1 / 26

ECE-8843 csc.gatech/copeland/jac/8843/ Prof. John A. Copeland

ECE-8843 http://www.csc.gatech.edu/copeland/jac/8843/ Prof. John A. Copeland john.copeland@ece.gatech.edu 404 894-5177 fax 404 894-0035 Office: GCATT Bldg 579 email or call for office visit, or call Kathy Cheek, 404 894-5696 Chapter 9 - Network Intrusion. Network Intruders.

rwessel
Download Presentation

ECE-8843 csc.gatech/copeland/jac/8843/ Prof. John A. Copeland

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ECE-8843 http://www.csc.gatech.edu/copeland/jac/8843/ Prof. John A. Copeland john.copeland@ece.gatech.edu 404 894-5177 fax 404 894-0035 Office: GCATT Bldg 579 email or call for office visit, or call Kathy Cheek, 404 894-5696 Chapter 9 - Network Intrusion

  2. Network Intruders Masquerader: A person who is not authorized to use a computer, but gains access appearing to be someone with authorization (steals services, violates the right to privacy, destroys data, ...) Misfeasor: A person who has limited authorization to use a computer, but misuses that authorization (steals services, violates the right to privacy, destroys data, ...) Clandestine User: A person who seizes supervisory control of a computer and proceeds to evade auditing and access controls. Hacker: generic term for someone who does unauthorized things with other peoples’ computers (also a poor golfer, tennis player, or programmer good at quick and dirty code). 2

  3. Access Control Today almost all systems are protected only by a simple password that is typed in, or sent over a network in the clear.Techniques for guessing passwords: 1. Try default passwords. 2. Try all short words, 1 to 3 characters long. 3. Try all the words in an electronic dictionary(60,000). 4. Collect information about the user’s hobbies, family names, birthday, etc. 5. Try user’s phone number, social security number, street address, etc. 6. Try all license plate numbers (123XYZ). Prevention: Enforce good password selection (“c0p31an6” - not great, “wduSR-wmHb365” - better). 3

  4. Password Gathering Look under keyboard, telephone etc. Look in the Rolodex under “X” and “Z” Call up pretending to from “micro-support,” and ask for it. “Snoop” a network and watch the plaintext passwords go by. Tap a phone line - but this requires a very special modem. Use a “Trojan Horse” program to record key stokes. 4

  5. User ID User ID User ID Salt Value Salt Value Salt Value Hash Hash Hash UNIX Passwords User’s password ( should be required to have 8 characters, some non-letters) Random 12-bit number (Salt) DES Encrypted to 11 viewable characters 5

  6. Storing UNIX Passwords Until a few years ago, UNIX password hashes were kept in in a publicly readable file, /etc/passwords. Now they are kept in a “shadow” directory only visible by “root”. This helps prevent a “reverse-lookup dictionary” attack. “Salt”: • prevents duplicate passwords from being easily seen as such. • prevents use of standard reverse-lookup dictionaries ( a different dictionary would have to be generated for each value of Salt). • does not “effectively increase the length of the password.” 6

  7. The Stages of a Network Intrusion 1. Scan the network to: • locate which IP addresses are in use, • what operating system is in use, • what TCP or UDP ports are “open” (being listened to by Servers). 2. Run “Exploit” scripts against open ports 3. Get access to Shell program which is “suid” (has “root” privileges). 4. Download from Hacker Web site special versions of systems files that will let Cracker have free access in the future without his cpu time or disk storage space being noticed by auditing programs. 5. Use IRC (Internet Relay Chat) to invite friends to the feast. 7

