Internet Firewalls for Trusted Systems PDF

11 Internet Firewalls for Trusted Systems A ﬁrewall is a device or group of devices that controls access between networks. A ﬁrewall generally consists of ﬁlters and gateway(s), varying from ﬁrewall to ﬁrewall. It is a security gateway that controls access between the public Internet and an intranet (a private internal network) and is a secure computer system placed between a trusted network and an untrusted Internet. A ﬁrewall is an agent that screens network trafﬁc in some way, blocking trafﬁc it believes to be inappropriate, dangerous, or both. The security concerns that inevitably arise between the sometimes hostile Internet and secure intranets are often dealt with by inserting one or more ﬁrewalls in the path connecting the Internet and the internal network. In reality, Internet access provides beneﬁts to individual users, government agencies, and most organizations. But this access often creates a threat as a security ﬂaw. The protective device that has been widely accepted is the ﬁrewall. When inserted between the private intranet and the public Internet, it establishes a controlled link and erects an outer security wall or perimeter. The aim of this wall is to protect the intranet from Internet-based attacks and to provide a choke point where security can be imposed. Firewalls act as an intermediate server in handling SMTP and HTTP connections in either direction. Firewalls also require the use of an access negotiation and encapsulation protocol such as SOCKS to gain access to the Internet, the intranet, or both. Many ﬁrewalls support tri-homing, allowing use of a demilitarized zone (DMZ) network. It is possible for a ﬁrewall to accommodate more than three interfaces, each attached to a different network segment. Firewalls can be classiﬁed into three main categories: packet ﬁlters, circuit-level gateways, and application-level gateways. 11.1 Role of Firewalls The ﬁrewall imposes restrictions on packets entering or leaving the private network. All trafﬁc from inside to outside, and vice versa, must pass through the ﬁrewall, but only authorized trafﬁc will be allowed to pass. Packets are not allowed through unless they Wireless Mobile Internet Security, Second Edition. Man Young Rhee.  2013 John Wiley & Sons, Ltd. Published 2013 by John Wiley & Sons, Ltd. 388 WIRELESS MOBILE INTERNET SECURITY conform to a ﬁltering speciﬁcation or unless there is negotiation involving some sort of authentication. The ﬁrewall itself must be immune to penetration. Firewalls create checkpoints (or choke points) between an internal private network and an untrusted Internet. Once the choke points have been clearly established, the device can monitor, ﬁlter, and verify all inbound and outbound trafﬁc. The ﬁrewall may ﬁlter on the basis of IP source and destination addresses and TCP port number. Firewalls may block packets from the Internet side that claim a source address of a system on the intranet, or they may require the use of an access negotiation and encapsulation protocol like SOCKS to gain access to the intranet. The means by which access is controlled relate to using network layer or transport layer criteria such as IP subnet or TCP port number, but there is no reason that this must always be so. A growing number of ﬁrewalls control access at the application layer, using user identiﬁcation as the criterion. In addition, ﬁrewalls for ATM networks may control access based on the data link layer criteria. The ﬁrewall also enforces logging and provides alarm capacities as well. By placing logging services at ﬁrewalls, security administrators can monitor all access to and from the Internet. Good logging strategies are one of the most effective tools for proper net- work security. Firewalls may block TELNET or RLOGIN connections from the Internet to the intranet. They also block SMTP and FTP connections to the Internet from internal systems not authorized to send e-mail or to move ﬁles. The ﬁrewall provides protection from various kinds of IP spooﬁng and routing attacks. It can also serve as the platform for IPsec. Using the tunnel mode capability, the ﬁrewall can be used to implement Virtual Private Networks (VPNs). A VPN encapsulates all the encrypted data within an IP packet. A ﬁrewall can limit network exposure by hiding the internal network systems and information from the public Internet. The ﬁrewall is a convenient platform for security-unrelated events such as a net- work address translator (which maps local addresses to Internet addresses) and has a network management function that accepts or logs Internet usage. The ﬁrewall certainly has some negative aspects: it cannot protect against internal threats such as an employee who cooperates with an external attacker; it is also unable to protect against the transfer of virus-infected programs or ﬁles because it is impossible for it to scan all incoming ﬁles, e-mail, and messages for viruses. However, since a ﬁrewall acts as a protocol endpoint, it may use an implementation methodology designed to minimize the likelihood of bugs. A ﬁrewall can effectively implement and control the traversal of IP multicast trafﬁc. Some ﬁrewall mechanisms such as SOCKS are less appropriate for multicast because they are designed speciﬁcally for unicast trafﬁc. 11.2 Firewall-Related Terminology To design and conﬁgure a ﬁrewall, some familiarity with the basic terminology is required. It is useful for readers to understand the important terms commonly applicable to ﬁrewall technologies. INTERNET FIREWALLS FOR TRUSTED SYSTEMS 389 11.2.1 Bastion Host A bastion host is a publicly accessible device for the network’s security, which has a direct connection to a public network such as the Internet. The bastion host serves as a platform for any one of the three types of ﬁrewalls: packet ﬁlter, circuit-level gateway, or application-level gateway. Bastion hosts must check all incoming and outgoing trafﬁc and enforce the rules speciﬁed in the security policy. They must be prepared for attacks from external and possibly internal sources. They should be built with the least amount of hardware and software in order for a potential hacker to have less opportunity to overcome the ﬁrewall. Bastion hosts are armed with logging and alarm features to prevent attacks. The bastion host’s role falls into the following three common types: Single-homed bastion host. This is a device with only one network interface, normally used for an application-level gateway. The external router is conﬁgured to send all incoming data to the bastion host, and all internal clients are conﬁgured to send all outgoing data to the host. Accordingly, the host will test the data according to security guidelines. Dual-homed bastion host. This is a ﬁrewall device with at least two network interfaces. Dual-homed bastion hosts serve as application-level gateways, and as packet ﬁlters and circuit-level gateways as well. The advantage of using such hosts is that they create a complete break between the external network and the internal network. This break forces all incoming and outgoing trafﬁc to pass through the host. The dual- homed bastion host will prevent a security break-in when a hacker tries to access internal devices. Multihomed bastion host. Single-purpose or internal bastion hosts can be classiﬁed as either single-homed or multihomed bastion hosts. The latter are used to allow the user to enforce strict security mechanisms. When the security policy requires all inbound and outbound trafﬁc to be sent through a proxy server, a new proxy server should be created for the new streaming application. On the new proxy server, it is necessary to implement strict security mechanisms such as authentication. When multihomed bastion hosts are used as internal bastion hosts, they must reside inside the organization’s internal network, normally as application gateways that receive all incoming trafﬁc from external bastion hosts. They provide an additional level of security in case the external ﬁrewall devices are compromised. All the internal network devices are conﬁgured to communicate only with the internal bastion host. A tri-homed ﬁrewall connects three network segments with different network addresses. This ﬁrewall may offer some security advantages over ﬁrewalls with two interfaces. An attacker on the unprotected Internet may compromise hosts on the DMZ but still not reach any hosts on the protected internal network. 11.2.2 Proxy Server Proxy servers are used to communicate with external servers on behalf of internal clients. A proxy service is set up and torn down in response to a client request, rather than 390 WIRELESS MOBILE INTERNET SECURITY existing on a static basis. The term proxy server typically refers to an application-level gateway, although a circuit-level gateway is also a form of proxy server. The gateway can be conﬁgured to support an application-level proxy on inbound connections and a circuit-level proxy on outbound connections. Application proxies forward packets only when a connection has been established using some known protocol. When the connection closes, a ﬁrewall using application proxies rejects individual packets, even if they contain port numbers allowed by a rule set. In contrast, circuit proxies always forward packets containing a given port number if that port number is permitted by the rule set. Thus, the key difference between application and circuit proxies is that the latter are static and will always set up a connection if the DUT/SUT’s rule set allows it. Each proxy is conﬁgured to allow access only to speciﬁc host systems. The audit log is an essential tool for detecting and terminating intruder attacks. Therefore, each proxy maintains detailed audit information by logging all trafﬁc, each connection, and the duration of each connection. Since a proxy module is a relatively small software package speciﬁcally designed for network security, it is easier to check such modules for security ﬂaws. Each proxy is independent of other proxies on the bastion host. If there is a problem with the operation of any proxy, or if future vulnerability is discovered, it is easy to replace