T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings A Stateful Inspection of FireWall-1 Thomas Lopatic, John McDonald TÜV data protect GmbH Dug Song CITI at the University of Michigan data protect

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Overview Architecture of FireWall-1 Attacking the firewall’s state I FWZ encapsulation Attacking the firewall’s state II Attacking authentication between firewall modules Hardening FireWall-1 The big picture

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Stateful Inspection I virtual defrag pre-inspection “connections” chain of fragments ACCEPT virtual machine ACCEPTREJECT “connections” “pending”

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Stateful Inspection II UDP replies accepted C Cany internal client external server accepted UDP packet S UDP “connections” from a client, port C to a server, port S + wildcard port

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Stateful Inspection III “PORT 192,168,0,2,4,36” data connection “PASV” > 1023 “ (172,16,0,2,4,36)” FTP server FTP client data connection

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Topology Solaris Windows NT OpenBSD Nokia IP-440 Linux Hub Victim networkHostile network

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Fastmode Services non-SYN packets accepted Source port = fastmode service Destination port = fastmode service Stealth scanning (FINs,...) x Internet non-SYNs

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FTP “PORT” Parsing “PORT 172,16,0,258,p1,p2” “PORT 172,16, ,2,p1,p2” = * ( ) * ( ) data connection Application: bounce attack

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FTP “PASV” Handling “XXXXXXXXXXXXXX227 (172,16,0,2,128,7)” Invalid command giv 227 (172,16,0,2,128,7) Advertise small Maximal Segment Size Server replies split en: XXXXXXXXXXXXXX

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings One-way Connections I TCP header TCP payload TCP header + payload ACCEPT DROP Intranet established one-way connection

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings One-way Connections II open one-way connection datagram A datagram B open one-way connection retransmission of B [...]

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FWZ Encapsulation I modified IP header IP payload encapsulation info (obfuscated) + 1. original d-address, original protocol 2. d-address = firewall, protocol = 94 VPN tunneling protocol Decapsulation without decryption or authentication Cannot be disabled

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FWZ Encapsulation II Key to spoofing attacks 10.x.x.x s-addr = d-addr = d-addr = IP header encapsulation info

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Fake “PORT” Commands FTP client s-addr = d-addr = d-addr = IP header encapsulation info “PORT 172,16,0,2,128,7” TCP header + payload fake “PORT” packet

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings RSH Error Connections I “error port is 1025” error connection 514 < RSH server RSH client in “connections” in “pending” Reversed matching

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings RSH Error Connections II s-addr:s-port d-addr:magic seq : :magic s-addr:error-port d-addr:magic protocol : :magic 6 (TCP) s-addr:s-port d-addr:magic seq : :magic 6 = seq + 1 = TCP seq = 5 SYN packet #2 (port info)

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Fake UDP Requests DNS client s-addr = d-addr = d-addr = IP header encapsulation info s-port = 161 d-port = 53 UDP header fake DNS request

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FWZ Encapsulation III Key to non-routable addresses 10.x.x.x s-addr = d-addr = d-addr = IP header encapsulation info

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Anti-Spoofing Protection I s-addr = d-addr = s-port = any d-port = fake DNS request 2. tunnel to firewall s-addr = d-addr = s-port = 161 d-port = d-addr =

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Anti-Spoofing Protection II s-addr = d-addr = d-addr = s-port = 53 d-port = fake DNS request 2. tunnel to firewall s-addr = d-addr = s-port = 161 d-port = d-addr =

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FireWall-1 Modules Management module GUI Filter module Port 256/TCP Security policy, status, logs Port 258/TCP Authentication methods S/Key, FWN1, FWA1

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Inter-Module Protocol Version IP addresses Command Required authentication Management module Filter module Authentication Arguments, Result

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings S/Key Authentication Hash n (x) = Hash(Hash(... Hash(x))) = Hash(Hash n- 1 (x)) n times Seed x (password hash) Hash 100 (x) Index = 99 Hash 99 (x) Index = 1 Hash 1 (x)... Calculate seed y, Hash 100 (y) “y = MakeSeed(time(NULL))” Attack: brute force

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FWN1 Authentication Random number R 1 S 1 = Hash(R 1 + K) Random number R 2 S 2 = Hash(R 2 + K) Shared key K (“fw putkey”) Attack: choose R 2 = R 1, so that S 2 = S 1

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings FWA1 Authentication Random number R 1 S 1 = Hash(R 1 + K) Random number R 2 S 2 = Hash((R 1 ^ R 2 ) + K) Shared key K (“fw putkey”) Attack: choose R 2 = 0, so that R 1 ^ R 2 = R 1 and S 2 = Hash((R 1 ^ R 2 ) + K) = Hash(R 1 + K) = S 1 To be solved: encryption

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Hardening I Disable implicit rules DNS control connections ICMP Restrictive access rules no “any” sources or destinations deny broadcast / multicast addresses “minimal privilege” Properly configure anti-spoofing mechanism Filter protocol 94 (e.g. IP Filter)

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Hardening II Different (virtual) IP addresses for public services Restrict control connections FWA1 authentication VPN technology More than one line of defense!

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Fixes by Check Point Solutions by Check Point available today at

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Problems in Inspection Unreliable / unauthenticated input Layering restrictions on inspection Layering violations in inspection Ambiguous end-to-end semantics

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Example: Airport Security Unreliable / unauthenticated input Examining baggage tags Layering restrictions on inspection Examining shape, size, weight Layering violations in inspection Parallelizing bag content inspection Ambiguous end-to-end semantics Checking for known contraband

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Classification of the Attacks Unreliable / unauthenticated input TCP fastmode Layering restrictions on inspection FWZ VPN encapsulation Layering violations in inspection FTP data connection handling unidirectional TCP data flow RSH error connection handling Ambiguous end-to-end semantics Parsing of FTP “PORT” commands

T. Lopatic, J. McDonald, D. Song, "A Stateful Inspection of FireWall-1", Black Hat Briefings Thanks. Thomas Lopatic John McDonald Dug Song