NDSU IT Security

4. NDSU IT Security • Theresa SemmensChief Information Technology Security Officer • Jeff GimbelSenior Security Analyst

5. NDSU Physical Infrastructure • Open Network • External facing network • 79 subnets • Open to Internet • Internal facing network • 79 subnets • Open to the University System and some statewide entities • Firewalled network • Used by some departments for regulatory compliance • Server room network • Used for server to server communication (i.e., backup)

6. NDSU IT Infrastructure Supported Departments Distributed IT Independent Departments

7. A Little History • 2004, ND Information Technology Department • SNMP Scan – Found a majority of printers on the University System network that had SNMP set to public • 2008, Foundstone • 175 insecure devices recognized as printers

8. How did the printer problem really come to light? • Nessus scan • Removed the safe scan • See how much paper would be wasted • LaserJet M 602 • 3 sheets • Nessus findings • FTP open • Telnet open • Web page default username and password • SNMP community name set to public

9. How did the printer problem really come to light? (continued) • Brought to the attention of IT leadership • Nessus set to “scan the entire network” • Work out alternative solution

10. Is this really a problem? • 2008 - NDSU dropped support for printers as cost-savings initiative • Currently, departments request DNS name for purchased printers • Name is granted within our naming scheme • Name is added to an install script • Printer plugged into the network

11. Is this really a problem?

12. Is this really a problem?

13. Is this really a problem?

14. Methodology • Tools – What are we going to use? • Locating devices – How widespread is the problem? • Policies and procedures – Shouldn’t we have covered this somewhere? • Identification and notification – How do we let stakeholders know their printers are not secure? • Reactions – How could we have been so wrong about how stakeholders would react? • Interesting problems – It did WHAT? • First follow-up scan – Is it working?

15. Tools Used • Angry IP scanner (GPLv2) • Putty (GNU GPL) • WinSCP(GNU GPL) • Microsoft Excel (campus agreement) • Student Employee

16. Locating Devices • Finding what is on the network • Angry IP Scanner • http://angryip.org/w/Home

17. Locating Devices (continued)

18. Findings • External network – Outward facing • 3,526 active hosts (June 7) • 67 recognizable printers • Internal network – Not routable to the Internet • 1885 active hosts (June 6) • 509 recognizable printers

19. How bad is it? • Human solution for finding the vulnerabilities in the printers • Didn’t want to be responsible for: • Crashing printers • Reams of wasted paper • Default usernames and passwords

20. Methodology • What did the student employee do? • Opened a browser to IP and hostname • Tried to log in using defaults • Used Putty to Telnet into IP or hostname • Port 23 • Tried anonymous FTP connection with WinSCP • Port 21 • Anonymous login selected

21. Findings (continued) • External network – 67 printers • 20 with anonymous FTP logins (30%) • 20 default user/admin accounts (30%) • 9 Telnet logins (13%)

22. Findings (continued) • Internal network – 509 printers • 177 with anonymous FTP logins (35%) • 219 default user/admin accounts (43%) • 156 Telnet logins (31%)

23. Policies and Procedures • Reviewed existing policies and procedures • Did we have any? • Why were they not being followed? • Should we create new ones? • How do we enforce newpolicies and procedures?

24. Review of Policies, Procedures • Vague policies • N.D. University System 1901.2 • NDSU 158 • No documented procedures • No procedures meant few people knew what should have been done • Started new procedures right away • Isn’t getting client buy-in the most difficult task anyway?

25. Vendors • Mind tricks, (policies or procedures) do not work on them, only money • Need to make sure departments consult withcentral IT unit before making purchases of devices that will be placed on the network

26. Identification and Notification • DNS names include department name, for the most part • For others, impossible to know to which department they belonged

27. Methodology • Sent emails to identified groups • IP address • DNS name • Vulnerabilities found • Directions for cleanup • Worked with communications coordinator and IT Help Desk

28. Methodology Sent out the emails and we waited

29. Reactions • Calm and collected • Were able to configure devices with no problems • Glad to help • Panicked when contacted by security office • Needed help with securing process • Grateful for help

30. It did WHAT?!?!

31. Interesting Problems • Printers no longer printing • Disabled port 9100 • Disabled SNMP • Client needed reconfiguration • Stop the print spooler • Delete all jobs in C:\Windows\system32\spool • Restart spooler • Delete all IP ports • Delete all printers • Restart computer • Setup printers

32. Problems (continued) • Older printers did not have a Web-based configuration • Older Java • Did not have any of the sections needed to configure • Configuration through Telnet • set-password – Changes default password • ftp-config:0 – Disables FTP • set-cmnty-name: <newname> - Changes default SNMP • Idle-timeout: 5 – Sets short timeout for Telnet

33. Follow-Up Scan • External network • Initially 67 printers • 20 with anonymous FTP logins (30%) • 20 default user/admin accounts (30%) • Telnet logins (13%) • First follow-up scan found 67 Printers • 16 with anonymous FTP logins (24%) • 17 default user/admin accounts (25%) • 7 Telnet logins (10%)

34. Follow-Up Scan • Internal network • Initially 509 printers • 177 with anonymous FTP logins (35%) • 219 default user/admin accounts (43%) • 156 Telnet logins (31%) • First follow-up scan found 509 Printers • 129 with anonymous FTP logins (25%) • 182 default user/admin accounts (36%) • 118 Telnet logins (23%)

35. What’s Next?

36. Questions?