Casing the Joint What we already know about

Casing the Joint What we already know about your network. batz@vapour.

Casing the Joint • Contents • Context for this information. • Hierarchical breakdown of information that can be used to describe a network into "Areas". • Mock ASN. 1 notation will describe each Area and extensible attributes within its domain and how they pertain to finding vulnerabilities.

Casing the Joint • Evaluate information contained in attributes and how it can be damaging • How a heuristic like this could be used by automated attacks described by Caesar in related presentation. • Questions, comments, violent objections.

Casing the Joint • Recent events: • December 1999, RTMark uses organized flooding tactics to Do. S Etoys. com. Stock price conspicuously falls like rock. • DDo. S attacks cause mild interruption to search engine in February. News media and lobbyists still recovering.

Casing the Joint • First major distributed attack since Morris Worm. • Internet connected hosts vulnerable to distributed attacks for the foreseeable future.

Casing the Joint • Each service provided by a host can provide a wealth of information to a potential attacker. • Attempt to formalize some elements of how that information can be gathered and what it can tell us.

Casing the Joint • • • Types of information: Protocols Layer 3 and up. Addressing, naming schemes. Port ranges of un/filtered services. Applications. Implicit and Explicit Trust.

Casing the Joint • • • AREAS Autonomous System Route DNS Domain Segment Host

Casing the Joint • • • Autonomous System At. ASN BGP routing information for all routes. Paths to other networks, traffic flow, and Peers. Routing policy.

Casing the Joint • • • Information readily available from RAdb, or any BGP speaking peer on the Internet. Very holistic information for a single host.

Casing the Joint • AREA TYPE: ROUTE • At. Route. Rt • A CIDR block that contains the IP addresses contained within targets At. Host or At. DNS. • At. Route. Origin • The AS that this route be being announced from. Useful for collating other routes from other agents.

Casing the Joint • • At. Route. routers list of all routers within the address space one aggregated prefix length shorter than the one defined in At. Route. Rt. • At. Route. gateways • The default gateways of all hosts that are within this netblock.

Casing the Joint • • • At. Route. multicast Each gateway that may route multicast. Potentially a list of multicast groups memberships if possible.

Casing the Joint • • AREA TYPE: DNS DOMAIN Set of all hosts listed in forward and reverse zones for the first level domain.

Casing the Joint • • At. DNS. forward-zone A zone transfer of the domain and/or subdomain that is contained in At. Host. DNSName if available.

Casing the Joint • At. DNS. reverse-zone • In the event that a zone transfer is available, the reverse zone for the /24 that At. Host. Addr is contained in.

Casing the Joint • At. DNS. reverse-lookup • If the whole zone is not available, then the individual ip addresses in the range of /24 or contiguous addresses should be listed within a predefined range .

Casing the Joint • At. DNS. RR • This is for specific resource records such as MX and esoteric entries if the full zone is not available. i. e

Casing the Joint • • • At. DNS. RR. SOA At. DNS. RR. MX At. DNS. RR. A At. DNS. RR. CNAME etc. . .

Casing the Joint • AREA TYPE: SEGMENT • Sharing an Ethernet Segment is a huge amount of trust to be put between devices. Use with caution .

Casing the Joint • The best information that an agent will have will be gained via the local segment. Much of this information can be attained through more active, but less covert means.

Casing the Joint • At. Segment. macaddr • • The mac address of the host that the agent has attached itself to.

Casing the Joint • At. Segment. arp. Table • • • A copy of the ARP table of the agents host. The format of this table should make an XML DTD more appealing.

Casing the Joint • At. Segment. Protocols From captured Ethernet frames, a table of Layer 3 protocols should be kept so that other agents can be informed of local customs. Possible extensible elements of this in next slide.

