Network Security Notes

Página 1

Network Security

Intrusion

Social

Engineering

This is a way

for an intruder to gain enough information from people to gain access

to the network.

Attacker

calling a user on a network claiming to be from the computer support

Searching through trash

Phishing

The solution is educating

users about not sharing information on how they access the network and

to always require identification from support staff.

Password Cracking

This is an

attempt to guess the password using brute force or dictionary attacks.

Brute-force

attack means the attacker uses every possible combination of

characters for the password.

Dictionary attack uses

known passwords and many variations to try to log in to your account.

Guidelines to help

prevent password cracking:

Don’t use

passwords that are dictionary words.

Don’t use your username

as your password.

Don’t use your username

spelled backwards as your password.

Limit the number of

login attempts .

Make your password

strong, sufficiently long, and is an alphanumeric combination.

Change passwords often.

Packet Sniffing

This assumes

that the attacker can see the network data packets, would have to have

a device on the network.

Many applications pass

the username and password over the network in plain text allowing for

access.

They way to prevent this

is by encrypting the information traveling over the network.

Secure Shell

(SSH)

Secure socket layer

(SSL)

Secure File Transfer

Protocol (SFTP)

You can also implement IP

Security (Ipsec) at layer 3. IN IPsec each packet is encrypted prior

to transmission across the network link.

Vulnerable Software

In the process

of writing large amounts of code, errors happen that can open access

to the code and to a network.

Buffer overflow

capitalizes on this, it occurs when a program attempts to put more

data into a buffer than it was configured to hold and the overflow

writes past the end of the buffer and over adjacent memory locations.

The program stack contains data plus instructions that it will run.

These instructions can allow a attacker remote access to the machine.

Sometimes buffer

overflows don’t allow instructions to run, but rather the applications

crashes. This is used in denial-of-service attacks.

Common code that gets run

in buffer overflow attacks is setting up a backdoor to gain entry into

the computer. It creates an application on a port and then connecting

to the port. This can be used to place viruses.

Steps

for Preventing Vulnerable Software Attacks

Keep software

patches and service packs for the operating system current.

Turn off all services

and ports that are not needed on a machine.

The command [netstat -a] can be used to display the ports currently

open on the windows operating system. It also shows who is connected

to your machine and the port numbers.

Another useful command

is [netstat -b], which shows the executable involved in creating

the connection of listening port.

The ports that are

listening are just waiting for a connection.

Viruses and Worms

A virus is a

piece of malicious computer code that when run on your machine can

damage your hardware, software, or other files. They typically attach

to an executable file and can spread when run. Virus is spread by

sharing infected files or sending emails with the attached files that

are infected with the virus.

Problems caused by

viruses include:

Annoyance

Clogging up the mail

server

Denial of Service

Data Loss

Open holes for others to

access your machine

A computer worm is a type

of computer virus that attacks computers, typically self-replicating;

it can deny service to networks. Can use the network to send copies of

themselves to other computers. A common objective of a worm is to

establish a backdoor in the infected computer.

The following are steps

that can be taken to prevent viruses:

Open only

trusted verified attachments.

Require that the emails

you receive be digitally signed so you can verify the sender.

Always run antivirus

software on the client machines. Not 100%

Include email server

filters to block specific types of emails or attachments

Keep the antivirus

software up-to-date.

Keep the operating

system and application software current.

Use personal firewalls

when possible.

Malware is the term used

to encompass all malicious programs intended to harm, disrupt, deny,

or gain unauthorized access to a computer system. An intruder can gain

access or even control of your network.

Denial-of-Service Attacks

Denial of

Service (DoS) means that an service is being denied to a computer,

network, or network server. Attacks can be on individual machines, the

network that connects the machines, or on all machines simultaneously.

DoS attacks

can be initiated by exploiting software vulnerabilities. A software

vulnerability can permit a buffer overflow, causing the machine to

crash. This affects all applications, even secure applications.

This type of

DoS attacks the system by making it reboot repeatedly. This included

attacks on router software.

Another DoS attack is an

SYN attack. This refers to the TCP SYN (synchronizing) packet. An

attacker will send many of these packets to a host, opening many TCP

sessions. The host machine has limited memory set aside for open

connections. If all the TCP connections are opened by the SYN attack,

other users are kept from accessing services from the computer because

the buffer is full. New OS systems take countermeasures against SYN

attacks.

