Architecture Flaws Internet Security Systems. All rights reserved. Contents are property of Internet Security Systems.
|
|
|
- Esmond Cameron
- 8 years ago
- Views:
Transcription
1 Architecture Flaws
2 #1 Architecture Flaw Security tools simply the problem (take short-cuts) Why do I care? Often the most exposed part of an environment Malware authors are becoming better with exploit development, are security vendors keeping pace? Are important things caught? Missed? Do they have any idea? With minor modifications to existing exploits most security tools can be evaded. If malware authors know this why don t you?
3 Network
4 Network Architecture Flaws Flaw #1 TCP is stream based (layer 4), network security products are packet based (layer 3) Flaw #2 The tricky bits are at the application layer (layer 7), but network security products are still at the network layer (layer 3).
5 Firewall Runs as inline device Inspects each packet as it comes in Assigns packet to flow Allow/block/other Stateful inspection opens temporary ports for applications FTP VoIP Etc.
6 Example FTP session Response to PASV command tells firewall to open up a new port 220 ftp.example.com FTP server (Version wu-2.6.2(1) Fri May 17 16:36:20 EDT 2002) re USER anonymous 331 Guest login ok, send your complete address as password. PASS Mozilla@ 230 Greetings! PASV 227 Entering Passive Mode (192,2,0,155,156,172) LIST 150 Opening BINARY mode data connection for /bin/ls. 226 Transfer complete.
7 Example FTP session Returns helpful error text 220 ftp.example.com FTP server (Version wu-2.6.2(1) Fri May 17 16:36:20 EDT 2002) re USER anonymous 331 Guest login ok, send your complete address as password. PASS 230 Greetings! Mary had a little lamb 500 Mary had a little lamb : command not understood
8 Example FTP session Cause desired response to come back in two packets More than 1500 of xxxxx Adjust size of input so that response is in the next packet So that second response packet starts with 227 Entering 220 ftp.example.com FTP server (Version wu-2.6.2(1) Fri May 17 16:36:20 EDT 2002) re USER anonymous 331 Guest login ok, send your complete address as password. PASS 230 Greetings! Mary had a little lamb xxxxxx 227 Entering Passive Mode (192,2,0,155,156,172) 500 Mary had a little lamb xxxxxx 227 Entering Passive Mode (192,2,0,155,156,172) : command not understood
9 Why this confused firewalls They are examining only one packet at a time They have no concept of TCP s stream nature Carefully constructed input may be invalid from a stream point of view, but valid from a packet point of view, and confuse the firewall Typical stateful-inspection firewall has 100 rules for opening ports dynamically E.g. VoIP Lots of opportunity to confuse the firewall
10 IDS/IPS IDS (Intrusion Detection System) Passively watches traffic, but does not interfere IPS (Intrusion Prevention System) Watches traffic AND interferes Inline device like firewalls So-called application-layer protection means searching packet payload for patterns Not true application-layer devices Inspection done mostly on per-packet basis Not true stream oriented devices
11 Example: Snort TCP rule Lots of Snort TCP rule use depth and offset keywords These are packet depth/offsets, not stream depth/offsets With TCP fragmentation, the depth and the offset within the packet can be changed, without changing the depth and offset within the stream. E.g. alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (\ msg:"netbios SMB "; \ content:" 00 "; depth:1; \ content:" FF SMB"; within:4; distance:3; \ );
12 Live Demo: Zotob attack Snort rule trigger on packet depth and offset This demonstration will show a minor change to the Zotob exploit that changes the depth and offset where Snort looks for patterns We see that while Snort detects the original exploit, it misses the changed one that takes advantage of TCP streaming Conclusion: depth and offset have no meaning on TCP, yet they are used heavily to write Snort rules.