the proxy without affecting the operation of the proxy’s applications. If the support of a new service is required, the network administrator can easily install the required proxy on the bastion host. A proxy generally performs no disk access other than to read its initial conﬁguration ﬁle. This makes it difﬁcult for an intruder to install Trojan horse sniffers or other dangerous ﬁles on the bastion host. 11.2.3 SOCKS The SOCKS protocol version 4 provides for unsecured ﬁrewall traversal for TCP-based client/server applications, including HTTP, TELNET, and FTP. The new protocol extends the SOCKS version 4 model to include UDP, allows the framework to include provision for generalized strong authentication schemes, and extends the addressing scheme to encompass domain name and IPv6 addresses. The implementation of the SOCKS protocol typically involves the recompilation or relinking of TCP-based client applications so that they can use the appropriate encapsulation routines in the SOCKS library (refer to RFC 1928). When a TCP-based client wishes to establish a connection to an object that is reachable only via a ﬁrewall, it must open a TCP connection to the appropriate SOCKS port on the SOCKS server system. The SOCKS service is conventionally located at TCP port 1080. If the connection request succeeds, the client enters negotiation for the authentication method to be used, authenticates with the chosen method, and then sends a relay request. The SOCKS server evaluates the request and either establishes the appropriate connection or denies it. In fact, SOCKS deﬁnes how to establish authenticated connections, but currently, it does not provide a clear-cut solution to the problem of encrypting the data trafﬁc. Since the Internet at large is considered a hostile medium, encryption by using INTERNET FIREWALLS FOR TRUSTED SYSTEMS 391 ESP is also assumed in this scenario. An ESP transform that provides both authentication and encryption could be used, in which case the AH need not be included. 11.2.4 Choke Point The most important aspect of ﬁrewall placement is to create choke points. A choke point is the point at which a public Internet can access the internal network. The most comprehensive and extensive monitoring tools should be conﬁgured on the choke points. Proper implementation requires that all trafﬁc be funneled through these choke points. Since all trafﬁc is ﬂowing through the ﬁrewalls, security administrators, as a ﬁrewall strategy, need to create choke points to limit external access to their networks. Once these choke points have been clearly established, the ﬁrewall devices can monitor, ﬁlter, and verify all inbound and outbound trafﬁc. Since a choke point is installed at the ﬁrewall, a prospective hacker will go through the choke point. If the most comprehensive logging devices are installed in the ﬁrewall itself, all hacker activities can be captured. Hence, this will be detected exactly what a hacker is doing. 11.2.5 Demilitarized Zone (DMZ) The DMZ is an expression that originates from the Korean War. It meant a strip of land forcibly kept clear of enemy soldiers. In terms of a ﬁrewall, the DMZ is a network that lies between an internal private network and the external public network. DMZ networks are sometimes called perimeter networks. A DMZ is used as an additional buffer to further separate the public network from the internal network. A gateway is a machine that provides relay services to compensate for the effects of a ﬁlter. The network inhabited by the gateway is often called the DMZ. A gateway in the DMZ is sometimes assisted by an internal gateway. The internal ﬁlter is used to guard against the consequences of a compromised gateway, while the outside ﬁlter can be used to protect the gateway from attack. Many ﬁrewalls support tri-homing, allowing use of a DMZ network. It is possible for a ﬁrewall to accommodate more than three interfaces, each attached to a different network segment. 11.2.6 Logging and Alarms Logging is usually implemented at every device in the ﬁrewall, but these individual logs combine to become the entire record of user activity. Packet ﬁlters normally do not enable logging by default so as not to degrade performance. Packet ﬁlters as well as circuit-level gateways log only the most basic information. Since a choke point is installed at the ﬁrewall, a prospective hacker will go through the choke point. If so, the comprehensive logging devices will probably capture all hacker activities, including all user activities as well. The user can then tell exactly what a hacker is doing and have 392 WIRELESS MOBILE INTERNET SECURITY such information available for audit. The audit log is an essential tool for detecting and terminating intruder attacks. Many ﬁrewalls allow the user to preconﬁgure responses to unacceptable activities. The ﬁrewall should alert the user by several means. The two most common actions are for the ﬁrewall to break the TCP/IP connection or to have it automatically set off alarms. 11.2.7 VPN Some ﬁrewalls are now providing VPN services. VPNs are appropriate for any organization requiring secure external access to internal resources. All VPNs are tun- nelling protocols in the sense that their information packets or payloads are encapsulated or tunnelled into the network packets. All data transmitted over a VPN is usually encrypted because an opponent with access to the Internet could eavesdrop on the data as it travels over the public network. The VPN encapsulates all the encrypted data within an IP packet. Authentication, message integrity, and encryption are very important fundamentals for implementing a VPN. Without such authentication procedures, a hacker could imperson- ate anyone and then gain access to the network. Message integrity is required because the packets can be altered as they travel through the Internet. Without encryption, the informa- tion may become truly public. Several methods exist to implement a VPN. Windows NT or later versions support a standard RSA connection through a VPN. Specialized ﬁrewalls or routers can be conﬁgured to establish a VPN over the Internet. New protocols such as IPsec are expected to standardize on a speciﬁc VPN solution. Several VPN protocols exist, but the Point-to-Point Tunnelling Protocol (PPTP) and IPsec are the most popular. 11.3 Types of Firewalls As mentioned above, ﬁrewalls are classiﬁed into three common types: packet ﬁlters, circuit-level gateways, and application-level gateways. We examine each of these in turn. 11.3.1 Packet Filters Packet ﬁlters are one of several different types of ﬁrewalls that process network trafﬁc on a packet-by-packet basis. A packet ﬁlter’s main function is to ﬁlter trafﬁc from a remote IP host, so a router is needed to connect the internal network to the Internet. A packet ﬁlter is a device which inspects or ﬁlters each packet at a screening router for the content of IP packets. The screening router is conﬁgured to ﬁlter packets from entering or leaving the internal network, as shown in Figure 11.1. The routers can easily compare each IP address to a ﬁlter or a series of ﬁlters. The type of router used in a packet-ﬁltering ﬁrewall is known as a screening router. Packet ﬁlters typically set up a list of rules that are sequentially read line by line. Filtering rules can be applied based on source and destination IP addresses or network addresses, and TCP or UDP ports. Packet ﬁlters are read and then treated on a rule-by-rule basis. A packet ﬁlter will provide two actions, forward or discard. If the action is in the INTERNET FIREWALLS FOR TRUSTED SYSTEMS 393 Inside net 1 Inside net 2 Internet Inside net 3 Screening router Figure 11.1 A screening router for packet ﬁltering. forward process, the action takes place to route the packet as normal if all conditions within the rule are met. The discard action will block all packets if the conditions in the rule are not met. Thus, a packet ﬁlter is a device that inspects each packet for predeﬁned content. Although it does not provide an error-correcting ability, it is almost always the ﬁrst line of defense. When packets are ﬁltered at the external ﬁlter, it is usually called a screening router. Since a packet ﬁlter can restrict all inbound trafﬁc to a speciﬁc host, this restriction may prevent a hacker from being able to contact any other host within the internal network. However, the signiﬁcant weakness with packet ﬁlters is that they cannot discriminate between good and bad packets. Even if a packet passes all the rules and is routed to the destination, packet ﬁlters cannot tell whether the routed packet contains good or malicious data. Another weakness of packet ﬁlters is their susceptibility to spooﬁng. In IP spooﬁng, an attacker sends packets with an incorrect source address. When this happen, replies will be sent to the apparent source address, not to the attacker. This might seem to be a problem. Packet Filtering Rules A packet ﬁlter applies a set of rules to each incoming IP packet and then forwards or discards the packet. The packet ﬁlter typically sets up a list of rules which may match ﬁelds in the IP or TCP header. If there is a match to one of the rules, that rule is able to determine whether to forward or discard the packet. If there is no match to any rule then two default actions (forward and discard) will be taken. TELNET packet ﬁltering TELNET is a simple remote terminal access that allows a user to log onto a computer across an Internet. TELNET establishes a TCP connection and then passes keystrokes from the user’s keyboard directly to the remote computer as if they had been typed on a keyboard attached to the remote machine. TELNET also carries output from the remote machine back to the user’s screen. TELNET client software allows the user to specify a remote machine either by giving its domain name or IP address. TELNET can be used to administer a UNIX machine. Windows NT does not provide a TELNET serve with the default installation, but a third-party service can be easily added. TELNET sends all user names and passwords in plaintext. Experienced hackers 394 WIRELESS MOBILE INTERNET SECURITY Table 11.1 Telnet packet-ﬁltering