Γηαρείξηζε δηθηύσλ SNMP

Transcript

1 Γηαρείξηζε δηθηύσλ SNMP

2 SNMP: Simple Network Management Protocol Δίλαη έλα de facto Internet standard (βαζηζκέλν ζε RFCs). Τα δεδνκέλα πνπ δηαρεηξίδεηαη ην SNMP αλαπαξηζηώληαη ζε έλα δέληξν, ην ΜΙΒ (Management Information Base). Tα θξηηήξηα ζρεδηαζκνύ ήηαλ: Simple. Lightweight. Low-bandwidth. Φξεζηκνπνίεζε TCP/IP πξσηνθόιισλ (επίπεδα 3 θαη 4).

3 SNMP Simple Network Management Protocol Doesn't SNMP solve all these problems? Don't be silly!

4 SNMP Where did it come from? Internet Engineering Task Force» Network Management Area SNMP V1 MIB definitions SNMPV2

5 What is it? more than just a protocol It defines an architecture for extracting information from the network regarding the current operational state of the network, using a vendor-independent family of mechanisms

6 Structure of Management Information (SMI) identifies and defines structure of management information RFC1155 defines commonly defined data item syntax of the data type semantics of the data object

7 Syntax uses ASN.1 (Abstract Syntax Notation) binary encoding is a 1 byte integer, value 6 Primitive Types INTEGER, OCTECT STRING, OBJECT IDENTIFIER, NULL Constructor Types SEQUENCE <primitive-type>... SEQUENCE OF <primitive-type>... ie. a record ie. an array

8 Syntax Defined Data Types IpAddress Counter Gauge TimeTicks what you expect non-negative integer that wraps non-negative integer that latches time in hundredths of seconds

9 SNMP NAMES SNMP Name Structure 1 - iso 3 - org 6 - dod 1 - Internet 1 - directory 2 - mgmt 3 - expt 4 - private 1 - mib 1 - Enterprise 1 - system 2 - interfaces 9 - cisco 1 - sysdescr 2 - sysobjectid 1 - iftable 1 - ifentry 1 - ifindex 2 - ifdescr 3 - iftype ifinoctets

10 SNMP Management Information Base (MIB) "database"of network objects Groups:» System, Interfaces, Address Translation, IP, ICMP, TCP, UDP, EGP "Access" and "Status" attributes actual variables are "instances" of OIDs sysdescr ifinoctets for interface iproutenexthop for network

11 SNMP The SNMP protocol itself allows inspection and alteration of MIB variables UDP Based not acknowledged transactions PUT, GET, GET-NEXT operators

12 SNMP SNMP Traps unsolicited notification of events can include variable list ColdStart, WarmStart LinkUp, LinkDown Authentication Failure EGP Neighbour Loss Enterprise Specific

13 Network Management Software SNMP Agents provided by all router vendors many expanded (enterprise) MIBs bridges, wiring concentrators, toasters

14 Network Management Software Public Domain Application Programming Interfaces available from CMU and MIT include variety of applications

15 Network Management Software Commercially many offerings, UNIX and PC based» HP OpenView» SunNet Manager» Cabletron Spectrum» *MANY* others

16 Does it: Choosing a Management Platform a) Support your systems? b) Run on your platforms? c) Meet your requirements? d) Match your resources?

17 Choosing a Management Platform Maybe you can get away with something quick and dirty using existing tools Maybe a commercial management product will meet your operational requirements

18 SNMP Tutorial

19 Tutorial Overview Introduction Management Information Base (MIB) Simple Network Management Protocol (SNMP) SNMP Commands Tools - SNMPwalk (CLI) - MIB Browser (GUI)

20 Introduction SNMP Simple Network Management Protocol is an application layer protocol that facilitates the exchange of management information between network devices - Application-layer protocol for managing TCP/IP based networks. - Runs over UDP, which runs over IP using Port 161 and Two versions of SNMP exist: SNMP version 1 (SNMPv1) and SNMP version 2 (SNMPv2).

21 Basic tasks that fall under this category are Configuration Management Keeping track of device setting Fault Management -Dealing with problems and emergencies in the network i.e. server, router Performance Management

22 Network Management Success factors The management interface must be Standardized Extendable Portable The management mechanism must be In expensive

23 Major functions Configuration Management - inventory, configuration, provisioning Fault Management - reactive and proactive network fault management Performance Management - # of packets dropped, timeouts, collisions, CRC errors Security Management - SNMP doesn t provide much here Accounting Management - cost management and chargeback assessment Asset Management - statistics of equipment, facility, and administration personnel Planning Management - analysis of trends to help justify a network upgrade or bandwidth increase

