Cryptography and
Network Security
Ref:Fourth Edition
by William Stallings
Lecture slides
Module 5
– Intruders
They agreed that Graham should set the test for
Charles Mabledene. It was neither more nor
less than that Dragon should get Stern's code. If
he had the 'in' at Utting which he claimed to
have this should be possible, only loyalty to
Moscow Centre would prevent it. If he got the
key to the code he would prove his loyalty to
London Central beyond a doubt.
—Talking to Strange Men, Ruth Rendell
Module 5: [09
hours]
WEB SECURITY: Requirements, Secure Socket Layer (SSL)
and Transport Layer Security (TLS), Secure Electronic
Transaction (SET), Intruders, Viruses and related threats.
FIREWALL: Firewall Design principles, Trusted Systems.
Intruders
significant issue for networked systems is hostile or
unwanted access
either via network or local
can identify classes of intruders:
masquerader
misfeasor
clandestine user
varying levels of competence
Intruders
clearly a growing publicized problem
from “Wily Hacker” in 1986/87
to clearly escalating CERT stats
may seem benign, but still cost resources
may use compromised system to launch other attacks
awareness of intruders has led to the development of
CERTs
Intrusion Techniques
aim to gain access and/or increase privileges on a
system
basic attack methodology
target acquisition and information gathering
initial access
privilege escalation
covering tracks
key goal often is to acquire passwords
so then exercise access rights of owner
Password Guessing
one of the most common attacks
attacker knows a login (from email/web page
etc)
then attempts to guess password for it
defaults, short passwords, common word searches
user info (variations on names, birthday, phone,
common words/interests)
exhaustively searching all possible passwords
check by login or against stolen password file
success depends on password chosen by user
surveys show many users choose poorly
Password Capture
another attack involves password capture
watching over shoulder as password is entered
using a trojan horse program to collect
monitoring an insecure network login
eg. telnet, FTP, web, email
extracting recorded info after successful login
(web history/cache, last number dialed etc)
using valid login/password can
impersonate user
users need to be educated to use suitable
precautions/countermeasures
Intrusion Detection
inevitably will have security failures
so need also to detect intrusions so can
block if detected quickly
act as deterrent
collect info to improve security
assume intruder will behave differently to a legitimate
user
but will have imperfect distinction between
Approaches to Intrusion
Detection
statistical anomaly detection
threshold
profile based
rule-based detection
anomaly
penetration identification
Audit Records
fundamental tool for intrusion detection
native audit records
part of all common multi-user O/S
already present for use
may not have info wanted in desired form
detection-specific audit records
created specifically to collect wanted info
at cost of additional overhead on system
Statistical Anomaly Detection
threshold detection
count occurrences of specific event over time
if exceed reasonable value assume intrusion
alone is a crude & ineffective detector
profile based
characterize past behavior of users
detect significant deviations from this
profile usually multi-parameter
Audit Record Analysis
foundation of statistical approaches
analyze records to get metrics over time
counter, gauge, interval timer, resource use
use various tests on these to determine if current
behavior is acceptable
mean & standard deviation, multivariate, markov process,
time series, operational
key advantage is no prior knowledge used
Rule-Based Intrusion
Detection
observe events on system & apply rules to decide if
activity is suspicious or not
rule-based anomaly detection
analyze historical audit records to identify usage patterns
& auto-generate rules for them
then observe current behavior & match against rules to
see if conforms
like statistical anomaly detection does not require prior
knowledge of security flaws
Rule-Based Intrusion
Detection
rule-based penetration identification
uses expert systems technology
with rules identifying known penetration, weakness patterns, or suspicious
behavior
compare audit records or states against rules
rules usually machine & O/S specific
rules are generated by experts who interview & codify knowledge of security
admins
quality depends on how well this is done
Base-Rate Fallacy
practically an intrusion detection system needs to
detect a substantial percentage of intrusions with few
false alarms
if too few intrusions detected -> false security
if too many false alarms -> ignore / waste time
this is very hard to do
existing systems seem not to have a good record
Distributed Intrusion
Detection
traditional focus is on single systems
but typically have networked systems
more effective defense has these working together to
detect intrusions
issues
dealing with varying audit record formats
integrity & confidentiality of networked data
centralized or decentralized architecture
Distributed Intrusion
Detection - Architecture
Distributed Intrusion
Detection – Agent
Implementation
Honeypots
decoy systems to lure attackers
away from accessing critical systems
to collect information of their activities
to encourage attacker to stay on system so administrator can respond
are filled with fabricated information
instrumented to collect detailed information on attackers activities
single or multiple networked systems
cf IETF Intrusion Detection WG standards
Password Management
front-line defense against intruders
users supply both:
login – determines privileges of that user
password – to identify them
passwords often stored encrypted
Unix uses multiple DES (variant with salt)
more recent systems use crypto hash function
should protect password file on system
Password Studies
Purdue 1992 - many short passwords
Klein 1990 - many guessable passwords
conclusion is that users choose poor passwords too often
need some approach to counter this
Managing Passwords -
Education
can use policies and good user education
educate on importance of good passwords
give guidelines for good passwords
minimum length (>6)
require a mix of upper & lower case letters, numbers,
punctuation
not dictionary words
but likely to be ignored by many users
Managing Passwords -
Computer Generated
let computer create passwords
if random likely not memorisable, so will be written
down (sticky label syndrome)
even pronounceable not remembered
have history of poor user acceptance
FIPS PUB 181 one of best generators
has both description & sample code
generates words from concatenating random
pronounceable syllables
Managing Passwords -
Reactive
Checking
reactively run password guessing tools
note that good dictionaries exist for almost any language/interest group
cracked passwords are disabled
but is resource intensive
bad passwords are vulnerable till found
Managing Passwords -
Proactive Checking
most promising approach to improving password security
allow users to select own password
but have system verify it is acceptable
simple rule enforcement (see earlier slide)
compare against dictionary of bad passwords
use algorithmic (markov model or bloom filter) to detect
poor choices
Summary
have considered:
problem of intrusion
intrusion detection (statistical & rule-based)
password management
