TCP/IP Security

1. Just how secure is the TCP/IP
protocol?
Andy Leigh
Information Security Strategist
BBC UK

2. What I will cover:
Packet Networks
• So, just what is TCP/IP?
• Packets and circuits – a security comparison
• How does an IP packet get from there to here?
Security Primer
• The whole security picture
• The principles of good security
• How hacks happen
TCP/IP Security
• General IP security issues
• TCP specific security issues
• Some Solutions
Conclusions

3. So, just what is TCP/IP?
TCP (IP Type = 6) UDP (IP Type = 17)
ICMP (IP Type = 1)
IP (Ethernet type = 0800)
Ethernet
Co-ax Fibre
Twisted Pair
ARP (Ethernet type = 0806)
Echo Request (ping) POP3 (Port = 110) DNS (Port = 53)
HTTP (Port = 80)
L2
L3
L4
WAN link
L1
L7
SDH link
SNMP (Port = 161)
1 .. 1023, 1024 ..65535 1 .. 1023, 1024 ..65535

4. Wrapping up packets
Web Data
HTTP Header
TCP Header
IP Header
Ethernet Header
64 Bytes to 1518 Bytes

5. Yes
No
No
Global address self-assignable
Yes
Yes
No
Route decided by destination address
Yes
Yes
No
Public global addresses used
IP=Yes, UDP=Yes, TCP=No
No
No
Connectionless "letter" mode
IP=N/A, UDP=N/A, TCP=Yes
Yes
No
End "user" does setup/tear-down
No
No
Yes
Service Provider does setup/tear-down
No
No
Yes
Same route for weeks
No
Yes
Yes
Same route during the connection
IP=N/A, UDP=N/A, TCP=Yes
Yes
Yes
End-to-end connection tear-down
IP=N/A, UDP=N/A, TCP=Yes
Yes
Yes
End-to-end connection setup
Packet (TCP/IP)
Dialled
Permanent
Packets and circuits – comparing security features

6. How does an IP packet get from here to there?
User
Network card
OS & IP stack
Application
Desktop
Computer
HW
Software
Data & destination
address & port
Network 1
NIC 5
OS & IP stack
Router code
Router
HW
Software
destination
address
NIC 2 NIC 6
OS & IP stack
Router code
Router
destination
address
NIC 8
Network2
Network3
Network card
OS & IP stack
Application
Server
Computer
HW
Software
Data
Inter-router protocol
“End Systems”
“Intermediate Systems”

7. The bigger security picture
• Badly specified, designed, installed or operated
technologies such as:
– Misconfigured Intermediate Systems (routers, firewalls)
– Weak network-glue (DNS, authentication systems)
– Flawed or unpatched Operating Systems
– Bug-ridden or unpatched applications, databases etc.
• Badly trained and poorly informed end-users and
support personnel
• The attackers themselves
TCP/IP is not to blame for many computer security
issues
We also need to consider:

8. The (simple) principles of good security
1. Never trust a network
2. Authenticate everything and everyone
3. Build systems to survive attacks

9. Saltzer & Schroeder’s 1975 principles
DO NOT SHARE RESOURCES UNLESS YOU HAVE TO
1. Economy of mechanisms
• keep design simple
2. Fail-safe defaults
• “deny all” unless approved
3. Complete mediation
• every access on every object checked for authority
4. Open design
• don’t depend on obscurity
5. Separation of privilege
• 2 separate keys (or devices) better than one
6. Least privilege
• users and software operate with least privilege necessary to get the job done
7. Least common mechanism
• minimise mount of kit shared by, or critical to, more than user
8. Psychological acceptability
• make the process easy to use so people just accept it

10. How hacks happen – a refresher
• Discovery and fingerprinting
• Scanning for vulnerabilities
• Analysing and looking for weaknesses
• Gaining low-level access
• Escalating to high-level access
• Inserting a back-door
• Cleaning up and exiting
Some attacks exploit weak passwords (many don’t)
It’s all over in minutes

