Introduction to Network Security © N. Ganesan, Ph.D. Acknowledgement What is a Firewall?* • A firewall, in general, isolates two networks from one another to enforce security • A network in this case may consist of one or more computers • The firewall inspects each individual “packet” of data as it arrives at either side of the firewall — inbound or outbound and determines whether the data packet should be allowed to pass Types of Firewall • Hardware based • Software based Hardware Firewalls • CISCO • Dlink • Linksys Software Firewalls • Zone Alarm Pro General Firewall Features • Port Control, Network Address Translation, Application Monitoring (Program Control) and Packet Filtering. • Additional features: Data encryption, hiding presence, reporting/logging, e-mail virus protection, pop-up ad blocking, cookie digestion, spy ware protection, laptop protection. • Note that different features may be available in hardware and software firewalls Do Firewalls Prevent Viruses and Trojans?* • NO!! A firewall can only prevent a virus or Trojan from accessing the internet while on your machine. • 95% of all viruses and Trojans are received via e-mail, through file sharing (like Kazaa or Gnucleus) or through direct download of a malicious program. • Firewalls can't prevent this - only a good antivirus software program can. Firewall Protection for Viruses and Trojans* • However, once installed on your PC, many viruses and Trojans "call home" using the internet to the hacker that designed it. • This lets the hacker activate the Trojan and he/she can now use your PC for his/her own purposes. • A firewall can block the call home and can alert you if there is suspicious behavior taking place on your system. Some Hardware Firewall Features* • Offers IP security and internet key exchange network encryption. • Integrated firewall functions. • Network address translation. • Encrypted SNMP management traffic. Some Software Firewalls • Zone Alarm • Microsoft • Mcafee • Norton Basic Types • Network Layer • Application Layer Network Layer • Makes decision based on the source, destination addresses, and ports in individual IP packets. • Based on routers. • Has the ability to perform static and dynamic packet filtering and stateful inspection. Static & Dynamic Filtering • Static Packet Filtering looks at minimal information in the packets to allow or block traffic between specific service ports. Offers little protection. • Dynamic Packet Filtering maintains a connection table in order to monitor requests and replies. Stateful inspection • Compares certain key parts of the packet to a database of trusted information. Incoming information is compared to outgoing information characteristics. Information is allowed through only If comparison yields a reasonable match. Application Layer • They are generally, hosts running proxy servers which perform logging and auditing of traffic through the network. • Logging and access control are done through software components. Proxy Services • Application that mediates traffic between a protected network and the internet. • Able to understand the application protocol being utilized and implement protocol specific security. • App. Protocols include: FTP, HTTP, Telnet etc. Port Scans • When hackers remotely spy on your computers to see what software and services they have. • Port scans are common but with a properly configured and maintained firewall you can restrict access. DMZ • Demilitarized zone • Neither part of the internal network nor part of the Internet • Never offer attackers more to work with than is absolutely necessary Firewall Scenario • Microsoft Internet Security and Acceleration (ISA) Server as a Dedicated Server Network Configuration Local Area Network • Single Computer • Small Office Network – Less than 250 Clients – IP Network Protocol – Demand Dial Connectivity • Larger Organization – Array of ISA Server ISA Server Internet Opening Ports Software • Firewall Windows – Zone Alarm – Winroute – Trojan Trap - Trojan Horse • Firewall Linux – Iptables • Firewall Mac – Netbarrier Implementing Firewall – An Example • Using Winroute as a software router for a small LAN. • Using Trojan Trap as protection against active code attack. • Software installation. • Firewall configuration. • Test and scan. Firewall software comparison Winroute • Routing using NAT(Network Address Translation) • Packet filtering • Port mapping • Anti-spoofing • VPN support • DNS, DHCP • Remote adminstration