Dependable Intrusion Tolerance March 2002 Magnus Almgren, Alfonso Valdes SRI International Acknowledgements Research sponsored under DARPA Contract N C Views presented are those of the authors and do not represent the views of DARPA or the Space and Naval Warfare Systems Center

Outline t Background t System Components t The Single Proxy t Example t Validation t Performance t Stopping Code Red t Future Work

Background t Intrusion Tolerant Server

Background t Intrusion Tolerant Server u Redundancy & Diversity

Background t Intrusion Tolerant Server u Redundancy & Diversity u Hardened Proxy l StackGuard l Online Verifiers l Small Code Base

Background t Intrusion Tolerant Server u Redundancy & Diversity u Hardened Proxy l StackGuard l Online Verifiers l Small Code Base u HIDS/NIDS/app-IDS l EMERALD/Snort

System Components t Application Servers u Solaris, Win2k, RedHat, FreeBSD t IDS t Proxy u RedHat-6.2 u Our own code base MS Win2k IIS Solaris 8 (Sparc5) Apache eXpert-BSM RedHat 7.1 iPlanet FreeBSD 4.2 Apache App-IDS eXpert-Net eBayes-TCP eBayes-Blue Snort RedHat 6.2 Proxy eAggregator C-R

Proxy in Detail e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Regime Manager Alert Manager 1,12,23,34,4 4,3 Policy/Regime reconnaissance

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager web attack Proxy Server Regime Manager

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime web attack Regime Manager

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager web answer

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Policy/Regime Regime Manager

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Regime Manager Policy/Regime Block client Block URI

Simple Example e-Aggregator Challenge Response Repair Manager Proxy Server Alert Manager 1,12,23,34,4 4,3 Regime Manager Policy/Regime

Plans for Validation t Performance u Preliminary Results t Resistance to attacks u Compile a list of existing Web exploits u Run these against system u Problem: A very new attack, which we might not have thought about l Assembly of Complementary Mechanisms l Red Teaming?

Performance Measurement 1)Round-trip time measured through the proxy u Regime 1 — 4 2)Round-trip time measured directly for each application server Asking for index.html with all included images and measured round-trip time. About 34 kb in 9 requests.

Round-trip time 10 simultaneous clients

Response vs Number of Clients

Outline General principles Architecture overview Proxy functionality t Stopping Code Red t Summary

Stopping Code Red (and NIMDA) Proxy Bank IDS Appliance IIS 1. 3/4 of Code Red attempts miss the IIS server 2. IDS detects attempt. System invokes agreement mode 4. Clients get valid content while compromised server is rebuilt 3. In case of a successful infection, corrupt content is detected and reinfection attempts are blocked

Dependable Intrusion Tolerance t Intrusion Detection to Date u Seeks to detect an arbitrary number of attacks in progress u Relies on signature analysis and probabilistic (including Bayes) techniques u Response components immature u No concept of intrusion tolerance t New Emphasis u Detection, damage assessment, and recovery u Finite number of attacks or deviations from expected system behavior u Seek a synthesis of intrusion detection, unsupervised learning, and proof-based methods for the detection aspect u Concepts from fault tolerance are adapted to ensure delivery of service (possibly degraded)

Summary t Developing an adaptable intrusion tolerant server architecture t General Principles: u Hardened proxy u Redundant capability with diverse implementation u Adaptive response t A variety of IDS, symptom detectors, and on-line verifiers provide situational awareness t Stepped policy response enforces content agreement in suspicious situations

Future directions t Refine Alert Manager t Multiple proxies t Validate with existing exploits t Dynamic content