#! /opt/cpg/bin/do-mgp
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%
%%deffont "standard" tfont "comic.ttf"
%deffont "standard" tfont "times.ttf"
%deffont "thick" tfont "arial.ttf"
%deffont "typewriter" xfont "courier new-bold-r"
%deffont "type2writer" xfont "arial narrow-bold-r"
%%
%% Default settings per each line numbers.
%%
%default 1 leftfill, size 2, fore "gold", back "black", font "thick"
%default 1 bimage "bg-parallel.jpg" 1024x768
%default 2 size 7, vgap 10, prefix " "
%default 3 size 2, bar "darkgreen", vgap 30
%default 4 size 5, fore "lemon chiffon", vgap 30, prefix " ", font "standard"
%%
%% Default settings that are applied to TAB-indented lines.
%%
%tab 1 size 4, vgap 40, prefix "  ", icon arc "tomato" 40
%tab 2 size 4, vgap 20, prefix "      ", icon box "spring green" 40
%tab 3 size 3, vgap 20, prefix "            ", icon delta3 "white" 40 
%%
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%nodefault
%size 7, font "thick", fore "gold", bimage "bg-parallel.jpg" 1024x768
%center, size 7

Security Risks of Emerging Technologies
%size 5
Wireless Networks and Intrusion Detection Systems

%right
%size 4
by Fyodor    
fyodor@insecure.org    
http://www.insecure.org/    


%cont, left
%image "LinksysAP2.gif"
%size 2
ACS Client Symposium;  May 17, 2001
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Online Resources

Presentation URL: http://www.insecure.org/presentations/ACS01

	Download these slides

	Pointers to additional information

	URLs for papers referenced here

	Source code & executables for my demonstration programs

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Wireless (802.11B) Risks

%pause
The biggest blunder: neglecting security completely!  Just plug in access point and begin usage. 

	Extremely frequent problem

	Allows attackers backdoor access to your network

	They can sniff traffic or join the network to mount active attacks

	Exploitation of this setup requires very little skill

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Excuses

Why would anyone leave their wireless network wide open?

%pause
	"Our access point supports 128-bit WEP encryption"
%pause

	"It is only temporary -- we will lock it down very soon"
%pause

	"We monitor the premises for intruders and would notice spies hanging out in our parking lot"
%pause

	"The access points are outside the firewall so attackers would only get free Internet access"
%pause

	Rogue networks

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

FLAWED Wireless Security Schemes

Even when security is attempted, the solutions promoted by vendors, administrators, and standards bodies are often ineffective

%pause
	"Secret" ESSID
		Most networks allow the "null" or "broadcast" SSID
		Usually sniffable, even with WEP enabled (example: Lucent "Closed Network")
%pause

	MAC Address Access Control lists
		Always sniffable (even with WEP)
		MAC can be changed on most cards

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

More FLAWED Security Schemes

Even when security is attempted, the solutions promoted by vendors, administrators, and standards bodies are often ineffective

	40/64-bit WEP ("Wired Equivalent Privacy")
		So-called "64-bit" is really only 40-bit
		Sujbject to well-known, easily automated brute force attack
		Subject to same problems as 128-bit version described next
%pause

	128-bit WEP
		Poorly designed; Contains numerous serious cryptographic weaknesses
		Very little key management support
		Proprietary vendor solutions (eg Cisco "Dynamic WEP") are only partial "band-aid" fixes

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Recommended Wireless Architecture

%image "recommendedwireless.gif"
	Wireless network on DMZ OUTSIDE of firewall
	Router only allows wireless traffic to VPN/firewall -- prevents (or at least limits) direct Internet access
	WEP not needed; Clients run same VPN software as telecommuters/travelers

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Wireless Security Resources

Berkeley WEP Cryptography Analysis: http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html

"Your 802.11 Wireless Network Has No Clothes": http://www.cs.umd.edu/~waa/wireless.pdf

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Questions about Wireless Security?

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Fun With Intrusion Detection Systems

Risks:
	Security vulnerabilities in the IDS itself
	Limitations that allow attackers to evade detection

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

How an IDS is supposed to work

Attacker command: nmap -sS -O target.com

%pause
IDS Response:
%image "BlackICE_Normalscan.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Decoy Scanning

Attacker command: nmap -sS -D12.72.193.4,51.176.79.2,94.101.211.12,42.79.122.16,192.168.7.90,10.45.161.9,48.210.38.12,12.114.187.169,96.184.127.10,63.175.91.128,95.23.114.67,123.4.61.89,179.186.23.74,72.38.20.47,12.1.13.214,215.81.17.88,119.33.21.232,23.67.25.58,161.83.32.219,147.36.19.166.64 -n -p139,12345,1080,3128,6666 -O target.com

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

IDS Response to Decoys

%image "BlackICE_Decoys.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Specific Signature Evasion

Latest Snort IDS rules relating to Nmap (as of April '01):

	icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nmap2.36BETA or HPING2 Echo ";itype:8;dsize:0; reference:arachnids,162;)
		Translation: ping packet with 0 bytes of data

	scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap fingerprint attempt";flags:SFPU; reference:arachnids,05;) 
		Translation: packet with a bunch of TCP flags set

	scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap TCP";flags:A;ack:0; reference:arachnids,28;)
		Translation: Acknowledgement packet with an acknowledgement number of 0

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Use an exploit which is not part of in the signature database


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Overload the IDS with false alarms

Attacker command:  nmap -n -sS  -S 192.168.49.49 -e eth0 -P0 -p120-139,12345,1080,3128,6666 -O target.com

%pause
IDS Response:

%image "BlackICE_SpoofedScan.gif"


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Exploiting attacker identification mechanisms

Attacker commands:
./windentd
./icepick -x target.com

%pause
IDS Response:

%image "BlackICE_AttackedbyMom.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

IDS Evasion Resources

My tools Icepick, Windentd, and Nmap are available at:
http://www.insecure.org/presentations/ACS01/

Excellent classic paper by Thomas Ptacek and Timothy Newsham on evading IDS systems
http://www.insecure.org/stf/secnet_ids

Fragrouter by Dug Song which implements many lowlevel fragmentation attacks
http://www.anzen.com/research/nidsbench/

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Conclusions

	When setup properly, both IDS Systes and Wireless networks can provide huge benefits to your organization.  However, they are very complex and improper configuration can lead to a security disaster.  When evaluating new technology, always weigh the security consequences very carefully.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page

Questions?

Any questions about IDS evasion, Wireless insecurity, or related topics?