13 Application-layer parsing CVE Outlook allows arbitrary command execution <html> <body> <img src="mailto:aa" /select javascript:alert('vulnerable')"> </body> </html>
14 HTTP/ OK Date: Wed, 29 Jun :53:41 GMT Server: Apache/ (Unix) PHP/4.0.6 Last-Modified: Wed, 29 Jun :53:41 GMT Cache-Control: no-cache Pragma: no-cache Expires: -1 Transfer-Encoding: chunked Content-Type: text/html 5 <html 9 > <body> 5 <img 4 src= 4 "mai 4 lto: 5 aa&qu 3 ot; CAN (chunked) 2 / 7 select 5 javas 5 cript 6 :alert 9 ('vulnera a ble')"> </ 8 body> </ 6 html> 1 0
15 CAN (7-bit Unicode) HTTP/ OK Date: Wed, 29 Jun :59:39 GMT Server: Apache/ (Unix) PHP/4.0.6 Last-Modified: Wed, 29 Jun :59:39 GMT Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Length: 145 Content-Type: text/html; charset=utf-7 +ADw-html+AD4 +ADw-body+AD4 +ADw-img src+ad0aig-mailto:aa+acy-quot; /select javascript:alert('vulnerable')+aciapg +ADw-/body+AD4 +ADw-/html+AD4
16 CAN (base64 encoded w/ chaff) HTTP/ OK Date: Wed, 29 Jun :05:05 GMT Server: Apache/ (Unix) PHP/4.0.6 Last-Modified: Wed, 29 Jun :05:05 GMT Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Length: 703 Content-Type: message/rfc822; charset=iso From: <Saved by Microsoft Internet Explorer 5> Subject: Date: MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_nextpart_000_0009_98f1ecb0.631ddd4f"; type="text/html" X-MimeOLE: Produced By Microsoft MimeOLE V This is a multi-part message in MIME format =_NextPart_000_0009_98F1ECB0.631DDD4F Content-Type: text/html Content-Transfer-Encoding: base64 P[G;.?h0bW_{#w_+%_~&%]I<Dxib!&2$R'5 Pg,^o8(;aW1nI:$H );_N'-?>yYz$0i\(*~?bWF>p^ b.&hrv}omf#.hjn%#:f1b3q`7_ic{9(#@z#.z_w}xl_y&3qg[amf*2yx#n^} ^?^`j() cm$]>_l% w,dd"$p](hb._\^#gvy'>d@!!_~cgnd`n[ Vsb](m'VyYW_JsZS#c`!)#"p'I@%j4KP'C9i`~b.:2 ]R5'{P?$i';A_8L *,2)h}0)@bWw_+Cgo= =_NextPart_000_0009_98F1ECB0.631DDD4F--
17 CAN (synopsis) Base64 (with or without; with or without chaffing) Compression (none, gzip, or deflate) Chunked (with or without chaffing) Character set ASCII, UTF-8, UTF-7, UTF-16LE, UTF16BE, UTF-32LE, UTF-32BE Specified in HTTP header, initial bytes of document, or HTML tag The above can be combined in thousands of ways commonly occurs in normal web traffic
18 BAES64 fragging Used by some viruses Surprisingly effective at evading spam and virus checking --CSmtpMsgPart123X456_000_00A525F4 Content-Type: application/octet-stream; name="document.pif" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="document.pif TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v ZGUuDQ0KJAAAAAAAAABSj0hvFu4mPBbuJjwW7iY8 lfiopazujjz+8sw8bo4mpedxntwb7iy8fu4m PBXuJjwW7ic8hu4mPHTxNTwb7iY8/vEtPA3uJjxSaWNoFu4mPAAAAAAAAAAAUEUAAEwBAwBEk9c+ AAAAAAAAAADgAA8BCwEGAADgAAAAEAAAABABANDyAQAAIAEAAAACAAAAQAAAEAAAAAIAAAQAAAAA AAAABAAAAA AAAAAAEAIAABAAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAA AAAAAAIA0AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAABDREQwAAAAAAAQAQAAEAAAAAAAAAAEAAAAAAA AAAAAAAAAAACAAADgQ0REMQAAAAAA 4AAAACABAADWAAAABAAAAAAAAAAAAAAAAAAAQAAA4ENERDIAAAAAABAAAAAAAgAAAgAAANoAAAAA
19 Upper Layers vs. Network Layer Fragmentation happens at all layers IP Packets can be fragmented TCP Streams can be segmented NamedPipes Pipe writes can be fragmented MS-RPC PDUs can be fragmented HTTP Payloads can be chunked
20 Zotob again Zotob runs over MS-RPC, over NamedPipes, over SMB, over NetBIOS, over TCP, over IP, over Rather than open socket, open null-session WNetAddConnection2( \\target\ipc$, "", "", 0); Rather than doing sockets, open a named-pipe over that session CreateFile( \\target\pipe\browser, ); Rather than doing a send on the socket, do a write on the named-pipe WriteFile( fp, SMB_PNPEndpoint+0x58, sizeof(smb_pnpendpoint)-1-0x58, &bytes_written, &ov); Rather than doing a single write, instead write the traffic one byte at a time
21 Default Snort/2.4.0 config # tcp stream reassembly directive # no arguments loads the default configuration # Only reassemble the client, # Only reassemble the default list of ports (See below), # ports [list] - use the space separated list of ports in [list], "all # will turn on reassembly for all ports, "default" will turn # on reassembly for ports 21, 23, 25, 42, 53, 80, 110, # 111, 135, 136, 137, 139, 143, 445, 513, 1433, 1521, # and 3306 Meaning 90% of network traffic is not reassembled Turning on reassembly does what to performance? This issue is endemic to all products What the product can do in theory (in order to pass the tests) is not what 99% of the customers have deployed i.e. even if an IPS tests says a product protects against X, there is a chance that 99% of the customers can still be attacked using X.
