CHAPTER -1

Network Security

prepared by: Fakhruddin Noori

2
Overview
 What is security?
 Why do we need security?
 Who is vulnerable?
 Common security attacks and countermeasures
– Firewalls & Intrusion Detection Systems
– Denial of Service Attacks
– TCP Attacks
– Packet Sniffing
– Social Problems

3
What is “Security”
 Dictionary.com says:
– 1. Freedom from risk or danger; safety.
– 2. Freedom from doubt, anxiety, or fear; confidence.
– 3. Something that gives or assures safety, as:
• 1. A group or department of private guards: Call building security
if a visitor acts suspicious.
• 2. Measures adopted by a government to prevent espionage,
sabotage, or attack.
• 3. Measures adopted, as by a business or homeowner, to
prevent a crime such as burglary or assault: Security was lax at
the firm's smaller plant.
…etc.

4
What is “Security”
 Dictionary.com says:
– 1. Freedom from risk or danger; safety.
– 2. Freedom from doubt, anxiety, or fear; confidence.
– 3. Something that gives or assures safety, as:
• 1. A group or department of private guards: Call building security
if a visitor acts suspicious.
• 2. Measures adopted by a government to prevent espionage,
sabotage, or attack.
• 3. Measures adopted, as by a business or homeowner, to
prevent a crime such as burglary or assault: Security was lax at
the firm's smaller plant.
…etc.

5
What is “Security”
 Dictionary.com says:
– 1. Freedom from risk or danger; safety.
– 2. Freedom from doubt, anxiety, or fear; confidence.
– 3. Something that gives or assures safety, as:
• 1. A group or department of private guards: Call building security
if a visitor acts suspicious.
• 2. Measures adopted by a government to prevent espionage,
sabotage, or attack.
• 3. Measures adopted, as by a business or homeowner, to
prevent a crime such as burglary or assault: Security was lax at
the firm's smaller plant.
…etc.

6
What is “Security”
 Dictionary.com says:
– 1. Freedom from risk or danger; safety.
– 2. Freedom from doubt, anxiety, or fear; confidence.
– 3. Something that gives or assures safety, as:
• 1. A group or department of private guards: Call building security
if a visitor acts suspicious.
• 2. Measures adopted by a government to prevent espionage,
sabotage, or attack.
• 3. Measures adopted, as by a business or homeowner, to
prevent a crime such as burglary or assault: Security was lax at
the firm's smaller plant.
…etc.

7
Why do we need security?
 Protect
vital information while still allowing
access to those who need it
– Trade secrets, medical records, etc.
 Provideauthentication and access control for
resources
– Ex: AFS
 Guarantee availability of resources
– Ex: 5 9’s (99.999% reliability)

8
Who is vulnerable?
 Financial institutions and banks
 Internet service providers
 Pharmaceutical companies
 Government and defense agencies
 Contractors to various government agencies
 Multinational corporations
 ANYONE ON THE NETWORK

9
Common security attacks and
their countermeasures
 Finding a way into the network
– Firewalls
 Exploiting software bugs, buffer overflows
– Intrusion Detection Systems
 Denial of Service
– Ingress filtering, IDS
 TCP hijacking
– IPSec
 Packet sniffing
– Encryption (SSH, SSL, HTTPS)
 Social problems
– Education

10
Firewalls
 Basic problem – many network applications
and protocols have security problems that
are fixed over time
– Difficult for users to keep up with changes and
keep host secure
– Solution
• Administrators limit access to end hosts by using a
firewall
• Firewall is kept up-to-date by administrators

11
Firewalls
A firewall is like a castle with a drawbridge
– Only one point of access into the network
– This can be good or bad
 Can be hardware or software
– Ex. Some routers come with firewall functionality
– ipfw, ipchains, pf on Unix systems, Windows XP
and Mac OS X have built in firewalls

12
Firewalls

Internet DMZ
Web server, email
server, web proxy,
etc
Firewall

Firewall
Intranet

13
Firewalls
 Used to filter packets based on a combination of
features
– These are called packet filtering firewalls
• There are other types too, but they will not be discussed
– Ex. Drop packets with destination port of 23 (Telnet)
– Can use any combination of IP/UDP/TCP header
information
– man ipfw on unix47 for much more detail
 But why don’t we just turn Telnet off?

14
Intrusion Detection
 Usedto monitor for “suspicious activity” on a
network
– Can protect against known software exploits, like
buffer overflows
 Open Source IDS: Snort, www.snort.org

15
Intrusion Detection
 Uses “intrusion signatures”
– Well known patterns of behavior
• Ping sweeps, port scanning, web server indexing, OS
fingerprinting, DoS attempts, etc.
 Example
– IRIX vulnerability in webdist.cgi
– Can make a rule to drop packets containing the line
• “/cgi-bin/webdist.cgi?distloc=?;cat%20/etc/passwd”

 However, IDS is only useful if contingency plans

16
Minor Detour…
 Say we got the /etc/passwd file from the IRIX
server
 What can we do with it?

17
Dictionary Attack
 We can run a dictionary attack on the passwords
– The passwords in /etc/passwd are encrypted with the
crypt(3) function (one-way hash)
– Can take a dictionary of words, crypt() them all, and
compare with the hashed passwords
 This is why your passwords should be meaningless
random junk!
– For example, “sdfo839f” is a good passwor

18
Denial of Service
 Purpose: Make a network service unusable,
usually by overloading the server or network
 Many different kinds of DoS attacks
– SYN flooding
– SMURF
– Distributed attacks
– Mini Case Study: Code-Red

19
Denial of Service
 SYN flooding attack
 Send SYN packets with bogus source address
– Why?
 Server responds with SYN ACK and keeps state
about TCP half-open connection
– Eventually, server memory is exhausted with this state
 Solution: use “SYN cookies”
– In response to a SYN, create a special “cookie” for the
connection, and forget everything else
– Then, can recreate the forgotten information when the
ACK comes in from a legitimate connection
20
Denial of Service

21
Denial of Service
 SMURF
– Source IP address of a broadcast ping is forged
– Large number of machines respond back to
victim, overloading it

22
Denial of Service
IC M P echo (spoofed source address of victim )
S ent to IP broadcast address
IC M P echo reply

Internet

P erpetrator V ictim

23
Thank you!

24