Your SlideShare is downloading. ×
13 Ways Through a Firewall – What You Don’t Know Will Hurt You
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

13 Ways Through a Firewall – What You Don’t Know Will Hurt You

927

Published on

Presented by: Mike Firstenberg, Waterfall Security Solutions …

Presented by: Mike Firstenberg, Waterfall Security Solutions

Abstract: Firewalls are a given – everyone assumes that every security posture includes a firewall. But are they really secure? Join us to see 13 kinds of ways to break through a firewall. Each kind of way through a firewall has between dozens and thousands of examples circulating in the wild. Up to 5 of the kinds of breaches will be demonstrated live, time permitting. For each kind of attack, seven compensating measures are briefly discussed and compared.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
927
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
19
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 2013 13 Ways Through A Firewall What you don’t know will hurt you Andrew Ginter VP Industrial Security Waterfall Security Solutions andrew. ginter @ waterfall - security . com ® Mike Firstenberg Director of Industrial Security Waterfall Security Solutions michaelf @ waterfall - security . com Scientech 2013 Symposium: Managing Fleet Assets and Performance
  • 2. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 2 Firewalls ● Firewalls – separate networks and sub- networks with different security / connectivity needs ● Often first investment any site makes when starting down the road to an ICS cyber security program ● “Unified Threat Managers” – firewalls with stateful inspection, VPNs, in-line anti-virus scanning, intrusion detection, intrusion prevention, anti-spam, web filtering, and much more – but are they secure? ● DMZ – “in-between” network(s) ● ICS best practice: layers of firewalls, layers of host and network-based defenses Photo: Red Tiger Security
  • 3. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 3 Setup for Demo Scenarios ● Industrial firewall / UTM ● Business network – my laptop + “hacked host” ● Control network – ICS server to attack / take over + one other ICS host ● Consider only one-hop compromise – into DMZ, or into ICS from DMZ
  • 4. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 4 Compensating Measures Abbrev Compensating Measure 2-FACT 2-Factor authentication ENC Encryption RULES Better firewall rules HIDS Host intrusion detection / prevention system / SIEM NIDS Network intrusion detection / prevention system / SIEM SECUPD Security updates / patch program UGW Unidirectional security gateway Graphic Impact Would have prevented / detected the attack Would prevent / detect some variants of the attack Would not have prevented / detected the attack
  • 5. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 5 #1 Phishing / Spam / Drive-By-Download ● Single most common way through (enterprise) firewalls ● Client on business network pulls malware from internet, or activates malware in email attachment ● “Spear-phishing” – carefully crafted email to fool even security experts into opening attachment 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 6. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 6 #2 Social Engineering – Steal a Password ● VPN password on sticky note on monitor, or under keyboard ● Call up administrator, weave a convincing tale of woe, and ask for the password ● Ask the administrator to give you a VPN account ● Shoulder-surf while administrator enters firewall password ● Guess ● Install a keystroke logger 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 7. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 7 #3 Compromise Domain Controller – Create Account ● More generally – abuse trust of external system ● Create account / change password of exposed ICS server, or firewall itself ● Other external trust abuse – compromise external HMI, ERP, DCS vendor with remote access, WSUS server, DNS server, etc. 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 8. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 8 #4 Attack Exposed Servers ● Every exposed port is vulnerable: ● SQL injection ● buffer overflow ● default passwords ● hard-coded password ● denial of service / SYN-flood 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 9. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 9 #5 Attack ICS Clients via Compromised Servers ● Best practice: originate all cross-firewall TCP connections on ICS / trusted side ● Once established, all TCP connections are bi-directional – attacks can flow back to clients: ● compromised web servers ● compromised files on file servers ● buffer overflows 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 10. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 10 #6 Session Hijacking / Man-in-the-Middle ● Requires access to communications stream between authorized endpoints – eg: ARPSpoof (LAN), fake Wi-Fi access point, hacked DNS server ● Insert new commands into existing communications session ● Sniff / fake session ID / cookie and re-use 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 11. