NetPass and Northwestern By Julian Y. Koh As told by Robert Vance NUIT-Telecom & Network Services

Outline A Brief History Past Tools and Solutions What is NetPass? How Does NetPass Work? What Will NetPass Become?

A Brief History Pre-2003 –Relatively few virus/worm outbreaks –Quickly contained –Slowly increasing frequency And then……

History - Winter 2003 MS SQL Slammer Worm –Aggressive scanning on TCP Port 1434 –<30 infected hosts crippled over half the network –Still quickly contained

History - Summer/Fall 2003 Blaster Worm –Exploited DCOM RPC hole –Scanned on TCP port 135 Welchia Worm –Patched Blaster DCOM hole –Scanned on TCP ports 135 and 80 –Opened backdoor port 707 –Aggressive ICMP pinging to find hosts

History - Winter Viruses –SoBig –Beagle –NetSky –Backdoors used for spam proxying!

History - Spring 2004 Sasser Worm –Exploited LSASS hole –Scanned on TCP port 445 Gaobot/Agobot –Rise of the Botnet –IRC command/control channel –Scanned for previous worm backdoors –Denial of Service attacks swamp Internet connectivity

Past Tools and Solutions Turning Off Ports –Disruptive to users –No easy self-fixing or information provided –Machine can move Disabling NetIDs –Very disruptive

Past Tools and Solutions NUSA –Allowed tech support admins to receive automated reports and reactivate ports NetReg –Associated NetID with MAC address via DHCP –Rudimentary port scanning

Limitations of NetReg Relied on DHCP for quarantining Still had to shut off ports Problem machines could move ports to regain connectivity

What is NetPass? Layer 2 quarantine Selective access Host-based registration –Associate NetID with MAC address Vulnerability/Infection scanning Per-event per-network self-remediation instructions Integration with other systems

How Does NetPass Work? General Principles –All ports default to QUAR network –Same DHCP server, DNS server, and IP addresses for QUAR and UNQUAR networks –Traffic routing depends solely on QUAR/UNQUAR switch port assignment –Access allowed to certain Web sites Windows Update, Symantec, etc.

NetPass Network Diagram DHCP Server Internet!! ResNet Computer Switch Router VLAN 200 NetPass Server VLAN 100 External IP UNQUAR VLAN 200 QUAR VLAN 100

NetPass User Experience User Connects Scan Pass Scan? Already Scanned? User Disconnects Move to QUAR Remediate No Yes Log In No Move to UNQUAR Yes

Additional Capabilities PQUAR - Permanent Quarantine –Used instead of shutting off ports PUNQUAR - Permanent Unquarantine –Used for manually registered devices

Interesting Situations Cookies required Machine must source network traffic soon after bringing up Ethernet link –Effect: user must launch web browser to force NetPass to recognize the machine Firewalls –Scan can take up to 1 minute

Interesting Situations Hublet/Switchlet –NetPass sees multiple MAC addresses –All MAC addresses will have to be registered before port will be moved to UNQUAR Router or NAT device –NetPass will only see 1 MAC address –If client machines move to other ports, they will have to be scanned again

NetPass Administration Must connect to VPN from dorms first All Rescons and SC cons should have access to QuarControl and Manual Registration Note: with great power comes great responsibility! Remember to log out!!!

NetPass Futures Snort IDS integration –Automatic QUAR on suspicious network traffic Software client integration –More accurate than external scanning –Eliminates firewall problem

Questions?