Firewall Architecture and Application Layer Firewalls Intrusion

1

Firewall Architecture andIntrusion Detection Systems

Firewall Architecture Firewalls Architectural Platforms

Packet Filters/Screening Routers

Application Layer Firewalls

Proxy Gateways

Stateful Inspection Engines

Screened Subnets

Reactive / Conditional Firewalls

Two levels -

Application level firewalls operate at session, presentation and

application layers. Also calledbastion hosts or proxy firewall(LINUX, UNIX or Windows 2000)

Packet level firewalls

operate at network (IP) and transport(TCP) layers. Called screeningrouters or packet filters

Firewall Architecture

Physical

Data LinkNetwork

Transport

Session

Presentation

Application

Secure Internet Gateway


UntrustedNetwork

DMZ

TrustedNetwork

Packet Filters/Screening Routers

Demilitarised Zone - DMZ


UntrustedNetwork

TrustedNetwork

Optional (DMZ)Networks (1+)

Filtering based on - source IP address destination IP address TCP/UDP source port TCP/UDP destination port May block on specific ports,

hosts, networks, all externaladdresses, etc.

Packet Layer Firewalls

LAN Internet

Packet Filter/Screening Router

Physical

Data LinkNetwork

Transport

Session

Presentation

Application

2

Packet Layer Firewalls

Application

Presentation

Session

Transport

DataLink

Physical

DataLink

Physical

Router

Application

Presentation

Session

Transport

DataLink

Physical

Network Network

PROS

CONS Low Security

No Screening Above the NetworkLayer (No “State” or Application-Context Information)

Application Independence High Performance Scalability

Network

The following services are inherently vulnerable:

TFTP (port 69) X-Windows (ports 6000+, port 2000) rlogin, rsh, and rexec (ports 513, 514, and 512) Telnet (port 23), RPC (port 111) FTP (ports 20 and 21), SMTP (port 25) RIP (port 520), DNS (port 53) UUCP (port 540), NNTP (port 119) Gopher, HTTP (ports 70 and 80)

Policing Protocols

Advantages Information hiding

names of internal systems notknown to Internet users

Authentication and logging Cost effectiveness

authentication can be located atapplication gateway

Less-complex filtering rulesthan with packet filter

Only host whose name madeknown to outside systems

Application Layer Firewalls

Physical

Data LinkNetwork

Transport

Session

Presentation

Application Application

Presentation

Session

Transport

DataLink

Physical

Network

DataLink

Physical

Application

Presentation

Session

Transport

DataLink

Physical

Application-Layer Gateway(Proxy-Service)

Application Gateway

Application

Presentation

Session

Transport

Network Network

Telnet HTTPFTP

Poorer Performance Limited Application Support Poor Scalability

(Breaks the Client/Server Model)PROS

CONS Good Security

Full Application-Layer Awareness

Application firewall mediates traffic betweenprotected network and Internet a proxy service is an application which routes

IP traffic from one port to another (it breaksthe connection, cf stateful packet filter)

can provide user authentication, auditing, andlogging facilities

great improvement over packetfilters/screening routers

proxy software written for each service

Proxy Gateways

basic proxies available for - Telnet, FTP,HTTP, WWW etc

users on Internet can only see proxy proxy allows services for which proxy

application has been specified connection broken hence proxy will not

work for some services - eg VPN tunnels

Proxy Gateways contd...

3

Stateful Packet Filters Dynamic packet filtering Examines packet stream based upon

dynamic state tables Mandates storing of state information Usually implemented with support of entire

TCP/IP stack Examines:

content vector protocol Allows/denies packet based upon rules

appropriate for the TCP service

Application

Presentation

Session

Transport

DataLink

Physical

DataLink

Physical

Application

Presentation

Session

Transport

DataLink

Physical

Network Network

PROS

Stateful Packet Filters

Network

Presentation

Session

Transport

EngineINSPECT

Application

Good Security Full Application-Layer Awareness Transparency

DynamicState TablesDynamic

State Tables

Performance Mis-configuration

CONS

LAN

Firewall Internet

SCEND MAX

A SCEN D

Server

Most secure firewall architecture

Firewall & Public Services Server

Public Services

Screened Subnet

Trusted

Optional (DMZ)

Untrusted

X X

Screened subnet considered to be the mostsecure firewall architecture:

isolated network positioned between theexternal and internal networks

allows non-critical hosts (web servers,anonymous FTP sites) to be placed outsideinternal network

forces all traffic and services through firewall

provides source for encrypted tunnels

Screened Subnet Benefits

17


Current firewall architectures: Packet filter Application proxy Stateful packet filters

All imply a static rule set (even if analysis and filteringengines are really powerful)

A reactive or conditional firewall will change / adapt itsrule set as a result of certain attack scenarios observedeither by an IDS or the firewall itself.