example Rule Action Source Source Destination Destination Protocol number IP port IP port 1 Discard * 23 * * TCP 2 Discard * * * 23 TCP can hijack a TELNET session in progress. TELNET should only be used when the user can verify the entire network connecting the client and server, not over the Internet. All TELNET trafﬁc should be ﬁltered at the ﬁrewall. TELNET runs on TCP port 23. For example, to disable the ability to TELNET into internal devices from the Internet, the information listed Table 11.1 tells the router to discard any packet going to or coming from TCP port 23. TELNET for remote access application runs on TCP port 23. It runs completely in open nonencryption, with no authentication other than the user name and password that are transmitted in clear. An asterisk (*) in a ﬁeld indicates any value in that particular ﬁeld. The packet-ﬁltering rule sets are executed sequentially, from top to bottom. If a packet is passed through the ﬁlter and has a source port of 23, it will immediately be discarded. If a packet with a destination port of 23 is passed through this ﬁlter, it is discarded only after rule 2 has been applied. All other packets will be discarded. FTP packet ﬁltering If the FTP service is to apply the same basic rule as applied to TELNET, the packet ﬁlter to allow or block FTP would look like Table 11.2. The FTP service is typically associated with using TCP ports 20 and 21. One approach to handling FTP connections is explained with the following rule set. Rule 1 allows any host with the network address 192.168.10.0 to initiate a TCP session on any destination IP address on port 21. Rule 2 blocks any packet originating from any remote address with a source port of 20 and contacting a host with a network address 192.168.10.0 on any port less than 1024. Rule 3 allows any remote address that has a source port of 20 and is contacting any host with a network address of 192.168.10.0 on any port. Once a connection is set up, the ACK ﬂag (ACK = 1) of a TCP segment is set to acknowledge segments sent from the other side. If any packet violates rule 2, it will be immediately discarded, and rule 3 will never be executed. Table 11.2 FTP packet-ﬁltering example Rule Action Source Source Destination Destination Protocol number IP port IP port 1 Allow 192.168.10.0 * * 21 TCP 2 Block * 20 192.168.10.0 < 1024 TCP 3 Allow * 20 192.168.10.0 * TCP ACK = 1 INTERNET FIREWALLS FOR TRUSTED SYSTEMS 395 With FTP, two TCP connections are used: a control connection to set up the ﬁle transfer and a data connection for the actual ﬁle transfer. The data connection uses a different port number to be assigned for the transfer. Remember that most servers live on low-numbered ports, but most outgoing calls tend to use higher-numbered ports, typically above 1024. FTP is the ﬁrst protocol for transferring or moving ﬁles across the Internet. Like many of the TCP/IP protocols, FTP was not designed with security in mind. It communicates with the server on two separate TCP ports 20 and 21. Each FTP server has a command channel, where the requests for data and directory listings are issued, and a data channel, over which the requested data is delivered. FTP operates in two different modes (active and passive). In active mode, an FTP server receives commands on TCP/IP port 21 and exchanges data with the client. When a client contacts an FTP server in active mode and wants to send or receive data, the client picks an unused local TCP port between 1024 and 65 535, tells the server over the command channel, and listens for the server to connect on the chosen port. The server opens a connection from TCP port 20 to the speciﬁed port on the client machine. Once the connection is established, the data is passed across. In passive mode, the command channel is still port 21 on the server, but the traditional data channel on port 20 is not used. Instead, when the client requests passive mode, the server picks an unused local TCP port between 1024 and 65 535 and tells the client. The client opens a connection to that port on the server. The server is listening on that port for the inbound connection from the client. Once the connection is established, the data ﬂows across. Thus, since the client is initiating both the command and data channel connections to the server, most modern browsers use passive mode FTP for data accessing. SMTP packet ﬁltering The sending and transmission of mail is the responsibility of a mail transport agent (MTA). The protocol behind nearly all MTAs is SMTP and its extension ESMTP. On the Internet, e-mail exchanges between mail servers are handled with SMTP. It is the protocol that transfers e-mail from one server to another, and it provides a basic e-mail facility for transferring messages among separate hosts. A host’s SMTP server accepts mail and examines the destination IP address to decide whether to deliver the mail locally or to forward it to some other machine. SMTP is a store/forward system, and such systems are well suited to ﬁrewall applications. SMTP receivers use TCP port 25; SMTP senders use a randomly selected port above 1023. Most e-mail messages are addressed with hostnames instead of IP addresses, and the SMTP server uses DNS (Directory and Naming Services) to determine the matching IP address. If the same machines handle internal and external mail delivery, a hacker who can spoof DNS information may be able to cause mail that was intended for internal destinations to be delivered to an external host. A hacker who can manipulate DNS responses can redirect mail to a server under the control of the hacker. That server can then copy the mail and return it. This will introduce delays and will usually leave a trail in the log or message headers. Therefore, if it is desired to avoid situations where internal and external mail delivery are handled on the machine and internal names are resolved 396 WIRELESS MOBILE INTERNET SECURITY through DNS, it will be good practice to have the best conﬁguration in which there is an external mail server and a separate internal mail server. The external mail server has the IP address of the internal mail server conﬁgured via a host ﬁle. Sendmail (www.sendmail.org/) is the mailer commonly used on UNIX systems. Send- mail is very actively supported on security issues and has both an advantage and a disadvantage. Table 11.3 displays some examples of SMTP packet-ﬁltering rule sets. Packet ﬁlters offer their services at the network, transport, and session layers of the OSI model. Packet ﬁlters forward or deny packets based on information in each packet’s header, such as the IP address or TCP port number. A packet-ﬁltering ﬁrewall uses a rule set to determine which trafﬁc should be forwarded and which should be blocked. Packet ﬁlters are then composed of rules that are read and treated on a rule-by-rule basis. Therefore, packet ﬁltering is deﬁned as the process of controlling access by examining packets based on the content of packet headers. The following two subsections outline the speciﬁc details with relation to the circuit- level and application-level gateways for respective proxy services. Proxying provides Internet access for a single host or a small number of hosts. The proxy server evaluates requests from the client and decides which to pass on and which to disregard. If a request is approved, the proxy server talks to the real server on behalf of the client and proceeds to relay requests from the client to the real server and to relay the real server’s answers back to the client. The concept of proxies is very important to ﬁrewall application because a proxy replaces the network IP address with another contingent address. Proxies are classiﬁed into two basic forms: Circuit-level gateway. Application-level gateway. Table 11.3 SMTP packet-ﬁltering examples Case Action Source Source Destination Destination Protocol host port host port A Allow Source gateway 25 * * TCP B Allow * * * 25 TCP C Allow Internal host * * 25 TCP D Allow * 25 * * TCP ACK ﬂag Case A: Connection to source SMTP port. Port 25 is for SMTP incoming. Inbound mail is allowed, but only to a gateway host. Case B: Connection to destination SMTP port. This rule set is intended to specify that any source host can send mail to the destination. A TCP packet with a destination port 25 is routed to the SMTP server on the destination machine. Case C: This rule set achieves the intended result that was not achieved in B. The rule takes advantage of a feature of TCP connection. This rule set states that it allows IP packets where the source IP address is one of a list of designated internal hosts and the destination TCP port 25. Case D: This rule takes advantage of a feature of TCP connections. Once a connection is set up, the ACK ﬂag of a TCP segment is set to acknowledge segments sent from the destination. It also allows incoming packets with a source port number of 25 that include ACK ﬂag in the TCP segment. INTERNET FIREWALLS FOR TRUSTED SYSTEMS 397 Both circuit- and application-level gateways create a complete break between the internal premises network and external Internet. This break allows the ﬁrewall system to examine everything before passing it into or out of the internal network. Each of these gateways will be examined in turn in the following. 11.3.2 Circuit-Level Gateways The circuit-level gateway represents a proxy server that statically deﬁnes what trafﬁc will be forwarded. Circuit proxies always forward packets containing a given port number if that port number is permitted by the rule set. A circuit-leval gateway operates at the network level of the OSI model. This gateway acts as an IP address translator between the Internet and the internal system. The main advantage of a proxy server is its ability to provide network address translation (NAT). NAT hides the internal IP address from the Internet. NAT is the primary advantage of circuit-level gateways and provides secu- rity administrators with great ﬂexibility when developing an address scheme internally. Circuit-level gateways are based on the same principles as packet ﬁlter ﬁrewalls. When the internal system sends out a series of packets, these packets appear at the circuit-level gateway where they are checked against the predetermined rules set. If the packets do not violate any rules, the gateway sends out the same packets on behalf of the internal system. The packets that appear on the Internet originate from the IP address of the gateway’s external port, which is also the address that receives any replies. This process efﬁciently shields all internal information from the Internet. Figure 11.2 illustrates the circuit-level gateway for setting up two TCP connections. 