24 History TCP/IP replaces ARPANET at U.S. Dept. of Defense, effective birth of Internet First model for net management - HEMS - High-Level Entity Management System (RFCs 1021,1022,1024,1076) ISO OSI proposes CMIP - Common Management Information Protocol, and CMOT (CMIP over TCP) for the actual network management protocol for use on the internet Nov SGMP - Simple Gateway Monitoring protocol (RFC 1028) Marshall T. Rose heads up SNMP working group to create a common network management framework to be used by both SGMP and CMOT to allow for transition to CMOT Aug Internet-standard Network Management Framework defined (RFCs 1065, 1066, 1067) Apr SNMP promoted to recommended status as the de facto TCP/IP network management framework (RFC 1098) June IAB committee decides to let SNMP and CMOT develop separately May IAB promotes SNMP to a standard protocol with a recommended status (RFC 1157) Mar format of MIBs and traps defined (RFCs 1212, 1215) TCP/IP MIB definition revised to create SNMPv1 (RFC 1213)

25 SNMP & OSI model 7 Application Layer Management and Agent APIs SNMP 6 Presentation Layer ASN.1 and BER 5 Session Layer RPC and NetBIOS 4 Transport Layer TCP and UDP 3 Network Layer IP and IPX 2 Data Link Layer Ethernet, Token Ring, FDDI 1 Physical Layer

26 Port & UDP SNMP uses User Datagram Protocol (UDP) as the transport mechanism for SNMP messages Ethernet Frame IP Packet UDP Datagram SNMP Message CRC Like FTP, SNMP uses two well-known ports to operate: UDP Port SNMP Messages UDP Port SNMP Trap Messages

27 SNMP Components An SNMP-managed network consists of three key components: managed devices, agents, and network-management systems (NMSs).

28 SNMP components A managed device is a network node that contains an SNMP agent and that resides on a managed network. Managed devices collect and store management information and make this information available to NMSs using SNMP. Managed devices, sometimes called network elements, can be routers and access servers, switches and bridges, hubs, computer hosts, or printers. An agent is a network-management software module that resides in a managed device. An agent has local knowledge of management information and translates that information into a form compatible with SNMP. An NMS executes applications that monitor and control managed devices. NMSs provide the bulk of the processing and memory resources required for network management. One or more NMSs must exist on any managed network.

29

30 Basic Command Managed devices are monitored and controlled using four basic SNMP commands: read, write, trap, and traversal operations. The read command is used by an NMS to monitor managed devices. The NMS examines different variables that are maintained by managed devices. The write command is used by an NMS to control managed devices. The NMS changes the values of variables stored within managed devices. The trap command is used by managed devices to asynchronously report events to the NMS. When certain types of events occur, a managed device sends a trap to the NMS. Traversal operations are used by the NMS to determine which variables a managed device supports and to sequentially gather information in variable tables, such as a routing table.

31 Language of SNMP Structure of Management Information (SMI) specifies the format used for defining managed objects that are accessed via the SNMP protocol Abstract Syntax Notation One (ASN.1) used to define the format of SNMP messages and managed objects (MIB modules) using an unambiguous data description format Basic Encoding Rules (BER) used to encode the SNMP messages into a format suitable for transmission across a network

32 Abstract Syntax Notation One ASN.1 is nothing more than a language definition. It is similar to C/C++ and other programming languages. Syntax examples: -- two dashes is a comment -- The C equivalent is written in the comment MostSevereAlarm ::= INTEGER -- typedef MostSevereAlarm int; circuitalarms MostSevereAlarm ::= 3 -- MostSevereAlarm circuitalarms = 3; MostSevereAlarm ::= INTEGER (1..5) -- specify a valid range ErrorCounts ::= SEQUENCE { circuitid erroredseconds OCTET STRING, INTEGER, unavailableseconds INTEGER } -- data structures are defined using the SEQUENCE keyword

33 Simple Data Types INTEGER -- signed 32-bit integer OCTET STRING OBJECT IDENTIFIER (OID) NULL -- not actually data type, but data value IpAddress -- OCTET STRING of size 4, in network byte order (B.E.) Counter -- unsigned 32-bit integer (rolls over) Gauge -- unsigned 32-bit integer (will top out and stay there) TimeTicks -- unsigned 32-bit integer (rolls over after 497 days) Opaque -- used to create new data types not in SNMPv1 RED items defined by ASN.1 Blue items defined by RFC 1155 DateAndTime, DisplayString, MacAddress, PhysAddress, TimeInterval, TimeStamp, TruthValue, VariablePointer -- textual conventions used as types

34 SNMP overview: 4 key parts Management information base (MIB): distributed information store of network management data Structure of Management Information (SMI): data definition language for MIB objects SNMP protocol convey manager<->managed object info, commands security, administration capabilities major addition in SNMPv3

35 MIB Management Information Base (MIB) is a collection of information that is organized hierarchically. MIBs are accessed using a network-management protocol such as SNMP. They are comprised of managed objects and are identified by object identifiers.

36 Two types of managed objects exist: scalar and tabular Scalar objects define a single object instance. Tabular objects define multiple related object instances that are grouped in MIB tables.

