Skip to content

Commit 1052e60

Browse files
dboskdbosk
committed
Adds final parts for firewalls lecture
1 parent 5047df8 commit 1052e60

File tree

9 files changed

+758
-17
lines changed

9 files changed

+758
-17
lines changed

‎overview/Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,12 @@ LATEXFLAGS+= -shell-escape
66
SRC+= preamble.tex
77
SRC+= abstract.tex contents.tex
88

9-
FIGS+= xkcd-341.png
10-
FIGS+= skatteverket-hack.png
11-
FIGS+= behaviour-profiles.pdf
129
FIGS+= network-rotated.pdf
10+
FIGS+= network-dmz-rotated.pdf
1311
FIGS+= network-layers.pdf
12+
FIGS+= network-layers-packet.pdf
13+
FIGS+= network-layers-fw.pdf
14+
FIGS+= network-layers-dpi.pdf
1415

1516

1617
notes.pdf: notes.tex

‎overview/contents.tex‎

Lines changed: 228 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,25 +85,247 @@ \section{Packet filters}
8585

8686
\begin{frame}
8787
\begin{figure}
88-
\includegraphics[width=\columnwidth]{figs/network-layers.pdf}
88+
\includegraphics[width=\columnwidth]{figs/network-layers-fw.pdf}
8989
\caption{Communication between Bob and a server.}
9090
\end{figure}
9191
\end{frame}
9292

93+
\begin{frame}[fragile]
94+
\begin{definition}[Packet filter]
95+
\begin{itemize}
96+
\item \emph{Stateless} filtering based on transport layer data.
97+
\end{itemize}
98+
\end{definition}
99+
100+
\begin{minted}{json}
101+
{
102+
"src addr": "Bob",
103+
"dst addr": "server",
104+
"payload": {
105+
"src port": "random",
106+
"dst port": "https",
107+
"payload": "unintelligible blob"
108+
}
109+
}
110+
\end{minted}
111+
\end{frame}
112+
113+
\begin{frame}
114+
\begin{definition}[Ingress, egress filtering]
115+
\begin{description}
116+
\item[Ingress] inbound traffic.
117+
\item[Egress] outbound traffic.
118+
\end{description}
119+
\end{definition}
120+
\end{frame}
121+
122+
\begin{frame}[fragile]
123+
\begin{example}[Ingress filtering]
124+
\begin{minted}{json}
125+
{
126+
"src addr": "not internal",
127+
"dst addr": "Bob",
128+
"payload": {
129+
"src port": "random",
130+
"dst port": "https",
131+
"payload": "unintelligible blob"
132+
}
133+
}
134+
\end{minted}
135+
\end{example}
136+
\end{frame}
137+
138+
\begin{frame}[fragile]
139+
\begin{example}[Egress filtering]
140+
\begin{minted}{json}
141+
{
142+
"src addr": "Bob",
143+
"dst addr": "server",
144+
"payload": {
145+
"src port": "random",
146+
"dst port": "http",
147+
"payload": "unintelligible blob"
148+
}
149+
}
150+
\end{minted}
151+
\end{example}
152+
\end{frame}
153+
154+
\begin{frame}
155+
\begin{remark}
156+
\begin{itemize}
157+
\item A blunt tool.
158+
\item Discard or forward a packet.
159+
\item Vulnerable to TCP/IP bugs.
160+
\end{itemize}
161+
\end{remark}
162+
\end{frame}
93163

94-
\section{Circuit-level gateways}
95164

165+
\section[SPI]{Circuit-level gateways}
96166

97-
\section{Application firewalls}
167+
\begin{frame}[fragile]
168+
\begin{definition}[Stateful firewall/circuit-level gateway]
169+
\begin{itemize}
170+
\item Stateful filtering based on transport layer data.
171+
\end{itemize}
172+
\end{definition}
98173

174+
\begin{columns}[T]
175+
\begin{column}{0.35\columnwidth}
176+
\begin{minted}{json}
177+
{
178+
"src addr": "Bob",
179+
"dst addr": "server",
180+
"payload": {
181+
"flag": "SYN",
182+
"seq num": 0,
183+
"src port": "random",
184+
"dst port": "https",
185+
"payload": "blob"
186+
}
187+
}
188+
\end{minted}
189+
\end{column}
190+
\begin{column}{0.55\columnwidth}
191+
\begin{tabular}{llll}
192+
\textbf{src} & \textbf{dst} & \textbf{state} & \textbf{sn} \\
193+
\midrule
194+
Bob:random & server:https & SYN & 0
195+
\end{tabular}
196+
\end{column}
197+
\end{columns}
198+
\end{frame}
99199