11.3.3 Application-Level Gateways The application-level gateway represents a proxy server, performing at the TCP/IP application level, that is set up and torn down in response to a client request, rather than existing on a static basis. Application proxies forward packets only when a connection has been established using some known protocol. When the connection closes, a ﬁrewall using application proxies rejects individual packets, even if the packets contain port numbers allowed by a rule set. The application gateway analyses the entire message instead of individual packets when sending or receiving data. When an inside host initiates a TCP/IP connection, the application gateway receives the request and checks it against a set of rules or ﬁlters. Outside Inside connection connection Circuit-level gateway TCP user on TCP user on outside host An IP address translator inner host Figure 11.2 Circuit-level gateway for setting up two TCP connections. 398 WIRELESS MOBILE INTERNET SECURITY The application gateway (or proxy server) will then initiate a TCP/IP connection with the remote server. The server will generate TCP/IP responses based on the request from the proxy server. The responses will be sent to the proxy server (application gateway) where the responses are again checked against the proxy server’s ﬁlters. If the remote server’s response is permitted, the proxy server will then forward the response to the inside host. Certain transport layer protocols work better than others. For example, TCP can easily be used through a proxy server because it is a connection-based protocol, while each User Datagram Protocol (UDP) packet should be treated as an individual message because UDP is connectionless. The proxy server must analyze each UDP packet and apply it to the ﬁlters separately, which slows down the proxy process. Internet Control Message Protocol (ICMP) programs are nearly impossible to proxy because ICMP messages do not work through an application-level gateway. For example, HTTP trafﬁc is often used in conjunction with proxy servers, but an internal host could not ping a remote host through the proxy server. Application-level gateways (proxy servers) are used as intermediate devices when routing SMTP trafﬁc to and from the internal network and the Internet. The main advantage of a proxy server is its ability to provide NAT for shielding the internal network from the Internet. Figure 11.3 illustrates the application-level gateway acting as a relay of the application-level trafﬁc. 11.4 Firewall Designs This section concerns how to implement a ﬁrewall strategy. The primary step in designing a secure ﬁrewall is obviously to prevent the ﬁrewall devices from being compromised by threats. To provide a certain level of security, the three basic ﬁrewall designs are considered: a single-homed bastion host, a dual-homed bastion host, and a screened subnet ﬁrewall. The ﬁrst two options are for creating a screened host ﬁrewall, and the third option contains an additional packet-ﬁltering router to achieve another level of security. To achieve the most security with the least amount of effort is always desirable. When building ﬁrewall devices, the bastion host should keep the design simple with the fewest Application-level gateway Private Internet network FTP TELNET Application-level DNS gateway SMTP HTTP Outside Inside host host A relay of application-level traffic Figure 11.3 Application-level gateway for acting as a relay of application-level trafﬁc. INTERNET FIREWALLS FOR TRUSTED SYSTEMS 399 possible components, both hardware and software. A bastion host is a publicly accessible device. When Internet users attempt to access resources on the Internet network, the ﬁrst device they encounter is a bastion host. Fewer running services on the bastion host will give a potential hacker less opportunity to overcome the ﬁrewall. Bastion hosts must check all incoming and outgoing trafﬁc and enforce the rules speciﬁed in the security policy. Bastion hosts are armed with logging and alarm features to prevent attacks. When creating a bastion host, it must be kept in mind that its role will help to decide what is needed and how to conﬁgure the device. 11.4.1 Screened Host Firewall (Single-Homed Bastion Host) The ﬁrst type of ﬁrewall is a screened host which uses a single-homed bastion host plus a packet-ﬁltering router, as shown in Figure 11.4. Single-homed bastion hosts can be conﬁgured as either circuit-level or application-level gateways. When using either of these two gateways, each of which is called a proxy server, the bastion host can hide the conﬁguration of the internal network. NAT is essentially needed for developing an address scheme internally. It is a critical component of any ﬁrewall strategy. It translates the internal IP addresses to Internet Assigned Numbers Authority (IANA)-registered addresses to access the Internet. Hence, using NAT allows network administrators to use any internal IP address scheme. The screened host ﬁrewall is designed such that all incoming and outgoing information is passed through the bastion host. The external screening router is conﬁgured to route all incoming trafﬁc directly to the bastion host as indicated in Figure 11.4. The screening router is also conﬁgured to route outgoing trafﬁc only if it originates from the bastion host. This kind of conﬁguration prevents internal clients from bypassing the bastion host. Thus, the bastion host is conﬁgured to restrict unacceptable trafﬁc and proxy acceptable trafﬁc. A single-homed implementation may allow a hacker to modify the router not to forward packets to the bastion host. This action would bypass the bastion host and allow the hacker directly into the network. But such a bypass usually does not happen because a network using a single-homed bastion host is normally conﬁgured to send packets only to the bastion host and not directly to the Internet. Bastion host Internet Packet-filtering Server router Internal network (Web and FTP) host Figure 11.4 Screened host ﬁrewall system (single-homed bastion host). 400 WIRELESS MOBILE INTERNET SECURITY 11.4.2 Screened Host Firewall (Dual-Homed Bastion Host) The conﬁguration of the screened host ﬁrewall using a dual-homed bastion host adds signiﬁcant security, compared with a single-homed bastion host. As shown in Figure 11.5, a dual-homed bastion host has two network interfaces. This ﬁrewall implementation is secure due to the fact that it creates a complete break between the internal network and the external Internet. As with the single-homed bastion, all external trafﬁc is forwarded directly to the bastion host for processing. However, a hacker may try to subvert the bastion host and the router to bypass the ﬁrewall mechanisms. Even if a hacker could defeat either the screening router or the dual-homed bastion host, the hacker would still have to penetrate the other. Nevertheless, a dual-homed bastion host removes even this possibility. It is also possible to implement NAT for dual-homed bastion hosts. 11.4.3 Screened Subnet Firewall The third implementation of a ﬁrewall is the screened subnet, which is also known as a DMZ. This ﬁrewall is the most secure one among the three implementations, simply because it uses a bastion host to support both circuit- and application-level gateways. As shown in Figure 11.6, all publicly accessible devices, including modem and server, are placed inside the DMZ. This DMZ then functions as a small isolated network positioned between the Internet and the internal network. The screened subnet ﬁrewall contains external and internal screening routers. Each is conﬁgured such that its trafﬁc ﬂows only to or from the bastion host. This arrangement prevents any trafﬁc from directly traversing the DMZ subnetwork. The external screening router uses standard ﬁltering to restrict external access to the bastion host and rejects any trafﬁc that does not come from the bastion host. This router also uses ﬁlters to prevent attacks such as IP spooﬁng and source routing. The internal screening router also uses rules to prevent spooﬁng and source routing. Like its external counterpart, this internal router rejects incoming packets that do not originate from the bastion host and sends only outgoing packets to the bastion host. Bastion host Internet Packet-filtering Internal network router hosts Server (Web and FTP) Figure 11.5 Screened host ﬁrewall system (dual-homed bastion host). INTERNET FIREWALLS FOR TRUSTED SYSTEMS 401 Bastion host Internet Packet-filtering Packet-filtering Internal router (external) router (internal) network Server Modem (Web and FTP) De-militarized zone Figure 11.6 Screened subnet ﬁrewall system. The beneﬁts of the screened subnet ﬁrewall are based on the following facts. First, a hacker must subvert three separate tri-homed interfaces when he or she wants to access the internal network. But it is almost infeasible. Second, the internal network is effectively invisible to the Internet because all inbound/outbound packets go directly through the DMZ. This arrangement makes it impossible for a hacker to gain information about the internal systems because only the DMZ is advertized in the routing tables and other Internet information. Third, internal users cannot access the Internet without going through the bastion host because the routing information is contained within the network. 11.5 IDS Against Cyber Attacks Recently, the information technology (IT) industry has witnessed the development of many cyber security solutions for protecting IT networks and reducing their vulnerability to cyber attacks. From ﬁrewalls to intrusion detection systems (IDSs), their security solutions have been progressed effectively in some extent for preserving data integrity, protecting data conﬁdentiality, and maintaining data availability. This section will present a survey and comparison of Internet worm/virus detection against cyber defense. 