Recent Attack Technologies Neil Long OxCert Introduction Hope - - PowerPoint PPT Presentation

▶

Sep 28, 2022 341 likes •538 views

Recent Attack Technologies Neil Long OxCert Introduction Hope for audience participation! At least two aspects Target payloads Attack origins Future? arenas Attack Payloads Buffer overflow Format strings

SLIDE 1

Recent Attack Technologies

Neil Long OxCert

SLIDE 2

Introduction

Hope for audience participation!
At least two aspects

– Target payloads – Attack origins

Future? arenas

SLIDE 3

Attack Payloads

Buffer overflow
Format strings

– Any experts in the audience?

Network DoS

– volume vs. content

SLIDE 4

Buffer Overflow

Kernel switches, defences
stack vs heap vs libc
Options off by default

SLIDE 5

Format Strings

Relatively recent - major examples

– Wu-ftpd - Linux – rpc.statd - Linux – telnetd - IRIX – Local uid to root exploits

SLIDE 6

Built-in Defences?

Libc modifications

– Are they enough?

POSIX compliance

– LibC from major vendors??

Source code re-writes

– continuous release of new exploits

SLIDE 7

Bugtraq

Libc Sperl Screen Imp pam_smb and pam_ntdom Sysklogd Envcheck klogd wu-ftpd new variants Traceroute Cfengine Su Ncurses rpc.statd improved Php Apache mod_rewrite

SLIDE 8

Attacks

Scanning granularity
Real-time IDS
Post-event IDS
Multi-source attacks

– scan host – exploit host – intrusion host(s)

SLIDE 9

Tools used

Root-kits
hidden ‘extras’
rapid evolution
IRC still major factor

SLIDE 10

Counteractive Tools

LSOF
TCT

– mactime – lsi & icat

Netflows
Active IDS

SLIDE 11

DDoS tools

Trinoo still popular - evolving
Stacheldraht
‘TFN3K’ very worrying
Trinity (Entitee)
Handler-agent communication differences

SLIDE 12

DDoS Payloads

UDP volume
TCP SYN flood
Smurf & Fraggle amplifiers
Stream
Fragments and others?
Higher bandwidth will make them more

effective

SLIDE 13

IP Spoofing

All vs. partial vs. none at all
Generator efficiency
benefits to them (and us)

SLIDE 14

Locating the intruder

Traceback
Mobility becoming easier - locating more

difficult

– e.g. Use of non-contract cell phones

Wireless networks

– promiscuous mode?

SLIDE 15

New targets?

Voice-over-IP?
DNS revisited
WAP

SLIDE 16

What is to come?

DDoS Net of nets? How long?
Pipes get fatter -

– firewalls & IDS fall behind? – Cost prohibitive?

Disks keep getting bigger

SLIDE 17

Finally

Story is not changing -

– Demand for fatter pipes, bigger faster machines – But security is still an after-thought

Less logging by ISPs?
Growing awareness == more incidents

– increased IRT load

Liability issues on the horizon?

SLIDE 18