CURELAN TECHNOLOGY Co., LTD Flowviewer FM-800A

CURELAN TECHNOLOGY Co., LTDFlowviewer FM-800A CURELAN TECHNOLOGY Co., LTD www.CureLan.com

Introduce Product Major Functions • Quota Management (IPv4 & IPv6) and current traffic monitor. • Peer-to-Peer (P2P) filter. • P2P Report. • Netflow or sFlow traffic report. • Worm detection(NBAD). • Automatically block infected IPs from L3 Switch by ACL .(for Cisco, Foundry, Alcatel, Extreme) or Automatically block by Flowviewer. • Port Scan and SSH Password Guess Attacks Report. (NBAD) • RDP Password Guess Attacks Report. (NBAD) • List of Possible UDP Flood Attacks Report. (NBAD) • List of Possible DOS Attacks Report. (NBAD) • Port Scan and SSH Password Guess Detection and Blocking. Blocked by Flowviewer . • RDP Password Guess Detection and Blocking. Blocking method: Blocked by Flowviewer . • UDP Flood Attack Detection and Blocking. Blocking method: Apply ACL command to core switch. • DOS Attack Detection and Blocking. Blocking method: Apply ACL command to core switch.

Agenda Classification by Function Automatic detection of RDP and SSH attacks. Automatic prevention of UDP Flood and DOS attacks. Dynamic Traffic Query can identify suspect network traffic and check the IP against a list of known and offenders.

Network Security Threats Case-1 • Virus：Using normal packet data a virus compromises PCs, potentially leading to the destruction of personal computer hard disk data or storage memory and also causing the PC to slow and so on. The destructive characteristics of those programs are limited to personal computers. • Hacker：In the computer security context, a hacker is someone who seeks and exploits weaknesses in a computer system or computer network. Hackers may be motivated by a multitude of reasons, such as profit, protest, or challenge. • The hackers can use a port scan Trojan to discover the network vulnerabilities. They can also scan the unit's Port Service, so some units will change the original Port Service number leaving the network open to further hacking activities. • By using a Port Scan hackers can scan the unit's Port Service, allowing Trojans to invade a specific port by guessing the password. After the success of these Trojans horse programs the computer then becomes a zombie computer and potentially part of a botnet.

Network Security Threats Case-2 • After the successful hacking of the zombie computer, this can lead to other internal computer intrusion and through the use of a key logging program the hacker can determine if the computer is a personal computer or a server, because the personal computer will be shutdown regularly by the user while a server is very rarely shutdown. If it is a server this is a suitable method to relay and attack the target IP. The server may also contain valuable data which can be stolen by the hacker. • Through the Port Scan program hackers can exploit the known insecurities of ports 53 and 123 and can then create a DNS Amplification Attack via port 53 (DOS Attacks), this type of attack can also be created by using port 123 NTP (Network Time Protocol) reflection attacks. (UDP Flood Attacks) • If your device is using network behavior analysis(NBA) to identify hacker intrusion and attack, you do not need to use the feature value (Pattern). Network behavior analysis is the collection of all network IP data to determine, by identifying anomalous network data, intrusion and hacking attacks. NBA allows for the rapid detection of network attacks by analyzing ALL network data unlike the pattern detection method which is restricted to identifying attacks based on set patterns of network activity. Hackers can bypass this detection method by regularly changing the pattern of their attacks every 2 or 3 days.

Hacking Methods • Bypass network security by exploiting SSH and RDP vulnerabilities. • Known Microsoft operating system vulnerabilities(see note below) and PHP, C++ database vulnerabilities. These methods exploit bugs that even software and operating system developers are not aware of in their systems. This is the best situation from a hacker’s point of view as these types of attacks cannot be detected or stopped until developers identify the bug and release updated software to fix the problem. • Note: Hackers can use injection of CSS codes on insecure web sites allowing them to access confidential user data on the host server. A google safety engineer also pointed out that there is evidence that Microsoft was aware of this vulnerability as early as 2008 . At present users must rely on their browsers to deal with this vulnerability. • No network security product can ever protect from all attacks, for example, a Trojan horse attached during P2P、APP and Spear Phishing is undetectable. Luckily, server equipment does not receive and send mails or use P2P downloads automatically, therefore any action of this kind is on a personal computer. Most hacks focus on one computer and then use the intranet to attack other IPs until they locate the server IP that allows access to confidential data. Another method is to slip Trojans to individual PCs then using the relay function to take down the network. • The FM-800A provides RDP、SSH attack detection and blocking functions.

