Cryptography and Network Security Chapter 20. Chapter 20– Intruders They agreed that Graham should set the test for Charles Mabledene. It was neither.

Cryptography and Cryptography and Network SecurityNetwork Security

Chapter 20Chapter 20

Chapter 20– Chapter 20– IntrudersIntruders

They agreed that Graham should set the test for They agreed that Graham should set the test for Charles Mabledene. It was neither more nor less Charles Mabledene. It was neither more nor less than that Dragon should get Stern's code. If he than that Dragon should get Stern's code. If he had the 'in' at Utting which he claimed to have had the 'in' at Utting which he claimed to have this should be possible, only loyalty to Moscow this should be possible, only loyalty to Moscow Centre would prevent it. If he got the key to the Centre would prevent it. If he got the key to the code he would prove his loyalty to London code he would prove his loyalty to London Central beyond a doubt.Central beyond a doubt.——Talking to Strange Men, Talking to Strange Men, Ruth RendellRuth Rendell

IntrudersIntruders

significant issue for networked systems is significant issue for networked systems is hostile or unwanted accesshostile or unwanted access

either via network or localeither via network or local can identify classes of intruders:can identify classes of intruders:

masqueradermasquerader misfeasormisfeasor clandestine userclandestine user

varying levels of competencevarying levels of competence

IntrudersIntruders clearly a growing publicized problemclearly a growing publicized problem

from “Wily Hacker” in 1986/87from “Wily Hacker” in 1986/87 to clearly escalating CERTsto clearly escalating CERTs

range range benign: explore, still costs resourcesbenign: explore, still costs resources serious: access/modify data, disrupt systemserious: access/modify data, disrupt system

led to the development of CERTsled to the development of CERTs intruder techniques & behavior patterns intruder techniques & behavior patterns

constantly shifting, have common featuresconstantly shifting, have common features

Examples of IntrusionExamples of Intrusion

remote root compromiseremote root compromise web server defacementweb server defacement guessing / cracking passwordsguessing / cracking passwords Copying/viewing sensitive data / databasesCopying/viewing sensitive data / databases running a packet snifferrunning a packet sniffer distributing pirated softwaredistributing pirated software using an unsecured modem to access netusing an unsecured modem to access net impersonating a user to reset passwordimpersonating a user to reset password using an unattended workstationusing an unattended workstation

HackersHackers

motivated by thrill of access and statusmotivated by thrill of access and status hacking community a strong meritocracyhacking community a strong meritocracy status is determined by level of competencestatus is determined by level of competence

benign hackers might be tolerablebenign hackers might be tolerable do consume resources and may slow performancedo consume resources and may slow performance can’t know in advance whether benign or maligncan’t know in advance whether benign or malign

IDS / IPS / VPNs can help counterIDS / IPS / VPNs can help counter awareness led to establishment of CERTsawareness led to establishment of CERTs

collect / disseminate vulnerability info / responsescollect / disseminate vulnerability info / responses

Hacker Behavior ExampleHacker Behavior Example

1.1. select target using IP lookup tools select target using IP lookup tools 2.2. map network for accessible services map network for accessible services 3.3. identify potentially vulnerable services identify potentially vulnerable services 4.4. brute force (guess) passwordsbrute force (guess) passwords5.5. install remote administration tool install remote administration tool 6.6. wait for admin to log on and capture wait for admin to log on and capture

passwordpassword7.7. use password to access remainder of use password to access remainder of

networknetwork

Criminal EnterpriseCriminal Enterprise organized groups of hackers now a threatorganized groups of hackers now a threat

corporation / government / loosely affiliated gangscorporation / government / loosely affiliated gangs typically youngtypically young often Eastern European or Russian hackersoften Eastern European or Russian hackers often target credit cards on e-commerce serveroften target credit cards on e-commerce server

criminal hackers usually have specific targetscriminal hackers usually have specific targets once penetrated act quickly and get outonce penetrated act quickly and get out IDS / IPS help but less effectiveIDS / IPS help but less effective sensitive data needs strong protectionsensitive data needs strong protection

Criminal Enterprise BehaviorCriminal Enterprise Behavior

1.1. act quickly and precisely to make their act quickly and precisely to make their activities harder to detectactivities harder to detect

2.2. exploit perimeter via vulnerable portsexploit perimeter via vulnerable ports

3.3. use trojan horses (hidden software) to use trojan horses (hidden software) to leave back doors for re-entryleave back doors for re-entry

4.4. use sniffers to capture passwordsuse sniffers to capture passwords

5.5. do not stick around until noticeddo not stick around until noticed

6.6. make few or no mistakes. make few or no mistakes.

