1 / 29

Network Security Firewalls: Preventing Attacks and Unauthorized Access

Firewalls isolate an organization's internal network from the larger Internet, allowing some packets to pass while blocking others. They prevent denial-of-service attacks, illegal modification/access of internal data, and allow only authorized access to the inside network. There are two types of firewalls: application-level and packet-filtering. Examples and limitations of firewalls and gateways are discussed, along with countermeasures for internet security threats such as packet sniffing and IP spoofing.

matthewc
Download Presentation

Network Security Firewalls: Preventing Attacks and Unauthorized Access

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. public Internet administered network firewall Firewalls isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others. firewall Network Security

  2. Firewalls: Why Prevent denial of service attacks: • Denial-of-Service (DoS) attack: • Send many fake requests to congest link or consume server resource (CPU, memory) • SYN flooding: • attacker sends many SYNs to victim; victim has to allocate connection resource; victim has no resource left for real connection requests any more. • Usually with spoofed source IP address Prevent illegal modification/access of internal data. • e.g., attacker replaces CIA’s homepage with something else Network Security

  3. Firewalls: Why Allow only authorized access to inside network • Set of authenticated users • Set of authorized IP addresses Two types of firewalls: • application-level • Checking application level data • packet-filtering • Checking TCP or IP packets only Network Security

  4. internal network connected to Internet via router firewall router filters packet-by-packet, decision to forward/drop packet based on: source IP address, destination IP address TCP/UDP source and destination port numbers ICMP message type TCP SYN and ACK bits Packet Filtering Should arriving packet be allowed in? Departing packet let out? Network Security

  5. Example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23. All incoming and outgoing UDP flows and telnet connections are blocked. Example 2: Block inbound TCP segments with SYN=1. Prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside. Packet Filtering Example of Windows XP service pack 2 firewall Network Security

  6. Filters packets on application data as well as on IP/TCP/UDP fields. Example: allow select internal users to telnet outside. Application gateways gateway-to-remote host telnet session host-to-gateway telnet session application gateway router and filter 1. Require all telnet users to telnet through gateway. 2. For authorized users, gateway sets up telnet connection to dest host. Gateway relays data between 2 connections 3. Router filter blocks all telnet connections not originating from gateway. • Example: block user access to know porn websites • Check if the Web URL is in a “black-list” Network Security

  7. IP spoofing: router can’t know if data “really” comes from claimed source SYN flood attack UDP traffic client software must know how to contact application gateway. e.g., must set IP address of proxy in Web browser Speed constraint on high-bandwidth link Application-level firewall is time consuming filters often use all or nothing policy for UDP Usually most incoming UDP ports are blocked The trouble caused to real-time Internet video Limitations of firewalls and gateways Network Security

  8. tradeoff: degree of communication with outside world, level of security Trend --- remote office Blurred boundary between inside <-> outside Employee laptop threat many highly protected sites still suffer from attacks Limitations of firewalls and gateways Network Security

  9. Internet security threats Mapping: • before attacking: “case the joint” – find out what services are implemented on network • Use ping to determine what hosts have addresses on network • Port-scanning: try to establish TCP connection to each port in sequence (see what happens) • nmap (http://www.insecure.org/nmap/) mapper: “network exploration and security auditing” Countermeasures? Network Security

  10. Internet security threats Mapping:countermeasures • record traffic entering network • look for suspicious activity (IP addresses, pots being scanned sequentially) • Firewall to block incoming TCP/SYN to ports or computers not providing the services • Block ping traffic Network Security

  11. src:B dest:A payload Internet security threats Packet sniffing: • broadcast media • promiscuous NIC reads all packets passing by • can read all unencrypted data (e.g. passwords) • e.g.: C sniffs B’s packets C A B Countermeasures? Network Security

  12. src:B dest:A payload Internet security threats Packet sniffing: countermeasures • all hosts in orgnization run software that checks periodically if host interface in promiscuous mode. • one host per segment of broadcast media (switched Ethernet at hub) C A B Network Security

  13. src:B dest:A payload Internet security threats IP Spoofing: • can generate “raw” IP packets directly from application, putting any value into IP source address field • receiver can’t tell if source is spoofed • e.g.: C pretends to be B C A B Countermeasures? Network Security

  14. src:B dest:A payload Internet security threats IP Spoofing: ingress filtering • routers should not forward outgoing packets with invalid source addresses (e.g., datagram source address not in router’s network) • great, but ingress filtering can not be mandated for all networks C A B Network Security

  15. SYN SYN SYN SYN SYN SYN SYN Internet security threats Denial of service (DOS): • flood of maliciously generated packets “swamp” receiver • Distributed DOS (DDOS): multiple coordinated sources swamp receiver • e.g., C and remote host SYN-attack A C A B Countermeasures? Network Security

