EU FP6 LOBSTER European Infrastructure for accurate network monitoring An IST Project http://www.ist-lobster.org/ personal view on the future of ero-day Worm Containment Herbert Bos Vrije Universiteit Amsterdam herbertb _AT_ cs.vu.nl http://www.ist-lobster.org/ 1 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
What is LOBSTER? An IST Project http://www.ist-lobster.org/ • FP6 Specific Support Activity (SSA) • Duration: 09/2004 – 12/06 • Partners – FORTH – Vrije Universiteit Amsterdam – TNO ICT – CESNET – UNINETT – FORTHnet – ALCATEL – TERENA – Symantec? 2 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
What is LOBSTER? An IST Project http://www.ist-lobster.org/ • European Infrastructure for accurate network monitoring • Allows one to perform pan-European monitoring – across organisations • High-speed – specialised network cards – also: common NICs • Why? – traffic classification – security • worms • DDoS – performance – billing – management 3 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Privacy An IST Project http://www.ist-lobster.org/ ? e r u c t u r t s a r f n i g n i r o t i n o m d e r a h ! ? s y a c a v • i r p t u o b a t a h � w 4 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
What is LOBSTER? An IST Project http://www.ist-lobster.org/ • Data owners control – which users may access which data – very flexible 5 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Passive Monitoring and Security An IST Project http://www.ist-lobster.org/ • Intrusion Detection – Are any of my computers compromised? – Is there any attacker trying to intrude into my network? • Large-scale Attack Detection – Detection of Epidemics – DoS Attack detection (e.g., detect sharp increases in TCP/SYN packets) – Zero-day worm detection • e.g., detect lots of identical packets, never seen before, from several sources to several destinations • e.g., unusual no. of connections from a single port to unique destinations • e.g., detect worm characteristics – such as NOP sleds: long sequences of executable code • Network Telescopes – monitor unused IP addresses – observe victims of DoS attacks • “back-scatter” traffic – observe infected hosts – port scans 6 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Zero-day worm containment An IST Project http://www.ist-lobster.org/ • Why do we need it? – detect something new is on the loose – worms spread too fast for human intervention • Different worms in different forms – fast �� slow – polymorphic �� immutable – wide spread �� narrow spread – stealth �� plain – multi-vector �� uni-vector • Worm structure exploit payload 7 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
• can be fast (certainly flow-based) Two tasks • protects many hosts An IST Project http://www.ist-lobster.org/ • Spot the bad guys • handles polymorphism – network-based • content-based: EarlyBird • can be very accurate • flow-based: VirusThrottling (no false positives) – host-based • may handle polymorphism • honeypots • handles polymorphism • end-users (systrace) • Stop them! • protects many hosts – filters for networks • snort • polymorphism • VirusThrottle – filters for hosts • few false positives • some polymorphism? • Self-Certifying Alerts 8 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
• false positives Two tasks • what to do with encryption? An IST Project http://www.ist-lobster.org/ • Spot the bad guys • false positives – network-based • content-based: EarlyBird • slow • flow-based: VirusThrottling • needs a certain amount of luck – host-based • need real services for accuracy • honeypots • false positives • end-users (systrace) • Stop them! • encryption/polymorphism will kill us – filters for networks • snort • false positives • VirusThrottle – filters for hosts • pretty slow • can we rely on end-users? • Self-Certifying Alerts 9 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
My conclusion (1/4) An IST Project http://www.ist-lobster.org/ • detection – network-based • behaviour-based – first indication • content-based: – weed out known and old threats – first indication for new threats – host-based • inaccurate behaviour based: first indication • accurate behaviour based: – zero-day detection – verification • should not handle full streams 10 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
My conclusion (2/4) An IST Project http://www.ist-lobster.org/ • blocking – network-based • behaviour-based: – no (unless exceptional circumstances) • content-based: – weed out known and old threats – first indication for new threats – host-based • good place for filtering, but scope of protection limited • end-host, so filtering should be fairly efficient 11 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
My conclusion (3/4) An IST Project http://www.ist-lobster.org/ • future of network-based content inspection for zero-day worm detection 12 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
My conclusion (4/4) An IST Project http://www.ist-lobster.org/ • passive monitoring still needed, but role is changing – redirect traffic – sample traffic – first-pass detection – first-pass filtering – behaviour-based detection • explore – multi-tier detection – multi-tier filtering – integrated approaches – cocktail-drugs for Internet diseases? 13 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Argos Emulator noah An IST Project http://www.ist-lobster.org/ Fingerprinting zero-day attacks and using advertised honeypots (or: guarding the heifer without falling asleep) 14 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Argos Overview noah An IST Project http://www.ist-lobster.org/ • Platform for next generation honeypots – High-interaction, advertised, safe • Detection of most common vulnerabilities – Control, code injection, function argument attacks • Emulate + protect entire PC systems – OS agnostic, run on commodity hardware • Generate host and network intrusion prevention signatures – Protect even uncooperative users • Joint development with Dutch DeWorm project (VU) 15 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Argos Overview noah An IST Project http://www.ist-lobster.org/ Applications Forensics Guest OS Argos emulator Detect attack Host OS and log state Signature NIC Signature Correlate post-processing data Log 16 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Argos Overview noah An IST Project http://www.ist-lobster.org/ Applications Forensics Guest OS Argos emulator Detect attack Host OS and log state Signature NIC Signature Correlate post-processing data Log 17 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Development up to Present noah An IST Project http://www.ist-lobster.org/ • Based on the Qemu emulator • Track network data throughout execution • Detect illegal uses of network data – Jump targets, function pointers, instructions, system call arguments • Forensics to generate signatures – Export emulator state, inject “forensics” shellcode skip boring details 18 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Network Data Tracking noah An IST Project http://www.ist-lobster.org/ • Tagging network data as “tainted” EAX EBX EBX ECX EDX RAM PORT I/O Virtual NIC 19 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Network Data Tracking noah An IST Project http://www.ist-lobster.org/ • Tagging network data as “tainted” EAX EBX EAX EBX ECX EDX RAM • Tracking “tainted” data – ALU operations ADD EAX, EBX 20 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Network Data Tracking noah An IST Project http://www.ist-lobster.org/ • Tagging network data as “tainted” EAX EBX EAX EBX ECX EDX RAM • Tracking “tainted” data – ALU operations ADD EAX, EBX XOR EBX, EBX 21 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Network Data Tracking noah An IST Project http://www.ist-lobster.org/ • Tagging network data as “tainted” EAX EAX EBX ECX EDX RAM • Tracking “tainted” data – ALU operations – MMU operations A ADD EAX, EBX XOR EBX, EBX ST A, EAX 22 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Identifying Attacks noah An IST Project http://www.ist-lobster.org/ • Jump targets EAX EAX EBX ECX EDX RAM JMP EAX A STACK ALERT 23 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Identifying Attacks noah An IST Project http://www.ist-lobster.org/ • Jump targets • Function calls EAX EAX EBX ECX EDX RAM JMP EAX CALL EAX A STACK ALERT 24 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Identifying Attacks noah An IST Project http://www.ist-lobster.org/ • Jump targets • Function calls EAX EAX EBX ECX EDX RAM • Returns JMP EAX CALL EAX RET A STACK ALERT 25 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Identifying Attacks noah An IST Project http://www.ist-lobster.org/ • Jump targets • Function calls EAX EAX EBX ECX EDX RAM • Returns JMP EAX CALL EAX • Code injection RET JMP A A STACK ALERT 26 Herbert Bos, VU, http://www.cs.vu.nl/~herbertb
Recommend
More recommend