22 Evasion techniques in the wild Toolkits Metasploit CANVAS Impact Techniques Custom shell-code Polymorphic shell-code Known tweaks cmd.exe /K rather than cmd.exe Set DIRCMD=/b Fragmentation IP, TCP, named-pipe, MS-RPC, etc. Obfuscation Unicode, endian, insertion, etc.
23 Host
24 Host based IPS Runs on host to provide last line of defense. Incorporates NIPS and Firewall like capabilities. Also may include a myriad of other technologies File protection Generic buffer overflow protection Shellcode execution prevention Process blacklist/whitelist
25 Host based IPS Generic Buffer overflow detection Designed to stop buffer overflows by focusing on detection of payloads Detection can be done via a variety of different methods. API hooking Stack back trace Sandboxes Detection can be implemented in two different places Ring 0 Ring 3
26 Host based IPS Why is protection in ring 3 a bad idea? If you wanted to stop this car from crossing the bridge, now is a bad time to start.
27 How a buffer overflow is caught The scenario An attacker sends an exploit Heap corruption occurs and exploit now has the ability to execute its payload How API hooking and stack backtracing would detect this. Once the payload makes a monitored function call a hook is tripped and a jmp is done into a runtime analysis engine. The run time analysis engine makes a determination based on details like where the call is being made from and the memory protection on the calling page Writeable and executable memory pages are bad. A backtrace of the stack could also be performed, tracing the execution back a certain depth. If the analysis engine determines the function call is bad it can terminate the request by doing an immediate ret.
28 How a buffer overflow is caught What is API hooking? Insertion of some type of conditional jmp somewhere in a function that will switch control to some other element when tripped. The function prologue can be replaced with an arbitrary jmp to analysis engine. If function is found to be legit the prologue is executed and a jmp back to the function occurs. Example: Function prologue goes from: push ebp jmp mov ebp, esp to:
29 How a buffer overflow is caught How would a sandbox detect this attack? During the heap corruption phase the instructions would be virtualized first. If the result of an operation is memory corruption the instruction is not allowed to execute.
30 How a buffer overflow is caught What is a Sandbox? A virtual environment that allows execution of instructions but in theory has no impact on the operation of the host machine
31 You have seen the good, now the bad. API Hooking and stack backtracing Evasion methods first publicly discussed by Jamie Butler in Phrack Why execute the hook? A fake stack frame can be constructed by a clued-in attacker. Why is this a flawed system? Most tools who rely on these techniques implement them in userspace. While in userspace the executing code does not have to follow the set way execution attempts are done. Shellcode that makes syscalls directly. If the shellcode makes syscalls directly, all the userland hooking won t do any good because they will never be executed.
32 You have seen the good, now the bad. Dealing with embedded hooks. The Butler described method works well for detecting execution of top level functions, what about the functions they call? CreateProcess -> CreateProcessA -> CreateProcessInternalA What happens if all the functions in the chain are hooked? Jumping over the hook in the first function will still get you nabbed by the second function. Why not just remove the hooks? Your shellcode can test to make sure the beginning of the function is a function prologue. If not, since you are in userland, your shellcode can do a VirtualProtect on the functions page and just overwrite the hook with a function prologue. No more hook. What if VirtualProtect is hooked? If you trace VirtualProtect you will find that you can emulate what it does right up to the syscall in your shellcode.