DoS attacks can affect

the network bandwidth and the end points on the network.

Smurf Attack

The attacker

sent a small packet and got many packets in return, requires few

resources from the attacker.

The attacker would pick

a victim and an intermediate site.

The attacker sends a

packet to a broadcast address for a subnet.

The attacker then

spoofs the source address information, making it look as if the

packet came from the victim's network.

All the machines on the

subnet send a reply to the source address.

This allows the

attacker to generate a lot of data traffic on the victim's network

without requiring the attacker to have many resources.

This type of attack is

not new, and you can take steps to stop a network from becoming an

intermediate site.

Cisco routers have an

interface command that clocks broadcasts packets to that subnet.

No ip

directed-broadcast

Routers block general

broadcasts but this is a directed broadcast attack.

The command enables

only the router to reply.

Access lists allow only

specific sources from the network to enter the router's interface.

This can

become a maintenance problem: keeping track of the access lists can

be a challenge for the network administrator and processing the

access lists on the router is processor intensive and can slow the

throughput of the packets.

This does help

eliminate spoofed packets. Spoof means the attacker doesn’t use his

IP address but will insert an IP address from the victim's network

or another network as the source IP.

There isn't a way to

prevent being a victim unless you aren't connected to any network or

to any other users.

Distributed Denial-of

Service Attacks

The number of

packets that can be generated by a Smurf attack can be limited on a

router; however, attackers now use worms to distribute an attack. In a

distributed denial-of-Service (DDoS) attack, the attacker will do a

port scan and look for an open port or a software application that is

vulnerable to an attack. The machine is hacked and distributes the

malicious software. This is repeated on many victim machines. With the

software on the victim machines, the attacker can issue a command that

starts the attack on a specific site. The attack comes from a

potentially massive amount of machines the worm has infected.

To stop DDoS attacks, you

must stop intrusions to the network.

Security Software

Antivirus

Software

The first line

of defense against malware is antivirus software.

Recommended practice

dictates that every computer should have an antivirus program

installed even though it cannot provide 100% protection.

The software uses

signatures or definitions to match against the viruses and worms

traits. When a virus or worm is

found a signature or definition is created. Most companies provide

these updates within hours as needed.

Make sure it is always up

to date and launches at startup.

When found the virus

program is usually quarantined or removed.

Personal Firewall

Intro

Most

operating systems today are equipped with a personal firewall but

might not be enabled by default.

The personal firewall

software is typically based on basic packet filtering inspections

where the firewall accepts or denies incoming network traffic based

on information contained in the packets' TCP or IP headers.

Some personal firewalls

allow for other controls such as allowing specific hots or subnets

and even application-based trusted sites.

In the Windows OS,

firewall protection was introduced in the Windows XP service pack 2.

It has since evolved from a simple firewall to one with more controls

as mentioned above.

Linux, iptables has been

a de facto firewall program.

Mac OS X deployed ipfw,

a BSD Linu-based firewall, then turned to an application based

firewall.

Windows 7

START >

Control Panel > System Security

Windows Firewall >

Check Firewall Status or Allow a program through Windows

Check

firewall status indicates if it is on and for which network type.

Allow a program through

Windows displays a list of allowed programs and features

From here

you can choose which network type is allowed for the program or feature

Show details or remove

them from the list

Can also add new

programs to the list

Advance firewall

settings

Can be found

on the left column of the firewall status window

Control both the

inbound and outbound traffic

When selecting Inbound

Rules the middle pane shows all the firewall inbound rules

If double clicking a

rule the rule properties window pops up.

This allows

you to change "Enabled" or "Action"

In the Protocols and

Ports section you see this is defined as a ICMPv4 protocol.

The customize button

shows the Echo request ICMP type selected.

Mac OS X

System

Preferences > Security > Firewall

The Firewall window

displays the status of the firewall and lets you turn it off or on.

Advance Button

List of

software connections

Add and

remove

Change status

Block all incoming

connections

Automatically allow

signed software to receive incoming connections

Enable stealth mode

Blocks ICMP

ping requests

Linux

Command to

view Linux Firewall:

Command is

iptables --list

Shows chains the INPUT,

FORWARD, OUTPUT and RH-Firewall-1-INPUT

Chains can

consist of firewall rules and other chains

RH-1-INPUT allows

incoming HTTP, HTTPS, SSH, SMTP, DNS, and IMAP traffic and will

reject any incoming that does not match.

