alcarparka.github.io/week6.html at master · alcarparka/alcarparka.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
<!DOCTYPE html>
<html>
<title>Defense Against the Dark Arts Page</title>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="https://www.w3schools.com/w3css/4/w3.css">
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Raleway">
<style>
body,h1,h2,h3,h4,h5 {font-family: "Raleway", sans-serif}
</style>
<body class="w3-light-grey">

<div class="w3-content" style="max-width:1400px">

<header class="w3-container w3-center w3-padding-32">
  <h1><b>Week 6 Write Up</b></h1>
  <p>Welcome to the page of <span class="w3-tag">Alexandra Carper</span></p>
</header>

<!-- Grid -->
<div class="w3-row">

<!-- Blog entries -->
<div class="w3-col l8 s12">
  <!-- Blog entry -->
  <hr>

  <!-- Blog entry -->
  <div class="w3-card-4 w3-margin w3-white">
    <div class="w3-container">
      <h3><b>Homework Write Up</b></h3>
    </div>

    <div class="w3-container">
      <p></p>

<div class="w3-container">
      <h5>Week 6 <span class="w3-opacity">August 4, 2019</span></h5>
    <p>The focus of this week’s lectures was network security. Network security is important for helping host-based protections, protecting from threats that come in from the network, and protecting against threats going out on the network. Network security ensures we can keep dangerous hosts and data out, creating a safe space, preventing exfiltration of critical data, and protecting hosts that lack internal protection. Threats that come in from the network include distributed denial of service attacks, where someone floods the network to the point where you can’t actually do any work, and attacks from the network, including a stack overflow or the notorious Morris Worm. Threats coming out of the network include worms, botnets, and theft of network resources. However, we cannot forget that CDs and USBs are also important vectors of attacks. </p>
<p>	At every layer of the protocols, there is a general rule whose application can lead to enormous benefits in robustness an interoperability. This rule is called the Robustness Principle, which was thought of by Jon Postell, the original editor of the Request For Comments, or the specifications for certain Internet protocols. The principle states “be liberal in what you accept, and conservative in what you send”, and it was used as an idea to build an internet that interconnects with software connecting with software. But being “liberal in what you accept” has allowed attackers to use old code to break into systems by methods such as character coding Unicode and the directory hierarchy, used to break out and access user files. There are several network-based protection strategies that are popular today to prevent attackers from gaining access. A few of these are positive policy, firewall/security zones, defense in depth, intrusion detection, honeynets/intrusion deception, quarantine, and reputation. </p>
<p>	Positive policy refers to the definition of what you expect or allow to happen, and other things that are suspicious are not permitted. This is otherwise called “whitelisting”, and it gives the defender an advantage: by allowing the use of internal conventions and choices, the attacker must play a guessing game with which addresses are valid, where the servers are, and what data is critical. This strategy limits the attack surface, which is the set of operations your network is willing to respond to. By limiting the attack surface, other kinds of protection become more effective, and there is less room to make mistakes in setting up the host properly. Positive policy can provide a hook for other trust mechanism, including identity, trust chaining, and hooking up to firewalls. Policy may detect a threat, but it does not name the threat. The main concept here is that by defining what you expect to happen, you can subtract the things that do not belong. </p>
<p>	Another strategy is using firewalls and security zones. The most common implementation of policy is to define zones in the network with policy between the zones. Once the network is divided into a series of security zones, the firewalls will let you define rules for what kind of interactions, or protocols, are supposed to appear. Firewalls are devices that sit between the zones and filter traffic for policy. Zones commonly used by firewalls are Internet, Extranet, DMZ (demilitarized zone, half inside and half outside the network), Intranet, Corporate, User Stations, Labs, and Data Centers. Firewalls are better for describing policy from IP address to IP address. Other devices similar to a firewall are web gateways and email gateways. Web gateways proxy web connections to apply policy. A proxy is a connection on both sides that is spliced together, seeing all the data from the original connection and regenerating data from the other side. A web gateway can be on premise or in the cloud, typically providing inspection of web content and general anti-malware analysis. An email gateway, on the other hand, proxies Simple Mail Transfer Protocol connections. Here, the customer sets the MK record to point at the gateway’s IP address and configures the mail server IP into the gateway. This allows you to put something in the middle, a Domain Name Service, with an MX record giving you an IP address, setting this as a gateway, and this gateway filters and sends you the rest of the data. Email gateways can also be on premise or in the cloud. The original mission of the email gateway was anti-spam with an amazing 99% accuracy, but file scanning for malware has become equally important. </p>
