AdvancedLinuxFirewalls MichaelRash SecurityArchitect EnterasysNetworks,Inc. http://www.cipherdyne.org/ 03/12/2008 SOURCEBoston,2008 Copyright(C)2008MichaelRash 1
Agenda IntrusionDetectionandPreventionviaiptables Snortruleemulationviaiptablesextensions (fwsnort) iptablesloganalysis(psad) iptableslogdatavisualizations psad+afterglow+gnuplot SinglePacketAuthorization+fwknop 1.9.2release LiveDemo Copyright(C)2008MichaelRash 2
NoStarchPress,Oct2007 Copyright(C)2008MichaelRash 3
WhyTalkaboutiptablesinthe ContextofIntrusionDetection? SnortandcommercialIDSinfrastructureismature(subjectto usualconcernsaroundfalsepositives),butwhystopthere? IDS'scanthemselvesbetargeted,bothfromthedetectionand codeexecutionstandpoints ModifiedStick/SnottosendfakedattacksoverTor SnortDCE/RPCPreprocessorvulnerability Defense in depthisimportant Hostfragmentreassemblyissueslessofaconcernforiptables stringmatching(moreonthislater) Copyright(C)2008MichaelRash 4
IDSandiptables Canspecifygranularpacketheadertests,and loggingformatcontainsnearlyallinteresting packetheaderfields Canmatchagainstconnectionstates UsefulformitigatingStick/Snotstyleattacks Stringmatchinginthekernelstartedinthe2.4 days(patchappliedvianetfilterpatch o matic); madeavailableagainin2.6.14 Copyright(C)2008MichaelRash 5
IDSandiptables(cont'd) Kerneltextsearch(linux/lib/ts_*)infrastructure Boyer MooreandKnuth Morris Prattalgorithms StringmatchingenabledbydefaultinrecentLinuxkernels Yougetnetworklayerdefragmentationforfreewhen connectiontrackingisusedyoudon'thavetorelyon properconfigurationoffrag3;itisthedefragmentation algorithmofthehost Stringmatchingwithinthefiltertablehappensafter networkdefrag Copyright(C)2008MichaelRash 6
HowAboutIntrusionPrevention? PlentyofreasonsNOTtorespond(falsepositives,possibilityof attackerabuse,possibilityoffingerprintingtheresponse mechanism) However: Canenvisionscenarioswherecontrollingtheshapeofapplicationlayerdatathat cantalktolocalsocketsisagoodthingiptablescanenforcethedroptarget (thisispreventioninsteadofjustsomeweakresponsemechanism) Someautomatedattacksdonotbotherwithobfuscation/encryptiontargetrich environment Sometimesitisnoteasytopatchaproductionserverwhoseuptimemustremain high(assumingapatchevenexists) Copyright(C)2008MichaelRash 7
fwsnort TranslatesSnortsignaturesinto equivalent iptablesrules usingstringmatchextensionandnetfilterconnection trackingsubsystem AlltranslatedSnortsignaturesareplacedwithinuser definedchains,towhichpacketsarejumpedfrombuilt in chains(input,output,andforward) Maintainsstrictseparationfromexistingiptablespolicy Approximately60%ofallSnort 2.3.3rules(rememberthis isanidssupplement)canbetranslated Copyright(C)2008MichaelRash 8
fwsnort(cont'd) ReportingviaLOGtarget(integrateswithpsad) WhitelistsviatheRETURNtarget BlacklistsviatheDROPorREJECTtargets EmulationofSnortconfigvariablessuchas$HOME_NETand $EXTERNAL_NET Snortsignatureinfostoredwiththeiptablescommentmatchin kernel space iptablesisinlinebydefinition;easytoconfigurefwsnorttouse thedroporrejecttargets Copyright(C)2008MichaelRash 9
psad iptablesloganalyzer Emailandsyslogreporting Fwsnortintegration DShieldintegration iptableslogvisualizationwithafterglowandgnuplot Built inpassiveosfingerprintingderivedfromp0f (requires log tcp options) IPoptionsdecoding(requires log ip options) Copyright(C)2008MichaelRash 10
