CEH: Secure Network Infrastructures: Analyze Firewall and IDS Penetration Testing
Classes of Firewalls
There are many different types of firewalls on the market and each has its place on the network. Many commercial products, sometimes referred to as “Internet-in-a-box” appliances, combine each of these types including infrastructure features such as routing and DMZs (Demilitarized Zones). However, it is critical for CEH that we take some time to understand the separate concepts.
Packet filters
Packet filters look for protocol information in the delivery and transport layers. The idea is to get rid of the easiest and obvious stuff first.
Every packet is a discreet single logical unit, much like the way an envelope that is received in the “snail mail” box is just one single package. Packet filters only look at one delivery at a time. They are computationally cheap and very efficient.
Circuit level gateways
This is a unique class of firewall that protects the integrity of each end of the session without invading the confidentiality of the data that is exchanged. It is a socket-level proxy in that it creates entirely new connections based on the synchronizing of IP addresses and ports.
It takes the concepts of network address translation a step further by including a new translation of the sequence numbers that are tracked by TCP to help the receiving host reassemble all of the segments of data. This prevents session hijacking and helps obscure the true endpoints of any observed conversation.
Application level firewalls
Application firewalls look at the content of each network packet, otherwise described as “Layer 7.” This data includes all client server requests and information content that is delivered on the network.
This form of firewall is computationally expensive. Many factors that ride far beyond simple string pattern matches must be incorporated. Context is a factor as well as policies such as user profiles and time of day constraints. If a violation of policy is encountered, it must be considered whether or not to log the evidence in a forensically sound manner, redirect the user to another source, or simply log an alert and let human management make the call regarding appropriate actions.
Stateful multilayer inspection firewalls
This firewall class combines the aspects of the other three types. They filter packets at the network layer to get rid of the easiest stuff first and then send the remaining packets to the “deep packet inspection” engine.
Classes of Intrusion Detection Systems
Intrusion detection is a critical aspect of network monitoring. It is considered a “passive” technique in that detection only informs us that an event has occurred, but it does not by default prevent or correct the situation.
Intrusion prevention systems also exist that take this monitoring to an “active” level. Attackers can sometimes use false positives to turn these systems against their owners. The configuration and testing of these devices is critical and might be something a CEH professional is asked to do.
There is no “right choice”. It is about the best fit for the purpose. Passive IDS can be prone to false positives and rely on administrative overhead in the form of analysis, but it can look for a broad range of suspicious activity. Active IDS can create DoS situations if false positives are present; therefore it must be finely tuned and will generally look for a narrower scope of events.
Context based “deep packet inspection” products are available that can provide important services for forensic needs, and uses much the same technologies as proxy based firewalls in the same class of sophistication. An attacker should try to understand the security policy of the target in advance because these IDS will be hard to detect if they are properly installed.
Placement of detection agents also plays a role in the type of system that is chosen. There should always be an agent in the DMZ, and one just to the inside of the firewall that screens all internal networks.
Whether passive or active, there are many approaches to intrusion detection. Let’s take a quick look at a few techniques and terms that will help on the CEH exam:
Signature recognition
Signatures are simply recognizable characteristics of a packet; for instance, a particular series of bytes or characters. The position (offset) of particular bytes can also be of significance, also specific field values or protocol flag combinations.
Signature detection happens in real time. Alerts can be placed in a log file immediately after a suspect packet is detected. Notifications can then be sent, and an IRP (Incident Response Plan) is activated is there is one in placeThis is often one of the greatest weaknesses of IDS implementations, by the time the attack is noticed the objective may have already been met and the attacker might be long gone, or has changed the nature of his presence.
Alternatively, if the IDS is running in “in-line” mode, it can interact with firewall software to implement new policy rules to block the attack. This is an IPS (Intrusion Prevention System).
The drawback to signature detection is in the complexity and amount of the rule set that must be used. It must be updated constantly, and will not detect 0-day exploits. These are attacks for which are are not yet any signature rules available.
Anomaly detection
This type of IDS looks for events that are unusual. This means that knowing what normal traffic is becomes critical. A baseline metric of typical and expected traffic is given to the IDS. It then provides an alert when events other than what the baseline predicts take place.
The advantage of this form of monitoring is that certain types of attacks that would evade signature analysis might be noticed. Attacks such as ARP poisoning or heavily fragmented packets will cause unusual traffic that can be noticed. The drawback is this IDS is only as good as the accuracy of its baseline.
