Pondering and Patrolling Perimeter Defenses Bill Cheswick - - PowerPoint PPT Presentation

▶
pondering and patrolling perimeter defenses
SMART_READER_LITE
LIVE PREVIEW

Pondering and Patrolling Perimeter Defenses Bill Cheswick - - PowerPoint PPT Presentation

Apr 15, 2023 155 likes •1.21k views

Pondering and Patrolling Perimeter Defenses Bill Cheswick ches@lumeta.com http://www.lumeta.com 16 June 2005 Pondering Perimeters: DOE 1 of 105 Brief personal history Started at Bell Labs in December 1987 Immediately took over

slide-1
SLIDE 1

Pondering and Patrolling Perimeter Defenses

Bill Cheswick ches@lumeta.com http://www.lumeta.com

16 June 2005 Pondering Perimeters: DOE 1 of 105

slide-2
SLIDE 2

Brief personal history

  • Started at Bell Labs in December 1987

– Immediately took over postmaster and firewall duties

  • Good way to learn the ropes, which was

my intention

16 June 2005 Pondering Perimeters: DOE 2 of 105

slide-3
SLIDE 3

Morris worm hit on Nov 1988

  • Heard about it on NPR

– Had a “sinking feeling” about it

  • The home-made firewall worked

– No fingerd – No sendmail (we rewrote the mailer)

  • Intranet connection to Bellcore
  • We got lucky
  • Bell Labs had 1330 hosts
  • Corporate HQ didn’t know or care

16 June 2005 Pondering Perimeters: DOE 3 of 105

slide-4
SLIDE 4

Action items

  • Shut down the unprotected connection to

Bellcore

– What we now call a “routing leak”

  • Redesign the firewall for much more

capacity, and no “sinking feeling”

– (VAX 750, load average of 15)

  • Write a paper on it

– “if you don’t write it up, you didn’t do the work”

16 June 2005 Pondering Perimeters: DOE 4 of 105

slide-5
SLIDE 5

Old gateway:

16 June 2005 Pondering Perimeters: DOE 5 of 105

slide-6
SLIDE 6

New gateway:

suspenders belt

16 June 2005 Pondering Perimeters: DOE 6 of 105

slide-7
SLIDE 7

New gateway: (one referee’s suggestion)

16 June 2005 Pondering Perimeters: DOE 7 of 105

slide-8
SLIDE 8

“Design of a Secure Internet Gateway” – Anaheim Usenix, Jun 1990

  • My first real academic paper
  • It was pretty good, I think
  • It didn’t have much impact, except for two

pieces:

– Coined the work “proxy” in its current use (this was for a circuit level gateway

  • Predated “socks by three years)

– Coined the expression “crunchy outside and soft chewy center”

16 June 2005 Pondering Perimeters: DOE 8 of 105

slide-9
SLIDE 9

Why wasn’t the paper more influential?

  • Because the hard part isn’t the firewall, it

is the perimeter

– I built a high security firewall for USSS from scratch in about 2 hours in Sept. 2001.

  • I raised our firewall security from “low

medium” to “high”

– (that’s about as good as computer and network security measurement gets)

  • The perimeter security was “dumb luck”,

which we raised to “probably none”

16 June 2005 Pondering Perimeters: DOE 9 of 105

slide-10
SLIDE 10

Network and host security levels

  • Dumb luck
  • None
  • Low
  • Medium
  • High = no “sinking feeling”

16 June 2005 Pondering Perimeters: DOE 10 of 105

slide-11
SLIDE 11

By 1996, AT&T’s intranet

  • Firewall security: high, and sometimes

quite a pain, which meant

  • Perimeter security: dumb luck
  • Trivestiture didn’t change the intranet

configuration that much

16 June 2005 Pondering Perimeters: DOE 11 of 105

slide-12
SLIDE 12

Lucent 1997: Circling the wagons around Wyoming

Allentown Murray Hill Columbus Holmdel SLIP PPP ISDN X.25 cable ...

Lucent - 130,000, 266K IP addresses, 3000 nets ann.