<p>	The next strategy under focus was Defense in Depth, which refers to layered defenses. With this concept, a good analogy is that of a castle under attack. The surrounding terrain, watch towers, moat, drawbridge, etc. make up the layers of defenses. When considering building a network, it is important to figure out what the security of the network is going to be, and it is safer in the long run if you have defense in depth. </p>
<p>	Intrusion Detection is a strategy that uses signatures and anomaly detection to detect attacks. Intrusion Protection Systems allow defenders to look for things you do not want to have happen and blacklist them. Intrusion detection is good at catching threats that are well understood; however, you may not know where all of your instances of something are. While intrusion detection gives you good information on attacks and allows virtual patching, it is generally not a good strategy for zero-day attacks, or unknown attacks generally found through looking at and analyzing code. It also throws a large number of false positives, looking for evidence that someone is running an attack tool or exploiting a vulnerability. This results from the great possibility that the script doing the testing is not perfect. </p>
<p>	Honeynets refers to the concept that anyone can catch flies in honey. With this strategy, attackers don’t know the structure of the network under attack, so we can devise a phony network to waste their time or deceive them. By using an unassigned internal address and applying sucker algorithms we can slow down the attacker by making them wait a long time receiving bytes. We can also create phony content for the attacker to download or look at, also wasting their time. The problem with this strategy is that it requires a lot of configuration per site with very specific information to make it work and not interfere with the regular network. </p>
<p>	A quarantine is the idea of placing hosts that misbehave into a quarantine area where they can’t infect anyone else. This is commonly deployed when the user enters a network, such as with airport wireless logins and Software Defined Networks. Firewalls often implement something like a quarantine with their blacklisting mechanism. The host’s behavior will usually indicate it is infected or the user is doing something wrong through reputation or policy violations. A limited quarantine is more effective for local hosts because users become dissatisfied if they are blacklisted, especially if they are doing nothing wrong. Reputation is a Big Data solution, or a solution in which the magnitude changes the value of the data. With reputation, we collect a list of bad things and good things, serving the list out from the Cloud. These things include IP addresses that were associated with malware or botnets, IP addresses of spammers, URLs that reference pages with scripting attacks, URL classification and categorization, files that come from known program releases, and files that come from known viruses, or tend to be included in viruses. McAfee GTI is a prominent example of this. However, issues with reputation include multi-function hosts, stale data, and once again, zero-day susceptibility. </p>
<p>	Network security technologies for detection include policy, passive capture, packet filtering, deep state inspection, crypto inspection, a proxy or gateway, vulnerability scanning, intrusion detection, static analysis, dynamic analysis, security information and event management, and reputation or Cloud data analysis. For example, deep stateful inspection involves looking at a packet stream and doing the same operations on it as the host, going down the protocol stack and seeing everything you can about the stream. The deeper into the packets you inspect, the more comprehensive you can make your policy. Network security products include firewalls, which have policy, packet filtering, deep stateful inspection, blocking traffic, modifying traffic to remove suspicious parts, translation, and routing, next-gen firewalls, which have all the capabilities of a firewall with the additions of app identification, crypto inspection, and intrusion detection, next-gen IPS, web gateways, email gateways, data loss prevention, identity management or authentication, and advanced threat detection. Network security technologies for protection, on the other hand, include policy, identity/trust, blocking traffic, modifying traffic to remove suspicious parts, transition, routing, encryption, and SIEM. Decomposed, a network security product such as IDS would include passive capture, deep stateful inspection, and intrusion detection. These products all have different combinations of protection and detection. </p>
