Quiz 2 -> Exam Topics Fall 2004. Chapter 10a - Firewalls. Simple Firewall - drops packets based on IP, port Stateful - Keeps track of connections, set up inside or outside. NAT - Network Address Translation, Private Address ranges (10. ) Proxy Server - checks application header and data.
Simple Firewall - drops packets based on IP, port
Stateful - Keeps track of connections, set up inside or outside.
NAT - Network Address Translation, Private Address ranges (10. )
Proxy Server - checks application header and data.
Attacks - how does Firewall protect against scanning, bad-fragments, bad TCP flags, Smuft attack, ...
Host-based Firewalls - xinetd (/etc/hosts.allow), iptables, Zone Alarm, Black Ice (now ISS Desktop Proventia)
Subject, Object, Access Rights (permissions)
Policy - Access matrix or ACL (access control list)
Basic Security Rules:
No read up (simple security property)
No write down (do not widen accessibility)
Need to Know.
Reference Monitor, audit file, security kernel database.
Requirements to be a “Trusted System”:
“Common Criteria” Security Specifications - multinational trust ratings
Use of bad fragments to crash Operating System (OS).
Use of ICMP packets (ping, “unreachable”, “time-out”)
Smuft attack (packet multiplication, use of broadcast address).
TCP Flags - bad combinations to map OS, cause crashes.
TCP - Highjacked connection.
Bandwidth versus time (flood attacks).
Packets per period - by TCP and UDP port numbers.
Therminator - shows unbalance in traffic flow.
What do they do?
Saint and Satan
Ethereal and “tcpdump”
US-CERT (U.S. Computer Emergency Response Team)
NIPC (FBI - Nat. Infrastructure Protection Center)
What to do if a host is compromised.
Evidence - chain of custody
WEP is weak security, but far better than nothing.
Use longest key-length possible.
Enable use of “allowed list” of MAC addresses.
Use higher-layer security - IPsec or SSL.
Use a firewall and IDS to isolate wireless access points (WAP’s) just like you do for the Internet.
Search for “Rogue” WAP’s.
Hidden Files (on UNIX, name starts with “.”)
Startup scripts (great place to hide a Trojan Horse)
Covert channels (hide in “Ping” packets, SSH, port 80 FTP)
Steganography (hiding data in an image file)
Watch for new processes, files (particularly “suid” files), open Internet TCP and UDP ports.
Buffer Overflow(what is it, what does it do)
How to code to prevent possibility of a “Buffer Overflow”
Eliminate unneeded daemons, “suid programs,” open ports, and user accounts.
Enforce long, mixed-character passwords.
Explain “Once root, always root”