Intrusion Detection Systems

Intrusion Detection ceAuthor: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusions

Intrusion Detection nAuthor: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

Enemy takes some time to breach each of the levels of eAuthor: Prof Bill BuchananDefence-in-the-depthAuthor: Bill BuchananDefence

Untrusted(their side)Author: Prof Bill BuchananDMZAuthor: Bill BuchananTrusted(our side)DMZ – an areawhere militaryactionsare prohibited

AssetsHello. How areyou? Is thisokay?UsersSystemsEven with the bestdefences, intruderscan penetrate themProtectingAuthor: Prof Bill BuchananAuthor: Bill BuchananData

Intrusion Detection Systems can help to reduce eFirst-leveldefenceAuthor: Prof Bill BuchananDefence-in-the-depthAuthor: Bill BuchananAssets

Intrusion Detection or: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

DatastealingCorporate accessEmail accessExternalhackWeb accessIntrusionDetectionDoS imeterTerrorism/extortionFraudAuthor: Prof Bill BuchananOutside threatsAuthor: Bill BuchananAssets

CSI (Computer Security Institute) found:70% of organisation had breaches60% of all breaches came from inside theirown systemsDatastealingCorporate accessEmail accessExternalhackWeb accessIntrusionDetectionDoS ot deal withinternal nisationalperimeterTerrorism/extortionFraudAuthor: Prof Bill BuchananInternal threats (often Protectinga great threat than from outside)Author: Bill BuchananAssets

Eve(Intruder)Public WebServerDefencePublic FTPServerPublic ProxyServerDefenceAudit/loggingFirewallIntrusion tionDefenceNAT DeviceIntrusion r: Prof Bill BuchananDefence-in-depth (multiple obstacles)Author: Bill BuchananDefence-in-depth puts as manyobstacles in the way of anintruder, so that it becomesharder to penetrate the network,and easier to detectIntrusion DetectionSystem

Intrusion Detection : Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

IntrusionDetectionMisuse DetectionThis attempts to modelattacks on a system asspecific patterns, and thenscans for occurrences ofthese. Its disadvantage isthat it struggles to detectnew attacks.IDS agentPersonal abuseDenial-of-ServiceExternal hack(scripting)FraudExternal hack(human)DatastealingAuthor: Prof Bill BuchananIDS typesAuthor: Bill BuchananViruses/WormsAnomaly Detection.This assumes that abnormalbehaviour by a user can becorrelated with an intrusion.Its advantage is that it cantypically react to newattacks, but can oftenstruggle to detect variants ofknown attacks, particularly ifthey fit into the normalusage pattern of a user.Another problem is that theintruder can mimic thebehavioural pattern of theuser.

Network intrusiondetection systems (NIDS)These monitor packetson the network and tries todetermine an intrusion.This is either host base(where it runs on a host),or can listen to thenetwork using a hub,router or probe.Intrusion DetectionSystemThese monitor systemfiles to determine if anintruder has changed them(a backdoor attack). Agood example of this isTripwire. It can also watchother key systemcomponents, such as theWindows registry and root/administrator levelprivileges.User profilingLog file monitors (LFM)These monitor log fileswhich are generated bynetwork services, and lookfor key patterns of change.Swatch is a goodexample.Author: Prof Bill BuchananIDS TypesAuthor: Bill BuchananSystem Integrity Verifier

Intruder gains public informationabout the systems, such as DNS andIP Intruder gains more specificinformation such as subnet layout, andnetworked Intruder)From code yellow to codered .ExploitIntruder finds aweakness, such ascracking a password,breachinga firewall, and so on.FootholdIntrusionDetectionData stealing, systemdamage,user abuse, and so on.IntrusionDetectionOnce into the system, theintruder can then advanceup the privilege levels,Author: Prof Bill BuchananTypical pattern of intrusion 4Author: Bill BuchananProfit

Intrusion Detection SystemsIntrusionDetectionDefenceDefenceHost or Network?Author: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