33 You have seen the good, now the bad. Sandboxes and virtualizing instructions Explore what they don t count on. Corrupting their sandbox Since the protection is in userspace a virtualized instruction has the ability to corrupt the sandbox it is running on. By doing this the sandbox can be tricked into doing your dirty work. Combinations of protection If these methods are combined since they are all still in userspace you can layer the attacks to defeat them.
34 False HIPS trigger on the wrong things all the time:
35 False Was it?
36 False Why did it happen? Some assumptions are made on the part of HIPS about what is and what isn t bad. Screensavers sometimes hook keyboard and mouse events so they can know when to deactivate. Most HIPS will report this as a problem since backdoors also use this method to log keystrokes. What other assumptions are made? Network traffic Process behavior File access
37 Other problems? Things to check while testing! The firewall. Its hard to do a personal firewall on the host correctly. Correct operations of a firewall may introduce system latency. For the reason of shortcuts many incorrect assumptions are made: Src Port 53. The IPS engine Where does the engine hook? If to early it may be susceptible to application level evasions. Too late and you could impact performance with analyzing. Gap in coverage How long after system boot does the protection engage?
38 Other problems? Application protection This is generally done by hooking loader calls How many loaders does Windows have? MSDOS and.bat Win16 POSIX OS2 Are they all covered? Is the hook a userland hook? Does it check for injection of code into a process. Does it check new processes created by existing processes?
39 Questions: Rob Graham, Chief Security Officer, ISS David Maynor, X-Force researcher, ISS
Barracuda Intrusion Detection and Prevention System
Providing complete and comprehensive real-time network protection Today s networks are constantly under attack by an ever growing number of emerging exploits and attackers using advanced evasion techniques
Playing with Web Application Firewalls
Playing with Web Application Firewalls DEFCON 16, August 8-10, 2008, Las Vegas, NV, USA Who is Wendel Guglielmetti Henrique? Penetration Test analyst at SecurityLabs - Intruders Tiger Team Security division
Attacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com
Attacking Host Intrusion Prevention Systems Eugene Tsyrklevich eugene@securityarchitects.com Agenda Introduction to HIPS Buffer Overflow Protection Operating System Protection Conclusions Demonstration
Implementation of Web Application Firewall
Implementation of Web Application Firewall OuTian 1 Introduction Abstract Web 層 應 用 程 式 之 攻 擊 日 趨 嚴 重, 而 國 內 多 數 企 業 仍 不 知 該 如 何 以 資 安 設 備 阻 擋, 仍 在 採 購 傳 統 的 Firewall/IPS,
NETWORK INTRUSION PREVENTION SYSTEM PRODUCT ANALYSIS
NETWORK INTRUSION PREVENTION SYSTEM PRODUCT ANALYSIS McAfee Network Security Platform NS9200 v7.1.5 2013 Ryan Liles, Joseph Pearce Overview NSS Labs performed an independent test of the McAfee NS9200 v7.1.5.
FTP e TFTP. File transfer protocols PSA1
FTP e TFTP File transfer protocols PSA1 PSA2 PSA3 PSA4 PSA5 PSA6 PSA7 PSA8 PSA9 Firewall problems with FTP Client-side Firewalls the client is behind a firewall and cannot be reached directly from the
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
CSE331: Introduction to Networks and Security. Lecture 17 Fall 2006
CSE331: Introduction to Networks and Security Lecture 17 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Summary:
Divide and Conquer Real World Distributed Port Scanning
Divide and Conquer Real World Distributed Port Scanning Ofer Maor CTO Hacktics 16 Feb 2006 Hackers & Threats I, 3:25PM (HT1-302) Introduction Divide and Conquer: Real World Distributed Port Scanning reviews
Network Technologies
Network Technologies Glenn Strong Department of Computer Science School of Computer Science and Statistics Trinity College, Dublin January 28, 2014 What Happens When Browser Contacts Server I Top view:
NEXT GENERATION FIREWALL PRODUCT ANALYSIS
NEXT GENERATION FIREWALL PRODUCT ANALYSIS Palo Alto Networks PA- 3020 v6.0.5- h3 Authors Christopher Conrad, Joseph Pearce Overview NSS Labs performed an independent test of the Palo Alto Networks PA-
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
NEXT GENERATION FIREWALL PRODUCT ANALYSIS
NEXT GENERATION FIREWALL PRODUCT ANALYSIS Cisco ASA 5585- X SSP60 v5.3.1 Authors Joseph Pearce, Christopher Conrad Overview NSS Labs performed an independent test of the Cisco ASA 5585- X SSP60 v5.3.1.