Security Hardware

Firewall

Firewalls are

used in computer networks for protection against the "network

elements". Access lists (ACLs) are the basic form of firewall

protection, although an access list is not stateful and is not by

itself a firewall. ACLs can be configured on a router, on a true

dedicated firewall, or on the host computer.

Firewalls allow traffic

from inside the network to exit but don’t allow general traffic from

the outside to enter the network. They monitor the data traffic and

recognizes where packets are coming from. It allows packets from the

outside inside if they match a request from within the network. Based

on three technologies:

Packet

Filtering

Proxy Server

Stateful packet

filtering

In packet filtering, a

limit is placed on the packets that can enter the network. ACLs are

used to enable the firewall to accept or deny data packets. The

disadvantages are:

Packets can

still enter the network by fragmenting the data packets

It is difficult to

implement complex ACLs

Not all network services

can be filtered.

A proxy server is used by

clients to communicate with secure systems using a proxy. This is used

to authenticate the user, establish the session, and set policies. The

client must connect to the proxy server to connect to resources

outside the network. The disadvantages of the proxy server are:

The proxy

server can fun very slowly

Adding services can be

difficult

There can be a potential

problem with network failure if the proxy server fails or is

corrupted.

In a stateful firewall

the inbound and outbound data packets are compared to determine if a

connection should be allowed. Tracks the source and destination port

numbers, sequence numbers, and the source and destination IP

addresses. This is used to protect the inside of the network from the

outside world but still allow traffic.

The three most common

traffic types that require holes to be opened are web servers, DNS,

and email. The firewall must be modified so that anybody can connect

to the webserver. When opening

ports, the network admin must continually upgrade the software so that

vulnerabilities are removed. The web server may also need its own

firewall. Most firewalls can perform deep packet inspection which can

catch some of protocol vulnerabilities.

A firewall is usually

placed between a trusted internal network and an untrusted external

network. Function is to protect its trusted network. All incoming

traffic is considered untrusted and is inspected by the firewall

according to its rules. At the firewall, NAT or PAT is typically

configured to handle the translation between the private IP addresses

to the public IP addresses.

Users assume that

firewalls catch all possible problems and that is wrong. A firewall is

not the end-to-end solution,

Other Security Appliances

These

appliances work in conjunction with the firewall or as a supplement.

Intrusion prevention

system (IPS) monitors and analyzes the network traffic. In real time,

it identifies misuse and anomaly on the network. The IPS detects a

misuse intrusion by matching the network packets with its IPS

signatures for known attacks or activities that are classified as bad.

It builds up a profile of the system being monitored and detecting

significant deviations from this profile. The IPS has the capability

to stop or prevent malicious attacks that it detects by interacting

with the firewall.

Web Filter appliance

monitors and filters web traffic. A web filter appliance has a

database containing inappropriate websites. Removes content or

redirects to a security page. Constantly updated. Sites can be

manually marked.

Introduction to Virtual

Private Network

Intro

When a network

is protected behind a firewall it is sometimes referred to as a

private network, and only computers on the same private network care

considered trusted. Public access to the private network can be

limited and require special permission to be granted on the firewall.

Virtual private network (VPN) extends a private or a trusted network

over public infrastructure like the internet. This is accomplished by

establishing a secure connection between the remote end and the

private network, therefore allowing remote clients to become part of

the trusted network.

The secure connection

between two endpoints is known as an IP tunnel that is created by an

encapsulation technique. A tunnel creates a virtual circuit-like

between the two endpoints and makes the connection appear like a

dedicated connection even though it spans over the internet

infrastructure.

Two commonly used VPN

types are:

Remote access

VPN: allows for users that travel or work from areas not on the

network to access remotely.

Site-to-Site VPN: Used

to link sites or buildings that cannot be directly connected via

infrastructure. It requires

network hardware like a router or a firewall to create and maintain

the connection.

VPN Tunneling Protocols

Generic

Routing Encapsulation (GRE) is one of the original tunneling protocols

developed by CISCO in 1994 and still used today. Commonly used as a

site-to-site VPN solution because of its simplicity and versatility.