Murray Hill

The Internet ~200 business partners thousands of telecommuters

16 June 2005 Pondering Perimeters: DOE 12 of 105

slide-13
SLIDE 13

16 June 2005 Pondering Perimeters: DOE 13 of 105

slide-14
SLIDE 14

Highlands forum, Annapolis, Dec 1996

  • A Rand corp. game to help brief a member
  • f the new President’s Infrastructure

Protection Commission

  • Met Esther Dyson and Fred Cohen there

– Personal assessment by intel profiler

  • “Day after” scenario
  • Gosh it would be great to figure out where

these networks actually go

16 June 2005 Pondering Perimeters: DOE 14 of 105

slide-15
SLIDE 15

Perimeter Defenses have a long history

16 June 2005 Pondering Perimeters: DOE 15 of 105

slide-16
SLIDE 16

16 June 2005 Pondering Perimeters: DOE 16 of 105

The Pretty Good Wall of China

slide-17
SLIDE 17

16 June 2005 Pondering Perimeters: DOE 17 of 105

slide-18
SLIDE 18

16 June 2005 Pondering Perimeters: DOE 18 of 105

Perimeter Defense

slide-19
SLIDE 19

Flower pots

16 June 2005 Pondering Perimeters: DOE 19 of 105

slide-20
SLIDE 20

16 June 2005 Pondering Perimeters: DOE 20 of 105

slide-21
SLIDE 21

16 June 2005 Pondering Perimeters: DOE 21 of 105

slide-22
SLIDE 22

Security doesn’t have to be ugly

16 June 2005 Pondering Perimeters: DOE 22 of 105

slide-23
SLIDE 23

16 June 2005 Pondering Perimeters: DOE 23 of 105

slide-24
SLIDE 24

16 June 2005 Pondering Perimeters: DOE 24 of 105

slide-25
SLIDE 25

16 June 2005 Pondering Perimeters: DOE 25 of 105

slide-26
SLIDE 26

16 June 2005 Pondering Perimeters: DOE 26 of 105

Delta barriers

slide-27
SLIDE 27

16 June 2005 Pondering Perimeters: DOE 27 of 105

Parliament: entrance

slide-28
SLIDE 28

16 June 2005 Pondering Perimeters: DOE 28 of 105

Parliament: exit

slide-29
SLIDE 29

16 June 2005 Pondering Perimeters: DOE 29 of 105

Edinburgh Castle

slide-30
SLIDE 30

16 June 2005 Pondering Perimeters: DOE 30 of 105

Warwick Castle

slide-31
SLIDE 31

16 June 2005 Pondering Perimeters: DOE 31 of 105

slide-32
SLIDE 32

16 June 2005 Pondering Perimeters: DOE 32 of 105

Berwick Castle

slide-33
SLIDE 33

16 June 2005 Pondering Perimeters: DOE 33 of 105

slide-34
SLIDE 34

16 June 2005 Pondering Perimeters: DOE 34 of 105

slide-35
SLIDE 35

Why use a perimeter defense?

  • It is cheaper

– A man’s home is his castle, but most people can’t afford the moat

  • You can concentrate your equipment and

your expertise in a few areas

  • It is simpler, and simpler security is usually

better

– Easier to understand and audit – Easier to spot broken parts

16 June 2005 Pondering Perimeters: DOE 35 of 105

slide-36
SLIDE 36

16 June 2005 Pondering Perimeters: DOE 36 of 105

slide-37
SLIDE 37

What’s wrong with perimeter defenses

  • They are useless against insider attacks
  • They provide a false sense of security

– You still need to toughen up the inside, at least some – You need to hire enough defenders

  • They don’t scale well

16 June 2005 Pondering Perimeters: DOE 37 of 105

slide-38
SLIDE 38

Anything large enough to be called an ‘intranet’ is out of control

16 June 2005 Pondering Perimeters: DOE 38 of 105

slide-39
SLIDE 39

The Internet Mapping Project

An experiment in exploring network connectivity 1998

16 June 2005 Pondering Perimeters: DOE 39 of 105

slide-40
SLIDE 40

Methods - network discovery (ND)

  • Obtain master network list

– network lists from Merit, RIPE, APNIC, etc. – BGP data or routing data from customers – hand-assembled list of Yugoslavia/Bosnia

  • Run a TTL-type (traceroute) scan towards

each network

  • Stop on error, completion, no data

– Keep the natives happy

16 June 2005 Pondering Perimeters: DOE 40 of 105

slide-41
SLIDE 41

Methods - data collection

16 June 2005 Pondering Perimeters: DOE 41 of 105

  • Single reliable host connected at the

company perimeter

  • Daily full scan of Lucent
  • Daily partial scan of Internet, monthly full

scan

  • One line of text per network scanned

– Unix tools

  • Use a light touch, so we don’t bother

Internet denizens

slide-42
SLIDE 42

TTL probes

  • Used by traceroute and other tools
  • Probes toward each target network with

increasing TTL

  • Probes are ICMP, UDP, TCP to port 80,

25, 139, etc.

