Tài liệu Intrusion Detection The Big Picture – Part IV pdf

Trang 2

Intrusion Detection Roadmap What are the pieces and how they play together

• Honeypots

• Firewalls

– Proxy, State Aware, Filtering Routers

• Risk Assessment and Auditing

– Introduction to Risk Management

– Knowledge-Based Risk Assessment

– Online Auditing Tools

As we begin our next section, we are going to cover a really interesting technology The timing of

this is really interesting I am poring over 30 MB of logs from Lance Spitzner’s honeypot system

We have logs of hackers bragging about their conquests; trading stolen credit card numbers,

passwords and IDs for compromised systems; the list continues If you want more details on the

approach Lance uses, try: http://www.enteract.com/~lspitz/honeypot.html

A honeypot can be a tool and process that is used to capture the tools, plans, and techniques of

attackers, or it can be as simple as a decoy tool that is used to deflect attackers from a compromised

system or a system under fire A third good use of a honeypot is a sensor - if you have an old, slow

system lying around, it can serve a productive life as a honeypot In fact, that may be ideal! There is

one important rule of a honeypot: try to engineer it so that it collects information, but it is not used to

attack anyone else An old 75Mhz Pentium limits the harm that could be caused if the sandbox is

breached

Trang 3

Honeypots

• What are they?

• Example honeypots: Lance, TIS

Toolkit, DTK

• Why you might choose to run them

• Why you want others to run them

Thanks to Tim Aldrich and Lance Spitzner for their

research into honeypots!

There are a number of technologies that can be used for a honeypot and everyone has a strong

opinion about their approach Obviously the more sophisticated attackers are only going to be fooled

by an operating system that exactly mirrors what they expect and this includes when they

“compromise” it, the system must fail correctly

The only honeypot that will work at that level of fidelity is a an operating system itself; this is the

approach Lance uses This is a very advanced and dangerous technique, since the system can easily

be used to attack others To make his system work, he relies on multiple layers of monitoring and has

modified the syslog facility to do a lot of logging, but not in a way attackers will notice He has also

modified the operating system shell to log commands to the syslog facility and then monitors

everything with a Snort IDS Still, when he published his work, the attackers figured out they had

been had and laid waste to the system This is evidence a few more safety measures would be a good

thing!

Trang 4

Honeypots

• What are they?

– A trap - they run real services on a

sacrificial computer or simulated instrumented services, (or fake a core dump)

– TIS Toolkit smap example

So, are there safer alternatives? Network Associates sells a commercial honeypot (CyberSting) that

stands up to a fair amount of scrutiny We will talk about DTK in some depth I have had good

success with the free firewall code that was written by Marcus Ranum and has gone by various

names, but was classically known as the TIS toolkit How would a proxy firewall work as a

honeypot?

To use an attack against sendmail as an example, the toolkit had a sendmail replacement called

“smap” Smap would take any file that was sent to it and write it into a directory on the system

Then a separate program takes the file and delivers it This meant that I could simply place this mail

system up and examine the files for malicious one Since there were no real users, most of the mail

was either SPAM (a product of Hormel foods) or malicious code I would check it once a month or

so and see what the pot would catch The beauty of this approach is that it meets the important rule of

honeypots: smap is a small easily understood program that is not going to suffer a buffer overflow

Trang 5

What are they?

• A decoy - if a machine becomes

“hot”, change the IP address and

name and put in a honeypot

• DNS, Mail, Web servers make great

honeypots on their unused ports

Attackers will not succeed in being able to crack it to attack other systems Of course, smap is not

sendmail and just changing the banner from “smap” to “sendmail” will not fool the wise attacker

The higher the fidelity of the honeypot, the greater the risk

Where do you put a honeypot, how do you make it effective? Well to be sure, every IP address gets

attacked - ask any cablemodem user However, there are things you can do to optimize performance

Perhaps the most effective honeypots are machines that have become “hot” In such a case, it is a

good idea to move that machine to a new name and IP address, (think “witness protection program”),

and deploy a honeypot on that system’s address

Domain servers, mail servers and web servers’ non-service ports make a great place to put honeypot

code

Trang 6

Deception Tool Kit (DTK)

• What is it?

