SysSec 7
SysSec 7
Network Security
Network Security
Overview
Reconnaissance: discovering topology and servers Using network tools
Fingerprinting Offensive
Man In The Middle attacks, Bugs, Attacks on routing Bypassing network restrictions,
Network Reconnaissance
Reconnaissance
Network reconnaissance is always a first step
Nmap, Hping2 Netcat
Understanding open/filtered ports
What services are running
Reconnaissance
Network reconnaissance is always a first step
Public databases always a good start
whois iseclab.org
dig iseclab.org
whois 128.130.60.29
Zone transfers ? If very lucky:
dig axfr ZoneTransfer.me @ns16.zoneedit.com.
Reconnaissance
Robtex : the Internet swiss army knife
GeoIP: approximate physical location of an IP address More accurate solutions exist
Finger directory service to provide information about users Almost not used anymore
Scanning
Basics : Send TCP Syn packet
Closed port: reply with a RST Open port: reply with Syn/Ack
Filtered port: nothing back or ICMP error packet
nmap -A -T4 scanme.nmap.org
Smarter techniques :
OS Detection Idle Scan
Idle Scan
2 main purposes: Stealth Reconnaissance
Port may be blocked for you on server
Maybe not for the zombie?
Scanning for vulnerabilities directly
Nessus / OpenVAS
Has a list of test for discovering daemon type, version,
kind of service, options set etc
Has a list of vulnerabilities associated
Will check that automatically and generate reports
Client/server side can be programmed to run
regularly
Useful for
Network administrators to check for vulnerabilities on
the network
Routing AS etc...
Internet is a set of Autonomous Systems (AS)
e.g. Renater, France Telecom, Proxad (free)
They are interconnected by links between their routers BGP is the protocol that is used to know on which links
to send packets depending on their destination
Some of the BGP/AS information is publicly
available
Whois records Looking glass
Network Attacks
Denial of Service Attacks
DoS is an attack that aims at disrupting a service such that none of the
customers can enjoy the services
The consequence of flooding or vulnerability attacks
Flooding : an attack that consumes the application resources at such a
rate that the service becomes unresponsive
In a vulnerability attack, a vulnerability cause the application to crash or
go to an infinite loop
How common is DoS? Answer: Very common
Research showed ~4,000 reported attacks in a week
(and most attacks go unreported)
How likely are you to be victim of DoS?
A report showed 25% of large companies suffer DoS attacks at some
Denial of Service Attacks
DDoS Distributed Denial of Service
Attacking machines are called daemons, slaves,
zombies or agents.
Zombies are usually poorly secured machines that are exploited
Machines that control and command the zombies are called masters
or handlers.
Attacker would like to hide trace: He hides himself
Denial of Service Amplification
A DoS attacker may look for
Network reflectors:
To hide source of the attack Prevent blocking it
e.g. ICMP reply to forged source address
Network “amplifiers”
To perform efficient DoS
Find a service that replies N packets when 1 packet is sent with forged source
Denial of Service Amplification
Examples
SYN flood
with forged source address
“Smurf” attack :
e.g. send a ping packet to a broadcast address
(x.x.x.255)
DNS can generate many requests when the
server is asked about a record not in cache DNSSec packets much larger
Web applications are particularly susceptible to denial of
service attacks
A web application can’t easily tell the difference between an attack and ordinary traffic
Because there is no reliable way to tell from whom an HTTP request is coming from, it is very difficult to filter out
malicious traffic. Slashdotted effect
Most web servers can handle several hundred concurrent users under normal use, but a single attacker can still
generate enough traffic from a single host to swamp many applications
Defending against denial of service attacks is difficult and
only a small number of “limited” solutions exist
Research has shown that the majority of attacks are
launched by script-kiddies
Such attacks are “easier” to detect and defend against Kids use readily available tools to attack
E.g. LOIC tool
Some DoS attacks, however, are highly sophisticated and
very difficult to defend against
Denial of Service Attacks:
Defenses IP layer
Drop IP connections from a list of IP addresses, Put in list those that send too many Syn
Firewall : rate limiting, broadcast packets...
Reroute BGP to a provider with lots of bandwidth; e.g.
