Advanced Netfilter; Content Replacement (ala Snort_inline)
Michael Rash explores advanced netfilter; content replacement (ala snort_inline) at DEF CON 12, examining rootkit and practical defenses.
Summary
Architecture and Background
Michael Rash, Advanced Netfilter; Content Replacement (ala Snort_inline), and Port Knocking Based on Passive OS Fingerprinting The boundaries between network access control devices and network monitoring devices are steadily becomming blured. Network intrusion detection systems are moving into the realm of not only monitoring network traffic, but also modifying it either through dynamic reconfiguration of firewall rulesets, spoofed session-busting traffic, or outright alteration of application layer data (ala Snort_inline). Firewalls themselves are also getting smarter about protocol validation and application layer data.
Vulnerability Analysis
This talk will discuss two main topics; 1) a patch to the iptables string match extension in the Linux kernel that allows iptables to perform the same data substitution as Snort_inline but three times faster, and 2) a new tool called "fwknop" that implements port knocking authentication based on passive operating system fingerprints as detected via iptables log messages. The latter makes it possible to allow only, say, Linux systems to connect to your SSH daemon. Michael Rash holds a Master's Degree in applied mathematics with a concentration in computer security from the University of Maryland.
Exploitation and Demonstrations
Mr. Rash works as a security research engineer for Enterasys, Inc. where he develops signatures and writes code for the Dragon IDS.
Remediation and Defensive Strategies
Previous to Enterasys, Michael developed a custom host-based intrusion detection system for USinternetworking, Inc. which was deployed on over one thousand systems from Linux to Cisco IOS. Michael frequently contributes to open source projects such as Netfilter and Bastille-Linux, and has written security related articles for the Linux Journal, Sys Admin Magazine, and Information Security Magazine. He is also a co-author of the book Snort-2.1 Intrusion Detection published by Syngress (to be published in late May, 2004). Michael is the developer of two open source tools "psad" and "fwsnort" that are designed to tear down the boundaries between iptables and the Snort IDS. More information about Michael and his open source projects can be found at:
Related talks
Main Stage·1 hr 7 min
spoonm · HD Moore
spoonm and HD Moore details spoonm and HD Moore, Bubonic Buffer Overflow The Metasploit Framework has progressed from a simple network game to a powerful tool for administrators and security analysts alike.
Main Stage·51 min
Michael Davis
Michael Davis explores the open-source security myth and how to make it a reality at DEF CON 12, examining rootkit and practical defenses.
Main Stage·50 min
Kathy Wang
Kathy Wang details fingerprinting with Morph Sun Tzu once stated, "Know your enemy and know yourself, and in a hundred battles you will never be defeated.