• A Perl script that executes state machine

scripts on specified ports, C binaries for

telnetd, web

– Includes state machine scripts for ports:

• 0, systat(11), qotd(17), chargen(19), ftp (21), telnet(23), smtp(25), time(37), domain(53), 65, 66, tftp(69), finger (79), http (80), pop-3(110), 365, 507, 508, exec (512), login (513), shell (514), 893, nfs (2049), 5999, 6001, 8000, 10000,

12000, 12345, 12346, 14000, 28000, 31337

The Deception Tool Kit (DTK) was created by Fred Cohen, one of the most brilliant and well-loved

individuals on the Internet (one out of two ain’t bad), and was available for free with a funky license

at www.all.net/dtk/

There are DTK groupies that can make this code sing, but we want to learn from the architecture of

this tool to understand the processes a honeypot needs to go through

On the next slide we see that DTK makes use of port 365 If you query a DTK on port 365, it will

tell you it is a DTK If a substantial number of people ran honeypots such as DTK, and a substantial

people who DIDN’T ran the port 365 service, it would increase the price of hacking I am sorry to

report that after extensive study of thousands upon thousands of network traces, I have not seen this

in action

In the notes pages of the next slide, take a minute to look over the logs This is nice high fidelity

information about what the attackers are attempting

Trang 7

• May confuse the hackers in the short term.

• Can also be used to access /dtk/log with password

– Can time-tag and log every typed command.

– Can email notification of break in.

• Example detect in notes pages

JUNE 1999 Also from the latest DTK logs

'1', 'listen.pl', 'S', 'RPeace-Peace', '/bin/uname -a;/usr/bin/id;echo

'moof::0:0::/:/bin/bash' >>/etc/passwd;rm -rf /etc/securetty;exit;'

Trang 8

DTK

• Sample state machine script:

# State Input NexStat Exit lf/file output/filename

What is a state machine? If you meet the condition at the first state, you can transition to the next

Please take a minute to read the slide

State 0 is initiated with someone makes contact with the system on TCP port 23, telnet with an active

open, or the SYN flag is set The system responds with “login” If the answer is either guest or root,

the system moves to State 1

In State 1 it offers “Password” and if the password matches the list with root or guest spelled

backwards, the system “logs them in” and gives them a prompt We move to State 2

Here we are looking for one of the operating system commands off the list: ls, df, pwd As you can

see, an attacker will quickly discover this is not a real system However, it is fine to collect

information about script based attacks

Trang 9

128.38.330.25 1063 110 1998/07/13 11:00:46 31394 176:2 listen.pl S0 USER taldric^M

128.38.330.25 1063 110 1998/07/13 11:00:53 31394 176:2 listen.pl S0 PASS taldric^M

128.38.330.25 1063 110 1998/07/13 11:01:02 31394 176:2 listen.pl S0 USER taldric^M

128.38.330.25 1063 110 1998/07/13 11:01:09 31394 176:2 listen.pl S0 PASS toor^M

128.38.330.25 1063 110 1998/07/13 11:01:11 31394 176:2 listen.pl S0 ^M

128.38.330.25 1063 110 1998/07/13 11:01:13 31394 176:2 listen.pl S0 ^M

128.38.330.25 1063 110 1998/07/13 11:01:15 31394 176:2 listen.pl S0 QUIT^M

128.38.330.25 1063 110 1998/07/13 11:01:15 31394 176:2 listen.pl S0 WeClose

This slide shows the result of running DTK This serves as a sensor and has a lot of value If

someone has sniffed a password or obtained it by other measures, the honeypot allows you to see that

it is in use

Most organizations have no or minimal logging internally, so this is one way you can know

something is wrong

Trang 10

DTK

• Recommendation:

– A good tool available for honeypot use today.

– Can use inetd to start DTK, but listen.pl provides

better logging.

• Problems:

– Relies on non-portable assumptions.

– Yet another log file to check.

– Yet another log file format.