  • Some people block UDP, others ICMP

16 June 2005 Pondering Perimeters: DOE 42 of 105

slide-43
SLIDE 43

TTL probes

Application level TCP/UDP

IP Hardware Client IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router

Application level TCP/UDP

IP Hardware Server

Hop 3 Hop 1 Hop 2 Hop 3 Hop 4

16 June 2005 Pondering Perimeters: DOE 43 of 105

slide-44
SLIDE 44

Send a packet with a TTL of 1…

Application level TCP/UDP

IP Hardware Client IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router

Application level TCP/UDP

IP Hardware Server

Hop 3 Hop 1 Hop 2 Hop 3 Hop 4

16 June 2005 Pondering Perimeters: DOE 44 of 105

slide-45
SLIDE 45

…and we get the death notice from the first hop

Application level TCP/UDP

IP Hardware Client IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router

Application level TCP/UDP

IP Hardware Server

Hop 3 Hop 1 Hop 2 Hop 3 Hop 4

16 June 2005 Pondering Perimeters: DOE 45 of 105

slide-46
SLIDE 46

Send a packet with a TTL of 2…

Application level TCP/UDP

IP Hardware Client IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router

Application level TCP/UDP

IP Hardware Server

Hop 3 Hop 1 Hop 2 Hop 3 Hop 4

16 June 2005 Pondering Perimeters: DOE 46 of 105

slide-47
SLIDE 47

… and so on …

Application level TCP/UDP

IP Hardware Client IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Router

Application level TCP/UDP

IP Hardware Server

Hop 3 Hop 1 Hop 2 Hop 3 Hop 4

16 June 2005 Pondering Perimeters: DOE 47 of 105

slide-48
SLIDE 48

Advantages

  • We don’t need access (I.e. SNMP) to the

routers

  • It’s very fast
  • Standard Internet tool: it doesn’t break

things

  • Insignificant load on the routers
  • Not likely to show up on IDS reports
  • We can probe with many packet types

16 June 2005 Pondering Perimeters: DOE 48 of 105

slide-49
SLIDE 49

Limitations

  • Outgoing paths only
  • Level 3 (IP) only

– ATM networks appear as a single node – This distorts graphical analysis

  • Not all routers respond
  • Many routers limited to one response per

second

16 June 2005 Pondering Perimeters: DOE 49 of 105

slide-50
SLIDE 50

Limitations

  • View is from scanning host only
  • Takes a while to collect alternating paths
  • Gentle mapping means missed endpoints
  • Imputes non-existent links

16 June 2005 Pondering Perimeters: DOE 50 of 105

slide-51
SLIDE 51

The data can go either way

A E F D B C

16 June 2005 Pondering Perimeters: DOE 51 of 105

slide-52
SLIDE 52

The data can go either way

A E F D B C

16 June 2005 Pondering Perimeters: DOE 52 of 105

slide-53
SLIDE 53

But our test packets only go part

  • f the way

A E F D B C

16 June 2005 Pondering Perimeters: DOE 53 of 105

slide-54
SLIDE 54

We record the hop…

A E F D B C

16 June 2005 Pondering Perimeters: DOE 54 of 105

slide-55
SLIDE 55

The next probe happens to go the other way

A E F D B C

16 June 2005 Pondering Perimeters: DOE 55 of 105

slide-56
SLIDE 56

…and we record the other hop…

A E F D B C

16 June 2005 Pondering Perimeters: DOE 56 of 105

slide-57
SLIDE 57

We’ve imputed a link that doesn’t exist

A E F D B C

16 June 2005 Pondering Perimeters: DOE 57 of 105

slide-58
SLIDE 58

Intranet implications of Internet mapping

  • High speed technique, able to handle the

largest networks

  • Light touch: “what are you going to do to

my intranet?”

