Intro to Networking for the Insufficiently Paranoid Mihai - PowerPoint PPT Presentation

Intro to Networking for the Insufficiently Paranoid Mihai Christodorescu CS 642 – Spring 2007 mihai@cs.wisc.edu Original slides by Jonathon Giffin

Internet: Attack and Defenses � Makes communication easier and faster � Makes attacks easier and faster Today’s topics: � Short introduction to networking � Network-level attacks � Network-level defenses 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 2

Switched Networks � A network can be defined recursively as... � two or more nodes � two or more networks connected by a link, or connected by two or more nodes 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 3

Layering Motivation � Use abstractions to hide complexity � Abstraction naturally lead to layering � Alternative abstractions at each layer Application programs Request/reply Message stream channel channel Host-to-host connectivity Hardware 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 4

7-Layer Architecture � Early inter-networks were the result of gluing together dissimilar networks End host � The International Standards Application Organization came up with a model for Presentation describing interconnect between Session networks (Open Systems Interconnect) Transport Network Data link Physical 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 5

Physical Layer � Raw bits over a communications link � Examples: End host � Ethernet (Electrical and connector) Application � Wireless IEEE-802.11a/b/g/n Presentation � Cable Modem Session � DSL Transport Network Data link Software Hardware Physical Think of this as an Ethernet card and cable and vendor-specific APIs 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 6

Data link layer � Frames of data from one device to another directly-attached device End host � Example: Ethernet frames Application � Collision detection, flow control Presentation � Discovery of new devices Session Transport Network Multi-hop Single-hop Data link Example Ethernet address 08:00:2b:e4:b1:02 Physical Frame Preamble FrameCRC Payload Think of this as the FRAMES from your cable modem to your PC 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 7

Network layer � Packets delivered multiple hops � Addressed to a globally-unique, End host aggregatable address Application � Routed to the next hop Presentation Session Transport Reliable Best Effort Network Typical IPv4 address: 128.105.2.10 Data link IPHeader Physical IP Payload Think of this as a packet from a web server to your computer 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 8

Transport layer � End-to-End in-order delivery of exactly one copy of each message (TCP) End host � Retransmits lost packets (TCP) Application � Holds received packets until Presentation requested by the application Session Connection (UDP) Message Transport � Examples: TCP, UDP Network Data link TCP Header Physical TCP Payload Think of this as a packet from a web server to your computer 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 9

Session layer � Initiates and monitors whole sessions End host � Translates host names to host Application addresses Presentation User � Allocates ports and sockets Kernel Session Transport Network Data link Physical 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 10

Presentation layer � Translates from standard network data representation End host to local Application App � Handles encryption, Library Presentation compression, and OS- Session specific transmogrifications Transport Network Data link Physical 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 11

Application layer � Requestor for network service End host � Examples: Bittorrent, FTP, Firefox, Application The SIMS online, Quake, AIM, Presentation Sendmail, . . . Session Transport Network Data link Physical 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 12

Typical Routed Delivery Path End host End host Logical Messages Application Application Presentation Presentation Session Session Control Messages Transport Transport Network Network Network Network Data link Data link Data link Data link Physical Physical Physical Physical One or more nodes within the network 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 13

IP Packet Header � Connectionless (datagram-based) � Best-effort delivery 0 4 8 16 19 31 (unreliable service) Version HLen TOS Length Ident Flags Offset � packets are lost TTL Protocol Checksum � packets are delivered SourceAddr out of order DestinationAddr Pad Options (variable) � duplicate copies of a (variable) Data packet are delivered � packets can be delayed for a long time � Datagram format 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 14

TCP Overview � Byte-stream � app writes bytes � TCP sends segments � app reads bytes Application process Application process Write Read … bytes … bytes TCP TCP Send buffer Receive buffer … Segment Segment Segment Transmit segments 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 15

TCP Protocol Header � Connection oriented � Reliable delivery 0 4 10 16 31 SrcPort DstPort � Flow control: keep sender SequenceNum from overrunning receiver Acknowledgment HdrLen 0 Flags AdvertisedWindow � Congestion control: keep sender from overrunning Checksum UrgPtr network Options (variable) Data 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 16

Normal Connection Establishment The Server sets up retransmission timers, allocates receive buffers, etc. Imagine a web server that can handle 12,000 connections. If the process fails, a timeout occurs after 120 seconds, freeing up the resources. Note: SYN packets are very small and take up very little bandwidth. Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 17

State Transition Diagram Not Connected CLOSED Active open/SYN Passive open Close Close Waiting for Connection LISTEN SYN/SYN + ACK Send/SYN TCP Handshake SYN/SYN + ACK SYN_RCVD SYN_SENT ACK SYN + ACK/ACK Connected Close/FIN ESTABLISHED Close/FIN FIN/ACK FIN_WAIT_1 CLOSE_WAIT FIN/ACK ACK + FIN/ACK ACK Close/FIN FIN_WAIT_2 CLOSING LAST_ACK Closing the Connection Timeout after two ACK ACK segment lifetimes FIN/ACK TIME_WAIT CLOSED 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 18

Attack #1: SYN Flood � Each SYN creates one half-open connection � Half-open connections take minutes to time-out � Servers have finite connection tables � Perpetrator would be easily caught (Source IP) � Unless SourceIP is spoofed � See: CERT Advisory CA-1996-21 http://www.cert.org/advisories/CA-1996-21.html � 100 SYN packets per second fits in 56 Kbps Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 19

Spoofed IP Address The SYN/ACK is delivered to the fake (spoofed) IP Address. The attacker doesn’t see it, and doesn’t care. (Backscatter) Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 20

Example SYN Flood Attacks � February 2000 � Victims included CNN, eBay, Yahoo, Amazon � Attackers (allegedly) used simple, readily available tools (script-kiddies) � Law enforcement unable (unwilling?) to help � Under-age perpetrators have blanket immunity � October 2002 � Root DNS servers � 9 of 13 servers brought down 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 21

22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 22

Attack #2: Distributed DoS � Rather than filling connection table, fill all available bandwidth � Infect innocent bystanders (zombies) � Zombies listen (e.g. on IRC channel) for attack command (or simply attack at will) � Attacker need not have high bandwidth connection Typical Program: EvilGoat EvilBot Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 23

Example Distributed DOS Attack � 6 attacks on 5 different days � One attack lasted for 17 hours � 474 infected windows PC as zombies � 2.4 billion malicious packets Legitimate throughput Time Graphics from http://grc.com/dos/grcdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 24

Flood-based Distributed DoS Attacks � Coordinate zombies to attack with big packets � Use up “last-hop” bandwidth � “Last-hop” router discards packets indiscriminately � Zombies need not spoof addresses Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 25

Recent Twist - Reflection � Many routers accept connections on port 179 (Border Gateway Protocol) � Although any big server and any port it listens on will work � Send a SYN to a server, claiming it came from the victim � The server will send a SYN/ACK to the victim � And then re-transmit several times before giving up (typically about 4X) 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 26

Reflection Mechanism Graphics from http://grc.com/dos/drdos.htm 22 March 2007 Mihai Christodorescu - UW CS 642 - Spring 2007 27