Hacker steals confidential data of file serverFlowveiwer has solution • Most intranet attacks are performed via RDP, the RDP password guessing attack detection function is unique and available only in Flowviewer FM-800A. The Flowviewer system can detect and automatically send ACLs (Access Control List Entries) to Core Switch (Layer 3) to prevent attacks. As seen below: a list of possible RDP Attacks report, Number 3, 5, 6 and 7 illustrate this type of intranet attack. • Outlined in the red column, we can see an internal source IP (140.xxx.xxx.229) attacked 9 IPs (140.xxx.xxx.3, 140.xxx.xxx.2, and so on) at the same time. • It is possible that the source IP of number 3, 5, 6 and 7 are the victims of the Spear Phishing.Figure is a successful example of FM-800A detecting the RDP attack.

Exclusive technology : RDP Attacks-1 • On 2012/06/04, our RDP Attack detect function detected a hacker using 222.133.38.22 (Src IP) trying to compromise 140.XXX.101.4(Dst IP). • Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to another computer. Clients exist for most versions of Microsoft Windows (including Windows Mobile), Linux, Unix, Mac OS X, Android, and other modern operating systems.

RDP Attacks-2 • Trace of the source IP of RDP attack. • 222.133.38.22 (Source IP) is from China. • All series of Flowviewer FM-800A can query IP address using Geotooland whois web site.

SSH Password Guess Attacks Report • Many attacks go through the SSH route, the Flowviewer system can detect and automatically send ACLs (Access Control List Entries) to Core Switch (Layer 3) to prevent attacks. As seen below: a list of Possible SSH Attacks. • FM-800A detected and blocked the IP 203.125.203.23 that used the SSH password guess attack to compromise a certain university's IP on 2013/08/23.

Real Case Hackers compromised the intranet IP successfully by SSH password guessing then implanted the Trojans on September 12th, 2010. After three days, hackers attacked the external IP by using UDP Flood Attacks with intranet IPs that had been implanted with the Trojans.

Example of an SSH Attack • The IP (218.29.100.122) tried to attack TANet betweenSeptember 9th and 12th. The targets were National Sun Yat-sen University, National Chung Cheng University and the Ministry of Education Computer Center. There were as many as 160000 individual attack during this period. • Hackers(218.29.100.122) tried to invade one University IP 140.XXX.XXX.134(Server) and another University Server Farm on September 11th & 12th. • Hackers successfully invaded the servers of these two universities. Using the same method, hackers can invade the networks of commercial companies and gain access to confidential information. For example customer credit card details.

Successful detection of SSH intrusion attempts-1 • Hackers(218.29.100.122) try to invade the XXX University IP 140.XXX.XXX.134(Server) on September 11th. • Hackers(218.29.100.122) try to invade the YYY University Server Farm on September 11th.

Successful detection of SSH intrusion attempts-2 • Hackers(218.29.100.122) try to invade the XXX University IP 140.XXX.XXX.134(Server) on September 12th. • Hackers(218.29.100.122) try to invade the YYY University Server Farm on September 12th.

Successful hacker attack : September 12th . UDP Flood Attacks begins September 15th • Why do hackers try to implant Trojan horse programs to servers via SSH? • Taking the IP 218.29.100.122 as an example. On 9/12, the TANet intrusion finishes, but it then starts to attack the IP 93.114.111.187(it belongs to an ISP based in Romania) by UDP Flood attack. Although we do not know why hackers do these attacks, but they used IP 218.29.100.122 (Server) to intrude 140.XXX.XXX.134(Server) . It’s purpose is to attack the ISP in Romania by UDP Flood attack. The following description is a real case.