  8. # nmap -sS -P0 -vv -p 21,22,25,110,443 209.162.185.100 Starting nmap V. 3.00 ( www.insecure.org/nmap/ ) Host jacsw (209.162.185.100) appears to be up ... good. Initiating SYN Stealth Scan against victim (209.162.185.100) Adding open port 22/tcp Adding open port 443/tcp The SYN Stealth Scan took 4 seconds to scan 5 ports. Interesting ports on jacsw (209.162.185.100): Port State Service 21/tcp filtered ftp [response blocked by firewall] 22/tcp open ssh [tcp port 22 open] 25/tcp filtered smtp 110/tcp filtered pop-3 443/tcp open https Nmap run completed -- 1 IP address (1 host up) scanned in 5 seconds # telnet 209.162.185.100 22 [telnet can connect to any port] Trying 209.162.185.101... [here we specified port 22] Connected to 209.162.185.100. SSH-2.0-OpenSSH_3.1p1 [response shows SSH version] 8

  9. # less /var/log/secure Oct 15 13:45:30 lc1 sshd[12538]: Could not reverse map address 199.77.146.103. Oct 15 13:46:26 lc1 sshd[12538]: Accepted password for root from 199.77.146.103 port 52388 ssh2 Oct 15 15:05:44 lc1 sshd[12591]: Could not reverse map address 199.77.146.103. Oct 15 15:05:48 lc1 sshd[12591]: Accepted password for root from 199.77.146.103 port 52438 ssh2 Oct 17 07:34:10 lc1 sshd[13409]: Accepted password for root from 130.207.226.152 port 52613 ssh2 Oct 17 07:49:33 lc1 sshd[13460]: Accepted password for root from 130.207.226.152 port 52615 ssh2 Oct 17 08:02:37 lc1 sshd[13503]: Accepted password for root from 130.207.237.139 port 52616 ssh2 Oct 17 08:10:40 lc1 sshd[13542]: Accepted password for root from 130.207.237.148 port 52617 ssh2 Oct 17 08:26:16 lc1 sshd[13584]: Accepted password for root from 130.207.237.158 port 52618 ssh2 Oct 17 11:52:18 lc1 sshd[13640]: Could not reverse map address 199.77.146.103. Oct 17 11:52:27 lc1 sshd[13640]: Accepted password for root from 199.77.146.103 port 52639 ssh2 9

  10. Protection from a Network Intrusion 1. Use a “Firewall” between the local area network and the world-wide Internet to limit access (Chapter 10). 2. Use an IDS (Intrusion Detection System) to detect Cracker during the scanning stage (lock out the IP address, or monitor and prosecute). 3. Use a program like TripWire on each host to detect when systems files are altered, and email an alert to Sys Admin. 4. On Microsoft PC’s, a program like BlackIce or Zone Alarm is easier to install (and more fun) than learning how to reset all of the Windows default parameters to make the system safe. 10

  11. Anomaly-Based Intrusion Detection High statistical variation in most measurable network behavior parameters results in high false-alarm rate False Alarms Undetected Intrusions Detection Threshold 12

  12. “Base-Rate” Fallacy Suppose the accuracy of an IDS is 99%. This means that for every 100 normal events, there will be 1 false positive. Also for every 100 intrusion events, there will be 99 detects (true positives) and 1 missed detection (false negative). If there are 300,000 normal connections a day, there will be 3000 false alarms. If there is one intrusion per week, there will be a 99% chance of detecting it (if the IDS is still turned on). For detailed math, see Appendix 9A of the textbook (edition 2). 13

  13. Distributed Host-Based IDS Highly recommended for critical servers Modules must be installed and configured on hosts. Examples: Okena (Cisco), ISS Desktop Proventia 14

  14. Signature-Based IDS Data Packets are compared to a growing library of known attack signatures. These include port numbers or sequence numbers that are fixed in the exploit application, and sequences of characters that appear in the data stream. Packet streams must be assembled and searched, which reduces the maximum possible data rate on the link being observed. 15

