IP Filtering and Intrusion Detection/Intrusion Prevention - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

IP Filtering and Intrusion Detection/Intrusion Prevention

The ISA firewall performs intrusion detection and intrusion prevention. In this section, we discuss the following intrusion detection and intrusion prevention features:

Common Attacks Detection and Prevention

DNS Attacks Detection and Prevention

IP Options and IP Fragment Filtering

Common Attacks Detection and Prevention

You can access the Intrusion Detection dialog box by opening the Microsoft Internet Security and Acceleration Server 2004 management console, expanding the server name, and then expanding the Configuration node. Click the General node.

In the General node, click the Enable Intrusion Detection and DNS Attack Detection link. This brings up the Common Attacks tab.

On the Common Attacks tab, put a checkmark in the Enable intrusion detection checkbox. Put a checkmark to the left of each of the attacks you want to prevent. If you enable the Port scan attack, enter values for the Detect after attacks … well-known ports and Detect after attacks on … ports. (See Figure 10.41.)

Figure 10.41: The Common Attacks Tab

You can disable logging for packets dropped by the Intrusion Detection filter by removing the checkmark from the Log dropped packets checkbox.

Denial-of-Service Attacks

Denial-of-service (DoS) attacks are one of the most popular choices of Internet hackers who want to disrupt a network's operations. Although they do not destroy or steal data as some other types of attacks do, the objective of the DoS attacker is to bring down the network, denying service to its legitimate users. DoS attacks are easy to initiate; software is readily available from hacker Web sites and warez newsgroups that will allow anyone to launch a DoS attack with little or no technical expertise.

In February 2000, massive DoS attacks brought down several of the biggest Web sites, including Yahoo.com and Buy.com.

The purpose of a DoS attack is to render a network inaccessible by generating a type or amount of network traffic that will crash the servers, overwhelm the routers, or otherwise prevent the network's devices from functioning properly. Denial of service can be accomplished by tying up the server's resources; for example, by overwhelming the CPU and memory resources. In other cases, a particular user/machine can be the target of DoS attacks that hang up the client machine and require it to be rebooted.

Distributed Denial-of-Service Attack

Distributed DoS attacks use intermediary computers, called agents, on which programs called zombies have previously been surreptitiously installed. The hacker activates these zombie programs remotely, causing the intermediary computers (which can number in the hundreds or even thousands) to simultaneously launch the actual attack. Because the attack comes from the computers running the zombie programs, which may be on networks anywhere in the world, the hacker is able to conceal the true origin of the attack.

Examples of DDoS tools used by hackers are TFN (Tribe FloodNet), TFN2K, Trinoo, and Stacheldraht (German for 'barbed wire'). While early versions of DDoS tools targeted UNIX and Solaris systems, TFN2K can run on both UNIX and Windows systems.

Because DDoS attacks are so popular, many tools have been developed to help you detect, eliminate, and analyze DDoS software that may be installed on your network. The National Infrastructure Protection Center has recently announced one such tool to detect some types of DDoS programs on some systems. For more information, see www.fbi.gov/nipc/trinoo.

It is important to note that DDoS attacks pose a two-layer threat. Your network could be the target of a DoS attack that crashes your servers and prevents incoming and outgoing traffic, and your computers could be used as the 'innocent middlemen' to launch a DoS attack against another network or site.

SYN Attack/LAND Attack

SYN attacks exploit the TCP 'three-way handshake,' the process by which a communications session is established between two computers. Because TCP (unlike UDP) is connection-oriented, a session, or direct one-to-one communication link, must be created prior to sending data. The client computer initiates the communication with the server (the computer whose resources it wants to access).

The 'handshake' includes the following steps:

The client machine sends a SYN (synchronization request) segment.

The server sends an ACK message and a SYN, which acknowledges the client machine's request that was sent in step 1, and sends the client a synchronization request of its own. The client and server machines must synchronize each other's sequence numbers.

The client sends an ACK back to the server, acknowledging the server's request for synchronization. When both machines have acknowledged each other's requests, the handshake has been successfully completed and a connection is established between the two computers.

Figure 10.42 illustrates how the process works.

