IT Infrastrucutre Security
Download as PPTX, PDF0 likes637 views
The document discusses various information security threats and countermeasures across infrastructure, systems, databases, and networks. It describes threats like viruses, worms, Trojans, SQL injection, and denial of service attacks. It also explains associated countermeasures like firewalls, intrusion detection, input validation, log monitoring, and defense in depth.
IT Infrastrucutre Security
- 2. Agenda o Basics – Information Security o Infra Security Threats o Systems Threats & Countermeasures o Database Threats & Countermeasures o Network Threats & Countermeasures o Layered defense o Questions
- 3. Basics – Information Security Information Information Information architecture classification assets Data lifecycle Private People Data flow Public Process Data storage Confidential Technology
- 4. Infra - Security Threats virus: A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Trojan Horse: A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves worm: A program or algorithm that replicates itself over a computer network and usually performs malicious actions
- 5. Infra- Security Threats - Contd Adware is considered a legitimate alternative offered to consumers who do not wish to pay for software. Spyware is considered a malicious program and is similar to a Trojan horse in that users unwittingly install the product when they install something else. Adware is considered a legitimate alternative offered to consumers who do not wish to pay for software. Programs, games or utilities can be designed and distributed as freeware Malware is short form of malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behaviour. root kit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications.
- 6. System Threats & Countermeasures SMB relay – MITM FTP bouncing DNS Cache Poisoning Insider threat – Windows environment
- 7. SMB Relay Attack - Explained A SMB Relay attack is a type of man-in-the-middle attack where the attacker asks the victim to authenticate to a machine controlled by the attacker, then relays the credentials to the target. The attacker forwards the authentication information both ways, giving him access. Here are the players in this scenario •The attacker is the person trying to break into the target •The victim is the person who has the credentials •The target is the system the attacker wants access to, and that the victim has credentials for And here’s the scenario (see the image at the right for a diagram): 1.Attacker tricks the victim into connecting to him 2.Attacker establishes connection to the target, receives the Counter Measures 8-byte challenge 3.Attacker sends the 8-byte challenge to victim • Preventive : Signed SMBs (NTLM V2) 4.Victim responds to the attacker with the password hash 5.Attacker responds to the target’s challenge with the • Detective : Log monitoring – TCP victim’s hash 139 445 transactions 6.Target grants access to attacker • Compensative : Layered defence
- 8. FTP Bouncing - Explained An open port completes the transfer over the specified connection 1. It is a fact that printers are usually installed with all the settings by default. This includes having the A closed port will result with the FTP server informing the default administration password (if any), default source station that the FTP server can't build the connection administrative interfaces enabled, default services running, default SNMP community string, etc. 2. It is interesting to note that some printers run an anonymous FTP server that users (and processes) can use to print documents. A user can upload a document to the FTP server running on the printer and it will be printed. Things get worse when you discover that the FTP server supports the PORT Counter Measures command. 3. The PORT command is sent by the FTP client to • Preventive : Deny FTP establish a secondary channel for data to travel over. Passive, Avoid FTP arbitrary connections. This command can be abused by attacker to network • Detective : IDS Log monitoring scan other hosts on your network, as shown in the • Compensative : Layered defense next
- 9. DNS Cache Poisoning DNS cache poisoning is a maliciously created or unintended situation that provides data to a Domain Name Server that did not originate from authoritative DNS sources
- 10. DNS Cache Poisoning - Explained 1. A request is sent to the authoritative server for companyA.com. This is identical to the standard process for an iterative query – with one exception. 2. A cracker has decided to poison the internal DNS server‘s cache. In order to intercept a query and return malicious information, the cracker must know the transaction ID. Once the transaction ID is known, the attacker‘s DNS server can respond as the authoritative server for companyA.com. Although this would be a simple matter with older DNS software (e.g. BIND 4 and earlier), newer DNS systems have built-in safeguards. In our example, the transaction ID used to identify each query instance is randomized. But figuring out the transaction ID is not impossible. 3. All that‘s required is time. To slow the response of the real authoritative server, cracker uses a botnet to initiate a Denial of Service (DoS) attack. While the authoritative Counter Measures server struggles to deal with the attack, the attacker‘s DNS server has time to determine the transaction ID. 4. Once the ID is determined, a query response is sent to the • Preventive : Latest version of internal DNS server. But the IP address for DNS software BIND 9.3 Win 2003, DNSSEC farpoint.companyA.com in the response is actually the IP • Detective : IDS log analysis address of the attacker‘s site. The response is placed into • Compensative : Layered defense the server‘s cache
- 11. Insider Threat – Unpatched application
- 12. Insider Threat – Backdoor & Password crack
- 13. Insider Threat – Misuse of Admin privilege Counter Measures • Preventive : Proper Patch updates , Least user privilege, Role based access. • Detective : IDS ,File integrity monitors • Compensative : Layered defense
- 14. Database Threats & Countermeasures Disparate Attack vectors SQL Injection XSS Cross Site Scripting Buffer Overflow Top 5 Process Gaps
