Datalink and Network Layer security threads

• Networking Basics
  • OSI model
  • Security at all levels and layers is needed
  • "When you connect to the internet, the internet connects back to you"
  • "Security is a system, and not a component"
  • "The hackers need to find one security hole. The network adminsitrators have to close all the holes"
  • "Know your network!"
• PPP
  • Basics и този линк
  • Protokoli za autentikaciq
    • PAP, S(hiva)PAP, MSCHAP v1 * - kripto-slabi
    • CHAP, MSCHAP v2 *, EAP-MD5 * - kripto-silni
    • EAP-TLS * - PKI baziran
  • Ataki i resheniq, za slabite protokoli
    • Obiknowenno podslushvane na parolata pri PAP
    • Ataki wyrhu crypto hashowete pri MSCHAP v1
    • Simple Hash playback pri SPAP
    • Reshenie: NE GI IZPOLZWAJTE
  • Ataki i resheniq, za silnite protokoli
    • Hash playback ataka wyrhu dvuposochno autentikiranite s silen protokol wryzki
    • Reshenie: software e dlyjen da zashtitawa ot tazi ataka, kato prowerqwa challenge stojnostta, nezawisimo ot towa izpolzwajte razlichni paroli w dwete posoki, kogato e wyzmojno
    • Tipichna situaciq: ednata strana se autentikira, no drugata ne se (primerno po naeta liniq)
    • Reshenie: Kogato w vyzmojno izpolzwajte dwuposochna autentikaciq
  • Kriptirane, MPPE
• Ethernet
  • Basics и този линк , също и този
  • Fizicheska sigurnost, MAC filtri -> 802.1x (EAP)
  • Sniffing on a switch?
    • MAC-flooding -> port security
    • ARP reply-any attack
    • Gratious ARP attack
    • Solutions: Now- PVLANs *, switch-based arp-cache (arp snooping), Later- DAI
  • VLAN Hopping -> software update-i, know your network, spazwaj preporykite na proizwoditelq
  • "Dynamic" VLANs insecurity -> use 802.1x instead
  • D(ynamic)T(trunking)P(rotocol) Attacks -> disable DTP na potrebitelskite portowe
  • VTP, GVRP Attacks -> authenticate, disable VLAN management protokol(ite)
  • 802.1ad (LACP), PAGP -> disable trunk management protocols
  • STP Attacks -> disable STP na potrebitelskite portowe, BPDU Filtering, BPDU Guard
  • Интересни връзки: "Secure use of VLANs: An @stake Security Assessment" *
• TCP/IP
  • Basics
  • NAT and connection tracking(statefull firewalling)
  • Multihomed hosts dilusions: достъп до един интерфейс на хост през другия
  • Spoofing -> (loose) uRPF, Administrative boundary filters RFC1918, RFC2827
  • Защо трябва да се пазим от spoofing част първа: Predictable IP (fragmentation) ID -> change your OS
  • Защо трябва да се пазим от spoofing част втора: Predictable TCP ISNs, link2, link 3 -> change your OS
  • Защо трябва да се пазим от spoofing част трета: DNS poisoning и DNS query id guessing -> Use securely-written DNS software
  • ICMP
    • ping/pong
    • "Time exceeded" (ttl expired in transit)
    • ICMP source quench
    • ICMP unreachables
      • Fragmentation Needed and Don't Fragment was Set (packet too big, can't fragment)
      • net/host/protocol/port
      • others
    • ICMP redirects
    • IRDP, timestamp req/rep, mask req/rep, information req/rep
    • others
  • Source routing -> disable
  • Classless, subnet zero -> enable, не са security риск, въпреки разпространяващите се слухове :)
  • Routing protocols: RIPv2, EIGRP, OSPF, IS-IS, BGP -> md5 authentication
  • HSRP, VRRP -> no real protection available (yet)!
• Network Management protocols
  • Introduction
  • telnet, tftp, ftp, snmp v<=2 -> use ssh, scp, sftp, snmpv3(!) instead
  • syslog -> no alternative!
  • ntp -> use authentication
  • cdp -> disable
• Wrap-up
  • Сигурността е система и процес, а не компонент
  • Познавайте мрежата си! И ползвайте услугите на производителите на мрежовите ви компоненти или security консултанти, те знаят може би най-добре.
  • Вземете мерки сега!
  • Компрометирането не един мрежов компонент работещ на OSI ниво X води до значително увеличаване на шансовете за успешни атаки върху нива по-големи и по-малки от X.
  • Insecure мрежа означава insecure приложения. И обратното. Insecure приложения означава insecure мрежа.
  • Препоръчителна литература: ВСИЧКИ линкове нагоре +
    • RFC1918 Address Allocation for Private Internets
    • RFC2827 Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
    • RFC3013 Recommended Internet Service Provider Security Services and Procedures *
    • RFC2644 Changing the Default for Directed Broadcasts in Routers *
    • RFC2196 Site Security Handbook
    • RFC2504 Users' Security Handbook
    • RFC2828 Internet Security Glosary
    • RFC2289 A One-Time Password System *
    • Cisco Systems: Introduction to Security technologies *
    • Cisco Systems: The SAFE White Papers *
    • Cisco Networkers 2002: SEC-200 Network Security: Risk and Threat model *
    • Cisco Networkers 2002: SEC-201 Network Security: Design and Attack Mitigation *
    • Cisco Networkers 2002: SEC-301 Surviving a DoS Attack *
    • SANS Institute resources *
    • IP Smart Spoofing *