Figure 10.42: TCP Uses a 'Three-Way Handshake' to Establish a Connection between Client and Server

This is how the process normally works. A SYN attack uses this process to flood the system targeted as the victim of the attack with multiple SYN packets that have bad source IP addresses, which causes the system to respond with SYN/ACK messages. The problem comes in when the system, waiting for the ACK message from the client that normally comes in response to its SYN/ACK, puts the waiting SYN/ACK messages into a queue. This is a problem because the queue is limited in the number of messages it can handle. When it is full, all subsequent incoming SYN packets will be ignored. For a SYN/ACK to be removed from the queue, an ACK must be returned from the client, or the interval timer must run out and terminate the three-way handshake process.

Because the source IP addresses for the SYN packets sent by the attacker are no good, the ACKs that the server is waiting for never come. The queue stays full, and there is no room for valid SYN requests to be processed. Thus, service is denied to legitimate clients attempting to establish communications with the server.

The LAND attack is a variation on the SYN attack. In the LAND attack, instead of sending SYN packets with IP addresses that do not exist, the flood of SYN packets all have the same spoof IP address-that of the targeted computer.

The LAND attack can be prevented by filtering out incoming packets whose source IP addresses appear to be from computers on the internal network. ISA Server has preset intrusion detection functionality that allows you to detect attempted LAND attacks, and you can configure Alerts to notify you when such an attack is detected.

Ping of Death

Another type of DoS attack that ISA Server can be set to specifically detect is the so-called 'Ping of Death' (also known as the 'large packet ping'). The Ping of Death attack is launched by creating an IP packet larger than 65,536 bytes, which is the maximum allowed by the IP specification (this is sometimes referred to as a 'killer packet'). This can cause the target system to crash, hang, or reboot.

ISA allows you to specifically enable detection of Ping of Death attacks.

Teardrop

The Teardrop attack works a little differently from the Ping of Death, but with similar results. The Teardrop program creates IP fragments, which are pieces of an IP packet into which an original packet can be divided as it travels through the Internet. The problem is that the offset fields on these fragments, which are supposed to indicate the portion (in bytes) of the original packet that is contained in the fragment, overlap.

For example, normally two fragments' offset fields might appear as:

Fragment 1:  (offset) 100 - 300
Fragment 2:  (offset) 301 - 600

This indicates that the first fragment contains bytes 100 through 300 of the original packet, and the second fragment contains bytes 301 through 600.

Overlapping offset fields would appear something like this:

Fragment 1: (offset) 100 - 300
Fragment 2: (offset) 200 - 400

When the destination computer tries to reassemble these packets, it is unable to do so and may crash, hang, or reboot.

Variations include:

NewTear

Teardrop2

SynDrop

Boink

All of these programs generate some sort of fragment overlap.

Ping Flood (ICMP Flood)

The ping flood or ICMP flood is a means of tying up a specific client machine. It is caused by an attacker sending a large number of ping packets (ICMP echo request packets) to the Winsock or dialer software. This prevents it from responding to server ping activity requests, which causes the server to eventually time out the connection. A symptom of a ping flood is a huge amount of modem activity, as indicated by the modem lights. This is also referred to as a ping storm.

The fraggle attack is related to the ping storm. Using a spoofed IP address (which is the address of the targeted victim), an attacker sends ping packets to a subnet, causing all computers on the subnet to respond to the spoofed address and flood it with echo reply messages.

You can use programs such as NetXray or other IP tracing software to record and display a log of the flood packets. Firewalls can be configured to block ping packets, to prevent these attacks.

SMURF Attack

The Smurf attack is a form of 'brute force' attack that uses the same method as the ping flood, but directs the flood of ICMP echo request packets at the network's router. The destination address of the ping packets is the broadcast address of the network, which causes the router to broadcast the packet to every computer on the network or segment. This can result in a very large amount of network traffic if there are many host computers, which can create congestion that causes a denial of service to legitimate users.

In its most insidious form, the Smurf attacker spoofs the source IP address of ping packets. Then, both the network to which the packets are sent and the network of the spoofed source IP address will be overwhelmed with traffic. The network to which the spoofed source address belongs will be deluged with responses to the ping when all the hosts to which the ping was sent answer the echo request with an echo reply.