Configuration and Rule Sets • Setup Winroute for LAN • Winroute-PC should at least have 2 NICs • Check that all IP addresses are pingable • Validate NAT on the Winroute-PC • Deactivate NAT on the NIC connected to internal LAN Setup Winroute for LAN • No gateway configured on your local interface of the Winroute-PC • Configure forwarding options • On each internal PC configure the default gateway • On each internal PC configure the DNS server Scan and Test • http://scan.sygatetech.com/ • http://www.csnc.ch/onlinetests/ • http://grc.com/ • http://hackerwhacker.com/ Trojan Trap • Resources protection – restrict access to system resources by unknown application • Application control • Content filtering • IP ports monitoring Hardware Firewall • • • • • What is it? What it does. An example. Firewall use. What it protects you from. Hardware Firewall (Cont.) • What is it? It is just a software firewall running on a dedicated piece of hardware or specialized device. Basically, it is a barrier to keep destructive forces away from your property. You can use a firewall to protect your home network and family from offensive Web sites and potential hackers. Hardware Firewall (Cont.) • What it does ! It is a hardware device that filters the information coming through the Internet connection into your private network or computer system. An incoming packet of information is flagged by the filters, it is not allowed through. Hardware Firewall (Cont.) • An example ! Hardware Firewall (Cont.) • Firewalls use: Firewalls use one or more of three methods to control traffic flowing in and out of the network: – Packet filtering – Proxy service – State-full inspection Hardware Firewall (Cont.) • Packet filtering - Packets are analyzed against a set of filters. • Proxy service - Information from the Internet is retrieved by the firewall and then sent to the requesting system and vice versa. • State-full inspection – It compares certain key parts of the packet to a database of trusted information. Information traveling from inside to the outside is monitored for specific defining characteristics, then incoming information is compared to these characteristics. Hardware Firewall (Cont.) • What it protects you from: – – – – – – – Remote logins Application backdoors SMTP session hijacking E-mail Addresses Spam Denial of service E-mail bombs E-mail sent 1000’s of times till mailbox is full Macros Viruses Software Firewall • What it is? – Also called Application Level Firewalls – It is firewall that operate at the Application Layer of the OSI – They filter packets at the network layer – It Operating between the Datalink Layer and the Network Layer – It monitor the communication type (TCP, UDP, ICMP, etc.) as well as the origination of the packet, destination port of the packet, and application (program) the packet is coming from or headed to. Software Firewall (Cont.) • How does software firewall works ? Software Firewall (Cont.) • Benefit of using application firewalls: – – – – – – allow direct connection between client and host ability to report to intrusion detection software equipped with a certain level of logic Make intelligent decisions configured to check for a known Vulnerability large amount of logging Software Firewall (Cont.) • Benefit of application firewalls (Cont.) easier to track when a potential vulnerability happens protect against new vulnerabilities before they are found and exploited ability to "understand" applications specific information structure Incoming or outgoing packets cannot access services for which there is no proxy Software Firewall (Cont.) • Disadvantage of Firewall: slow down network access dramatically more susceptible to distributed denial of service (DDOS) attacks. not transparent to end users require manual configuration of each client computer Top Picks Personal Firewalls • Norton Personal Firewall • ZoneAlarm Free/Plus/Pro Conclusion Web References • • • • • • • firewall.com firewall-net.com firewallguide.com msdn.microsoft.com winroute.com tinysoftware.com sunsite.unc.edu Benefits of Firewall-Summary • Prevent intrusion • Choke point for security audit • Reduce attacks by hackers • Hide network behind a single IP address • Part of total network security policy References http:// www.howstuffworks.com http://www.microsoft.com http://www.securityfocus.com http://grace.com/us-firewalls.htm http://www.kerio.com/us/supp_kpf_manual. html http://www.broadbandreports.com/faq/secur ity/2.5.1. http://www.firewall-software.com