Application Firewallssmb/classes/f06/l16.pdf · Inbound Email Diﬀerent Sublayers Outbound Email...

Application Firewalls

Moving Up theStack

Advantages

Disadvantages

Example: ProtectingEmail

Email Threats

Inbound Email

Different Sublayers

Outbound EmailCombining FirewallTypes

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Personal andDistributed Firewalls

The Problems withFirewalls

Midterm

1 / 44

Moving Up the Stack

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

2 / 44

■ Why move up the stack?■ Apart from the limitations of packet filters

discussed last time, firewalls are inherently

incapable of protecting against attacks on a

higher layer

■ IP packet filters (plus port numbers. . . ) can’tprotect against bogus TCP data

■ A TCP-layer firewall can’t protect against bugsin SMTP

■ SMTP proxies can’t protect against problemsin the email itself, etc.

Advantages

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

3 / 44

■ Protection can be tuned to the individualapplication

■ More context can be available■ You only pay the performance price for that

application, not others

Disadvantages

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

4 / 44

■ Application-layer firewalls don’t protect againstattacks at lower layers!

■ They require a separate program perapplication

■ These programs can be quite complex■ They may be very intrusive for user

applications, user behavior, etc.

Example: Protecting Email

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

5 / 44

■ Do we protect inbound or outbound email?Some of the code is common; some is quitedifferent

■ Do we work at the SMTP level (RFC 2821) orthe mail content level (RFC 2822)?

■ What about MIME?■ (What about S/MIME- or PGP-protected

mail?)■ What are the threats?

Email Threats

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

6 / 44

■ The usual: defend against protocolimplementation bugs

■ Virus-scanning■ Anti-spam?■ Javascript? Web bugs in HTML email?■ Violations of organizational email policy?■ Signature-checking?

Inbound Email

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

7 / 44

■ Email is easy to intercept: MX records in theDNS route inbound email to an arbitrarymachine

■ Possible to use “*” to handle entire domain■ Example: DNS records exist for att.com and

*.att.com

■ Net result: all email for that domain is sent toa front end machine

Different Sublayers

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

8 / 44

■ Note that are are multiple layers of protectionpossible here

■ The receiving machine can run a hardenedSMTP, providing protection at that layer

■ Once the email is received, it can be scannedat the content layer for any threats

■ The firewall function can consist of either orboth

Outbound Email

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

9 / 44

■ No help from the protocol definition here■ But — most mailers have the ability to

forward some or all email to a relay host■ Declare by administrative fiat that this must

be done■ Enforce this with a packet filter. . .

Combining Firewall Types

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

10 / 44

■ Use an application firewall to handle inboundand outbound email

■ Use a packet filter to enforce the rules

Firewalling Email

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

11 / 44

Filter

Outside

Inside

SMTPReceiver

Anti−SpamAnti−Virus

Packet

Enforcement

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

12 / 44

■ Email can’t flow any other way■ The only SMTP server the outside can talk to

is the SMTP receiver■ It forwards the email to the

anti-virus/anti-spam filter, via some arbitraryprotocol

■ That machine speaks SMTP to some insidemail gateway

■ Note the other benefit: if the SMTP receiver iscompromised, it can’t speak directly to theinside

Outbound Email

Moving Up theStack

Advantages

Disadvantages

Email Threats

Inbound Email

Different Sublayers

Firewalling Email

Enforcement

Outbound Email

The DNS

Application Proxies

Circuit Gateways

Midterm

13 / 44

■ Again, we use a packet filter to block directoutbound connections to port 25

■ The only machine that can speak to externalSMTP receivers is the dedicated outboundemail gateway

■ That gateway can either live on the inside oron the DMZ

The DNS

DNS Issues

UDP IssuesInternal VersusExternal ViewCacheContaminationAttacks

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

14 / 44

DNS Issues

The DNS

DNS Issues

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

15 / 44

■ UDP (discussed previously)■ Internal versus external view■ DNS cache corruption■ Optimizing DNSSEC checks

UDP Issues

The DNS

DNS Issues

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

16 / 44

■ Remember the DNS server location discsussedlast time

■ In fact, what we did there was use anapplication-level relay to work around packetfilter restrictions

■ We’re lucky — since the DNS protocolincludes provision for recursion, it requires noapplication changes for this to work

Internal Versus External View

The DNS

DNS Issues

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

17 / 44

■ Should outsiders be able to see the names ofall internal machines?

