1. 100 slides Pondering and Patrolling Network Perimeters Bill Cheswick ches@lumeta.com http://www.lumeta.com

2. 2 of 100Pondering Perimeters Talk Outline A little personal history concerning perimeter defenses Outside: mapping the Internet A discussion of perimeter defenses Strong host security Mapping and understanding intranets

3. 3 of 100Pondering Perimeters A short bio regarding Internet perimeters Started at Bell Labs in December 1987 – Immediately took over postmaster and firewall duties Good way to learn the ropes, which was my intention

4. 4 of 100Pondering Perimeters Morris worm hit on Nov 1988 Heard about it on NPR – Had a “sinking feeling” about it The home-made firewall worked – No fingerd – No sendmail (we rewrote the mailer) Intranet connection to Bellcore We got lucky Bell Labs had 1330 hosts Corporate HQ didn’t know or care

5. 5 of 100Pondering Perimeters Action items Shut down the unprotected connection to Bellcore – What we now call a “routing leak” Redesign the firewall for much more capacity, and no “sinking feeling” – (VAX 750, load average of 15) Write a paper on it – “if you don’t write it up, you didn’t do the work”

6. 6 of 100Pondering Perimeters Old gateway:

7. 7 of 100Pondering Perimeters New gateway:

8. 8 of 100Pondering Perimeters New gateway: (one referee’s suggestion)

9. 9 of 100Pondering Perimeters “Design of a Secure Internet Gateway” – Anaheim Usenix, Jan 1990 My first real academic paper It was pretty good, I think It didn’t have much impact, except for two pieces: – Coined the work “proxy” in its current use (this was for a circuit level gateway Predated socks by three years) – Coined the expression “crunchy outside and soft chewy center”

10. 10 of 100Pondering Perimeters By 1996, AT&T’s intranet Firewall security: high, and sometimes quite a pain, which meant Perimeter security: dumb luck Trivestiture didn’t change the intranet configuration that much

11. 11 of 100Pondering Perimeters Lucent now (1997) (sort of) We’d circled the wagons around Wyoming Allentown Murray Hill Columbus Holmdel SLIP PPP ISDN X.25 cable... Lucent - 130,000, 266K IP addresses, 3000 nets ann. Murray Hill The Internet ~200 business partners thousands of telecommuters

12. 12 of 100Pondering Perimeters

13. 13 of 100Pondering Perimeters Highlands forum, Annapolis, Dec 1996 A Rand corp. game to help brief a member of the new President’s Infrastructure Protection Commission Met Esther Dyson and Fred Cohen there – Personal assessment by intel profiler “Day after” scenario Gosh it would be great to figure out where these networks actually go

14. 100 slides Perimeter Defenses have a long history

15. 15 of 100Pondering Perimeters Lorton Prison

16. 16 of 100Pondering Perimeters

17. 17 of 100Pondering Perimeters The Pretty Good Wall of China

18. 18 of 100Pondering Perimeters

19. 19 of 100Pondering Perimeters

20. 20 of 100Pondering Perimeters Perimeter Defense of the US Capitol Building

21. 21 of 100Pondering Perimeters Flower pots

22. 22 of 100Pondering Perimeters

23. 23 of 100Pondering Perimeters Security doesn’t have to be ugly

24. 24 of 100Pondering Perimeters

25. 25 of 100Pondering Perimeters

26. 26 of 100Pondering Perimeters

27. 27 of 100Pondering Perimeters

28. 28 of 100Pondering Perimeters Delta barriers

29. 29 of 100Pondering Perimeters Edinburgh Castle

30. 30 of 100Pondering Perimeters Warwick Castle

31. 31 of 100Pondering Perimeters Heidelberg Castle started in the 1300s

32. 32 of 100Pondering Perimeters

33. 33 of 100Pondering Perimeters

34. 34 of 100Pondering Perimeters Parliament: entrance

35. 35 of 100Pondering Perimeters Parliament: exit

36. 36 of 100Pondering Perimeters Why use a perimeter defense? It is cheaper – A man’s home is his castle, but most people can’t afford the moat You can concentrate your equipment and your expertise in a few areas It is simpler, and simpler security is usually better – Easier to understand and audit – Easier to spot broken parts

37. 37 of 100Pondering Perimeters What’s wrong with perimeter defenses They are useless against insider attacks They provide a false sense of security – You still need to toughen up the inside, at least some – You need to hire enough defenders They don’t scale well

