The Internet: what it looks like, how it works, and how it is abused

Transcription

1 The Internet: what it looks like, how it works, and how it is abused Bill Cheswick Visiting Scholar, University of Pennsylvania 1

2 What Does the Internet Look Like? 2

3 Science Seminar 3

4 Science Seminar 4

5 Science Seminar 5

6 Internet 101 6

7 At the heart of the Internet TCP/IP Local area networks Wide area communications modems hard-wired lines Routers 7

8 Clients and Servers Clients initiate the call Clients are programs web browsers mail readers The client s name is usually unimportant 8

9 Some Internet Basics Internet communication Client Server Internet 9

10 TCP/IP A set of protocols, standards, and agreements Started by the government (DARPA research) A priesthood of geeks polished it up Running by

11 Some Internet Basics Internet communication Client Server Application level Application level TCP/UDP TCP/UDP IP IP Hardware Hardware Internet 11

12 Some Internet Basics Internet communication Client Server Application level Application level TCP/UDP TCP/UDP IP IP Hardware Hardware Internet 12

13 IP Packets All Internet traffic consists of packets A packet is roughly 64 to 1,500 characters long Each packet has a source and destination IP address, and a payload 13

14 Sample IP Packet (simplified) Typical MTU: 1500 bytes Source Destination Payload 14

15 IP addresses IPv4: 4 octets (32 bits), 3,758,096,384 IP addresses May be permanently assigned to a host, or dynamically assigned when the host is booted IPv6: 128 bits, 3.4x10 38, or 5x10 14 moles! 2601:647:4781:4100::13 15

16 Sample IP Packet Source Destination French poetry Payload of Zambian origin 16

17 Sample IP Packets French poetry of Zambian origin 47,86 matches found Match 1:... 17

18 Network Hardware 18

19 Local area network Ethernet

20 Local area network To the Internet (router) Ethernet

21 Routers 21

22 Routers Each router has a list of all network destinations, and where to forward packets to them......except this gateway, which has a single default route. 22

23 Some Internet Basics Internet communication Client Application level TCP/UDP IP Hardware Router IP Hardware Router IP Hardware Router IP Hardware Server Router Router Application level IP Hardware IP Hardware TCP/UDP IP Hardware 23

24 tracert (in DOS) Shows the path to an Internet host Can be used to diagnose those mysterious Internet failures and slowdowns 24

25 5 Feb 1999 Science Seminar 25

26 Science Seminar 26

27 Science Seminar 27

28 Science Seminar 28

29 Science Seminar 29

30 Science Seminar 30

31 Science Seminar 31

32 Science Seminar 32

33 Science Seminar 33

34 Science Seminar 34

35 Science Seminar 35

36 Science Seminar 36

37 Science Seminar 37

38 Science Seminar 38

39 Science Seminar 39

40 Science Seminar 40

41 Science Seminar 41

42 Science Seminar 42

43 Science Seminar 43

44 Science Seminar 44

45 Science Seminar 45

46 Science Seminar 46

47 Science Seminar 47

48 Science Seminar 48

49 Routers play hot-potato with packets They only need to know the next router for any IP address An average packet travels 17 hops on the Internet between client and server Maximum number of hops has been somewhere in the high 30s 49

50 How do these packets find their way through this mess? Master routing lists had some 50,000 entries in Current size: 393,165 ( The size of this table is a limit to Internet growth IP packets may be dropped, duplicated, or arrive out of order 50

51 TCP Taming IP 5 Feb 1999 Science Seminar 51

52 TCP TCP supplies a reliable connection to the other end Breaks a stream of data into packets Reassembles packets into a stream Application level TCP or UDP IP Services do, or time out Ethernet, etc. 52

53 TCP services, by the numbers 21: ftp 23: telnet 25: smtp (mail) 80: http (web) You can make up your own, without permission needed 53

54 Domain Name Service (DNS) ntp.research.bell-labs.com mail.att.net DNS converts names to IP addresses 54

55 A Sample Internet session (simplified a bit) 55

56 User types URL found on a beer can 56

57 The browser uses the DNS to look up the IP address budweiser.com DNS Answer is

58 Browser sends request packet to the gateway Addressed to

59 Gateway forwards packet to default route 5 Feb 1999 Science Seminar 59

60 60

61 61

62 What Can Go Wrong? (everything) 62

63 User types the wrong URL URLs not suited to speech Spelling counts in URLS drudge.com is not drudgereport.com budwieser.com is not micros0ft.com 63

64 DNS gives an incorrect answer Might be hacked or miss-configured DNS Cache poisoning 64

65 Routing might be subverted 65

66 Eavesdropping (usually at the ends, not in the middle) 66

67 Denial-of-Service attack 67

68 Server compromised 68

69 !69

70 Un film par Steve Hollywood Branigan... 70

71 !71

72 72

73 fin 73

74 Default TCP services on an SGI workstation ftp stream tcp nowait root /v/gate/ftpd telnet stream tcp nowait root /usr/etc/telnetd shell stream tcp nowait root /usr/etc/rshd login stream tcp nowait root /usr/etc/rlogind exec stream tcp nowait root /usr/etc/rexecd finger stream tcp nowait guest /usr/etc/fingerd bootp dgram udp wait root /usr/etc/bootp tftp dgram udp wait guest /usr/etc/tftpd ntalk dgram udp wait root /usr/etc/talkd tcpmux stream tcp nowait root internal echo stream tcp nowait root internal discard stream tcp nowait root internal chargen stream tcp nowait root internal daytime stream tcp nowait root internal time stream tcp nowait root internal echo dgram udp wait root internal discard dgram udp wait root internal chargen dgram udp wait root internal daytime dgram udp wait root internal time dgram udp wait root internal sgi-dgl stream tcp nowait root/rcv dgld uucp stream tcp nowait root /usr/lib/uucp/uucpd 74

75 Social Engineering (cont.) Click here to infect your computer. 75

76 Another problem with strange programs 76

77 Viruses Attached to useful programs Infect other programs when moved to new systems Payloads vary There are about 200 new viruses reported daily Now they are spread by Word documents (executable?!) 77

78 Firewalls 78

79 We can protect a community with a guard at the entrance Evil services are blocked from external access Can let the good guys go out, and keep the bad guys from coming in Not perfect, but the economics are good 79

80 Questions/Discussion 80