qwest– 16 OC192 links (NLR, ESNet, Abilene, Teragrid, etc.)– 1 OC768 link to PSC

• Wireless architecture (free/open system)– Integrated wireless system by Trapeze

• Wired conference network to every meeting room• Argonne address space (140.221.128.0/17)



SCinet security team

• Timothy Toole - Sandia• Stephen Lau - NERSC/LBL• Jim Hutchins - Sandia• Scott Campbell - NERSC/LBL• Bill Nickless - PNNL• Tim Witteveen - PNNL• Roger Winslow - NERSC/LBL• Patrick Stevens - Sandia



Network Security Features

• Three primary IDS systems– Mon, Bro, Snort

• Cisco port mirroring• Packet Engines GigE Hub & NetOptics splitters• RST responder, Desuckit application, SYN-ACK

responder• Password display• MAC address blocking on wireless • Experimental

– Flo, OSX, AMD64 Opteron, Xyratex RAID system, S2IO 10GigE NICs



Expectations

• Whack-a-mole game with worms (wired and wireless)• Expect about a handful of successful intrusions

(requiring clean-up)• Likely target of cluster/HPC systems

– Valuable information provided by FBI

– Expect to see outbound TCP 53 and 55

• Expect other 'phone-home' mechanisms (bot-nets)



Worm infections (approx. 35)• Never really attempted to identify the exact signature• Location of infected device takes time, especially on DHCP

wireless• Repeat offenders• Tried shunning in Trapeze system, but took time to implement

(mainly due to 1 individual having access)• Shunning induced a load through AP association reqs• Much success in responding with SYN-acks and window sizes

of zero– Significantly slowed down the infected host– Need a good windows administrator who's security

conscious to help repair systems



Intrusions• 11/07 @ 9:00 SCinet rental desktop

– Very poorly configured from PC vendor• 11/08 @ 11:53 VendorW booth (linux cluster)

– Brute forced ssh password, outbound ftp & IRC• 11/10 in the AM

– MSSQL null SA password• 11/11 @ 08:25 & 08:36 VendorX and BoothY (Linux systems)

– Brute forced ssh password; identification of rootkit• 11/11 @ 10:21-15:07 VendorZ (Windows laptop)

– Windows file sharing exploit/whatever; became FTP server



Intrusion Summary

• At least 1 compromised system to deal with per day• Windows boxes are low hanging fruit on open

Internet• Weak passwords are also low hanging fruit on open

Internet• Script-kiddie Romanians are a pain to deal with, but

somewhat entertaining• Need someone good at explaining problem to

customer (definition of 0wn3d)



Lessons learned• Intrusions were caught by good judgment• Need to factor in 2x to 3x amount of time to get stuff done• if (BitTorrent && Wireless) { wireless.usability = crap; }• Users not courteous on wireless

– 500? users associated on empty exhibit hall• RF interference, rogue AP's, mis-configured laptops, old drivers

cause wireless problems• Never got a good data stream to adequately test 10Gbe cards

or application(s)• Not sure how to educate this particular community on good

practices• Outbound IRC ports were easy to pickup suspicious traffic

– Don't confuse GPFS with IRC• Need IPv6 IDS, since we have some native v6 links



Future projects

• SCinet05 network architecture and its impact on network security

• 10Gbe IDS/Monitoring systems• BPF/PCAP/IP/TCP on a 1/10Gig card• Visualization• Netflow analysis (help from CERT)• User education?

SC04 Network Security Wrap-Up Version 3. Role of Network Security in SCinet ISP role/rule in...

Documents

Transcript of SC04 Network Security Wrap-Up Version 3. Role of Network Security in SCinet ISP role/rule in...