Attacks

Vulnerability Laboratory:

http://www.vulnerability-lab.com/

Hackers

Do You know ?

A Different Approach to Network Intrusion Detection

There are many Intrusion Detection Systems out there. What exactly should an Intrusion Detection System or Solution do? Well that one’s sort of self explanatory, it should detect intrusions. There are host based intrusion detection solutions and there are network based IDS solutions. Host based IDS try to determine malicious processes and inter-process behavior from the perspective of a host. Network IDS solutions attempt to see malicious activity from analyzing network traffic. Network Based IDS has a particularly broad view, but is prone to false positives (falsely identifying benign traffic as malicious) and false negatives (not identifying malicious traffic). Additionally, more and more network traffic is being encrypted, thus hiding malicious payloads from IDS sensors. So in addition to the initial cost of purchasing an IDS solution, they require a lot of tuning to get useable results.

This post is about a different approach to network intrusion detection. It is certainly not meant to replace traditional IDS solutions, but can be added alongside existing solutions. This solution looks for traffic that shouldn’t exist at all. If traffic is seen using this method, it should be investigated. This stray traffic is either a result of a configuration error, or a malicious process. In addition to producing few false positives, the cost of this solution is next to nothing.

To implement this solution, a network administrator would basically black hole all address ranges that are known not to be in use and direct the traffic to a host that can capture these packets. The RFC1918 range should be a safe bet. Additionally any public IP address space that is owned by the organization, but not in use could also be used. Let’s look at an example organization’s IP address usage to understand how this might work

ACME Organization

Routing Protocol (IGP): EIGRP (summarization disabled)

IP Addresses (Internal)—

192.168.1.0/24

192.168.50.0/24

192.168.60.0/24

192.168.70.0/24

192.168.80.0/24

10.1.1.0/30

10.1.1.4/30

10.1.1.8/30

10.1.1.12/30

Public Addresses Owned: 192.0.2.0/24
Public Addresses Used: 192.0.2.1-250

In the ACME organization, we should only see IP traffic destined to IPv4 addresses in the above RFC1918 address ranges, the used public address range, and any other public IP address that are not owned by this organization. If traffic appears on the network destined to other RFC1918 address it is certainly out of place and should be investigated. Additionally packets containing a destination IP addresses 192.0.2.0 or 192.0.2.251-255 are also out of place and should be looked at.

So how do we easily capture this traffic for investigation? It is actually quite simple if we think about how routers work and how packets are converted into frames as they are handed back down the OSI model. The first concept we should revisit is the longest match rule that is used by the route table. If a router has a route to 192.168.0.0/16 and another to 192.168.50.0/24, a packet to 192.168.50.12 would match the route to 192.168.50.0/24. A packet to 192.168.33.5 would match 192.168.0.0/16. We can leverage this and inject some routes into our network. So let’s take this concept and apply it to a simple network.

Network Diagram



In the above diagram, we have a “deflection router”. This router is located just behind the firewall, but could be located anywhere in the network (as long as summary routes aren’t overriding the routes that we are about to inject). The first thing we need to do is to deflect packets going to unused RFC1918 ranges out the Ethernet interface connected to our “Sniffer Host”. To do this, we’ll set up an IP address for that interface, and create some routes.

Router(config)#interface fa0/1

Router(config-if)#ip address 10.1.1.13 255.255.255.252

Router(config-if)#no shut

Router(config)#ip route 10.0.0.0 255.0.0.0 10.1.1.14
Router(config)#ip route 172.16.0.0 255.240.0.0 10.1.1.14
Router(config)#ip route 192.168.0.0 255.255.0.0 10.1.1.14
Next we will create routes that will divert the unused public addresses.

Router(config)#ip route 192.0.2.0 255.255.255.255 10.1.1.14
Router(config)#ip route 192.0.2.251 255.255.255.255 10.1.1.14
Router(config)#ip route 192.0.2.252 255.255.255.252 10.1.1.14

Notice, I’m routing the traffic to these unknown address ranges to 10.1.1.14. Does 10.1.1.14 have to exist on “sniffer host”? Not exactly. Actually I might not even want IP bound to the sniffer hosts’ interface. This will help protect the sniffer host itself from being attacked. However, if I take this approach, I must somehow coerce the router to forward the frame anyway. Typically, the router will do an ARP lookup or request to figure out what destination MAC address to use on the frame it has to build. We can trick the router into doing this by creating a static ARP entry. In this diagram, we are directly connecting a host to the router via crossover cable so the host will receive all frames produced by that interface (we just need to remember to put the sniffer’s NIC into promiscuous mode when we start to capture traffic).

Router(config)#arp 10.1.1.14 abcd.abcd.abcd arpa

Now the router understands the egress interface for these packets based on the route statements and the interface that is connected to the 10.1.1.12/30 network. The static arp entry gives the router the information that it needs to “frame” the packets. As long as the interface is up and the router doesn’t have more specific routes to a destination, it will send these packets to the sniffer host.

Earlier I pointed out that this router is in the path to the firewall but it could be located anywhere in the network. Keep in mind that if summary routes are being used, that may need to be evaluated. If this router isn’t already in the path of all packets (aka the default gateway), the routes can be injected into the IGP. This might look something like the following.

