Extranet for Security Professionals Intrusion Scenarios Heather T

Extranet for Security Professionals Intrusion Scenarios Heather T. Kowalski Tong Xu Ying Hao Hui Huang Bill Halpin Nov. 14, 2000

Preview Review of Project Progress Accomplishments l Current Status l What We Have Learned l Today’s Focus: Intrusion Scenarios Future Steps

Review Business Mission Central Repository of Security Information l Central Location for Information Sharing l Secure Environment, Manageable Resource l System Architecture Essential Services/Assets l Normal Usage Scenarios l

Primary Users Router (FW 1) Client Work. Station Cisco 7200 128. 237. 144. 1 DNS Red. Hat 6. 2 IPchains IDS-1 Firewall-2 Windows NT 4. 0 (SP 6) Hot Fixes Real. Secure 3. 2 Guardian Pro V 5 IDS-2 Windows NT 4. 0 (SP 6) Hot Fixes Real. Secure 3. 2 Web Server Windows NT 4. 0 (SP 6), Hot Fixes DNS NES 3. 63 Red. Hat 6. 2 IPchains Active. State Perl 5. 5 Cold Fusion 4. 5. 1 Tripwire 2. 2. 1 Database Visual Fox. Pro

Attackers vs. Legitimate Users Recreational/Casual Hackers Disgruntled Employee Organized Criminal Groups Nation/State ESP User VSO & CR Owners Site Manager Organizational Manager Site Administrator

Objectives of Attacks Embarrassment of the Target Organization Embarrassment of the Target User Financial Gain by Selling Acquired Information Improve Hacking Skill Set Fun/Vanity Publicity

Attacker Profile: Recreational/Casual Hacker Resources: none or limited Time: depends on opportunity Tools: free/cheap and readily available tools Risk attitude: unaware of consequences and risks Access: from outside network Objective: fun, vanity, skill test, or none Damage: limited

Attacker Profile: Disgruntled Employee Resources: enough to create a significant attack Time: depends on malice Risk Attitude: strongly risk averse Access: from inside Objectives: l Revenge through embarrassment l Financial gain

Attackers Profile: Organized Entity Who: organized criminals, fanatics, enemy nations/states, etc Resources and Time: unlimited Risk Attitude: genuine risk seeker Access: external or internal Objectives: Publicity!!! Real Damage!!!

Potential Attack Pattern Attack as User l Gain the illegal access as end user l Gain the illegal access as system administrator Attack on Component l Disable or slow down the process ability of a component Attack on Application l l l Induce system crash Induce service failure Induce assets damage

Compromisable Components Route DNS Firewall Web Server Database IDS Sniffing, Scans, Enumeration, Malicious Code, Flooding Malicious Code, Buffer Overflow Time, Planning, Buffer Overflow, Password

More Facts No intrusion in ESP has been reported since date of establishment ESP has strong physical security l l l Multi-layer protection Dedicated room Only few have physical access Other protective efforts l l Regular reconfiguration of firewall (once/ per month) Virus signature files are updated daily

Recreational Hacker Router (FW 1) Firewall-2 DNS 2 IDS Web Server DNS 1 Database

Compromised User Workstation Router (FW 1) Firewall-2 DNS 2 IDS Web Server DNS 1 Database

Router (FW 1) Firewall-2 IDS DNS 1 Admin Console DNS 2 IDS Web Server Database

Future Plans Regular Saturday Team Meetings Planned Meeting with Client Final Presentation and Report Summary of Findings l Recommendations l

Questions?

Type of DOS Attacks Bandwidth consumption Resource starvation Programming flaws Router attacks DNS attacks

Examples of DOS Attacks Network based DOS attack l l ICMP traffics (PING, Echo flood) SYN-flood Windows NT Programming Flaw Attacks l Tools: Tear. Drop, OOB (port 139), Land, Ping of Death Cisco Router Attacking Tools l Tool: Land