Cybersecurity cyberlab2

Download Cybersecurity cyberlab2

Post on 18-Nov-2014




1 download

Embed Size (px)


Intro to computer hacker and attacks and network security.


<ul><li> 1. Network SecuritySlides by Raymond Borges </li> <li> 2. Outline In the NEWS (LOIS) DDoS attacks Passive Network Attacks Active Network Attacks Designing a Secure Network Web 2.0 Summary 2 </li> <li> 3. IN THE NEWS 3 </li> <li> 4. Low Orbit Ion Cannon (LOIC) Primary tool being used by the script kiddies Low Orbit Ion Cannon (LOIC) is a web app performance tool Denial of Service/testing tool DoS operation using HTTP/TCP/UDP requests DDoS voluntarily joining botnet Hive Mind 4 </li> <li> 5. How does LOIC work?While IsFlooding is True{1. Create/Connect a TCP Socket to webserver2. Send standard GET request to the server3. Read the first 64 bytes returned4. Sleep for configured Delay} 5 </li> <li> 6. Low Orbit Ion Cannon Hive 6 </li> <li> 7. Low Orbit Ion Cannon New 7 </li> <li> 8. Hive Mind The automatic mode or Hive Mind, option to voluntarily join a botnet Using mode, all parameters of attack set up remotely via IRC, including target IRC is a network protocol designed to provide real-time group chat, often (miss)used to control botnets 8 </li> <li> 9. LOIC trail If an anonymization network (TOR) is not used traceable IP address records can be logged by its recipient Logs kept by the ISP used to identify users Many users arrested using LOIC LOIC not anonymous 9 </li> <li> 10. LOIC/ Wireshark Demo1. Turn on VMware WinXP machine2. Turn on Wireshark3. Turn on LOIC4. Start packet capture in Wireshark5. Start LOIC 10 </li> <li> 11. LOIC MitigationAttack vector old as the HTTP protocol Best approach is to use a good rule based firewall, allow for rules on connection limits per IP per secondLegitimate uses for this tool: Performance base lines Measuring server performance 11 </li> <li> 12. PASSIVE NETWORK ATTACKS 12 </li> <li> 13. FTP Password Attack Setup1. Install virtual machine or connect to network2. Install Internet Information Services (IIS) on Windows and File Transfer Protocol (FTP)3. Setup FTP with a password4. Run Wireshark while attempting FTP 13 </li> <li> 14. FTP Password Attack1. Run Wireshark on LAN in promiscuous mode2. Wait till someone connects to host with FTP 14 </li> <li> 15. Passive online attack0. Wireshark2.Filter http3.Find post method4.Follow TCP stream5.You have username and password in the clearif server isnt using https SSL or other encryption 15 </li> <li> 16. ACTIVE NETWORK ATTACKS 16 </li> <li> 17. Replay and Man-in-the-middle When passwords cant be caught in plaintext Man-in-the-middle ARP poisoning Replay attack Session hijacking 17 </li> <li> 18. Cain and Abel (ARP poisoning)1. Install Cain and Abel2. Connect to a network3. Select sniffer tab4. Start sniffer and select network interface5. Select hosts on bottom and press then ok6. Select bottom APR tab and click top window7. Press and select target IP then hit Ok8. Hit then select passwords tab, (http) 18 </li> <li> 19. NETWORK INFRASTRUCTURE 19 </li> <li> 20. Policy Network security Company goals lead to security policy Network infrastructure design policy Network design meets requirements 20 </li> <li> 21. So how do we go from? 21 </li> <li> 22. Data Classification Policy develops from information flow Who can access what?Common classifications: Public Secret Confidential Group based 22 </li> <li> 23. User Classifications Serves same purpose as data classification Who can access what?Common classifications: Outsiders Employees Executives Owners 23 </li> <li> 24. Access Control Matrix (ACM) 24 </li> <li> 25. Network Organization Network infrastructure design using ACM Layered security measures Separation of information Fairly standard corporate network 25 </li> <li> 26. Network Organization Public network firewall Demilitarized Zone (DMZ) Public or External Network Internal network firewallInternal Network 26 </li> <li> 27. FirewallsFirewalls filter based on: IP Addresses, destination PortsFiltering firewall based on: Packet Headers Source addressesProxy or application level firewalls based on message content: Virus scanner Key terms? 