Router(config)#router eigrp 1
Router(config-rtr)#redistribute static

Now all we need to do is connect the Sniffer Host to our router via a crossover cable and start our favorite sniffer program. We don’t even need an IP address or the IP Protocol bound on the sniffing interface. A good technique for capturing traffic might to be using dumpcap (part of the Wireshark package) to capture anything destined to MAC address abcd.abcd.abcd and storing it in a file. For example, create a directory called “c:\caps” and enter the following command.

C:\Program Files\Wireshark>dumpcap.exe -i 2 -b duration:86400 -b filesize:50000 files:1000 -f "ether host ab:cd:ab:cd:ab:cd" -w c:\caps\badtraffic.pcap

The above command uses dumpcap to capture traffic on interface 2. The interface number is entered following the “-i” parameter. To determine the interface numbers use for a system, use the following command “dumpcap –D” (case sensitive). The parameters following the “-b” parameters are the ring buffer options. These tell dumpcap when to create a new file. In this case, a new file would be created at least once every 24 hours, the files would never exceed 50MB, and 1000 files would be retained. This should keep space consumption below 50GB. The string following “-f” limits the capture to the frames that contain the MAC address abcd.abcd.abcd (from the static arp). Finally “-w” directs dumpcap to save this contents to a file in the c:\caps directory. The filenames will be based on badtraffic.pcap but will also include a timestamp in the filename.

Now that we have this in place, we can easily test it. To do so, simply ping an address from an RFC1918 address space that is not in use. For the ACME network, we could ping 192.168.254.200. It is a good idea to test this from various points in the network. These packets should make it to our capture file. Double clicking the capture files should open it in Wireshark. We can now investigate the file for any signs of configuration errors or reconnaissance against our internal network. While this is not a comprehensive IDS solution, it is a good way to see when an internal host has been infected with something that it is trying to propagate to other internal hosts.

Ever heard of Layer 8?

In the networking world many are taught the Open Systems Interconnection model or OSI model of networking.  The OSI model is described as a layered approach of how data travels in the network.  The layers taught in any networking class are, starting from the bottom and working your way up:

Application Layer

Presentation Layer

Session Layer

Transport Layer

Network Layer

Data Link Layer

Physical Layer

However, for years I have always heard the joke about Layer 8.  Now although the OSI has no official designation of such a layer, it has been my experience that such a layer may exist!  In fact, Cisco even addresses this “layer” in their CCDA certification although they do not refer to it as a Layer of the OSI, which they are correct.

In the CCDA, it is taught that in order to make a good design you need to know what the business and technological requirements are and you have to live within the business and technological constraints.  Think about that for a minute.  You have to design a network to deliver who knows what and you have to do it with certain constraints, usually a limited time line or budget.  Have you ever found yourself in a meeting where a customer wants what is technologically impossible, against their company policy or so expense that not even all the money in the world could afford what they want?  I have… often.  To make matters worse the customer may have multiple people present the business and technological constraints and goals and they may conflict with another person’s goals and constraints within the same organization.  Then comes the process of debating, negotiating, hashing out the details to find some kind of compromise and to find a solution that will meet all of the goals and be achievable within the constraints that exist.  It is this process that I refer to as the Layer 8.

If you have not had this experience, consider yourself fortunate.  However as unpleasant as such a situation may be, there are some good learning opportunities for both the design engineer and the customer.  In fact, during this political process as I choose to call it, I have learned a great many things that have been beneficial to help me increase my understanding and help the customer increase theirs!

·      Education and understanding is key when going through the “Layer 8” or “political” process.  During such meetings I have come to realize that more often than not, the customer doesn’t even know what they want themselves!  They just want a solution to work and to be as convenient and easy as possible and they want it for next to nothing.  Listen, really listen to your customer and restate what they are telling you to make sure you understand the feedback they are giving you.  They may be surprised at what you understand from then.

·      Ask who, what, when where, why and how questions.  This will be extreamly helpful in getting the customer to really think deeper and consider the outcome. 

·      Explain in basic principles how technology works.  Some people really don’t want to know the deep details, however, give your customer enough understanding to help them make an informed decision.  It is been amazing to hear customers” gratitude for explaining technology to them. 

·      Give people options.  My kids really don’t care for being told what do to or how to do it.  Customers can be the same way.  Instead of dictating to them what they should be doing (even if you are right), give them options and explain the pros and cons of each option.  Remember it is ultimately their decision, not yours.  Help then to make decision via the process of elimination.  Objectivity is a must!

·      Control emotions!  I cannot stress this enough.  It can make or break a deal, get you promoted or fired!  It is difficult, but it can be done.  People are passionate creatures and that is ok, as long as the passion is controlled.  If it gets out of hand, you may find yourself having a Darth Vader conversion moment and that is not going to help yours or your customers situation. 