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
NEXT GENERATION INTRUSION PREVENTION SYSTEM (NGIPS) TEST REPORT
NEXT GENERATION INTRUSION PREVENTION SYSTEM (NGIPS) TEST REPORT Fortinet FortiGate-1500D FortiOS v5.2.2 build 642 Author Ty Smith Overview NSS Labs performed an independent test of the Fortinet FortiGate-1500D
Playing with Web Application Firewalls
Playing with Web Application Firewalls Who is Wendel? Independent penetration test analyst. Affiliated to Hackaholic team. Over 7 years in the security industry. Discovered vulnerabilities in Webmails,
Vulnerability-Focused Threat Detection: Protect Against the Unknown
Vulnerability-Focused Threat Detection: Protect Against the Unknown Vulnerabilities and threats are being discovered at a pace that traditional exploit-based attack detection technology cannot meet. Vulnerability-focused
Exploiting nginx chunked overflow bug, the undisclosed attack vector
Exploiting nginx chunked overflow bug, the undisclosed attack vector Long Le longld@vnsecurity.net About VNSECURITY.NET CLGT CTF team 2 VNSECURITY.NET In this talk Nginx brief introduction Nginx chunked
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET)
2- Electronic Mail (SMTP), File Transfer (FTP), & Remote Logging (TELNET) There are three popular applications for exchanging information. Electronic mail exchanges information between people and file
Intrusion Detection Systems
Intrusion Detection Systems Assessment of the operation and usefulness of informatics tools for the detection of on-going computer attacks André Matos Luís Machado Work Topics 1. Definition 2. Characteristics
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning
Passive Vulnerability Detection
Page 1 of 5 Passive Vulnerability Detection "Techniques to passively find network security vulnerabilities" Ron Gula rgula@securitywizards.com September 9, 1999 Copyright 1999 Network Security Wizards
How Lastline Has Better Breach Detection Capabilities. By David Strom December 2014 david@strom.com
How Lastline Has Better Breach Detection Capabilities By David Strom December 2014 david@strom.com The Internet is a nasty place, and getting nastier. Current breach detection products using traditional
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
Defense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
TEST METHODOLOGY. Endpoint Protection Evasion and Exploit. v4.0
TEST METHODOLOGY Endpoint Protection Evasion and Exploit v4.0 Table of Contents 1 Introduction... 3 1.1 Inclusion Criteria... 3 2 Product Guidance... 5 2.1 Recommended... 5 2.2 Neutral... 5 2.3 Caution...
13 Ways Through A Firewall
Industrial Control Systems Joint Working Group 2012 Fall Meeting 13 Ways Through A Firewall Andrew Ginter Director of Industrial Security Waterfall Security Solutions Proprietary Information -- Copyright
Virtual Fragmentation Reassembly
Virtual Fragmentation Reassembly Currently, the Cisco IOS Firewall specifically context-based access control (CBAC) and the intrusion detection system (IDS) cannot identify the contents of the IP fragments
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
CrashPlan Security SECURITY CONTEXT TECHNOLOGY
TECHNICAL SPECIFICATIONS CrashPlan Security CrashPlan is a continuous, multi-destination solution engineered to back up mission-critical data whenever and wherever it is created. Because mobile laptops
Computer Networks. Lecture 7: Application layer: FTP and HTTP. Marcin Bieńkowski. Institute of Computer Science University of Wrocław
Computer Networks Lecture 7: Application layer: FTP and Marcin Bieńkowski Institute of Computer Science University of Wrocław Computer networks (II UWr) Lecture 7 1 / 23 Reminder: Internet reference model
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Using Nessus to Detect Wireless Access Points. March 6, 2015 (Revision 4)
Using Nessus to Detect Wireless Access Points March 6, 2015 (Revision 4) Table of Contents Introduction... 3 Why Detect Wireless Access Points?... 3 Wireless Scanning for WAPs... 4 Detecting WAPs using
REMOVING THE MYSTERY OF SECURITY ENGINES AND THEIR EFFECT ON YOUR NETWORK
REMOVING THE MYSTERY OF SECURITY ENGINES AND THEIR EFFECT ON YOUR NETWORK Philip Trainor Senior Manager Applications and Security Ixia Communications Session ID: SPO-T02 Session Classification: Intermediate
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr HTTP/1.1 200 OK Date: Thu, 20 Oct 2005 14:42:54 GMT Server: Apache/2.0.50 (Linux/SUSE) Last-Modified: Thu, 20 Oct 2005 14:41:56 GMT ETag: "2d7b4-14b-8efd9500"
No. Time Source Destination Protocol Info 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.
