1. Security fundamentals Topic 6 Securing the network infrastructure

2. Agenda • Security at the TCP/IP layers • Security at the physical layer • Securing network devices

3. Network layer attacks • MAC address spoofing • Attackers can create packets with the MAC address of a different computer and impersonate that computer • Denial of Service (DoS) • Overloads a single system so that it cannot provide the service it is configured to provide • Sends frames designed to use up all the resources of the target device • ARP cache poisoning • Incorrect or spoofed entries are added to the ARP cache – messages are sent to incorrect destinations

4. Internet layer attacks • IP address spoofing • Source addresses of IP packets are spoofed to impersonate another computer • Man-in-the-middle attack • Attacker intercepts and reads or modifies packet contents without the knowledge of the source or destination computers • Denial of Service • Attacker overloads the TCP/IP stack with a large number of invalid packets which prevents processing of legitimate packets • Attacker changes entries in routing tables to prevent delivery of packets • Incorrect reassembly of fragmented datagrams • Offset field used to reassemble fragments is changed so that they can’t be reassembled correctly – datagram could pass through a firewall when it shouldn’t • Avoiding detection by fragmenting datagrams • An attacker might fragment a packet to hide patterns (such as virus signatures) to avoid detection • Corrupting packets • Information in IP header fields is modified

5. Transport layer attacks • Manipulation of UDP or TCP ports • Attacker can format packets so they appear to come from a port allowed by the firewall • Denial of service • SYN flood attack to leave sessions half open until router cannot accept anymore connections • Session hijacking • After the connection is established, attacker predicts TCP sequence numbers and takes over the connection with his own segments

6. Application layer attacks • Specific to the application layer protocol • Common attacks exploit: • Email protocols • Web protocols • DNS

7. Network cabling security • Coaxial cables • Cutting or destroying cables • Noise from EMI or RFI • Removing a terminator • Eavesdropping traffic by tapping into coaxial cable at any point on network • Mitigation • Protect the Cable: bury it, inside walls, tamperproof containers • Document the cable infrastructure • Investigate all outages • Inspect your cables regularly • Investigate undocumented hosts and connections

8. Network cabling security • Twisted pair • Cutting or destroying cables • Noise from EMI or RFI, STP mitigates the impact of EMI and RFI • Mitigation • Protect the cables • Protect the switches and patch panels • Document the cable infrastructure • Investigate all outages • Inspect your cables and infrastructure regularly • Investigate undocumented hosts and connections • Eavesdropping • Using a protocol analyser or packet sniffer (requires physical connection) • Splicing into a cable • Listening to electromagnetic signals from the signals passing through the wire

9. Network cabling security • Fiber optic cables • Bend or snap the cable • Any damage will disrupt the signal • Eavesdropping • Virtually impossible – requires cutting cable and polishing ends and connecting a device • Mitigation • Protect the cables • Protect the switches and patch panels • Document the cable infrastructure • Investigate all outages • Inspect your cables and infrastructure regularly • Investigate undocumented hosts and connections

10. Device security • Compromising switches and bridges • If an attacker has physical access, he can disable a switch • Attach a computer to a span port which receives all switch traffic • Transmit frames with spoofed MAC address to corrupt the MAC address table • Flood the switch with frames to disrupt operations • Gaining administrative access • Port mirroring: map the input and output of one or more ports to a single port to eavesdrop on communications • Change the MAC address table to redirect traffic • ARP cache poisoning • Attacker can overwrite entries in the ARP cache allowing attacker to eavesdrop or hijack a session

11. Securing switches and bridges • Physical security • Limit physical access, use security personnel and monitoring (cameras) • Protecting admin functions with passwords • Set complex passwords and change routinely • Restrict access to few staff • Manually enter ARP mappings on critical devices: servers, switches and bridges • Keep up to date with patches • Document configurations so you know what is normal and authorised • Monitoring for security breaches • Monitor devices for unauthorised connections • ARPWATCH to monitor traffic and keep MAC-to-IP address mappings

12. Securing routers • Compromising routers • Susceptible to ARP cache poisoning • Routing tables can be changed either administratively or with incorrect routing updates • RIP spoofing – updating routing tables with bogus updates • ACLs can be changed if admin access is compromised • Insecure protocols, services could be enabled

13. Securing routers • Keep routers in secure locations: locked server rooms and wiring closets • Secure all physical connections to network segments • Use security personnel and monitoring (cameras) • Set complex passwords and change regularly • Keep up to date with latest patches • Restrict staff with access and locations access can come from • Set ACLs to prevent inappropriate connections • Set passwords for routing updates • Disable insecure protocols and services • Document and regularly review the network

14. Securing telecommunications • Compromised by • Free long distance calls by changing billing records • Compromise or shut down the organisation’s voice mail system • Reroute incoming, transferred or outgoing calls • Gain access to voice mail boxes of employees

15. Securing PBX systems • Vulnerabilities • Insecure or default passwords are used • Older PBX systems don’t implement latest security technology • Lack of knowledge and security procedures: social engineering • Remote management connections could be compromised • Unused floors and offices may have active connections • Protecting PBX • Physically securing PBX equipment • Control access to PBX wiring room and switching equipment • Document • Routinely check unauthorised connections • Secure offsite transfers with passwords (for updates) • System exclusion lists to limit long distance calling • Shut down services not required during off days and hours • Educate users • Enforce PBX password change and audit policy • Secure maintenance ports, limit entry ports, log all system access

16. Securing modems Compromising modems • Can be used to circumvent firewall security • Can be used to provide direct access to internal computers • War dialling to discover computers with modems attached Mitigation • Remove all unnecessary modems • If modem is required for outgoing calls make sure it is configured not to accept incoming calls • Software/security updates for computers with modems • Monitor security bulletins • Isolate computers with modems to limit the damage • Monitor computers with modems to ensure they have not been compromised

17. Lesson summary • What some TCP/IP layer attacks are, and security practices • What some physical layer attacks are, and security practices • Practices for securing network cabling and network devices and threats associated