Insider AttacksInsider Attacks

among most difficult to detect and preventamong most difficult to detect and prevent employees have access & systems knowledgeemployees have access & systems knowledge may be motivated by revenge / entitlementmay be motivated by revenge / entitlement

when employment terminatedwhen employment terminated taking customer data when move to competitortaking customer data when move to competitor

IDS / IPS may help but also need:IDS / IPS may help but also need: least privilege, monitor logs, strong authentication, least privilege, monitor logs, strong authentication,

termination process to block access & mirror datatermination process to block access & mirror data

Insider Behavior ExampleInsider Behavior Example

1.1. create network accounts for themselves and create network accounts for themselves and their friendstheir friends

2.2. access accounts and applications they wouldn't access accounts and applications they wouldn't normally use for their daily jobsnormally use for their daily jobs

3.3. e-mail former and prospective employerse-mail former and prospective employers4.4. conduct furtive instant-messaging chatsconduct furtive instant-messaging chats5.5. visit web sites that cater to disgruntled visit web sites that cater to disgruntled

employees, such as f'dcompany.comemployees, such as f'dcompany.com6.6. perform large downloads and file copyingperform large downloads and file copying7.7. access the network during off hours.access the network during off hours.

Intrusion TechniquesIntrusion Techniques aim to gain access and/or increase privileges aim to gain access and/or increase privileges

on a systemon a system often use system / software vulnerabilitiesoften use system / software vulnerabilities that that

allow a user to execute code that opens a allow a user to execute code that opens a back door into the systemback door into the system

key goal often is to acquire passwordskey goal often is to acquire passwords so then exercise access rights of ownerso then exercise access rights of owner

Basic methodology (McClure --Hacking Exposed):

• target acquisition and information gathering • initial access • privilege escalation

• covering tracks

Intrusion TechniquesIntrusion Techniques

Techniques for learning passwordsTechniques for learning passwords(Based on literature survey & interviews with a no. of password crackers)(Based on literature survey & interviews with a no. of password crackers)

Password GuessingPassword Guessing one of the most common attacksone of the most common attacks attacker knows a login (from email/web page etc) attacker knows a login (from email/web page etc) then attempts to guess password for it then attempts to guess password for it

defaults, short passwords, defaults, short passwords, common word searchescommon word searches user info (variations on names, birthday, phone, user info (variations on names, birthday, phone,

common words/interests) common words/interests) exhaustively searching all possible passwordsexhaustively searching all possible passwords

check by login check by login success depends on password chosen by usersuccess depends on password chosen by user surveys show many users choose poorly surveys show many users choose poorly

Password CapturePassword Capture

another attack involves another attack involves password capturepassword capture watching over shoulder as password is entered watching over shoulder as password is entered using a trojan horse program to collectusing a trojan horse program to collect monitoring an insecure network login monitoring an insecure network login

• eg. telnet, FTP, web, emaileg. telnet, FTP, web, email extracting recorded info after successful login (web extracting recorded info after successful login (web

history/cache, last number dialed etc) history/cache, last number dialed etc)

using valid login/password can impersonate userusing valid login/password can impersonate user users need to be educated to use suitable users need to be educated to use suitable

precautions/countermeasures precautions/countermeasures

Need to educate users to be aware of whose around, to check they really are interacting with the computer system (trusted path), to beware of unknown source s/w, to use secure network connections (HTTPS, SSH, SSL), to flush browser/phone histories after use etc.

Password file can be protected in one of the 2 ways:

Detection V/S Prevention

Intrusion DetectionIntrusion Detection

inevitably will have security failuresinevitably will have security failures so need also to detect intrusions so canso need also to detect intrusions so can

block if detected quicklyblock if detected quickly act as deterrentact as deterrent collect info to improve securitycollect info to improve security

Intrusion detection is based on the Intrusion detection is based on the assumption that the behavior of the assumption that the behavior of the intruder differs from that of a legitimate intruder differs from that of a legitimate user in ways that can be quantified.user in ways that can be quantified.