  15. Six “Signatures” from the Snort Database www.snort.org alert tcp $EXTERNAL_NET any -> $HOME_NET 7070 (msg: "IDS411 - RealAudio-DoS"; flags: AP; content: "|fff4 fffd 06|";) alert udp $EXTERNAL_NET any -> $HOME_NET any (msg: "IDS362 - MISC - Shellcode X86 NOPS-UDP"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|";) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS359 - OVERFLOW-NOOP-HP-TCP2";flags:PA; content:"|0b39 0280 0b39 0280 0b39 0280 0b39 0280|";) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS345 - OVERFLOW-NOOP-Sparc-TCP";flags:PA; content:"|13c0 1ca6 13c0 1ca6 13c0 1ca6 13c0 1ca6|";) alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"IDS355 - OVERFLOW-NOOP-Sparc-UDP2"; content:"|a61c c013 a61c c013 a61c c013 a61c c013|";) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "IDS291 - MISC - Shellcode x86 stealth NOP"; content: "|eb 02 eb 02 eb 02|";) Other systems: “Dragon”, ISS RealSecure, Arbor 16

  16. Signature-Based Intrusion Detection Systems May Not Detect New Types of Attack Back Orifice Land Attack Win Nuke IP Blob Trino Attacks with Names Alarm on Activities in these areas. Attacks without Names (not analyzed yet) 17

  17. Flow-Based Technology -An approach that recognizes normal traffic can detect new types of intrusions. Back Orifice Land Attack FTP Web Win Nuke IP Blob NetBIOS Trino Email Attacks with Names Normal Network Activities Attacks without Names (not analyzed yet) Alarm on Activities in this areas. Example: Lancope’s “StealthWatch” 18

  18. Flow-based Statistical Analysis A “Flow” is the stream of packets from one host to another related to the same service (e.g., Web, email, telnet, …). Data in packet headers is used to build up counts (leads to high speed). After the flow is over, counters are analyzed and a value is derived for the probability that the flow was crafted, perhaps for probing the network for vulnerabilities or for denial of service. Flow- Statistics Counters Flow- Statistics Counters Number of Packets Number of Total Bytes Number of Data Bytes Start Time of Flow Stop Time of Flow Duration of Flow Flag-Bit True-False Combo Fragmentation Bits ICMP Packet Responses to UDP Packets Counters 19

  19. Zone Protection 20

  20. IDS Types Should be Combined Host-Based Can detect misuse of OS access and file permissions. Signature -Based Can detect attacks embedded in network data -if signature is known Anomaly -Based On host or network. Can detect new types, but high false alarm rate. Flow-Based Can detect new types of attacks by network activity. Should be used with Host-Based and/or Signature Based 21

  21. The Stages of a Network Intrusion Flow-based* "CI", signature-based? 1. Scan the network to: • locate which IP addresses are in use, • what operating system is in use, • what TCP or UDP ports are “open” (being listened to by Servers). 2. Run “Exploit” scripts against open ports 3. Get access to Shell program which is “suid” (has “root” privileges). 4. Download from Hacker Web site special versions of systems files that will let Cracker have free access in the future without his cpu time or disk storage space being noticed by auditing programs. 5. Use IRC (Internet Relay Chat) to invite friends to the feast. Vulnerability Scan Signature?, Flow-Based Port Profile* Host-based Signature?, "Port-Profile*", Forbidden Zones*, Host-based Signature?, "Port-Profile*", Forbidden Zones*, Host-based * StealthWatch 22

  22. Detection of the “Mac Attack” DDoS Plan Type "A" Probes (detected by John Copeland in Dec. 1999) The first three UDP probes, which started my investigation, had a single character in the data field, an 'A'. The UDP port numbers were identical, 31790->31789. They stimulate the 1500-byte ICMP Echo-Request packet and the normal 58-byte ICMP Destination_Unreachable-Port Packets. The Echo-Request is never answered. Date Time EST Source IP (Place) Destination (Place) 1999-12-28 18:40 151.21.82.251 (Italy) to 24.88.48.47 (Atlanta, GA) 1999-12-10 18:28 152.169.145.206 ( AOL ) to 24.88.48.47 (Atlanta, GA) 1999-12-16 03:34 212.24.231.131 (Saudi Arabia) to 24.88.48.47 (Atlanta, GA) UDP packets with an empty data field, like those generated by the "nmap" scan program, do not stimulate the 1500-byte ICMP packets from an OS-9 Macintosh. 23

