Conducting Defensive Information Warfare on Open Platforms 23rd - - PowerPoint PPT Presentation

▶
conducting defensive information warfare on open platforms
SMART_READER_LITE
LIVE PREVIEW

Conducting Defensive Information Warfare on Open Platforms 23rd - - PowerPoint PPT Presentation

Oct 11, 2022 291 likes •886 views

Conducting Defensive Information Warfare on Open Platforms 23rd October 2013 LinuxCon Europe Ben Tullis (formerly of) LinuxIT (Europe) Ltd. Ben Tullis - Background Professional Linux sysadmin (etc.) for 12+ years Worked in

slide-1
SLIDE 1

Conducting Defensive Information Warfare

  • n

Open Platforms

Ben Tullis – (formerly of) LinuxIT (Europe) Ltd.

23rd October 2013 – LinuxCon Europe

slide-2
SLIDE 2

Ben Tullis - Background

  • Professional Linux sysadmin (etc.) for 12+ years
  • Worked in several markets:

– Independent Software Vendor – UK Government Research: (British Antarctic Survey) – Managed Services Providers – Specialist Linux Consultancy

  • Broad experience of Linux and IT security:

– ...in the SME Sector – ...in the Outsourced Enterprise Sector

slide-3
SLIDE 3

Presentation Topics

Defensive Information Warfare on Open Platforms

  • Definitions, Threats, Targets, The Basics
  • Increasing Network Visibility
  • Increasing Host Visibility
  • Log Management Tools & Techniques
  • Collating and Presenting Security Information
  • Focused Distributions
slide-4
SLIDE 4

What is Information Warfare?

It's a model that helps to achieve good security practice. Comprised of four key elements: 1: Information Resources

These resource have intrinsic value to someone:

  • Exchange value – how much is it worth?
  • Operational value – how useful/important is it?
slide-5
SLIDE 5

What is Information Warfare?

2: Players of The Game

Offence

–

In this context, the enemy.

–

Could be anyone with Motive, Means & Opportunity to launch an attack on an Information Resource

–

One or more of: insiders, hackers, criminals, corporations, governments, and terrorists

–

Those ever-present “unknown unknowns”

Defence

–

Everyone else, from individuals to governments

–

Anyone with Information Resources to protect

–

In this context, us

slide-6
SLIDE 6

What is Information Warfare?

3: Offensive Operations

Their aim is to:

  • Increase the value of an Information Resource to an Offensive player.
  • Decrease the value of an Information Resource to a Defensive player.

Three classes of attack Increased availability of information for the offence

e.g. espionage, identity theft, physical theft

Decreased integrity of information

e.g. tampering, fabrication, perception management

Decreased availability of information for the defence

e.g. sabotage, denial of service, physical theft

slide-7
SLIDE 7

What is Information Warfare?

4: Defensive Operations

Their aim is to:

  • Protect Information Resources from these three forms of attack.

They must:

  • Cost less than the losses that would occur in their absence.

Six classes of defensive operation

  • Prevention
  • Deterrence
  • Indications and Warnings
  • Detection
  • Emergency Preparedness
  • Response
slide-8
SLIDE 8

Random Threats - Can affect anyone equally

Examples:

  • Malware distribution:

– Removable Media – Infected Downloads

  • IP Address scanning:

–

Brute-force attacks

–

Zero-day attacks

–

e.g. Carna Botnet (420k node bot-net created by using default passwords)

  • Wardriving
  • Session Hijacking
slide-9
SLIDE 9

Focused Threats - We are the target

  • Traditional Network Penetration:

– Dictionary Attacks – Off-line Attacks (e.g. Cloudcracker)

  • Known Exploits:

– Vulnerable Network Services – Privilege Escalation

  • Social Engineering
slide-10
SLIDE 10

Focused Threats - We are the target

Stealthy Devices:

Requiring physical access

– Dropboxes e.g.

  • Pwnie Express
  • MiniPwner
  • Pwn Pi

– Rogue Access Point e.g.

  • WiFi Pineapple

– Key Stroke Loggers – Miniature Cameras etc.

slide-11
SLIDE 11

Defining the Targets

They are/will be everywhere.

slide-12
SLIDE 12

Defending Information – The Basics

  • Good documentation & communication
  • Good passwords & security policies
  • Appropriate physical security measures
  • Well defined change-management procedures
  • Apply security patches promptly
  • Standardize where possible/appropriate
  • Back it all up
slide-13
SLIDE 13

Defending Information – The Basics

  • Your Monitoring Solution TM

– Monitor everything you can think of – Record as many metrics as possible – Review its configuration periodically and...

