1 Protection against Reconnaissance and Scan
Description: 1 Protection against Reconnaissance and Scan Attacks Robert Schmidt, Jordana Maciel Advisors: Sergio Elizalde, Jorge Crichigno Department of Integrated Information Technology (IIT) University of South Carolina December, 2024 Agenda 2
Related Topics
Download Presentation
"1 Protection against Reconnaissance and Scan" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. 1 Protection against Reconnaissance and Scan Attacks
Robert Schmidt, Jordana Maciel
Advisors: Sergio Elizalde, Jorge Crichigno
Department of Integrated Information Technology (IIT)
University of South Carolina
December, 2024<br>
slide2. Agenda 2 Project description Background information Infrastructure Experiment Demo Conclusion<br>
slide3. 3 Project overview Objective
Gain a fundamental understanding of reconnaissance in networking security and exploring strategies to mitigate scan attacks.
Key Focus Areas
Reconnaissance Techniques: Mapping networks and identifying vulnerabilities by port scans and host sweeps.
Configuration of NGFW: Implementing modern firewalls and zone protection to counter unauthorized data collection.
Significance
Highlights the importance of proactive defense, preventing breaches before they happen
Provides framework for securing networks against real-world reconnaissance activities<br>
slide4. 4 Background information Firewall: Network monitoring device that monitors traffic on the network, blocking traffic determined by placed firewall policies.
NGFW: While very similar to a firewall, it offers far more advanced and comprehensive protection against cyber threats.
Zones: Segment the network into smaller, manageable areas to enhance protection. Zone Protection Profiles: To prevent attackers from collecting network data, zone protection profiles with Reconnaissance Protection can be implemented. This helps defend against tactics like port scans and host sweeps.<br>
slide5. 5 Background information Scan network 192.168.50.0/24.
-v1 = Employ more verbosity.
-Pn = No host discovery, port scan only. Reconnaissance attacks are unauthorized attempts to map or discover networks to detect vulnerabilities
Various techniques such as port scans, host sweeping, and OS fingerprinting are types of deployable scan attacks used to find vulnerabilities on the network.
Common Tools
Nmap: Network mapping tool, used for scanning networks, finding open ports, and discovering hosts.
Nping: Packet generation tool, used for response analysis and response measurement.
Hping3: Network tool used for sending custom TCP packets to view target replies. It can also be used for flood attacks.
Reconnaissance is often a precursor to different types of attacks to exploit any vulnerabilities found in a network.<br>
slide6. 6 Background information Nmap and Hping3 are open-source resources used for pen-testing and various forms of cyber attacks.
Nmap scans for open hosts and ports by ping scanning, the command can be altered by a variety of flags to make the scan more aggressive, or harder to detect by the firewall.
Hping3 allows a threat actor or pen-tester to generate and manipulate a variety of TCP, UDP, or ICMP packets. By flooding a network with these packets, we can better view how a network is protected.<br>
slide7. 7 Key Devices:
DMZ server: Public-facing services (192.168.50.10)
Web Server: Within the DMZ (192.168.50.80)
Internal Client: Compromised client device (192.168.1.20)
Virtual Router: Connects and segments security zones. (192.168.1.1 – Default Gateway)
Network Zones:
Users_Network: (192.168.1.0/24): Hosts internal devices.
Extranet: (192.168.50.0/24): DMZ for public-facing network services.
Internet: External Devices outside of organizations control. System Topology Infrastructure<br>
slide8. 8 Experiment Scenario
An internal client (192.168.1.20) is compromised and used by a threat actor to initiate a reconnaissance attack against a critical web server (192.168.50.80). The attacker plans on using Nmap to find vulnerabilities before attacking by using a Hping3 flood attack.
Potential Damages if attack is not blocked
DMZ Compromised: Allowing the threat actor to take control of the DMZ server.
Data Breach: Information in DMZ can be accessed or leaked.
Service Disruption: Hping3 can create a denial-of-service (DoS) attack, disabling public-facing services.<br>
slide9. 9 Experiment Nmap was utilized in our project to identify and spot open ports that may be vulnerable to attack. The Nmap’s record-route feature was also used to find routing information to map out the network.
Command 1 (TCP Port Scan): nmap –sP --ip-options R 192.168.50.80
Command 2 (IP Record Route): nmap –v1 –Pn –T4 --max-retries 1 192.168.50.80
Hping3 was used to create a flood attack on the vulnerable ports identified earlier with Nmap. A follow-up test will be conducted to view how the firewall handles oncoming ping requests.
Command 3 (hping3 flood): -S -p 80 --flood -c 50 192.168.50.80
All commands are tools that any pen tester or threat actor can use to infiltrate the target network.<br>
slide10. 10 Demo This demonstration will be hosted on Netlab, a virtual lab for training.
Step 1: Successfully executing a reconnaissance attack on the web server from the compromised machine due to no security policies being in place.
Utilizing Nmap and Hping3 to attack the web server.
Step 2: The implementation of the zone protection policies in the NGFW.
Showing the zone protection policies in place to prevent the attacks.
Step 3: A failed execution of the reconnaissance attack on the webserver from the compromised machine due to the security policies set in place.
Showing the policy actively stopping the attack attempts and inspect the firewall logs.<br>
slide11. 11 As shown in the completion of the demo we have successfully configured Palo Alto’s Next Generation Firewall to configure zone protections against reconnaissance attacks.
