1. 102 slides Pondering and Patrolling Network Perimeters Bill Cheswick ches@lumeta.com http://www.lumeta.com

2. 102 slides Perimeter Defenses have a long history

3. 3 of 102Pondering Perimeters

4. 4 of 102Pondering Perimeters

5. 5 of 102Pondering Perimeters Lorton Prison

6. 6 of 102Pondering Perimeters

7. 7 of 102Pondering Perimeters Perimeter Defense of the US Capitol Building

8. 8 of 102Pondering Perimeters Flower pots

9. 9 of 102Pondering Perimeters

10. 10 of 102Pondering Perimeters Security doesn’t have to be ugly

11. 11 of 102Pondering Perimeters

12. 12 of 102Pondering Perimeters

13. 13 of 102Pondering Perimeters

14. 14 of 102Pondering Perimeters

15. 15 of 102Pondering Perimeters Delta barriers

16. 16 of 102Pondering Perimeters Why use a perimeter defense? It is cheaper – A man’s home is his castle, but most people can’t afford the moat You can concentrate your equipment and your expertise in a few areas It is simpler, and simpler security is usually better – Easier to understand and audit – Easier to spot broken parts

17. 17 of 102Pondering Perimeters What’s wrong with perimeter defenses They are useless against insider attacks They provide a false sense of security – You still need to toughen up the inside, at least some – You need to hire enough defenders They don’t scale well

18. 18 of 102Pondering Perimeters The Pretty Good Wall of China

19. 19 of 102Pondering Perimeters

20. 20 of 102Pondering Perimeters Heidelberg Castle started in the 1300s

21. 21 of 102Pondering Perimeters

22. 22 of 102Pondering Perimeters

23. 23 of 102Pondering Perimeters Perimeters need gateways Let the good stuff in and keep out the bad stuff This requires a bit of technology in any case – Doors, gates, murder holes, etc. A place to focus your defenses

24. 24 of 102Pondering Perimeters

25. 25 of 102Pondering Perimeters Parliament: entrance

26. 26 of 102Pondering Perimeters Parliament: exit

27. 27 of 102Pondering Perimeters One gate is not enough Too much infrastructure Low-budget gates – Sally ports – Postern gates

28. 28 of 102Pondering Perimeters Warsaw gate

29. 29 of 102Pondering Perimeters Edinburgh Castle

30. 30 of 102Pondering Perimeters Postern gate (Sterling castle)

31. 31 of 102Pondering Perimeters A short bio regarding Internet perimeters Started at Bell Labs in December 1987 – Immediately took over postmaster and firewall duties Good way to learn the ropes, which was my intention

32. 32 of 102Pondering Perimeters Morris worm hit on Nov 1988 Heard about it on NPR – Had a “sinking feeling” about it The home-made firewall worked – No fingerd – No sendmail (we rewrote the mailer) Intranet connection to Bellcore We got lucky Bell Labs had 1330 hosts Corporate HQ didn’t know or care

33. 33 of 102Pondering Perimeters Action items Shut down the unprotected connection to Bellcore – What we now call a “routing leak” Redesign the firewall for much more capacity, and no “sinking feeling” – (VAX 750, load average of 15) Write a paper on it – “if you don’t write it up, you didn’t do the work”

34. 34 of 102Pondering Perimeters Old gateway:

35. 35 of 102Pondering Perimeters New gateway:

36. 36 of 102Pondering Perimeters New gateway: (one referee’s suggestion)

37. 37 of 102Pondering Perimeters “Design of a Secure Internet Gateway” – Anaheim Usenix, Jan 1990 My first real academic paper It was pretty good, I think Coined the work “proxy” in its current use (this was for a circuit level gateway Predated socks by three years) Coined the expression “crunchy outside and soft chewy center”

38. 38 of 102Pondering Perimeters

39. 39 of 102Pondering Perimeters Lucent now (1997) (sort of) We’d circled the wagons around Wyoming Allentown Murray Hill Columbus Holmdel SLIP PPP ISDN X.25 cable... Lucent - 130,000, 266K IP addresses, 3000 nets ann. Murray Hill The Internet ~200 business partners thousands of telecommuters

40. 102 slides Anything large enough to be called an ‘intranet’ is probably out of control

41. 41 of 102Pondering Perimeters Controlling an intranet is hard, even if you care a lot about it End-to-end philosophy is not helpful if you are the phone company New networks and hosts are easily connected without the knowledge and permission of the network owner Security scan tools are not helpful if you don’t know where to point them This is not the fault of the network managers! They didn’t have the right tools!