A reactive or conditional firewall can process multipleconnections (eg Nimda - 24,000!) 18


4

19


Some firewalls appear to change their rule set in theface of an attack - but results are very limited: Watchguard watches for attempted access to

services defined as sensitive and policy violations.When violation is detected, source is submitted to apreprocessor which discards all further packetsinvolving that host.

Checkpoint has an API which allows it to acceptfirewall rule modification from an external IDS.Should a compatible IDS detect an attack it couldmodify the firewall configuration to exclude theattacker.

20

Reactive / Conditional FirewallsAutoblockingleading toDenial ofServicecondition

21


Some firewalls appear to change their rule set in theface of an attack - but results are very limited: Port Sentry monitors unused ports. Any attempt to

access such ports are indicative of port scanningattacks or other probes. On detection, the localfirewall/router configuration is modified to exclude thehost involved.

Guardian is a security program which operates byautomatically updating firewall rules based uponalerts generated by Snort and blocking all incomingdata from the IP address of the attacking machine

22


Reactive / conditional firewalls allow considerableflexibility in implementing packet filtering rules andproxies, ranging from elegant support for excludingattackers, to the ability to define complex traffic, state-tracking systems and bandwidth management systems.

Various terms can be used to describe a firewall whichchanges its rules based upon external conditions. Suchterms include: conditional, adaptive, mutable, responsive or reactive

firewalls

Secure Multipart Internet Mail Encoding Secure Shell (Telnet, FTP etc) Point to Point Tunnelling Protocol Secure Electronic Transactions IP version 6 (IPv6) Secure Sockets Layer Encrypted Tunnelling

S/MIMESSHPPTPSETIPv6SSL/TLSIPSec

Secure Transactions on theInternet/Intranet

LAN - Ethernet, WAN-PPP ADSL,ISDN, Frame Relay, ATM

IPSecIPv4 and IPv6

TCP UDP

PPTP

FTP

T E L N E T

SNMP

SMTP

HTTP/HTTPS

BROWSER SE

T

S/M

IME

or P

GP

SSL/TLS

SSH

Hole in the (Fire)wall …..

Server Client

Firewall

Holes forHackers

5

Watchguard Technologies (Firebox 4500 System 5) Symantec Corp. (Symantec Enterprise Firewall v6.5.2) Stonesoft Corp. (Stonegate v17.0) SonicWall Inc. (SonicWall Tele3 v6.2) Secure Computing (Sidewinder v5.2) Global Technologies (GNAT Box v3.2) Network-1 Security Solutions (CyberwallPLUS v7.0) Cyberguard Corp. (CyberGuard KnightStar v5.0) Checkpoint Technologies (NG FW-1) Borderware Technologies (Firewall Server v6.5)

see also www.networkintrusion.co.uk

Firewall Vendors

26

Personal Firewall VendorsTiny Firewall (www.tinysoftware.com)BlackICE/Networkice (www.networkice.com)Norton (www.norton.com)SyGate (wwww.sygate.com)www.sygate.com/products/centrally_managed_personal_firewall.htm

Zone alarm (www.zonelabs.com) .. see on...IPCop (Linux) (www.ipcop.com)Smoothwall (Linux) (www.smoothwall.org)

last two loaded onto a gateway machineIPCop is an offshoot of SmoothwallSmoothwall can operate as a packet filtering IDS

27

Personal Firewall VendorsZone alarm (www.zonelabs.com) …..

Personal firewall with security settings of High,Medium, Low for both LAN and Internetconnections

Alerts occur during access to unauthorised port.ZoneAlarm advises what likely cause is and howindicative of an attack it is - hence acts as an IDS

Access is allowed/denied for programs on thehost PC to connect to the Internet

ZoneAlarm Pro $US50 for single user and$US1800 for 50 users

ZoneAlarm - free for home users 28

Intrusion Detection Systems

29

Sequence of related actions by a malicious adversary thatresults in occurrence of security threats to target computeror network

What is an Intrusion?

