Today I'm going to talk about an open source project designed for protecting the network.
In particular using some concepts such as geofencing, block list and analysis of service
networks.
I will tell you a little bit the idea behind this project.
So in a sense this work started mainly when the war in Ukraine started and we have seen
a really spiking in attacks towards servers.
And so we wanted to do something that was easier to maintain than what we had in the
past.
So we said let's do something.
And this is a work that we have started to develop with some students at the university.
And we said to ourselves we need to handle a little bit IP firewalling a little bit better
because you know a firewall is great if it is static.
So in the sense that you put some rules inside the firewall and they stay in the firewall
for a while.
It's not continuous, add or remove, add or remove.
This is not a nice thing.
And a typical example is geofencing.
Geofencing is the ability to block traffic from specific countries.
We know that it is not a solution.
Definitely it is not a solution.
But for specific protocols it makes sense.
Let's make an example.
Suppose that you have a VPN server that it is used by your company to simply to connect
you to your corporate site.
So what do you want to leave it open for everybody?
You can claim that today you are in Belgium maybe tomorrow or after tomorrow you will
be back to your home country.
So probably it is not a good idea.
But in general some sort of geofencing is necessary.
If you manage a service on the internet you will see that most of the logs inside your
Pashi.log or Postgres or whatever are generated by people that are not really interested in
what you do but are interested in breaking you or trying to find a way to break your
system to go somewhere else.
So it makes sense for us at least to circumvent.
When I say geofencing it doesn't mean a specific country.
It doesn't mean Belgium for instance.
We must say Europe for sure, not South America.
And another problem is encryption.
Encryptions is a very nice thing to have.
We are not going to remove it.
It should be present everywhere.
But the problem is that if you look at this problem from the network and we are in the
network in that room you would see that encryption creates a problem.
Not just the analysis of the traffic per se.
So when you say the initial handshake, the way people are contacting you, if the fingerprint
of this guy is a good fingerprint or is not a fingerprint used by a previous attacker.
These things are very nice to have but they are not enough because you don't know after
the handshake what is this guy asking you to do.
So this is another problem.
So this has been the motivation.
So the idea was to create a single open source tool because you can use many tools to do
that.
Okay, ready.
Very simple.
I will show that in this presentation.
But the problem is that you have one.
So to have something simplified in one place.
And also to do this for the next thing that we show in a second.
So geofencing.
So this is a typical example of how you can block a country on Linux.
So this is a simple script.
You have a country.
You have a country where you want to ban.
So you download from a certain place.
This is a typical example.
The list of networks that belong to such countries.
You have to make sure that this is updated because you have to do it from time to time.
Because countries in particular, sometimes there is a network that is sold or acquired
by the companies belonging to a country or another.
And you have in essence to download that didn't occur, but I hope that it is not upset with
me.
download the file and then put it into the file.
And this is the way it works.
And every day, you have to do it every week.
General from time to time, you have to do that.
And if you have several countries,
it's a country, one, BCN, whatever,
so you lose here track of what this is in this country.
So you have to remove everything and start over.
So this was how I understand that
configuring this is complicated.
Even though solutions exist.
Again, geofencing is not the way
to solve cybersecurity problems,
but it's a nice way to mitigate them, for sure,
at least for specific protocol.
So this was one of the motivations.
The second thing I told you before is so-called block list.
Block list means I want to block specific people
based on something, okay?
It's usually based on black list.
So a set of IP addresses that, as I said,
have been pre-labeled, or if you want to use
the machine learning word that today is very popular,
or if you want to say, there are some people
that for some reasons have put in some list,
some security guys, that have done something nasty
to other people in a few days before or the previous week.
Usually these are created by putting
honeypots on the internet.
And when you see the violations that people
are trying to break to those honeypots,
you will see that these guys are labeled as bad guys.
The nice thing is that there are several
black lists available on the internet,
but this is not good news all the time.
Unfortunately, because some of those black lists
are run by volunteers, okay?
So some of them are good, some of them are not maintained.
So in particular, if you imagine the free VPS services,
so those that you can buy for five euro a month,
they are constantly moving.
So today this IP is bad, tomorrow it's not bad anymore,
and the thing happens to the reverse.
So the reputation is something that is dynamic.
So you need to find black lists that make sense.
So for instance, these days we are using the,
one of the black lists that we are using,
the Stratosphere IPS black list.
That is a very good black list.
But unfortunately, since some days,
they are black listing for instance, Google,
or they are black listing with GitHub,
or they are black listing 888.0999,
so they are the public DNS servers.
But if you don't have some regional knowledge,
so something on the place where you live,
that doesn't mean the town,
but it means the network operators, or your neighbors.