37 Always defined and referenced within the context of a MIB A typical MIB variable definition: syscontact OBJECT-TYPE -- OBJECT-TYPE is a macro SYNTAX DisplayString (SIZE (0..255)) ACCESS read-write -- or read-write, write-only, notaccessible STATUS mandatory -- or optional, deprecated, obsolete DESCRIPTION CEPN1331 Computer Network ::= { system 4 }

38 MIB Management Information Base MIB Breakdown - OBJECT-TYPE - String that describes the MIB object. - Object IDentifier (OID). - SYNTAX - Defines what kind of info is stored in the MIB object. - ACCESS - READ-ONLY, READ-WRITE. - STATUS - State of object in regards the SNMP community. - DESCRIPTION - Reason why the MIB object exists. Standard MIB Object: sysuptime OBJECT-TYPE SYNTAX Time-Ticks ACCESS read-only STATUS mandatory DESCRIPTION Time since the network management portion of the system was last reinitialised. ::= {system 3}

39 MIB Management Information Base Object IDentifier (OID) - Example iso(1) org(3) dod(6) internet(1) mgmt(2) mib-2(1) system(1) Note: ~100% present. - mgmt and private most common. - MIB-2 successor to original MIB. - STATUS mandatory, All or nothing in group 1 directory(1) system(1) iso(1) org(3) dod(6) 6 1 mgmt(2) 2 3 internet(1) private(4) mib-2(1) experimental(3) interfaces(2) ip(4) tcp(6)

40

41 MIB Management Information Base system(1) group - Contains objects that describe some basic information on an entity. - An entity can be the agent itself or the network object that the agent is on. 1 system(1) 2 1 mib-2(1) interfaces(2) system(1) group objects - sysdescr(1) Description of the entity. - sysobjectid(2) Vendor defined OID string. - sysuptime(3) Time since net-mgt was last re-initialised. - syscontact(4) Name of person responsible for the entity.

42 MIB Management Information Base MIB - tree view MIB - syntax view 1 sysdesc(1) 2 1 system(1) sysobjectid(2) mib-2(1) sysuptime OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION The time (in hundredths of a second) since the network management portion of the system was last resyscontact(3) sysuptime(3)

43 MIB Management Information Base SNMP Instances - Each MIB object can have an instance. - A MIB for a router s (entity) interface information iso(1) org(3) dod(6) internet(1) mgmt(2) mib-2(1) interfaces(2) iftable(2) ifentry(1) iftype(3) - Require one iftype value per interface (e.g. 3) - One MIB object definition can represent multiple instances through Tables, Entries, and Indexes.

44 MIB Management Information Base Tables, Entries, and Indexes. - Imagine tables as spreadsheets - Three interface types require 3 rows (index no.s) - Each column represents a MIB object, as defined by the entry node. ENTRY + INDEX = INSTANCE iftype(3) ifmtu(4) Etc Index #1 Index #2 Index #3 iftype.1[6] iftype.2:[9] iftype.3:[15] ifmtu.1 ifmtu.2 ifmtu.3

45 Simple Network Management Protocol Retrieval protocol for MIB. Can retrieve by - CLI (snmpwalk), - GUI (MIB Browser), or - Larger applications (Sun Net Manager) called Network Management Software (NMS). NMS collection of smaller applications to manage network with illustrations, graphs, etc. NMS run on Network Management Stations (also NMS), which can run several different NMS software applications.

46 SMI: data definition language Purpose: syntax, semantics of management data well-defined, unambiguous base data types: straightforward, boring OBJECT-TYPE data type, status, semantics of managed object MODULE-IDENTITY groups related objects into MIB module Basic Data Types INTEGER Integer32 Unsigned32 OCTET STRING OBJECT IDENTIFIED IPaddress Counter32 Counter64 Guage32 Time Ticks Opaque

47 SNMP MIB MIB module specified via SMI MODULE-IDENTITY (100 standardized MIBs, more vendor-specific) MODULE OBJECT TYPE: OBJECT TYPE: OBJECT TYPE: objects specified via SMI OBJECT-TYPE construct

48 SMI: Object, module examples OBJECT-TYPE: ipindelivers ipindelivers OBJECT TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION The total number of input datagrams successfully delivered to IP userprotocols (including ICMP) ::= { ip 9} MODULE-IDENTITY: ipmib ipmib MODULE-IDENTITY LAST-UPDATED Z ORGANZATION IETF SNPv2 Working Group CONTACT-INFO Keith McCloghrie DESCRIPTION The MIB module for managing IP and ICMP implementations, but excluding their management of IP routes. REVISION Z ::= {mib-2 48}

49 MIB example: UDP module Object ID Name Type Comments UDPInDatagrams Counter32 total # datagrams delivered at this node UDPNoPorts Counter32 # underliverable datagrams no app at portl UDInErrors Counter32 # undeliverable datagrams all other reasons UDPOutDatagrams Counter32 # datagrams sent udptable SEQUENCE one entry for each port in use by app, gives port # and IP address

50 SNMP Naming question: how to name every possible standard object (protocol, data, more..) in every possible network standard?? answer: ISO Object Identifier tree: hierarchical naming of all objects each branchpoint has name, number ISO ISO-ident. Org. US DoD Internet udpindatagrams UDP MIB2 management