  • ...in response to change
  • ...in response to significant incidents

– If appropriate, use multiple/parallel systems.

  • Availability Monitoring
  • Performance Monitoring
  • Network Security Monitoring
slide-14
SLIDE 14

Increasing Network Visibility - Overview

Making the best possible haystack/needle finding machine:

– Capture as much network traffic as possible – Scan captured traffic: NIDS – Consider wireless protocols: WIDS – Profile network traffic:

  • Record detailed statistical information
  • Visualise normal network behaviour
  • Facilitates filtering-out of legitimate traffic

– Implement anomaly detection

slide-15
SLIDE 15

Capturing Ethernet Traffic

Often use Switch Mirror Ports (aka. SPAN or Monitor Port)

One port receives all traffic sent to/from the other ports. Most smart/managed switches support this feature.

Another technique is to use a Network Tap

slide-16
SLIDE 16

# ifconfig eth1 up promisc # ifconfig eth1 up promisc

Capturing Ethernet Traffic

Simplest case:

  • All traffic passing through the switch is visible at

the protective Monitoring Server

  • Do not assign an IP address to the capture

interface:

slide-17
SLIDE 17

Capturing Ethernet Traffic

Redundant System:

  • Dual interfaces on all servers:

active/active or active/passive

  • One capture interface per switch
slide-18
SLIDE 18

Capturing Ethernet Traffic

Tree Topology - Option 1 – Remote Port Mirroring

  • Requires high-end switches. e.g. Cisco, HP, H3C, Alcatel
  • Send all captured traffic to a central location for analysis/profiling.
  • Upgrade interface links as necessary.
  • Uses VLANs to isolate the mirrored traffic.
  • Fairly complex to configure.
slide-19
SLIDE 19

Capturing Ethernet Traffic

Tree Topology - Option 2 – Distributed Monitoring

Requires several capture servers

Remote servers send back:

  • Events & Alerts
  • Statistical traffic information
  • System log files
slide-20
SLIDE 20

Network Intrusion Detection Systems

Snort

– Passive mode – Intrusion Detection – Inline mode – Intrusion Prevention – Searches network traffic for pattern matches – Rules files updated daily

  • Up-to-date VRT rules available immediately to subscribers
  • VRT rules freely available to registered users after 30 days
  • Community rules under GPL. A subset of the VRT rules
  • Third-party rule sets available. e.g.

http://www.emergingthreats.net

slide-21
SLIDE 21

Network Intrusion Detection Systems

Snort

– Update rules daily with one of:

  • Oinkmaster
  • Pulled Pork

– Expect to spend some time tuning:

  • Main config file: snort.conf
  • Rules files
  • Ethernet interface configuration

e.g. Disable ”Large Receive Offload” and ”Generic Receive Offload” on the collector:

ethtool -K eth1 gro off ethtool -K eth1 lro off ethtool -K eth1 gro off ethtool -K eth1 lro off

slide-22
SLIDE 22

Network Intrusion Detection Systems

Snort

– Each rule has an Action associated, e.g.

  • Send an alert and log traffic.
  • Simply drop the offending packets. (Inline mode)
  • Reject the traffic: TCP reset. UDP unreachable. (Inline mode)
  • Custom actions & custom log types

– Very flexible alerting and logging methods, e.g.

  • Text → email alert & Pcap log file
  • Syslog alert & logging to database
  • Unified2 (recommended, high-performance format)
slide-23
SLIDE 23

Network Intrusion Detection Systems

Suricata

  • IDS/IPS project started in 2009

– Multi-threaded for greater native performance – Unified2 output by default – Protocol detection. Not based on port number – File identification by md5. Extract and save files from traffic – Can use Snort rules and can co-exist – http://suricata-ids.org/

slide-24
SLIDE 24

Network Intrusion Detection Systems

Bro

  • Passive Network Analysis Platform:

– IDS features available – require custom scripting. – Detailed statistical log files created – Application-layer transcripts, e.g. HTTP, SSL etc. – Cluster-aware for high-capacity analysis – Scripting engine : Highly extensible – Match MD5 against Team Cymru malware database

slide-25
SLIDE 25

Wireless Intrusion Detection Systems

  • Current best practice in IEEE 802.11:

– Implement WPA2-Enterprise

  • RADIUS – e.g. FreeRADIUS
  • EAP – Strong Authentication
  • hostapd + wpa_supplicant [+ OpenSSL]

– Implement IEEE 802.11w

  • Management Frames Protected
  • We consider two types of attack:

– A Rogue Access Point – A De-Authentication Attack

slide-26
SLIDE 26

Wireless Intrusion Detection Systems

Kismet

  • Monitor 802.11 traffic for known attack patterns:

– Use additional wireless radios in monitor mode – (optionally) Channel-hop on the channels that you use – Drones can be distributed network-wide – Suitable for embedded use i.e. OpenWRT, DD-WRT etc. – Client can view real-time client list and traffic – Alerts can be sent via syslog – Tap interface permits full 802.11 capture

slide-27
SLIDE 27

Wireless Intrusion Detection Systems

Kismet

1: Detecting rogue access points

Legitimate Clients

slide-28
SLIDE 28

Wireless Intrusion Detection Systems

Kismet

1: Detecting rogue access points

ncsource=drone1:host=10.10.100.1,port=2502 ncsource=drone2:host=10.10.100.2,port=2502 alert=APSPOOF,10/min,1/sec apspoof=Tullix:ssid="Tullix",validmacs="00:11:22:33:44:55,AA:BB:CC:DD:EE:FF" allowplugins=true ncsource=drone1:host=10.10.100.1,port=2502 ncsource=drone2:host=10.10.100.2,port=2502 alert=APSPOOF,10/min,1/sec apspoof=Tullix:ssid="Tullix",validmacs="00:11:22:33:44:55,AA:BB:CC:DD:EE:FF" allowplugins=true

Kismet

  • On the server: kismet.conf
  • On the drones: kismet_drone.conf

ncsource=wlan0:drone1:channellist=Tullix dronelisten=tcp://10.10.100.1:2502 droneallowedhosts=10.10.0.1 ncsource=wlan0:drone1:channellist=Tullix dronelisten=tcp://10.10.100.1:2502 droneallowedhosts=10.10.0.1

slide-29
SLIDE 29

Wireless Intrusion Detection Systems

Kismet

2: Detecting a de-authentication attack

slide-30
SLIDE 30

Wireless Intrusion Detection Systems

Kismet

2: Detecting a de-authentication attack

ncsource=drone1:host=10.10.100.1,port=2502 ncsource=drone2:host=10.10.100.2,port=2502 alert=DEAUTHFLOOD,5/min,2/sec alert=BCASTDISCON,5/min,2/sec allowplugins=true ncsource=drone1:host=10.10.100.1,port=2502 ncsource=drone2:host=10.10.100.2,port=2502 alert=DEAUTHFLOOD,5/min,2/sec alert=BCASTDISCON,5/min,2/sec allowplugins=true

  • On the server: kismet.conf
slide-31
SLIDE 31

Network Traffic Profiling

Ntop and NtopNG

  • Near real-time and historical information about:

– Hosts observed – Protocol distribution – Multicast/Broadcast frequency – Who's talking to whom?

  • Rich graphical interface
  • Can also be used as a NetFlow Collector
  • PF_RING allows multi-threaded libpcap analysis
slide-32
SLIDE 32

Network Traffic Profiling - NtopNG

slide-33
SLIDE 33

Network Traffic Profiling - Ntop

slide-34
SLIDE 34

NetFlow and friends

  • A UDP protocol describing network traffic
  • Many proprietary formats: NetFlow, sFlow, jflow, Rflow
  • IETF proposed standard: IPFIX (== NetFlow v10)
slide-35
SLIDE 35

NetFlow Exporters

  • Native support in high-end switches routers
  • Open Source exporters based on Libpcap (& PF_RING)

– Nprobe - http://www.ntop.org/products/nprobe/ – Fprobe - http://fprobe.sourceforge.net/ – Softflowd - http://code.google.com/p/softflowd/ – Rflow - https://en.wikipedia.org/wiki/DD-WRT#Features

