20-751 ECOMMERCE TECHNOLOGY SPRING 2003 COPYRIGHT © 2003 MICHAEL I. SHAMOS Network Security.

transcript

20-751 ECOMMERCE TECHNOLOGY

MICHAEL I. SHAMOS

Network Security

MICHAEL I. SHAMOS

Outline

• Authentication

– Passwords– Biometrics

• Network protection– Firewalls, proxy servers– Denial of service attacks– Viruses

MICHAEL I. SHAMOS

““10591059””

Methods of User Authentication• Something you know . . .

– Password, PIN, “mother’s maiden name”

• Something you have . . .

– Physical key, token, magnetic card, smartcard

• Something you are . . .

– Finger print, voice, retina, iris

• Someplace you are– GPS information

• Best to use two or more of the above,called two-factor authentication

SOURCE: SECURITY DYNAMICS

MICHAEL I. SHAMOS

Time-based Token Authentication

Login: mcollingsPasscode: 2468234836

PIN TOKENCODE

Token code: Changes every

60 seconds

Unique seed

Clock synchronized to UCT(UNIVERSAL COORDINATED TIME)

PASSCODE = +PIN TOKENCODE

SOURCE: RSA

MICHAEL I. SHAMOS

Biometrics

• Use of an unalterable body part or feature to provide identification

• History– For 1,000,000 years we couldn’t identify people– France used tattoos; abolished in 1832– Uniqueness of fingerprints 1890

• Verification v. identification• Weaknesses:

– Forgery– Replay attack

MICHAEL I. SHAMOS

Fingerprints

SOURCE: C3i

MAIN SHAPES:

LOOPWHORLARCH

MINUTIAE:

END BIFURCATION ISLAND LAKE DOT

EACH PERSON HAS A UNIQUEARRANGEMENT OF MINUTIAE:

MICHAEL I. SHAMOS

Fingerprint CaptureThompson-CSF FingerChip

(Thermal-sensed swipe)DEMO1, DEMO2

ST-Micro TOUCHCHIP(Capacitative)

American Biometric CompanyBioMouse (Optical) Biometric Partners

Touchless Sensor

MICHAEL I. SHAMOS

Fingerprint Capture

BIOMETRIC ACCESS CORPORATION

DIGITAL PERSONA

VERITOUCH MULTI-FINGERSCANNER

NOVUS HAND GEOMETRY SYSTEM

MICHAEL I. SHAMOS

Two-Factor Authentication Token

MICHAEL I. SHAMOS

Iris Scan

SOURCE: IRISCAN

• Human iris patterns encode ~3.4 bits per sq. mm

• Can be stored in 512 bytes

• Patterns do not change after 1 year of life

• Patterns of identical twins are uncorrelated

• Chance of duplication < 1 in 1078

• Identification speed: 2 sec. per 100,000 people

PERSONAL IRIS IMAGER

Companies: British Telecom, Iriscan, Sensar

MICHAEL I. SHAMOS

Signature Dynamics

• Examines formation of signature, not final appearance

• DSV (Dynamic signature verification)

• Parameters• Total time

• Sign changes in x-y velocities

and accelerations

• Pen-up time

• Total path length

• Sampling 100 times/second

Companies: CyberSIgn, Quintet,PenOp, SoftPro SignPlus,

MICHAEL I. SHAMOS

Web/Network Security

• Client Side– What can the server do to the client?

• Fool it• Install or run unauthorized software, inspect/alter files

• Server Side– What can the client do to the server?

• Bring it down (denial of service)• Gain access (break-in)

• Network– Is anyone listening? (Sniffing)– Is the information genuine? Are the parties genuine?

MICHAEL I. SHAMOS

Packet Sniffer

Client

Packet Sniffing

Server

NETWORK INTERFACE CARDALLOWS ONLY PACKETS

FOR THIS MAC ADDRESS

EVERY NETWORK INTERFACE CARD HAS A UNIQUE 48-BIT MEDIA ACCESS CONTROL (MAC) ADDRESS, e.g. 00:0D:84:F6:3A:10

24 BITS ASSIGNED BY IEEE; 24 BY CARD VENDOR

PACKET SNIFFER SETS HIS CARDTO PROMISCUOUS MODE TO

ALLOW ALL PACKETS THROUGH

MICHAEL I. SHAMOS

Network Security Problem

SOURCE: CERT

REMOVABLEMEDIA

MODEM +TELEPHONE

LOCAL AREANETWORK

REMOTELOCATION

INTERNETCONNECTION

“BACKDOOR”INTERNET

CONNECTION

REMOTEUSER

VENDORS ANDSUBCONTRACTORS

RADIOEMISSIONS

WIRELESS

MICHAEL I. SHAMOS

Sophistication v. Intruder Knowledge

SOURCE: CERT

MICHAEL I. SHAMOS

Firewall

• A device placed between two networks or machines– All traffic in and out must pass through the firewall– Only authorized traffic is allowed to pass– The firewall itself is immune to penetration