11.5.1 Internet Worm Detection In order to reduce the damage effectively caused by the fast propagation of malicious Internet worms, exiting IDSs should be strong enough to combat against the propagation worms, as well as to provide the security-related regulations of their monitoring networks. A computer worm is a standalone malware program which replicates itself and spreads to other devices via network by utilizing vulnerabilities on the target devices. There- fore, a worm is a malicious piece of codes that self-progresses via network connections, exploiting security ﬂaws in computers on the network. 402 WIRELESS MOBILE INTERNET SECURITY Passive worms will require certain host behavior or human intervention to propagate itself until it is contacted by another host. Since the Morris worm was found in 1988, Internet worms have caused the most extensive and widespread damage of all kinds of computer attacks. Thus, an Internet worm is deﬁned as a piece of malicious code that duplicates and propagates itself. The life of a worm, after it is released, typically includes the following four phases: Target ﬁnding. Target ﬁnding is the ﬁrst step in a worm’s life to discover vulnerable hosts. Worm transferring. Transferring is referred to send a copy of the worm to the target after the victim (target) is discovered. Worm activation. Worm code starts to activate, duplicate, and propagate by itself until the target is discovered. Worm infection. Infection is the result of the worm, performing its malicious activities on the target host. Differently from Computer Virus, the worm is a standalone program which can replicate itself through the network to spread, so it does not need to be attached. It makes the net- work performance weak by consuming bandwidth, increasing network trafﬁc, or causing the denial of service (DoS). Morris worm, Blaster worm, Sasser worm, and Mydoom worm were some example of most notorious worms. Morris worm (2 November, 1988) was written by a Cornell University student, Robert Tappan Morris, and reported to infect about 6000 major UNIX machines (damaging size is about $100 000–dollar;10 000 000). Blaster worm (11 August, 2003) spread by exploiting BOF (buffer overﬂow) attack in DCOM RPC service of Windows operating system (OS), displayed some message, and rebooted the victim. Sasser worm might be the evolution of the Blast worm. Mydoom worm (26 January, 2004) was transmitted to attack Windows OS via e-mail with attachment, using user’s address book. It evolved to many versions. It also affected South Korea and the United States on July 2009. Nowadays, the worm will install Trojan horse or backdoor into the PC and make the victim PC as botnet zombie. 11.5.2 Computer Virus The Computer Virus is a kind of malicious program which can damage the victim computer and spread itself to another computer. The word “Virus” is used for most of the malicious program and it is confused with other programs, but the Virus, worm botnet, or other terms is distinct from one another. The Virus destroys or disturbs the computer systems and user ﬁles, replicating itself via some media including hard disk, removable disc (ﬂoppy disk, USB, etc.), or network. Almost all Viruses must be attached to an executive ﬁle to be executed, because it can- not run without any action of human. Before the network is widespread, most Viruses INTERNET FIREWALLS FOR TRUSTED SYSTEMS 403 spread via ﬂoppy disks. PC was booted from ﬂoppy disks and most of user ﬁles are also transferred by them. So the Virus in that time infected the ﬂoppy or hard disk ﬁles, or the boot sector of them. When the PC is booted or a user runs the virus attached ﬁles, the Virus uploads the malicious module and replication module to memory, sometimes it scans the victim host or ﬁles and attaches itself to them. The Virus used binary executable ﬁles, boot record, come script ﬁles, documents containing macro, and so on to transmit and infect. 11.5.3 Special Kind of Viruses Trojan Horse Trojan horse (or Trojan) is made to steal some information by social engineering. The term Trojan horse is derived from Greek mythology. The Trojan gives a cracker remote access permission like the Greek soldiers, avoiding detection of their user. It looks like some useful or helpful program, or looks like legitimate access process, but it just steal password, card number, or other useful information. The popular Trojan are Netbus, Back Oriﬁce, Zeus, and so on. Botnet Botnet is the set of zombie computers connected to the Internet. Each compromised zombie computer is called as bot, and the botmaster, called as C&C (Command & Control server), controls these bots. Some Web site or e-mail has the malicious code, and if a user downloads and runs the program by curiosity or mistake, the PC is compromised by the program but the user cannot notice it. The bot has Trojan horse, backdoor, or other command tunnel, so the C&C can do anything with these bots. Most of the bots run hidden and communicate via covert channel, so the user can hardly notice the bot. And botnet servers often liaise with each servers, the real size of bot network may be more larger than we can count. The purpose of botnet is various, such as denial of service, STMP mail relays for sending spam mail, click fraud, steal some ﬁnancial information, and login information. There are so many kinds of botnet, and Stuxnet (June, 2010) is the most popular botnet of them. It was written to attack the industrial system with closed network, infected by USB memory. When it penetrates into one network, it spreads itself in the network and controls all of the systems. It used the system vulnerabilities such as LNK, Print Spooler, and Server Service. Key Logger Key logger program monitors the action of the key inputs. The key logger is of two types, software and hardware. This section concerns the software type only. It is also installed in the victim computers and logs all the strokes of keys. They save the log into some ﬁles or send the logs to the hacker by network. Key logger can steal the action of key input by kernel level, memory level, API level, packet level, and so on. 404 WIRELESS MOBILE INTERNET SECURITY 11.6 Intrusion Detections Systems The lack of knowledge about security makes the people vulnerable to the damage due to acts of violence such as physical or electronical acts, putting on the risk the integrity of persons, companies for the loss or damage of electronic documents, physical areas, IT infrastructures, and so on. From the point of view of the IT environment, we have to consider the implemen- tation of IDSs to provide reliable information to network-administrator-related security of physical (Servers, Databases, Firewall, LAN, PCs, etc.) and electronic ﬁles which are considering the most valuable assets in companies. This section presents several IDS systems which are typically deployed in IT networks. 11.6.1 Network-Based Intrusion Detection System (NIDS) A network-based intrusion detection system (NIDS) monitors network trafﬁc for particular network segments or devices and analyzes network, transport, and application protocols to identify suspicious activity. NIDSs typically perform most of their analysis at the application layer such as HTTP, DNS, FTP, SMTP, and SNMP. They also analyze activity at the transport and network layers both to identify attacks at those layers and to facilitate the analysis of the application layer activity (e.g., a TCP port number may indicate which application is being used). Some NIDSs also perform limited analysis at the hardware layer. A typical NIDS is composed of sensors, one or more management servers, multiple consoles, and optionally, one or more database servers (if the NIDS supports their use). All of these components are similar to other types of IDS technologies, except for the sensors. An NIDS sensor monitors and analyzes network activity on one or more network segments. The network interface cards that will be performing monitoring are placed into promiscuous mode, which means that they will accept all incoming packets that they see, regardless of their intended destinations. Most IDS deployments use multiple sensors, with large deployments having hundreds of sensors. Sensors are available in two formats: Appliance. An appliance-based sensor consists of specialized hardware and sensor software. The hardware is typically optimized for sensor use, including specialized NICs and NIC drivers for efﬁcient capture of packets, and specialized processors or other hardware components that assist in analysis. Parts or all of the IDS software might reside in ﬁrmware for increased efﬁciency. Appliances often use a customized, hardened OS that administrators are not intended to access directly. Software Only. Some vendors sell sensor software without an appliance. Administrators can install the software onto hosts that meet certain speciﬁcations. The sensor software might include a customized OS or it might be installed onto a standard OS just as any other application would. Organizations should consider using management networks for their NIDS deployments whenever feasible. If an IDS is deployed without a separate management network, INTERNET FIREWALLS FOR TRUSTED SYSTEMS 405 organizations should consider whether or not a VLAN is needed to protect the IDS communications. In addition to choosing the appropriate network for the components, administrators also need to decide where the IDS sensors should be located. Sensors can be deployed in one of two modes: Inline. An inline sensor is deployed so that the network trafﬁc it is monitoring must pass through it, much like the trafﬁc ﬂow associated with a ﬁrewall. In fact, some inline sensors are hybrid ﬁrewall/IDS devices, while others are simply IDSs. The primary motivation for deploying IDS sensors inline is to enable them to stop attacks by blocking network trafﬁc. Inline sensors are typically