  • Acquire and maintain databases of

Internet network assignments and usage

16 June 2005 Pondering Perimeters: DOE 58 of 105

slide-59
SLIDE 59

Data collection complaints

  • Australian parliament was the first to

complain

  • List of whiners (25 nets)
  • On the Internet, these complaints are

mostly a thing of the past

– Internet background radiation predominates

16 June 2005 Pondering Perimeters: DOE 59 of 105

slide-60
SLIDE 60

Visualization goals

  • make a map

– show interesting features – debug our database and collection methods

  • geography doesn’t matter
  • use colors to show further meaning

16 June 2005 Pondering Perimeters: DOE 60 of 105

slide-61
SLIDE 61

16 June 2005 Pondering Perimeters: DOE 61 of 105

slide-62
SLIDE 62

Visualization of the layout algorithm

Laying out the Internet graph

16 June 2005 Pondering Perimeters: DOE 62 of 105

slide-63
SLIDE 63

16 June 2005 Pondering Perimeters: DOE 63 of 105

slide-64
SLIDE 64

16 June 2005 Pondering Perimeters: DOE 64 of 105

slide-65
SLIDE 65

16 June 2005 Pondering Perimeters: DOE 65 of 105

Colored by AS number

slide-66
SLIDE 66

Map Coloring

  • distance from test host
  • IP address

– shows communities

  • Geographical (by TLD)
  • ISPs
  • future

– timing, firewalls, LSRR blocks

16 June 2005 Pondering Perimeters: DOE 66 of 105

slide-67
SLIDE 67

16 June 2005 Pondering Perimeters: DOE 67 of 105

Colored by IP address!

slide-68
SLIDE 68

16 June 2005 Pondering Perimeters: DOE 68 of 105

Colored by geography

slide-69
SLIDE 69

16 June 2005 Pondering Perimeters: DOE 69 of 105

Colored by ISP

slide-70
SLIDE 70

16 June 2005 Pondering Perimeters: DOE 70 of 105

Colored by distance from scanning host

slide-71
SLIDE 71

16 June 2005 Pondering Perimeters: DOE 71 of 105

slide-72
SLIDE 72

16 June 2005 Pondering Perimeters: DOE 72 of 105

slide-73
SLIDE 73

Yugoslavia

An unclassified peek at a new battlefield 1999

16 June 2005 Pondering Perimeters: DOE 73 of 105

slide-74
SLIDE 74

16 June 2005 Pondering Perimeters: DOE 74 of 105

slide-75
SLIDE 75

Un film par Steve “Hollywood” Branigan...

16 June 2005 Pondering Perimeters: DOE 75 of 105

slide-76
SLIDE 76

16 June 2005 Pondering Perimeters: DOE 76 of 105

slide-77
SLIDE 77

fin

16 June 2005 Pondering Perimeters: DOE 77 of 105

slide-78
SLIDE 78

Intranets: the rest of the Internet

16 June 2005 Pondering Perimeters: DOE 78 of 105

slide-79
SLIDE 79

16 June 2005 Pondering Perimeters: DOE 79 of 105

slide-80
SLIDE 80

16 June 2005 Pondering Perimeters: DOE 80 of 105

slide-81
SLIDE 81

16 June 2005 Pondering Perimeters: DOE 81 of 105

slide-82
SLIDE 82

16 June 2005 Pondering Perimeters: DOE 82 of 105

This was Supposed To be a VPN

slide-83
SLIDE 83

16 June 2005 Pondering Perimeters: DOE 83 of 105

slide-84
SLIDE 84

16 June 2005 Pondering Perimeters: DOE 84 of 105

slide-85
SLIDE 85

Detecting perimeter leaks: not all spoofing is evil

Lumeta’s Special Sauce 2000

16 June 2005 Pondering Perimeters: DOE 85 of 105

slide-86
SLIDE 86

Types of leaks

  • Routing leaks

– Internal routes are announced externally, and the packets are allowed to flow betwixt

  • Host leaks

– Simultaneously connected inside and out, probably without firewall-functionality – Not necessarily a dual-homed host

  • “Please don’t call them leaks”

– They aren’t always a Bad Thing

16 June 2005 Pondering Perimeters: DOE 86 of 105

slide-87
SLIDE 87

Routing leaks

  • Easily seen on maps
  • Shows up in our reports
  • Generally easily fixed

16 June 2005 Pondering Perimeters: DOE 87 of 105

slide-88
SLIDE 88

Host leak detection

  • Developed to find hosts that have access

to both intranet and Internet

  • Or across any privilege boundary
  • Leaking hosts do not route between the

networks

  • Technology didn’t exist to find these

16 June 2005 Pondering Perimeters: DOE 88 of 105

slide-89
SLIDE 89

Possible host leaks

  • Miss-configured telecommuters

connecting remotely

  • VPNs that are broken
  • DMZ hosts with too much access
  • Business partner networks
  • Internet connections by rogue managers
  • Modem links to ISPs

16 June 2005 Pondering Perimeters: DOE 89 of 105

slide-90
SLIDE 90

Leak Detection Prerequisites

  • List of potential leakers: obtained by

census

  • Access to intranet
  • Simultaneous availability of a “mitt”