Smurf attacks can generally do more damage than some other forms of DoS, such as SYN floods. The SYN flood affects only the capability of other computers to establish a TCP connection to the flooded server, but a Smurf attack can bring an entire ISP down for minutes or hours. This is because a single attacker can easily send 40 to 50 ping packets per second, even using a slow modem connection. Because each is broadcast to every computer on the destination network, the number of responses per second is 40 to 50 times the number of computers on the network-which could be hundreds or thousands. This is enough data to congest even a T-1 link.

One way to prevent a Smurf attack from using your network as the broadcast target is to turn off the capability to transmit broadcast traffic on the router. Most routers allow you to do this. To prevent your network from being the victim of the spoofed IP address, you will need to configure your firewall to filter out incoming ping packets.

UDP Bomb or UDP Flood

An attacker can use the User Datagram Protocol (UDP) and one of several services that echo packets upon receipt to create service-denying network congestion by generating a flood of UDP packets between two target systems. For example, the UDP chargen service on the first computer, which is a testing tool that generates a series of characters for every packet that it receives, sends packets to another system's UDP echo service, which echoes every character it receives. By exploiting these testing tools, an endless flow of echoes goes back and forth between the two systems, congesting the network. This is sometimes called a UDP packet storm.

In addition to port 7, the echo port, an attacker can use port 17, the quote of the day service (quotd) or the daytime service on port 13. These services will also echo packets they receive. UDP chargen is on port 19.

Disabling unnecessary UDP services on each computer (especially those mentioned previously) or using a firewall to filter those ports/services will protect you from this type of attack.

UDP Snork Attack

The Snork attack is similar to the UDP bomb. It uses a UDP frame that has a source port of either 7 (echo) or 9 (chargen), with a destination port of 135 (Microsoft location service). The result is the same as the UDP bomb-a flood of unnecessary transmissions that can slow performance or crash the systems that are involved.

WinNuke (Windows Out-of-Band Attack)

The out-of-band (OOB) attack, sometimes called the Windows OOB bug, exploits a vulnerability in Microsoft networks,. The WinNuke program (and variations such as Sinnerz and Muerte) creates an out-of-band data transmission that crashes the machine to which it is sent. It works like this: A TCP/IP connection is established with the target IP address, using port 139 (the NetBIOS port). Then, the program sends data using a flag called MSG_OOB (or Urgent) in the packet header. This flag instructs the computer's Winsock to send data called out-of-band data. Upon receipt, the targeted Windows server expects a pointer to the position in the packet where the Urgent data ends, with normal data following. However, the OOB pointer in the packet created by WinNuke points to the end of the frame with no data following.

The Windows machine does not know how to handle this situation and will cease communicating on the network, and service will be denied to any users who subsequently attempt to communicate with it. A WinNuke attack usually requires a reboot of the affected system to reestablish network communications.

Windows 95 and NT 3.51 and 4.0 are vulnerable to the WinNuke exploit, unless the fixes provided by Microsoft have been installed. Windows 98/ME and Windows 2000/2003 are not vulnerable to WinNuke, but ISA Server allows you to enable detection of attempted OOB attacks.

Mail Bomb Attack

A mail bomb is a means of overwhelming a mail server, causing it to stop functioning and thus denying service to users. It is a relatively simple form of attack, accomplished by sending a massive quantity of e-mail to a specific user or system. There are programs available on hacking sites on the Internet that allow a user to easily launch a mail bomb attack, automatically sending floods of e-mail to a specified address while protecting the attacker's identity.

A variation on the mail bomb program automatically subscribes a targeted user to hundreds or thousands of high-volume Internet mailing lists, which will fill the user's mailbox and/or the mail server. Bombers call this list linking. Examples of these mail bomb programs include Unabomber, extreme Mail, Avalanche, and Kaboom.

The solution to repeated mail bomb attacks is to block traffic from the originating network using packet filters. Unfortunately, this does not work with list linking because the originator's address is obscured; the deluge of traffic comes from the mailing lists to which the victim has subscribed.

Scanning and Spoofing

The term scanner, in the context of network security, refers to a software program that is used by hackers to remotely determine what TCP/UDP ports are open on a given system, and thus vulnerable to attack. Scanners are also used by administrators to detect vulnerabilities in their own systems in order to correct them before an intruder finds them. Network diagnostic tools such as the famous Security Administrator's Tool for Analyzing Networks (SATAN), a UNIX utility, include sophisticated port scanning capabilities.

