CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Network Monitoring

CIT 380: Securing Computer SystemsSlide #2 Active Responses by Network Layer Data Link: Shut down a switch port. Only useful for local intrusions. Rate limit switch ports. Network: Block a particular IP address. –Inline: can perform blocking itself. –Non-inline: send request to firewall. Transport: Send TCP RST or ICMP messages to sender and target to tear down TCP sessions.

Active Responses by Network Layer Application: Inline IPS can modify application data to be harmless: /bin/sh -> /ben/sh CIT 380: Securing Computer SystemsSlide #3

CIT 380: Securing Computer SystemsSlide #4 Host IDS and IPS Anti-virus and anti-spyware –AVG anti-virus, SpyBot S&D Log monitors –swatch, logwatch Integrity checkers –tripwire, osiris, samhain –Monitor file checksums, etc. Application shims –mod_security

CIT 380: Securing Computer SystemsSlide #5 Evading IDS and IPS Alter appearance to prevent sig match –URL encode parameters to avoid match. –Use ‘ or 783>412-- for SQL injection. Alter context –Change TTL so IDS sees different packets than target hosts receives. –Fragment packets so that IDS and target host reassemble the packets differently.

CIT 380: Securing Computer SystemsSlide #6 Fragment Evasion Techniques Use fragments –Older IDS cannot handle reassembly. Flood of fragments –DoS via heavy use of CPU/RAM on IDS. Tiny fragment –Break attack into multiple fragments, none of which match signature. –ex: frag 1:“cat /etc”, frag 2: “/shadow” Overlapping fragments –Offset of later fragments overwrites earlier fragments. –ex: frag 1: “cat /etc/fred”, frag 2: offset=10, “shadow” –Different OSes deal differently with overlapping.

CIT 380: Securing Computer SystemsSlide #7 Web Evasion Techniques URL encoding –GET /%63%67%69%2d%62%69%6e/bad.cgi /./ directory insertion –GET /./cgi-bin/./bad.cgi Long directory insertion –GET /junklongdirectorypathstuffhereuseless/../cgi-bin/bad.cgi –IDS may only read first part of URL for speed. Tab separation –GET /cgi-bin/bad.cgi –Tabs usually work on servers, but may not be in sig. Case sensitivity –GET /CGI-BIN/bad.cgi –Windows filenames are case insensitive, but signature may not be.

CIT 380: Securing Computer SystemsSlide #8 Countering Evasion Keep IDS/IPS signatures up to date. –On daily or weekly basis. Use both host and network IDS/IPS. –Host-based harder to evade as runs on host. –Fragment attacks can’t evade host IDS. –Network IDS still useful as overall monitor. Like any alarm, IDS/IPS has –False positives –False negatives

CIT 380: Securing Computer SystemsSlide #9 Key Points Models of IDS: –Anomaly detection: unexpected events. –Misuse detection: violations of policy. IDS Architecture: –Agents. –Director. –Notifiers. Types of IDS –Host: agent on host checks files, procs to detect attacks. –Network: sniffs and analyzes packets to detect intrusions. IDS/IPS Evasion –Alter appearance to avoid signature match. –Alter context to so IDS interprets differently than host.

CIT 380: Securing Computer SystemsSlide #10 References 1.Richard Bejtlich, The Tao of Network Security Monitoring, Addison-Wesley, Matt Bishop, Computer Security: Art and Science, Addison-Wesley, Brian Caswell, et. al., Snort 2.0 Intrusion Detection, Snygress, William Cheswick, Steven Bellovin, and Avriel Rubin, Firewalls and Internet Security, 2 nd edition, The Honeynet Project, Know Your Enemy, 2 nd edition, Addison-Wesley, Richard A. Kemmerer and Giovanni Vigna, “Intrusion Detection: A Brief History and Overview,” IEEE Security & Privacy, v1 n1, Apr 2002, pp Steven Northcutt and Julie Novak, Network Intrusion Detection, 3 rd edition, New Riders, Michael Rash et. al., Intrusion Prevention and Active Response, Syngress, Rafiq Rehman, Intrusion Detection Systems with Snort: Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID, Prentice Hall, Ed Skoudis, Counter Hack Reloaded 2/e, Prentice Hall, Ed Skoudis and Lenny Zeltser, Malware: Fighting Malicious Code, Prentice Hall, 2003.