Concepts in Network Security: LTC Ronald Dodge, Ph.D. United States Military Academy doc

Concepts in Network Security... Trends in Network Security... Trends: Another PictureHigh Low Intruder Knowledge Attack Sophistication self-replicating code password guessing password cr

Concepts in Network Security

Trends in Network Security

Trends: Another Picture

High

Low

Intruder Knowledge

Attack Sophistication

self-replicating code password guessing

password cracking exploiting known vulnerabilities burglaries

session high jacking

burglaries

BOTnets

www attacks sweepers

automated probes GUI interfaces

network diagnostics backdoors

disabling audits

cross site scripting

distributed attacks denial of service

packet spoofing

2

Also Convenience Usability

Assumes Fixed Cost

ƒ Motivation

ƒ Virtual Information Assurance Network (VIAN) introduction

ƒ Viruses, Worms and Trojans – Oh My!

ƒ (And don’t forget about SPAM)

USMA VIAN

ƒ Virtual network design

presents students with two internal networks separated

The VMware virtualization layer sites between the hardware and software and allows users to create virtual machines that are the full equivalent of a standard x86 machine

Intel Architecture with VMware

How Does VMware Workstation Work?

USMA VIAN Configuration

ƒ VMware license: Academic $130 each

ƒ OS licenses

ƒ Solaris: $20

ƒ MSDNAA: Deeply discounted

ƒ Applications: Most all open source

ƒ Hardware

ƒ P4 1.8GhZ, 1 GB RAM (512), 60 GB HD

USMA VIAN Operating Systems

ƒ Windows 2003 (all versions)

USMA VIAN Modules

in the Middle

detection using SNORT

detection with monitors

and using virtual machines

and network fundamentals

Viruses, Worms and Trojans – Oh My!

HACKER Pre-test

ƒ Can you read this?

ƒ T1hs iz da h0m3p4g3 0f d4 m0St l33T w4r3z gR0uP th3r3

iz, LWE! W3 f0cUs oN bRiNgIng j0 dA l4t3eSt 0-dAy 313373

w4r3z év3rydAy J0 c4n f1nd aLl 0ur r3l3ases 0n ThIs l33t p4ge!! Ph34r 0ur sKiLlz!!

H4x0r Language Homework

www.google.com

->preferences

Example Malicious Program Types

Hacking, Step-by-Step

ƒ Well, this ain't exactly for beginners, but it'll have to do What all hackers have to know

is that there are 4 steps in hacking

ƒ Step 1: Getting access to site

ƒ Step 2: Hacking r00t

ƒ Step 3: Covering your traces

ƒ Step 4: Keeping that account

http://forbidden.net-security.org/txt/beginner.txt

ƒ Scanning

ƒ A method for discovering exploitable communication channels The idea is to probe as many listeners as possible, and keep track of the ones that are

receptive or useful to your particular need

ƒ SuperScan – NMAP – Nessus

ƒ CORE Impact – Metasploit – WHAX 3.0

(a.k.a WHOPPIX)

ƒ Sniffing

ƒ A packet sniffer is a wire-tap devices that plugs into computer networks and eavesdrops on the network traffic A “sniffing” program lets

someone listen in on computer conversations

ƒ Ethereal FTP/SFTP Demo

ƒ IIS buffer overflow

ƒ DCOM

ƒ Maintain access

ƒ Patch

ƒ Install backdoor

ƒ USMA IWAR and VIAN

ƒ Web: http://www.itoc.usma.edu

ƒ E-mail: itoc@usma.edu