42. 42 of 102Pondering Perimeters Highlands forum, Annapolis, Dec 1996 A Rand corp. game to help brief a member of the new President’s Infrastructure Protection Commission Met Esther Dyson and Fred Cohen there – Personal assessment by intel profiler “Day after” scenario Gosh it would be great to figure out where these networks actually go

43. 102 slides The Internet Mapping Project An experiment in exploring network connectivity 1997

44. 44 of 102Pondering Perimeters Goals Consistent, reasonably thorough description of the important topology of the Internet A light touch, so Internet denizens wouldn’t be angry (or even notice) me. Use a technology that doesn’t require access to routers – Traceroute-style probes are fast, informative, and recognized as harmless by most network administrators Clean up Lucent’s intranet

45. 45 of 102Pondering Perimeters Methods - network discovery (ND) Obtain master network list – network lists from Merit, RIPE, APNIC, etc. – BGP data or routing data from customers – hand-assembled list of Yugoslavia/Bosnia Run a TTL-type (traceroute) scan towards each network Stop on error, completion, no data – Keep the natives happy

46. 46 of 102Pondering Perimeters Advantages We don’t need access (I.e. SNMP) to the routers It’s very fast Standard Internet tool: it doesn’t break things Insignificant load on the routers Not likely to show up on IDS reports We can probe with many packet types

47. 47 of 102Pondering Perimeters Limitations View is from scanning host only – Multiple scan sources gives a better view Outgoing paths only Level 3 (IP) only – ATM networks appear as a single node Not all routers respond – Some are silent – Others are “shy” (RFC 1123 compliant), limited to one response per second

48. 48 of 102Pondering Perimeters Data collection complaints Australian parliament was the first to complain List of whiners (25 nets) On the Internet, these complaints are a thing of the past – Internet background radiation predominates

49. 49 of 102Pondering Perimeters Visualization goals make a map – show interesting features – debug our database and collection methods geography doesn’t matter use colors to show further meaning

50. 50 of 102Pondering Perimeters

51. 102 slides Visualization of the layout algorithm Laying out the Internet graph

52. 52 of 102Pondering Perimeters

53. 53 of 102Pondering Perimeters

54. 54 of 102Pondering Perimeters Colored by AS number

55. 55 of 102Pondering Perimeters Map Coloring distance from test host IP address – shows communities Geographical (by TLD) ISPs future – timing, firewalls, LSRR blocks

56. 56 of 102Pondering Perimeters Colored by IP address!

57. 57 of 102Pondering Perimeters Colored by geography

58. 58 of 102Pondering Perimeters Colored by ISP

59. 59 of 102Pondering Perimeters Colored by distance from scanning host

60. 60 of 102Pondering Perimeters

61. 61 of 102Pondering Perimeters

62. 102 slides Yugoslavia An unclassified peek at a new battlefield 1999

63. 63 of 102Pondering Perimeters

64. 102 slides Un film par Steve “Hollywood” Branigan...

65. 65 of 102Pondering Perimeters

66. 102 slides fin

67. 102 slides Intranets: the rest of the Internet

68. 68 of 102Pondering Perimeters

69. 69 of 102Pondering Perimeters Lucent’s intranet Legacy links understood and removed Network list cleaned up M&A assistance

70. 70 of 102Pondering Perimeters

71. 71 of 102Pondering Perimeters This was Supposed To be a VPN

72. 72 of 102Pondering Perimeters

73. 73 of 102Pondering Perimeters

74. 102 slides Perimeter leaks Lumeta’s “Special Sauce” 2000

75. 75 of 102Pondering Perimeters Types of leaks Routing leaks – Internal routes are announced externally, and the packets are allowed to flow betwixt

76. 76 of 102Pondering Perimeters

77. 77 of 102Pondering Perimeters Types of leaks Host leaks – Simultaneously connected inside and out, probably without firewall-functionality – Not necessarily a dual-homed host

78. 78 of 102Pondering Perimeters Possible host leaks Miss-configured telecommuters connecting remotely VPNs that are broken DMZ hosts with too much access Business partner networks Internet connections by rogue managers Modem links to ISPs