Internet

FirewallCompany Network

SOURCE: ADAM COLDWELL

MICHAEL I. SHAMOS

Firewall Architecture

SOURCE: CHAPMAN, BUILDING INTERNET FIREWALLS

MICHAEL I. SHAMOS

Firewall Architecture

Intranet

Internet

WEBSERVER

EMAILSERVER

PROXYSERVER

MICHAEL I. SHAMOS

Proxy Server

SOURCE: CHAPMAN, BUILDING INTERNET FIREWALLS

• “DUAL-HOMED” MEANS HAS TWO IP ADDRESSES• DOES NOT FORWARD IP PACKETS

MICHAEL I. SHAMOS

Enterprise Access Security

Web Server

Firewall

Authentication Server

Intranet

Mainframe

Enterprise

UNIXRSA Agent

Remote Access

InternetRSA

Internet Access

RSA Agent

Enterprise Access

RSA Agents

SOURCE: RSA

MICHAEL I. SHAMOS

Denial-of-Service Attacks

• Attack to disable a machine (server) by making it unable to respond to requests

• Use up resources– Bandwidth, swap space, RAM, hard disk

• Some attacks yield millions of service requests per second

MICHAEL I. SHAMOS

Ping Flooding

Victim System

Attacking System(s)

Internet

SOURCE: PETER SHIPLEY

MICHAEL I. SHAMOS

Three-Way Handshake

ClientServer

SYNSYN | ACK

1: Send SYN seq=x

2: Send SYN seq=y, ACK x+1

3: Send ACK y+1SOURCE: PETER SHIPLEY

MICHAEL I. SHAMOS

SMURF ATTACK

INTERNET

PERPETRATORVICTIM

ICMP echo (spoofed source address of victim) Sent to IP broadcast address

ICMP echo reply

SOURCE: CISCO

ICMP = Internet Control Message Protocol

INNOCENTREFLECTOR SITES

BANDWIDTH MULTIPLICATION:A T1 (1.54 Mbps) can easilyyield 100 MBbps of attack

10,000 SYN/ACKs -- VICTIM IS DEAD

MICHAEL I. SHAMOS

Distributed Denial of Service Attack

SOURCE: CERT

VICTIM

INTRUDER

INTRUDER SENDSCOMMANDS TO

HANDLERS

MICHAEL I. SHAMOS

DDOS Attack

SOURCE: CERT

MICHAEL I. SHAMOS

DDOS Attack

SOURCE: CERT

MICHAEL I. SHAMOS

Rate Limiting

• Allows network managers to set bandwidth limits for users and by traffic type.

• Prevents deliberate or accidental flooding of the network

Rate Limiting for Different

Classes ofUsers

NetworkManager

Teachers

Students

2 Mbps

10 Mbps

50 Mbps

SOURCE: CISCO

MICHAEL I. SHAMOS

Code Attacks

• Virus– executable code– that attaches itself to other executable code

(infection)– to reproduce itself (spread) replicator + concealer + payload

• Rabbit, Worm– program that makes many copies of itself and spreads them.

Each copy makes copies, etc. Worm spreads via networks.

• Trojan Horse– performs unauthorized activity while pretending to be

another program. Example: fake login program

MICHAEL I. SHAMOS

Viral Phenomena

• Invented ~1985• More than 70,000 known viruses

– More than in nature

• 10-15 new viruses per day• 35% are destructive (up from 10% in 1993)

• Virus attacks per computer doubles every two years• Written mostly by men 14-24

– India, New Zealand, Australia, U.S.

• Symantec employs 45 people full-time, spread over 24 hours, to detect and neutralize viruses

MICHAEL I. SHAMOS

Exploiting System Bugs

• Buffer overflows– Program allocates 255 bytes for input.

– Hacker sends 500 bytes.

BUFFER (255 BYTES) PROGRAM CODE

245 BYTES ARE OVERWRITTEN WITH HACKER’S DATANOW HACKER’S CODE CAN BE EXECUTED

INPUT IS 500 BYTES LONG

BUFFER (255 BYTES) PROGRAM CODE

MICHAEL I. SHAMOS

Viral Phenomena

• Stealth capability– Virus “hides” from detection. Installs memory-resident code.

– Intercepts file accesses. If attempt is made to access its disk sector, substitutes “clean” data instead.

• Mutation

– Accidental. Virus gets changed (corrupted) by system

– Deliberate. Creator inserts program modification code.“Self-garbling” - unscrambles itself before use

– Result: virus becomes hard to detect

• Virus toolkits

MICHAEL I. SHAMOS

Virus Detection

• Some virus families have common characteristics– Presence or absence of particular strings

• Antiviral software– Only detects what it know how to detect.– Must be upgraded regularly for new viruses.– Symantec encyclopedia

• File virus– Compare size with known backup copy.– Presence of strings, like “.EXE”

• Retrovirus– Attacks or disables antivirus software

MICHAEL I. SHAMOS

Network Attacks

SOURCE: CERT

MICHAEL I. SHAMOS

Key Takeaways

• Evaluate all risks, even internal ones• People do bizarre things when they think no one will

find out • Security is for professionals• Unexplored future in biometrics• Proxies give only thin protection• There is no current defense to DOS attacks• There is no defense to new viruses

(except Java for a while)

MICHAEL I. SHAMOS

20-751 ECOMMERCE TECHNOLOGY SPRING 2003 COPYRIGHT © 2003 MICHAEL I. SHAMOS Network Security.

Documents