TMG Client Protection 6NPS – Session 7

Objectives Understand and implement malware inspection Understand and implement URL filtering Understand E-mail threats and TMG SMTP protection Understand application filter and implement HTTP & HTTPS inspection.

Malware Inspection in TMG Many of the malware found in networks today is brought in on user’s laptops. Many malware are also downloaded by naive users TMG Malware Inspection was designed to detect and stop the evil bits in the HTTP stream that is sent to clients in protected networks before the evil bits can gain access Malware Inspection operates as one of the TMG Web filters.

Malware Inspection in TMG The main goals of TMG Malware Inspection are: Minimize the threat imposed by Web-sourced malware Provide malware defence for hosts in TMG-protected networks Minimize the impact on TMG performance Provide a mechanism that is reliable and flexible By default, TMG installs with a basic malware detection signature database. Can use Microsoft Updates or manually update malware inspection can be enabled globally or on a per rule, source, destination or user basis

Practice: Configuring Malware Inspection Configure Malware Inspection (Page 432) www TMG Win7 Internet DC

URL Filtering How URL Filtering Works URL filtering enhances TMG firewall policies by controlling access to Web sites based on their URL category membership This feature works dynamically. Web sites categorized by the MRS are posted to Microsoft Update (MU) and downloaded from MU by TMG. MRS aggregates reputation data from multiple vendors and uses telemetry to improve data accuracy.

URL Filtering User sends a request for a Web site. TMG intercepts the request and determines whether URL categorization is needed. TMG needs to determine the category to which this URL belongs to allow or deny this traffic based on the rules available. If URL categorization is needed, name resolution is done for the URL and the URL is matched to category. When URL categorization is not needed, TMG marks the request as not categorized and logs the category to be used in case it needs to send a denial to the user. The rule allowing the request is then matched and TMG determines whether the rule allows or denies the category. If categorization is needed at the rule, a request marked as not categorized is blocked and a denial is sent to the user; otherwise, the rule verifies the category matched and then TMG allows or denies the action based on whether the rule allows that category.

Practice: Configuring Malware Inspection Configure URL Filtering(Page 470) www TMG Win7 Internet DC

Enhancing E-Mail Protection E-mail has been used by hackers to distribute malicious content to users. Networks have been breached by attacks using malicious code and worms that bypass the protection offered by a common firewall as they tunnel the malicious code through the e-mail protocol as most firewalls don’t inspect e-mail content. As e-mail can include file attachments, hackers can send malicious code in. E.g. The Melissa virus in 1999 and the ILOVEYOU e-mail virus in 2000. Hackers are ableto inject code through e-mail to run custom applications automatically while the end users were reading their e-mail because of the prevalence of the HTML e-mail format; worms and viruses such as the KaK worm, BubbleBoy virus, and Nimda virus have used HTML-rendered e-mail to spread.

E-Mail Attack Methods E-Mail Attachments with Malicious Code Melissa AnnaKournikova SirCam ILOVEYOU Took advantage of trusts between people in your contacts Malformed MIME Headers The Multipurpose Internet Mail Extension (MIME) is an Internet standard MIME headers specify fields such as date, filename, or subject line. In Outlook Express the date and filename fields were susceptible to buffer overflow attacks. Hackers could execute arbitrary code on the victim’s computer e.g. Nimda Embedded Scripts and ActiveX Content HTML Email formats can allow programs or code to be executed on the target computer e.g. KaK worm and BublleBoy virus Spam and Phishing

How SMTP Protection Works Exchange 2007 SPAM protection Exchange 2007 offers strong message filtering capabilities, such as connection filtering, sender and recipient filtering, and sender ID and reputation. Forefront Protection 2010 for Exchange Server Forefront Protection 2010 for Exchange Server extends Exchange Server 2007 e-mail filtering capabilities by adding enhanced malware protection through the use of multiple anti-malware engines. TMG SMTP filter and centralized management The SMTP application filter verifies the SMTP conversation by validating the SMTP verbs against a predefined list and the current SMTP protocol state. TMG also provides a single place from which to manage the e-mail protection features in Exchange 2007 anti-spam and anti-virus and Forefront Protection 2010 for Exchange Server.

HTTP & HTTPS Inspection The Web Proxy Application Filter The main purpose of the Web Proxy application filter is to process HTTP and HTTPS inspection. The Web Proxy filter provides compression, authentication, and caching features through the use of Web filters, which operate as plug-ins to the Web Proxy filter.

HTTP Filter The HTTP Filter is an application-layer filter used by the Web Proxy engine for HTTP protocol application-layer filtering. The HTTP Filter provides granular control over HTTP communication by examining HTTP commands and data. Can’t block the protocol HTTP as this is required for accessing resources on the internet. But many unwanted application also use HTTP i.e. Kazaa, Messenger, WebDav, etc The TMG HTTP Filter helps you restrict traffic by blocking requests according to several HTTP features such as HTTP headers, length and URL patterns, HTTP method, HTTP body content and content-types, and file extensions. TMG HTTP filtering configuration is rule specific, so that you can apply different levels and types of filtering depending on the specific requirements of your firewall policy.

SAMPLE Practical Test Test1 Session 8 Practical & Theory 2 hours Total Theory test 1hour max (Closed book) Practical test 1remaining of the 2 hours (open book ie. Textbook, worksheets and power points ONLY) SAMPLE Practical test