Intrusion DetectionIntrusion Detection

Approaches to Intrusion DetectionApproaches to Intrusion Detection

statistical anomaly detectionstatistical anomaly detection attempts to define normal/expected behaviorattempts to define normal/expected behavior thresholdthreshold profile basedprofile based

Effective against masqueradorsEffective against masqueradors rule-based detectionrule-based detection

attempts to define proper behaviorattempts to define proper behavior Anomaly detection: RulesAnomaly detection: Rules penetration identification: Expert system approachpenetration identification: Expert system approach

Effective against misfeasorsEffective against misfeasors

Statistical Anomaly DetectionStatistical Anomaly Detection

threshold detectionthreshold detection count occurrences of specific event over timecount occurrences of specific event over time if exceeded by a reasonable value assume if exceeded by a reasonable value assume

intrusionintrusion alone is a crude & ineffective detectoralone is a crude & ineffective detector

profile basedprofile based characterize past behavior of userscharacterize past behavior of users detect significant deviations from thisdetect significant deviations from this profile usually multi-parameterprofile usually multi-parameter

Audit RecordsAudit Records

fundamental tool for intrusion detectionfundamental tool for intrusion detection native audit recordsnative audit records

part of all common multi-user O/Spart of all common multi-user O/S already present for usealready present for use may not have info wanted in desired formmay not have info wanted in desired form

detection-specific audit recordsdetection-specific audit records created specifically to collect wanted infocreated specifically to collect wanted info at cost of additional overhead on systemat cost of additional overhead on system

Audit Record AnalysisAudit Record Analysis

foundation of statistical approachesfoundation of statistical approaches analyze records to get metrics over timeanalyze records to get metrics over time

counter, gauge, interval timer, resource usecounter, gauge, interval timer, resource use use various tests on these to determine if use various tests on these to determine if

current behavior is acceptablecurrent behavior is acceptable mean & standard deviation, multivariate, mean & standard deviation, multivariate,

markov process, time series, operationalmarkov process, time series, operational key advantage is no prior knowledge usedkey advantage is no prior knowledge used

Rule-Based Intrusion Rule-Based Intrusion DetectionDetection

observe events on system & apply rules to observe events on system & apply rules to decide if activity is suspicious or notdecide if activity is suspicious or not

rule-based anomaly detectionrule-based anomaly detection analyze historical audit records to identify usage analyze historical audit records to identify usage

patterns & auto-generate rules for thempatterns & auto-generate rules for them then observe current behavior & match against then observe current behavior & match against

rules to see if conformsrules to see if conforms like like statistical anomaly detection does not require statistical anomaly detection does not require

prior knowledge of security flawsprior knowledge of security flaws Effective when there is a large database of Effective when there is a large database of

rules(10rules(1044 to 10 to 1066 rules) rules)

Rule-Based Intrusion DetectionRule-Based Intrusion Detection

rule-based penetration identificationrule-based penetration identification uses expert systems technologyuses expert systems technology with rules identifying known penetration, weakness with rules identifying known penetration, weakness

patterns, or suspicious behaviorpatterns, or suspicious behavior compare audit records or states against rulescompare audit records or states against rules rules usually machine & O/S specificrules usually machine & O/S specific rules are generated by experts who interview & codify rules are generated by experts who interview & codify

knowledge of security adminsknowledge of security admins rules are also generated by experts who analyze attack rules are also generated by experts who analyze attack

tools & scripts collected from Internettools & scripts collected from Internet

quality depends on how well this is donequality depends on how well this is done

Sample RulesSample Rules

Base-Rate FallacyBase-Rate Fallacy practically an intrusion detection system needs to practically an intrusion detection system needs to

detect a substantial percentage of intrusions with detect a substantial percentage of intrusions with few false alarmsfew false alarms if too few intrusions detected -> false securityif too few intrusions detected -> false security if too many false alarms -> ignore / waste timeif too many false alarms -> ignore / waste time

Unfortunately, because of the nature of the Unfortunately, because of the nature of the probabilities involved, it is very difficult to meet the probabilities involved, it is very difficult to meet the standard of high rate of detections with a low rate standard of high rate of detections with a low rate of false alarms. A study of existing intrusion of false alarms. A study of existing intrusion detection systems indicated that current systems detection systems indicated that current systems have not overcome the problem of the base-rate have not overcome the problem of the base-rate fallacy. fallacy.