psad(cont'd) CandetectSnortsignaturesthatdonotrequire applicationlayertests(sourceroutingattempts,lowttl values,icmpsourcequench,nachiworm,etc.).this isallpossiblebyvirtueofiptableslogformat completeness. DetectionofmanyportscantypesgeneratedbyNmap Timeout basedauto blocking(optional,andcanbe restrictedtoapplicationlayermatcheswithfwsnort) Whitelists/Blacklists Copyright(C)2008MichaelRash 11
iptablespacketflow Copyright(C)2008MichaelRash 12
fwsnortpacketflow Copyright(C)2008MichaelRash 13
ExampleSnortRule:nmap ExecutionviaWebServer alerttcp$external_netany >$HTTP_SERVERS $HTTP_PORTS (msg:"web ATTACKSnmapcommandattempt"; flow:to_server,established;content:"nmap%20";nocase; classtype:web application attack;sid:1361;rev:5;) Copyright(C)2008MichaelRash 14
fwsnorttranslation $IPTABLES AFWSNORT_FORWARD_ESTAB d 192.168.10.0/24 ptcp dport80 mstring string"nmap%20" algobm mcomment comment"msg:web ATTACKSnmapcommand attempt;classtype:web application attack; rev:5;fws:0.9.0;" jlog log tcp options log prefix"[1]sid1361estab" Copyright(C)2008MichaelRash 15
BLEEDING EDGEVIRUS Signature(MultipleContentFields) alerttcp$external_net$http_ports > $HOME_NETany(msg:"BLEEDING EDGEVIRUS Trojan Spy.Win32.BancosDownload";flow: established,from_server;content:"[aspackdie!]"; content:" 0f6d079e6c626c6800d22f636d649d11 afaf45c772ac5f3138d0 ";classtype:trojan activity; reference:url,securityresponse.symantec.com/avcenter/ve nc/data/pwsteal.bancos.b.html;sid:2001726;rev:6;) Copyright(C)2008MichaelRash 16
(translated) $IPTABLES AFWSNORT_FORWARD_ESTAB d 192.168.10.0/24 ptcp sport80 mstring string "[AspackDie!]" algobm mstring hex string" 0f6d 079e6c626c6800d22f636d649d11afaf45c772 ac5f3138d0 " algobm mcomment comment"msg: BLEEDING EDGEVIRUSTrojan Spy.Win32.Bancos Download;classtype:trojan activity;reference: url,securityresponse.symantec.com/avcenter/venc/data/pw steal.bancos.b.html;rev:6;fws:0.9.0;" jlog log ip options log tcp options log prefix"[640]sid2001726 ESTAB" Copyright(C)2008MichaelRash 17
SupportedSnortRuleOptions AllSnortruleheader options itype icode content ttl(ttlmatch) flow(conntrack) tos(tosmatch) flags ipopts offset ip_proto depth resp dsize(lengthmatch) Copyright(C)2008MichaelRash 18
UnsupportedSnortRuleOptions: LostinTranslation pcre flowbits byte_test< u32module(comingsoon2.6supportadded) byte_jump< u32module(comingsoon2.6supportadded) asn1 window< includediniptableslogs isdataat id< includediniptableslogs Copyright(C)2008MichaelRash 19
UnsupportedSnortRuleOptions (cont'd) icmp_id< includediniptableslogs icmp_seq< includediniptableslogs seq< includedwith log tcp sequence ack< includedwith log tcp sequence sameip< includediniptableslogs Thereareafewothers thosethatareloggedcanbe analyzedbypsad Copyright(C)2008MichaelRash 20
IntroducingiptablesLogs TCP UDP ICMP Copyright(C)2008MichaelRash 21
iptablestcplogmessage Mar1120:21:22minastirithkernel:[199] SID1361ESTABIN=eth1OUT= MAC=00:13:d3:38:b6:e4:00:13:46:c2:60:44:08: 00SRC=192.168.10.3DST=192.168.10.1LEN=60 TOS=0x00PREC=0x00TTL=63ID=11112DF PROTO=TCPSPT=28778DPT=80WINDOW=5840 RES=0x00ACKPSHURGP=0OPT (0101080A02A041D20CC386B1) Copyright(C)2008MichaelRash 22
iptablesipheadercoverage Copyright(C)2008MichaelRash 23
iptablestcpheadercoverage Copyright(C)2008MichaelRash 24
PassiveOSFingerprinting RequiredIP/TCPheaderfieldsforp0f: InitialTTL TCPwindowsize DFbit SYNpacketsize TCPoptionsandorderspecification Copyright(C)2008MichaelRash 25