A good scanning program can locate a target computer on the Internet (one that is vulnerable to attack), determine what TCP/IP services are running on the machine, and probe those services for security weaknesses.

Many scanning programs are available as freeware on the Internet. An excellent resource for information about the history of scanning, how scanners work, and some popular scanning programs can be found at www.ladysharrow.ndirect.co.uk/Maximum%20Security/scanners.

Port Scan

Port scanning refers to a means of locating 'listening' TCP or UDP ports on a computer or router, and obtaining as much information as possible about the device from the listening ports. TCP and UDP services and applications use a number of well-known ports, which are widely published. The hacker uses his knowledge of these commonly used ports to extrapolate information.

For example, Telnet normally uses port 23. If the hacker finds that port open and listening, he knows that Telnet is probably enabled on the machine. He can then try to infiltrate the system; for example, by guessing the appropriate password in a brute-force attack.

DNS Attacks Detection and Prevention

The ISA firewall's DNS filter protects DNS servers published by the ISA firewall using Server Publishing Rules. You can access the configuration interface for the DNS filter's attack prevention configuration page in the Intrusion Detection dialog box. Expand the server name and then expand the Configuration node. Click the General node.

In the Details Pane, click the Enable Intrusion Detection and DNS Attack Detection link. In the Intrusion Detection dialog box, click the DNS Attacks tab. On the DNS Attacks tab, put a checkmark in the Enable detection and filtering of DNS attacks checkbox. (See Figure 10.43.)

Figure 10.43: The DNS Attacks Tab

Once detection is enabled, you can enable prevention, and protect yourself from three attacks:

DNS host name overflow

DNS length overflow

DNS zone transfer

The DNS host name overflow and DNS length overflow attacks are DNS DoS type attacks. The DNS DoS attack exploits the difference in size between a DNS query and a DNS response, in which all of the network's bandwidth is tied up by bogus DNS queries. The attacker uses the DNS servers as 'amplifiers' to multiply the DNS traffic.

The attacker begins by sending small DNS queries to each DNS server that contain the spoofed IP address (see IP Spoofing) of the intended victim. The responses returned to the small queries are much larger, so that if there are a large number of responses returned at the same time, the link will become congested and denial of service will take place.

One solution to this problem is for administrators to configure DNS servers to respond with a 'refused' response, which is much smaller than a name resolution response, when they receive DNS queries from suspicious or unexpected sources.

Detailed information for configuring DNS servers to prevent this problem is contained in the U.S. Department of Energy's Computer Incident Advisory Capability information bulletin J-063, available at http://www.ciac.org/ciac/bulletins/j-063.shtml.

IP Options and IP Fragment Filtering

You can configure what IP Options are allowed through the ISA firewall and whether IP Fragments are allowed through. Figures 10.44 and 10.45 show the configuration interfaces for IP Options filtering and IP Fragment filtering. Figure 10.46 shows a dialog box warning that enabling Fragment filtering may interfere with L2TP/IPSec and streaming media services.

Figure 10.44: The IP Options Tab

Figure 10.45: The IP Fragments Tab

Figure 10.46: The IP Fragment Filter Warning Dialog Box

For more information on fragment filtering, see the discussion on common network layer attacks earlier in this chapter.

Source Routing Attack

TCP/IP supports source routing, which is a means to permit the sender of network data to route the packets through a specific point on the network. There are two types of source routing:

Strict source routing The sender of the data can specify the exact route (rarely used).

Loose source record route (LSRR) The sender can specify certain routers (hops) through which the packet must pass.

The source route is an option in the IP header that allows the sender to override routing decisions that are normally made by the routers between the source and destination machines. Source routing is used by network administrators to map the network, or for troubleshooting routing and communications problems. It can also be used to force traffic through a route that will provide the best performance. Unfortunately, source routing can be exploited by hackers.

If the system allows source routing, an intruder can use it to reach private internal addresses on the LAN that normally would not be reachable from the Internet, by routing the traffic through another machine that is reachable from both the Internet and the internal machine.

Source routing can be disabled on most routers to prevent this type of attack. The ISA firewall also blocks source routing by default.