Distributed Intrusion Distributed Intrusion DetectionDetection

traditional focus is on single systemstraditional focus is on single systems but typically have networked systemsbut typically have networked systems more effective defense has these working more effective defense has these working

together to detect intrusionstogether to detect intrusions issuesissues

dealing with varying audit record formatsdealing with varying audit record formats integrity & confidentiality of networked dataintegrity & confidentiality of networked data centralized or decentralized architecturecentralized or decentralized architecture

Distributed Intrusion Detection - Distributed Intrusion Detection - ArchitectureArchitecture

Distributed Intrusion Detection – Distributed Intrusion Detection – Agent ImplementationAgent Implementation

HoneypotsHoneypots decoy systems to lure attackersdecoy systems to lure attackers

away from accessing critical systemsaway from accessing critical systems to collect information of their activitiesto collect information of their activities to encourage attacker to stay on system so to encourage attacker to stay on system so

administrator can respondadministrator can respond are filled with fabricated informationare filled with fabricated information instrumented to collect detailed instrumented to collect detailed

information on attackers activitiesinformation on attackers activities single or multiple networked systemssingle or multiple networked systems IETF Intrusion Detection WG standardsIETF Intrusion Detection WG standards

Password ManagementPassword Management

front-line defense against intrudersfront-line defense against intruders users supply both:users supply both:

login – determines privileges of that userlogin – determines privileges of that user password – to identify thempassword – to identify them

passwords often stored encryptedpasswords often stored encrypted Unix uses multiple DES (variant with salt)Unix uses multiple DES (variant with salt) more recent systems use crypto hash functionmore recent systems use crypto hash function

should protect password file on systemshould protect password file on system

Password StudiesPassword Studies

Purdue 1992 - many short passwordsPurdue 1992 - many short passwords Klein 1990 - many guessable passwordsKlein 1990 - many guessable passwords conclusion is that users choose poor conclusion is that users choose poor

passwords too oftenpasswords too often need some approach to counter thisneed some approach to counter this

Managing Passwords - Managing Passwords - EducationEducation

can use policies and good user education can use policies and good user education educate on importance of good passwordseducate on importance of good passwords give guidelines for good passwords give guidelines for good passwords

minimum length (>6) minimum length (>6) require a mix of upper & lower case letters, require a mix of upper & lower case letters,

numbers, punctuation numbers, punctuation not dictionary wordsnot dictionary words

but likely to be ignored by many usersbut likely to be ignored by many users

Managing Passwords - Managing Passwords - Computer GeneratedComputer Generated

let computer create passwordslet computer create passwords if random likely not memorisable, so will if random likely not memorisable, so will

be written down (sticky label syndrome)be written down (sticky label syndrome) even pronounceable not rememberedeven pronounceable not remembered have history of poor user acceptancehave history of poor user acceptance FIPS PUB 181 one of best generatorsFIPS PUB 181 one of best generators

has both description & sample codehas both description & sample code generates words from concatenating random generates words from concatenating random

pronounceable syllablespronounceable syllables

Managing Passwords - Managing Passwords - Reactive CheckingReactive Checking

reactively run password guessing tools reactively run password guessing tools note that good dictionaries exist for almost note that good dictionaries exist for almost

any language/interest groupany language/interest group cracked passwords are disabledcracked passwords are disabled but is resource intensivebut is resource intensive bad passwords are vulnerable till foundbad passwords are vulnerable till found

Managing Passwords - Managing Passwords - Proactive CheckingProactive Checking

most promising approach to improving most promising approach to improving password securitypassword security

allow users to select own passwordallow users to select own password but have system verify it is acceptablebut have system verify it is acceptable

simple rule enforcement (see earlier slide)simple rule enforcement (see earlier slide) compare against dictionary of bad passwordscompare against dictionary of bad passwords use algorithmic (markov model or bloom filter) use algorithmic (markov model or bloom filter)

to detect poor choicesto detect poor choices

SummarySummary

have considered:have considered: problem of intrusion, behavior and techniquesproblem of intrusion, behavior and techniques intrusion detection (statistical & rule-based)intrusion detection (statistical & rule-based) password managementpassword management