placed where network ﬁrewalls and other network security devices would be placed – at the divisions between networks, such as connections with external networks and borders between different internal networks that should be segregated. Inline sensors that are not hybrid ﬁrewall/IDS devices are often deployed on the more secure side of a network division so that they have less trafﬁc to process. Sensors can also be placed on the less secure side of a network division to provide protection for and reduce the load on the dividing device, such as a ﬁrewall. Passive. A passive sensor is deployed so that it monitors a copy of the actual net- work trafﬁc; no trafﬁc actually passes through the sensor. Passive sensors are typically deployed so that they can monitor key network locations, such as the divisions between networks, and key network segments, such as activity on a DMZ subnet. Passive sensors can monitor trafﬁc through various methods, including the following: Spanning Port. Many switches have a spanning port, which is a port that can see all network trafﬁc going through the switch. Connecting a sensor to a spanning port can allow it to monitor trafﬁc going to and from many hosts. Although this monitoring method is relatively easy and inexpensive, it can also be problematic. If a switch is conﬁgured or reconﬁgured incorrectly, the spanning port might not be able to see all the trafﬁc. Another problem with spanning ports is that their use can be resource- intensive; when a switch is under heavy loads, its spanning port might not be able to see all trafﬁc or spanning might be temporarily disabled. Also, many switches have only one spanning port, and there is often a need to have multiple technologies, such as network monitoring tools, network forensic analysis tools, and other IDS sensors, to monitor the same trafﬁc. Network Tap. A network tap is a direct connection between a sensor and the physical network media itself, such as a ﬁber-optic cable. The tap provides the sensor with a copy of all network trafﬁc being carried by the media. Installing a tap generally involves some network downtime, and problems with a tap could cause additional downtime. Also, unlike spanning ports, which are usually already present throughout an organization, network taps need to be purchased as add-ons to the network. IDS Load Balancer. An IDS load balancer is a device that aggregates and directs network trafﬁc to monitoring systems, including IDS sensors. A load balancer can receive copies of network trafﬁc from one or more spanning ports or network taps and aggregate trafﬁc from different networks (e.g., reassemble a session that was split between two networks). The load balancer then distributes copies of the trafﬁc 406 WIRELESS MOBILE INTERNET SECURITY to one or more listening devices, including IDS sensors, based on a set of rules conﬁgured by an administrator. The rules tell the load balancer which types of trafﬁc to provide to each listening device. NIDS products provide a wide variety of security capabilities. Some NIDSs offer limited information gathering capabilities, which means that they can collect information on hosts and the network activity involving those hosts. NIDSs typically perform extensive logging of data related to detected events. This data can be used to conﬁrm the validity of alerts, investigate incidents, and correlate events between the IDS and other logging sources. NIDSs typically offer extensive and broad detection capabilities. Most products use a combination of signature-based detection, anomaly-based detection, and stateful proto- col analysis techniques to perform in-depth analysis of common protocols; organizations should use NIDS products that use such a combination of techniques. The detection meth- ods are usually tightly interwoven; for example, a stateful protocol analysis engine might parse activity into requests and responses, each of which is examined for anomalies and compared to signatures of known bad activity. Some products also use the same techniques and provide the same functionality as network behavior analysis (NBA) software. NIDS sensors offer various prevention capabilities, including Passive only, Inline only, and both Passive and Inline. 11.6.2 Wireless Intrusion Detection System (WIDS) A wireless intrusion detection system (WIDS) monitors wireless network trafﬁc and analyzes its wireless networking protocols to identify suspicious activity. The typical components in a WIDS are the same as an NIDS: consoles, database servers (optional), management servers, and sensors. However, unlike an NIDS sensor, which can see all packets on the networks it monitors, a WIDS sensor works by sampling trafﬁc because it can only monitor a single channel at a time. The longer a single channel is monitored, the more likely it is that the sensor will miss malicious activity occurring on other channels. To avoid this, sensors typically change channels frequently, so that they can monitor each channel a few times per second. Wireless sensors are available in multiple forms. A dedicated sensor is a ﬁxed or mobile device that performs WIDS functions but does not pass network trafﬁc from source to destination. The other wireless sensor forms are bundled with access points (AP) or wireless switches. Because dedicated sensors can focus on detection and do not need to carry wireless trafﬁc, they typically offer stronger detection capabilities than wireless sensors bundled with AP or wireless switches. However, dedicated sensors are often more expensive to acquire, install, and maintain than bundled sensors because bundled sensors can be installed on existing hardware, whereas dedicated sensors involve additional hardware and software. Organizations should consider both security and cost when selecting WIDS sensors. WIDS components are typically connected to each other through a wired network. Because there should already be a strictly controlled separation between the wireless and wired networks, using either a management network or a standard network should be acceptable for WIDS components. Choosing sensor locations for a WIDS deployment is a INTERNET FIREWALLS FOR TRUSTED SYSTEMS 407 fundamentally different problem than choosing locations for any other type of IDS sensor. If the organization uses termdefwireless local area networks (WLAN), wireless sensors should be deployed so that they monitor the range of the WLANs. Many organizations also want to deploy sensors to monitor parts of their facilities where there should be no WLAN activity, as well as channels and bands that the organization’s WLANs should not use. Other considerations for selecting sensor locations include physical security, sensor range, wired network connection availability, cost, and AP and wireless switch locations. WIDSs provide several types of security capabilities. Most can collect information on observed wireless devices and WLANs and perform extensive logging of event data. WIDSs can detect attacks, misconﬁgurations, and policy violations at the WLAN protocol level. Organizations should use WIDS products that use a combination of detection tech- niques to achieve broader and more accurate detection. Examples of events detected by WIDSs are unauthorized WLANs and WLAN devices, poorly secured WLAN devices, unusual usage patterns, the use of active wireless network scanners, denial of service attacks, and impersonation and man-in-the-middle attacks. Most WIDS sensors can also identify the physical location of a detected threat by using triangulation. Compared to other forms of IDS, WIDS is generally more accurate; this is largely due to its limited scope (analyzing wireless networking protocols). WIDSs usually require some tuning and customization to improve their detection accuracy. The main effort is in specifying which WLANs, APs, and STAs are authorized and in entering the pol- icy characteristics into the WIDS software. Besides reviewing tuning and customizations periodically to ensure that they are still accurate, administrators should also ensure that changes to building plans are incorporated occasionally. This is needed for accurate iden- tiﬁcation of the physical location of threats and accurate planning of sensor deployments. Although WIDSs offer robust detection capabilities, they do have some signiﬁcant limitations. WIDSs cannot detect certain types of attacks against wireless networks, such as attacks involving passive monitoring and off-line processing of wireless trafﬁc. WIDSs are also susceptible to evasion techniques, especially those involving knowledge of a product’s channel scanning scheme. Channel scanning can also impact network forensics because each sensor sees only a fraction of the activity on each channel. WIDS sensors are also susceptible to denial of service attacks and physical attacks. WIDS sensors can offer intrusion prevention capabilities. Some sensors can instruct end points to terminate a session and prevent a new session from being established. Some sensors can instruct a switch on the wired network to block network activity for a particular wireless end point; however, this method can only block wired network communications and will not stop an end point from continuing to perform malicious actions through wireless protocols. Most IDS sensors allow administrators to specify the prevention capability conﬁguration for each type of alert. Prevention actions can affect sensor monitoring; for example, if a sensor is transmitting signals to terminate connections, it may not be able to perform channel scanning to monitor other communications until it has completed the prevention action. To mitigate this, some sensors have two radios – one for monitoring and detection and the other for performing prevention actions. When selecting sensors, organizations should consider what prevention actions may need to be performed and how the sensor’s detection capabilities could be affected by performing prevention actions. 