100-
\section{Summary}
200+
\begin{frame}[fragile]
201+
\begin{columns}[T]
202+
\begin{column}{0.35\columnwidth}
203+
\begin{minted}{json}
204+
{
205+
"src addr": "server",
206+
"dst addr": "Bob",
207+
"payload": {
208+
"flag": "ACK",
209+
"seq num": 1,
210+
"src port": "https",
211+
"dst port": "random",
212+
"payload": "blob"
213+
}
214+
}
215+
\end{minted}
216+
\end{column}
217+
\begin{column}{0.55\columnwidth}
218+
\begin{tabular}{llll}
219+
\textbf{src} & \textbf{dst} & \textbf{state} & \textbf{sn} \\
220+
\midrule
221+
Bob:random & server:https
222+
& \only<1>{SYN}\only<2>{\color{blue}ACK}
223+
& \only<1>{0}\only<2>{\color{blue}1}
224+
\end{tabular}
225+
\end{column}
226+
\end{columns}
227+
\end{frame}
101228

102229
\begin{frame}
103-
\begin{block}{Summary}
230+
\begin{remark}
104231
\begin{itemize}
105-
\item \dots
232+
\item Keeps track of TCP connections.
233+
\item Avoids TCP/IP bugs.
106234
\end{itemize}
235+
\end{remark}
236+
\end{frame}
237+
238+
239+
\section[DPI]{Application firewalls}
240+
241+
\begin{frame}
242+
\begin{figure}
243+
\includegraphics[width=\columnwidth]{figs/network-layers-dpi.pdf}
244+
\caption{Communication between Bob and a server.}
245+
\end{figure}
246+
\end{frame}
247+
248+
\begin{frame}[fragile]
249+
\begin{definition}[Application firewalls/Deep packet inspection]
250+
\begin{itemize}
251+
\item Stateful filtering based on data from \emph{all layers}.
252+
\end{itemize}
253+
\end{definition}
254+
\begin{minted}{json}
255+
{
256+
"src addr": "server",
257+
"dst addr": "Bob",
258+
"payload": {
259+
"flag": "ACK",
260+
"seq num": 4,
261+
"src port": "http",
262+
"dst port": "random",
263+
"payload": {
264+
"data": "...<h1>Down with government!</h1>..."
265+
}
266+
}
267+
}
268+
\end{minted}
269+
\end{frame}
270+
271+
\begin{frame}
272+
\begin{remark}
273+
\begin{itemize}
274+
\item Can detect banned content.
275+
\item Can detect forbidden protocols on non-standard ports.
276+
\item Can even detect certain buffer-overflow attacks.
277+
\item Essentially a combination of stateful firewall and network-based
278+
intrusion detection system.
279+
\end{itemize}
280+
\end{remark}
281+
\end{frame}
282+
283+
\begin{frame}
284+
\begin{example}[The Great Firewall of China]
285+
\begin{itemize}
286+
\item Many countries engaging in censorship use DPI.
287+
\item See
288+
\citetitle{MeasuringCircumventingInternetCensorship}\footfullcite{MeasuringCircumventingInternetCensorship}
289+
for an adversarial treatment of DPI.
290+
\end{itemize}
291+
\end{example}
292+
\end{frame}
293+
294+
295+
\section{Placement}
296+
297+
\begin{frame}
298+
\centering
299+
\only<1>{
300+
\includegraphics[height=0.70\textheight]{figs/network-rotated.pdf}
301+
}
302+
\only<2>{
303+
\includegraphics[height=0.70\textheight]{figs/network-dmz-rotated.pdf}
304+
}
305+
306+
\begin{question}
307+
\begin{itemize}
308+
\item Where to place the firewall?
309+
\end{itemize}
310+
\end{question}
311+
\end{frame}
312+
313+
\begin{frame}
314+
\begin{block}{Types}
315+
\begin{description}
316+
\item[Bastion host] Stronghold in network.
317+
\begin{itemize}
318+
\item Minimize attack surface.
319+
\end{itemize}
320+
321+
\item[Host based] Firewalls on servers, secure individual host.
322+
\begin{itemize}
323+
\item Tailored filter to host needs.
324+
\item Protects from internal attacks.
325+
\end{itemize}
326+
327+
\item[Personal] Firewall on workstations, much less complex.
328+
\end{description}
107329
\end{block}
108330
\end{frame}
109331

‎overview/figs/.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,13 @@ network-layers.pdf_tex
44
network-rotated.pdf
55
network.pdf
66
network.pdf_tex
7+
network-dmz-rotated.pdf
8+
network-dmz.pdf
9+
network-dmz.pdf_tex
10+
network-layers-dpi.pdf
11+
network-layers-dpi.pdf_tex
12+
network-layers-fw.pdf
13+
network-layers-fw.pdf_tex
14+
network-layers-packet.pdf
15+
network-layers-packet.pdf_tex
716