Hacking © N. Ganesan, Ph.D. IP Spoofing • IP spoofing is when an attacker captures the routing packets to redirect a file or transmission to a different destination. • The technique is also effective in disguising an attacker's identity. • Protocols that deal with inter-computer communication are most susceptible to spoofing,e.g., ICMP, IGMP and UDP. • Solution is securing transmission packets and establishing screening policies, point to point encryption, configuring network to reject packets that claim to originate from a local address. FTP Attacks One of the most common FTP attacks is a buffer overflow caused by a malformed command. A successful attack could either drop the attacker in a command shell or cause a denial of service. Failure to apply the frequently released system upgrades and patches is the most common cause of FTP vulnerabilities. FTP exploits are also useful in password guessing , FTP bounce attacks, and mining information (such as the machine's registry). Unix Finger Exploits The Unix OS finger utility was used as an efficient way to share user information in the early days of the Internet. To an attacker, the Finger utility can yield valuable information, including user names, logons and contact information. It also provides a pretty good indication of users' activities like how many times they are logged on. The personal information it reveals can provide an attacker with enough of a framework to trick legitimate users into revealing passwords and access codes. Flooding and Broadcasting An attacker can significantly reduce the processing capacity of a network by sending more information requests than it can handle-a classic denial of service. Sending a large amount of requests to a single port is Flooding. When the requests are sent to all network stations, it's called broadcasting. Attackers will often use flood attacks to gain access to a system for use against other networks in distributed denial-of-service (DDoS) campaigns. DDoS attacks are harder to stop because they come from multiple IP addresses simultaneously. The only solution is to trace the packets back to their source and shutdown the transmitting networks. Fragmented Packet Attacks Internet messages transmitted via TCP/IP can be divided into packets in such a way that only the first packet contains the TCP segment header information. Some firewalls will allow the processing of subsequent packets that do not contain the same source address information as the first packet, which can cause any type of system to crash. Fragmented packets can also create a flood-like situation because they are stored in the Kernel. The server will crash if the kernel memory absorbs too many fragmented packets. Solution : Firewall Filters Email Exploits E-mail exploits come in five forms: mail floods, command manipulations, transport-level attacks, malicious code insertion and social engineering. Mail-flood attacks occur when so much mail is sent to a target that communication programs destabilize and crash the system. Command-manipulation attacks can cause a system to crash by subverting the mail transfer agent with a buffer overflow caused by entering a malformed command. Email Exploits (Contd…) Transport-level attacks exploit the SMTP. An attacker can cause a temporary error condition in the target system by overloading an SMTP buffer with more data than it can handle. Malicious content is often propagated through email systems. Some viruses and worms will be carried into a system appearing as a legitimate attachment Social engineering e-mails are an attacker's attempt to trick a legitimate user into revealing sensitive information or executing a task. E.g., posing as a network administrator to get your password for Password Attacks The most common password attacks are guessing, brute force, cracking and sniffing. Password guessing involves entering common passwords either manually or through programmed scripts. Brute-force logon attacks follow the same basic logic as password guessing, but are faster and more powerful. Password cracking is a method for defeating the protection of encrypted passwords stored in a system's admin files. Because an attacker needs a significant level of access to launch this kind of attack, the best defense Selective Program Insertions A selective program insertion is when an attacker places a destructive program—a virus, worm or Trojan horse--on a target system. Some network administrators