1. INDIANAUNIVERSITYINDIANAUNIVERSITY Automated Network Isolation at Indiana University David A. Greenberg Information Technology Security and Policy Office Indiana University Copyright Indiana University 2006. This work is the intellectual property of the author. Permission is granted for this material to be shared for non- commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author."

2. INDIANAUNIVERSITYINDIANAUNIVERSITY Indiana University Founded in 1820 8 campuses ~100,000 Students ~18,000 Faculty and Staff http://factbook.indiana.edu/fbook05/fast_facts/fastfacts1.shtml

3. INDIANAUNIVERSITYINDIANAUNIVERSITY IT Security and Policy Office Reports directly to CIO University-wide office Staff responsible for a wide range of technologies

4. INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Coordinating response to incidents of abuse or inappropriate use of information or information technology, such as: –Computer and network security breaches –Unauthorized disclosure or modification of electronic information –Denial of service attacks –Port probes, scans –Identifying virus infected machines –Copyright infringement (DMCA) –Forgery, fraud, harassment, chain mail, etc.

5. INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Process Reports sent in to our tracking system Gather supporting technical data Interact with computer security officers to assist with technical investigation Package technical information for IU governance agencies, IU legal counsel, law enforcement, prosecutors, university administration, etc.

6. INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Statistics

7. INDIANAUNIVERSITYINDIANAUNIVERSITY What types of common blocks exist? On Campus –DHCP lease –Switch port –Null Route –Router ACL Remote Access –Dialup modem pool –VPN access

8. INDIANAUNIVERSITYINDIANAUNIVERSITY Null Route A route that goes nowhere > route add 192.168.1.1 mask 255.255.255.255 0.0.0.0 Unicast Reverse Path Filtering (RPF) –Prevents traffic sourced from the null routed IP

9. INDIANAUNIVERSITYINDIANAUNIVERSITY Internet 129.79.0.00.0.0.0 Router Null Routing

10. INDIANAUNIVERSITYINDIANAUNIVERSITY Block characteristics The device can communicate with other hosts on the same VLAN, yet is not routed beyond. Typically used as an easier to implement switch port block.

11. INDIANAUNIVERSITYINDIANAUNIVERSITY Null Route Pros –Blocks take effect almost instantaneously –Can block many devices efficiently –Integration with web interface and shell interface Cons –Devices on same VLAN still exposed to threat –Reporting limited (no means to associate IPs belonging to computer support staff yet) –Only keeps track of IPs –Not suitable for dynamic ips

12. INDIANAUNIVERSITYINDIANAUNIVERSITY IU Core Network Map

13. INDIANAUNIVERSITYINDIANAUNIVERSITY Automated Network Isolation (ANI) The coupling of Network Intrusion Detection and Null Routing made easy In a nutshell –ITSO Intrusion Detection Sensors (IDS) detect malicious activity –IDS notifies Null Route Injector “hub” to block IP –ANI block is set with an expiration time of 10 mins Limited view ability

14. INDIANAUNIVERSITYINDIANAUNIVERSITY ANI cont’d Ideal for people that have the authority to block devices from the network but do not maintain network hardware. Initial automated ANI rollout focused on only one IDS rule, with fairly low incidence and high confidence.

15. INDIANAUNIVERSITYINDIANAUNIVERSITY

16. INDIANAUNIVERSITYINDIANAUNIVERSITY

17. INDIANAUNIVERSITYINDIANAUNIVERSITY Block List

18. INDIANAUNIVERSITYINDIANAUNIVERSITY 3-way Handshake SYN SYN + ACK ACK FIN ACK FIN ACK CLIENTSERVER

19. INDIANAUNIVERSITYINDIANAUNIVERSITY SSH brute force attack 13:01:34.006421 IP 128.148.y.z.22 > 129.79.aa.bb.49343: F ack 13:01:34.006432 IP 128.148.y.z.22 > 129.79.aa.bb.49358: S ack 13:01:34.006812 IP 129.79.aa.bb.49343 > 128.148.y.z.22:. ack 13:01:34.006872 IP 129.79.aa.bb.49358 > 128.148.y.z.22:. ack 13:01:34.076087 IP 128.148.y.z.22 > 129.79.aa.bb.49358:. ack

20. INDIANAUNIVERSITYINDIANAUNIVERSITY SSH attack after ANI block 13:01:43.325296 IP 129.79.aa.bb.44337 > 128.148.x.y.22: F 0:0(0) ack 13:01:43.973671 IP 129.79.aa.bb.49358 > 128.148.a.b.22: F 469:469(0) ack 13:01:44.723014 IP 129.79.aa.bb.49358 > 128.148.a.b.22: F 469:469(0) ack 13:01:45.117176 IP 129.79.aa.bb.50781 > 128.148.c.d.22: F 468:468(0) ack 13:01:45.192800 IP 129.79.aa.bb.44319 > 128.148.c.d.22: F 449:449(0) ack 13:01:45.194553 IP 129.79.aa.bb.48956 > 128.148.e.f.22: F 468:468(0) ack 13:01:45.237350 IP 129.79.aa.bb.44576 > 128.148.g.h.22: F 469:469(0) ack

21. INDIANAUNIVERSITYINDIANAUNIVERSITY Additional Resources Indiana University IT Security Office –http://itso.iu.edu/ IU Knowledge Base –http://kb.iu.edu/ Indiana University –http://www.indiana.edu/

22. INDIANAUNIVERSITYINDIANAUNIVERSITY

23. INDIANAUNIVERSITYINDIANAUNIVERSITY

24. INDIANAUNIVERSITYINDIANAUNIVERSITY Data submission my $wddx_data = { requestor => "$user via sniffer", action => "BLOCK", ipaddr => $ipaddr, expire => $expire_time, itso_reason => $sig, itpo_incident => "$incident" };