11. General IP/UDP security issues
• UDP is “stateless” and is easy to forge
– But it’s needed for one-way streams and multicast
• Checksums are not a security technology
– Anyone can change the packet details or fake a packet and easily get
the CRC correct
– Each router has to change the IP checksum anyway to deal with hop-
counts (TTL)
• IP source addresses are not guaranteed to be correct
– Anyone can send a packet with fake source address
– IP addresses are therefore NOT a form of authentication
• IP breaks packets into fragments if they are too big for the
link
– Higher-level headers carried only in the first fragment (second fragment
may be something completely different)
– Only end-stations are allowed to re-assemble

12. IP fragmentation
UDP data
UDP header
UDP data
UDP header
IP header UDP data
IP header

13. TCP specific security issues – TCP states
• TCP states – Denial Of Service weaknesses
– An established TCP connection is open “forever” unless keep-
alive timers (optional) are invoked
– SYN attacks – each incoming “SYN” packet hold a listen-queue
connection open for 75 seconds
– Double-ended synchronisation is possible
NB these are all “flaws” in the original specification –
most real-world Operating Systems have fixed the
problems

14. The TCP finite-state-machine
CLOSED
LISTEN
SYN_RCVD SYN_SENT
ESTABLISHED
CLOSING
CLOSE_WAIT
LAST_ACK
FIN_WAIT_1
FIN_WAIT_2 TIME_WAIT
Active Close
Passive Close
CLOSED
Start
Return to beginning
Client States
Server States

15. TCP specific security issues
• Poor randomisation in the Initial Sequence
Number
– TCP’s handshake invokes a “random” Sequence Number which
should be hard to guess
– In practice many implementations have been very predictable
– TCP-connection spoofing is therefore possible
– Connection hijacking
– RST Denial Of Service
– FIN Denial Of Service

16. Some real world ISN “random numbers”
From “Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later” by Michal Zalewski
Cisco’s IOS 12.2.10a

17. Some real world ISN “random numbers”
From “Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later” by Michal Zalewski
OpenVMS V7.2

18. Some real world ISN “random numbers”
From “Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later” by Michal Zalewski
MacOS X

19. Some real world ISN “random numbers”
From “Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later” by Michal Zalewski
Win XP

20. Other “TCP/IP” security issues
• Name-spoofing
• Attacks against routing algorithms
• ICMP “Redirect” DOS attack
• ICMP “Destination Unreachable” DOS attack
• SNMP
• ARP spoofing

21. Solutions to TCP/IP’s problems
• Re–write TCP/IP
• Move to IPv6
– IPv6 Authentication Header
– IPv6 ESP and Encryption Header
• Use IPSec to secure point-to-point connections
– Looks remarkably similar to IPv6 security solutions (AH, ESP)
• “Harden” any common equipment & use
application-level protection (e.g. SSL)
– And follow good security operational practices
• Build layered security using choke-points (e.g.
using firewalls) …

22. Solutions to TCP/IP’s problems – Firewalls
Positives
• Stateful filtering firewalls
– Watch the “state” of any connections to ensure they are valid
– Can prevent most network attacks
• Proxy firewalls
– Don’t pass through packets (if well-built, are impervious to network
attacks)
– They communicate application-to-application
Negatives
• Firewalls cannot stop application-level attacks
• They affect performance
• Secure rules sometimes impossible in real-world
• They don’t prevent snooping

23. Conclusions
• Packet networks are inherently less secure than switched-
circuit networks
• There’s a great deal more to security than secure networking
• The basic principles of good security:
– Never trust a network
– Always authenticate every transaction
– Build systems to survive
• IP and associated protocols have a number of security flaws
• TCP has a number of inherent security flaws (which have
been mitigated by most real-world implementations)
• Firewalls, hardening, IPv6 and encryption can help
Good security is essential, but can affect performance
Broadcasters must agree amongst themselves good security
standards

24. Thanks for Listening
Any Questions?