1. Stealth Network Strategies: Offensive and Defensive Mark Loveless RAZOR Security BindView Corporation

2. About Me  AKA Simple Nomad  http://www.nmrc.org/ http://www.nmrc.org/  Currently Sr. Security Analyst for BindView’s RAZOR Team  http://razor.bindview.com/ http://razor.bindview.com/

3. About This Presentation  Assume basics –Understand IP addressing –Understand basic system administration  Tools –Where to find them –Basic usage  A “Network” point of view

4. Network Mapping  Active  Passive

5. Active Mapping  Techniques –ICMP Sweeps –Firewalk –Nmap  Defenses –Tight firewall rules –Block most ICMP –Block packets with TTL of 0 or 1

6. Passive Mapping  Techniques –Manual via Public sources –Automated via Siphon  Defenses –Strong policy regarding publishing/posting –Egress filtering and decent ISP

7. Distributed Tools and Stealth Techniques  Attack Models  Good Guy Usage

8. Basic Distributed Attack Models  Attacks that do not require direct observation of the results  Attacks that require the attacker to directly observe the results

9. Basic Model ServerAgent Client Issue commands Processes commands to agents Carries out commands

10. More Advanced Model TargetAttacker Forged ICMP Timestamp Requests ICMP Timestamp Replies Sniffed Replies

11. Even More Advanced Model Target FirewallFirewall

12. Even More Advanced Model Target FirewallFirewall Upstream Host

13. Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Master Node

14. Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Attacks or Probes Master Node

15. Even More Advanced Model Target Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

16. Even More Advanced Model Target Attack Node Sniffed Replies Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

17. Even More Advanced Model Target Attack Node Sniffed Replies Attack Node FirewallFirewall Upstream Host Attacks or Probes Replies Master Node

18. Good Guy Usage  VPN technology  Remote managed networks

19. The Hype of DDoS  What is DDoS?  Stealth Techniques Used within DDoS

20. Defenses Against Distributed Attacks  Ingress and Egress filtering  Usage of IDS inside and out  Analysis of network traffic and logs

21. Protocol Fun  Traffic Pattern Masking  Network Stegnography

22. Traffic Pattern Masking  Techniques –SMTP patterns –DNS patterns –Web traffic  Defenses –Egress filtering –Logging –Study of logs and network dumps

23. Network Stegnography  Techniques –HTTP –SMTP –Packet combinations  Defenses –Egress filtering –More logging, etc

24. Questions….  For followup: –Work http://razor.bindview.com/ thegnome@razor.bindview.com –Play http://www.nmrc.org/ thegnome@nmrc.org