p0fsignaturematchwithpsad Mar823:23:48minastirithkernel:DROP IN=eth0OUT=MAC=00:13:46:3a:41:4b: 00:90:1a:a0:1c:ec:08:00SRC=208.53.138.16 DST=71.N.N.NLEN=60TOS=0x00PREC=0x00TTL=55 ID=23249DFPROTO=TCPSPT=54155DPT=3128 WINDOW=5840RES=0x00SYNURGP=0OPT (020405B40402080A04C4FF5B0000000001030307) S4:64:1:60:M*,S,T,N,W7:Linux:2.6:8:Linux2.6.8andnewer Copyright(C)2008MichaelRash 26
iptablesudplogmessage Mar1120:50:54minastirithkernel:[153] SID2001597IN=eth0OUT= MAC=00:13:d3:38:b6:e4:00:13:46:c2:60:44:08: 00SRC=192.168.10.3DST=192.168.10.1LEN=40 TOS=0x00PREC=0x00TTL=63ID=29758DF PROTO=UDPSPT=32046DPT=61LEN=20 Copyright(C)2008MichaelRash 27
iptablesudpheadercoverage Copyright(C)2008MichaelRash 28
iptablesicmplogmessage Mar1120:57:18minastirithkernel:[98] SID2003294IN=eth0OUT= MAC=00:13:d3:38:b6:e4:00:13:46:c2:60:44:08: 00SRC=192.168.10.3DST=192.168.10.1 LEN=128TOS=0x00PREC=0x00TTL=63ID=53466 PROTO=ICMPTYPE=8CODE=0ID=27459SEQ=0 Copyright(C)2008MichaelRash 29
iptablesicmpheadercoverage Copyright(C)2008MichaelRash 30
HowAboutaniptablesLogData Source? HoneynetProjectScanChallenges Copyright(C)2008MichaelRash 31
HoneynetScanChallenge#34 Challengesummary: Challengeinformationandanalysiscanbefound here:http://www.honeynet.org/scans/scan34/ BothSnortandiptableslogdatamadeavailableto thecommunity(39mbofiptablesdata) Containsportscans,portsweeps,trafficfrom worms,andoutrightcompromisesofhoneynet systems Copyright(C)2008MichaelRash 32
PortSweepVisualization psad -m iptables.data --gnuplot -CSV-fields src:not11.11.0.0/16 dp:count --gnuplot-graph points -gnuplot-3d --gnuplot-view 74,77 -gnuplot-file-prefix portsweep Copyright(C)2008MichaelRash 33
VisualizingPortSweeps(IPvs. DestinationPortvs.PacketCount) Copyright(C)2008MichaelRash 34
TheTopPortSweeper: 200.216.205.189vs.TCP/3306 Copyright(C)2007MichaelRash 35
HoneynetVisualizations: CompromisedHosts Lookforoutboundconnectionsfromhoneynet hostswithafterglow(see http://www.secviz.org) #psad CSV miptablessyslog CSV fields "src:11.11.79.0/24dstdp" perl afterglow.pl ccolor.properties neato Tgif ooutbound_connections.gif Copyright(C)2008MichaelRash 36
Copyright(C)2008MichaelRash 37
NachiWormVisualization Lookfor92 byteicmpechorequests #psad CSV miptablessyslog CSV fields "srcdstip_len:92" CSV max300 CSV regex "PROTO=ICMP.*TYPE=8" perlafterglow.pl c color.properties neato Tgif o nachi_worm.gif Copyright(C)2008MichaelRash 38
Copyright(C)2008MichaelRash 39
EnhancingiptablesLogData Use log ip options Use log tcp sequence Use log tcp options Moreattackscanbedetected,andoperating systemscanbepassivelyfingerprinted Copyright(C)2008MichaelRash 40
PassiveAuthorization Basicidea: Combineadefault droppacketfilterwithapassive mechanismtoauthenticate(andauthorize)clients Thesecuritybenefitisderivedfromareductioninthe complexityofcodethatanarbitraryipaddresscaninteract with.everyfunctionhasanon zeroprobabilityofcontaining asecurityvulnerability ThisisNOTsecuritythroughobscurity;thisisconcealment (similartopasswordsandencryptionkeys) Copyright(C)2008MichaelRash 41
PortKnocking Usespacketheaderstotransmitinformation=>serious protocollimitations Difficulttoprotectagainstreplayattacks Lowdatatransfercapabilityimpliesasymmetricencryptionisnot feasible Knocksequencestriviallybustedfromanysourcewithspoofed duplicatepackets PortknockingsequenceslooklikeportscanstoanyIDS/IPSthatis watching Copyright(C)2008MichaelRash 42
