Articulus Detecting IP Hijacking Through Server Fingerprinting

Research Question How can we detect BGP IP hijacking by probing the at – risk subnets to detect suspect change to hosts and subnets. 2 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

(Slightly) related work  BGPmon  Cyclops by UCLA  Uptrends SSL monitoring  Unnamed Eric & Mick tool 3 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

The problem 4 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

What are the possibilities  Man-in-the-middle attacks  Downgrade attacks  False information 5 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Articulus 6 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Terminology  Sentinel  Globally spread out  Executes fingers  Node  At-risk host in need of protection  Server  Command & control server  Result comparison  Fingers 7  Commands executed on Sentinels Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Our solution 8 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting  Identifying software used  Identifying software version used  Identifying specific host characteristics 9 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting - DNS  Response only  DNS censorship/hijacking detection. 10 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting - Mail services  SMTP / IMAP / POP  STARTTLS 11 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting – Secure Shell  RSA Fingerprint  OpenSSH version  Distribution 12 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting - Webservices  WordPress 3.8  Apache 2.2.16  JQuery 1.10.2 13 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting – Sercure Webservices  Nginx 1.4.4  SHA-1 of certificate 14 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting - Traceroute  ICMP / UDP / TCP port 80 15 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting – TCP/IP  Uptime Guess  TCP characteristics  TCP Sequence difficulty 16 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Reporting  Three levels  Paranoid  System administrator  User  Alerts  Email  SMS 17 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Fingerprinting – Avoiding detection 18 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Comparing Fingerprints  All output saved  RegEx fingerprint  Compare result to previous result 19 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Technical details  Command and Control server  Python API  Only works for approved UUID’s  HTTPS webserver with Python support (Apache, Nginx , …)  MySQL database (MariaDB should work as well)  Sentinels  Python  Hardcoded server and certificate (-pinning)  POST requests to C&C API  Generates UUID  Parallel command execution 20 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Technical details  Secure  Lightweight  Scalable 21 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Modular setup  Add commands for execution on the fly  Sentinel needs commands to be installed though  Add nodes dynamically  IPv4 and IPv6 support 22 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

DEMO  http://sne.pretwolk.nl:81 23 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Thank you for your attention  Are there any questions? 24 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

25 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Thank you for your attention  Are there any questions? 31 Intro – Fingerprinting – Avoiding Detection – Technical Details – Demo - Questions

Articulus Detecting IP Hijacking Through Server Fingerprinting - PowerPoint PPT Presentation

Articulus Detecting IP Hijacking Through Server Fingerprinting Research Question How can we detect BGP IP hijacking by probing the at risk subnets to detect suspect change to hosts and subnets. 2 Intro Fingerprinting Avoiding

A Parallel-Object Programming Model for PetaFLOPS Machines and BlueGene/Cyclops Gengbin Zheng ,

Dr Douglas McKenzie CEO Xanthella Ltd Design and manufacturing company based at European

Disclaimer & Competent Person Statement This presentation has been prepared by Platypus

Peninsula Clean Energy Board of Directors Meeting March 28, 2019 June 23, 2016 Agenda Call to

2 nd EGEE NA4 SSC Workshop ES SSC Proposal H. Schwichtenberg 1 & M. Petitdidier 2 On behalf

COMPANY PRESENTATION January 2018 IMPORTANT INFORMATION THIS PRESENTATION AND THE INFORMATION

CONTRIBUTION TO THE MODELLING OF CONTRIBUTION TO THE MODELLING OF SHELLFISH ZOOPLANKTON

of Mediterranean monk seal ( Monachus monachus ) in Albanian coastal regions Himara Meeting

THE FYNBOS: AN OVERVIEW Fiona Impson University of Cape Town & Plant Protection Research

LAKE WHATCOM NORTH SHORE ON-SITE SEWAGE SYSTEM LEACHATE DETECTION PROJECT Rob Zisette, Herrera

Plataforma Meccano: Medio e Predio de fluxo de visitas e vendas em lojas fsicas

Sim-LIT: A simulation framework for image quality assessment in wireless visual sensor networks

Drafting Indemnification and Hold Harmless Provisions in Commercial Contracts Negotiating Scope

VOLCANOES by Christoph Brandl Ch r i s to p h B r an d l Pa r e tz e r St r . 1 10713 Be r l i

Next Generation 3D Printer Final Project Proposal Fahad Alahmari, Sebastian Arevalo, Brad Evans,

Community Forum for Swords to City Centre Core Bus Corridor Tuesday 17 th September 2019

Active Travel Act Guidance Presentations to accompany the consultation on the revised guidance

PRESENTS: PRESENTS: THE PRODUCT WHERE NATURE GIVES A HELPING HAND A ready to use

Mythical Creatures Centaur Nymphs The god, Poseidon, sent King Minotaur Minos,King of

RAK Ghani Glass LLC Ras Al Khaimah United Arab Emirates Ou Our Vis ision ion With Focus On

1 0 FLYERS Objectives BACKGROUND INFORMATION Mother Teresa (19101997) was a nun who founded

A E G I S I M P A C T P r e s e n t e d b y G r o u p 7 2 D P H Y S I C S G A M E Top Down

Community-based Hazard Map Development Prepared by Institute for Ocean Management Anna

WATER LICENCE AMENDMENT TECHNICAL SESSIONS 22.Jan.2015 The De Beers Group of Companies Overview

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us