Adatbiztonság a gazaságinformatikában

Átírás

1 Adatbiztonság a gazaságinformatikában Assessment, terms, info gathering szeptember 30. Budapest Dr. Bencsáth Boldizsár adjunktus BME Híradástechnikai Tanszék bencsath@crysys.hit.bme.hu

2 1. Security stakeholders Security chief (CIO, etc.) Owners/managers Employees Internet Service Provider Contracted professionals (security product vendors, ethical hackers, etc.) Auditors Outsider attackers Everybody has a different goal Everybody has different permissions, possibilities Something working in the classroom might not work in reallife 2

3 Attackers Internal attackers Script kiddies Internet-wide scans (botnets, worms, etc.) Targeted attackers (with low budget) Professional targeted attackers (high budget) Differences: What tools can they use (budget, knowledge) What time constraint they have How much computing, network resources they have How targeted is the attack What (how deep, sophisticated) is the main goal of an attack (e.g. just have a proxy -> ransom, multi-million dollar theft, obtaining millions of credit cards) 3

4 Point-of-View of the attacker The attacker focuses on errors rather than what is working Tries to find the weakest point Finds new ways to attack This is why security testing, audits are important! If You learned security, You can avoid typical errors However, It is hard to identify system-wide problems at the first glance, during a large-scale development And nobody has enough time to do everything in a secure fashion It is not impossible to do security testing against Your own work just take a different hat and a bit different thinking, 4

5 Network vulnerability scanners Target: A system, IP range, etc. Goal: To find vulnerable software components of the target in a fast and efficient way: Test against ten thousands of vulnerabilities in seconds Working method: Scans target for services identifies software version Performs basic tests to find out vulnerable services (e.g. is anonymous ftp login enabled?) Generally uses a number of active plugins to test target service against known vulnerabilities Uses a database that contains vulnerable software version numbers -> only matching this to the identified software version might result in large number of false positives Generally a lot more is incorporated (login support, password trial for weak pw., fuzzing tests, etc.) 5

6 Problems and advantages of vulnerability scanners Problems Limited availability of free tools (Nessus: free, open source to closed source, limited free version) Vulnerability databases have to be kept updated Knowledge might be needed on the OS, Services to have accurate results (to avoid false positives) Attacks against custom settings, tools, software components is generally missing Generally, no new attack or system-wide vulnerability can be found The human knowledge is still needed Advantages Automatic running, fast scanning of multiple hosts against thousands of vulnerabilities Good looking automatic reports as audit material Most of the internet-wide scanning attacks can be prevented (those attackers also use standard attacks, databases) 6

7 Nessus installation 1. Downloading and installing Nessus VIDEO nessus_inst1.avi 02: Installing Nessus plugins, activation VIDEO nessus_inst2.avi 03:47 7

8 Further videos on nessus 1. Nessus Scanning preparation, test1 VIDEO nessus_test1.avi 02:34 2. First results VIDEO nessus_test1_results.avi 03:47 3. Results in HTML LINK nessus_test1_results.html 4. Nessus Webscan 1 Video nessus_crysys_webscan_start.avi 01:38 5. Nessus Webscan result 1 Video nessus_crysys_webscan_results.avi 02:05 8

9 Security through obscurity Security through obscurity (!!! There s a long-long debate about that!!!) = we don t even tell how the system/configuration/software looks like, someone thinks that hiding information makes the system secure. Harder to find bugs Insider information -> higher risk to find flaws as the system is not yet known for most of the experts Obscurity is just a tool to have more time to solve problems Time is crucial for the system administrator but not on the global level E.g traditional locks are all about time not about absolute protection However, Obscurity might hide problems that ought to be solved Audits can help to find out problems even if security-through-obscurity mechanisms are in use Hiding unnecessary information is a general tool of protection, but in fact, it is security through obscurity 9

10 DNS as information source 1 basic query [2010-noDNSSec] boldi@hbgyak:~$ dig crysys.hu ; <<>> DiG P3 <<>> crysys.hu ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6960 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN A ;; ANSWER SECTION: crysys.hu IN A ;; Query time: 33 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:04: ;; MSG SIZE rcvd: 43 10