Real Case : UDP Flood Attack on September 15th • Example: XXX university has a server which was implanted with Trojan horse programs and launched a UDP Flood Attack to a foreign IP. 218.29.100.122 andinvaded 140.XXX.XXX.134and then attacked the Romanian ISP(IP:93.114.111.187) via UDP Flood Attack on September 15th. • As shown below, the time duration was 2010-09-15 11:57:59 --> 2010-09-15 12:00:23. • There is 1.63GB of network traffic but the number of transmission packets is as high as 22,464,848, so we can know it is indeed a UDP Flood Attack event. Within 5 minutes, the Flowviewer was abled to detect the UDP Flood attack and send an email to notify administrators and write ACL commands to the Core Switch to block the attack.

Defense Methods • The FM-800A collects real time IP network traffic and analyzes it to identify unusual or suspicious behavior, rather than using the defined terms. Therefore the system doesn't take into account the names of the attacks, that is to say network administrators don't have to waste time in researching the names of hacker attacks. • 1.UDP Flood Attacks：Make a large number of small, fake UDP packages to attack a special IP. Weaken the intranet so it cannot work normally. This IP can be the HTTP file server, Web server, DNS server and so on. • 2.DOS Attacks：Make a large number of small, fake TCP packages to attack a special IP. Weaken the intranet so it cannot work normally. This IP can be the HTTP file server, Web server, DNS server and so on. • FM-800A automatically blocks UDP Flood attacks and DOS attacks.

UDP Flood Attack(DNS Amplification Attack)Attacks National XXX University -1 • On November 29, 2010, a central national university internal IP was attacked by three foreign IPs: 212.59.6.158 (Lithuania) 202.104.151.201 (Chinese) 124.127.117.86 (Chinese) via UDP Flood Attack. This attack caused the entire campus network to shut down.

UDP Flood Attack(DNS Amplification Attack)Attacks National XXX University -2 • Highlighted below we can see the flows which 212.59.6.158 attacked 140.XXX.XXX.131 with. As the following figure shows, that time duration is 2010-11-29 06:41:53 - > 2010-11-29 06:46:12. It produced 23,566,887 packets in 5 minutes, the graph clearly shows that the Flowviewer can accurately and automatically detect the UDP Flood Attacks from 140.XXX.XXX.131. From the following report, we can identify that the hacker attacked the target via port 53 and it is a DNS Amplification Attack.

Detection of UDP Flood Attack Event • After detecting the UDP Flood Attack, the Flowviewer will send a notification e-mail to administrators and write ACL commands to the Core Switch to block the attacking IP. • According to the time duration, the packet number and traffic are correlated, we can identify that it is a UDP flood attack.

NTP reflection attacks (UDP Flood Attacks)： • The Hacker relays 140.XXX.XXX.2 to attack 192.99.18.64 via port 123, this attack is an NTP reflection attack.

Detection of DOS Attack Event • The Flowviewer can detect DOS attacks and notify the administrator by e-mail. It can also automatically block the IP by itself. • 140.XXX.XXX.174. is used as a DOS Relay source to attack 113.107.174.140. The flows (Sessions) are up to 53,706,960 and the traffic was 105.44 GB. • The attack will cause internal network performance to fall sharply and even cause the entire internal network to shut down, so we can see that a DOS Relay IP is not just a problem for a single user it is also a problem for the entire network.

Comparison Chart between FM-800A, IPS and Spyware

The Blind Spot of IPS Equipment • IPS equipment uses a feature code (Pattern) scheme to identify the external network hacker attacks by feature codes (Pattern) and threshold (threshold) setting function and then block the hacker. However the hacker through P2P, APP, Spear Phishing and other methods of intrusion into the internal network computer, can then by using implanted Trojan zombie computers on the internal network bypass IPS detection methods as these are designed to block external attacks only. • IPS equipment uses a feature code (Pattern) to detect hacker attacks and intrusion. Feature code (Pattern) update is slow, and the threshold value (threshold) setting function error rate is very high. • Just like the USA Inc Arbor Networks, Mazu Networks, Lancope , the Flowviewer device uses NBAD (Network Behavior Anomaly Detection) technology with synchronization and does not use feature code(Pattern) and so does not suffer from slow updates and very high false positive rate problems with the threshold function.