51 OSI Object Identifier Tree Check out

52 SNMP protocol Two ways to convey MIB info, commands: request managing entity response agent data managing entity trap msg agent data Managed device request/response mode Managed device trap mode

53 SNMP protocol: message types Message type GetRequest GetNextRequest GetBulkRequest InformRequest SetRequest Response Trap Function Mgr-to-agent: get me data (instance,next in list, block) Mgr-to-Mgr: here s MIB value Mgr-to-agent: set MIB value Agent-to-mgr: value, response to Request Agent-to-mgr: inform manager of exceptional event

54 SNMP protocol: message formats

55 SNMP security and administration encryption: DES-encrypt SNMP message authentication: compute, send MIC(m,k): compute hash (MIC) over message (m), secret shared key (k) protection against playback: use nonce view-based access control SNMP entity maintains database of access rights, policies for various users database itself accessible as managed object!

56 SNMP Commands SNMP has 5 different functions referred to as Protocol Data Units (PDU s), which are: (1) GetRequest, aka Get (2) GetNextRequest, aka GetNext (3) GetResponse, aka Response (4) SetRequest, aka Set (5) Trap

57 SNMP Commands [Get] GetRequest [Get] - Most common PDU. - Used to ask SNMP agent for value of a particular MIB agent. - NMS sends out 1 Get PDU for each instance, which is a unique OID string. - What happens if you don t know how many instances of a MIB object exist?

58 SNMP Commands [GetNext] GetNextRequest [GetNext] - NMS application uses GetNext to walk down a table within a MIB. - Designed to ask for the OID and value of the MIB instance that comes after the one asked for. - Once the agent responds the NMS application can increment its count and generate a GetNext. - This can continue until the NMS application detects that the OID has changed, i.e. it has reached the end of the table.

59 SNMP Commands [GetResponse] GetResponse [Response] - Simply a response to a Get, GetNext or Set. - SNMP agent responds to all requests or commands via this PDU.

60 SNMP Commands [SetRequest] SetRequest [Set] - Issued by an NMS application to change a MIB instance to the variable within the Set PDU. - For example, you could issue a - GetRequest against a KDEG server asking for syslocation.0 and may get ORI as the response. - Then, if the server was moved, you could issue a Set against that KDEG server to change its location to INS. - You must have the correct permissions when using the set PDU.

61 SNMP Commands [Trap] Trap - Asynchronous notification. - SNMP agents can be programmed to send a trap when a certain set of circumstances arise. - Circumstances can be view as thresholds, i.e. a trap may be sent when the temperature of the core breaches a predefined level.

62 SNMP Security SNMP Community Strings (like passwords) - 3 kinds: - READ-ONLY: You can send out a Get & GetNext to the SNMP agent, and if the agent is using the same read-only string it will process the request. - READ-WRITE: Get, GetNext, and Set. If a MIB object has an ACCESS value of read-write, then a Set PDU can change the value of that object with the correct read-write community string. - TRAP: Allows administrators to cluster network entities into communities. Fairly redundant.

63 SNMP Tools Command Line Interface e.g. snmpwalk Graphical User Interface e.g. ireasoning s MIB Browser» Or via

64 SNMP MIB Browser (1) Initial set-up... java -Xmx384m -jar XYZ\lib\browser.jar (where XYZ = your specific path) Breakdown - LHS is the SNMP MIB structure. - Lower LHS has details of MIB structure. - RHS will present MIB values.

65 SNMP MIB Browser (2) Discovery - Subnet: 134.XXX.XXX.* - Read Community: public Start Note IP Address. Stop

66 SNMP MIB Browser (3) Navigation - MIB Tree System sysuptime -Notice Lower LHS - Notice OID

67 SNMP MIB Browser (4) SNMP PDU s (1) Get - Select Go Get - RHS has values. - OID Value

68 SNMP MIB Browser (5) SNMP PDU s (2) GetNext -Selected OID is: Returned value: ( ) or DSG, O Reilly Institute, F.35

69 SNMP MIB Browser (6) SNMP (3) Get SubTree -Position of MIB: (a.k.a. system) -RHS values: Returns all values below system.

70 SNMP MIB Browser (7) SNMP (4) Walk -MIB Location: (a.k.a. mib-2) - Returns *ALL* values under mib-2

71 SNMP MIB Browser (8) Tables - MIB Location: (or interfaces) - Select iftable, Go, then Table View. - Refresh/Poll

72 SNMP MIB Browser (9) SNMP - Graph - Select a value from the RHS, say sysuptime - Highlight and select Go, then Graph. - Interval = 1s set.

73 The presentation problem Q: does perfect memory-to-memory copy solve the communication problem? A: not always! struct { char code; int x; } test; test.x = 256; test.code= a test.code test.x a host 1 format test.code test.x a host 2 format problem: different data format, storage conventions

74 A real-life presentation problem: grandma 2004 teenager aging 60 s hippie

75 Presentation problem: potential solutions 1. Sender learns receiver s format. Sender translates into receiver s format. Sender sends. real-world analogy? pros and cons? 2. Sender sends. Receiver learns sender s format. Receiver translate into receiver-local format real-world-analogy pros and cons? 3. Sender translates host-independent format. Sends. Receiver translates to receiver-local format. real-world analogy? pros and cons?