Indicators: Repetition of unusual behaviour Exploitation of known vulnerabilities Inconsistent packet sequences or routes Unexplained problems Suspicious traffic content

30

Major Reasons for Using Intrusion DetectionSystems are…..

To detect intruders, attacks, abuse... To detect probes To provide active network security To provide a means of deterrent To collect data on system behavior so as to

recover after intrusion To indirectly provide useful information

6

31

History of IDS Developments/Products

32

IDS Goals

• Differentiate normal from damaging actions

• Scalable

• Variety of network systems and architectures

• Adapts in response to new attacks

• Reports attacks in real-time

• Co-operates with other security mechanisms

33

IDS Goals

• Increase monitoring at suspicious points

• Protect against being attacked itself

• Function in face of network failure

• Minimal performance impact

• Generate audit information

• Reflect security policy of organisation

X34

IDS Architecture

35

IDS Architecture Components

• Sensors - data gathering for the IDS

• Monitors - process the collected data

• Resolver - determines appropriate responses

• Controller - configuration of components in a distributed

systemModern IDS apply these components in a cascadingfashion, ie - allowing higher level system overviews to begained as a user ascends through the tree

36

IDS Techniques

• Misuse Detection (M-IDS) - attempts to match

observed v expected behaviour (eg signature

analysis, Petri nets, state transition diagrams, genetic

algorithms)

• Anomaly Detection (A-IDS) - models expected

behaviour (eg statistical, expert systems, neural

networks)

7

37

IDS Techniques

• Location of Sensors - network-based (no processing

overheads and difficult to attack) or host-based

(performance impact but good data collection)

• Monitor Processing Patterns - real-time (cf. batch)

detection of significant benefit (performance issues)

• Distributed Correlation - simple interfaces (eg Shadow)

or hierarchical (eg GrIDS)

38

Capabilities of IDS

• Second level of defense if primary security fails

• Clear view and summary (eg Tripwire)

• Extracts information useful in tracking intrusions

• Identifies nature of abuse - (eg systems

modifications for later backdoor use)

• IDS logs as evidence in legal cases

39

Capabilities of IDS

• IDS can assist in detecting mis-configurations

• Combined with network security scanners, security

holes can be revealed - eg finding particular firewall

is vulnerable to certain attacks

• IDS can determine which resources are targeted

• New attacks every month - simplifies detection

• IDS works well with security policy

40

Limitations of IDS

• Reporting tool - cannot stop ongoing intrusions• Cannot trace intrusion with poor authentication• Can only trace intrusion to point of entry to system• Must be aware of security policy• Attackers may attack IDS systems• Depends upon seeing all traffic• Models event - systems react in different ways• Widely spread attacks may be ignored• New attacks continually being discovered• Scaling problems

41

Current Development in IDS

• Distributed and scalable IDS• Use of AI and pattern matching• Embedded IDS in network devices• Use in other areas - telephone / credit card systems• Adaptation to new technologies• Automatic recognition of new attacks (adaptive AI)• IDS which responds to attacks in progress• IDS standards/groups (eg CIDF, IDWG, IDSC ….)

42

IPS - Intrusion Prevention Systems

Current IDS systems “notify” but do not react Current Firewalls are mainly static rule based systems IPS implies a combination of IDS + Firewall

This can still be static although sophisticated in its filtering andanalysis engines

If this is the case - is it different from IDS+firewall? “Conditional or Reactive” firewalls imply:

IDS / IPS / Firewall with dynamic rules which adapt to specificattack scenarios

8

43

Intrusion Detection Systems and Products

• Manual Review Techniques

• Full-scale IDS may not always be appropriate:

• connect dummy service to ports (eg IMAP (143), SMB

(139), HTTP (80) - trigger script when attacked

• use log files and audit info to build critical log• use simple monitors such as NetMon and FileMon

44

Types of IDS Host-based (HIDS)

searches for mis-configurations and dangerous settings,unusual privileges etc

Network-based (NIDS) checks host security policies, dangerous or unnecessary

services HybridVary according to whether:

fixed/wirelesscommercial/freewareoperating system

45

Host-Based IDS

GFi LANgaurd SELM Windows Commercialhttp://www.gfi.com/lanselm/index.html

EMERALD eXpert-BSM Solaris Commercialhttp://www.sdl.sri.com/projects/emerald/releases/eXpert-BSM/