Public Web Public FTPServerServerPublic Intrusion DetectionSystemDMZIntrusionDetectionNAT DeviceIntrusion nIntrusion DetectionSystemHost-based IDSlistens to trafficin/out of a hostAuthor: Prof Bill BuchananHost or network?Author: Bill BuchananNetwork-basedIDS listens tosome/allnetwork trafficIntrusion DetectionSystem

FirewallIntrusion DetectionSystemDMZAuthor: Prof Bill BuchananProtectingAuthor: Bill BuchananNAT Device

HubIntrusionDetectionSwitchIDS can listen toall the incomingand outgoing networkIntrusionDetectionAuthor: Prof Bill BuchananIDS locationAuthor: Bill BuchananThis IDS cannot hear anytraffic which is not addressed to itas it connects to a switch.

IntrusionDetection0/20/5Author: Prof Bill BuchananUsing the span portAuthor: Bill Buchanan0/1interface FastEthernet0/1port monitor FastEthernet0/2port monitor FastEthernet0/5port monitor VLAN2!interface FastEthernet0/2!interface FastEthernet0/3switchport access vlan 2!interface FastEthernet0/4switchport access vlan 2!interface FastEthernet0/5!interface VLAN1ip address 192.168.0.1 255.255.255.0no ip directed-broadcastno ip route-cache!

IntrusionDetectionIntrusionDetectionThis IDS detectssuccessful attacksagainst firewallIDS detectsattacks againstserverIntrusionDetectionDMZThis IDS detectsattacks againstmain S detects internalattacks Author: Prof Bill BuchananProtectingAuthor: Bill BuchananIDS detectsattacks againsthost

Intrusion Detection Author: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

Security agentManagement agentQoS agentSNORT agentReconfig agentAuthor: Prof Bill BuchananAgent-based system allows for distributed securityAuthor: Bill BuchananAuditing agent

Author: Bill BuchananIDSAgent-based

Intrusion Detection or: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

WiresharkSNORTUser-definedagentAPI InterfaceWinPCaplibpcapNetwork Interface: Ethernet, Wireless, ADSL, etcAuthor: Prof Bill BuchananIntegrating with WinPCap – capturing packetsAuthor: Bill BuchananCapturefilter

Author: Bill BuchananIDSWinPCap

WinPCapAuthor: Prof Bill BuchananIntegrating with WinPCap – showing the interfaceAuthor: Bill Buchananusing System;using Tamir.IPLib;namespace NapierCapture{public class ShowDevices{public static void Main(string[] args){string verWinPCap null;int count 0;verWinPCap ist getNetConnections ap Version: {0}", verWinPCap);Console.WriteLine("Connected devices:\r\n");foreach(PcapDevice net in getNetConnections){Console.WriteLine("{0}) tIP Address: oopback: nt ;}Console.Write("Press any RETURN to exit");Console.Read();}}Tamir Code Wrapper (.NET interface)}

namespace NapierCapture{public class CapturePackets{public static void Main(string[] args){PcapDeviceList getNetConnections SharpPcap.GetAllDevices();NetworkDevice netConn (NetworkDevice)getNetConnections[1];PcapDevice device netConn;device.PcapOnPacketArrival new SharpPcap.PacketArrivalEvent(device PcapOnPacketArrival);Console.WriteLine("Network connection: re();Console.Write("Press any RETURN to ice.PcapClose();}}13:17:56,990 Len 69513:17:57,66 Len 28813:17:57,68 Len 69413:18:4,363 Len 31913:18:4,364 Len 37313:18:4,364 Len 37113:18:4,365 Len 37513:18:4,366 Len 367Tamir Code Wrapper (.NET interface)WinPCapAuthor: Prof Bill BuchananProtectingAuthor: Bill Buchanan}private static void device PcapOnPacketArrival(object sender,Packet packet){DateTime time packet.PcapHeader.Date;int len {0}:{1}:{2},{3} Len {4}",time.Hour,time.Minute, time.Second, time.Millisecond, len);}