  23. 2nd Generation, “Mac Attack” Scanning "Double-zero" Probes (James Bond, "00" -> "license to kill"), detected in Dec. 1999. I have now seen 3 UDP type "00" probes, and had another "00" probe reported from Kansas. These probes use a single UDP packet, two bytes of data (ascii zeroes) and identical UDP port numbers, 60000->2140. They stimulate the 1500-byte ICMP Echo-Request packet and the normal 58-byte ICMP Destination_Unreachable-Port Packets. The Echo-Request is never answered. 1999-12-20 07:04 195.229.024.212 (Arab Emirates*) to 24.88.48.47 (Atlanta, GA) 1999-12-21 08:04 195.229.024.213 (Arab Emirates*) to 24.88.48.47 (Atlanta, GA) *DNS name: cwa129.emirates.net.ae 1999-12-25 09:39 212.174.198.29 (Turkey) to 24.94.xxx.xxx (Wichita, Kansas) *DNS: none 1999-12-31 05:35 195.99.56.179 (Manchester, UK*) to 14.88.xx.xx (Atlanta, GA) *DNS name: manchester_nas11.ida.bt.net 2000-01-04 05:08 24.94.80.152 (Road Runner, Hawaii) to 24.94.xxx.xxx (Wichita, Kansas) *DNS name: a24b94n80client152.hawaii.rr.com 2000-01-06 04:48 195.44.201.41 (cwnet, NJ) to 24.88.xx.xxx (Atlanta, GA) *DNS name: ad11-s16-201-41.cwci.net 24

  24. Drawing from Atlanta Journal-Constitution article, Dec. 1999. Full details at www.csc,gatech.edu /macattack/ 25

  25. Traceroute to find location of IP Address Start: 11/21/99 11:07:40 PM Find route from: 24.88.48.47 to: www.orbicom.com. (196.28.160.129), Max 30 hops, 40 byte packets Host Names truncated to 32 bytes 1 24.88.48.1 (24.88.48.1 ): 17ms 17ms 16ms 2 24.88.3.21 (24.88.3.21 ): 18ms 19ms 18ms 3 24.93.64.69 (24.93.64.69 ): 17ms 18ms 17ms 4 24.93.64.61 (24.93.64.61 ): 19ms 17ms 18ms 5 24.93.64.57 (24.93.64.57 ): 25ms 25ms 23ms 6 sgarden-sa-gsr.carolina.rr.com. (24.93.64.30 ): 26ms 27ms 27ms 7 roc-gsr-greensboro-gsr.carolina. (24.93.64.17 ): 28ms 28ms 30ms 8 roc-asbr-roc-gsr.carolina.rr.com (24.93.64.6 ): 30ms 32ms 30ms 9 12.127.173.205 (12.127.173.205 ): 40ms 39ms 39ms 10 gbr2-a30s1.wswdc.ip.att.net. (12.127.1.30 ): 38ms 40ms 39ms 11 gr2-p3110.wswdc.ip.att.net. (12.123.8.246 ): 278ms 40ms 39ms 12 att-gw.washdc.teleglobe.net. (192.205.32.94 ): 41ms 43ms 42ms 13 if-7-2.core1.newyork.teleglobe.n (207.45.222.145 ): 45ms 46ms 45ms 14 if-0-0-0.bb3.newyork.teleglobe.n (207.45.221.69 ): 45ms 47ms 49ms 15 ix-1-1-1.bb3.newyork.teleglobe.n (207.45.199.202 ): 50ms 46ms 50ms 16 196.30.121.243 (196.30.121.243 ): 44ms 48ms 45ms 17 fe0-0.cr3.ndf.iafrica.net. (196.31.17.26 ): 635ms 632ms 633ms 18 atm6-0sub300.cr1.vic.iafrica.net (196.30.121.81 ): 641ms 640ms 644ms 19 196.30.200.6 (196.30.200.6 ): 643ms 640ms 643ms 20 196.4.162.86 (196.4.162.86 ): 662ms 659ms 664ms 21 www.orbicom.com. (196.28.160.129 ): 663ms 658ms 664ms • Trace completed 11/21/99 11:08:25 PM • 26

More Related