SinglePacketAuthorization Next generationportknocking Usesapplicationlayerdata Replayattackseasilythwarted Supportsasymmetricciphers Onlyasinglepacketistransmitted,somuchless likelytotriggerids/ipsalarms Copyright(C)2008MichaelRash 43
fwknopfeatures fwknopd server includessupportforiptablesandipfw firewalls(linux,macosx,andfreebsd). fwknopclientincludessupportforlinux,macosx, FreeBSD,Windows2000,XP(underCygwin)orviathe WindowsUI(developedbySeanGreven) SPApacketsareencryptedeitherviaRijndaelorwithan asymmetricalgorithmsupportedbygnupg SupportsoutboundandinboundNAT(SNATandDNAT, withdnatsupportnewinfwknop 1.9.0) Copyright(C)2008MichaelRash 44
Newinfwknop 1.9.2 Client derivedfirewallaccesstimeouts Removalofencoded Salted prefixfromrijndaelspapackets SupportforLinux cooked interfaces(e.g.pppoe) Selectabledigestalgorithmsforreplayattackdetection(SHA256, SHA1,orMD5) BlacklistexclusionsforSPApackets SpecialthankstotheSPAPICTteam(Calsoftsecurityenthusiasts+students fromthepuneinstituteofcomputingtechnology: http://tech.groups.yahoo.com/group/spapict/)whocontributedmanyofthenew featuresinfwknop 1.9.2. Copyright(C)2008MichaelRash 45
fwknopforwardaccessviadnat rules Copyright(C)2008MichaelRash 46
fwknopspapacketformat randomnumber(16bytes) username timestamp softwareversion messagetypeandcontent: 0=>commandmode/commandtoexecute 1=>accessmode/IP,proto,port 2=>forwardaccessmode/IP,proto,port/internalIP,externalNATPort (optional)server_auth(post0.9.2release) messagedigest(sha256/sha1/md5) Copyright(C)2008MichaelRash 47
ExampleSPAPackets Cleartextmessage(fieldsarebase64encodedbeforeencrypted): 5514438870168371:cm9vdA==:1203874973:1.9.2 pre6:1:mti3ljaumc4ylhrjcc8ymg==:yaynmuufyi/93syvrviib4mxkbhn/93cb +Ceu5cUUf4 TwoSPApackets(encryptedwiththeRijndaelcipher): 9aoMEM9Jr5vHTdvKbx +phe3in6onbglezorpld4y1ymcgw1udngm1mai/8b2s41aohabyfvnzyxchfy Sp7hPusjzLyRhwStmDzFFazHxzNmBh9xsgAvrGLqmmQzYhS+ +7XmtIH2D8hPjpaDGaGzs1nZPxGpZ2mQ5bjhBkutwcrkqCbe9wZf0o /buclg8gnm4+wldclkxktywjqedemhjwh +g4lrgaal09cykpv9501z52zp00e/bru5oe/bkojed8hvewk3ldoyvvuxfpwt9c DF7FG6xF/Rk4FhjcDPkaqVZb4CpMr7Yqr2wyL5Lxqy6YI7rt2ZdqaVGBIdGtzlHL OoXnz5j4mC1+H6hxa7e0pO Copyright(C)2008MichaelRash 48
FutureWork WebproxythatcreatesSPApacketsonbehalf ofanyonewithawebbrowser IntegrationwiththepffirewallonOpenBSD Integrationwithadditionalclients(scp,sftp,mail clients,etc.) FirefoxSPAextension fwknopisopensource,pleasesubmitpatches! Copyright(C)2008MichaelRash 49
LiveDemo... Copyright(C)2008MichaelRash 50
References SecurityDataVisualization : http://www.nostarch.com/securityvisualization.htm SecVizSecurityVisualization :http://www.secviz.org RaffaelMarty'sBlogandAfterGlowproject:http://raffy.ch/blog/ MRTG:http://oss.oetiker.ch/mrtg/(psadsupportcomingsoon) Gnuplot:http://www.gnuplot.info/ Copyright(C)2008MichaelRash 51
References(cont'd) AnAnalysisofPortKnockingandSinglePacketAuthorization : http://www.securethoughts.net/spa/ SinglePacketAuthorizationwithfwknop : http://www.cipherdyne.org/fwknop/docs/spa.html EnhancingFirewalls:ConveyingUserandApplicationIdentificationtoNetwork Firewalls :http://pages.cpsc.ucalgary.ca/~degraaf/ WikipediaonPortKnocking:http://en.wikipedia.org/wiki/Port_knocking Hakin9onPortKnockingandSPA:http://mscoder.org/en/haking/articles_html.html LinuxJournalarticles: http://www.linuxjournal.com/article/9565 http://www.linuxjournal.com/article/9621 Copyright(C)2008MichaelRash 52
Questions? http://www.cipherdyne.org/ mbr@cipherdyne.org Copyright(C)2008MichaelRash 53