408 WIRELESS MOBILE INTERNET SECURITY 11.6.3 Network Behavior Analysis System (NBAS) A network behavior analysis system (NBAS) examines network trafﬁc or statistics on network trafﬁc to identify unusual trafﬁc ﬂows. NBA solutions usually have sensors and consoles, with some products also offering management servers. Some sensors are similar to NIDS sensors in that they sniff packets to monitor network activity on one or a few network segments. Other NBA sensors do not monitor the networks directly, but instead rely on network ﬂow information provided by routers and other networking devices. Most NBA sensors can be deployed in passive mode only, using the same connection methods (e.g., network tap, switch spanning port) as NIDSs. Passive sensors that are performing direct network monitoring should be placed so that they can monitor key network locations, such as the divisions between networks, and key network segments, such as DMZ subnets. Inline sensors are typically intended for network perimeter use, so they would be deployed in close proximity to the perimeter ﬁrewalls, often in front to limit incoming attacks that could overwhelm the ﬁrewalls. NBA products provide a variety of security capabilities. They offer extensive infor- mation gathering capabilities, collecting detailed information on each observed host and constantly monitoring network activity for changes to this information. NBA technologies typically perform extensive logging of data related to detected events. They also typically have the capability to detect several types of malicious activity, including DoS attacks, scanning, worms, unexpected application services, and policy violations, such as a client system providing network services to other systems. Because NBA sensors work primar- ily by detecting signiﬁcant deviations from normal behavior, they are most accurate at detecting attacks that generate large amounts of network activity in a short period of time and attacks that have unusual ﬂow patterns. Most NBA sensors can also reconstruct a series of observed events to determine the origin of a threat. NBA products automatically update their baselines on an ongoing basis. As a result, typically, there is not much tuning or customization to be done, other than updating ﬁrewall rule-set-like policies that most products support. A few NBA products offer limited signature customization capabilities; these are most helpful for inline sensors because they can use the signatures to ﬁnd and block attacks that a ﬁrewall or router might not be capable of blocking. Besides reviewing tuning and customizations periodically to ensure that they are still accurate, administrators should also ensure that signiﬁcant changes to hosts are incorporated, such as new hosts and new services. Generally, it is not feasible to automatically link NBA systems with change management systems, but administrators could review change management records regularly and adjust host inventory information in the NBA to prevent false positives. NBA technologies have some signiﬁcant limitations. They are delayed in detecting attacks because of their data sources, especially when they rely on ﬂow data from routers and other network devices. This data is often transferred to the NBA in batches from every minute to a few times an hour. Attacks that occur quickly may not be detected until they have already disrupted or damaged systems. This delay can be avoided by using sensors that do their own packet captures and analysis; however, this is much more resource- intensive than analyzing ﬂow data. Also, a single sensor can analyze ﬂow data from INTERNET FIREWALLS FOR TRUSTED SYSTEMS 409 many networks, while a single sensor can generally directly monitor only a few networks at once. Therefore, to do direct monitoring instead of using ﬂow data, organizations might have to purchase more powerful sensors and/or more sensors. 11.6.4 Host-Based Intrusion Detection System (HIDS) Host-based intrusion detection systems (HIDSs) monitor the characteristics of a single host and the events occurring within that host for suspicious activity. Examples of the types of characteristics an HIDS might monitor are wired and wireless network trafﬁc, system logs, running processes, ﬁle access and modiﬁcation, and system and application conﬁguration changes. Most HIDSs have detection software known as agents installed on the hosts of interest. Each agent monitors activity on a single host and if prevention capabilities are enabled, also performs prevention actions. The agents transmit data to management servers. Each agent is typically designed to protect a server, a desktop or laptop, or an application service. The network architecture for HIDS deployments is typically very simple. Because the agents are deployed to existing hosts on the organization’s networks, the components usually communicate over those networks instead of using a management network. HIDS agents are most commonly deployed to critical hosts such as publicly accessible servers and servers containing sensitive information. However, because agents are available for various server and desktop/laptop OSs, as well as speciﬁc server applications, organi- zations could potentially deploy agents to most of their servers and desktops/laptops. Organizations should consider several criteria when selecting agent locations, including the need to analyze activity that cannot be monitored by other security controls; the cost of the agents’ deployment, maintenance, and monitoring; the OSs and applications sup- ported by the agents; the importance of each host’s data or services; and the ability of the network infrastructure to support the agents’ communications. Most IDS agents alter the internal architecture of the hosts on which they are installed through shims, which are layers of code placed between existing layers of code. Although it is less intrusive to the host to perform monitoring without shims, which reduces the pos- sibility of the IDS interfering with the host’s normal operations, monitoring without shims is also generally less accurate at detecting threats and often precludes the performance of effective prevention actions. HIDSs provide a variety of security capabilities. They typically perform extensive logging of data related to detected events and can detect several types of malicious activity. Detection techniques used include code analysis, network trafﬁc analysis, network trafﬁc ﬁltering, ﬁlesystem monitoring, log analysis, and network conﬁguration monitoring. HIDSs that use combinations of several detection techniques should generally be capable of achieving more accurate detection than products that use one or a few techniques, because each technique can monitor different characteristics of hosts. Organizations should determine which characteristics need to be monitored and select IDS products that provide adequate monitoring and analysis of those characteristics. HIDSs usually require considerable tuning and customization; for example, many rely on observing host activity and developing baselines or proﬁles of expected behavior. 410 WIRELESS MOBILE INTERNET SECURITY Others need to be conﬁgured with detailed policies that deﬁne exactly how each application on a host should behave. As the host environment changes, administrators should ensure that HIDS policies are updated to take those changes into account. HIDSs have some signiﬁcant limitations. Some detection techniques are performed only periodically, such as hourly or a few times a day, to identify events that have already hap- pened, causing signiﬁcant delay in identifying certain events. Also, many HIDSs forward their alert data to the management servers in batches a few times an hour, which can cause delays in initiating response actions. Because HIDSs run agents on the hosts being mon- itored, they can impact host performance because of the resources the agents consume. Installing an agent can also cause conﬂicts with existing host security controls, such as personal ﬁrewalls and VPN clients. Agent upgrades and some conﬁguration changes can also necessitate rebooting the monitored hosts. HIDSs offer various intrusion prevention capabilities; these vary based on the detection techniques used by each product. Code analysis techniques can prevent code from being executed; this can be very effective at stopping both known and previously unknown attacks. Network trafﬁc analysis can stop incoming and outgoing network trafﬁc contain- ing network, transport, or application layer attacks; wireless networking protocol attacks; and the use of unauthorized applications and protocols. Network trafﬁc ﬁltering works as a host-based ﬁrewall and stops unauthorized access and acceptable use policy viola- tions. Filesystem monitoring can prevent ﬁles from being accessed, modiﬁed, replaced, or deleted, which can stop malware installation and other attacks involving inappropriate ﬁle access. Other HIDS detection techniques generally do not support prevention actions because they identify events well after they have occurred. Some HIDSs offer additional capabilities related to intrusion detection and prevention, such as enforcing restrictions on the use of removable media, detecting the activation or use of audiovisual devices, automatically hardening hosts on an ongoing basis, monitoring the status of running processes and restarting failed ones, and performing network trafﬁc sanitization. 