■ What about secretproject.foobar.com?■ Solution: use two DNS servers, one for internal

requests and one for external request■ Put one on each side of the firewall■ Issue: which machine does the NS record for

foobar.com point to, the inside or the outsideserver?

■ Can be trickier than it seems — must makesure that internal machines don’t see NSrecords that will make them try to go outsidedirectly

Cache Contamination Attacks

The DNS

DNS Issues

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

18 / 44

■ DNS servers cache results from queries■ Responses can contain “additional

information” — data that may be helpful butisn’t part of the answer

■ Send bogus DNS records as additionalinformation; confuse a later querier

DNS Filtering

The DNS

DNS Issues

DNS Filtering

Application Proxies

Circuit Gateways

Midterm

19 / 44

■ All internal DNS queries go to a DNS switch

■ If it’s an internal query, forward the query tothe internal server or pass back internal NSrecord

■ If it’s an external query, forward the query tooutside, but:

◆ Scrub the result to remove any referencesto inside machines

◆ Scrub the result to remove any referencesto any NS records; this prevents attemptsto go outside directly

■ Use a packet filter to block direct DNScommunication

Application Proxies

The DNS

Application Proxies

Small ApplicationGateways

FTP Proxy

Attacks Via FTPProxy

Web Proxies

Circuit Gateways

Midterm

20 / 44

Small Application Gateways

The DNS

Application Proxies

FTP Proxy

Web Proxies

Circuit Gateways

Midterm

21 / 44

■ Some protocols don’t need full-fledgedhandling at the application level

■ That said, a packet filter isn’t adequate■ Solution: examine some of the traffic via an

application-specific proxy; react accordingly

FTP Proxy

The DNS

Application Proxies

FTP Proxy

Web Proxies

Circuit Gateways

Midterm

22 / 44

■ Remember the problem with the PORTcommand?

■ Scan the FTP control channel■ If a PORT command is spotted, tell the

firewall to open that port temporarily for anincoming connection

■ (Can do similar things with RPC — definefilters based on RPC applications, rather thanport numbers)

Attacks Via FTP Proxy

The DNS

Application Proxies

FTP Proxy

Web Proxies

Circuit Gateways

Midterm

23 / 44

■ Downloaded Java applets can call back to theoriginating host

■ A malicious applet can open an FTP channel,and send a PORT command listing avulnerable port on a nominally-protected host

■ The firewall will let that connection through■ Solution: make the firewall smarter about

what host and port numbers can appear inPORT commands. . .

Web Proxies

The DNS

Application Proxies

FTP Proxy

Web Proxies

Circuit Gateways

Midterm

24 / 44

■ Again, built-in protocol support■ Provide performance advantage: caching■ Can enforce site-specific filtering rules

Circuit Gateways

The DNS

Application Proxies

Circuit Gateways

ApplicationModificationsAddingAuthentication

Midterm

25 / 44

Circuit Gateways

The DNS

Application Proxies

Circuit Gateways

Midterm

26 / 44

■ Circuit gateways operate at (more or less) theTCP layer

■ No application-specific semantics■ Avoid complexities of packet filters■ Allow controlled inband connections, i.e., for

FTP■ Handle UDP■ Most common one: SOCKS. Supported by

many common applications, such as Firefoxand GAIM.

