Upload File

a less attack-prone, internet deployment of ilanga · brute force attack – password guessing –...

  • Home
  • Documents
  • A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page
20
Page 1 A less attack-prone, Internet deployment of iLanga Researcher: Courage Radu Email: [email protected] Supervisor : M. Tsietsi Co-Supervisor : A. Terzoli

Upload: others

Post on 14-Aug-2020

10 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 1

A less attack-prone, Internet deployment

of iLanga

Researcher: Courage Radu

Email: [email protected]

Supervisor : M. Tsietsi

Co-Supervisor : A. Terzoli

Page 2: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 2

Outline

1) Background

2) Motivation

3) Threats

4) Approach

5) Asterisk security

6) Conclusion

7) Possible extensions

8) Questions and answers

Page 3: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 3

Background

iLanga is an open computer based telecommunication system

Objective of project is to have a securely deployed iLanga

A guide with best security practices

Developed a web based UI to easy up security administration

Page 4: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 4

Background

server

cellphone

Analog

phone

Telkom

Softphone

installed

on laptop

InternetISDN

Ethernet

Ethernet

IP Phone

Ethernet

gsm

Analog

line

Page 5: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 5

Background

Ubuntu Linux – operating system

Asterisk – software implementation of a PBX

Kamailio – proxy server for authentication

MySQL – database to store user information

Page 6: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 6

Motivation

The system uses open source software

The system can be deployed at tertiary institutions, small business

enterprises, etc

Affordable hardware extensions

Security is not inherently enabled and configured by default

Page 7: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 7

Threats

Brute force attack – password guessing

– Session Initiation Protocol (SIP) brute force

– Root account brute force

Page 8: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 8

Threats

Toll fraud

– unauthorised long distance calls

Dos

– service disruption

Page 9: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 9

Approach

Page 10: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 10

Preliminary phases

Current state-of-art of the system

– documenting versions for each component

Replicated the system

Learning the system

– how asterisk handles phone calls

– how the components are integrated

Page 11: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 11

Asterisk security

Install Asterisk PBX as non-root

– a remote security compromise should not be used to take over the entire

machine

Set the variable alwaysauthreject = yes

– prevent attacker from scanning for valid usernames

Change Session Initiation Protocol (SIP) default port 5060

– change default port to any unused random port number

Page 12: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 12

Asterisk security (Cont.)

Use public key authentication for SSH login

– disable password authentication

Secure dialplan

– properly designed diaplan prevent tool fraud

– well programmed dialplan will prevent dialplan injection

– a secured default context will not cost the organisation

Page 13: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 13

Asterisk security (Cont.)

Perl script

– ban IP address with more than 6 wrong passwords

Page 14: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 14

Asterisk security (Cont.)

Perl script monitors DoS and password strength for legitimate users

Page 15: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 15

Asterisk security (Cont.)

Perl script

Asterisk.log

Firewall

(iptables)

Block

Blocked.txt

Scan

Outgoing

traffic

Incoming

traffic

Internet

Administrator

Read

Send Blocked IP

Username +

Password

Page 16: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 16

Video Demonstration

Scenario – an intruder want to enumerate usernames and crack

passwords on iLanga

– perl script is running in background

– the administrator should view the blocked IP address via the browser

Step 2:

Enumerate

usernames

Step 3:

Cracking the

password

Step 1:

Ping the Server

Page 17: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 17

Results

Intrusion prevention script effectively quarantines offending IP addresses

Sipvicious tool can generate an average of 170 password attempts per

second on Intel(R) Core(TM) i7 CPU @ 2.93GHz

Page 18: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 18

Conclusion

Open source software empower institutions and small organisations to

deploy communication systems like iLanga

iLanga brings different components together but we have to configure and

enhance security features in it

Create an image with necessary security features pre-enabled and

distribute it to other institutions (UFH and NMMU)

Page 19: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 19

Possible extensions

Extension of the UI so that the administrator can view all security

information.

The security information is scattered everywhere within the system.

The interface should be able to lighten the burden for non-linux experts.