11.6.5 Signature-Based Systems A signature-based IDS is based on pattern matching techniques. The IDS contains a database of patterns. Some patterns are well known by public program or domain, for example, Snort (http://www.snort.org/) and some are found by signature-based IDS com- panies. Using database of already found signature is much like antivirus software. The IDS tries to match these signatures with the analyzed data. If a match is found, an alert is raised. This approach usually yields good results in terms of few false positives. For few false positives, the Users try to select needed signatures, a task known as tuning, to avoid future false alerts. Tuning is performed once, and then updated from time to time. Thanks to tuning, a signature-based IDS generally generates a low rate of false alerts. Even though the IDS make good results, it has drawbacks. First, all new attacks or polymorphic attacks, for example, zero-day attack, will go unnoticed until the responsible signatures are updated to database. It is because the IDS only tries to match signatures of its database with the attacks. INTERNET FIREWALLS FOR TRUSTED SYSTEMS 411 The IDS is not likely to detect even slight modiﬁcations of a known attack. Thus, attackers have a window of opportunity to gain control of the system or application under attack. Second, the IDS need to be updated regularly, increasing the IT personnel workload and required skills. Developing a new signature is tedious and hard work. Once an attack is made public, ﬁrst, the experts need to analyze it carefully. The attack could exploit either a well-known vulnerability or a new one. The experts should develop the signature to detect the way the attack exploits a given vulnerability rather than the attack only. For example, BOF attacks could exploit different attack vectors, but those vectors will show common length. This is because attackers try to modify the attack payload without altering the attack effectiveness. So there are more chances to detect attack variations with just one signature. A signature-based IDS raises classiﬁed alerts, for example, BOF or SQL Injection, and this classiﬁcation is assigned “off-line” during the development of the signature. The importance of classiﬁcation is threefold. First, Security teams can prioritize alerts without having to inspect them. Second, Security teams deploy automatic defensive countermea- sures to react to certain disruptive attacks as soon as they take place, for example, dropping network trafﬁc when a BOF is detected or changing some rules in ﬁrewall systems. Third, alerts can be correlated with each other and with other system logs, for example, ﬁrewall logs, to detect multistep attacks, that is, attacks that require the attacker to execute several actions to achieve his/her goal, and to reduce false alerts by identifying root causes. Thus, determining the attack class helps these tasks. 11.6.6 Anomaly-Based Systems The deployment of an anomaly-based IDS typically requires expert personnel. Several parameters need to be conﬁgured, such as the duration of the training phase or the similarity metric. Every environment being different, guidelines are hard to give. Each anomaly-based IDS is also different from the others (while all signature-based IDSs work in a similar manner). Users gain little knowledge from subsequent installations; hence, deployment tasks are likely to be trial-and-error processes. Users mainly criticize three aspects of the management of current anomaly-based IDSs, each of which increases the user effort needed to run the IDS, namely, 1. An anomaly-based IDS generally raises a high number of false alerts. 2. An anomaly-based IDS usually works as a black box. 3. An anomaly-based IDS raises alerts without an exact classiﬁcation. False Alerts Because of its statistical nature, an anomaly-based IDS is bound to raise a higher number of false alerts than a signature-based IDS. As a matter of fact, the classiﬁcation of a certain input for a signature-based IDS is predetermined (for malicious inputs), while the classiﬁcation of inputs for an anomaly-based IDS depends on the training data. Thus, different anomaly-based model instances could classify the same input differently. 412 WIRELESS MOBILE INTERNET SECURITY False alerting is a well-known problem of IDSs in general and anomaly-based IDSs in particular. Security teams need to verify each raised alert; thus, an ineffective system (i.e., a system prone to raise a high number of false alerts) will require more personnel for its management. Black Box Approach An anomaly-based IDS carries out detection as a black box. Users have little control: quite often, they can adjust only the similarity metric used to discern licit trafﬁc from malicious activities. Because most anomaly-based IDSs employ complex mathematical models (think of neural networks), users can neither precisely understand how the IDS engine discerns normal input nor reﬁne the IDS model to avoid certain false alerts or to improve attack detection. Users need to spend a good deal of time to understand the inner working of the system, and they must be experts. Lack of Attack Classiﬁcation An anomaly-based IDS raises an alert every time its model differs from the current input. The cause of the anomaly itself is unknown to the IDS. It holds little information to determine the attack class (other than the targeted IP address/TCP port and the IP source of attack). Because the model employed by the detection engine is locally built during a certain timeframe, each model is likely to be different. Hence, it is difﬁcult to develop an off-line classiﬁer suitable for any anomaly-based IDS instance. Because an anomaly- based IDS is supposed to detect unknown attacks, or slight modiﬁcations of well-known attacks, manual classiﬁcation or the application of some heuristics are currently the only possible choices. However, manual classiﬁcation is not feasible and the heuristics deliver results in a restricted context only (because the “traits” of each attack must be known before). Because alerts come unclassiﬁed, no automatic countermeasure can be activated to react to a certain threat. Because of all the difﬁculties listed above for an anomaly-based IDS, a signature-based IDS is the obvious choice when users have to monitor complex systems, such as modern corporate networks, despite its inability to deal with zero-day attacks. Users can accom- plish tuning more easily to avoid false alerts (thereby saving overall time), they can write their own set of signatures to detect attacks and a signature-based IDS automatically per- forms alert classiﬁcation. An anomaly-based IDS lacks these features because researchers have mainly focused on enhancing attack detection and have not considered usability. As a matter of fact, users could improve the usability of current anomaly-based IDSs by setting the similarity metric in such a way that the IDS generate fewer alerts. However, the detection rate would be (negatively) affected as well, thereby reducing the only advantage an anomaly-based IDS has over a signature-based IDS. 11.6.7 Evasion Techniques of IDS Systems Attackers continuously try to ﬁnd new exploits to intrude a system, while IDS system developers attempt to analyze and detect attacks. Here, four common evasions are introduced. INTERNET FIREWALLS FOR TRUSTED SYSTEMS 413 1. DoS 2. packet splitting 3. duplicate insertion 4. payload mutation. Denial of Service DoS attack intends to overwhelm network bandwidth or use system resources like CPU usage and the memory space of the system up. To do this, DoS attacks generate huge volume of network trafﬁc and exploit the vulnerability of detection algorithm like slowing down the signature matching algorithm with modiﬁed network payload. In case of Snort, it uses backtracking for covering all possible pattern matching. The attacker could exploit this and modify the payload to take worst execution time for rule matching. Packet Splitting Packet splitting chops IP datagrams or TCP streams into nonoverlapping fragments known as IP fragmentations and TCP segmentation. Because of limited system resource, some IDS systems just try to match patterns to each fragmented packet without reassembling those. In this case, IDS could not detect attacking pattern in the reassembled packet. For example, an IDS may look for /bin/sh or/bin/bash to check whether the command execution code is included or not in the payload. But the attacker can deliberately split the payload with the signature into two segments, one containing /bin and the other containing /sh. If the IPS does not reassemble the two segments, it will be unable to ﬁnd the signature in either segment, so the attacker can evade its detection. Duplicate Insertion Attackers could send duplicate or overlapping segments to IDS to confuse or neglect the content from IDS. Because IDS system does not know network topology and victim system’s OS infor- mation, if attackers send packets modifying TTL values with same sequence number, when IDS systems reassemble the packets, it gets confused with that. If IDS considered all possible combinations of packet reassembly, it gets confused as to which combination is the correct one. However, the victim system could not get all the packets sent by the attacker but the attacking packets only. For example, an attacker sends fragmented and duplicated packets like: 1. TTL value = 30 contents=“/b” sequence number = 1 2. TTL values = 13 contents “abcd” sequence number = 2 3. TTL values = 30 contents “in/b” sequence number = 2 4. TTL values = 12 contents “yep” sequence number = 3 5. TTL values = 24 contents “ash” sequence number = 3. In this case, IDS receives all ﬁve packets and is confused how to reassemble them and hence cannot detect them as attacker packets. If hop number from attacker to victim is 20, second and fourth packets are dropped and only ﬁrst, third, and ﬁfth packets are delivered to victim system. The reassembled content is/bin/bash. 414 WIRELESS MOBILE INTERNET SECURITY Payload Mutation An attacker transforms malicious packet’s payloads into semantically equivalent ones. Transformed packets will be different for IDS systems. Especially, the uniform resource identiﬁer (URI) of an HTTP request could be the target of the attack. URI characters can be encoded to hexadecimal values like Original URI: http://www.google.com?a=b Transformed URI: http%3a%2f%2fwww.google.com%3fa=b Attackers could transform several mutated expressions using the libwhisker library (www.wiretrip.net/rfp/ txt/whiskerids.html). This includes not only character transforma- tion but also self-reference directory. For example, /abc/def/../def/gf/../../../bin/abc/../sh means /bin/sh. Before trying to match patterns to URI, IDS systems need to process URL normaliza- tion (http://en.wikipedia.org/ wiki/URL_normalization) for transformed URI to original URI. IDS systems without this process will fail to detect the packet as attack.

Internet Firewalls for Trusted Systems PDF

Document Details

Tags

Related

Summary

Full Transcript

Upgrade to continue