Spamhaus Event:
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
Denial of Service Attacks:
Defenses HTTP layer
Change the DNS to a CDN (Content Distribution Network) With a lot of bandwidth
Caches HTTP requests
Applies filtering rules (OWASP) e.g., Akamai:
http://www.akamai.com/html/solutions/site_defender.ht ml
Limit complex requests in complexity
Denial of Service Attacks:
Other Defenses
Use a CAPTCHA if a human is expected to interact
But they are annoying and not that hard to guess by machines after
all …
Use a Cryptographic Puzzle :
Some challenges are slow to compute by the client fast but to
verify by the Server
Sent by the server to the client before handling any further request Not very efficient against DDoS
Make sure your hosts are patched against DoS vulnerabilities Anomaly detection and behavioral models
Ingress filtering
TCP connection-hijacking
A bit “old-school” Was used by Kevin Mitnick in 1995 … Attack on RSH to gain access on a server With control of a computer on the network
Principle of the attack:
Impersonate a computer with IP spoofing TCP sequence number guessing
to send packets while ignoring responses
DoS the spoofed machine
TCP connection-hijacking: RSH
Remote Shell
“Ancestor” of SSH
Can be configured to allow/deny connection based on:
Remote username IP address
No crypto in place... but hijacking an IP address is not easy.
TCP connection-hijacking:
TCP 3-way handshake
TCP connection-hijacking:
TCP Syn-flooding
Server keeps a state for each opening connection in
a buffer
This buffer has a limited size
SYN
SYN/ACK
TCP connection-hijacking:
IP Spoofing
Sending packets with spoofed IP address is as
simple as forging source IP in a crafted packet
Usually requires root (raw socket) MAC / IP address forging
May be blocked by the switch / ISP Called “Ingress filtering”
Packets with forged IP address
Easy to send
But no response received …
IP address spoofing
Can be used directly to exploit stateless protocols
e.g., based only on UDP
But on TCP how do we perform the 3-way
handshake ?
We don't receive the response packets
As we don't control the return path...
How to guess the seq nr / prevent spoofed host to
Mitnick attack
DoS Server
Send packets to target guessing sequence numbers
If guess is OK packets are accepted
Replies will go to server
Not seen by attacker
Server DoS'ed will not send an error msg
Used to send command over RSH
echo + + >>/.rhosts
ARP Poisoning
ARP is a protocol to map MAC address to IP address on Ethernet: Who has <IP> ?
<IP> is at <mac>
Needed to know where to send IP packets over Ethernet
This can be abused to inject a wrong MAC address <=> IP address
association
Source routing
The route taken by TCP/IP packets is determined by
router's routing tables
Source routing allows to bypass this
Specify the path that packets should take
E.g., Authorized host can specify path
Auth host → A → C → D → Server Auth host → A → B → D → Server
Source routing
This allows an attacker to
Discover network
Have its packets go trough a specific network path
Bypass IP address rules (TCP wrappers …)
Access computers behind a NAT / private address space
DNS
Domain Name Service
Maps host names to IP addresses on the Internet Makes Internet more “user friendly”
A distributed system
Root servers are at fixed IP
The “hints” file
http://www.internic.net/zones/named.root
They provide IP addresses of TLD servers
Top Level Domains (.com, .net, .org …) DNS servers
provide IP addresses for domains
DNS
Their security is very important
Integrity of DNS responses
www.bank.com
SSL certificates certifies hostnames not IP addresses
Availability
No DNS no Internet :(
Scalability
Recursive DNS Requests
Record obtained from DNS architecture the first time
Will remain in cache until TTL timeout
Kaminsky Attack I
2007 Dan Kaminsky found a serious issue
Almost all DNS servers implementations were
vulnerable to cache poisoning
Allow to insert malicious information in a cache
server
Attacker controlled “glue records”
Cache poisoning attacks
How do we know the response received is actually
received as a reply to a query ?
Rely on transaction serial number
Normal DNS Request
DNS Cache poisoning
Query ID can be guessed... Solution ?
So they should be random ?
… with good random number generators!
Randomize the Query ID
16-bit field 64k possibilities
An attacker has large chances to fail
Glue records
There is a chicken and Egg problem in the DNS
System, e.g.:
Q: Who is the NS for domain.com ? R: ns.domain.com
We need a Glue record
Glue records are used when name server is a host of that
domain and provide IP address
Q: Who is the NS for domain.com ?