<p>	One major concept in network security is Man In The Middle. Here, we have A and B and M is in the middle, intercepting and possibly changing messages. Examples of this include Address Resolution Protocol poisoning, which floods the network with ARP responses and fools hosts into thinking that the Internet gateway is at the attacker’s MAC address instead of the real one, and TCP hijacking. TCP hijacking involves injecting, deleting or changing data in a TCP stream. Attackers can use ARP poisoning as well to do TCP hijacking. An example of TCP hijacking is an SSL Renegotiate attack. In this attack the MITM intercepts the initial SSL handshake request, opens the SSL handshake to a destination and sends the initial request, followed by a renegotiation request, and the MITM lets the user request proceed as renegotiation. MITM can be use for good by terminating a TCP proxy or using an HTTP proxy to verify a destination against a list of “dangerous” hosts. It can also be used in mail proxies to prevent attackers from sending EXE files, or in an SSL MITM. </p>
<p>	There are various ways to detect certain kinds of MITMs. In the detection of the TCP MITM, the trick is to use a HMAC, which is a one-way function that takes a large number of bits and generates a smaller number of bits making inversion practically impossible. If each packet has a hash on it, the receiver can detect if the MITM changes the packet. The Crypto Hash is another way to detect MITMs. With this method, we pick a shared secret and add a SHA-256 of each message with a secret. We can chain packets, using a sequence number, or just chain the hashes. Now, the MITM changes to the middle of the stream are detectible, but we still have stream setup and end of stream protection to do. The shared secret method involves the example of Alice needing N2 secrets to talk with her associates, otherwise known as the N squared problem. The solution here is Public Key Cryptography, which involves a special kind of lock with one key to lock (public key) and another key to unlock (private key). The public key is known to everyone, while the private key is kept secret. One popular scheme is the Diffie-Hellman scheme, which involves taking public and private keys, combining them, and then taking the inversion combination, which results in the same secret. </p>
<p>	Understanding how to secure communications is very difficult, but TLS guarantees can be used as a stock solution. With TLS guarantees, the host you connect to has the private key of the server certificate. The DNS name of this host, stored in the server certificate resolves to the same IP address you connected to; however, these DNS requests can be spoofed with ARP poisoning. There are many other TLS guarantees, but there are flaws with most of them. TLS was well designed but an implement can still fail. This relates back to the Heartbleed vulnerability in 2014 that was simply caused by a missing bounds check. This vulnerability caused a rash of TLS patching, and any data on the server could have been compromised. This serves as an important lesson about separating data into different paths when needing to separate risks. </p>
<p>	Covert channels are hidden from traditional network control devices, and they leverage channels to transmit information that was not meant to do so. They are usually very low bandwidth and proxies are very good at stopping this at the root. This also relates to legitimate channel misuse, which includes hiding in plain sight, payload tunneling, overlapping IP segments, manipulating data at the end of the datagram or file, and steganography, or concealed messages within other messages. There are also policy holes and limitations, including the situation in which an old policy never expired even after its need became non-existent. IPv6 can be used in IPv4 tunnels, new and upcoming tunneling sometimes cannot be detected, and encrypted traffic sometimes cannot be Man in the Middle’d. Therefore, when you monitor a network to protect it, you must get as much depth of data as possible so you can determine what is happening by looking deep into the data and you must get as many different interactions as possible so you can notices the overarching patterns within the data that reveal the structure of the network. </p>
