Transcript document
Portscans Jonathon Giffin [email protected] April 25, 2001 In This Talk... Why scan? Anatomy of a portscan Methods Classical detection methods Statistical packet anomaly detection Responding to a portscan Q&[maybe]A 2 Why Portscan: Black Hats Locate exploitable machines Say, FTP Servers: cecil.cs.wisc.edu bobby.cs.wisc.edu ross.cs.wisc.edu joyce.cs.wisc.edu (128.105.175.17): (128.105.175.18): (128.105.175.19): (128.105.175.20): open closed closed open Fingerprint operating systems 3 Administrators Monitor services running on own networks Test security policies 4 Anatomy of a Portscan Scan footprint Set of IPs and ports scanned Defines attacker’s information gathering requirements Horizontal scan Scan same port across multiple machines Idea: attacker has an exploit for this particular service 5 Scan Footprint Vertical scan Scan multiple ports on a single machine Idea: looking for vulnerable services on a specific machine e3-16.foundry2.cs.wisc.edu (128.105.100.247): 23/tcp open telnet 25/tcp filtered smtp 111/tcp filtered sunrpc 515/tcp filtered printer 6 Scan Footprint Block scan Host cygnet cilantro xena bodik-soho salsa bobby 21 telnet open open open closed open closed 22 ssh open open open closed open closed 23 ftp open open open closed open closed 7 Anatomy of a Portscan Scan script Method of carrying out scan Defines how a given footprint will be scanned Footprint and script together compose a portscan 8 Methods Scan tools available Nmap http://www.insecure.org/nmap/ Portscans, OS fingerprinting QueSO http://apostols.org/projectz/queso/ OS fingerprinting 9 Ping Scan Reveals network topology Host krishna.cs.wisc.edu (128.105.175.45) appears to be up. Host ursula.cs.wisc.edu (128.105.175.51) appears to be up. Host antipholus.cs.wisc.edu (128.105.175.111) appears to be up. Host ferdinand.cs.wisc.edu (128.105.175.112) appears to be up. Host wonderwoman.cs.wisc.edu (128.105.175.113) appears to be up. Host thugbert.cs.wisc.edu (128.105.175.114) appears to be up. Host paneer.cs.wisc.edu (128.105.175.115) appears to be up. Host coral.cs.wisc.edu (128.105.175.116) appears to be up. Host crow.cs.wisc.edu (128.105.175.118) appears to be up. Host chef.cs.wisc.edu (128.105.175.120) appears to be up. 10 UDP Scan Send any data to UDP port Receive ICMP port unreachable: port closed No response: port open or blocked 11 Vanilla SYN Scan Client Server socket connect SYN socket bind listen accept SYNACK connect returns close ACK FIN accept returns 12 Vanilla SYN Scan crash10.cs.wisc.edu.42977 > malakai.cs.wisc.edu.telnet: S malakai.cs.wisc.edu.telnet > crash10.cs.wisc.edu.42977: S ack crash10.cs.wisc.edu.42977 > malakai.cs.wisc.edu.telnet: . ack crash10.cs.wisc.edu.42977 > malakai.cs.wisc.edu.41212: F Defense Log completed connections that are immediately closed 13 Half-Open SYN Scan Client Server raw socket bind constructed packet SYN socket bind listen accept SYNACK constructed packet RES 14 Half-Open SYN Scan crash10.cs.wisc.edu.42977 > malakai.cs.wisc.edu.telnet: S malakai.cs.wisc.edu.telnet > crash10.cs.wisc.edu.42977: S ack crash10.cs.wisc.edu.42977 > malakai.cs.wisc.edu.telnet: R Defense Log all SYN packets received 15 Stealth Scans Attempt to avoid server logging Send invalid TCP packets SYNFIN scan XMAS scan FIN scan Windows avoids this scan because its stack is broken (surprise) Null scan 16 FTP Bounce Scan RFC 959 defines FTP proxy Run portscan via an FTP proxy 17 Other Possibilities RFC 1413 defines ident protocol Find services running as root crash10.cs.wisc.edu: Port State Service 23/tcp open telnet 25/tcp open smtp 79/tcp open finger 80/tcp open http 111/tcp open sunrpc 113/tcp open auth Owner root root root apache rpc nobody 18 Other Possibilities Insert decoy scans microsoft.com.54177 > malakai.cs.wisc.edu.352: S malakai.cs.wisc.edu.660 > crash10.cs.wisc.edu.54177: R crash10.cs.wisc.edu.54177 > malakai.cs.wisc.edu.128: S 19 OS Fingerprinting Identification of the operating system running on a remote machine Different kernels perform differently TCP options Initial sequence number ICMP error messages IP fragment overlap 20 OS Fingerprinting Machine www pub-nt2 malakai e3-16.foundry2 dns crash8 crash10 crash12 Operating System Solaris 2.6-2.7, Solaris 7 WinNT4 / Win95 / Win98 Linux 2.1.122 - 2.2.14 No OS Match Solaris 2.6-2.7, Solaris 7 Linux 2.1.122 - 2.2.14 Linux 2.1.122 - 2.2.14 No OS Match