DNS Amplification Attack-1

DNS Amplification Attack-2 • As shown in above, when a hacker slipped a Trojan on PC4, the hacker changed the inquiry packet sourced IP as target A, and this is the IP the hacker attacked. The fake IP would ask domain name data for Local DNS, but the DNS Server doesn’t have that data. Therefore, the DNS Server would ask for data from the Public DNS. When Domain name data is transferred back to the DNS Server, the DNS Server would transfer data back to the fake IP. However, that IP is Public IP on the Internet and is not on the Intranet. Thus, the domain name data which the Local DNS asked for will be transferred to the Internet Public IP. As you can see, PC4 had been slipped the Trojan, so PC4 would continuously ask for domain name data from the Local DNS, and the Local DNS would continuously transfer the data to the Internet Public IP. This method of attack is called a DNS Amplification Attack.

DNS Amplification Attack-3 • Here we can see how hackers used huge sessions (Flows) to paralyze a website or a server. This is an example to illustrate how our FM-800A can detect and stop network attacks. • On Oct. 11th, 2013, a hacker used at Ukrainian IP 80.91.160.129 (sourced IP) to make a huge sessions (Flows) to paralyze port 53 of the DNS server at Wu Feng University. The method of attack was to use a sessions (flows) on every single port service. As shown above the picture, we can see there were9,436sessions (flows).

Zoom In 9,436 Sessions(Flows)report • A UDP connection is a connection which does not include sessions (Flows), that’s why hackers use packets of only 69 Bytes with every single Port Service as shown above the picture, FM-800A receives Netflow data, and Netflow will take every single Port Service as a session (Flow).

DNS Amplification Attack-4 • According to the analysis data above , we made a chart to show how hackers used a huge UDP connection to paralyze the port 53 of the DNS server. This chart shows the UDP connection flows per second, by the 37th second, there is a maximum of 206 UDP connections.

DNS Attacks: How to avoid firewall detectionThe following are real cases showing that firewall Dos Protections (Threshold function) cannot protect the IP from attacks by hackers. • We set up an IP UDP connection (sessions/packets) with 300 UDP packets per second, to ensure that the firewall will then block this IP. However, in this case, there are only 206 UDP packets per second. This means that the attack cannot be detected by the firewall. When setting firewall thresholds, it is not effective to block an IP for just 300 UDP packets per second. Hackers always want to bypass the firewall and that includes changing the attack pattern every 2 or 3 days. In this case, NBAD (Network Behavior Anomaly Detection) is the best and most effective way to keep networks secure and free from outside attacks.

Real-time Query of Dynamic Traffic • The query can be adjusted at any time to analyze the individual IP address and show all of the destination IPs it has contacted. This function can identify the details of any potential crime and be used as evidence later on. • The following figure shows the source IP(120.XXX.XXX.39) and lists the destination IPs it contacted during May 20, 2014 from 12:30 to 13:30. The destination IP is the IP address of the website or server . The IP in blue means it was accessed via port 80 and the IP in green represents those not using port 80.

FM-800A Configuration : Inline Mode

Automatically Prevent Hacker Intrusion and Attack in Inline Mode • Even in the event of a combined hardware and system failure, the Flowviewer, utilizing auto by-pass mode, will not have any adverse effect on network connections or stability. • The Flowviewer FM-800A device provides automatic blocking of hacker intrusions and attacks. • Automatic blocking of external IPs. (When hackers want to intrude on internal network via the Internet.) • The Flowviewer can automatically write ACL commands to the Core Switch to block attacks via intranet to intranet.

Flowviewer FM-800A Can Block Automatically • Flowviewer FM-800A can automatically stop the SSH Password Guess Attacks, RDP Password Guess Attacks, UDP Flood Attacks and DOS Attacks , by sending ACLs (Access Control List Entries) to Core Switch (Layer 3). As we can see, the target company includes Cisco, Foundry,Alcatel and Extreme etc.