- 15. Database Attack Vectors & Vulnerabilities
- 16. SQL Injection – Attack Explained 1. SQL Injection is an attack method that targets the data residing in a database through the firewall that shields it. 2. It attempts to modify the parameters of a Web-based application in order to alter the SQL statements that are parsed to retrieve data from the database. 3. Enter the string as both user name and password in the frame on the right. This should get you logged in as a user (jake happens to be the first user in the table). This tells you that Jake is a user and it allows you to access his account. Privilege Escalation using SQL injection The GRANTEE parameter used in procedures of SYS.DBMS_STREAMS_AUTH PL/SQL Package is vulnerable to SQL injection. Exploitation of this vulnerability allows an attacker to execute arbitrary PL/SQL under the elevated privileges of the SYS user Counter Measures • Preventive : Input Validation/ Proper Patch management • Detective : Audit log monitoring of high privilege grants • Compensative : Layered defence
- 17. XSS – Cross Site Scripting Basics Counter Measures • Preventive : HTTP Post method, URL randomization • Detective : IDS • Compensative : Layered Defence
- 18. Buffer Overflow – Concept Explained Buffer overflow occurs when data is input or written beyond the allocated bounds of an buffer, array, or other object causing 1. SYS.OLAPIMPL_T.ODCITABLESTART Procedure in sys a program crash or a vulnerability that hackers might exploit. package with Execute privilege has Buffer Overflow in Oracle 9iR1 and 9iR2 2. EXECUTE privilege on DBMS_AQELM : Any Oracle database user with EXECUTE privilege on the package DBMS_AQELM can execute arbitrary code under the security context of the database server. 3. IBM Lotus Domino IMAP Cram-MD5 Buffer Overflow: It is prone to a remote buffer-overflow vulnerability because it fails to properly bounds- check user-supplied data before copying it to an insufficiently sized memory buffer. Counter Measures • Preventive : Input Validation/ Patch updates • Detective : Log monitoring • Compensative : Layered defence
- 19. Top 5 Database Security Process Gaps Poor Privilege management Poor Patch Management Lack of SOD Insecure communication protocol – TNS listener/DB links Lack of powerful grants audit trigger
- 20. Network Threats & Countermeasures Network Re-direction Arp-Cache poisoning Connection Hijacking SYN flooding Denial of Services Distributed Denial of Services
- 21. Network Re-direction 1. A port redirection attack is a trust exploitation-based attack that uses a compromised host to pass traffic through a firewall that the firewall would otherwise drop. 2. As an example the diagram ,shows a firewall with three interfaces: Inside, Outside, and DMZ, with Host A on the DMZ interface. A host located on the outside interface can reach Host A, but cannot reach the host on the inside, Host B. Host A can reach both the host on the outside and Host B. 3. If a hacker can compromise Host A, the hacker can install software on the DMZ host that redirects traffic from the outside host directly to the inside host (Host B). Although neither communication violates the rules implemented in the firewall, the outside host now has connectivity to the inside host through the port redirection process on the DMZ host Counter Measures • Preventive : HIPS, Proper Trust model and restricted services • Detective : Log monitoring • Compensative : Layered defence
- 22. ARP - Poisoning 1. In normal operation the computers on the LAN use ARP protocol to acquire and memorize each other's NIC MAC address which they use for sending network data to each other. 2. But the ARP protocol provides no protection against misuse. An attacking computer on the same LAN can simply send spoofed ARP Replies to any other computers, telling them that its MAC address should receive the traffic bound for other IP addresses. 3. This "ARP Cache Poisoning" can be used to Counter Measures redirect traffic throughout the LAN, allowing any malicious computer to insert itself into the • Preventive : Use Static IP entries communications stream between any other computers for the purpose of monitoring and even using batch script during login alter the data flowing across the LAN. • Detective : Arp inspection • Compensative : Layered defense
- 23. Connection Hijacking 1. The attacker examines the traffic flows with a network monitor and notices traffic from Employee X to a web server. 2. The web server returns or echoes data back to the origination station (Employee X). 3. Employee X acknowledges the packet. 4. The cracker launches a spoofed packet to the server. 5. The web server responds to the cracker. The cracker starts verifying SEQ/ACK numbers to double-check success. At this time, the cracker takes over the session from Employee X, which results in a session hanging for Employee X. 6. The cracker can start sending traffic to the web server. 7. The web server returns the requested data to confirm delivery with the correct ACK number. Counter Measures 8. The cracker can continue to send data (keeping track of the correct SEQ/ACK numbers) until eventually setting the FIN flag to terminate the • Preventive : Anti-Spoofing connection. • Detective : Log monitoring • Compensative : Layered defense
- 24. Syn - Flooding Counter Measures • Preventive : Effective Ingress filters. • Detective : IDS • Compensative : Layered defense
- 25. DOS & DDOS A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users Counter Measures • Preventive : Threshold/Rate limiting/Peak flow • Detective : IDS/SIEM • Compensative : HA/Load balancers
- 26. Layered defense Infrastrucre Layers of Defense Security Tools Network • RSA enVision • Multi Vendor Firewall • Arc Sight • Intrusion Detection System • Log Logic • Monitoring & Management • Log Review • McAfee Suite • Symantec Suite • Trend Micro • CIS – Bench Mark Audit tools System • Computing Environments • WebSense • Server Build Check • Blue Coat • Log Reviews • Tipping Point • FoundStone • Qualysguard Desktop/End Point • AppScan • Desktop Applications • End point Security User Access • User Access Requests • Multiple Applications • Diversified Technology - 26 -