07/07/2009

Overview
13.a Intruders
• Introduction
• Classes of Intruders
• Intrusion Techniques
– Password Guessing
Dr Joseph Sevilla – Password Capture
MIT 8342 Cryptography and Information Security – Buffer Overflows
• Intrusion Detection
– Approaches
– Audit Record Analysis
– Statistical Anomaly Detection
– Rule-Based Intrusion Detection
– Base-Rate Fallacy
• Distributed Intrusion Detection
• Honeypots
1

Intruders Classes of Intruders

• A significant security problem for networked systems is • Masquerader:

hostile or unwanted access by users or software. – Unauthorised individual who penetrates a system’s access
controls to exploit a legitimate user’s account.
– Via network or local access.
– Usually outsider.
– Unauthorised logon or acquisition of privileges.
• Misfeasor:
– Software intrusion: viruses, worms, Trojan horses.
– Legitimate user who abuses privileges to access data, programs
• We will examine the nature of attacks and strategies for or resources.
detection and prevention. – Usually insider.
– Detection: Learning of an attack, either before or after its success. • Clandestine user:
– Prevention: Attempt to thwart all possible attacks. – Individual who seizes supervisory control and uses it to evade
auditing and access controls.
– Insider or outsider.

3 4

Intruders Intrusion Techniques

• Two types of hackers: • Aim: Gain access and/or increase privileges on a system.
– Benign intruders: simply wish to explore to find out what is there. – Typically involves knowledge of some info that should have been
• May seem tolerable, but still cost resources.
protected: e.g. a user’s password.
– Malign intruders: perform unauthorised modifications or disrupt system. • Systems maintain a file that associates passwords to
• You can’t tell in advance whether an attack will be benign or malign. authorised users.
• May use compromised system to launch other attacks. • Protection of password files:
• Two levels of hackers: 1. One-way function
– Sophisticated users with thorough knowledge of the technology. • Store value of a function based on the user’s password.
– Low-level ‘foot soldiers’, merely use available cracking programs with • User presented password is transformed and compared with the
little understanding of the technology.
stored value.
• Awareness of intruders has led to the development of Computer • In practice, system performs a one-way transformation in which
Emergency Response Teams (CERTs): the password is used to generate a key for the one-way function.
– Collect information about system vulnerabilities and disseminate them to 2. Access Control
IT managers.
– Hackers also have access to such reports. • Access to password file limited to one or very few accounts.

5 6

1
 07/07/2009

Password Guessing Password Capture

• One of the most common attacks.

• Attacker knows a login name (from email/web page, • Another attack involves password capture.
etc). – Use of Trojan Horse program.
• Then attempts to guess password for it: • E.g. via a game.
– Defaults, short passwords, common word searches. – Monitoring an insecure network login tapping the line between
– User info (variations on names, birthday, phone no, number remote user and host system.
plates, common words/hobbies). • E.g. Telnet, FTP, web, email.
– Exhaustively searching all possible passwords. – Extracting recorded info after successful login (web history/cache,
• Success depends on password chosen by user. last number dialled, etc.).
– Surveys show that many users choose passwords poorly. • Using valid login/password can impersonate user.
• However, it is tedious and can be countered.
– Block users after several invalid attempts (but an attacker
may copy encrypted password file and try off-line).
7 8

Buffer Overflows Intrusion Detection

• Does not require learning a password. • Inevitably, intrusion prevention will have security failures.
• Need for detection as a second line of defence.
• Intruders get access to the system by exploiting – The sooner an intrusion is detected, the less the amount of
attacks such as buffer overflows on a program that damage and faster recovery is achievable.
runs with certain privileges. – Effective IDS can be a deterrent thus preventing intrusions.
– Enables collection of information that could be used to improve
• Privilege escalation can be done also in this way. security.
• Based on the assumption that intruder will behave
differently from a legitimate user.
– This is not exactly distinct! Expected overlap in behaviour.
– Means some false positives or false negatives may be arrived at in
trying to catch intruders.

9 10

Approaches to Intrusion Detection Audit Records

• Statistical anomaly detection: collection of data related to • Fundamental tool for intrusion detection. Two plans:
behaviour of legitimate users over time.
– Statistical tests applied to observed behaviour to determine with high
• Native audit records
level of confidence the legitimacy of a certain behaviour. – Collects info on user activity and is part of all common multi-user
– Threshold detection: define thresholds for the frequency of occurrence O/S.
of events – independent of user. • Advantages: software already present for use.
– Profile based: A profile for each user is developed and used to detect • Disadvantage: may not contain the information required or
changes in behaviour.
may have it in an inconvenient format.
• Rule-based detection: define a set of rules that determine an
intruder. • Detection-specific audit records
– Anomaly detection: detect deviation from previous patterns. – Created specifically to collect information required by the IDS.
– Penetration identification: expert system approach to search for – Could me made vendor independent and ported to different
suspicious behaviour. systems.
• In practice, a combination of both approaches will be more effective. – Additional overhead (two auditing packages running).

