ATM Security Draft 12 28 December 2001 Why

ATM Security Draft 12/28 December 2001

Why I chose this topic • We find that many people believe that ATM is intrinsically secure. Current wisdom says: – ATM’s high speed makes it impossible to extract data. – ATM uses optical fibre and you can’t tap an optical circuit. • Not so - there are many things a bad guy can do and you can buy the kit to tap an optical line for about $2, 000. Securing e-business

Agenda for the presentation • ATM - a recap • Security issues affecting ATM • Securing ATM connections Securing e-business

ATM - Recap Securing e-business

ATM Technology One International Standard Both LAN and WAN Technology St an Ba dard se s d n le i lab ce Sca stan Di Qo. S ple ulti s M e ries Typ ar ffic C a Tr Voice/Data/Video Sc ala Sp ble ee in d Mb Securing e-business Gb A

ATM Concepts • Negotiated Service Connection – End-to-end connections, called virtual circuits – Traffic contract • Switched Based – Dedicated capacity • Cell Based – Small, fixed length Securing e-business A

Quality of Service is important Q o S We will accept jerky video but not jerky voice so for mixed mode traffic ATM is a key solution. Data Video Audio Securing e-business

The ATM Cell Header Payload 5 Bytes 48 Bytes • Small Size – 5 Byte Header – 48 Byte Payload • Fixed Size means buffers can be fixed and switches faster • Header contains virtual circuit information • Payload can be voice, video or other data types Securing e-business A

ATM System Architecture Adaptation Layer ATM Layer Forward Cell Through Conversion to Network ATM Data Types, 48 -Byte Length Add 5 -Byte Header Physical Layer Convert To Correct Electrical Or Optical Format Voice Cell Data Cell Video Cell Services Securing e-business A

ATM Adaptation Level AAL Types 1 Circuit Emulation -Constant Bit Rate (CBR) 2 Low Bit Rate Voice (Real Time) 48 Bytes -Variable Bit Rate (VBR) 3/4 5 Time Invariant Data “Simple” Data • Provides Mapping Of Applications To ATM Service Of The Same Type • Segments/Reassembles Into 48 Byte Payloads • Hands 48 Byte Payloads To ATM Layer Securing e-business A

ATM Layer 48 -Byte Payloads From AAL 5 -Byte Header } 53 -Byte Cell To Physical Layer Header Contains Virtual Path and Channel Identifiers • Adds/Removes Header To 48 Byte Payload • Header Contains Connection Identifier • Multiplexes 53 Byte Cells Into Virtual Connections • Sequential Delivery Within A Virtual Connection Securing e-business A

Physical layer A cable can contain up to 255 virtual paths. A virtual path can contain up to 65, 535 virtual channels. Securing e-business

Virtual channels • Virtual channels can be permanent (PVCs) or switched (SVCs). • PVCs are controlled by the carrier. • SVCs are controlled by the end user. Securing e-business

ATM has a future • At very high transfer rates, the 9% of bandwidth dedicated to the header is too high. Groups are working on a specification for a new version of ATM that will allow variable cell length. • The ATM Forum are looking at retaining the benefits of the 53 byte cell size whilst adopting a more flexible approach to headers. • ATM is a rival for Multi-Protocol Label Switching (MPLS) the IETF attempt to provide different switching rates for different traffic. Securing e-business

Security issues affecting ATM You understand IP threats so let’s apply them to ATM Securing e-business

ATM threats • ATM networks are vulnerable to similar attacks as IP based networks. Examples of attacks that ATM networks may suffer include: – – – Eavesdropping Spoofing Denial of Service Traffic Analysis Virtual Channel Theft – a unique threat suffered only by ATM. Securing e-business

ATM - Points of Attack Knowledge of the internals of ATM is becoming widespread as is knowledge of SNMP network management systems. Securing e-business

Network management • PVCs and SVCs may be configured by network management systems that may rely on Telnet. • Monitoring systems can be accessed by Web browsers, or RMON probes that make data available. • Attackers can hijack management systems and perform management functions, much as phreakers attacked phone switches. Securing e-business

Virtual Circuits • PVCs are controlled by the carrier and generally more secure. • SVCs are controlled by users and are becoming more popular due. • SVCs are controlled by the Interim Local Management Interface IILMI). Access to the ATM device may be as simple as hooking up a PC or accessing a router using Telnet. • Attackers can join an SVC session by using the add-to-call function of the SVC management system Securing e-business

Hijacking virtual circuits • Attackers obtaining access to a management console or a switch can highjack a PVC. • Once a PVC has been hijacked the options for exploiting the access depend upon how ATM is used. • If an organisation relies solely on ATM for its protection, an attacker could insert fraudulent transactions. • If the PVC is used to access the corporate network then an attacker has effectively bypassed access controls. Securing e-business

Virtual Circuit theft • Increasingly long distance traffic (particularly international traffic) will traverse ATM circuits owned by different carriers. • Although ATM networks are connection based, cells are switched based upon the Virtual Channel or Virtual Path Indicators in the header. • If a VCI or VPI is altered in a switch then subsequent switches will treat the cells as valid. • A user could send traffic using a higher Qo. S and have someone else pick up the bill. Securing e-business

Physical Layer • Just as with IP networks, access to physical resources must be controlled but…………. • you do not know what the physical path is. Resources may be controlled by the service provider, or more likely they will be controlled by multiple partners of the service provider. • You may not know who is carrying your data. You are unlikely to know the strength of their security and how well they restrict access to physical network resources. Securing e-business