The bottom line on DTK is that it is in use and organizations are getting good results from it On

Unix computers, the Internet Daemon, or inetd, listens for incoming connections and “wakes up” the

appropriate daemon if the system offers that service For instance, the telnet daemon is not always

running Instead, when the system receives a packet with the SYN flag set and destination port 23

(the well-known address for telnet), inetd wakes up telnetd to service the connection DTK prefers to

run all the time, which is a shade wasteful of CPU and memory, but not too bad

The bigger problems are shown below DTK can be a bear to configure, and nobody on the mailing

list has proven to be too friendly In addition, the issue of checking another log is not minor The

approach used by Lance to modify the Unix System Logger (syslog) facility allows him to collect a

lot of data in a single place and as busy as we all are, this has a lot of advantages

Trang 11

DTK

• Able to simulate all/any services

– Looks and acts like the real thing

– No indication that it is simulated

– Low CPU/disk overhead

• Will not provide any “real” services

– As it becomes more complex, risk increases

• Easily customized for each machine

The telnetd and the web demon are “real” They are compiled C code They simply simulate the

services This could be important, since they might be vulnerable to a buffer overflow or similar

attack

That said, on the main DTK is unlikely to be compromised and then the honeypot would be used to

attack other people

Trang 12

DTK

• Log, with timestamp, every keystroke

• Able to simulate complex binary protocols

• Capable of file transfers

• Indicate the hit as it happens

– Email

– Console message

– Call to your pager

– Log files

You can use the way people type on keyboards as a biometric indicator People make the same

mistakes, for instance I tend to type “telent” instead of telnet Honeypots allow us to establish the

method of operations (MO) of an attacker

The ability of attackers to remain anonymous on the Internet is a huge problem for law enforcement

A good honeypot trace can act as supporting evidence that a particular attacker is the same as one

seen somewhere else For instance, if a lot of damage was done against one facility, and a honeypot

kept the attacker occupied long enough to trace them, or if they made a mistake, their unique typing

patterns, word use and so forth *might* be enough to tie them to the crime

Trang 13

Large Scale Deception

Rig DTK to listen to all of the IP addresses in the class C address range

Add 253 entries to the /etc/sysconfig/network-scripts directory - here's a script

A number of the emerging honeypot technologies can simulate a number of systems In this case,

DTK is being configured as an entire network

A firewall product (Raptor) does this in an interesting way If it receives a SYN packet to an IP

address it is protecting, it can forge the proper response, a SYN/ACK, even if the protected host does

not exist or exists and doesn’t offer that service The attacker will then complete the connection and

begin the attack, which can be recorded That is the end of the show however - at this point the

firewall aborts the connection However, I have managed to collect a lot of useful information from

just these few packets

Trang 14

No valuable content gets sent until the handshake

is complete Filtering routers and firewalls block on

at least the SYN packet, ergo no content.

Can you name a situation where you might really

want to know the content of the TCP conversation?

In this slide we see the steps that are required to complete a TCP connection Take a minute and

think about the question on the bottom of the slide Many times we just want to block the traffic and

not even think about it However there might be situations where you would really want to see what

the traffic is, they include:

• The example we discussed when an actual userid or login and password is being used In this case

we want to know the attacker’s intentions and how much they know

• When we see a particular system is the focus of lots of probes This can happen for a number of

reasons, we had a researcher give out the name and IP address of a research system when I worked

for the Navy, and for the next three years probes came from all over the world trying to find this

system I moved it and put a honeypot in its place

• When we think a new attack or technique is being used This would allow us to gain information

about what is being done

Trang 15

Why you might choose to run a honeypot to gain information

Firewall

The firewall, properly configured, stops this

attack That’s good But, you can’t learn anything

about the attack, (if it is TCP), and that might be

bad.

Firewalls impact network traffic In the slide above, the packet is addressed to TCP port 143, the

IMAP service If the site does not allow IMAP through the firewall, then there will never be a

SYN/ACK response, the TCP three way handshake will not complete and we never know the

attacker’s precise technique or intentions

If we place a honeypot outside the firewall or allow the traffic through the firewall to the honeypot

on an isolated network, we can collect information as to what the attacker is trying to do

Trang 16

Why you want others to run them

• Remember port 365?

• Name servers, mail servers, and web

servers draw the most fire on the

Internet What if they had their

non-service ports instrumented?

• The end result could be to slow down

the pace of attacks and increase

arrests.