Intrusion Detection : Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

Other tools:Tcptrace. Identity TCP streams.Tcpflow. Reconstruct TCP streams.Event dataSignature detection.Identify well-knownpatterns of attack.SNORT agentLog dataAnomaly detection.Statistical anomalies,such as user logins,changes to files, and soon.Author: Prof Bill BuchananSnort rulesAuthor: Bill BuchananSNORT rulesfile

alert tcp any any - 192.168.1.0/24 111 (content:" 00 01 86 a5 "; msg:"mountd access";)Generate an alert and log packetLog packetIgnore the packetAlert and activate another ruleRemain idle until activated by an activate ruleEvent dataSNORT agentLog dataAuthor: Prof Bill BuchananSnort rulesAuthor: Bill BuchananalertlogpassactivateDynamic

alert tcp any any - 192.168.1.0/24 111 (content:" 00 01 86 a5 "; msg:"mountd access";)[Destination IP] [Port]Event dataSNORT agentLog dataAuthor: Prof Bill BuchananSnort rulesAuthor: Bill Buchanan[Source IP] [Port]

alert tcp any any - 192.168.1.0/24 111 (content:" 00 01 86 a5 "; msg:"mountd access";)Payload detection:Hex sequence " 00 01 86 a5 "Text sequence "USER entbytejumpEvent dataLog dataAuthor: Prof Bill BuchananPayload detectionAuthor: Bill BuchananSNORT agent

alert tcp any any - 192.168.1.0/24 111 (content:" 00 01 86 a5 "; msg:"mountd access";)Message-to-displayEvent dataLog dataAuthor: Prof Bill BuchananPayload detectionAuthor: Bill BuchananSNORT agent

alert tcp HOME NET any - EXTERNAL NET 1863(msg:"CHAT MSN login attempt"; flow:to server,established; content:"USR "; depth:4;nocase; content:" TWN "; distance:1; nocase;classtype:policy-violation; sid:1991; rev:1;)Event dataSNORT agentLog dataLess 100 Reserved for future useBetween 100 and 1,000,000 are rules included with the SnortdistributionMore than 1,000,000 is for local rulesFor example: sid:336; rev:7; represents an attempt to change tothe system administrator’s account in FTP.Author: Prof Bill BuchananSnort ruleAuthor: Bill BuchananThe SID and REV represent know Snort rules:

Intrusion Detection SystemsIntrusionDetectionDefenceDefenceA simple ruleAuthor: Prof Bill BuchananAuthor: Bill BuchananIntroductionThreatsTypesHost or Network?Agent-basedSnortA simple ruleA few intrusionsUser profilingHoneypotsIPSConclusionsEve(Intruder)

alert tcp any any - any any (content:"the"; msg:"The found .";)Snort -v -c bill.rules -l /log[**] [1:0:0] The found . [**][Priority: 0]01/16-22:27:35.287084 0:3:6D:FF:2A:51 - 0:60:B3:68:B1:10 type:0x800 len:0x198192.168.0.20:3554 - 192.168.0.22:445 TCP TTL:128 TOS:0x0 ID:1086 IpLen:20DgmLen:394 DF***AP*** Seq: 0x3524EE7B Ack: 0xF842AB06 Win: 0x42E4 TcpLen: 20[**] [1:0:0] The found . [**][Priority: 0]01/16-22:27:35.290026 0:60:B3:68:B1:10 - 0:3:6D:FF:2A:51 type:0x800 len:0x5D192.168.0.22:445 - 192.168.0.20:3554 TCP TTL:128 TOS:0x0 ID:775 IpLen:20DgmLen:79 DF***AP*** Seq: 0xF842AB06 Ack: 0x3524EFDD Win: 0x41BF TcpLen: 20Author: Prof Bill BuchananRunning SnortAuthor: Bill BuchananAlert.ids(in \log)[**] [1:0:0] The found . [**]16 January 10:27pm[Priority: 0]01/16-22:27:35.286762 0:60:B3:68:B1:10 - 0:3:6D:FF:2A:51 type:0x800 len:0x169192.168.0.22:445 - 192.168.0.20:3554 TCP TTL:128 TOS:0x0 ID:774 IpLen:20DgmLen:347 DF***AP*** Seq: 0xF842A9D3 Ack: 0x3524EE7B Win: 0x4321 TcpLen: 20