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 11 #7 Piggy-Back on VPN ● You may trust the person you have granted remote access, but should you trust their computer? ● Broad VPN access rules – “I trust this user to connect to any machine, on any port” makes it easy for worms and viruses to jump ● Split-tunneling allows interactive remote control 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 12. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 12 #8 Firewall Vulnerabilities ● Firewalls are software. All large software artifacts have bugs, and some of those bugs are security vulnerabilities and zero-days ● Vendor back-doors / hard-coded passwords ● Supply chain issues – do you trust the manufacturer? The manufacturer’s suppliers? ● Occasional design vulnerabilities 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 13. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 13 #9 Errors and Omissions ● Modern firewalls require 6-8 weeks full-time training to cover all features and all configurations ● The smallest errors expose protected servers to attack ● Over time, poorly-managed firewalls increasingly resemble routers ● Well-meaning corporate IT personnel often control firewall configurations and can reach through to “fix” ICS hosts 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 14. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 14 #10 Forge an IP Address ● Most firewall rules are expressed in terms of IP addresses ● Any administrator can change the IP address on a laptop or workstation ● Works only if attacker is on same LAN segment as true IP address – or WAN routers route response traffic to a different LAN ● May need ARPSpoof to block machine with real IP 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 15. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 15 #11 Bypass Network Security Perimeter ● Complex network architectures – path from business network to ICS network through only routers exists, but is not obvious ● Rogue wireless access points ● Rogue cables – well meaning technicians eliminate “single point of failure” in firewall ● ICS network extends outside of physical security perimeter ● Dial-up port 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 16. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 16 #12 Physical Access to Firewall ● If you can touch it, you can compromise it ● Reset to factory defaults ● Log in to local serial port, change settings with CLI ● Re-arrange wiring 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 17. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 17 #13 Sneakernet ● Removable media, especially USB sticks, carried past physical / cyber security perimeter ● Entire laptops, workstations and servers carried past physical / cyber security perimeter 2-FACT ENC RULES HIDS NIDS SECUPD UGW
  • 18. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 18 Demo Warning: the issues demonstrated in the following slides apply to all firewalls, not just the firewall vendors and models illustrated. It is a mistake to interpret the following slides as a criticism of specific firewalls or specific firewall vendors.
  • 19. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 19 Firewall Vulnerability – Cross-Site Request Forgery
  • 20. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 20 Firewall Vulnerability – Cross-Site Request Forgery
  • 21. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 21 Firewall Vulnerability – Cross-Site Request Forgery
  • 22. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 22 Firewall Vulnerability – Cross-Site Request Forgery
  • 23. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 23 Firewall Vulnerability – Cross-Site Request Forgery
  • 24. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 24 Firewall Vulnerability – Cross-Site Request Forgery
  • 25. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 25 Firewall Vulnerability – Cross-Site Request Forgery
  • 26. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 26 Firewall Vulnerability – Cross-Site Request Forgery ● Uses web browser credentials for logged-in sites ● “Blind” technique – script cannot read from foreign web page ● Can however, push changed data to web server, as if user had pressed “send” Lesson: Cross-site scripting vulnerabilities are rampant in web applications of all kinds, including ICS applications. CSRF has been public knowledge for over a decade Mitigation: Modify web application to use hidden fields to echo random data back to web site on pages that change application state. Browsers prevent each site’s scripts from seeing data coming from another site, so foreign scripts cannot echo random data back to protected website
  • 27. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 27 Errors and Omissions – Can You See The Error?
  • 28. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 28 Errors and Omissions – Address Range Too Broad
