Conducting Defensive Information Warfare on Open Platforms 23rd October 2013 – LinuxCon Europe Ben Tullis – (formerly of) LinuxIT (Europe) Ltd.
Ben Tullis - Background ● Professional Linux sysadmin (etc.) for 12+ years ● Worked in several markets: – Independent Software Vendor – UK Government Research: (British Antarctic Survey) – Managed Services Providers – Specialist Linux Consultancy ● Broad experience of Linux and IT security: – ...in the SME Sector – ...in the Outsourced Enterprise Sector
Presentation Topics Defensive Information Warfare on Open Platforms ● Definitions, Threats, Targets, The Basics ● Increasing Network Visibility ● Increasing Host Visibility ● Log Management Tools & Techniques ● Collating and Presenting Security Information ● Focused Distributions
What is Information Warfare? It's a model that helps to achieve good security practice. Comprised of four key elements: 1: Information Resources These resource have intrinsic value to someone: ● Exchange value – how much is it worth? ● Operational value – how useful/important is it?
What is Information Warfare? 2: Players of The Game Offence In this context, the enemy. – Could be anyone with Motive, Means & Opportunity – to launch an attack on an Information Resource One or more of: insiders, hackers, criminals, – corporations, governments, and terrorists Those ever-present “ unknown unknowns” – Defence Everyone else, from individuals to governments – Anyone with Information Resources to protect – In this context, us –
What is Information Warfare? 3: Offensive Operations Their aim is to: Increase the value of an Information Resource to an Offensive player. ● Decrease the value of an Information Resource to a Defensive player. ● Three classes of attack Increased availability of information for the offence e.g. espionage, identity theft, physical theft Decreased integrity of information e.g. tampering, fabrication, perception management Decreased availability of information for the defence e.g. sabotage, denial of service, physical theft
What is Information Warfare? 4: Defensive Operations Their aim is to: Protect Information Resources from these three forms of attack. ● They must: Cost less than the losses that would occur in their absence. ● Six classes of defensive operation Prevention ● Deterrence ● Indications and Warnings ● Detection ● Emergency Preparedness ● Response ●
Random Threats - Can affect anyone equally Examples: ● Malware distribution: – Removable Media – Infected Downloads ● IP Address scanning: Brute-force attacks – Zero-day attacks – e.g. Carna Botnet (420k node bot-net created by using – default passwords) ● Wardriving ● Session Hijacking
Focused Threats - We are the target ● Traditional Network Penetration: – Dictionary Attacks – Off-line Attacks (e.g. Cloudcracker) ● Known Exploits: – Vulnerable Network Services – Privilege Escalation ● Social Engineering
Focused Threats - We are the target Stealthy Devices: Requiring physical access – Dropboxes e.g. ● Pwnie Express ● MiniPwner ● Pwn Pi – Rogue Access Point e.g. ● WiFi Pineapple – Key Stroke Loggers – Miniature Cameras etc.
Defining the Targets They are/will be everywhere.
Defending Information – The Basics ● Good documentation & communication ● Good passwords & security policies ● Appropriate physical security measures ● Well defined change-management procedures ● Apply security patches promptly ● Standardize where possible/appropriate ● Back it all up
Defending Information – The Basics ● Your Monitoring Solution TM – Monitor everything you can think of – Record as many metrics as possible – Review its configuration periodically and... ● ...in response to change ● ...in response to significant incidents – If appropriate, use multiple/parallel systems. ● Availability Monitoring ● Performance Monitoring ● Network Security Monitoring
Increasing Network Visibility - Overview Making the best possible haystack/needle finding machine: – Capture as much network traffic as possible – Scan captured traffic: NIDS – Consider wireless protocols: WIDS – Profile network traffic: ● Record detailed statistical information ● Visualise normal network behaviour ● Facilitates filtering-out of legitimate traffic – Implement anomaly detection
Capturing Ethernet Traffic Often use Switch Mirror Ports (aka. SPAN or Monitor Port) One port receives all traffic sent to/from the other ports. Most smart/managed switches support this feature. Another technique is to use a Network Tap
Capturing Ethernet Traffic Simplest case: ● All traffic passing through the switch is visible at the protective Monitoring Server ● Do not assign an IP address to the capture interface: # ifconfig eth1 up promisc # ifconfig eth1 up promisc
Capturing Ethernet Traffic Redundant System: ● Dual interfaces on all servers: active/active or active/passive ● One capture interface per switch
Capturing Ethernet Traffic Tree Topology - Option 1 – Remote Port Mirroring ● Requires high-end switches. e.g. Cisco, HP, H3C, Alcatel ● Send all captured traffic to a central location for analysis/profiling. ● Upgrade interface links as necessary. ● Uses VLANs to isolate the mirrored traffic. ● Fairly complex to configure.