Ethereal Lab: HTTP 1. The Basic HTTP GET/response interaction 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.1 GET /ethereal-labs/http-ethereal-file1.html
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
APACHE WEB SERVER. Andri Mirzal, PhD N28-439-03
APACHE WEB SERVER Andri Mirzal, PhD N28-439-03 Introduction The Apache is an open source web server software program notable for playing a key role in the initial growth of the World Wide Web Typically
Custom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
13 Ways Through A Firewall What you don t know will hurt you
Scientech 2013 Symposium: Managing Fleet Assets and Performance 13 Ways Through A Firewall What you don t know will hurt you Andrew Ginter VP Industrial Security Waterfall Security Solutions andrew. ginter
CloudOYE CDN USER MANUAL
CloudOYE CDN USER MANUAL Password - Based Access Logon to http://mycloud.cloudoye.com. Enter your Username & Password In case, you have forgotten your password, click Forgot your password to request a
NETWORK INTRUSION PREVENTION SYSTEM
NETWORK INTRUSION PREVENTION SYSTEM PRODUCT ANALYSIS Fortinet FortiGate 3240C METHODOLOGY VERSION: 6.2 Independent & unsponsored test report. This and other related documents available at: http://www.nsslabs.com/ips
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS)
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS) Internet (In)Security Exposed Prof. Dr. Bernhard Plattner With some contributions by Stephan Neuhaus Thanks to Thomas Dübendorfer, Stefan
Virtualization System Security
Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability
Reverse Engineering and Computer Security
Reverse Engineering and Computer Security Alexander Sotirov alex@sotirov.net Introduction Security researcher at Determina, working on our LiveShield product Responsible for vulnerability analysis and
CSE331: Introduction to Networks and Security. Lecture 18 Fall 2006
CSE331: Introduction to Networks and Security Lecture 18 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Attacker
Intrusion Detection in AlienVault
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
1 Introduction: Network Applications
1 Introduction: Network Applications Some Network Apps E-mail Web Instant messaging Remote login P2P file sharing Multi-user network games Streaming stored video clips Internet telephone Real-time video
Appendix. Web Command Error Codes. Web Command Error Codes
Appendix Web Command s Error codes marked with * are received in responses from the FTP server, and then returned as the result of FTP command execution. -501 Incorrect parameter type -502 Error getting
Application Security Policy
Purpose This document establishes the corporate policy and standards for ensuring that applications developed or purchased at LandStar Title Agency, Inc meet a minimum acceptable level of security. Policy
Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows
Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military
Lab exercise: Working with Wireshark and Snort for Intrusion Detection
CS 491S: Computer and Network Security Fall 2008 Lab exercise: Working with Wireshark and Snort for Intrusion Detection Abstract: This lab is intended to give you experience with two key tools used by
Data Communication I
Data Communication I Urban Bilstrup (E327) 090901 Urban.Bilstrup@ide.hh.se www2.hh.se/staff/urban Internet - Sweden, Northern Europe SUNET NORDUnet 2 Internet - Internet Addresses Everyone should be able
1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment?