Application Modifications

The DNS

Application Proxies

Circuit Gateways

Midterm

27 / 44

■ Application must be changed to speak thecircuit gateway protocol instead of TCP orUDP

■ Easy for open source■ Socket-compatible circuit gateway libraries

have been written for SOCKS — use thoseinstead of standard C library to convertapplication

Adding Authentication

The DNS

Application Proxies

Circuit Gateways

Midterm

28 / 44

■ Because of the circuit (rather than packet)orientation, it’s feasible to add authentication

■ Purpose: extrusion control

Personal and Distributed

Firewalls

The DNS

Application Proxies

Circuit Gateways

Rationale

Personal FirewallsSaying “No”, Saying“Yes”Application-LinkedFirewalls

Distributed Firewalls

Midterm

29 / 44

Rationale

The DNS

Application Proxies

Circuit Gateways

Rationale

Midterm

30 / 44

■ Conventional firewalls rely on topologicalassumptions — these are questionable today

■ Instead, install protection on the end system■ Let it protect itself

Personal Firewalls

The DNS

Application Proxies

Circuit Gateways

Rationale

Midterm

31 / 44

■ Add-on to the main protocol stack■ The “inside” is the host itself; everything else

is the “outside”■ Most act like packet filters■ Rule set can be set by individual or by

administrator

Saying “No”, Saying “Yes”

The DNS

Application Proxies

Circuit Gateways

Rationale

Midterm

32 / 44

■ It’s easy to reject protocols you don’t like witha personal firewall

■ The hard part is saying “yes” safely■ There’s no topology — all that you have is the

sender’s IP address■ Spoofing IP addresses isn’t that hard,

especially for UDP

Application-Linked Firewalls

The DNS

Application Proxies

Circuit Gateways

Rationale

Midterm

33 / 44

■ Most personal firewalls act on port numbers■ At least one such firewall is tied to applications

— individual programs are or are not allowedto talk, locally or globally

■ Pros: don’t worry about cryptic port numbers;handle auxiliary ports just fine

■ Cons: application names can be just ascryptic; service applications operate on behalfof some other application

The DNS

Application Proxies

Circuit Gateways

Rationale

Midterm

34 / 44

■ In some sense similar to personal firewalls,though with central policy control

■ Use IPsec to distinguish “inside” from“outside”

■ Insiders have inside-issued certificates;outsiders don’t

■ Only trust other machines with the propercertificate

■ No reliance on topology; insider laptops areprotected when traveling; outsider laptopsaren’t a threat when they visit

The Problems with Firewalls

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

35 / 44

Problems

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

36 / 44

■ Corrupt insiders■ Connectivity■ Laptops■ Evasion

Corrupt Insiders

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

37 / 44

■ Firewalls assume that everyone on the inside isgood

■ Obviously, that’s not true■ Beyond that, active content and subverted

machines mean there are bad actors on theinside

Connectivity

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

38 / 44

■ Firewalls rely on topology■ If there are too many conections, some will

bypass the firewall■ Sometimes, that’s even necessary; it isn’t

possible to effectively firewall all externalpartners

■ A large company may have hundreds or eventhousands of external links, most of which areunknown to the official networking people

Laptops

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

39 / 44

■ Laptops, more or less by definition, travel■ When they’re outside the firewall, what

protects them?■ At one conference, I spotted at least a dozen

other attendee machines that were infectedwith the Code Red virus

■ (Code Red only infected web servers. Whywere laptops running web servers?)

Evasion

The DNS

Application Proxies

Circuit Gateways

Problems

Corrupt Insiders

Connectivity

Laptops

Evasion

Midterm

40 / 44

■ Firewalls and firewall administrators got toogood

■ Some applications weren’t able to run■ Vendors started building things that ran over

HTTP■ HTTP usually gets through firewalls and even

web proxies. . .

Midterm

The DNS

Application Proxies

Circuit Gateways

Midterm

Conditions

Format

Material

41 / 44

Conditions

The DNS

Application Proxies

Circuit Gateways

Midterm

Conditions

Format

Material

42 / 44

■ Open book, open notes■ No computers or calculators■ 75 minutes

Format

The DNS

Application Proxies

Circuit Gateways

Midterm

Conditions

Format

Material

43 / 44

■ Approximately 8 questions■ I’m not asking you to write programs■ Three types of questions

◆ Explanations of certain concepts, abovethe pure memorization level

◆ Carrying out tasks based on thingsdiscussed in class

◆ Design questions (i.e., ones intended tomake you think)

Material

The DNS

Application Proxies

Circuit Gateways

Midterm

Conditions

Format

Material

44 / 44

■ Everything through today’s lecture■ If it’s in my slides or I said it in class, you’re

responsible for it■ There will be some material based more on the

readings■ You’re responsible for the assigned readings at

about the level of class coverage.