Statistical detection
This form of IDS can notice attacks that take place over time. If an attacker tries to scan very slowly for instance, it has been proven that even one packet per day at random times and with random values could trigger an alert. The drawback is that the analysis takes time; attacks may not be discovered until they have been completed, but at least the target will know the event has happened.
Network-based intrusion detection
This type of IDS is considered passive as it just “listens on the wire.” Any form of analysis engine can be used.
Host-based intrusion detection
This type of IDS is considered active as it can be invasive in order to monitor the behavior and actions of a host. For example, if a host sends out three e-mails within a fraction of a second that all have blank subject lines and empty contents, this could be considered suspicious. The HIDS will block all e-mail activity and ask the user if this action was intended or not before continuing.
Log file monitoring
Log files are a challenge to analyze because there are thousands of formats and each one is unique to the service being monitored. There are commercial tools that know about many popular formats and can make reporting much easier. They can even be used for real-time intrusion detection.
File integrity checking
SIVs (System Integrity Verifiers) are a class of IDS that keeps a database of hashes computed from critical files or directories on the system. It recalculates these hashes either periodically, or whenever the file is accessed, and presents an alert when changes have been detected.
This IDS discovers files that have been replaced, altered, or corrupted; therefore, files that change often are difficult to monitor. Operating system files and program libraries do not commonly change, and new hash databases must be computed after accepting patches or other security updates.
Interpreting Alerts
Whenever alerts to events are logged, it is up to a human analyst to determine if a response action is appropriate and exactly what that response should be. Knee-jerk reactions, overcorrections, and time wasted in response to non-issues are not only a waste of time but can create new problems.
It is important to keep in mind that IDSs only look for what they have been told to. Just as the case with firewalls, a strong policy is at the heart of any monitoring and incident response program.
For analysis, IDS alerts can be sorted into the following categories:
False positive
|
We thought it was an attack, but it wasn’t.
|
False negative
|
We didn’t think it was an attack, but it was.
|
True positive
|
Yes, it is really an attack!
|
True negative
|
No, it is not an attack.
|
Events to Look for During Analysis
The best monitoring program will include redundancy and many different methods of detection. Each threat category has its own risk factors to the organization which determine how the asset should be monitored.
A simple way to look at it is to consider the difference between a public web server and a database. The web server should be accessed a lot—at least, we hope many customers are visiting us—but certain types of access such as obvious directory traversals indicate one of our visitors is trying to scrape us for documents or detect other flaws. It could also just be a search engine spider. Regardless, if we know from our thorough testing there is nothing to find, most of that activity is expected and will be ignored.
The database server, on the other hand, should only be accessed by authorized processes, and only when those processes are running correctly. They should only attempt to perform certain actions. If anything outside of that is taking place, it may indicate that an attacker may have gained a better position on the network. The source of the queries has been compromised, and the database must also be analyzed for any successful breaches.
Know the threats and do not overreact. Just because a host reboots doesn’t mean it has been invaded; it could just mean the RAM needs to be reseated on the motherboard. Hint: On the CEH exam, often the simplest most direct answer is the correct one. If it just seems too easy that is probably what they want. Attackers and Pentesters alike enjoy the low hanging fruit and prefer to take advantage of the easy exploit while the complicated ones are getting the most attention.
Attackers may try to cause diversions and waste the administrator’s time with false positives. False negatives will only be detected by redundant IDSs that are using different methods of detection. True positives must be responded to by a tested IRP or an external team such as a CSIRT (Computer Security Incident Response Team).
The following is a brief list of items to consider monitoring for. As you read the list, consider which form of detection would be best, and how an attacker might trigger a false positive or evade detection altogether.
Modifications to systems software and configuration files
Gaps in accounting systems
Unusually slow performance
System crashes or reboots
Short or incomplete logs
Logs containing strange timestamps
Logs with incorrect permission or ownership
Missing logs
Abnormal system performance
Unfamiliar processes
Unusual displays or text messages
The presence of new, unfamiliar files or programs
Changes in file permissions
Unexplained changes in file size
Rogue files on the system that do not correspond to your master list of signed files
Unfamiliar user names
Missing files
Repeated probes of the available services on your machines
Connections from unusual locations
Repeated login attempts from the remote hosts
Arbitrary data in log files
| 