openbsd.org Solaris 2.6 21 Classical Detection N events in time M Typically measure hits on closed ports Slow scan down to avoid detection Heuristics Hits on empty IP addresses 22 Statistical Packet Anomaly Detection Stuart Staniford, James Hoagland, and Joseph McAlerny of Silicon Defense “Practical Automated Detection of Stealthy Portscans” Conjecture Traffic patterns characteristic of portscans have low rates of occurrence 23 Statistical Packet Anomaly Detection Layer 2 Anomaly correlation engine Layer 1 Anomaly detection engine Layer 0 Packet collection; Probability table construction 24 Layer 0 Build characteristic of expected traffic Packet collection Filtering Probability table construction Using header features, store probability of any given packet entering the network Adapt probabilities to changing network use 25 Layer 1 Anomaly detection Rate the anomalousness of each incoming packet Pass any packet with anomalousness above an anomaly threshold to the correlator 26 Layer 2 Anomaly correlation Reconstruct portscans from anomalous traffic Find clusters of similar packets 27 Data Flows Alarms Anomaly correlation engine Anomaly detection engine Incoming packets Packet collection Prob table construction 28 Implementation Packet collection Restricting to SYN packets Probability tables Relevant header fields Joint probabilities Bayes’ Net 29 Mutual Entropy 4.9 million SYN packets incoming to CS networks H( H( H( H( H( H( H( H( H( H( H( DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr DestAddr ): | SrcAddr ): | DestPort ): | SrcAddr, DestPort ): | SrcPort ): | SrcAddr, SrcPort ): | DestPort, SrcPort ): | Time ): | SrcAddr, Time ): | DestPort, Time ): | SrcPort, Time ): 6.927819 2.091069 4.064494 1.274497 4.631317 1.075178 2.580522 5.348499 0.862256 1.540623 1.508940 30 Bayes’ Net DestPort SrcPort Timestamp SrcIP DestIP 31 Anomaly Detection Engine Staniford’s model: packets in isolation Experiment: N size window p1 Given packets pi , i [1, N ]: pN N Anomaly ( window) log prob ( pi ) i 1 32 Anomaly Correlation Engine Staniford’s algorithm: bond graph ad hoc clustering method s( p1 , p2 ) c1h1 ( p1 , p2 ) c j h j ( p1 , p2 ) Experiment: use established clustering algorithms 33 Field Relationships in a Vertical Scan Example 128.105.175.29:3776 > 128.105.175.29:3777 > 128.105.175.29:3778 > 128.105.175.29:3779 > 128.105.175.29:3780 > 128.105.175.29:3781 > 128.105.175.29:3782 > 128.105.175.29:3783 > 128.105.175.29:3784 > 128.105.175.29:3785 > 128.105.175.29:3786 > 146.151.62.116:224,TCP 146.151.62.116:662,TCP 146.151.62.116:768,TCP 146.151.62.116:789,TCP 146.151.62.116:2016,TCP 146.151.62.116:194,TCP 146.151.62.116:6009,TCP 146.151.62.116:570,TCP 146.151.62.116:493,TCP 146.151.62.116:1393,TCP 146.151.62.116:1007,TCP 34 Open Questions Data set size necessary to establish traffic characteristic Relevant header fields Manner of measuring probability Threshold values Malleability of traffic characteristic Packet types captured 35 Advantages of Statistical Packet Anomaly Detection Adaptive to changing network topology Encompasses classical detection methods Useful beyond port scans 36 Disadvantages Learning curve may be slow Anomalous packets skew expected traffic characteristic Does not evaluate payload Few relevant header fields Correlator must handle many false positives 37 Responding to a Port Scan What is appropriate action? No legal recourse Block at firewall? Set up for DoS: microsoft.com > malakai.cs.wisc.edu: icmp: echo request Log for later legal purposes? Tighten network security? 38 Recap Purposes Exploration of remote services OS fingerprinting Port scans have evolved to counter detection methods Classical detection methods inadequate Statistical packet anomaly detection offers an adaptive scan identifier 39 Questions? Maybe I’ll know the answer But hey, I do know slides are posted at http://www.cs.wisc.edu/~giffin 40 References Fyodor. “The Art of Port Scanning.” Phrack 51, volume 7. September 1, 1997. Fyodor. “Remote OS detection via TCP/IP Stack Fingerprinting.” Phrack 54, volume 8. December 25, 1998. Maimon, Uriel. “Port Scanning Without the SYN Flag.” Phrack 49, volume 7. Man pages, nmap. Solar Designer. “Designing and Attacking Port Scan Detection Tools.” Phrack 53, volume 8. July 8, 1998. Staniford, Stuart, James A. Hoagland, Joseph M. McAlerny. “Practical Automated Detection of Stealthy Portscans.” 41