Reti di Calcolatori II - UniNa STiDuEunina.stidue.net/Computer Networks 2/Materiale/Slides/10.5 -...

1

Dipartimento di Informatica e Sistemistica, Università di Napoli Federico II Corso di Reti di Calcolatori II – Anno accademico 2007/2008

Reti di Calcolatori II

Introduction to

Information WarfareParte III

Giorgio VentreDipartimento di Informatica e Sistemistica

Università di Napoli Federico II


Nota di Copyright

Quest’insieme di trasparenze è stato ideato e realizzato dai ricercatori del Gruppo di Ricerca sull’Informatica Distribuita del

Dipartimento di Informatica e Sistemistica dell’Università di Napoli e del Laboratorio Nazionale per la Informatica e la Telematica Multimediali. Esse possono essere impiegate

liberamente per fini didattici esclusivamente senza fini di lucro, a meno di un esplicito consenso scritto degli Autori. Nell’uso dovrà essere esplicitamente riportata la fonte e gli Autori. Gli

Autori non sono responsabili per eventuali imprecisioni contenute in tali trasparenze né per eventuali problemi, danni o

malfunzionamenti derivanti dal loro uso o applicazione.

2


Why So Many Attacks?

� Systems are complex and vulnerable

� More targets and attackers owing to Internet growth

� Attackers are organized and communicate» teach each other and novices

» exchange tools and information

� Attackers developing increasingly powerful tools» exploitation scripts and sophisticated toolkits

» build on each other’s work and work of security community

� Attacks easy, low risk, hard to trace» investigations difficult; often international

� Lack of security awareness, expertise, or priorities» .0025 percent of revenue spent on information security [Forrester]


System Vulnerabilities

� Vulnerabilities arise in

» products – OS, network services, applications

» product configuration and operation – bad defaults, not installing patches

» user practices - bad passwords

� Product vulnerabilities are increasing

» systems are complex

� Most attacks exploit known vulnerabilities – maybe 99% of attacks

� Same types of vulnerabilities occur over and over again

� Many vulnerabilities give attacker “root” access

� Disclosure is big issue

3



Internet Auditing Project

� Scanned Internet (36 M hosts)

� 3 week period in Dec 98

� Used Bulk Auditing Security Scanner (BASS)» can download source code from www.securityfocus.com

� Scanned for 18 known Unix vulnerabilities

� Ran scan from 8 Unix boxes in Brazil (2), Israel, Japan, Mexico, and Russia (2)

� Found 450,000 vulnerable hosts (1.25%)

� Scanners used SSH to communicate securely

� Scanners experienced some attack-backs» one 18-hr. DOS attack against one of the Russian machines

– switched to backup

4


Vulnerability Trends

Vulerabilities Reported to CERT/CC

0

500

1000

1500

2000

2500

3000

95 96 97 98 99 00 01


OS Vulnerabilities1997 – early 2001 [Securityfocus.com]

5


Software Complexity

Windows Complexity

0

5

10

15

20

25

30

35

40

45

W 3.1

(90)

W NT

(95)

W 95

(97)

NT 4.0

(98)

W 98

(99)

NT 5.0

(00)

W 2K

(01)

W XP

(02)

Lin

es

of

Co

de

(m

illi

on

s)


SANS/FBI Top 20 List 2002 – www.sans.org

6


Weak Passwords

� Survey of 1,200 CentralNic employees found

» 1/2 used passwords with family connections

» 1/3 used passwords based on celebrities, fictional characters or sports teams

» 1/10 used self-laudatory, fantasist passwords

� “password” was the most common password in DoD


Times digitally edited out

names of participants

Cryptome found that names

could be read by freezing the

page just before full loading

(on slow computer)

Vulnerabilities

can be subtle

Same thing happened recently

With the DoD Report on the

Sgrena Accident in IRAQ

7


Vulnerability Disclosure� Full disclosure

» publish all information about vulnerability, including exploit tools

� Benefits» bad guys will figure it out; good guys need to know for defense

» vendors won’t pay attention unless pressured by disclosure

� Drawbacks» disclosure, especially of exploit tools, leads to increase in exploits

» makes it easier for hackers to develop more sophisticated tools

� Initiatives to develop responsible standards for handling vulnerabilities» IETF draft Responsible Disclosure Process

» Organization for Internet Safety (OIS) – major companies


“Windows of Vulnerability: A Case Study Analysis,”

William A. Arbaugh, William L. Fithen, and John McHugh,

IEEE Computer, vol. 33, no. 12, December 2000.

Intuitive but wrong

Vulnerability/Exploit Life Cycle

8



9


Attack Tools – More Powerful and Easy to Use


10



11



12



13



14


Challenges and Trends

� Growing number of attacks

� Growing number of attackers

� Faster attacks and propagation over network

� Growing complexity of products and networks

� Growing number of vulnerabilities» insider vulnerabilities cannot be eliminated

� Growing use of information technology and IP networks

� Pervasive, grounded, and mobile computing

� Growing power and sophistication of attacks and tools

� Impossible to prevent all attacks


Safeguards

pre-set secret codes

encrypted data

limits on # changes at once

15


Indirect threaths

� A quite problematic category of risks is related to legal and financial responibility for illegal activities

� Use of the communication infrastructure of a subject to committ a crime

» Illegal access

» D-DOS

» Copyright infringement

» Virus spread

» …


Copyright

� Much material accessible via the Internet is subject to copyright - including:

» Commercially-produced music recordings

» Videos

» Computer software

� Making copies is illegal, without permission of the rights holder

� “Personal use” is not exempt

16


P2P fileswapping

� Legal threats made against the University

� British phonographic industry now suing individuals

� 60 P2P occurrences noted during Sept 2004

� 2 turned out to be not infringing copyright


P2P Security Risks

� Unintentional uploading

� Risk of malware

� Unacceptable license conditions

17


Hope for The Future� Increased security awareness

� Increased priority

� Growing number of information security experts

� Growing security industry, with new and better products and services

� Growing number of public and private sector security initiatives, including joint public/private initiatives

� Attention from Congress and the Administration, backed by $$$ for research and education/training» President's proposed FY-03 budget includes 64% increase for

network security

� New laws to facilitate investigations

� International cooperation to fight cyber crime


Security Priority in Federal Govt

� Federal CIOs say protecting Internet infrastructure takes priority over e-government after September 11

� Infosec needed to protect against terrorism and to enable e-government

� Security Priorities

» securing the Internet against terrorist acts.

» integrating "appropriate data" to better fight terrorism.

» ensuring Internet content does not aid terrorists.

» ensuring a "robust" infrastructure with particular emphasis on telecommunications.

18


Security Priority in Microsoft

� Bill Gates memo on 1/15/02 stating security as a priority:» “Trustworthy Computing is the highest priority for all the work we

are doing.”

» “We must lead the industry to a whole new level of Trustworthiness in computing.”

» “So now, when we face a choice between adding features and resolving security issues, we need to choose security.”

» “Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve.”

� Microsoft announced on Feb 1 a month-long moratorium on new coding as part of its Trustworthy Computing Initiative

Reti di Calcolatori II - UniNa STiDuEunina.stidue.net/Computer Networks 2/Materiale/Slides/10.5 -...

Documents

Transcript of Reti di Calcolatori II - UniNa STiDuEunina.stidue.net/Computer Networks 2/Materiale/Slides/10.5 -...