·      Document!  The old saying “the customer is always right” rings true, even when they are wrong.  We all make decision, some good and some bad.  All those decisions have some kind of consequence, some good, some bad.  When participating in the Layer 8/political process, acknowledge ownership where it is due.  This is a joint effort and there must be joint responsibility.  Documentation is the key to not only hold people responsible but serves as a reminder of what is discussed, agreed upon and finally decided.  Documentation helps serve as a reminder to everyone.  I can’t remember everything that is discussed in a meeting, but having good notes and documentation sure helps remind me of things and helps to keep me in check.

The Layer 8/political process isn’t for everyone.  Some love it, others hate it.  I love to see customers enlightened as I explain technology to them on their terms.  I really don’t care to be the mediator of a heated debate.   Oh how glad I would be if I had the Enterprise transporters to get me out of those situations!  Unfortunately, that isn’t an option so the mentioned points are the things that have helped me get through the Layer 8/political process.  For a designer, there is much more than technology skills that are needed.  Good personal and communication and negoation skills or "soft skills" are an absolute must to survive this process.

----------
Ref:Cisco.com

Five Tips to Keep Your Career Moving Forward

Now that 2011 is coming to an end and 2012 will soon be upon us, many will be making New Year’s resolutions. The most popular resolutions probably relate to health. However, many people also include career goals in their resolve. With the continuing economic challenges, it is tough but not impossible to feel like personal career growth is continuing. This article is only peripherally related to our current series of discussions on job roles and tasks. This is article is a New Year's Article that focuses on five key things that everyone can do to help keep their careers moving forward, even in tough economic times.

Tip 1 - Find a Mentor

Finding a mentor may be a challenge. In many cases people tend to keep what they know to themselves. Some people seem to think that if they are the only person that can do a task, they are more valuable to the organization. Furthermore, some people like to place themselves high on a pedestal and have the desire to stay there. I think we have all met people like Nick Burns. I doubt Nick would make a good mentor.

For those unfamiliar with Nick Burns, here is a video excerpt from Saturday Night Live.

A good mentor is someone that you can trust and who can help you stay on track. This is not a person that does everything for you when you get in over your head. This is a person who gently steers you in a direction that is conducive to your career or your particular role in an organization. This person can not only be beneficial for career goals, but also for specific tasks that may be a stretch for your abilities. The challenge is finding someone that is willing to take the time to share their experiences. If you cannot find someone within your immediate circle, you can always have lunch with others in the industry and learn from each other’s experiences.

Tip 2 - Build your Network

There are many networks out there, so let me elaborate. There are social networks like Facebook, Twitter, Google Plus, and LinkedIn. What I’m talking about here is YOUR network. It may consist of contacts that you have met personally, as well as a subset of individuals from any or all of the social networks I mentioned. What is important is that you start to build solid relationships for a couple of reasons. You never know when you might need a “go to” person or a subject matter expert in a particular area. Additionally, making others aware of your areas of expertise or experience can be beneficial. People are in YOUR network if you feel comfortable reaching out to them and they feel comfortable reaching out to you. Don’t abuse your network. It should be a “qui pro quo” arrangement that is mutually beneficial for you and them.

Tip 3 - Help Others

Helping others is sort of the opposite of finding a mentor. Helping others can actually help you in many ways. First, there is no better way to solidify concepts than pushing your knowledge to the point that you can explain something simply. I am not advocating that someone should share their knowledge about something that they know nothing about. However, an individual that has worked with a specific topic or technology often will initially struggle to explain it. Working through this struggle often leads to a much deeper understanding.

If you can't explain it simply, you don't understand it well enough. -Albert Einstein

Tip 4 - Continue Learning

Since you are reading an article on The Cisco Learning Network, you may naturally desire to continue learning. This is a good thing. With networking technology, I do not think there is a point that you look at yourself and think “I have arrived”. Like other career choices in technology, we must be comfortable with change. The value that you bring to an organization is your ability to work with that change. Your thirst for knowledge should not just be in deeper understanding, but also broader understanding. How technologies interact with one another is as important as knowledge about the individual technologies. Nothing lives in a vacuum anymore. All areas of technology are interoperating with other areas to achieve some business goal. Although the fact that someone can configure a router or a switch is very important, companies are looking for people that can solve the business goals and challenges.

Tip 5 - Keep your life in Balance

If you love the challenges of technology, keeping your life in balance may be difficult. I think it is important to keep your relevant areas such as family, church, health, and personal time in check. Others tend to view your priorities based on how much time you spend nourishing each of the “loves” in your life. This is valid because we tend to spend more time with those things we enjoy. So if technology is dominating ALL of your free time, you may need to schedule “technology free” times to balance out your life. I have personally witnessed family or personal issues that have had serious adverse effects on individuals’ careers.

Conclusion

I think everyone knows that many challenges exist in the current job market. The challenges seem to be even more prevalent with those who are young or inexperienced to the field in which they are seeking employment. Although technology jobs are more prevalent than some other fields, challenges still exist. If you are not employed, my recommendation is to do what you can to get employed. Even if your employment is less than what was expected, there is always room for growth. For those employed, focusing on these five tips will help keep their careers on track. As new and exciting challenges present themselves, simply gravitate to the areas that are of interest to you.

Ref:

CCIE Career

Sydney Lab View

This is the meeting area from you can see the city view as well.