  • Also a feature of Open vSwitch - http://openvswitch.org/
  • Netflow v5 and v9 are the most common formats
  • Exporters send UDP packets to one or more collectors
slide-36
SLIDE 36

NetFlow Collectors

Ntop – Historical and statistical analysis Nfdump / NfSen – Long-term NetFlow storage and detailed query

– Nfdump tool-set

  • nfcapd – Collect netflow streams and save the information
  • nfdump – Extract and report information from the stored files
  • nfprofile – Report on a subset of traffic from the stored files

– NfSen web-interface

  • Web front-end to analyse and query Nfdump files
  • Dynamic graph generation, based on filters and time periods
slide-37
SLIDE 37

NfSen – NetFlow Sensor

slide-38
SLIDE 38

Anomaly Detection Tools

  • Arpwatch / Arpalert

– Maintain a database of authorized MAC addresses – Alert on any deviation – syslog or email

  • PRADS - Passive Real-Time Asset Detection System

– Builds a list of hosts/service on the network – Can be used to inform snort configuration

– prads-asset-report - what's been seen on the network?

  • PBNJ – Active Network Asset Detection System

– Database of discovered hosts/services (nmap) – Re-scan & diff

slide-39
SLIDE 39

Increasing Host Visibility - Overview

  • Useful host-based tools
  • Host-based Intrusion Detection Systems (HIDS)
slide-40
SLIDE 40

Host Visibility Tools

  • etckeeper – Keep /etc under version control
slide-41
SLIDE 41

Host Visibility Tools

  • atop – Retain Historical Process Information
slide-42
SLIDE 42

Host Visibility Tools

  • auditd – The Linux Audit Daemon

– and audispd – The Linux Audit Dispatcher

slide-43
SLIDE 43

Host Visibility Tools

  • lynis – Security audit script, with hardening suggestions
slide-44
SLIDE 44

Host-based Intrusion Detection Systems

  • OSSEC

– Multi-platform – facilitates distributed security monitoring – File integrity monitoring – Log file monitoring – Rootkit search – Policy audit – Email/syslog alerts – SQL output

slide-45
SLIDE 45

Host-based Intrusion Detection Systems

  • Samhain - File Integrity Monitor

– Client/Server mode – Stand-alone mode – Log file monitoring – Hidden processes – Stealth mode – auditd integration – SQL output – Syslog output

  • Beltane - web front-end
slide-46
SLIDE 46

Host-based Intrusion Detection Systems

  • Tripwire – Lightweight file integrity monitor

– Define policy for file monitoring – Create checksum databases of a clean system – Mount /var/lib/tripwire on R/O media or R/O

network share

– Checked by cron daily – email/syslog alert on change – Update databases and policies as required – Configuration, Policies and Databases digitally signed,

requiring pass-phrase to update

slide-47
SLIDE 47

Host-based Intrusion Detection Systems

  • AIDE – Advanced Intrusion Detection System

– Similar in scope and operation to Tripwire – Simpler configuration including conf.d snippets

  • Fcheck – Perl based file integrity monitor

– Older but dependable and useful in certain environments

  • Stealth – Remote file integrity monitor over SSH

– http://stealth.sourceforge.net

slide-48
SLIDE 48

Log File Management

  • syslog – Generally using rsyslog or syslog-ng now

– Centralize logs – including switches, routers, etc. – e.g. Snare or eventlog-to-syslog for Windows – TCP or RELP (rsyslog) can aid reliable network transfer

  • Cryptographic Log Signing (GPG-13 requirement)

– Feature of rsyslog version 7.4+ – rsgutil utility verifies signatures

action(type="omfile" file="/var/log/syslog" sig.provider="gt" sig.keepTreeHashes="on" sig.keepRecordHashes="on") action(type="omfile" file="/var/log/syslog" sig.provider="gt" sig.keepTreeHashes="on" sig.keepRecordHashes="on")

slide-49
SLIDE 49

Log File Management

  • Visualize/Analyse syslog data

– e.g. Addiscon Loganalyzer [sic]

slide-50
SLIDE 50

Log File Management

  • Visualize/search syslog data – alternatives

– ElasticSearch – Graylog2 – Logstash – Kibana – ELSA

slide-51
SLIDE 51

Log File Management

  • Application Logs – e.g. Web server

– Google Analytics != Web Log Analysis – Piwik Log Analytics Mode - http://piwik.org/log-analytics/

