Network Intrusion and Investigating Network Traffic

AGENDA • • • Network intrusion Investigating network traffic Intrusion Detection • The process of tracking unauthorized activity using techniques such as inspecting user action, security logs or audit data Network Forensics • Network Forensics is the capturing , recording & analysis of Network events in order to discover the source of security attacks Analyzing network data • An investigator needs to • Perform network forensics to determine the type of an attack over a network and to trace out the culprit • Follow proper investigative procedures so that the evidences recovered during investigation during investigation can be produced in court of law Analyzing network data • • • • • • Network forensics can reveal the following How an intruder entered the network The path of intrusion The intrusion techniques an attacker used Traces and evidence Network Forensics Investigators cannot do the following 1. 2. Solve the case alone Link a suspect to an attack The Intrusion Process • • • Network intruders can enter a system using the following methods Enumeration – enumeration is the process of gathering information about a network that may help an intruder attack the network Following information is collected during enumeration • Topology of the network • List of live hosts • Network architecture and types of traffic (TCP/UDP/IPX) • Potential Vulnerabilities in host systems The Intrusion Process • Vulnerabilities – an attacker identifies potential weaknesses in a system , network & elements of the network and then rises to take advantage of those vulnerabilities • The intruder can find known vulnerabilities using various scanners • Viruses –Viruses are a major cause of shutdown of network components • A virus is a software program written to change the behavior of a computer or other device The Intrusion Process • • • Trojans – Trojan horses are programs that contain or install malicious programs on targeted systems. Usually used to steal information from system Email- infection - The use of email to attack a network is increasing. An attacker can use email spamming and other means to flood a network and cause a denial of service attack • • • • • • • • • • • • The Intrusion Process Router attacks - Routers are the main gateways into a network through which all traffic passes. A router attack can bring down a whole network Password Cracking – Is the last resort for any kind of attack Looking for Evidence An investigator can find evidence from the following From the attack computer and intermediate computers Evidence is in the forms of Logs Files Ambient data Tools From Firewalls Firewall log If firewall itself is victim then it will be treated as device for obtaining evidence • • • • • • • • • • Looking for Evidence From internetworking devices Logs Buffers Victim computers Logs Files Ambient data Altered configuration file Trojan files Unknown file extensions End-to End Forensic Investigation • • • • • • • • Elements The end-to –end concept Tracks all elements of an attack including how attack began What intermediate devices were used during attack Who attacked Locating Evidence Search for evidence on device on devices which were attacked Analyse the evidence to learn more about the attack and attacker End-to End Forensic Investigation • • • • Elements Pitfalls of network evidence Evidence can be lost in few seconds during log analysis because logs change rapidly Sometimes permissions needed to collect evidence from sources like ISPs • This process take time., Which increases the chances of evidence loss • An investigator or network admin may mistake normal computer or network activity for attack activity • There may be gaps in the chain of evidence • Logs may be ambiguous, incomplete or missing • • • • • • • • • End-to End Forensic Investigation Event analysis After the investigator examines all of the information. He /she correlates all of the events and all of the data from the various sources to get the whole picture Computer records are not normally admissible as evidence They must meet certain criteria to be admitted. The prosecution must present appropriate testimony to show that logs are Accurate Reliable Fully intact Legality of Using Logs Legality of Using Logs Legality of Using Logs Legality of Using Logs Networking Addressing Schemes • • • • LAN ADRESSING Each node in the LAN has a unique MAC address assigned to the NIC. A MAC address is a unique 48 bit serial number assigned to each network interface card, providing a physical address to the host machine. A NIC is a piece of hardware used to provide an interface between a host machine and a computer network, Networking Addressing Schemes • • • • • A MAC address may be of the following types: Static address –A 48 bit unique address programmed by the Ethernet board manufacturer into the hardware of the computer. This address permanent and changes only if the NIC changes Configurable address – This type of address is programmed into the NIC during the initial installation of the hardware and becomes static after that. The user can set this type of address through switches or jumpers on the circuit board, or through software. Networking Addressing Schemes • Dynamic Address- this type MAC address is obtained when the computer is powered on and connected to the network. Due to this, there are chances that a number of systems have the same address. Networking Addressing Schemes • • • • • • Internetwork addressing Used where a number of LAN’s or other networks are connected with the help of routers. Each network has a unique network id or network address. Routers use these addresses when data packets are transmitted from a source to its target. Each node in the network has its own unique address known as the host address or node id. An Internetwork address is a combination of both a network address and host address OSI Reference Model OSI Reference Model • OSI model is based on the following principles • Every layer has a fully defined function • The boundaries of the layers have been designed to reduce the flow of information in the interface • Each layer contains the functions of the international standardised protocol Protocols in different layers • • Data Link layer Point to point protocol- is standard for the transport of IP Traffic over point to point links. Consist of 3 main components 1. High level data link control protocol used by PPP to sum up the data between the source and destination links 2. Link Control Protocol is used in establishing,configuring,and testing the data link connection between source and the destination IP address. 3. Network control protocols -(NCPs) are used to negotiate options for network layer protocols running on top of PPP Protocols in different layers • Data Link layer • Serial line Internet protocol(Slip)- IP packets were relayed over dial – up lines using Slip • Address Resolution Protocol(ARP) – ARP is considered a part of the data link layer, even though it is part of TCP/IP Protocols in different layers • Network Layer • RARP(Reverse address resolution Protocol) : RARP is a TCP/IP protocol that can allow an IP address to be changed into a physical address. • ICMP ( internet Control Message Protocol) : ICMP is an extension of IP and supports packets that have error and control messages Example of ICMP protocol is the Ping command in DOS • • • • IGMP( Internet Group Management Protocol)- IGMP is used to manage the membership of multicast groups that are available on a single network IP( Internet Protocol) : IP is a communications protocol used for transferring data across Packet Switched networks Often paired with TCP Protocols in different layers • Transport layer • UDP(User Datagram Protocol) – is a connectionless protocol that is different from TCP/IP • TCP- Connection oriented protocol involves dealing with packets sent from 1 system to another