Upload
others
View
7
Download
0
Embed Size (px)
Citation preview
1
CS242 Computer Networks Department of Computer Science Wellesley College
Operational Security Firewalls and Intrusion Detection
Firewalls 25-2
Speaking Frankly The Internet is not a very safe place
o From our network administrator’s point of view, the world divides into two camps:
o Us - good; able to access local resources and
o Them - suspicious; access must be carefully scrutinized and perhaps restricted.
Firewalls*
*A firewall isolates an organizations internal network from larger Internet, allowing some packets to pass, blocking others.
Firewalls 25-3
Administered Network
Public Internet
firewall trusted “good guys” untrusted “bad guys”
A sense of false security ... o In theory, only
authorized traffic, as defined by local security policy, is allowed to pass.
o Of course the firewall itself is a device connected to the network. It had better be carefully designed and installed or else we are only fooling ourselves.
Firewalls 25-4
2
Firewalls come in three flavors o Traditional packet filters
exam each datagram in isolation at the point of entry/exit.
o Stateful filters track TCP connections, and use this knowledge to make filtering decisions.
o Application gateways are application-specific servers through which all application data must pass.
Firewalls 25-5
Traditional (stateless) packet filters o The internal network is connected to Internet via router
firewall which filters packet-by-packet.
o Filtering decisions typically based on: IP source or destination address; Protocol type in IP datagram field; TCP or UDP source and destination port; TCP flag bits (SYN, ACK, etc.); ICMP message type.
Firewalls 25-6
Firewalls 25-7
Policy decisions Policy Firewall Setting
No outside Web access. Drop all outgoing packets to any IP address, port 80
No incoming TCP connections, except those for institution’s public Web server only.
Drop all incoming TCP SYN packets to any IP except 130.207.244.203, port 80
Prevent Web-radios from eating up the available bandwidth.
Drop all incoming UDP packets - except DNS and router broadcasts.
Prevent your network from being used for a smurf DoS attack.
Drop all ICMP packets going to a “broadcast” address (e.g. 130.207.255.255).
Prevent your network from being tracerouted
Drop all outgoing ICMP TTL expired traffic
We could get tricky o And base our policy on a
combination of addresses and port numbers.
o For example, our router could filter all Telnet datagrams (port 23) except those going to and coming from a list of specific IP address.
o This allows Telnet connections to and from hosts on the allowed list.
o However, ...
Firewalls 25-8
3
Filtering TCP handshakes
Firewalls 25-9
o Filtering can be based on whether or not the TCP ACK bit is set.
o This lets internal clients connect to external servers, but ...
o ... prevents external clients from connecting to internal servers.
Access control list for router interface*
Firewalls 25-10
action source
address dest
address protocol
source port
dest port
flag bit
allow 222.22/16 outside of 222.22/16
TCP > 1023 80 any
allow
outside of 222.22/16
222.22/16
TCP 80 > 1023 ACK
allow 222.22/16 outside of 222.22/16
UDP > 1023 53 ---
allow
outside of 222.22/16
222.22/16
UDP 53 > 1023 ----
deny all all all all all all
*Table of rules, applied top to bottom to incoming packets: (action, condition) pairs.
Problems with stateless filters o Although restrictive, the access control list in the previous
table allows packets arriving from the outside with ACK=1 and source port 80, even when no TCP connection has been established.
o Such packets could be used by attackers in attempts to
crashed internal systems with malformed packets, carry out denial-of-service attacks, or map the internal network.
Firewalls 25-11
action source address
dest address protocol
source port
dest port
flag bit
allow
outside of 222.22/16
222.22/16 TCP 80 > 1023 ACK
Stateful packet filters o Stateful filters track all ongoing TCP connections in a
connection table. o The firewall observes the beginning of a new connection
(SYN, SYNACK, and ACK); and it can observe the end of the connection with it sees a FIN packet.*
Firewalls 25-12
*The firewall can (conservatively) assume that the connection is over when it hasn’t seen any activity for say 60 seconds.
source addr dest addr sourceport dest port 222.22.1.7 37.96.87.123 12699 80
222.22.93.2 199.1.205.23 37654 80 222.22.65.143 203.77.240.43 48712 80
4
Augmented access control list for stateful filter
Firewalls 25-13
*ACL augmented to indicate need to check connection state table before admitting packet
action source
address dest
address proto source port
dest port
flag bit
check conxion
allow 222.22/16 outside of 222.22/16 TCP > 1023 80
any
allow
outside of 222.22/16
222.22/16 TCP 80 > 1023 ACK x
allow 222.22/16 outside of 222.22/16 UDP > 1023 53 ---
allow
outside of 222.22/16
222.22/16 UDP 53 > 1023 ----
x
deny all all all all all all
So far, so good, but suppose now that ...
Firewalls 25-14
o ... Wellesley wants to provide Telnet services to a restricted set of internal users, as opposed to IP addresses) ...
o ... and suppose Wellesley wants such privileged users to authenticate themselves first before being allowed to create a Telnet session to the outside world.
*Such tasks are beyond stateful filters. The identity of internal users is an application-layer data and is not included in the IP/TCP/UDP headers.
Application gateway
Firewalls 25-15
o An application gateway is an application-specific server through which all application data must pass.
o It looks beyond IP/TCP/UDP headers to make policy decisions based on application data.
o We design a firewall that allows only a restricted set of internal users to Telnet outside and prevents all external clients from Telneting inside.
host-to-gateway telnet session
gateway-to-remote host telnet session
application gateway
router and filter
To do this, we must ...
Firewalls 25-16
1. Require all Telnet users to Telnet through the application gateway.
2. For authorized users, gateway sets up Telnet connection to dest host. Gateway relays data between 2 connections
3. Router filter blocks all telnet connections not originating from gateway.
application gateway
host-to-gateway telnet session
router and filter
gateway-to-remote host telnet session
5
Intrusion detection systems
Firewalls 25-17
o Packet filtering: operates on TCP/IP headers only; no correlation check among sessions.
o To detect many attacks, we need a deep packet inspection, e.g., check character strings in packet against database of known virus strings.
o Additionally we may wish to examine correlation among multiple packets to detect: port scanning; network mapping; DoS attack.
Multiple IDS sensors
Firewalls 25-18
Web server FTP
server
DNS server
Internet
demilitarized zone
Firewall
IDS sensors
Internal network
Application gateway
Course grain classification o Signature-based IDS
maintains an database of attack signatures, sniffs every packet, comparing contents with tis database.*
o Anomaly-based IDS creates a traffic profile in normal operation, then looks for statistically unusual packet streams.**
Handshake pitfalls 18-19
*Most common, but completely blind to new attacks. Subject to false positives. **Can potentially detect new attacks, but often difficult to distinguish between normal traffic and statistically unusual traffic.