Kaminsky Attack
Glue records are cached as well,
What if we poison a glue record?
Completely owns the domain, can forge any hostname
of that domain.
Query ID randomization?
A failed attempt is not a problem, so we can try many
DNS cache poisoning
Very damaging attacks, Mitigations:
Cache servers should not face the Internet
e.g. not be at the same time a cache server and an
authoritative server for a domain
Randomize :
Query ID Source port
Host name capitalization
The Border Gateway Protocol ::
The art of building the Internet
The Internet is divided into thousands of smaller
networks called Autonomous Systems (ASes)
administered by a single entity (e.g., an Internet Service Provider, a company, a university)
AS2
AS3
AS5 AS1
The Border Gateway Protocol ::
The art of building the Internet
Each AS “owns” or is responsible for managing a
set of network IP addresses (e.g., AS3 is responsible for the IP address block 2.2.0.0/16)
5.0.0.0/8 45.54.0.0/16 45.55.0.0/16 15.1.2.0/24 2.2.0.0/16 AS2 AS3 AS5 AS1 AS4 1.1.0.0/16 1.2.0.0/16
The Border Gateway Protocol ::
The art of building the Internet
The Border Gateway Protocol (BGP) allows ASes to
interconnect with each other by exchanging network IP address block reachability information
BGP glues ASes together to form the Internet
5.0.0.0/8 2.2.0.0/16 45.54.0.0/16 45.55.0.0/16 15.1.2.0/24 AS2 AS5 1.1.0.0/16 1.2.0.0/16 physical link AS3 AS1 AS4
The Border Gateway Protocol ::
The art of building the Internet
The Border Gateway Protocol (BGP) allows ASes to
interconnect with each other by exchanging network IP address block reachability information
BGP glues ASes together to form the Internet
5.0.0.0/8 2.2.0.0/16 45.54.0.0/16 45.55.0.0/16 15.1.2.0/24 AS2 AS3 AS5 AS1 AS4
AS3 to AS1,AS4: “I am AS3 and I am responsible for 2.2.0.0/16!” 1.1.0.0/16
1.2.0.0/16
The Border Gateway Protocol ::
The art of building the Internet
The Border Gateway Protocol (BGP) allows ASes to
interconnect with each other by exchanging network IP address block reachability information
BGP glues ASes together to form the Internet
5.0.0.0/8 2.2.0.0/16 45.54.0.0/16 45.55.0.0/16 15.1.2.0/24 AS2 AS3 AS5 AS1 AS4 1.1.0.0/16 1.2.0.0/16
AS1 to AS2: “AS3 told me he is responsible for 2.2.0.0/16!”
AS4 to AS2,AS5: “AS3 told me he is responsible for 2.2.0.0/16!”
The Border Gateway Protocol ::
The art of building the Internet
The Border Gateway Protocol (BGP) allows ASes to
interconnect with each other by exchanging network IP address block reachability information
BGP glues ASes together to form the Internet
5.0.0.0/8 2.2.0.0/16 45.54.0.0/16 45.55.0.0/16 15.1.2.0/24 AS2 AS5 AS1 1.1.0.0/16 1.2.0.0/16 AS3 AS4
The Border Gateway Protocol ::
The art of building the Internet
BGP messages record the path of ASes they go
through to avoid routing loops
Network: 192.92.94.0/24 AS path : AS35289 AS5466 Eircom Ltd AS5466 Eircom Ltd AS35289 Symantec Ltd AS35289 Symantec Ltd 192.92.94.0/24 INTERNET INTERNET AS702 Verizon AS702 Verizon Network: 192.92.94.0/24
AS path : AS5466,AS35289 Network: 192.92.94.0/24AS path : AS702,AS35289
Network: 192.92.94.0/24
AS path : AS35289 BGP message
The Border Gateway Protocol ::
The art of building the Internet
Inter-AS links reflect the business relationships
between their respective owner (e.g., some provide transit connectivity to the Internet to their
customers) AS5466 Eircom Ltd AS5466 Eircom Ltd AS35289 Symantec Ltd AS35289 Symantec Ltd INTERNET INTERNET AS702 Verizon AS702 Verizon
(UPSTREAM) TRANSIT
PROVIDERS
CUSTOMER
BGP hijacking ::
The art of breaking the Internet
CAUSES
The injection of erroneous network reachability information into BGP Trust-based exchange of network reachability information
No widely deployed security mechanism yet
EFFECTS
Blackhole (e.g., Youtube hijack by Pakistan Telecom) Impersonation (e.g., Spamhaus hijack)
MITM (e.g., BGP MITM [1]) of the victim network
EXPLANATIONS
Router misconfiguration, operational fault (e.g., AS7007 incident [2]) Malicious intent?