Capturing Ethernet Traffic Tree Topology - Option 2 – Distributed Monitoring Requires several capture servers Remote servers send back: ● Events & Alerts ● Statistical traffic information ● System log files
Network Intrusion Detection Systems Snort – Passive mode – Intrusion Detection – Inline mode – Intrusion Prevention – Searches network traffic for pattern matches – Rules files updated daily ● Up-to-date VRT rules available immediately to subscribers ● VRT rules freely available to registered users after 30 days ● Community rules under GPL. A subset of the VRT rules ● Third-party rule sets available. e.g. http://www.emergingthreats.net
Network Intrusion Detection Systems Snort – Update rules daily with one of: ● Oinkmaster ● Pulled Pork – Expect to spend some time tuning: ● Main config file: snort.conf ● Rules files ● Ethernet interface configuration e.g. Disable ”Large Receive Offload” and ”Generic Receive Offload” on the collector: ethtool -K eth1 gro off ethtool -K eth1 gro off ethtool -K eth1 lro off ethtool -K eth1 lro off
Network Intrusion Detection Systems Snort – Each rule has an Action associated, e.g. ● Send an alert and log traffic. ● Simply drop the offending packets. (Inline mode) ● Reject the traffic: TCP reset. UDP unreachable. (Inline mode) ● Custom actions & custom log types – Very flexible alerting and logging methods, e.g. ● Text → email alert & Pcap log file ● Syslog alert & logging to database ● Unified2 (recommended, high-performance format)
Network Intrusion Detection Systems Suricata ● IDS/IPS project started in 2009 – Multi-threaded for greater native performance – Unified2 output by default – Protocol detection. Not based on port number – File identification by md5. Extract and save files from traffic – Can use Snort rules and can co-exist – http://suricata-ids.org/
Network Intrusion Detection Systems Bro ● Passive Network Analysis Platform: – IDS features available – require custom scripting. – Detailed statistical log files created – Application-layer transcripts, e.g. HTTP, SSL etc. – Cluster-aware for high-capacity analysis – Scripting engine : Highly extensible – Match MD5 against Team Cymru malware database
Wireless Intrusion Detection Systems ● Current best practice in IEEE 802.11: – Implement WPA2-Enterprise ● RADIUS – e.g. FreeRADIUS ● EAP – Strong Authentication ● hostapd + wpa_supplicant [+ OpenSSL] – Implement IEEE 802.11w ● Management Frames Protected ● We consider two types of attack: – A Rogue Access Point – A De-Authentication Attack
Wireless Intrusion Detection Systems Kismet ● Monitor 802.11 traffic for known attack patterns: – Use additional wireless radios in monitor mode – (optionally) Channel-hop on the channels that you use – Drones can be distributed network-wide – Suitable for embedded use i.e. OpenWRT, DD-WRT etc. – Client can view real-time client list and traffic – Alerts can be sent via syslog – Tap interface permits full 802.11 capture
Wireless Intrusion Detection Systems Kismet 1: Detecting rogue access points Legitimate Clients
Recommend
More recommend
