1 Network Security By Alan S H Lam 2003/7/29

2 Outlines Threat and Attack trends Attackers’ Activities (live demo) Forensic Tools (live demo) IT-Related Laws in HK Q & A You can review this presentation material at

3 Sophistication VS Population Source: CERT

4 Less Knowledge Required to Attack Source: Symantec

5 Vulnerabilities reported Source: CERT

6 Incidents reported Source: CERT As both the number of internet users grows and the intruder tools become more sophisticated as well as easy to use, more people can become “ successful ” intruders.

7 Vulnerability Exploit Cycle (1) Source: CERT

8 Vulnerability Exploit Cycle (2)

9 Vulnerability Exploit Cycle (3) For some vulnerabilities, there may be a resurgence in its exploitation

10 Typical Network Attack Source: CERT

11 Attack Trends (1) 1. Automation; speed of attack tools Scanning for potential victims. Compromising vulnerable systems. Propagate the attack. Coordinated management of attack tools. 2. Increasing sophistication of attack tools Anti-forensics. Dynamic behavior. Modularity of attack tools.

12 Attack Trends (2) 3. Faster discovery of vulnerabilities 4. Increasing permeability of firewalls 5. Increasingly asymmetric threat 6. Increasing threat from infrastructure attacks Distributed denial of service (DDOS) Worms Attacks on the Internet Domain Name System (DNS) Attacks against or using routers

13 The Classic DDoS model

14 DoS Impact to Infrastructure Traffic VS router CPU Loading

15 Attack Trends (3) Potential Impact Denial of service Compromise of sensitive information Misinformation Time and resources diverted from other tasks

16 Our Honeynet Network Infrastructure

17 Attackers ’ Activities (1) Identify/locate the victim by some scanning tools Break-in the victim through system security holes. The following vulnerabilities were used by the hackers to break-in our honeynet. sshd CRC32 Overflow Buffer overflow in openssl WU-FTP RNFR././ attack execve/ptrace race condition

18 Attackers ’ Activities (2) After break-in, the hackers may Install rootkit to setup backdoor, sniffer, or IRC proxy Use victim as a stepping stone to find and attack other victims Fix the victim vulnerability and undo other hackers jobs Send back the victim information through Propagate the attack to other victims. Deface/remove victim web page

19 Forensic Tools scp, dd, tar, nc tcptrace, tcpdump, snort ps, netstat, lsof, fuser, kill -STOP, pcat, ltrace, strace, /dev/kmem /proc directory find, ldd, strings, gbd, od, bvi, icat chkrootkit

20 IT-Related Laws in HK Unauthorized access to computer Access to computer with criminal or dishonest intent Destroying or damaging property Burglary False Accounting Infringement by making available of copies to the public Publishing obscene articles