38. 38 of 100Pondering Perimeters

39. 39 of 100Pondering Perimeters

40. 100 slides Anything large enough to be called an ‘intranet’ is out of control

41. 41 of 100Pondering Perimeters Controlling an intranet is hard, even if you care a lot about it End-to-end philosophy is not helpful if you are the phone company New networks and hosts are easily connected without the knowledge and permission of the network owner Security scan tools are not helpful if you don’t know where to point them

42. 100 slides Project 1: Can we live without an intranet? Strong host security Mid 1990s

43. 43 of 100Pondering Perimeters I can, but maybe you can’t “Skinny-dipping” on the Internet since the mid 1990s The exposure focuses one clearly on the threats and proactive security It’s very convenient, for the services I dare to use Many important network services are difficult to harden

44. 44 of 100Pondering Perimeters What you need to skinny dip Secure client – Only enclave computers like my laptop have access Secure communications (Κρυπτο) – AES is OK for “type 1” crypto – NSA Secure server

45. 45 of 100Pondering Perimeters Skinny dipping rules Only minimal services are offered to the general public – Ssh – Web server (jailed Apache) – DNS (self chrooted) – SMTP (postfix, not sendmail) Children (like employees) and MSFT clients are untrustworthy Offer hardened local services at home, like SAMBA (chroot), POP3 (chroot) I’d like to offer other services, but they are hard to secure

46. 46 of 100Pondering Perimeters Skinny dipping requires strong host security FreeBSD and Linux machines I am told that one can lock down an MSFT host, but there are hundreds of steps, and I don’t know how to do it. This isn’t just about operating systems: the most popular client applications are, in theory, very dangerous and, in practice, very dangerous. – Web browsers and mail readers have many dangerous features

47. 47 of 100Pondering Perimeters Skinny dipping flaws Less defense in depth No protection from denial-of-service attacks

48. 100 slides Project 2: The Internet Mapping Project An experiment in exploring network connectivity 1998

49. 49 of 100Pondering Perimeters Methods - network discovery (ND) Obtain master network list – network lists from Merit, RIPE, APNIC, etc. – BGP data or routing data from customers – hand-assembled list of Yugoslavia/Bosnia Run a TTL-type (traceroute) scan towards each network Stop on error, completion, no data – Keep the natives happy

50. 50 of 100Pondering Perimeters Methods - data collection Single reliable host connected at the company perimeter Daily full scan of Lucent Daily partial scan of Internet, monthly full scan One line of text per network scanned – Unix tools Use a light touch, so we don’t bother Internet denizens

51. 51 of 100Pondering Perimeters TTL probes Used by traceroute and other tools Probes toward each target network with increasing TTL Probes are ICMP, UDP, TCP to port 80, 25, 139, etc. Some people block UDP, others ICMP

52. 52 of 100Pondering Perimeters Intranet implications of Internet mapping High speed technique, able to handle the largest networks Light touch: “what are you going to do to my intranet?” Acquire and maintain databases of Internet network assignments and usage

53. 53 of 100Pondering Perimeters Advantages We don’t need access (I.e. SNMP) to the routers It’s very fast Standard Internet tool: it doesn’t break things Insignificant load on the routers Not likely to show up on IDS reports We can probe with many packet types

54. 54 of 100Pondering Perimeters Limitations View is from scanning host only – Multiple scan sources gives a better view Outgoing paths only Level 3 (IP) only – ATM networks appear as a single node Not all routers respond – Some are silent – Others are “shy” (RFC 1123 compliant), limited to one response per second

55. 55 of 100Pondering Perimeters Data collection complaints Australian parliament was the first to complain List of whiners (25 nets) On the Internet, these complaints are a thing of the past – Internet background radiation predominates

56. 56 of 100Pondering Perimeters Visualization goals make a map – show interesting features – debug our database and collection methods geography doesn’t matter use colors to show further meaning

57. 57 of 100Pondering Perimeters

58. 100 slides Visualization of the layout algorithm Laying out the Internet graph

59. 59 of 100Pondering Perimeters

60. 60 of 100Pondering Perimeters

61. 61 of 100Pondering Perimeters Colored by AS number

62. 62 of 100Pondering Perimeters Map Coloring distance from test host IP address – shows communities Geographical (by TLD) ISPs future – timing, firewalls, LSRR blocks

63. 63 of 100Pondering Perimeters Colored by IP address!