11 DNS get the MX record for mails dig crysys.hu in mx ; <<>> DiG P3 <<>> crysys.hu in mx ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN MX ;; ANSWER SECTION: crysys.hu IN MX 50 eternal.datacontact.hu. crysys.hu IN MX 10 shamir.crysys.hu. ;; Query time: 32 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:04: ;; MSG SIZE rcvd: 86 11

12 Getting list of DNS servers dig crysys.hu in ns ; <<>> DiG P3 <<>> crysys.hu in ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN NS ;; ANSWER SECTION: crysys.hu IN NS ns1.crysys.dc.hu. crysys.hu IN NS ns2.crysys.dc.hu. ;; Query time: 42 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:09: ;; MSG SIZE rcvd: 73 12

13 So?? DNS servers give the basic information about what servers are we connecting to The attacker will do these firsts steps as well Of course, sometimes this is not interesting But the attacker can learn which hosts are in duty for specific means (MX,NS,WEB, etc.) Multiple adresses might be used for a service (round-robin hosts for Web, multiple DNS servers (round-robin), MX records (priority based list + RR) Not to much to gain, but much to loose if You avoid to check this. 13

14 Finding out bind version information dig txt ch ; <<>> DiG P3 <<>> txt ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;version.bind. CH TXT ;; ANSWER SECTION: version.bind. 0 CH TXT "4.9.3-P1-plus-CA patches" 14

15 The named version of BME DNS server dig txt ch ; <<>> DiG P3 <<>> txt ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;version.bind. CH TXT ;; ANSWER SECTION: version.bind. 0 CH TXT "9.5.1-P3" ;; AUTHORITY SECTION: version.bind. 0 CH NS version.bind. 15

16 Version.bind So You can check the version of bind But You cannot be sure it is not faked As sysadmin, You might want to set this to something fake That will be security-through-obscurity But If You are lazy to upgrade whenever it is needed- at least, fake the version info 16

17 Zone transfer if allowed dig in axfr ; <<>> DiG P3 <<>> in axfr ;; global options: printcmd crysys.hu IN SOA ns1.crysys.dc.hu. netadmin.ns1.crysys.dc.hu crysys.hu IN NS ns1.crysys.dc.hu. crysys.hu IN NS ns2.crysys.dc.hu. crysys.hu IN A crysys.hu IN MX 10 shamir.crysys.hu. crysys.hu IN MX 50 eternal.datacontact.hu. crysys.hu IN TXT "Datacontact - your nameserver..." aggregator.crysys.hu IN A albifrons.crysys.hu IN A clamav.crysys.hu IN A cypio.crysys.hu IN A db.crysys.hu IN A deserecprj.crysys.hu IN A deserecvclt1.crysys.hu IN A deserecvclt2.crysys.hu IN A deserecvhost1.crysys.hu IN A deserecvirtclt1.crysys.hu IN A deserecvirtclt2.crysys.hu IN A

18 Zone transfer authorization dig in axfr ; <<>> DiG P1 <<>> in axfr ;; global options: printcmd ; Transfer failed. Limiting zone transfer in named.conf: allow-transfer { ; ; ) 18

19 Setting fake bind version in named.conf more $ more /etc/bind/named.conf /* sample configuration file for BIND 8.1 or later * should be installed as /etc/named.conf * * Author: Florian La Roche */ # # overall options of the server # options { version "4.9.3-P1-plus-CA patches"; 19

20 whois OrgName: RIPE Network Coordination Centre OrgID: RIPE Address: P.O. Box City: Amsterdam StateProv: PostalCode: 1001EB Country: NL ReferralServer: whois://whois.ripe.net:43 NetRange: CIDR: /16 NetName: RIPE-ERX NetHandle: NET Parent: NET NetType: Early Registrations, Transferred to RIPE NCC Comment: These addresses have been further assigned to users in Comment: the RIPE NCC region. Contact information can be found in Comment: the RIPE database at RegDate: Updated:

21 inetnum: netname: BMENET descr: Budapest University of Technology and Economics descr: Budapesti Muszaki es Gazdasagtudomanyi Egyetem country: HU org: ORG-BME1-RIPE admin-c: GR1029-RIPE tech-c: IOS2-RIPE tech-c: GOYA-RIPE tech-c: THU-RIPE remarks: rev-srv: nic.bme.hu remarks: rev-srv: ns.bme.hu status: ASSIGNED PI mnt-by: AS2547-MNT source: RIPE # Filtered remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/

22 DNS AXFR AXFR is a zone transfer, that means, a DNS server copies all available data in a specific zone to another DNS server (the secondary downloads all data to be served). Anyone, who can download zone transfer data knows all the hosts, or subdomains that are defined in the zone E.g. all.ca domain entries could be downloaded by AXFR Why is it a problem? E.g. info@domain.hu type spams. Spammer can easily collect a list Is it a problem? Hard to answer see above S.b.Obscurity. 22

23 Whois Whois is a general internet-wide database protocol It is typically used for IP address look, DNS owner look At many places it is no longer used directly for.hu it is redirected to web-based service (who know how ethical it is) 23

24 24

25 25

26 2011 domain: bme.hu domain-használó: Budapest University of Technology and Economics domain-használó: Budapesti Muszaki és Gazdaságtudományi Egyetem cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hun-id: admin-kontakt: tech-kontakt: zone-kontakt: névszerver: nic.bme.hu[ ] névszerver: ns2.pantel.net névszerver: ns.bme.hu[ ] regisztrálva: :24:46 módosítva: :28:56 regisztrátor: admin-kontakt: Remzső Gábor cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hun-id:

27 tech-kontakt: BMENET hostmaster cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hostmaster@bme.hu hun-id: zone-kontakt: DNS Admin HUNGARNET cím: Pf. 498 cím: 1396 Budapest 62 cím: HU telefon: dns-admin@hungarnet.hu telefax: hun-id: regisztrátor: HUNGARNET Association regisztrátor: HUNGARNET Egyesület (Registrar) cím: Victor Hugo u cím: H-1132 Budapest cím: HU telefon: telefax: hun-id:

28 2010 record (archive) person: Gabor Remzso address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: GR1029-RIPE org: ORG-BME1-RIPE mnt-by: AS2547-MNT source: RIPE # Filtered person: Istvan Ostrosits address: Invitel address: Puskas Tivadar u address: H-2040 Budaors address: Hungary phone: nic-hdl: IOS2-RIPE source: RIPE # Filtered 28

29 2010 record /2 person: Andras Jako address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: GOYA-RIPE org: ORG-BME1-RIPE source: RIPE # Filtered person: Imre Simon address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: THU-RIPE source: RIPE # Filtered 29

30 2010 record /3 % Information related to ' /16AS2547' route: /16 descr: BMENET org: ORG-BME1-RIPE origin: AS2547 mnt-by: AS2547-MNT source: RIPE # Filtered organisation: ORG-BME1-RIPE org-name: BME remarks: Budapest University of Technology and Economics remarks: Budapesti Muszaki es Gazdasagtudomanyi Egyetem org-type: OTHER address: Muegyetem rkp. 9. H-1111 Budapest Hungary phone: fax-no: remarks: ========================================================= abus box: abuse@bme.hu remarks: remarks: Reporting guidelines can be found at Reports not conforming to these guidelines may be discarded silently. Thanks for your cooperation. remarks:

31 2010 record /4 remarks: Bejelentest kerjuk az alabbiak szerint tegyen: Az itt leirtaknak meg nem felelo bejelentesekkel nem all modunkban foglalkozni. Koszonjuk szives egyuttmukodeset! remarks: ========================================================= mnt-ref: AS2547-MNT mnt-by: AS2547-MNT source: RIPE # Filtered 31

32 Kérdések? KÖSZÖNÖM A FIGYELMET! Dr. Bencsáth Boldizsár adjunktus BME Híradástechnikai Tanszék bencsath@crysys.hit.bme.hu 32