BGP hijack incidents that made the headlines
RENESYS
1,500 MITM (TRAFFIC
BGP hijack incidents that made the headlines
ISC
SEVERAL BANKS
TARGETED BY
BGP HIJACKS
RENESYS
1,500 MITM (TRAFFIC
INTERCEPTION) HIJACKS IN 2013
BGP hijack incidents that made the headlines
ISC
SEVERAL BANKS
TARGETED BY
BGP HIJACKS
BGPmon.net
BGP HIJACK ATTACK
AGAINST ANTI-SPAM
COMPANY
“SPAMHAUS”
RENESYS
1,500 MITM (TRAFFIC
INTERCEPTION) HIJACKS IN 2013
BGP hijack incidents that made the headlines
?
BENIGN!
BGP hijacks ::
Separate the wheat from the chaff
Identifying BGP hijacks is challenging
BGP hijacks look similar to some legitimate BGP engineering practices
lack of ground truth information, only the owner of a
network can precisely diagnose routing events related to his network
Case I :: BGP blackhole
AS5466 Eircom Ltd AS5466 Eircom Ltd 192.92.94.0/24 AS702 Verizon AS702 Verizon ASX iSpam Inc ASXiSpam Inc Symantec LtdSymantec LtdAS35289AS35289
INTERNET
INTERNET
Network: 192.92.94.0/25
Network: 192.92.94.128/25
AS path : ASX,AS35289
SYMANTEC
NETWORK IS
BLACKHOLED
BGP message
DoS of the victim network
similar to Youtube hijack
Case II : BGP impersonation
Fly-by spammers
CONJECTURE
Spammers would use BGP hijacking to send spam from the stolen IP space and evade spam sender blacklists
“BGP spectrum agility”: short-lived (< 1 day) spam networks [3]
POTENTIAL EFFECTS
Misattribute attacks launched from hijacked networks due to hijackers stealing IP identity
Spam filters heavily rely on IP reputation as a first layer of defense
Fly-by spammers :: Hijack signature
Hijacked networks
are dormant IP address blocks, i.e., by the time the
networks are hijacked they have been left unadvertised
by their owner
advertised for a rather short period of time
AS hijack: prefix is advertised in BGP from an
apparently legitimate AS but via a presumably
illegitimate upstream provider AS
Prefix hijack: prefix is advertised in BGP from an
apparently rogue AS but via a presumably
Fly-by spammers :: AS hijack illustration
ASX iSpam Inc ASX iSpam Inc ASY Owner of A.B.C.0/24 ASY Owner of A.B.C.0/24 INTERNET INTERNET Network: A.B.C.D/E AS path : ASX,ASYILLEGITIMATE
(UPSTREAM)
TRANSIT
PROVIDER AS
LEGITIMATE AS
spam spam A.B.C.1…A.B.C.255Fly-by spammers :: case study
IP prefixes are only announced when spam is received!
Few blacklisted spam sources at the time of the BGP
Case III :: BGP Man-In-The-Middle
Step 1: discover path between AS_Mallory (attacker) and AS_Alice (victim)
AS_MalloryAS_DAS_AAS_Alice
Step 2: advertise more specific prefix 66.102.0.0/24 and secure backup route (P)
Securing BGP?
Security extensions to BGP
e.g., RPKI, ROVER
Similar to DNSSEC for DNS Deployment is expansive
BGP monitoring
Analyze BGP updates and trigger alarm upon abnormal
routing change, e.g., BGP hijack
e.g., BGPmon.net, Renesys (Dyn), UCLA Cyclops
BGP “best current practices”
e.g., Customer routes filtering
Conclusion
Network attack and defense Can be surprisingly easy
Many countermeasures known already
And many are in place on most networks
Still some very difficult attacks to solve and countermeasures to deploy
DoS