‎overview/figs/Makefile‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,26 @@
11
%-crop.pdf: %.pdf
22
pdfcrop $<
33

4-
network.pdf: network.svg
5-
network-rotated.pdf: network.pdf
4+
%-rotated.pdf: %.pdf
65
pdftk $< cat 1-endeast output $@
76

7+
network.pdf: network.svg
8+
network-dmz.pdf: network-dmz.svg
89
network-layers.pdf: network-layers.svg
10+
network-layers-packet.pdf: network-layers-packet.svg
11+
network-layers-fw.pdf: network-layers-fw.svg
12+
network-layers-dpi.pdf: network-layers-dpi.svg
913

1014

1115
.PHONY: clean
1216
clean:
1317
${RM} *-crop.pdf
1418
${RM} network.pdf network.pdf_tex network-rotated.pdf
19+
${RM} network-dmz.pdf network-dmz.pdf_tex network-dmz-rotated.pdf
1520
${RM} network-layers.pdf network-layers.pdf_tex
21+
${RM} network-layers-packet.pdf network-layers-packet.pdf_tex
22+
${RM} network-layers-fw.pdf network-layers-fw.pdf_tex
23+
${RM} network-layers-dpi.pdf network-layers-dpi.pdf_tex
1624

1725

1826
INCLUDE_MAKEFILES?=../../makefiles

‎overview/figs/network-dmz.svg‎

Lines changed: 101 additions & 0 deletions
Loading

‎overview/figs/network-layers-dpi.svg‎

Lines changed: 129 additions & 0 deletions
Loading

‎overview/figs/network-layers-fw.svg‎

Lines changed: 122 additions & 0 deletions
Loading

‎overview/figs/network-layers-packet.svg‎

Lines changed: 108 additions & 0 deletions
Loading

‎overview/literature.bib‎

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,52 @@ @book{Anderson2008sea
1111
keywords={IT-s{\"a}kerhet},
1212
}
1313

14-
@book{SecurityEconometrics,
15-
title={Security econometrics: The dynamics of (in) security},
16-
author={Frei, Stefan},
17-
volume={93},
18-
year={2009},
19-
publisher={ETH Zurich}
14+
@phdthesis{MeasuringCircumventingInternetCensorship,
15+
author = {Winter, Philipp},
16+
institution = {Karlstad University, Department of Mathematics and
17+
Computer Sc ience},
18+
pages = {147},
19+
school = {Karlstad University, Department of Mathematics and
20+
Computer Science },
21+
title = {Measuring and circumventing Internet censorship},
22+
series = {Karlstad University Studies},
23+
ISSN = {1403-8099},
24+
number = {2014:65},
25+
keywords = {tor, censorship, circumvention,
26+
anonymity},
27+
abstract = {An ever increasing amount of governments, organisations, and
28+
comp anies employ Internet censorship in order to filter
29+
the free flow of informat ion.  These efforts are
30+
supported by an equally increasing number of companie s
31+
focusing on the development of filtering equipment. Only
32+
what these entitie s consider right can pass the
33+
filters. This practice constitutes a violation of the
34+
Universal Declaration of Human Rights and hampers progress. 
35+
This thes is contributes novel techniques to measure and
36+
to circumvent Internet censors hip. In particular, we 1)
37+
analyse how the Great Firewall of China is blocking the
38+
Tor network by using active probing techniques as well as
39+
side channel m easurements, we 2) propose a concept to
40+
involve users in the process of censo rship analysis, we
41+
3) discuss the aptitude of a globally-deployed network mea
42+
surement platform for censorship analysis, and we 4)
43+
propose a novel circumve ntion protocol. We attach
44+
particular importance to practicality and usability .
45+
Most of the techniques proposed in this thesis were
46+
implemented and some of them are deployed and used
47+
on a daily basis.  We demonstrate that the measur
48+
ement techniques proposed in this thesis are practical
49+
and useful by applying them in order to shed light
50+
on previously undocumented cases of Internet cen
51+
sorship. We employed our techniques in three countries
52+
and were able to expos e previously unknown
53+
censorship techniques and cooperation between a corporat
54+
ion and a government for the sake of censorship. We also
55+
implemented a circum vention protocol which was
56+
subsequently deployed and is used to evade the Gre at
57+
Firewall of China. },
58+
ISBN = {978-91-7063-605-9},
59+
year = {2014},
60+
URL = {http://urn.kb.se/resolve?urn=urn:nbn:se:kau:diva-34475}
2061
}
2162

0 commit comments

Comments
 (0)