All attempts of reconnaissance were successfully prevented, mitigated, and validated by the threat logs. In addition, the compromised client’s IP was exposed, as well as the type of commands which were run on the system.
In conclusion, preventing reconnaissance attacks is accomplishable and viable through properly configured zone protection policies. Conclusion<br>
Robert Schmidt, Jordana Maciel
Advisors: Sergio Elizalde, Jorge Crichigno
Department of Integrated Information Technology (IIT)
University of South Carolina
December, 2024<br>
slide2. Agenda 2 Project description Background information Infrastructure Experiment Demo Conclusion<br>
slide3. 3 Project overview Objective
Gain a fundamental understanding of reconnaissance in networking security and exploring strategies to mitigate scan attacks.
Key Focus Areas
Reconnaissance Techniques: Mapping networks and identifying vulnerabilities by port scans and host sweeps.
Configuration of NGFW: Implementing modern firewalls and zone protection to counter unauthorized data collection.
Significance
Highlights the importance of proactive defense, preventing breaches before they happen
Provides framework for securing networks against real-world reconnaissance activities<br>
slide4. 4 Background information Firewall: Network monitoring device that monitors traffic on the network, blocking traffic determined by placed firewall policies.
NGFW: While very similar to a firewall, it offers far more advanced and comprehensive protection against cyber threats.
Zones: Segment the network into smaller, manageable areas to enhance protection. Zone Protection Profiles: To prevent attackers from collecting network data, zone protection profiles with Reconnaissance Protection can be implemented. This helps defend against tactics like port scans and host sweeps.<br>
slide5. 5 Background information Scan network 192.168.50.0/24.
-v1 = Employ more verbosity.
-Pn = No host discovery, port scan only. Reconnaissance attacks are unauthorized attempts to map or discover networks to detect vulnerabilities
Various techniques such as port scans, host sweeping, and OS fingerprinting are types of deployable scan attacks used to find vulnerabilities on the network.
Common Tools
Nmap: Network mapping tool, used for scanning networks, finding open ports, and discovering hosts.
Nping: Packet generation tool, used for response analysis and response measurement.
Hping3: Network tool used for sending custom TCP packets to view target replies. It can also be used for flood attacks.
Reconnaissance is often a precursor to different types of attacks to exploit any vulnerabilities found in a network.<br>
slide6. 6 Background information Nmap and Hping3 are open-source resources used for pen-testing and various forms of cyber attacks.
Nmap scans for open hosts and ports by ping scanning, the command can be altered by a variety of flags to make the scan more aggressive, or harder to detect by the firewall.
Hping3 allows a threat actor or pen-tester to generate and manipulate a variety of TCP, UDP, or ICMP packets. By flooding a network with these packets, we can better view how a network is protected.<br>
slide7. 7 Key Devices:
DMZ server: Public-facing services (192.168.50.10)
Web Server: Within the DMZ (192.168.50.80)
Internal Client: Compromised client device (192.168.1.20)
Virtual Router: Connects and segments security zones. (192.168.1.1 – Default Gateway)
Network Zones:
Users_Network: (192.168.1.0/24): Hosts internal devices.
Extranet: (192.168.50.0/24): DMZ for public-facing network services.
Internet: External Devices outside of organizations control. System Topology Infrastructure<br>
slide8. 8 Experiment Scenario
An internal client (192.168.1.20) is compromised and used by a threat actor to initiate a reconnaissance attack against a critical web server (192.168.50.80). The attacker plans on using Nmap to find vulnerabilities before attacking by using a Hping3 flood attack.
Potential Damages if attack is not blocked
DMZ Compromised: Allowing the threat actor to take control of the DMZ server.
Data Breach: Information in DMZ can be accessed or leaked.
Service Disruption: Hping3 can create a denial-of-service (DoS) attack, disabling public-facing services.<br>
slide9. 9 Experiment Nmap was utilized in our project to identify and spot open ports that may be vulnerable to attack. The Nmap’s record-route feature was also used to find routing information to map out the network.
Command 1 (TCP Port Scan): nmap –sP --ip-options R 192.168.50.80
Command 2 (IP Record Route): nmap –v1 –Pn –T4 --max-retries 1 192.168.50.80
Hping3 was used to create a flood attack on the vulnerable ports identified earlier with Nmap. A follow-up test will be conducted to view how the firewall handles oncoming ping requests.
Command 3 (hping3 flood): -S -p 80 --flood -c 50 192.168.50.80
All commands are tools that any pen tester or threat actor can use to infiltrate the target network.<br>
slide10. 10 Demo This demonstration will be hosted on Netlab, a virtual lab for training.
Step 1: Successfully executing a reconnaissance attack on the web server from the compromised machine due to no security policies being in place.
Utilizing Nmap and Hping3 to attack the web server.
Step 2: The implementation of the zone protection policies in the NGFW.
Showing the zone protection policies in place to prevent the attacks.
Step 3: A failed execution of the reconnaissance attack on the webserver from the compromised machine due to the security policies set in place.
Showing the policy actively stopping the attack attempts and inspect the firewall logs.<br>
slide11. 11 As shown in the completion of the demo we have successfully configured Palo Alto’s Next Generation Firewall to configure zone protections against reconnaissance attacks.
All attempts of reconnaissance were successfully prevented, mitigated, and validated by the threat logs. In addition, the compromised client’s IP was exposed, as well as the type of commands which were run on the system.
In conclusion, preventing reconnaissance attacks is accomplishable and viable through properly configured zone protection policies. Conclusion<br>