There are a number of reasons that you might want others to run honeypots! When we discussed

port 365, think about the implications if everyone ran a tag on port 365 This would make life harder

for attackers, honeypots would answer and say they were honeypots and non-honeypots would

answer and they would say they were honeypots

This example illustrates why honeypots, if widely deployed, improve security Currently, the

paradigm in general is when the attackers break in to a system, it really is a compromised system

They are very bold and free with what they do The honeypots deployed by Lance illustrate just how

effective this is, because the attackers assume no one can monitor them If there were another couple

hundred honeypots, then the attackers would have to start slowing down and being more careful and

several of them would end up being arrested In the next section of the course, we will discuss

Firewalls These are not only the primary defense tool, they are one of the most important intrusion

detection sensors on the Internet

Trang 17

Intrusion Detection Roadmap What are the pieces and how they play together

• Honeypots

• Firewalls

– Proxy, State Aware, Filtering Routers

• Risk Assessment and Auditing

– Introduction to Risk Management

– Knowledge-Based Risk Assessment

– Online Auditing Tools

Firewalls are not magic bullets You can’t put one in and not pay attention to what you are doing

That said, they are a crucial tool for defense

A firewall uses a set of rules and the rules act as filters As a packet comes to the firewall, it

inspects the packet and checks its ruleset to see if there is a rule for the packet The effect of this is

that the firewall acts as a filter on network traffic

There are hundreds of firewall products, but we can classify them based on the level of inspection A

packet filter does a minimum amount of inspection, and fully stateful application gateway proxy

firewalls not only do a lot of inspection, they tear the packet up and rewrite it Which do you think is

faster?

Trang 18

PIndications and Warning

P Host Late Detection

P Host Very Late Negation

How does a firewall fit in the big picture?

P= Probability of

A firewall is the primary opportunity for attack negation

Before we dive down into the bits and bytes of firewalls, let’s consider their place in information

security In terms of the big picture a firewall is interesting for a number of reasons

A firewall is commonly deployed at boundaries interface between your site and the Internet There

is a point of demarcation where your Internet Service Provider’s responsibility ends and your

responsibility begins

On the slide, the cyberscape shows the attacker is at the right and the target or defender on the left

We will learn about Indications and Warnings later in the course This is a technique to determine

what the attackers are going to do, before they do it There are countermeasures that can be applied

before the attack gets to you For instance, if an Internet Service Provider detects the attack, they

may be able to filter so that it never leaves their network Does that sound impossible? It is not!

There is a simple technique called egress filtering that, if widely applied, would reduce the number

of attacks on the Internet by a large degree

Trang 19

Why a firewall?

• Reduces risk by protecting systems

from attempts to exploit

vulnerabilities

• Increases privacy - makes it harder

to gather intelligence about a site

• Enforces an organization’s security

policy

A firewall serves as a noise filter Even a permissive firewall (a firewall with a large number of open

or “allow” rules is called permissive) reduces the danger from an attack

This is because most firewalls are designed with something called a default rule This means that if

a packet doesn’t match any other rule, the default rule drops the packet This is known as deny all

except that which is explicitly allowed Firewall administrators that override this rule are creating

an allow all expect that which is explicitly denied policy.

There is a file called the top ten list at www.sans.org/topten.htm, organizations that have a

permissive policy and do not block the items on the top ten list are operating at a significant risk,

unless they are using other countermeasures

Trang 20

• A policy engine – that which is not explicitly denied is permitted or vice versa

In my years in security, I have learned people will argue with me, they will ignore me I can write

security policy until I turn green and it doesn’t change anything However, nobody can argue with a

firewall when it enforces policy Firewalls are engines that implement your organization’s security

policy If you don’t think you have a security policy, check your firewall!

Say you have a policy that Internet Relay Chat is not allowed People can (and will) still get on IRC

servers However, if you do not allow destination port TCP 6667 out, or source port 6667 in with a

rule on your firewall, that makes it much harder for people to get on IRC

A simple rule to block IRC might look like this:

SourceIP DestIP Service Action

Tiêu đề	Intrusion Detection The Big Picture – Part IV
Tác giả	Stephen Northcutt
Người hướng dẫn	J. Kolde
Trường học	SANS Institute
Chuyên ngành	Intrusion Detection
Thể loại	báo cáo
Năm xuất bản	2000
Thành phố	Unknown

Định dạng
Số trang	41
Dung lượng	829,09 KB