16 June 2005 Pondering Perimeters: DOE 90 of 105

slide-91
SLIDE 91

Leak Detection Layout

Internet intranet Mapping host A Test host B mitt D C

  • Mapping host with

address A is connected to the intranet

  • Mitt with address D

has Internet access

  • Mapping host and

mitt are currently the same host, with two interfaces

16 June 2005 Pondering Perimeters: DOE 91 of 105

slide-92
SLIDE 92

Leak Detection

16 June 2005 Pondering Perimeters: DOE 92 of 105

Internet intranet Mapping host A Test host B mitt D C

  • Test host has

known address B

  • n the intranet
  • It was found via

census

  • We are testing for

unauthorized access to the Internet, possibly through a different address, C

slide-93
SLIDE 93

Leak Detection

Internet intranet Mapping host A Test host B mitt D C

  • A sends packet to

B, with spoofed return address of D

  • If B can, it will reply

to D with a response, possibly through a different interface

16 June 2005 Pondering Perimeters: DOE 93 of 105

slide-94
SLIDE 94

Leak Detection

16 June 2005 Pondering Perimeters: DOE 94 of 105

Internet intranet Mapping host A Test host B mitt D C

  • Packet must be crafted

so the response won’t be permitted through the firewall

  • A variety of packet

types and responses are used

  • Either inside or outside

address may be discovered

  • Packet is labeled so we

know where it came from

slide-95
SLIDE 95

Inbound Leak Detection

Internet intranet Mapping host A Test host B mitt D C

  • This direction is

usually more important

  • It all depends on

the site policy…

  • …so many leaks

might be just fine.

16 June 2005 Pondering Perimeters: DOE 95 of 105

slide-96
SLIDE 96

Inbound Leak Detection

Internet intranet Mapping host A Test host B mitt D C

16 June 2005 Pondering Perimeters: DOE 96 of 105

slide-97
SLIDE 97

Leak results

  • Found home web businesses
  • At least two clients have tapped leaks

– One made front page news

  • From the military: “the republic is a little

safer”

16 June 2005 Pondering Perimeters: DOE 97 of 105

slide-98
SLIDE 98

16 June 2005 Pondering Perimeters: DOE 98 of 105

Case studies: corp. networks Some intranet statistics

Min Max Intranet sizes (devices) 7,900 365,000 Corporate address space 81,000 745,000,000 % devices in unknown address space 0.01% 20.86% % routers responding to "public" 0.14% 75.50% % routers responding to other 0.00% 52.00% Outbound host leaks on network 176,000 % devices with outbound ICMP leaks 0% 79% % devices with outbound UDP leaks 0% 82% Inbound UDP host leaks 5,800 % devices with inbound ICMP leaks 0% 11% % devices with inbound UDP leaks 0% 12% % hosts running Windows 36% 84%

slide-99
SLIDE 99

We developed lot of stuff

  • Leak detection (that’s the special sauce)
  • Lots of reports: the hardest part is converting data to

information

  • Route discovery: TTL probes plus SNMP router

queries

  • Host enumeration and identification: ping and

xprobe-style host identification

  • Server discovery: SYN probes of popular TCP ports
  • Wireless base station discovery: xprobe, SNMP,

HTTP

  • And more…ask the sales people
  • The “zeroth step in network intelligence”

– me

16 June 2005 Pondering Perimeters: DOE 99 of 105

slide-100
SLIDE 100

IP Sonar

2003

16 June 2005 Pondering Perimeters: DOE 100 of 105

slide-101
SLIDE 101

Nice research result: happy clients

  • Switched from service to appliance
  • Developers did a nice job with GUI and

productizing the software

  • Priced by approx. number of active IP devices

and length of time you have the appliance

  • ~100 Fortune 200 clients
  • Growing government use among military,

spooks, and various departments

– FAA, VA, EOP, DISA, DOD, Treasury, pilots at

  • thers including DOE

16 June 2005 Pondering Perimeters: DOE 101 of 105

slide-102
SLIDE 102

What’s next?

IPv6 2005 + 3

16 June 2005 Pondering Perimeters: DOE 102 of 105

slide-103
SLIDE 103

16 June 2005 Pondering Perimeters: DOE 103 of 105

slide-104
SLIDE 104

Pondering and Patrolling Perimeters

Bill Cheswick ches@lumeta.com http://www.lumeta.com

16 June 2005 Pondering Perimeters: DOE 104 of 105 (Bill, you can go drinking now)

slide-105
SLIDE 105

16 June 2005 Pondering Perimeters: DOE 105 of 105