<p>	This segues perfectly into reconnaissance, which can be active or passive. In active reconnaissance, an attacker wants to attack vulnerable machines on the network, looking to see what machines are on the network, what ports they have open, and what services they have enabled. The attacker must find addresses for the services that can be attacked. The most basic tool in active reconnaissance is scanning, or trying to connect to many hosts and services, and NMAP is a common tools for this. The goal is to get the IP address and UDP/TCP port of service that you can attack. Simple scans include ping, TCP port scan, UDP scans, randomizing the order, and slow scans, which attackers do to avoid suspicion. A tool like NMAP can output the stat of the ports you are in, with “open” telling you if the port can respond to a normal request. Passive reconnaissance refers to an attacker being able to see data on the network through a wiring closet or ISP. The AT&T scandal with the NSA is a good example of passive reconnaissance. In this kind of reconnaissance, the attacker wants to learn about people, and it is generally illegal. Tapping ISPs, hiding equipment in wiring closets, or listening radio signals allows for the collection of data, and then the data must be enveloped. Content can include web pages, files, and emails, which can be gathered through something like the Wireshark export command. Wireshark is one tool that was used for the labs this week. With Wireshark we can see IP addresses, applying DNS and whois, FTP protocol, MAC addresses of the routers, and the packet sizes. This tool can be used for defenses, and it is a really valuable packet sniffer. Reconnaissance defenses also include policy and deep inspection, honeynets, and log-correlations to detect SIEM, IPS, and firewall. </p>
<p>	Spoofing is when an attacker masquerades as another network entity in order to gain some advantage over the network defenses of the target. A LAND attack is a DoS attack that relies on spoofing. This attack sends a TCP SIEM packet to the Windows machine using the same source and destination to kill the stack. LAND stands for Local Area Network DoS. IP and ARP spoofing are also used to perform MITM attacks, poisoning ARP databases to perform MITM. In predictive spoofing, the TCP connection resets, and it uses a TCP sequence number prediction to get through NATs, predicting what the next few packets will be. TCP sequence numbers, IP addresses, MAC addresses, email addresses, and HTTP fields can all be spoofed, but there are a number of defenses against spoofing. Most network security solutions perform some basic detections and defenses against spoofing, but there is also Reverse Path Filtering, which considers which route from the box you would take to send a packet out. If the normal conditions are not true, the packet is dropped. Ingress filtering also includes dropping packets from bogons, and egress filtering ensures that only packets that belong to appropriate internal networks are routed through. </p>
<p>	Denial of Service attacks are also a very common method of attacking a network. This attack is about consuming resources for an extended period of time such that a targeted service is degraded, sometimes to the point where it is unusable. With Distributed Denial of Service Attacks, asymmetrical resource utilization is most important for success. This attack leverages large numbers of computer to perform several resource exhaustion attacks against a target so that it is overwhelmed and unable to perform its function. Slow Loris, for example, tries to keep connections open for long periods of time, using up all the possible connections and making a system unavailable. Types of DoS attacks include network exhaustion, CPU exhaustion, memory exhaustion, storage exhaustion, application vulnerability exploitation, and other finite resources. Defenses against DoS include network traffic validation and cleansing by network products and traffic scrubbing centers, which are huge data centers that are used for high volume traffic, sending out only data that their customers would care about in the event of high-volume traffic. </p>
<p>	Bugs and backdoors can also be a significant problem in network security. Whereas backdoors are intentional, bugs are unintentional, but the threat of compromise is the same for both. Common bugs include built-in or default passwords that are not changed, susceptibility to nasty packets, protocol design bugs in which something like legacy features may still be enabled, and buffer overflow. Packet filtering is the first step toward protecting your network with clear network boundaries and segmentation. Filtering packets is a policy driven whitelisting method to allow only expected traffic to cross the network boundary. Packet filtering performs basic packet validation that includes defenses against segmentation, malformed packets and streams, and fragmentation attacks, which occur when the attacker sends a fragment just before your fragment that overwrites part of your data. Deep inspection adds inspection of the data portion of the packet in addition to the network headers. This inspection traces protocol headers, performs signature processing on content, and performs dictionary processing on content. </p>
