presentation _id © 1999, cisco systems, inc. cisco security consulting assessing your network for...

Presentation_ID © 1999, Cisco Systems, Inc. Cisco Security Consulting

Assessing your Network for Vulnerabilities

Assessing your Network for Vulnerabilities

Danny Rodriguez

Network Security Engineer

2Presentation_ID © 1999, Cisco Systems, Inc. www.cisco.com/go/securityconsultingCisco Security Consulting

AgendaAgenda

• Why assess your Network?

• Define Assessment goals

• Assessment Methodology

• Break

• Common vulnerabilities

• Recent vulnerabilities


Why Assess your Network?Why Assess your Network?

• Fear of “CNN” moment

• Mandated by management

• Determine risk to Intrusion

• Measure effectiveness of safeguards


Why Assess your Network? (Cont.)

Why Assess your Network? (Cont.)

• To accurately map your network

• To identify vulnerabilities and countermeasures

• ...


Define Assessment goalsDefine Assessment goals

• What do you want to accomplish?

• Test effectiveness of current safeguards

• Measure staffs ability to detect and respond

• Discover vulnerabilities present

• Determine risk to Denial-of-Service


Assessment MethodologyAssessment Methodology


SPA = External, Dial, Internal Analysis

SPA = External, Dial, Internal Analysis

WAN

Internet

Enterprise Network

External IP Assessment

Internal Network Assessment

External Dial Assessment


Dial MethodologyDial Methodology

• Discovery

– Dial phone numbers provided

– During normal business hours

– During off hours (weekends, nights)

– Identify phone numbers with carriers


Dial Methodology(Cont.)Dial Methodology(Cont.)

• Carrier Analysis

– Determine type of connected device

• router, PC, phone switch

– Determine type of remote control software

• pcAnywhere, ReachOut


Dial Methodology(Cont.)Dial Methodology(Cont.)

• Penetration

– Test authentication

• Digital lines often overlooked (ISDN, DSL)


Network Assessment Network Assessment

• Network Mapping

– Host and Service discovery

• Targeting

– Identifying potential vulnerabilities

• Exploitation

– Confirm potential vulnerabilities


Network MappingNetwork Mapping

• Build registered map

– Public info

• Whois database (InterNIC, ARIN)

• DNS High Zone transfers


Network Mapping (Cont.)Network Mapping (Cont.)

• Build electronic map

–“Live” hosts and active services

• ICMP Sweeps

• Port scans

– well know ports

– “blind” (not responding to ICMP)


Network Mapping (Cont.)Network Mapping (Cont.)

• Map of record

– Customer provided information

• Network topos

– Including ISP information

• Registered domain names

• Hosted web sites


TargetingTargeting

• Banner analysis

– Host (login)

– Service (smtp, pop, http)

• Port correlation

• Identify potential vulnerabilities


ExploitationExploitation

• Automated confirmation tools

• Manual confirmation

– “Mind” in the middle

• Secondary exploitation

– “Launch pad”


BreakBreak


Common Vulnerabilities

Common Vulnerabilities


Common vulnerabilitiesCommon vulnerabilities

• Passwords

• Dial-up

• Network Infrastructure

• Host based

• Service based

– HTTP, SMTP, FTP


PasswordsPasswords

• Clear-Text

• “Null” passwords

• “Joe” passwords

• Weak passwords


PasswordsPasswords

• No required length

• No aging

• No history

• Same password used for different access levels


Password RecommendationsPassword Recommendations

• Use encrypted passwords

• Develop a password policy

– Require a password

– Require a minimum length

• 7 alphanumeric

– Implement password history and aging


Passwords Recommendations (Cont.)

Passwords Recommendations (Cont.)

• Develop a password policy

– Require unique passwords be used for different levels of access

• “Crack” passwords routinely

– L0phtCrack and John the Ripper


Dial-upDial-up

• Unauthorized modems

• Poor authentication mechanism

• No logging

• Digital lines often not analyzed


Dial-up RecommendationsDial-up Recommendations

• Have strict policies and procedures

• Centralize modem pool

• Implement proper authentication mechanism

• Adequate logging

• Include Digital lines in assessment


Network InfrastructureNetwork Infrastructure

• Unfiltered network traffic

• Remote management not restricted

• Susceptible to “sniffers”

• Susceptible to session hijacking


Network InfrastructureNetwork Infrastructure

• Guessable SNMP community strings

– public, private, system, read, write

• Extranet connections

– vendors, partners

• No logging


Network Infrastructure: Recommendations

Network Infrastructure: Recommendations

• Determine what network traffic should be allowed IN and OUT (policy)

• Restrict remote access only to authorized management workstations

• Determine if encryption is an option

• Implement a switched network


Network Infrastructure: Recommendations (Cont.)