  • 29. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 29 Errors and Omissions – Can You See the Error?
  • 30. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 30 Errors and Omissions – Rule for DHCP Address
  • 31. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 31 Errors and Omissions ● “andrews-machine” address was really for an entire subnet ● See this only when you go to the screen which defines “andrews- machine” address ● Correcting this problem is not sufficient – the address was in the DHCP range ● See this only when you go to the DHCP server definition screen ● Andrew’s machine needs to be given a static IP address Lesson: Full-featured firewalls are complex. Reviewing configurations to ensure they are safe is not straightforward.
  • 32. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 32 Firewall Design Vulnerability
  • 33. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 33 Firewall Design Vulnerability
  • 34. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 34 Firewall Design Vulnerability
  • 35. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 35 Firewall Design Vulnerability
  • 36. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 36 Firewall Design Vulnerability
  • 37. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 37 Firewall Design Vulnerability
  • 38. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 38 Firewall Design Vulnerability
  • 39. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 39 Firewall Design Vulnerability
  • 40. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 40 Firewall Design Vulnerability ● Browsers enforce “can’t touch other site’s web pages” rule when scripts and web pages come from different sites ● Within a site, scripts can touch web pages at will – this is how complex web applications work ● Hiding many web sites behind a single proxy address is very “convenient” – web browser is your SSL client ● Web browsers cannot enforce “can’t touch other site’s web pages” rules when scripts and web pages all appear to originate at the same site Lesson: Clientless/browser SSL clients are designed to hide many sites behind one address. Unless browser designs or clientless SSL designs change, hosts behind such proxy-site web servers will always be vulnerable to each other’s scripted attacks.
  • 41. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 41 Hacking ICS Servers
  • 42. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 42 Hacking ICS Servers
  • 43. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 43 Hacking ICS Servers
  • 44. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 44 Hacking ICS Servers – 100,000 Vulnerabilities ● A major vendor recently reported counting over 50,000 buffer- overflow-capable C library calls in one 2,000,000 LOC product ● All such calls are currently being replaced ● Do the math: ● Assume 2% of all overflow-capable calls are vulnerabilities ● 10 major vendors world-wide, in at least 5 verticals ● Assume at least 3 2MLOC products unique to each vertical ● Assume at least 75% of these products still written in C/C++ ● The math: 2% x 50,000 calls x 10 vendors x 5 verticals x 3 products x 75% = at least 100,000 vulnerabilities waiting to be found Lesson: Attacking firewall-exposed ICS servers with zero-day exploits will be straightforward for the foreseeable future
  • 45. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 45 Keeping Score Score Abbrev Compensating Measure 7 2-FACT 2-Factor authentication 7 ENC Encryption 11 RULES Better firewall rules 8 HIDS Host intrusion detection / prevention system / SIEM 9 NIDS Network intrusion detection / prevention system / SIEM 9 SECUPD Security updates / patch program 20 UGW Unidirectional security gateway Graphic Score Impact 2 Would have prevented / detected the attack 1 Would prevent / detect some variants of the attack 0 Would not have prevented / detected the attack
  • 46. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 46 ● Headquarters in Israel, sales and operations office in the USA ● Hundreds of sites deployed in all critical infrastructure sectors Best Practice Award 2012, Industrial Network Security IT and OT security architects should consider Waterfall for their operations networks Waterfall is key player in the cyber security market – 2010, 2011, & 2012 ● Strategic partnership agreements / cooperation with: OSIsoft, GE, Siemens, and many other major industrial vendors Waterfall Security Solutions
  • 47. Proprietary Information – Copyright © 2013 by Waterfall Security Solutions Ltd. 47 Stronger Than Firewalls ● Firewalls are porous ● Given the “elephants in the room,” perimeter protection will always be disproportionately important: ● 100,000 vulnerabilities ● Plain-text device communications ● Dissonance between ECC and IT’s “constant change” patch programs ● Long life-cycles for physical equipment andrew.ginter@waterfall-security.com www.waterfall-security.com michaelf @ waterfall - security . com 2-FACT ENC RULES HIDS NIDS SECUPD UGW

×