ISS BlackICE Windows Commercial http://blackice.iss.net

Symantec Host IDS Windows/Solaris Commercialhttp://enterprisesecurity.symantec.com/products

LIDS Linux GPL http://www.lids.org

GPL = General Public Licence

46

Network-Based IDS

AirDefense Guard (Wireless IDS) Hardware Commercial

www.airdefense.net/products/airdefense_ids.shtm NetDetector Solution Hardware Commercial

www.niksun.com/index.php?id=194 Network Flight Recorder Security Hardware Commercial

RealSecure Network Sensor Windows/Linux/Solaris/NokiaCommercial

Symantec ManHunt Solaris/Linux Commercial Shoki *nix GPL http://shoki.sourceforge.net Snort *nix GPL http://www.snort.org Sourcefire Intrusion MS Hardware Commercial

47

Hybrid IDS

Prelude *nix GPL http://www.prelude-ids.org RealSecure Network Sensor Windows/*nix Commercial

www.iss.net/products_services

[nix = UNIX compatible][GPL = Public License]

48

• Lightweight IDS system capable of performing real-time trafficanalysis and packet logging

• Can perform protocol analysis, content searching/matching.

• Can be used to detect a variety of attacks and probes, eg:• buffer overflows• stealth port scans• CGI attacks• SMB probes• OS fingerprinting attempts

Example NIDS: SNORT

9

49

• Snort has three primary uses. It can be used as:• a packet sniffer like tcpdump• a packet logger (useful for network traffic debugging, etc)• a full network intrusion detection system

• Snort/IDS operates from a script rule file applied to eachpacket monitored

• Provides specialised access to IP packets, egfragmentation bit checks

• Example rule:alert tcp any any -> 192.168.0.1/24 111 {content: “|00 01 86 A5|”;

msg: “mountd access”; }

Example IDS: SNORT

50

Host-based IDS for Windows and carries out extensive portanalysis

• Four levels: Paranoid, Nervous, Cautious, Trusting• Provides back-trace of intruders via NetBios• Uses signature files to detect known attacks• Real time network usage graph• Links to full protocol stack• http://blackice.iss.net

Example IDS: BlackIce

51

Example IDS: BlackIce Display

52

Example IDS: ZoneAlarm

ZoneAlarm (= Firewall + IDS)• www.zonelabs.com• Personal firewall with security settings of High, Medium, Low

for both LAN and Internet connections, and a mail attachmentcheck setting

• Alerts occur when access to an unauthorised port isattempted. ZoneAlarm advises what likely cause is and howindicative of an attack it is

• Access is allowed/denied for programs on the host PC toconnect to the Internet

• ZoneAlarm Pro $US50 for single user and $US1800 for 50users

• ZoneAlarm - free for home users

53

Tools Supporting Active Security

• Mapping Tools• System Scanning Tools• System Integrity Checkers• Honeytraps / Honeypots

54

IDS Support Tools - Mapping Tools

Network Mappers• Commercial and free tools available - nmap and Cheops-

NG• Carry out - DNS zone transfers, address/port scanning,

host requests, promiscuous monitoring• nmap sends variety of packets with illegal flags, ICMP

echos, fragmented packets etc to hosts and analysingresponses

• eg recognise Linux with kernels older than 2.0.35 byusing packet with SYN and illegal flags set

10

55

IDS Support Tools - Mapping Tools

Cheops *nix GPL (no longer supported)www.marko.net/cheops/

Cheops-NG *nix GPL http://cheops-ng.sourceforge.net/ nmap *nix/Windows GPL http://www.insecure.org/nmap

56

Tools used to detect and report onvulnerabilities in computer or network

Uses database of known vulnerabilities andattempts matching to these records

For an attacker these tools allow location ofpotential specific targets, egopen HTTP port with a known vulnerability

IDS Support Tools - System Scanning Tools

57

IDS Support Tools - System Scanning Tools

Core Impact Windows Commercial GFi LANguard NSS Windows Commercial/Freeware ISS Internet Scanner Commercial Nessus *nix GPL www.nessus.org Rapid7 NeXpose Linux/Windows Commercial Retina Windows Commercial

58

Detect anomalies which may indicate that data oncomputer has been tampered with

Cannot detect intruders until after intrusion and soare not real-time like IDSs

Stores hashed snapshot of file systems andcompares to current system state and reportsdiscrepancies

IDS Support Tools - System Integrity Checkers

59

Tripwire is best exampleCommonly support hashing algorithms, eg - MD4/5,

SHA, ITU CRC-16 and -32 signaturesReference database based upon initial trusted systemOnly reports changes already present in systemLast line of defence - system is already compromised!


