Lecture 18: Network Security #1

Network Security

• Computer security in a networked context. In today's lecture, we concentrate on this problem.
  • Computer system is subject to attack originating from the network
  • Extends well known security approaches adopted for protection of non-networked systems and adds network-specific mechanisms
  • No general solutions: any solution which provides perfect security seriously degrades usefulness of network...

• Security of information in transit across the network. This is covered in the next lecture.
  • Problem is largely due to the bad guys' ability to observe (capture) packets travelling across the network, and possibly an ability to introduce spurious packets.
  • Solution is usually in some form of encryption.

The Nature Of Attacks

• To obtain unauthorised access to private, or secret, information stored on the compromised system. Such access can be obtained by a wide variety of means. This is probably the most important type of attack.
• To use the compromised system as a start point for attacks on other, more interesting, systems.
• Denial of service attacks attempt to use up system resources to inconvenience the users. A classic example is to send vast megabytes of electronic mail to a target host in an attempt to exhaust its disk space.
• A variation of the denial-of-service attack is where a bad guy actually attempts to cause damage to the compromised system, for example, by removing important files, changing configurations, etc.
• etc, etc...

Internet Security

• An Internet-connected system uses the TCP/IP protocol suite. The TCP/IP model of communications is based on server processes waiting (at well-known ports) for remote sites to establish connections.
• A server process has very little information -- usually only a reverse DNS lookup -- about the identity of a remote host which is attempting to connect. Even reverse lookups can be compromised by manipulation of DNS tables or by IP Spoofing, where a remote host generates IP packets that look as though they came from some other system.
• Servers which generally accept all connections without any (initial) security checks (such as finger and sendmail) can be vulnerable to various forms of attack, such as attempted buffer over-running.^[1]
• A major problem is the whether the sysadmin can trust the server programs to be bug free...

Firewall Security

1. Packet filtering firewalls
2. Application gateways
3. Circuit level gateways

Of these, the packet filtering type is the most common. They are generally implemented in the main router used in an organisation to provide its Internet access.

Because the firewall is not a general- purpose host, it does not itself run any vulnerable server processes.

Packet Filtering Firewalls

The decision to forward a packet or to discard it is made by looking deep into its contents, usually at either the IP source or destination address. More rarely, the TCP or UDP port numbersin the packet can also be used.

Most packet filtering firewalls keep little "state" information, and provide very little logging of activity, due to memory and CPU constraints.

TCP (and UDP) level filtering is more complex. and requires the firewall router to keep much more "state" information. For example, a particular site may allow outgoing TCP connections for some services, but prohibit most incoming TCP connections. This can be (theoretically) achieved by examining the ACK bit in the TCP header: it is cleared in the first connection request segment, and is set in all subsequent segments. Needless to say, this is a very difficult problem, because the router must keep track of IP addresses and port numbers of every current, valid, TCP connection.

In addition, analysing every packet at this level is very CPU intensive, which can place severe constraints on router performance.

Packet Filtering Configuration

An access list is used to define permisible packet flows through the router. The general form of an access list entry is:

{ permit | deny } address [mask]

permit | deny

indicates whether this entry allows or blocks traffic from the specified address.

address

gives the source IP address.

mask

this (optional) field is interpreted as a "bitmap" which defines the significance of each bit in the preceding address field. Every bit in the mask which has a "1" value indicates a "don't care" bit in the address, whereas every "0" bit indicates a bit in the address which must match exactly.

The access list for each interface can have many entries of the above form.

In addition, an access list can be specified to restrict either incoming or outgoing packets on the particular interface.

More Complex Firewall Configurations

The DMZ is also called a "stub network". Note that the DMZ is, of necessity, a separate subnet.

There are many options for the level of filtering in the routers, and for the functionality of the bastion host. These are examined in the next slides.

Application Gateways

If users connected to the internal LANs wish to use the services of the outside Internet, they can (eg) telnet to the gateway, and then use standard tools running on it to access the rest of the Internet.

An example of such a structure is provided by an electronic mail gateway. Typically, a mail gateway in the DMZ receives messages addressed to an alias address, such as:

Phil.Scott@latrobe.edu.au

Circuit Level Gateways

Such a structure might be used where an internal host wishes to, for example, fetch a WWW page from a server in the external Internet. The client web browser establishes a connection to a server which is running on the gateway host. The gateway server in turn establishes a second connection to the actual WWW server on the external Internet, and passes the incoming HTML document back to the internal browser process. Such a server (running on the gateway, or bastion, host) is called a proxy.

One of the advantages of a proxy server is the possibility of caching external web pages, thereby potentially reducing traffic on the connection to the outside Internet -- see assignment 2 for more information.

Real Life Firewall Systems

The bastion host normally runs, for example, the organisation's WWW server, its FTP server (if applicable) and any other public information services. It also usually acts as an email gateway. The WWW server usually is configured as a proxy for the hosts connected to the internal LANs (the Intranet). It may also perform a similar function for other services such as FTP.

This type of structure can be very effective, combining many of the best characteristics of all of the other types. However, the gateway system must usually be a general-purpose timeshared (and therefore Unix - don't talk to me about NT!) system, which raises doubts about the safety and reliability of the proxy software processes. This is not a solved problem, for obvious reasons.

Although... Highly secure versions of Unix for just such applications are now said to be available.

Other Issues

• The importance of logging system activity in tracking break in attempts, and the use of log files in subsequent court actions.
• Legal and ethical issues, both from the perspective of the system manager and in relation to the crooks.
• Passwords - their general applicability, the tendency of people to share them around and the sacrosanct nature of /etc/passwd
• Security within Unix (and other environments), and the use of tools such as cops and crack.
• Network security analysis tools, including the notorious satan.
• The entirely unresolved philosophical and ethical question as to whether it is nobler to discuss issues like all of these in a full and frank way, or to hide them and hope the students and other potential bad guys don't hear about them...