Application Firewallssmb/classes/f06/l16.pdf · Inbound Email Diﬀerent Sublayers Outbound Email...

Documents

Office 365 Inbound and Outbound Configuration...Create Outbound Connector To configure Microsoft Office 365 / Exchange Online to route outbound email via SMX Email Security: 1. From

for Email Servers · heuristic analysis to detect viruses, spam, phishing, spyware and other types of unwanted and harmful email. Outbound data leak prevention, that uses the industry

How To Create The Perfect Outbound Email Campaign

Sublayers Under the Network Layer: BOOTP & DHCP

Outbound Email and Data Loss Prevention in Today's ...docs.govinfosecurity.com/files/whitepapers/pdf/351_GIS2010_WP1... · Outbound Email and Data Loss Prevention in Today’s Enterprise,

Current Reporting Period: 7/1/2015 6/30/2016...2015-2016 Annual Summary ... Benefit Partner Inbound Outbound Inbound Outbound Inbound Outbound Inbound Outbound Inbound Outbound Premera

Fungsi Outbound Training, Fungsi Kegiatan Outbound, Tujuan Outbound Perusahaan, 081231938011

Oracle eMail Center · Inbound Scenarios Outbound Scenarios Processing Overview. Overview of eMail Center 2 Oracle eMail Center Concepts and Procedures Inbound Processing Outbound

How to Create the Perfect Email Outbound Campaign

Mastering OUTBOUND Prospecting · 2020-02-27 · By combining, lead generation, email outreach, and analysis of replies in one platform, LeadGenius makes outbound faster and more

Outbound API - cisco.com · Outbound Campaign API AnOutboundCampaignmakesoutgoingcallstocustomersforaspecificpurposeortaskanddeliversthese …

Secure Pipes with Network Security · Malware scanning: Address and port scan detection and mitigation Outbound email spam: Mitigation of email spam using the CSP’s mail servers

Policies - DanumHost | Hosting · Our Email Hosting Services do not ensure that your inbound and outbound emails will be delivered; settings beyond our control may impact email deliverability,

Are You Protecting Your Email & Your Customers? …...•SPF & DKIM allow recipient to verify sender •Recommend implementation for inbound & outbound email •All domains –top-level

International SMS Rates - Elastic Email · AM ARMENIA Outbound SMS - Karabakh Telecom 0.0992 AM ARMENIA Outbound SMS - Orange 0.0992 AM ARMENIA Outbound SMS - Other 0.0992 AM ARMENIA

International SMS Rates - Elastic Email · CO COLOMBIA Outbound SMS - Avantel SAS 0.07 CO COLOMBIA Outbound SMS - Claro 0.07 CO COLOMBIA Outbound SMS - Empresa de Telecomunicaciones

Integrating with Outbound API - Oracle Cloud · 2017-08-07 · Oracle Field Service Cloud Integrating with Outbound API Chapter 2 Outbound API Overview 3 2 Outbound API Overview Outbound

Eclipse Outbound Email Frequently Asked Questions - …erpcustomer.epicor.com/docu/eclipse/companion/Outbound Email... · Eclipse – Outbound Email Frequently Asked ... When setting

Email Management Platform - Excel Micro€¦ · Account Email Archive Inbox ... using outbound logs: or Cancel Emergency Yes essentials . Filters Add New ... O Proofpoint Inc. 2013

VIBGYORtelvibgyortel.in/sites/vibgyortel.in/files/Teleoss_Brochure... · 2017-08-15 · Email Server (Outbound) SMTp Email Routing HTTP/XML with LCR RMI Server for Other Services