64. 64 of 100Pondering Perimeters Colored by geography

65. 65 of 100Pondering Perimeters Colored by ISP

66. 66 of 100Pondering Perimeters Colored by distance from scanning host

67. 67 of 100Pondering Perimeters

68. 68 of 100Pondering Perimeters

69. 100 slides Yugoslavia An unclassified peek at a new battlefield 1999

70. 70 of 100Pondering Perimeters

71. 100 slides Un film par Steve “Hollywood” Branigan...

72. 72 of 100Pondering Perimeters

73. 100 slides fin

74. 100 slides Intranets: the rest of the Internet

75. 75 of 100Pondering Perimeters

76. 76 of 100Pondering Perimeters

77. 77 of 100Pondering Perimeters

78. 78 of 100Pondering Perimeters This was Supposed To be a VPN

79. 79 of 100Pondering Perimeters

80. 80 of 100Pondering Perimeters

81. 81 of 100Pondering Perimeters Case studies: corp. networks Some intranet statistics

82. 100 slides Project 3: Detecting perimeter leaks Lumeta’s “Special Sauce” 2000

83. 83 of 100Pondering Perimeters Types of leaks Routing leaks – Internal routes are announced externally, and the packets are allowed to flow betwixt Host leaks – Simultaneously connected inside and out, probably without firewall-functionality – Not necessarily a dual-homed host “Please don’t call them leaks” – They aren’t always a Bad Thing

84. 84 of 100Pondering Perimeters Possible host leaks Miss-configured telecommuters connecting remotely VPNs that are broken DMZ hosts with too much access Business partner networks Internet connections by rogue managers Modem links to ISPs

85. 85 of 100Pondering Perimeters Leak Detection Layout Internet intranet Mapping host A Test host B mitt D C Mapping host with address A is connected to the intranet Mitt with address D has Internet access Mapping host and mitt are currently the same host, with two interfaces

86. 86 of 100Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C Test host has known address B on the intranet It was found via census We are testing for unauthorized access to the Internet, possibly through a different address, C

87. 87 of 100Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C A sends packet to B, with spoofed return address of D If B can, it will reply to D with a response, possibly through a different interface

88. 88 of 100Pondering Perimeters Leak Detection Internet intranet Mapping host A Test host B mitt D C Packet must be crafted so the response won’t be permitted through the firewall A variety of packet types and responses are used Either inside or outside address may be discovered Packet is labeled so we know where it came from

89. 89 of 100Pondering Perimeters Inbound Leak Detection Internet intranet Mapping host A Test host B mitt D C This direction is usually more important It all depends on the site policy… …so many leaks might be just fine.

90. 90 of 100Pondering Perimeters Inbound Leak Detection Internet intranet Mapping host A Test host B mitt D C

91. 91 of 100Pondering Perimeters Leak results Found home web businesses At least two clients have tapped leaks – One made front page news From the military: “the republic is a little safer”

92. 92 of 100Pondering Perimeters We developed lot of stuff Leak detection (that’s the special sauce) Lots of reports: the hardest part is converting data to information Route discovery: TTL probes plus SNMP router queries Host enumeration and identification: ping and xprobe- style host identification Server discovery: SYN probes of popular TCP ports Wireless base station discovery: xprobe, SNMP, HTTP And more…ask the sales people The “zeroth step in network intelligence” – me

93. 100 slides What’s next? IPv6 2005 + 3

94. 94 of 100Pondering Perimeters

95. 95 of 100Pondering Perimeters IPv6 deployment Has been 3 years away since 1993 Widely deployed in the Far East, and in the new cell phones Europe is getting on board US Government mandate for 2005 – But what does “IPv6 capable” really mean? None of the three ISPs I am connected to at home and work offer raw IPv6 feeds

96. 96 of 100Pondering Perimeters IPv6 address space /48s seem to be freely available: – Each US soldier will have one – One for each home 80-bit host address is a hell of a hell of a large space – ~2 * Avogadro’s Number Easy to hide hosts in that space Hard to administer hosts in that space Some interesting cryptographic and “IP hopping” applications come to mind.

97. 100 slides What’s next? Skinny dipping with Microsoft operating systems? 2062?

98. 98 of 100Pondering Perimeters XP SP2: Bill gets it “a feature you don’t use should not be a security problem for you.” “Security by design” – Too late for that, its all retrofitting now “Security by default” – No network services on by default Security control panel – Many things missing from it – Speaker could not find ActiveX security settings There are a lot of details that remain to be seen.

99. 100 slides Pondering and Patrolling Network Perimeters Bill Cheswick ches@lumeta.com http://www.lumeta.com

100. 100 of 100Pondering Perimeters