11 12

2
 07/07/2009

Statistical Anomaly Detection Audit Record Analysis

• Threshold detection: • Foundation of statistical approaches.

– Count occurrences of specific event over time.
• If count exceeds reasonable value an intrusion is assumed.
• Audit records provide input to the IDS.
– Alone it is a crude and ineffective detector. – Designer must decide what metrics to use to measure
• Variability across users, likely to generate either many false user behavior and in the long run define typical
positives or false negatives. behavior.
• Useful in conjunction with other techniques. – Current audit records used as input to detect intrusion.
• Profile-based systems: • Some metrics used include:
– Characterise past behaviour of users (or groups of users).
– Detect significant deviations from this.
– Counter (logins/hr, commands per session etc), gauge,
interval timer (e.g. length of time between successive
– Profile usually multi-parameter (deviation from one parameter may
not be sufficient to signal an alert). logins), resource utilisation.

13 14

Audit Record Analysis Rule-Based Intrusion Detection

• Given metrics, various tests are performed to determine if • Observe events on system & apply rules to decide
current behavior is acceptable using approaches such as: if activity is suspicious or not.
– mean & standard deviation, multivariate, Markov process, time • Approaches focus on either anomaly detection or
series, operational.
penetration identification.
• Advantage of statistical profiles: no prior knowledge of
security flaws is required. • Rule-based anomaly detection:
– The detector program learns what is normal and then looks for – Analyse historical audit records to identify usage
deviations. patterns & auto-generate rules that define them.
– Not based on system-dependent characteristics and – Then observe current behavior & match against rules to
vulnerabilities. see if conforms.
– Portable between systems. – Like statistical anomaly detection does not require prior
knowledge of security flaws.
15 16

Rule-Based Intrusion Detection Base-Rate Fallacy

• Rule-based penetration identification. • Need for IDSs to detect a substantial percentage

– Uses expert systems technology. of intrusions while keeping false alarms at an
– Use rules identifying known penetrations, exploit of acceptable level.
known weakness, or identify suspicious behaviour. – If too few intrusions detected -> false security.
– Compare audit records or states against rules. – If too many false alarms -> managers start to ignore /
– Rules usually machine & O/S specific. too much time spent analyzing false alarms.
– Rules are generated by experts who interview & • This is very hard to do.
codify knowledge of security and system admins
• Existing systems seem not to have a good record.
(rather than by automated analysis).
– Quality depends on how well this is done.
17 18

3
 07/07/2009

Distributed Intrusion Detection Distributed Intrusion Detection

• Traditional focus is on single systems. • Centralised

• But typically, we need to defend a distributed collection of – Single point of collection and analysis and easier
hosts supported on a LAN. correlation of incoming reports.
– More effective defence has IDSs across the network working
together. – Potential bottleneck and single point of failure.
• Issues in design of a distributed IDS: • Decentralised
– Dealing with varying native audit record formats.
– More than one analysis centre.
– Integrity & confidentiality of raw or summary data being
transmitted over the network. – Need for co-ordination of activities and exchange of
– Either centralised or decentralised architecture may be used. information.

19 20

Distributed Intrusion Detection – Distributed Intrusion Detection -

Example of Architecture Components

• Host agent module

– Audit collection module operating as a background process on a
monitored system.
– Collects data on security related events on the host and transmit
them to the central manager.
• LAN monitor agent module
– Analyses LAN traffic and reports results to central manager.
• Central manager module
– Processes the reports from the above and correlates the to detect
intrusion.

21 22

Distributed Intrusion Detection –

Agent Architecture
Honeypots

• Decoy systems to lure attackers.

• Filter is applied on what agent
– Divert attention from accessing critical systems.
has captured to retain only that
which is of security interest. – Collect information on attacker's activities.
– Encourage attacker to stay on system long enough for the
• Records standardised to Host
administrator to respond.
Audit Record (HAR) format.
• Designed with fabricated information that appears
• Template driven logic module
analyses records for suspicious
valuable.
activity. – Legitimate users would not access it.
• If suspicious activity is detected – Any access to the honeypot is suspect.
an alert is sent to the central • System is instrumented with sensitive monitors and
manager which includes an event loggers.
expert system that can be used – Able to detect accesses and collect detailed information on
to draw inferences from attackers activities.
received data. 23 24

4
 07/07/2009

Honeypots References

• Because an attack is made to look successful, admins

have time to mobilise and log and track attacker • Most of the material in the previous slides was
without exposing the real systems. taken from:
• Administrators can use information obtained to figure – Cryptography and Network Security by Stallings, 4 Ed
out defences. • Supplemental material from:
• Current evolution from single host honeypots to
• Lawrie Brown Slides
honeynets of multiple dispersed systems.
– Simulates an entire network with actual or simulated traffic.
www.cisa.umbc.edu/courses/cmsc/487/slides/ch18.ppt
• The IETF Intrusion Detection Working Group is
currently drafting standards to support interoperability
of IDS info (both honeypot and normal IDS) over a
wide range of systems & O/S’s.
25 26