Casing the Joint • • • At. Segment. Protocols. ether. stp At. Segment. Protocols. ether. vlan At. Segment. Protocols. ipv 4 At. Segment. Protocols. ipv 6 At. Segment. Protocols. esp At. Segment. Protocols. ipsec At. Segment. Protocols. ttcp At. Segment. Protocols. ipx At. Segment. Protocols. atm At. Segment. Protocols. pppoe At. Segment. Protocols. whatever

Casing the Joint • • Each of these would have their subsequent address tables, which would be passed to interested agents.

Casing the Joint • At. Segment. Protocols. Management • Some of these can be determined remotely. • List is not complete. • Gives information about routing architecture.

Casing the Joint • • At. Segment. Protocols. Management. DHCP At. Segment. Protocols. Management. IGMP At. Segment. Protocols. Management. RIPv 1 At. Segment. Protocols. Management. RIPv 2 At. Segment. Protocols. Management. OSPF At. Segment. Protocols. Management. MOSPF At. Segment. Protocols. Management. EIGRP At. Segment. Protocols. Management. IS-IS

Casing the Joint • At. Segment. Promiscuous • In the event that an agent was on a segment where the detection of a promiscuous interface could be detected, it would be nice to know.

Casing the Joint • At. Segment. Promiscuous. yay • At. Segment. Promiscuous. nay • At. Segment. Promiscuous. yay. arpinfo (mac/ip addr)

Casing the Joint • AREA TYPE: HOST • At. Host is defined as a /32 address allocation to an interface or device .

Casing the Joint • At. Host. Addr • The ip address of the device in question. • At. Host. DNSName • The reverse DNS lookup of the ip address as discovered by a local agent .

Casing the Joint • At. Host. Os. Type • • • This is the operating system, and possible version number/ patch level. This information can be ascertained through IP stack fingerprinting, login banners, or services.

Casing the Joint • • At. Host. IPForwarding Does the host forward IP datagrams?

Casing the Joint • At. Host. IPForwarding. tcp • At. Host. IPForwarding. udp • At. Host. IPForwarding. icmp • At. Host. IPForwarding. multicast_sourceroute • At. Host. IPForwarding. rfc 1918 (if no icmp was sent)

Casing the Joint • At. Host. IPForwarding. filter • Are there filtered ports/services on this device? • At. Host. Default. Gateway • The gateways that a packets travels through (within 1 hop) when the host responds to an agents scan.

Casing the Joint • At. Host. Privilaged. TCPServices running on ports less than 1024. This can be obtained from a scan from a local agent, or less accurately, from sniffed traffic on the local net that the agent has access to.

Casing the Joint • At. Host. Privilaged. UDPServices • Similar to TCP services, but of course, UDP services. These are especially useful to attackers and distributed agents due to the connectionless nature of the protocol.

Casing the Joint • At. Host. Nonprivilaged. TCPServices • All tcp services within predefined agent range greater than 1024

Casing the Joint • At. Host. Nonprivilaged. UDPServices • All UDP services within predefined agent range greater than 1024.

Casing the Joint • • At. Host. Privilaged. TCPServices. version At. Host. Privilaged. UDPServices. version At. Host. Non. Privilaged. TCPServices. version At. Host. Non. Privilaged. UDPServices. version

Casing the Joint • • • Version information on each service will allow each agent to correlate services with vulnerabilities.

Casing the Joint • Within the constraints of this rough model, an agent with access to this information could easily make a reasonable decision on how vulnerable a host is to a wide variety of attacks.

Casing the Joint • FUTURE RESEARCH • The mock ASN. 1 notation in this presentation was to illustrate the feasibility of integrating a similar system into a network of agents.

Casing the Joint • This information could easily be described in XML, or a number of other heuristics with the purpose of inter-agent communication.

Casing the Joint • With the advent of the DDo. S systems that have been revealed in the last year, it would be reasonable prediction that attacks against networks will be perpetrated less by individuals than by malicious software acting of its own volition.

Casing the Joint “What was once thought, can never be unthought” --The Physicists, Friedrich Durrenmatt batz@vapour. net