Network Infrastructure: Recommendations (Cont.)


– Log to external device (syslog)

• Use “good” snmp community strings

• Designate SNMP host servers

• Identify and properly segment extranet connections


Host basedHost based

• Unnecessary Services

• Incorrect file permissions

• Trust relationships

• Log files not reviewed

• No logging


Windows Windows

• Accessible shares to “Everyone”

• No logging

– Disabled by default in Windows NT

• WinNT NTFS not being utilized

• Domain Admin and Local Admin password the same


Windows (Cont.) Windows (Cont.)

• Anonymous user connection

• Ability for any user to submit a “AT” job

• Access to backup SAM file

• Misconfigured domain trust relationship


Windows RecommendationsWindows Recommendations

• Apply latest service packs, where applicable


• Set correct file permissions

– shares

– sensitive system files

• backup SAM


Windows Recommendations (Cont.)

Windows Recommendations (Cont.)

• Format WinNT system as NTFS

• Use different passwords for Domain Admin and Local Admin accounts

• Implement registry edits for:

Anonymous user connection

AT job submission

• Properly design NT domain Trusts


UnixUnix

• Incorrect file permissions

• Log files not reviewed

• Unnecessary services

R-services: rsh, rlogin, rexec

echo, discard, finger, rpc


Unix (Cont.)Unix (Cont.)

• setuid programs

• Misconfigured NFS servers

• Trust relationships

• World readable password file

• Access to X-Windows*


Unix RecommendationsUnix Recommendations

• Implement system auditing tools

– tripwire, logcheck

• Implement host based access control

– tcpwrappers

• Replace R-services with SSH implementation


Unix Recommendations (Cont.)


• Identify and remove setuid programs that are not needed

– $find / -perm -4000 -print

• Implement proper NFS access controls

– Host and file permissions




• Determine need for trust relationships

• Enforce X-Windows access control

• Implement shadow passwords

– pwconv


NovellNovell

• Accounts with “Null” password

• Access to management tools

– RCONSOLE

– NWAMDIN, SYSCON


Novell (Cont.)Novell (Cont.)

• Access to SYSTEM and ETC file systems

• Weak RCONSOLE passwords

• No logging


Novell RecommendationsNovell Recommendations

• Require passwords

• Restrict access to system files and management tools

• Determine need for RCONSOLE


Novell Recommendations (Cont.)

Novell Recommendations (Cont.)

• Implement encrypted RCONSOLE password mechanism

• Choose “good” RCONSOLE password



Common Service Vulnerabilities

Common Service Vulnerabilities

• HTTP (Web)

– Apache, Netscape, MS IIS

• SMTP (Mail)

– Sendmail, MS Exchange

• FTP

– wu-ftp, ProFTP, MS FTP


HTTP Vulnerabilities HTTP Vulnerabilities

• Access to cgi-bin, scripts directory

• Sample scripts

• PUT Method

• Buffer overflow

– MS IIS


SMTP Vulnerabilities SMTP Vulnerabilities

• Mail Relay

• SPAM

• Old sendmail versions

– remote “root” exploit


FTP VulnerabilitiesFTP Vulnerabilities

• Anonymous FTP

– Read/Write permissions incorrect

• Misconfigured “root” directory

– Allows access to entire file system

• Ability to perform “bounce” port scan


Recent VulnerabilitiesRecent Vulnerabilities

• Windows

– MS IIS (DoS attack)

– MS Office ODBC

• Linux

– crond, libtermcap, wu-ftpd


Recent Vulnerabilities (Cont.)Recent Vulnerabilities (Cont.)

• Solaris

– Calendar program (rpc.cmsd)

• HTTP

– cgi script allowed access to HotMail accounts


QuestionsQuestions

presentation _id © 1999, cisco systems, inc. cisco security consulting assessing your network for...

Documents