60

11

61


Aide *nix GPL Chkrootkit *nix Open Source Integrit *nix GPL Ionx Data Sentinel Windows Commercial GFi LANguard SIM Windows Commercial/Freeware Osiris *nix Open Source Samhain *nix GPL Tripwire *nix/Windows Commercial and Open Source

62

IDS Support Tools - Honeytraps

Current IDS methodologies have shortcomings: problem recognising novel attacks

occurrence of false positives

reporting of attacks of no interest

Honeytrap system – simulated or real system that

exists for sole purpose of being attacked!

Looks and behaves like real system

Must not be launching pad

Must gather valuable information on attacker

63

IDS Support Tools - Honeytraps

Bait and Switch *nix BSD KeyFocus Sensor Windows Commercial NetBait Enterprise i386-based Commercial Symantec Decoy Server Solaris Commercial Verizon NetFacade *nix Commercial NFR Back Officer Friendly (designed to prevent Back

Orifice scans) Commercial but free trial

64

KFSensorHoneypot

Output

65

Common Intrusion Detection Framework (CIDF) Common protocols and interface standards (1999)

Intrusion Detection Working Group (IDWG) Produced 4 Internet Drafts (2002)

Open Security Evaluation Criteria (OSEC) Evaluation of and tests on products (2003)

Intrusion Detection Systems Consortium (IDSC) Vendor consortium promoting product adoption by defining

common terminology, integrity, standards

IDS Standards

66

Intrusion Detection Experiments

• Watchguard firewall used as testbed for Intrusion

Detection Analysis

• simulates small office network

• single public server

• limited set of machines on firewall’s trusted network

• unspecified number of machines on external network

12

67 68

Sample Firewall policy might be ….• Incoming FTP traffic allowed (via proxy) only if destined for

204.137.98.164 - public server located in optional network• Outgoing FTP traffic allowed without restriction• Incoming HTTP traffic allowed (via proxy) only if destined for

204.137.98.165• Outgoing HTTP traffic allowed without restriction Incoming SMTP traffic

was allowed only to 177.209.49.31 (external firewall interface)• Outgoing SMTP traffic was allowed only from 177.209.0.25 (hypothetical

SMTP server on trusted network)• Configuration access to firewall allowed from internal networks• IP Masquerading was disabled• Port Autoblocking was disabled• All other ports and services were blocked

Intrusion Detection Case Study

69

1. Scan Web server (2) and IDS server (2) from Attack host (3)(all machines on a common network segment)

2. Scan Web server (1) and IDS server (1) from Attack host (3)(attack on optional from trusted network)

3. Scan Web server (2) and IDS server (2) from Attack host (2)(attack on trusted from optional network)

4. Scan Web server (1) and IDS server (1) from Attack host (1)(external attack on optional network)

5. Scan Web server (2) and IDS-server (2) from Attack host (1)(external attack on trusted network)


70

• Scan 1 gives baseline of what attacks IDS tools are capableof recognising, and corresponds to an internal attack ontrusted network

• Scan 2 simulates internal attack against optional network

• Scan 3 simulates result if machine on optional network iscompromised and then attacks internal machines

• Scan 4 -very common case - external attacker attempts toaccess machines on optional network

• Scan 5 is same situation for trusted network


71

Conclusions• IDS can highlight problems with Firewall configurations• Out-of-box configurations may be dangerous• Firewalls protect inaccessible machines well• Firewalls do not protect against application-level attacks• Firewalls are themselves vulnerable to attack• IDS tools can recognise many attacks• IDS tools have different detection sets• Network IDS recognise attacks from their area of coverage• Network scanning tools are susceptible to false readings• Firewalls offer minimal detection capabilities


Documents

Firewall Architecture and Application Layer Firewalls Intrusion