<p>	But the basic limitation of basic packet filtering is that it cannot understand higher level applications and protocols and hence cannot easily shield internal endpoints from application level attacks. Proxies, on the other hand, can terminate TCP connections and establish new ones, inspect and sometimes modify application data to prevent attacks, and provide nuanced and granular access control based on application specific information. The con to proxies, however, is that they have lower performance compared to basic packet filtering. Some popular proxies include H.323, SIP, HTTP, FTP, and SMTP, but because FTP and SIP send actual IP addresses as part of their protocol, NAT must be applied by the proxy in these cases. </p>
<p>	Network Address Translation was proposed to allow multiple endpoints to share the same IP address. This makes it harder for an attacker to learn the network architecture because it hides local IP addresses. NAT temporarily maps a connections from a local private IP and port to a public IP address and port to be used on the public side of that communication. Basic types of NAT include static NAT, dynamic/masquerade NAT, NAT pools, and PAT, which is a port address translation mapping connections to a specific port on public IP to a specific local private IP and port. Theoretically, one could hide IP addresses behind the NAT since attackers could not probe it, but they actually can probe it using STUN or TURN protocols. </p>
<p>	NAT prevents you from connecting directly to a specific endpoint behind a NAT device. Simple Traversal of UDP through NAT uses an external STUN server to derive the mapping of the external port and IP address being used for their connection. Traversal Using Relay NAT, on the other hand, uses an intermediate server that relays messages to both parties behind NAT. This method works more in general, but it is also more resource intensive on the TURN server. </p>
<p>	IPSec is a security layer at the IP level that allows IP packets to be encrypted between two endpoints under a Security Association. When a network is constructed out of IPSec tunnels, it is called a Virtual Private Network, which should be familiar to most users today. IPSec is commonly deployed in tunnel mode, where complete IP packets are encapsulated inside the Authentication Header between the IP and the payload. Firewalls commonly provide the IPSec services, and it is common for firewall managers to have wizards to set up VPNs. IPS are important for the Network Intrusion Prevention System. IPS systems were required to catch the attack contained in data allowed by a firewall policy in early firewalls because not very much of the data was looked at. IPS systems could evaluate the packet data against known and unknown attacks. </p>
<p>	There are two IPS detection strategies that are important to network security: signature-based and anomaly-based. Signature-based watches for patterns of traffic or application data presumed to be malicious. The advantages of signature-based are that there are fewer false positives and it is faster to deploy and easier to understand behavior. The disadvantages are that it can only detect known attacks or variations and it requires constant updating with new signatures. Anomaly-based monitors network traffic for application content presumed to be different from “normal” patterns. Knowledge of these patterns is based on trends from long-term monitoring. The advantage of anomaly-based is that it has the potential to detect hitherto unknown attacks, but unfortunately it often produces a comparatively higher number of false positives because of the unpredictable nature of users and networks. It also often requires extensive training sets of system event records to characterize normal behavior patterns. </p>
<p>	Software Defined Networks emerged out of the need for researchers to develop an experimental network without losing access to their email. Therefore, they figured out how to reprogram a switch remotely using the OpenFlow protocol so they could keep the old network and experiment on it. This idea is gaining traction in the present world. While a normal switch has existing flows that are forwarded by the interface hardware based on flow tables, processing new flows by embedded control logic according to standard algorithms, the OpenFlow SDN processes existing flows using the switch and processes new flows by the OpenFlow Controller, connecting the two with the OpenFlow protocol. </p>
	    Screenshots from the materials this week, as well as the firewall exercise, are included in the following zip file: <a href="/Screenshots6.zip" download>Screenshots Week 6</a></p>
    </div>
  </div>
</div>
<div class="w3-col l4">
  <div class="w3-card w3-margin w3-margin-top">
    <div class="w3-container w3-white">
      <h4><b>Alexandra Carper</b></h4>
      <p>This page was created for Weekly Writeups for Defense Against the Dark Arts</p>
    </div>
  </div>


</div>

</div><br>

</div>

<footer>
</footer>

</body>
</html>