Denial of Service attacks • Like many TCP/IP denial of service attacks, ATM can be attacked by repeatedly sending network commands. This requires access to the management system, but these are frequently IP based and potentially vulnerable to attack. • Examples of commands that can be exploited include diagnostic requests, or requests to be added to a virtual channel. Securing e-business

Scenario for an ATM attack • Tap an OC 3 line, connect to an ATM analyser, sit back and monitor your confidential data. • It is not as difficult nor as expensive as you might think. You need access to the line, an optical splitter or tap, a PC with a couple of ATM network cards and some software. • Consider a posting on the following site http: //www. inet-one. com/cypherpunks/dir. 1999. 05. 311999. 06/msg 00209. html Securing e-business

A Posting from Cypherpunk “We attach the two Coral/OC 3 mon ATM NICs to an OC -3 optical fiber pair carrying IP-over-ATM traffic. We connect the receive port of each ATM card to the monitor port of an optical splitter. The splitter carries a fraction of the light from each fiber to the receive port of one NIC. Attached to an OC-3 trunk that terminates on a switching device (e. g. , an ATM switch or a router), one of the Coral/OC 3 mon NICs sees all traffic received by the switching device and the other NIC sees all traffic transmitted by the switching device. The Coral/OC 3 mon NICs capture traffic on the two directions of an OC-3 link independently. ” Securing e-business

Optical Taps are not expensive A Century optical tap from Shomiti – costs around $150 Passive taps allow monitoring/capture/analysis of physical errors, enable full-duplex, full-line rate performance, even at gigabit rates whereas span ports do not. Passive taps also enable the dynamic insertion of network monitoring/analysis devices that need to 'see' all the traffic, i. e. , RMON probes, Intrusion Detection/Security devices, and network/protocol analyzers without breaking the segment. http: //www. shomiti. com/products/taps/index. html Securing e-business

The hardware required • IBM personal computer clone with 256 MB of main memory, a 166 MHz Intel Pentium processor, an Ethernet interface. • Two ATM interface cards, and a 33 MHz 32 bit-wide PCI bus. The ATM interface card used in the current Coral/OC 3 mon implementation is the Fore Systems ATM network interface card (NIC) for the PCI bus. The Intel i 960 processor on this interface card allows us to optimise Coral/OC 3 mon operation with custom firmware. Securing e-business

The software required • “In response to community feedback, NLANR's (National Laboratory for Applied Network Research) Measurement and Operations Analysis Team (MOAT) and the Cooperative Association for Internet Data Analysis (CAIDA) have ported Coral/OC 3 mon to Free. BSD Unix (2. 2. 2 -RELEASE). The Unix port is divided into two portions, the kernel-space device driver which deals with the Fore PCA-200 E card directly and the user-space code that does the flows analysis and fulfills requests for summary reports. ” http: //www. caida. org/outreach/papers/Inet 98/# coral Securing e-business

Securing ATM connections Securing e-business

Requirements for ATM security Verification of identities Accountability Access control and authorisation Activities logging Confidentiality Alarm reporting (with response) Integrity Audit trails of significant events ……………. . in fact nothing new Securing e-business

Basic security is important • Many users of ATM believe it to be intrinsically secure - they fail to implement basic security. • Baseline security requires protection of cables, particularly in shared occupancy buildings, and control of access to components such as switches and network management workstations. • It is easy to forget all this in the desire to manage everything remotely. Securing e-business

Controlling access to network management facilities • Network management facilities are key to the security of ATM networks. • Strong two factor authentication is essential. • Ideally, the network management facility should not be connected to the corporate network. • If remote access is essential then the IP network (including servers and gateways) must be configured securely as you would for the most. Securing e-business sensitive application.

You can monitor the cable • If a cable is attacked and a tap inserted, it will cause attenuation of the signal. By measuring the levels of light passing through the cable it is possible to detect any deviations from the baseline level. • Devices such as Meson’s Fiber. Guard monitor light levels and will trigger an alarm if a threshold is reached. They can also be used to protect unlit fibre. • If monitoring is used, it is important to ensure that any circuits used as standby are monitored since a tap may be inserted before they are used. Securing e-business

Encryption • Encryption is the most powerful tool for securing ATM links. It removes the domain of trust from those aspects of the network that are not under your direct control. • It ensures that if the line is tapped, the information will be of no use to the attacker. • It ensures that if an attacker hijacks a PVC they will not be able to insert fraudulent transactions. • It prevents an attacker using PVC hijack to launch further attacks on the corporate LAN. • 3 DES encryption at wire speed is available at speeds up to and including OC 12. Securing e-business

ATM Encryptor • Provide VPN security over ATM networks Site 3 Site 1 ATM Encryption sits between the ATM and Physical layers Securing e-business

Can you firewall an ATM network? • There is only one commercial ATM Firewall available – the Atlas produced by Bytex. • The traditional role of firewalls is to protect a networked group of computers, or enclave, from traffic coming from an untrusted outside source such as the Internet. ATLAS can perform this job, filtering cells and packets based on policies set by each customer. These policies are expressed in filters that use ATM source and destination, IP source and destination, protocol type, and port number. • The aim of the ATM Firewall is to pre-screen traffic before it reaches a conventional packet Firewall, it does not replace it. e-business Securing

Conclusion - Don’t Panic • If your networks rely totally or in part on ATM connections, you cannot depend on the network to protect your information. • You do not know who is carrying your traffic nor how any switches are involved. • Securing ATM networks is important but not particularly difficult. • A combination of good security practices coupled with strong encryption will enable you to secure your ATM links. Securing e-business

• Securing ebusiness