Questions 1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment? 4. When will a TCP process resend a segment? CP476 Internet
TEST METHODOLOGY. Next Generation Firewall (NGFW) v5.4
TEST METHODOLOGY Next Generation Firewall (NGFW) v5.4 Table of Contents 1 Introduction... 5 1.1 The Need For Next Generation Firewalls (NGFW)... 5 1.2 About This Test Methodology And Report... 5 1.3 Inclusion
How To Make An Attack Unnoticed By A Network Security System (Ipo) Or A Network (Ngfw) Without Being Detected (Ngw)
OLLI-PEKKA NIEMI & ANTTI LEVOMÄKI Bypassing Intrusion Prevention Systems Who?! ANTTI LEVOMÄKI! Stonesoft R&D! Evasion Research & TCP/IP Black Arts! Postgraduate student at Aalto University! OLLI-PEKKA
Remote Network Analysis
Remote Network Analysis Torsten Hoefler htor@cs.tu-chemnitz.de (DMZ), mostly between two packet filters and application gateways. The different possibilities to connect DMZ-hosts are also shown in Figure
Protocol-Level Evasion of Web Application Firewalls
Protocol-Level Evasion of Web Application Firewalls USA2012 Ivan Ristic Director of Engineering True Evasion Story Once, a long time ago, I evaded a web application firewall by adding a single character
Qualys API Limits. July 10, 2014. Overview. API Control Settings. Implementation
Qualys API Limits July 10, 2014 Overview The Qualys API enforces limits on the API calls a customer can make based on their subscription settings, starting with Qualys version 6.5. The limits apply to
Log Audit Ensuring Behavior Compliance Secoway elog System
As organizations strengthen informatization construction, their application systems (service systems, operating systems, databases, and Web servers), security devices (firewalls and the UTM, IPS, IDS,
Modern Web Development From Angle Brackets to Web Sockets
Modern Web Development From Angle Brackets to Web Sockets Pete Snyder Outline (or, what am i going to be going on about ) 1.What is the Web? 2.Why the web matters 3.What s unique about
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
DEERFIELD.COM. DNS2Go Update API. DNS2Go Update API
DEERFIELD.COM DNS2Go Update API DNS2Go Update API DEERFIELD.COM PRODUCT DOCUMENTATION DNS2Go Update API Deerfield.com 4241 Old U.S. 27 South Gaylord, MI 49686 Phone 989.732.8856 Email sales@deerfield.com
Network Simulation Traffic, Paths and Impairment
Network Simulation Traffic, Paths and Impairment Summary Network simulation software and hardware appliances can emulate networks and network hardware. Wide Area Network (WAN) emulation, by simulating
My FreeScan Vulnerabilities Report
Page 1 of 6 My FreeScan Vulnerabilities Report Print Help For 66.40.6.179 on Feb 07, 008 Thank you for trying FreeScan. Below you'll find the complete results of your scan, including whether or not the
Intrusion Detection Categories (note supplied by Steve Tonkovich of CAPTUS NETWORKS)
1 of 8 3/25/2005 9:45 AM Intrusion Detection Categories (note supplied by Steve Tonkovich of CAPTUS NETWORKS) Intrusion Detection systems fall into two broad categories and a single new one. All categories
P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis
Agenda Richard Baskerville P Principles of P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Principles Kim, et al (2004) A fuzzy expert system for
IDS Categories. Sensor Types Host-based (HIDS) sensors collect data from hosts for
Intrusion Detection Intrusion Detection Security Intrusion: a security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts
Managing Latency in IPS Networks
Application Note Revision B McAfee Network Security Platform Managing Latency in IPS Networks Managing Latency in IPS Networks McAfee Network Security Platform provides you with a set of pre-defined recommended
Announcements. Lab 2 now on web site
Lab 2 now on web site Announcements Next week my office hours moved to Monday 4:3pm This week office hours Wednesday 4:3pm as usual Weighting of papers for final discussion [discussion of listen] Bro:
Lab VI Capturing and monitoring the network traffic
Lab VI Capturing and monitoring the network traffic 1. Goals To gain general knowledge about the network analyzers and to understand their utility To learn how to use network traffic analyzer tools (Wireshark)
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE. Summary. Distribution and Installation
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE Distribution: Merchants, Acquirers Who should read this: Information security, incident response, cyber intelligence staff Summary Kuhook
Analysis of Network Packets. C DAC Bangalore Electronics City
Analysis of Network Packets C DAC Bangalore Electronics City Agenda TCP/IP Protocol Security concerns related to Protocols Packet Analysis Signature based Analysis Anomaly based Analysis Traffic Analysis
Introduction to Intrusion Detection and Snort p. 1 What is Intrusion Detection? p. 5 Some Definitions p. 6 Where IDS Should be Placed in Network
Introduction to Intrusion Detection and Snort p. 1 What is Intrusion Detection? p. 5 Some Definitions p. 6 Where IDS Should be Placed in Network Topology p. 8 Honey Pots p. 9 Security Zones and Levels
NEXT GENERATION FIREWALL TEST REPORT
NEXT GENERATION FIREWALL TEST REPORT Check Point Software Technologies, Ltd. 13800 Next Generation Firewall Appliance vr77.20 Author Timothy Otto Overview NSS Labs performed an independent test of the
Vodia PBX RESTful API (v2.0)
Vodia PBX RESTful API (v2.0) 2015 Vodia Networks Inc. All rights reserved. Page 1 of 30 Contents Login... 3 Get license info... 4 Get a complete list of domains... 5 Get the details of a specific domain...