  16. SYN SYN SYN SYN SYN SYN SYN Internet security threats Denial of service (DOS): countermeasures • filter out flooded packets (e.g., SYN) before reaaching host • Cooperation with source routers • Detect spoofed SYN based on TTL values • traceback to source of floods (most likely an innocent, compromised machine) C A B Network Security

  17. . KS( ) + + KB(KS ) KB + . + KB( ) Secure e-mail • Alice wants to send confidential e-mail, m, to Bob. KS KS(m ) m Internet KS • Alice: • generates random symmetric private key, KS. • encrypts message with KS (for efficiency) • also encrypts KS with Bob’s public key. • sends both KS(m) and KB(KS) to Bob. Network Security

  18. . . KS( ) KS( ) + + + - KB(KS ) KB(KS ) KB KB - + KS KS(m ) KS(m ) m m KS Internet KS . . + - KB( ) KB( ) Secure e-mail • Alice wants to send confidential e-mail, m, to Bob. • Bob: • uses his private key to decrypt and recover KS • uses KS to decrypt KS(m) to recover m Network Security

  19. + - KA KA + - . . + - KA( ) KA( ) . . - - KA(H(m)) KA(H(m)) H(m ) m H( ) H( ) compare Internet m H(m ) m Secure e-mail (continued) • Alice wants to provide sender authentication message integrity. • Alice digitally signs message. • sends both message (in the clear) and digital signature. Network Security

  20. . KS( ) + + - KB(KS ) KA KB + + KS m . - KA( ) . - KA(H(m)) H( ) m Internet KS . + KB( ) Secure e-mail (continued) • Alice wants to provide secrecy, sender authentication, message integrity. Alice uses three keys: her private key, Bob’s public key, newly created symmetric key Network Security

  21. Internet e-mail encryption scheme, de-facto standard. uses symmetric key cryptography, public key cryptography, hash function, and digital signature as described. provides secrecy, sender authentication, integrity. inventor, Phil Zimmerman, was target of 3-year federal investigation. ---BEGIN PGP SIGNED MESSAGE--- Hash: SHA1 Bob:My husband is out of town tonight.Passionately yours, Alice ---BEGIN PGP SIGNATURE--- Version: PGP 5.0 Charset: noconv yhHJRHhGJGhgg/12EpJ+lo8gE4vB3mqJhFEvZP9t6n7G6m5Gw2 ---END PGP SIGNATURE--- Pretty good privacy (PGP) A PGP signed message: Network Security

  22. transport layer security to any TCP-based app using SSL services. used between Web browsers, servers for e-commerce (shttp). security services: server authentication data encryption client authentication (optional) server authentication: SSL-enabled browser includes public keys for trusted CAs. Browser requests server certificate, issued by trusted CA. Browser uses CA’s public key to extract server’s public key from certificate. check your browser’s security menu to see its trusted CAs. Secure sockets layer (SSL) Network Security

  23. Encrypted SSL session: Browser generates symmetric session key, encrypts it with server’s public key, sends encrypted key to server. Using private key, server decrypts session key. Browser, server know session key All data sent into TCP socket (by client or server) encrypted with session key. SSL: basis of IETF Transport Layer Security (TLS). SSL can be used for non-Web applications, e.g., IMAP. Client authentication can be done with client certificates. Not widely used since too many clients SSL (continued) Network Security

  24. Network-layer secrecy: sending host encrypts the data in IP datagram Applicable toTCP and UDP segments; ICMP and SNMP messages. IP header in clear text, the other is in encrypted text Network-layer authentication destination host can authenticate source IP address Also use a similar public key authority for public key distribution IPsec: Network Layer Security Network Security

  25. IEEE 802.11 security • Packet sniffing is unavoidable • War-driving: drive around Bay area, see what 802.11 networks available? • More than 9000 accessible from public roadways • 85% use no encryption/authentication • packet-sniffing and various attacks easy! • Wired Equivalent Privacy (WEP): authentication as in protocol ap4.0 (require shared symmetric key) • host requests authentication from access point • access point sends 128 bit nonce • host encrypts nonce using shared symmetric key • access point decrypts nonce, authenticates host Network Security

  26. IEEE 802.11 security • Wired Equivalent Privacy (WEP): data encryption • Host/AP share 40 bit symmetric key (semi-permanent) • Host appends 24-bit initialization vector (IV) to create 64-bit key • IV is equivalent to a “nonce” • 64 bit key used to generate stream of keys, kiIV (using RC4 stream cipher) • kiIV used to encrypt i-th byte, di, in frame: ci = diXORkiIV • IV and encrypted bytes, ci sent in frame Network Security

  27. 802.11 WEP encryption Sender-side WEP encryption Network Security

  28. 802.11 WEP Security Concern • 40 bits in encryption is too short • RC4 is not properly used in 802.11 • A more sure protocol is just standardized, 802.11i Network Security

  29. Network Security (summary) Basic techniques…... • cryptography (symmetric and public) • authentication • message integrity • key distribution …. used in many different security scenarios • secure email • secure transport (SSL) • IP sec • 802.11 security Network Security

More Related