slide-52
SLIDE 52

Active Response – Intrusion Prevention

  • Snortsam – Firewall hosts using a Snort plugin

– Agent runs on/near firewall

  • fail2ban - Firewall hosts from log file matches

– Authentication

Failures

– Repeat Offender

Handling

slide-53
SLIDE 53

Collating and Presenting Security Information

  • Sagan – Scan log files for security related information

– Snort-like rules for pattern matching – e.g. Handling our previous WIDS alert

alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[KISMET] Spoofed disassociated/deauthenticate packets"; program: kismet_server; pcre: "/DEAUTHFLOOD|BCASTDISCON/"; classtype: suspicious-traffic;) alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg: "[KISMET] Spoofed disassociated/deauthenticate packets"; program: kismet_server; pcre: "/DEAUTHFLOOD|BCASTDISCON/"; classtype: suspicious-traffic;)

– Incorporate results into an IDS database – Integrates with Snortsam Agent for active firewall response

slide-54
SLIDE 54

Collating and Presenting Security Information

  • Snorby – Web console collating IDS/IPS and Sagan alerts

– Integrates with OpenFPC for full packet capture

  • Other consoles available – e.g. Sguil & Squert, BASE
slide-55
SLIDE 55

Focused Distributions

  • AlienVault OSSIM : (Debian based)

– Open Core version of their full-featured USM product

  • Nagios
  • NfSen
  • OSSEC
  • Kismet
  • Snort
  • Suricata
  • Ntop
  • Arpwatch
  • PADS
  • OpenVAS

– Custom Correlation Engine – Custom web framework

slide-56
SLIDE 56

Focused Distributions

  • The Security Onion : (Ubuntu based)
  • Snort
  • Suricata
  • Bro
  • Sguil
  • Squert
  • Snorby
  • ELSA
  • Netsniff-NG
  • OSSEC
  • PRADS
  • Xplico
  • NetworkMiner
  • CapME
  • Argus
slide-57
SLIDE 57

Summary Conducting Defensive Information Warfare

  • Maximum network visibility
  • Maximum host visibility
  • Rigorous log file management
  • Rapid analysis and response
slide-58
SLIDE 58

Fin

Thank You

Ben Tullis tullis@hypothetical.co.uk @tullis

slide-59
SLIDE 59

Image attributions

Thanks to Creative Commons:

  • http://www.flickr.com/photos/pasukaru76/5108255589/
  • http://idle.slashdot.org/story/08/10/01/231247/man-uses-r

emote-logon-to-help-find-laptop-thief

  • http://www.article-3.com/criminal-law-laptop-theft-prote

ction-92052

  • http://www.flickr.com/photos/pingdom/5370307776/
  • http://www.geograph.org.uk/photo/2472373
  • http://hakshop.myshopify.com/products/wifi-pineapple-ho

liday-bundle

  • http://www.cctvcameradvrs.com/4gb-mini-spy-camera-wit

h-voice-control

  • http://www.flickr.com/photos/fastjack/282707058/
  • http://www.insuretrust.com/study-finds-cyber-crime-costl

y-ever

  • http://www.telegraph.co.uk/technology/news/8262628/Cybe

r-attacks-could-cause-global-catastrophe.html

  • http://mtitechsolutions.com/blog/types-of-attacks.html
  • http://en.wikipedia.org/wiki/File:Snort_ids_logo.png
  • http://www.bro.org
  • http://commons.wikimedia.org
  • https://en.wikipedia.org/wiki/File:NetFlow_Architectur

e_2012.png

  • http://nfsen.sourceforge.net/
  • http://www.ossec.net/doc/manual/ossec-architecture.html
  • http://logstash.net/images/logstash.png
  • http://deinoscloud.wordpress.com/2012/11/01/esxigraylog

2-quickstart/

  • http://www.elasticsearch.org/
  • http://www.jesuisungeek.net/index.php?post/2013/01/31/I

nstaller-Kibana-par-Puppet-partie-1

  • http://munin.alexdpsg.net/alexdpsg.net/munin.alexdpsg.

net/fail2ban-month.png

  • http://en.wikipedia.org/wiki/File:Alienvault_capture.png
  • http://openclipart.org

Explicit Permission Granted:

  • Pwnie Express - http://pwnieexpress.com/
  • MiniPwner - http://www.minipwner.com/