Page 20: A less attack-prone, Internet deployment of iLanga · Brute force attack – password guessing – Session Initiation Protocol (SIP) brute force – Root account brute force . Page

Page 20

Questions and Answers


Aegis Padlock DT - Apricorn · Setting the Unattended Auto Lock Feature 12 Aegis Padlock DT Brute Force Protection 13 What is Brute Force Attack? 13

Brute Force Terrain Rendering

root brute force

Applying AI to Detect and Hunt Advanced Attackers · Brute-Force Attack. SMB Brute-Force: Kerberos Brute Force. Suspicious Kerberos Client: Suspicious Kerberos Account. Kerberos Server

Protecting Your Website - team218.com · Wordpress Login Wordpress is susceptible to brute force attacks from hackers. A brute force attack is simply an attempt to gain access to

Aegis Padlock 3 - Apricorn Padlock 3.0. Table of Contents ... Setting the Unattended Auto Lock Feature 12 Aegis Padlock Brute Force Protection 13 What is Brute Force Attack? 13

Theory of Algorithms: Brute Force - perisastry.com · Objectives To introduce the brute-force mind set To show a variety of brute-force solutions: Brute-Force String Matching Polynomial

Chapter 2 Basics of Cryptography - net.in.tum.de · Network Security, WS 2008/09 4 Attacking cryptography (2): brute force attack The brute force attack tries every possible key until

Hunting Invisible Salamanders · 2020. 7. 29. · know decryption key, can learn using (online) brute-force attack Brute-force feasible if key is not very random (e.g. password/PIN)

Password cracking in the field - Security Science · 2008. 2. 20. · Brute force attacks A brute force attack is an attack on a password, where all possible character combinations

Analisa Brute Force Attack Artikel Ilmiahrepository.uksw.edu/bitstream/123456789/11304/2/T1_672010194_Full...untuk mengetahui dan bagaimana cara kinerja serangan brute force tersebut

Brute Force Algorithm

Brute Force Attack

1 Why Botnets Work: Distributed Brute-Force Attacks Need No … · 2019-07-02 · The brute-force attack on the system would consist of, first, producing a list of all possible password

Key Exhaustive Search (Brute Force Attack)

Algoritma Brute Force. Definisi Brute Force Brute force adalah sebuah pendekatan yang lempang (straightforward) untuk memecahkan suatu masalah, biasanya

CAP6135 Malware & Software Vulnerability On Limitations of ...cs.ucf.edu/~czou/CAP6135-14/PaperPresentation/LRPS.pdf · Brute Force attack • The power of brute force attack is given

Theory of Algorithms: Brute Force. Outline Examples Brute-Force String Matching Closest-Pair Convex-Hull Exhaustive Search brute-force strengths and weaknesses

03 Brute Force

02 1 Symmetric Crypto - TUM · 2009-11-26 · Network Security, WS 2009/10, Chapter 2.1 5 Attacking cryptography (2): brute force attack The brute force attack tries every possible

Brute Force Algorithms

2.3.1 Algoritma Brute Force - eprints.dinus.ac.ideprints.dinus.ac.id/6365/1/BAB2_KOMGRAF.pdf2.3.1 Algoritma Brute Force Algoritma brute force untuk membentuk garis didasarkan pada

Algoritma Brute Force · 2018. 6. 13. · Definisi Brute Force Brute force adalah sebuah pendekatan yang lempang (straightforward) untuk memecahkan suatu masalah, biasanya didasarkan

Flow-based Brute-force Attack Detection in Large and High-speed

Brute Force Distortion

QUANTUM COMPUTERS AND THEIR APPLICATION TO … ATTACK Private cipher attack DES use Grover’s Algorithm - like brute force attack • Grover’s Algorithm based on amplitude amplification

IA Book v0.1.4cobhomepages.cob.isu.edu/schou/IA V0.1.4.doc · Web viewAnalytic Attack (0010) (0011) 18 Brute Force (0011) 18 Implementation Attacks (0011) 18 Known Plaintext Attack

BRUTE FORCE ATTACK DETECTION AND … /Archive-2017/June-2017/4.pdf · demonstrates a technique by which brute force attacks on FTP servers can be detected using Wireshark ... so you

VYSOKE´ UCˇENI´ TECHNICKE´ V BRNEˇ · password, cipher, AES, PKWARE, attack, brute-force, dictionary attack Citace Milan Prustomìrský: U¾ití techniky lÆmÆní hesel u komprimaŁních

Algoritma Brute Force

Kawasaki Brute Force

Types of attack. Brute force attack Forceful attack on a computer to escalate privileges

AD Brute Force Attack Protection - N-Partner Brute... · Brute-force attack is one of the most common ways to attack. Hackers run the brute-force program in the intranet, trying to

Popular Protocol attack Smurf Attack Introduction: Types ...jeffay/courses/nidsS05/... · Conclusion : Part 1!High-Rate Protocol attack!Very close to Brute force attack Alternate

Cryptanalysis and Language Deciphering: A 'Brute Force Attack' … · 2020-06-18 · Cryptanalysis and Language Deciphering: A ’Brute Force Attack’ on an Undeciphered Writing