So let's put it another term.
If you take a black list that is coming from the US,
it will be 70% effective to you,
but it will not protect you for the rest of the problem.
So we need something that are created here.
Also some of the black lists, please read the paper,
use very large CIDR.
And I don't believe that everybody is bad.
Maybe in this room there is somebody that is bad,
but I don't think that 99% of the people are bad.
So it put a slash, whatever, slash two or three,
this room and everybody's bad.
So this to say that they're good,
if you use high quality black list.
But if you want to take something on the internet
and put it, the longer is the better,
so this is the wrong way of doing it.
Also we have the problem of attacking on services.
The problem of the service is that most of the time,
it is encrypted.
If it is not encrypted, very often it is becoming encrypted.
And this again, it's good news.
So the black list is a way to prevent nasty people
from contacting you, but then the rest of the group,
that should be the majority,
can still create problems to you.
This is what I wanted to say.
So the black list are not the solution.
They are nice to have.
They are nice to have a solution to put in place,
but they are not enough.
So if you look at log servers,
this is an example from the log server I did
when I did this live two days ago,
it's one of them, it's full of them.
Most of the logs are like this.
So you would see good people contacting you,
but most of the logs are attempts like this.
So authentication, authentication,
authentication error, too many attempts.
This is the email and this is the web.
So if you look at the WordPress, it will be even worse.
I tried to break, you see,
they tried to put a single config file for everything.
Okay, you put everything in one place.
And because it's designed for security,
we have also put some security features, okay?
That spans from the network side,
but also to the service side.
So we have something we call watcher.
So tools that are watching log files
and searching for anomalies.
It can block and block people, very good.
And they call so refresh a blacklist automatically.
So you don't have to create complicated scripts
that sometimes they break and put several countries into it.
And the result can be shared first of all through Telegram.
So we receive messages from wherever there is something wrong.
You can execute actions, okay?
Or you can send them through Xerion Q
and we are adding additional brokers,
so for example QTT to distribute them.
So to have them into a single location.
And the config file, it is very simple.
So you specify first of all the market.
I think links mean drop or pass, okay?
You can hear them, but it can also mean slow down.
So you can mitigate certain traffic based on that.
You can specify the policy.
For the policy, you can specify what you want to do.
So in this case, if the policies drop,
allow these countries, okay?
Or this continent, North America, okay?
You can say everybody from this place can connect.
If you, for instance, pass, it's the other way around.
So block, allow everybody except those countries, okay?
And you can specify what part you want to monitor,
so what part you want to enforce your rules,
and what part you don't want to look at all
because they have to be open.
So something to ignore.
So for instance, this is 10TP.
In addition to that, you can put some honeypot ports.
So it means that if you want to say, okay,
these are the list of my services, good.
But if somebody connects to another port,
that is not one of the ports, so why is it doing that?
Is it a mistake, so it does it once?
Or it is an attempt, it's a scanning,
so we have seen before, so network discovery.
So once we made the decision,
we marked the traffic as good or bad,
and the Linux does the rest.
No more packets are sent to user space.
So very little, you know, CPU usage,
and everything is happening inside the,
inside the kernel, in VST, it's a little bit different.
And watch it suspend by the tool,
so when you do this control, start, start and stop,
everything is done by that, you do reload,
that's the automatic.
And automatically it refreshes the blacklist
or blocklist every night for you,
so you don't have to do anything.
And this is a typical example.
So look at the time, again, this is when I did my slides
a couple of days ago.
If you look at the time, you'll see,
and these are just two servers.
It's always like that.
Most of the problems are created by some people
that are spending their time to do things
that they should not do.
So our service, for instance, is in the Netherlands.
So we see some time, very simple patterns
that they are moving from one server to another to do that.
So this is all, but what's next?
So what is the idea?
As I said, one of the motivation was not just to create
a simple administrative tool so that in one place,
everything happens.
But we want to create something that it is used
to secure services for everyone
with one single config file, very simple, in JSON.
But we would like to do something next.
So what we are creating, we are creating a sort of cloud.
So in essence, we would like those tools
that are deployed to be put in a way
so that they can speak each other.
The cloud doesn't mean that you send everything to Amazon.
Send your data to the party people
that you don't know what type of use they will do,
what that can pollute your data with probably some IPs
that are wrong, maybe simply because they want
to block other people.
But the idea is that you can run your own server,
especially if you are a service provider,
so you have many services,
or you can put this service also on a laptop,
okay, on a Linux laptop that you can bring home.
If you see something bad happen,
you can report this to the central server.
And this is what we want to do.