Traffic Quota Function

Introduction of Traffic Quota Control • On campus, this function may be used to control the network traffic on the dorm. For government or enterprise, the function can be set to limit network traffic. Therefore, network limits can be set at different levels for different network groups depending on their requirements. • When the user quota is exceeded, the quota manager can: (1) Blocking(Block the user’s IP address). (2) Bandwidth limit(Rate limit). The system allows the user to choose either Bandwidth limit or Block IP for different groups at the same time. • The system can prevent the increase of bandwidth as a method to solve network traffic problems.

Traffic Monitor Function Introduction • Traffic Monitor can monitor real time traffic, including total up/down/bi-direction traffic, current up/down/bi-direction speed and peak up/down/bi-direction speed.

Forced Disconnection Function • When managers find an IP improperly using network resources or performing any malicious acts (such as setting others’ IP address) they can block this IP manually.

Traffic Analysis of Individual Units on the Internal Network • A unit IP Group can be defined and used to display the network traffic usage rate of this IP group, which is then displayed in a pie chart. • This can be used to identify network problems using a unit IP group to show that units individual flow analysis.

P2P function • The flowviewer system can use P2P Pattens to filter P2P traffic such as : BitTorrent；AppleJuice；WinMX；SoulSeek；Ares、AresLite；Gnutella ; Foxy；eDonkey、eMule、Kademlia；KaZaA、FastTrack；Direct Connect；Xunlei、Thunder；PPStream、QQLive、feidian、POCO、QVOD；SIP(VoIP). • P2P white list：IP or subnet can be added to P2P white list and will never be blocked from using P2P applications.

P2P White List • IP or subnet can be added to P2P white list and will never be blocked from using P2P applications.

Worm IP Blocking Function • The system provides an ACL(Access Control List) blocking function. • Flowviewer can block by itself, and can also notify the administrator while blocking IPs. • It can also set white list IPs that can bypass the blocking function. The feature can work on the following Layer 3 switches: Cisco, Foundry, Alcatel, H3C and Extreme.

Built-in standard feature with the difference functionality table

Telecoms Solutions • Most telecoms Companies provide an IDC(Internet Data Center) and the IDC service provides customer websites with the ability to detect DDoS（Distributed Denial of Service）attacks. • Therefore, detecting UDP Flood Attacks becomes the most important function. Flowviewer FM-800A has the ability to accurately detect hacker IPs and send ACLs (Access Control List Entries) to Core Switch (Layer 3) that cuts off UDP Flood Attacks and preventsIDC(Internet Data Center) customer websites or business application servers from being paralyzed.

UDP Flood Attacks: a real world example • Below is an example of the Flowviewer FM-800A successfully detecting an attack from an external IP(140.xxx.xxx.183) to a university in Taiwan. • Using a Flowviewer FM-800A a Telecoms Company can protect an IDC(Internet Data Center)client from hacker attacks.

Conclusion • No single device can detect all hacker attacks. But our device can detect most types of hacker attacks. • There is no solution for P2P and Spear Phishing but our device has a way to deal with these problems. We can do this using our RDP detect functionality. The Flowviewer FM-800A is the only system with this exclusive functionality on the market.

Our reference sites • Important Customer: • National Center for High-Performance Computing • l Main Service : Cross-Campus WLAN Roaming Mechanism. • l Our Product–Flowivewer–use netflow traffic report feature to trace IPs that controlled by Botnet and notify the administrators who’s in charge of the IP address. • School: • National Chung Hsing University (NCHU) • National Kaohsiung Marine University • National pingtung University of Science&Technology • I-Shou University ; Chinese culture University • National University of Tainan • National Taichung University • National Changhua University of Education ; WuFeng University • Nanya Institute of Technology • Ling Tung University • National Taichung Nursing College • Military: • Chung Cheng Armed Preparatory School • National Defense University • R.O.C Military Academy • Government: • Kaohsiung City Government • Taitung County Government • Financial Supervisory Commission, Financial Examination Bureau • Other: Show Chwan Memorial Hospital﹐Mega International Commercial Bank, Fist

Customers

Performance and Function

CURELAN TECHNOLOGY Co., LTD Flowviewer FM-800A