Redes TEC

Mitigação: TA14-017A

Objetivo: Recusar conexões UDP IP para o destino <PUBLIC-ADDRESS> na porta 161 (snmp) e 123 (ntp).

Acesso: C1905
Interface: Gateway de Navegação

Extended IP access list 199
10 deny ip 192.168.0.0 0.0.255.255 any
20 deny ip 172.16.0.0 0.15.255.255 any
30 deny ip any 10.0.0.0 0.255.255.255
40 deny ip any 192.168.0.0 0.0.255.255
50 deny ip any 172.16.0.0 0.15.255.255
60 deny udp host PUBLIC-ADDRESS eq ntp any (3 matches)
70 deny udp host PUBLIC-ADDRESS eq snmp any (2 matches)
80 deny tcp host PUBLIC-ADDRESS eq domain any
90 deny udp host PUBLIC-ADDRESS eq domain any
100 permit ip any any (8714 matches)

========== SNMP OPEN ==========

Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 08:35 -03
Nmap scan report for PUBLIC-ADDRESS
Host is up (0.0058s latency).

PORT STATE SERVICE
161/udp open snmp

Nmap done: 1 IP address (1 host up) scanned in 1.93 seconds

========== NTP OPEN ==========

Testador: Server Test

IPv4 test results
Result:OK
Server:PUBLIC-ADDRESS
Stratum:3
Offset:0.004442
Delay:0.23228

========== REGRA APLICADA ==========

• ABUSE DNS

• ABUSE NTP

• ABUSE SNMP

access-list 199 deny ip 192.168.0.0 0.0.255.255 any
access-list 199 deny ip 172.16.0.0 0.15.255.255 any
access-list 199 deny ip any 10.0.0.0 0.255.255.255
access-list 199 deny ip any 192.168.0.0 0.0.255.255
access-list 199 deny ip any 172.16.0.0 0.15.255.255
access-list 199 deny udp host PUBLIC-ADDRESS eq 123 any
access-list 199 deny udp host PUBLIC-ADDRESS eq snmp any
access-list 199 deny tcp host PUBLIC-ADDRESS eq domain any
access-list 199 deny udp host PUBLIC-ADDRESS eq domain any
access-list 199 permit ip any any

========== VALIDAÇÃO DE MITIGAÇÃO ==========

$ sudo nmap -sU PUBLIC-ADDRESS -p 161
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 09:43 -03
Nmap scan report for PUBLIC-ADDRESS
Host is up (0.011s latency).

PORT STATE SERVICE
161/udp open snmp

Nmap done: 1 IP address (1 host up) scanned in 4.98 seconds

$ sudo nmap -sU PUBLIC-ADDRESS -p 123
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 09:43 -03
Nmap scan report for PUBLIC-ADDRESS
Host is up (0.0057s latency).

PORT STATE SERVICE
123/udp open ntp

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

$ sudo nmap -sU PUBLIC-ADDRESS -p 123
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 09:44 -03
Nmap scan report for PUBLIC-ADDRESS
Host is up (0.0018s latency).

PORT STATE SERVICE
123/udp open|filtered ntp

Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds

$ sudo nmap -sU PUBLIC-ADDRESS -p 161
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 09:44 -03
Nmap scan report for PUBLIC-ADDRESS
Host is up (0.0058s latency).

PORT STATE SERVICE
161/udp open|filtered snmp

Nmap done: 1 IP address (1 host up) scanned in 0.42 seconds

===========================================================================================

Alert: TA14-017A - UDP-Based Amplification Attacks
Risk: Certain application-layer protocols that rely on the User Datagram Protocol (UDP) have been identified as potential attack vectors.
Protocol: Simple Network Management Protocol Version 2
Vulnetabilidade: GetBulk request
Bandwidth Amplification Factor: 6.3

Esta filtragem segue conformidade com o IETF BCP 38 e guia BCP 84 da RFC 2827.

-----

BCP 38 - RFC 2827

Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing, MAY 2000

Best Current Practices for the Internet Community

Baker, F. e P. Savola, "Ingress Filtering for Multihomed Networks", BCP 84, RFC 3704, março de 2004.

Sriram, K., Montgomery, D. e J. Haas, "Enhanced Faasible-Path Unicast Reverse Path Forwarding", BCP 84, RFC 8704, fevereiro de 2020.

<https://www.rfc-editor.org/info/bcp84>

===========================================================================================