are augmenting their malware defenses with alternative technologies such as behavior blockers, which stop suspicious code based on behavior patterns, not signatures. A time bomb, sometimes called a logic bomb, is an inserted program that executes its malicious payload on a predetermined time or date. Port Scanning and Polling Through port scanning and polling, an attacker can observe the functions and defenses of various system ports. For example, scanning could be used to determine whether default SNMP community strings are open to the public, meaning information can be extracted for use in a remote command attack. TCP/IP Sequence Stealing & Packet Interception TCP/IP sequence stealing is the capturing of sequence numbers, which can be used to make an attacker's packets appear legitimate. A successful TCP/IP attack could allow an attacker to intercept transactions between two organizations, providing an opportunity for a man-in-the-middle attack. In some versions of Secured Shell Service Daemon (SSHD), only the public key is used for authentication. If an attacker learns the public key, he could create and insert forged packets. Observations and Suggestions Various firms Install firewall, but never upgrade them. Do massive Website improvements without making parallel security improvements. The best way to safeguard a website from attack is to approach security as the ongoing challenge rather than a one time effort. Port Scanning Using PortQry • What is port scanning? • Using PortQry (the Portqry.exe command-line utility) What Is Port Scanning? • Network applications use TCP/UDP ports • Clients connect to applications using ports • Port scanning is the process of checking whether a port is open TCP 389 UDP 135 Transport ICMP IP Internet Ethernet Network TCP and UDP in TCP/IP protocol architecture Port Numbers • The Well Known Ports are those from 0 through 1023. • The Registered Ports are those from 1024 through 49151. • The Dynamic and/or Private Ports are those from 49152 through 65535. http://www.iana.org/assignments/port-numbers ftp://ftp.isi.edu/in-notes/rfc1700.txt Well-know TCP / UDP ports TCP Port Number Description 20 FTP (Data Channel) 21 FTP (Control Channel) 23 Telnet 80 HyperText Transfer Protocol (HTTP) used for the World Wide Web 139 NetBIOS session service UDP Port Number Description 53 Domain Name System (DNS) Name Queries 69 Trivial File Transfer Protocol (TFTP) 137 NetBIOS name service 138 NetBIOS datagram service 161 Simple Network Management Protocol (SNMP) Port Scanning for TCP • TCP ports use "three-way handshake" • Successful handshake means port is listening • TCP Reset packet means port is not listening • No response means port is filtered TCP 389 Transport ICMP IP Internet Ethernet Network Port Scanning for UDP • UDP ports do not use "three-way handshake" • Send UDP packet to port and wait for response • Most applications will not respond to zerolength packets • Formatted packet is necessary to get a response • Most port scanners do not scan UDP ports UDP 135 Transport ICMP IP Internet Ethernet Network What Is Port Scanning used for? Use port scanning to: • Test connectivity • Test security query ports Port Scanner App Firewall TCP 25: SMTP TCP 80: WWW UDP 135: RPC EPM UDP 389: LDAP Server Using PortQry • PortQry is designed as an application layer port scanner • It checks whether TCP and UDP ports are open, closed, or filtered • It determines if UDP ports are open using packets formatted for well known services Portqry is available for download on the Microsoft Web site at: http://download.microsoft.com/download/win2000adserv/Utility/1.0 /NT5/EN-US/portqry.exe PortQry Supports: • • • • • • • • LDAP RPC DNS SMTP POP3 IMAP4 FTP NetBIOS Name Service LDAP RPC EPM TCP 389 UDP 135 Application Session Transport ICMP IP Internet Ethernet Network Status of a TCP/IP port • Listening – A process is listening on the port on the computer you choose. Portqry.exe received a response from the port. • Not Listening – No process is listening on the target port on the target system. Portqry.exe received an Internet Control Message Protocol (ICMP) "Destination Unreachable - Port Unreachable" message back from the target UDP port. Or if the target port is a TCP port, Portqry received a TCP acknowledgement packet with the Reset flag set. • Filtered – The port on the computer you chose is being filtered. Portqry.exe did not receive a response from the port. A process may or may not be listening on