76 Solving the presentation problem 1. Translate local-host format to host-independent format 2. Transmit data in host-independent format 3. Translate host-independent format to remote-host format grandma aging 60 s hippie 2004 teenager

77 ASN.1: Abstract Syntax Notation 1 ISO standard X.680 used extensively in Internet like eating vegetables, knowing this good for you! defined data types, object constructors like SMI BER: Basic Encoding Rules specify how ASN.1-defined data objects to be transmitted each transmitted object has Type, Length, Value (TLV) encoding

78 TLV Encoding Idea: transmitted data is self-identifying T: data type, one of ASN.1-defined types L: length of data in bytes V: value of data, encoded according to ASN.1 standard Tag Value Type Boolean Integer Bitstring Octet string Null Object Identifier Real

79 TLV encoding: example Value, 259 Length, 2 bytes Type=2, integer Value, 5 octets (chars) Length, 5 bytes Type=4, octet string

80 Network Management: summary network management extremely important: 80% of network cost ASN.1 for data description SNMP protocol as a tool for conveying information Network management: more art than science what to measure/monitor how to respond to failures? alarm correlation/filtering?

81 Network Management and Security Outline Basic Concepts of SNMP SNMPv1 Community Facility SNMPv3

82 Basic Concepts of SNMP An integrated collection of tools for network monitoring and control. Single operator interface Minimal amount of separate equipment. Software and network communications capability built into the existing equipment SNMP key elements: Management station Managament agent Management information base Network Management protocol» Get, Set and Notify

83 Protocol context of SNMP

84 Proxy Configuration

85

86 SNMP v1 and v2 Trap an unsolicited message (reporting an alarm condition) SNMPv1 is connectionless since it utilizes UDP (rather than TCP) as the transport layer protocol. SNMPv2 allows the use of TCP for reliable, connection-oriented service.

87 Comparison of SNMPv1 and SNMPv2 SNMPv1 PDU SNMPv2 PDU Direction Description GetRequest GetRequest Manager to agent Request value for each listed object GetRequest GetRequest Manager to agent Request next value for each listed object GetBulkRequest Manager to agent Request multiple values SetRequest SetRequest Manager to agent Set value for each listed object InformRequest Manager to manager GetResponse Response Agent to manager or Manage to manager(snmpv2) Transmit unsolicited information Respond to manager request Trap SNMPv2-Trap Agent to manager Transmit unsolicited information

88 SNMPv1 Community Facility SNMP Community Relationship between an SNMP agent and SNMP managers. Three aspect of agent control: Authentication service» Access to MIB is restricted to authorised managers Access policy» Different access rights to different managers Proxy service» The agent as a broker for other agents

89 Access policy (Πνιηηηθή πξόζβαζεο) Με ηνλ θαζνξηζκό κηαο θνηλόηεηαο ν πξάθηνξαο πεξηνξίδεη ηελ πξόζβαζε ζηε βάζε ΜΙΒ Διεγρνο πξόζβαζεο: Πξνβνιή SNMP MIB: έλα ππνζύλνιν από αληηθείκελα κέζα ζε κηα ΜΙΒ. Μπνξνύλ λα νξηζηνύλ δηαθνξεηηθέο πξνβνιέο. Τν ζύλνιν αληηθεηκέλσλ ηεο πξνβνιήο δε ρξεηάδεηαη λα αλήθεη ζε ελα κόλν ππνδέλδξν ηεο ΜΙΒ Καηάζηαζε πξόζβαζεο SNMP: έλα ζηνηρείην από ην ζύλνιν {READ-ONLY, READ-WRITE}. Οξίδεηαη κηα θαηάζηαζε πξόζβαζεο γηα θάζε θνηλόηεηα. Πξνθίι θνηλόηεηαο SNMP (SNMP community profile)

90 SNMPv1 Administrative Concepts

91 SNMPv3 SNMPv3 defines a security capability to be used in conjunction with SNMPv1 or v2 User security model USM

92 Traditional SNMP Manager

93 Traditional SNMP Agent

94

95 SNMPv3 Flow

96 SNMP3 Message Format with USM

97 User Security Model (USM) Designed to secure against: Modification of information (Τξνπνπνίεζε πιεξνθνξηώλ) Masquerade (Μεηακθίεζε) Message stream modification (Τξνπνπνίεζε ξνήο κελπκάησλ) Disclosure (Απνθάιπςε) Not intended to secure against: Denial of Service (DoS attack) (Αξλεζε παξνρήο ππεξεζηώλ) Traffic analysis (Αλάιπζε θίλεζεο)

98 Key Localization Process

99 View-Based Access Control Model (VACM) VACM has two characteristics: Determines whether access to a managed object should be allowed. Make use of an MIB that:» Defines the access control policy for this agent.» Makes it possible for remote configuration to be used.