27 </li> <li> 28. Firewall Operation 28 </li> <li> 29. Outer FirewallCan be used to:1. Restrict outside access to internal network2. Restrict internal access to internet while allowing access to DMZ based on Access Control Lists (ACLs)3. ACLs bind source address/port and destinations address/ports to access rights 29 </li> <li> 30. Outer Firewall Public needs Web server and mail server access, no other services Firewall interface allows connections to WWW services (HTTP and HTTPS) and electronic mail (SMTP) Internet sees addresses of Web and mail servers equalthat of the firewall, NAT 30 </li> <li> 31. Internal Firewall Sensitive data resides in internal network Block all traffic except authorized traffic (fail-safe defaults principle) Information comes only from DMZ, never directly from Internet 31 </li> <li> 32. Ports/Services 20-21 FTP 22 SSH/SCP 23 Telnet 25 SMTP 53 DNS67-68 DHCP/BOOTP 80 HTTP 443 HTTP over SSL465 SMTP over SSL 32 </li> <li> 33. ProxiesProxies - hosts that relay data Hide identity and protect privacy Can be used as firewallsThe Onion Routing network (TOR) Proxy network made of volunteer hosts 33 </li> <li> 34. DMZ and ServersDemilitarized Zone or DMZ - area outsideinternal firewall, some ports unblocked forinbound internet access to serversServers hosts which serve webpages or storeand process electronic mail for usersWeb server and mail server contained in DMZ 34 </li> <li> 35. Domain Name System (DNS) ServerKnows directory name service information for: DMZ mail, Web, and log hosts Internal trusted administrative host Outer firewall Inner firewall 35 </li> <li> 36. DMZ Log ServerAll other servers log messages by writing them to alocal file and then to the log server The log server also writes them to a file and then to write-once media Confined to the DMZ Does not initiate transfer to inner network 36 </li> <li> 37. Internal Network Subnets may have firewall and servers, may filter traffic as inner firewall does Subnets may share servers Information flow constraints arrangement Firewalls impose confinement at interfaces 37 </li> <li> 38. Firewall AttacksAttackers have 3 methods of firewall entry Web server ports (HTTP) port proxy checks for invalid or illegal HTTPrequests and rejects them SMTP portMail proxy will detect and reject such attempts Bypass the low-level firewall checks by exploiting firewall vulnerabilities 38 </li> <li> 39. Defense Practices Economy of mechanism (simple mechanisms)Making hosts or devices do only their job Separation of privilege (divided jobs)More than one host does a certain job Defense in depth (layered security defense)Multiple defenses to bypass 39 </li> <li> 40. Internet AttacksDistributed Denial of Service (DDoS)SYN flood Consumes bandwidth Consumes memory resourcesRemedies TCP intercept mode Synkill software 40 </li> <li> 41. AttacksFocus on what we are most concerned about: Successful attacks Failed attacks in areas where attacks ought not to be launched e.g. DMZ.Efforts into where we can obtain useful results 41 </li> <li> 42. Summary Security requirements network infrastructure Security goals security policy network form Internal firewall limits traffic to public servers Outer firewall blocks external traffic from internal Public servers only provide one service Application level firewalls check contents 42 </li> <li> 43. RECENT RESEARCH 43 </li> <li> 44. Quantification of Attackers Activities on Servers running Web 2.0 Applications Attackers use search-based strategiesGoogle Easiest ways to attack servers dominate Password cracking attacks on SSH 44 </li> <li> 45. Quantification of Attackers Activities on Servers running Web 2.0 Applications Blog user accounts and vulnerability scans Spam attacks dominate Web 2.0 applications such as Blogs and Wikis Less activity use known vulnerabilities 45 </li> <li> 46. Possible Questions1. Why is privilege separation so important?2. What is normally closed security?3. What security model do you think Facebook uses?4. How can DNS be used to censor websites?5. Is there another means of reaching a website other than by URL?6. What makes the internet impossible to bring down completely? (Discussion erupts) 46 </li> <li> 47. References Introduction to Computer Security, Matt Bishop Attacks by Anonymous WikiLeaks Proponents not Anonymous Pras Design and Analysis of Communication Systems Group University of Twente, Enschede, The Netherlands Quantification of Attackers Activities on Servers runningWeb 2.0 Applications, Katerina Goseva-Popstojanova, Risto Pantev, Ana Dimitrijevikj, and Brandon Miller, Lane Department of CS and EE WVU loic-web-stress-tool/;feature=related 47 </li> <li> 48. Questions? </li> </ul>