Only tunneling protocol that can encapsulate up to 20 types of

protocols.

Point-to-Point

Protocol (PPP)

was used in the days of dial-up modems, you would make a dial-up

connection to the ISP and establish a PPP session to the internet.

Authentication is optional for PPP but most implementations of PPP

provide user authentication using protocols like Password

Authentication Protocol (PAP) or Challenge Handshake

Authentication protocol (CHAP). PAP is a unencrypted

auth method, which is superseded by CHAP, an encrypted auth method

that uses the MD5 hashing algorithm. Extensible Authentication

Protocol (EAP) was introduced as another PPP auth method. During

the PPP phase, the ISP dial-up server collects the auth data and

validates it against an auth server like a RADIUS server. RADIUS

or Remote Authentication Dial-In User Service is an IETF standard

protocol that is widely used for authenticating remote users and

authorizing user access. It supports many methods of user

authentication. PPP is not prevalent today.

Point-to-Point

Tunneling Protocol (PPTP) was widely used as a remote access solution and was

designed to work in conjunction with a standard PPP. PPTP would

establish a PPP connection to the ISP, after the connection it would

make a PPTP over the internet to the PPTP server. PPTP tunnel uses a

modified GRE tunnel to carry its encapsulated packet for IP

transmission. PPTP does not have an auth method and relies heavily on

the PPP auth.

Layer 2

Forwarding Protocol (L2F) developed by CISCO and was not widely used due to

its requirement of L2F hardware. This required coordination between

the ISP and the corporate network due to hardware being required at

the ISP as well. Also relies on the PPP auth.

Layer 2

Tunneling Protocol (L2TP) was developed by the Internet Engineering Task

Force (IETF)

in 1999 with the intention of merging two incompatibles proprietary

tunneling protocols, PPTP and L2F. It doesn’t require specific

hardware. Done over the UDP port 1701.

L2TP allows for tunnel auth so it doesn’t have to rely heavily

on PPP. If L2TP is used over an IP network where PPP is not used, the

tunnel can be created with its own auth mechanism.

None of the above offer

encryption. IPsec was designed for the purpose of providing a secure

end-to-end connection. IPsec provides network layer encryption and

authentication techniques. Can be used for Remote access or

site-to-site VPN. For IPv6, IPsec becomes an even more integral part

as it is embedded within the IPv6 packets. The two primary security

protocols used by Ipsec, Authentication Header (AH) and Encapsulating

Security Payload (ESP). AH guarantees the authenticity of the IP packets.

It uses a one-way hash algorithm like Message Digest 5 (MD5) or Secure

hash Algorithm (SHA-1) to ensure the data integrity of the IP packets. ESP

provides confidentiality to the data message (payloads) by ways of

encryption. IPsec uses symmetrical algorithms like Data

Encryption Standard (DES), Triple Data Encryption Standard (3DES), and Advanced

Encryption Standard (AES).

Before an Ipsec tunnel

can be established, a few security parameters have to be negotiated

and agreed upon by both ends. To do this Ipsec uses Internet

Key Exchange (IKE) protocol which is a hybrid protocol that encompasses several

key management protocols like Internet Security Association

and Key Management Protocol (ISAKMP). IKE phase 1 where both network nodes

authenticate each other and set up an IKE SA (Security

Association).

The Diffie-Hellman key exchange algorithm is used to generate a

shared session secret key to encrypt the key exchange communications.

IKE phase 2 uses the secure channel to negotiate the unidirectional

Ipsec SAs - inbound and outbound - to set up the Ipsec tunnel. (where

AH and ESP are negotiated)

Configuring a Remote

Access VPN Server

Windows 2003

and 2008 VPN Server

Start >

Programs > Administrative Tools > Routing and Remote Access

Right click the server

name and select Configure and Enable Routing and Remote Access.

Choose manually

configured server option

Select VPN server from

the Common Configurations menu.

Set the pool of IP

addresses to be used by the VPN server.

Right-click

the server name and select properties.

Click the IP tab and

select Static Address Pool > Add > Set range of IP Addresses

and input the desired IP address range.

Windows

2003 server will issue a default IP address in the 169.x.x.x range

if this step is not done and your client computers will be assigned

an IP address that is not valid for your network.

Configuring a Remote

Client's VPN Connection

Cisco VPN Client