100 Access control decision

101 Network security Intruders and Viruses

102 Outline Intruders Intrusion Techniques Password Protection Password Selection Strategies Intrusion Detection Viruses and Related Threats Malicious Programs The Nature of Viruses Antivirus Approaches Advanced Antivirus Techniques

103 Intruders Three classes of intruders (hackers or crackers): Masquerader (κεηακθηεζκέλνο) Misfeasor (παξάλνκνο) Clandestine user (θξπθόο ρξήζηεο)

104 Intrusion Techniques System maintain a file that associates a password with each authorized user. Password file can be protected with: One-way encryption (κνλόδξνκε θξππηνγξάθεζε: απνζήθεπζε θξππηνγξαθεκέλεο κνξθήο ζπλζεκαηηθνύ ρξήζηε) Access Control (έιεγρνο πξόζβαζεο ζην αξρείν ζπλζεκαηηθώλ)

105 Intrusion Techniques Techniques for guessing passwords: Try default passwords. Try all short words, 1 to 3 characters long. Try all the words in an electronic dictionary(60,000). Collect information about the user s hobbies, family names, birthday, etc. Try user s phone number, social security number, street address, etc. Try all license plate numbers (MUP103). Use a Trojan horse Tap the line between a remote user and the host system. Prevention: Enforce good password selection (Ij4Gf4Se%f#)

106 UNIX Password Scheme Loading a new password

107 UNIX Password Scheme Verifying a password file

108 Storing UNIX Passwords UNIX passwords were kept in a publicly readable file, etc/passwords. Now they are kept in a shadow directory and only visible by root.

109 Salt The salt serves three purposes: Prevents duplicate passwords. Effectively increases the length of the password. Prevents the use of hardware implementations of DES

110 Password Selecting Strategies User ducation (εθπαίδεπζε ρξεζηώλ) Computer-generated passwords (παξαγόκελα από ηνλ ππνινγηζηή ζπλζεκαηηθά) Reactive password checking (ζηξαηεγηθή αληηδξαζηηθνύ ειέγρνπ ζπλζεκαηηθνύ: ην ζύζηεκα εθηειεί πεξηνδηθά ην δηθό ηνπ πξνγξακκα ζπαζίκαηνο ζπλζεκαηηθώλ) Proactive password checking (πξνιεπηηθόο έιεγρνο ζπλζεκαηηθώλ)

111 Markov Model: ηερληθή πξνιεπηηθνύ ειεγθηή Μνληέιν γηα ηελ παξαγσγή πξνβιέςηκσλ ζπλζεκαηηθώλ: m: ν αξηζκόο θαηαζηάζεσλ ζην κνληειν Α: ν ρώξνο θαηαζηάζεσλ Τ: πηλαθαο πηζαλνηεησλ K: ε ηάμε ηνπ κνληέινπ

112 Transition Matrix 1. Determine the frequency matrix f, where f(i,j,k) is the number of occurrences of the trigram consisting of the ith, jth and kth character. 2. For each bigram ij, calculate f(i,j, ) as the total number of trigrams beginning with ij. 3. Compute the entries of T as follows: T( i, j, k) f ( i, j, k) f ( i, j, )

113 Spafford (Bloom Filter) H i where X i D ( X ) y 1 i k; 1 j D; 0 y N 1 i jthword inpassworddictionary numberof wordinpassworddictionary The following procedure is then applied to the dictionary: 1. A hash table of N bits is definied, with all bits initially set to For each password, its k hash values are calculated, and the responding bits in the hash table are set to 1

114 Spafford (Bloom Filter) Design the hash scheme to minimize false positive. Probability of false positive: kd/ N k P (1 e ) (1 e or, equivalent ly, k R 1/ k ln(1 P ) k / R ) k where k numberof hash function N numberof bitsinhashtable D numberof wordsindictionary R N / D, ratioof hash tablesize( bits) todictionarysize( words)

115 Performance of Bloom Filter

116 The Stages of a Network Intrusion 1. Scan the network to: locate which IP addresses are in use, what operating system is in use, what TCP or UDP ports are open (being listened to by Servers). 2. Run Exploit scripts against open ports 3. Get access to Shell program which is suid (has root privileges). 4. Download from Hacker Web site special versions of systems files that will let Cracker have free access in the future without his cpu time or disk storage space being noticed by auditing programs. 5. Use IRC (Internet Relay Chat) to invite friends to the feast.

117 Intusion Detection The intruder can be identified and ejected from the system. An effective intrusion detection can prevent intrusions. Intrusion detection enables the collection of information about intrusion techniques that can be used to strengthen the intrusion prevention facility.

118 Profiles of Behavior of Intruders and Authorized Users

119 Intrusion Detection Statistical anomaly detection (αλίρλεπζε ζηαηηζηηθώλ αλσκαιηώλ) Treshold detection (αλίρλεπζε κε θαηώθιηα) Profile based (αλίρλεπζε βαζηζκάλε ζε πξνθίι) Rule based detection (Αλίρλεπζε βαζηζκέλε ζε θαλόλεο) Anomaly detection (αλίρλεπζε αλσκαιηώλ) Penetration identidication (αλαγλσ ξηζε δηείζδπζεο)

120 Measures used for Intrusion Detection Login frequency by day and time. Frequency of login at different locations. Time since last login. Password failures at login. Execution frequency. Execution denials. Read, write, create, delete frequency. Failure count for read, write, create and delete.