the port. By default, TCP ports are queried three times and UDP ports are queried once before a report indicates that the port is filtered. PortQry Usage portqry -n server [-p protocol] [-e || -r || -o endpoint(s)] [-l logfile] [s] [-q] Where: -n [server] IP address or name of server to query -p [protocol] TCP or UDP or BOTH (default is TCP) -e [endpoint] single port to query (valid range: 1-65535) -r [end point range] range of ports to query (start:end) -o [end point order] range of ports to query in an order (x,y,z) -l [logfile] name of log file to create -s 'slow link delay' waits longer for UDP replies from remote systems -q 'quiet' operation runs with no output returns 0 if port is listening returns 1 if port is not listening returns 2 if port is listening or filtered portqry -n myserver -p UDP -e 389 Returns LDAP base query information UDP port 389 (unknown service): LISTENING or FILTERED Sending LDAP query to UDP port 389... LDAP query response: currentdate: 09/03/2001 05:42:40 (unadjusted GMT) subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=eu,DC=reskit,DC=com dsServiceName: CN=NTDS Settings,CN=RED-DC-11,CN=Servers,CN=NA-WARED,CN=Sites,CN=Configuration,DC=eu,DC=reskit,DC=com namingContexts: DC=redmond,DC=eu,DC=reskit,DC=com defaultNamingContext: DC=redmond,DC=eu,DC=reskit,DC=com schemaNamingContext: CN=Schema,CN=Configuration,DC=eu,DC=reskit,DC=com configurationNamingContext: CN=Configuration,DC=eu,DC=reskit,DC=com rootDomainNamingContext: DC=eu,DC=reskit,DC=com supportedControl: 1.2.840.113556.1.4.319 supportedLDAPVersion: 3 supportedLDAPPolicies: MaxPoolThreads highestCommittedUSN: 4259431 supportedSASLMechanisms: GSSAPI dnsHostName: myserver.eu.reskit.com ldapServiceName: eu.reskit.com:myserver$@eu.RESKIT.COM serverName: CN=MYSERVER,CN=Servers,CN=Sites,CN=Configuration,DC=eu,DC=reskit,DC=com supportedCapabilities: 1.2.840.113556.1.4.800 isSynchronized: TRUE isGlobalCatalogReady: TRUE ======== End of LDAP query response ======== UDP port 389 is LISTENING portqry -n myserver -p UDP -e 135 Dumps RPC EndPoint Mapper database UDP port 135 (epmap service): LISTENING or FILTERED Querying Endpoint Mapper Database... Server's response: UUID: 50abc2a4-574d-40b3-9d66-ee4fd5fba076 ncacn_ip_tcp:169.254.12.191[4144] UUID: ecec0d70-a603-11d0-96b1-00a0c91ece30 NTDS Backup Interface ncacn_np:\\\\MYSERVER[\\PIPE\\lsass] UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface ncacn_ip_tcp:169.254.12.191[1030] UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface ncadg_ip_udp:169.254.12.191[1032] UUID: 12345678-1234-abcd-ef00-01234567cffb ncacn_np:\\\\MYSERVER[\\PIPE\\lsass] UUID: 12345678-1234-abcd-ef00-01234567cffb ncacn_np:\\\\MYSERVER[\\PIPE\\POLICYAGENT] Total endpoints found: 6 ==== End of RPC Endpoint Mapper query response ==== UDP port 135 is LISTENING portqry -n myserver -p UDP -e 53 • Verifies DNS query and response operation UDP port 53 (domain service): LISTENING or FILTERED Sending DNS query to UDP port 53... UDP port 53 (domain service): LISTENING portqry -n MyMailServer -p TCP -e 25 • Returns SMTP, POP3, IMAP4 status messages TCP port 25 (SMTP service): LISTENING Data returned from the port: 220 MyMailServer.eu.reskit.com Microsoft ESMTP MAIL Service, Version: 5.0.2195.2966 ready at Sun, 2 Sep 2001 23:24:30 -0700 portqry -n MyFtpServer -p TCP -e 21 • Returns FTP status message and tests for anonymous account access 220 MyFtpServer Microsoft FTP Service (Version 5.0). 331 Anonymous access allowed, send identity (email name) as password. portqry -n myserver -p UDP -e 137 • Verifies NetBIOS Name Service functionality and returns MAC address UDP port 137 (netbios-ns service): LISTENING or FILTERED Attempting NETBIOS adapter status query to UDP port 137... Server's response: MAC address 00c04f7946f0 UDP port: LISTENING Query behavior configurable using local service file • Located in %systemroot%/system32/drivers/etc/servic e • Resolves service name using this file • Decides what type of query to send to port using this file References • http://www.tlc.discovery.com/convergence/hacker s/hackers.html • http://www.tuxedo.org/~esr/faqs/hackerhowto.html • http://www.iss.net/security_center/advice/Underg round/Hacking/Methods/Technical/ • http://www.infosecuritymag.com/articles/march01 /features4_battle_plans.shtml • http://www.nmrc.org/faqs/www/wsec09.html • http://www.microsoft.com/. Tim Rains • Technical Lead • Networking Team • Q310099, "Description of the Portqry.exe CommandLine Utility"