79. 79 of 102Pondering Perimeters (get technical host leak description)

80. 80 of 102Pondering Perimeters Leak Detection Layout Internet intranet Mapping host A Test host B mitt D C Mapping host with address A is connected to the intranet Mitt with address D has Internet access Mapping host and mitt are currently the same host, with two interfaces

81. 81 of 102Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C Test host has known address B on the intranet It was found via census We are testing for unauthorized access to the Internet, possibly through a different address, C

82. 82 of 102Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C A sends packet to B, with spoofed return address of D If B can, it will reply to D with a response, possibly through a different interface

83. 83 of 102Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C Packet must be crafted so the response won’t be permitted through the firewall A variety of packet types and responses are used Either inside or outside address may be discovered Packet is labeled so we know where it came from

84. 84 of 102Pondering Perimeters Inbound Leak Detection Internet intranet Mapping host A Test host B mitt D C This direction is usually more important It all depends on the site policy… …so many leaks might be just fine.

85. 85 of 102Pondering Perimeters Inbound Leak Detection Internet intranet Mapping host A Test host B mitt D C

86. 102 slides Lumeta Sept 2000

87. 87 of 102Pondering Perimeters Service offering Make sure everything works Our own experts ran it HTML report Map viewer (see below)

88. 88 of 102Pondering Perimeters Early results Early adopters They want to run tests – Like testing a cruiser on a small lake – Surprisingly subtle…IDS misses it often That’s interesting to some clients Service offering, so we can fix up the software – Surprisingly robust, especially the mapping layout software No show-stopping intranets

89. 89 of 102Pondering Perimeters Early results Maps and especially leak detection are popular, as expected

90. 90 of 102Pondering Perimeters We developed lot of stuff Routing loops Routing errors Can load expensive lines

91. 91 of 102Pondering Perimeters We developed lot of stuff Address space visualization Outliers Network usage at the class B level

92. 92 of 102Pondering Perimeters Leak results Found home web businesses At least two clients have tapped leaks – One made front page news From the military: “the republic is a little safer” Please don’t call them leaks” – They aren’t always a Bad Thing

93. 93 of 102Pondering Perimeters Case studies: corp. networks Some intranet statistics

94. 94 of 102Pondering Perimeters

95. 102 slides IPsonar 2003

96. 96 of 102Pondering Perimeters We developed lot of stuff multi-protocol ND (by service) Are there some kinds of packets that penetrate farther than others? E.g. Pings blocked, UDP probes continue Can show firewall leaks

97. 97 of 102Pondering Perimeters We developed lot of stuff service discovery The obvious service port scans We do it as gently as possible

98. 98 of 102Pondering Perimeters We developed lot of stuff Perimeter map Where exactly are the edges of your network? Are there intranet sections reached through the Internet

99. 99 of 102Pondering Perimeters We developed lot of stuff Lumeta Network Index Computes an index of your network security Objective measurement of security Clients can vary what’s important

100. 100 of 102Pondering Perimeters We developed lot of stuff Route sources What routers announce routes that aren’t in our official list?

101. 101 of 102Pondering Perimeters We developed lot of stuff Host enumeration and type Light-weight OS identification Not perfect, but very quick Non-intrusive. NOT nmap.

102. 102 of 102Pondering Perimeters We developed lot of stuff Wireless base station detection A lot of people care about this No antennas are involved We look for network signatures of base stations – User-configurable You can find them from far away Rogue ones are much less likely to evade detection than properly-run ones

103. 103 of 102Pondering Perimeters The zeroth step in network management You can’t secure what you don’t know Large investment in security stuff, now aim it correctly I don’t know how network managers run a large network without a tool like this – Legacy links are almost always there – Misconfigured DMZ hosts – Business partners – Personnel changes

104. 102 slides What’s next? IPv6 2005 + 3

105. 105 of 102Pondering Perimeters

106. 106 of 102Pondering Perimeters IPv6 deployment Has been 3 years away since 1993 Widely deployed in the Far East, and in the new cell phones Europe is getting on board US Government mandate Karl Siil and Lumeta are trying to figure all this out….we will still have perimeter defenses

107. 102 slides Pondering and Patrolling Network Perimeters Bill Cheswick ches@lumeta.com http://www.lumeta.com