121 Distributed Intrusion Detection Developed at University of California at Davis

122 Distributed Intrusion Detection

123 Viruses and Malicious Programs Computer Viruses and related programs have the ability to replicate themselves on an ever increasing number of computers. They originally spread by people sharing floppy disks. Now they spread primarily over the Internet (a Worm ). Other Malicious Programs may be installed by hand on a single machine. They may also be built into widely distributed commercial software packages. These are very hard to detect before the payload activates (Trojan Horses, Trap Doors, and Logic Bombs).

124 Taxonomy of Malicious Programs Malicious Programs Need Host Program Independent Trapdoors Logic Bombs Trojan Horses Viruses Bacteria Worms

125 Definitions Virus (Ινο) - code that copies itself into other programs. A Bacteria replicates until it fills all disk space, or CPU cycles. Payload - harmful things the malicious program does, after it has had time to spread. Worm (Σθνπιήθη) - a program that replicates itself across the network (usually riding on messages or attached documents (e.g., macro viruses).

126 Definitions Trojan Horse (Γνύξεηνο Ιππνο) - instructions in an otherwise good program that cause bad things to happen (sending your data or password to an attacker over the net). Logic Bomb (Λνγηθή Βόκβα) - malicious code that activates on an event (e.g., date). Trap Door (or Back Door) (Κεξθόπνξηα) - undocumented entry point written into code for debugging that can allow unwanted users.

127 Definitions Exploits (Σεκεία Δθκεηάιεπζεο) Πξνγξάκκαηα πνπ εθκεηαιεύνληαη ζπγθεθξηκέλεο αδπλακίεο. Downloaders (Πξνγξάκκαηα Καηεβάζκαηνο) εγθαζηζηά άιια πξνγξάκκαηα ζην ζύζηεκα ζην νπνίν βξίζθεηαη. Σπλήζσο κεηαδίδνληαη κέζσ ει. ηαρπδξνκείνπ Spammer εξγαιεία πνπ ζηέιλνπλ κεγάιν όγθν κελπκάησλ ει. Ταρπδξνκείνπ Flooder ρξεζηκνπνηνύληαη ζε επηζέζεηο θαηά δηθηπσκέλσλ ζπζηεκάησλ θαη πξνθαινύλ επηζέζεηο άξλεζεο εμππεξέηεζεο. Zombie πξόγξακκα ην νπνίν νηαλ ελεξγνπνηείηαη ζε ελαλ ππνινγηζηή, μεθηλά επηζέζεηο ζε άιινπο ππνινγηζηέο

128 Virus Phases Dormant phase (θάζη ύπνωζης) - the virus is idle Propagation phase (θάζη διάδοζης) - the virus places an identical copy of itself into other programs Triggering phase (θάζη πσροδόηηζης) the virus is activated to perform the function for which it was intended Execution phase (θάζη εκηέλεζης) the function is performed

129 Virus Protection Have a well-known virus protection program, configured to scan disks and downloads automatically for known viruses. Do not execute programs (or "macro's") from unknown sources (e.g., PS files, Hypercard files, MS Office documents, Avoid the most common operating systems and programs, if possible.

130 Virus Structure 1 ε γξακκή: άικα ζην θπξην πξόγξακκα ηνύ 2 ε γξακκή: αλαδεηά ακόιπληα εθηειέζηκα θαη ηα κνιύλεη... Ο ηόο πξαγκαηνπνηεί θάπνηα επδήκηα ελέξγεηα (κπνξεί λα εθηειείηαη θαζε θνξά πνπ ηξέρεη ην πξόγξακκα ή λα είλαη κηα ινγηθή βόκβα)

131 A Compression Virus

132 Types of Viruses Parasitic Virus (παξαζηηηθόο) - attaches itself to executable files as part of their code. Runs whenever the host program runs. Memory-resident Virus (ιός μόνιμα εγκαηεζηημένος ζηη μνήμη) - Lodges in main memory as part of the residual operating system. Boot Sector Virus (ιός ηομέα εκκίνηζης) - infects the boot sector of a disk, and spreads when the operating system boots up (original DOS viruses). Stealth Virus (αόξαηνο ηόο) - explicitly designed to hide from Virus Scanning programs. Polymorphic Virus (πνιπκνξθηθόο ηόο)- mutates with every new host to prevent signature detection. Metamorphic Virus (κεηακνξθηθόο ηόο) mutates with every new host, rewrites itself and changes its behavior and appearance

133 Macro Viruses Microsoft Office applications allow macros to be part of the document. The macro could run whenever the document is opened, or when a certain command is selected (Save File). Platform independent. Infect documents, delete files, generate and edit letters.

