Stealth Network Strategies: Offensive and Defensive Mark Loveless RAZOR Security BindView Corporation

About Me  AKA Simple Nomad   Currently Sr. Security Analyst for BindView’s RAZOR Team 

About This Presentation  Assume basics –Understand IP addressing –Understand basic system administration  Tools –Where to find them –Basic usage  A “Network” point of view

Network Mapping  Active  Passive

Active Mapping  Techniques –ICMP Sweeps –Firewalk –Nmap  Defenses –Tight firewall rules –Block most ICMP –Block packets with TTL of 0 or 1

Passive Mapping  Techniques –Manual via Public sources –Automated via Siphon  Defenses –Strong policy regarding publishing/posting –Egress filtering and decent ISP

Distributed Tools and Stealth Techniques  Attack Models  Good Guy Usage

Basic Distributed Attack Models  Attacks that do not require direct observation of the results  Attacks that require the attacker to directly observe the results

Basic Model ServerAgent Client Issue commands Processes commands to agents Carries out commands

More Advanced Model TargetAttacker Forged ICMP Timestamp Requests ICMP Timestamp Replies Sniffed Replies

Even More Advanced Model Target FirewallFirewall

Even More Advanced Model Target FirewallFirewall Upstream Host

Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Master Node

Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Attacks or Probes Master Node

Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

Even More Advanced Model Target Attack Node Sniffed Replies Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

Even More Advanced Model Target Attack Node Sniffed Replies Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

Good Guy Usage  VPN technology  Remote managed networks

The Hype of DDoS  What is DDoS?  Stealth Techniques Used within DDoS

Defenses Against Distributed Attacks  Ingress and Egress filtering  Usage of IDS inside and out  Analysis of network traffic and logs

Protocol Fun  Traffic Pattern Masking  Network Stegnography

Traffic Pattern Masking  Techniques –SMTP patterns –DNS patterns –Web traffic  Defenses –Egress filtering –Logging –Study of logs and network dumps

Network Stegnography  Techniques –HTTP –SMTP –Packet combinations  Defenses –Egress filtering –More logging, etc

Questions….  For followup: –Work –Play