An Overview of the Bro Intrusion Detection System
An Overview of the Bro Intrusion Detection System Brian L. Tierney, Vern Paxson, James Rothfuss Lawrence Berkeley National Laboratory Typical Approach: Firewall with default deny policy A blocking router
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda
The Hyper-Text Transfer Protocol (HTTP)
The Hyper-Text Transfer Protocol (HTTP) Antonio Carzaniga Faculty of Informatics University of Lugano October 4, 2011 2005 2007 Antonio Carzaniga 1 HTTP message formats Outline HTTP methods Status codes
HoneyBOT User Guide A Windows based honeypot solution
HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
Network- vs. Host-based Intrusion Detection
Network- vs. Host-based Intrusion Detection A Guide to Intrusion Detection Technology 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free: 800.776.2362 Fax: 678.443.6477
Internet Technologies Internet Protocols and Services
QAFQAZ UNIVERSITY Computer Engineering Department Internet Technologies Internet Protocols and Services Dr. Abzetdin ADAMOV Chair of Computer Engineering Department aadamov@qu.edu.az http://ce.qu.edu.az/~aadamov
Integrating Fax Sending Services
Integrating Fax Sending Services Developer Guide Enabled by Popfax Integrating Fax Sending Services Using SMTP API (mail to fax) DEVELOPER GUIDE Enabled by Popfax We recommend developers to register as
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
Intrusion Defense Firewall
Intrusion Defense Firewall Available as a Plug-In for OfficeScan 8 Network-Level HIPS at the Endpoint A Trend Micro White Paper October 2008 I. EXECUTIVE SUMMARY Mobile computers that connect directly
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Hydra. Advanced x86 polymorphic engine. Incorporates existing techniques and introduces new ones in one package. All but one feature OS-independent
Hydra Advanced x86 polymorphic engine Incorporates existing techniques and introduces new ones in one package All but one feature OS-independent Random register operations Different synonymous instructions
Pwning Intranets with HTML5
Javier Marcos de Prado Juan Galiana Lara Pwning Intranets with HTML5 2009 IBM Corporation Agenda How our attack works? How we discover what is in your network? What does your infrastructure tell us for
Intrusion Detection. this is not the packet you are looking for, move along
Intrusion Detection this is not the packet you are looking for, move along About Security-Assessment.com Specialise in high quality Information Security services throughout the Asia Pacific region Our
Automated Vulnerability Scan Results
Automated Vulnerability Scan Results Table of Contents Introduction...2 Executive Summary...3 Possible Vulnerabilities... 7 Host Information... 17 What Next?...20 1 Introduction The 'www.example.com' scan
Application-layer Protocols and Internet Services
Application-layer Protocols and Internet Services Computer Networks Lecture 8 http://goo.gl/pze5o8 Terminal Emulation 2 Purpose of Telnet Service Supports remote terminal connected via network connection
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
DATA CENTER IPS COMPARATIVE ANALYSIS
DATA CENTER IPS COMPARATIVE ANALYSIS Security 2014 Thomas Skybakmoen, Jason Pappalexis Tested Products Fortinet FortiGate 5140B, Juniper SRX 5800, McAfee NS- 9300, Sourcefire 8290-2 Data Center Overview
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
Transformation of honeypot raw data into structured data
Transformation of honeypot raw data into structured data 1 Majed SANAN, Mahmoud RAMMAL 2,Wassim RAMMAL 3 1 Lebanese University, Faculty of Sciences. 2 Lebanese University, Director of center of Research