134 Ινί ει. ηαρπδξνκείνπ Φαξαθηεξηζηηθά Σηέιλεηαη ζε όια ηα άηνκα πνπ ππάξρνπλ ζηε ιίζηα επαθώλ ηνπ ρξήζηε Ο ηόο πξνθαιεί ηνπηθή δεκηά ελεξγνπνίεζε θαη κε απιό άλνηγκα ηνπ κελύκαηνο ει. ηαρπδξ. δπλαηόηεηεο ηαρείαο δηάδνζεο κέζσ Γηαδηθηύνπ Σθνπιήθηα Χάρλεη ελεξγεηηθά γηα άιια ζπζηήκαηα πξνθεηκέλνπ λα δηαδνζεί ρξεζηκνπνηεί «δηθηπαθό όρεκα»:» Υπεξεζία ει. ηαρπδξνκείνπ» Γπλαηόηεηα απνκαθξπζκέλεο εθηέιεζεο (εθηειεί ελα αληηγξαθό ηνπ ζε ελα αιιν ζύζηεκα)» Γπλαηόηεηα απνκαθξπζκέλεο ζύλδεζεο (ζπλδέεηαη σο ρξήζηεο ζε απνκαθξπζκέλν ζύζηεκα θαη ρξεζηκνπνηεί εληνιεο γηα λα αληηγξαθεί από ην έλα ζύζηεκα ζην άιιν) Τν ζθνπιήθη Morris: Robert Morris 1998, γηα ζπζηήκαηα UNIX, αλαθάιπςε άιισλ ππνινγηζηώλ ηνπο νπνηνπο εκπηζηεπόηαλ ν ππνινγηζηήο

135 Τερλνινγία Σθνπιεθηώλ Πνιππιαηθνξκηθά: κπνξνύλ λα επηηεζνύλ ζε WINDOWS, UNIX θιπ Πνιιαπιήο εθκεηάιιεπζεο: πνηθίινη ηξόπνη δηείζδπζεο(ρξεζηκνπνηώληαο εππάζεηεο ζε δηαθνκηζηέο Γηαδηθηύνπ, θνηλνρξεζηία αξρείσλ θιπ) Δμαηξεηηθά γξήγνξε εμάπισζε: ηερληθή γηα επηηάρπλζε ηεο εμάπισζεο-αλίρλεπζε ζην Γηαδηθηπν γηα ηελ ζπγθέληξσζε δηεπζύλζεσλ Πνιπκνξθηζκόο Μεηακνξθηζκόο Μεηαθνξηθά νρήκαηα: είλαη ηδαληθά κέζα κεηαθνξάο γηα άιια εξγαιεία θαηαλεκεκέλεο επίζεζεο Δθκεηάιιεπζε ηελ «εκέξα κεδελ»: γηα επίηεπμε κέγηζηνπ βαζκνύ αηθληδηαζκνύ θαη δηάδνζεο ην ζθνπιήθη εθκεηαιεύεηαη κηα άγλσζηε εππάζεηα

136 Μέηξα αληηκηώπηζεο Ιώλ Αλίρλεπζε: δηαπηζηώλεηαη ε κόιπλζε θαη εληνπίδεηαη ν ηόο Αλαγλώξηζε: αλαγλσξίδεηαη ν ζπγθεθξηκέλνο ηόο πνπ έρεη πξνζβάιιεη ην ζύζηεκα Καηάξγεζε: αθνπ αλαγλσξηζηεί ν ηνο, αθαηξνύληαη ηα ίρλε ηνπ

137 Antivirus Approaches 1st Generation, Scanners (απινί αληρλεπηέο): searched files for any of a library of known virus signatures. Checked executable files for length changes. 2nd Generation, Heuristic Scanners (επξεηηθνί αληρλεπηέο): looks for more general signs than specific signatures (code segments common to many viruses). Checked files for checksum or hash changes. Διεγρνο αθεξαηόηεηαο integrity checking: checksum-πξνζάξηεζε αζξνίζκαηνο ειεγρνπ 3rd Generation, Activity Traps (παγίδεο δξαζηεξηόηεηαο): stay resident in memory and look for certain patterns of software behavior (e.g., scanning files). 4th Generation, Full Featured (πιήξεο πξνζηαζία): combine the best of the techniques above.

138 Πξνεγκέλεο ηερληθέο αληηβηνηηθώλ

139 Χεθηαθό αλνζνπνηεηηθό ζύζηεκα

140

141 Advanced Antivirus Techniques

142

143

144 Δπίζεζε εζσηεξηθνύ πόξνπ

145

146 Δπίζεζε πνπ θαηαλαιώλεη πόξνπο κεηάδνζεο δεδνκέλσλ

147

148

149 Σηξαηεγηθέο ζάξσζεο ινγηζκηθνύ δόκπη γηα κόιπλζε ζπζηεκάησλ

150 Advanced Antivirus Techniques Generic Decryption (GD) CPU Emulator Virus Signature Scanner Emulation Control Module For how long should a GD scanner run each interpretation?