Cybersecurity Fundamentals Lab Series and P4 Programmable Switches Overview

Cybersecurity (Security+) and P4 Programmable Switches Jorge Crichigno University of South Carolina https://research.cec.sc.edu/cyberinfra/ Western Academy Support and Training Center (WASTC) University of South Carolina (USC) Cisco Systems 260 East Tasman, Building 9 San Jose, California January 5, 2024 1

Agenda Slides and resources are available on the webpage of the session: https://research.cec.sc.edu/cyberinfra/wastc-january-2024-conference 2

Cybersecurity Fundamentals Lab Series 3

Cybersecurity Fundamentals Lab Series The labs provide a hands-on experience on cybersecurity tools and applications It covers topics included in Security+ Malware Social engineering SQL injection Cross-site scripting Cryptography others The labs are available on NDG s NETLAB+ and NDG s Online More information about CybersecurityFundamentals and other lab libraries is available at: https://research.cec.sc.edu/cyberinfra/cybertraining 4

Cybersecurity Fundamentals Lab Series The labs provide learning experiences on cybersecurity topics Lab 1: Reconnaissance: Scanning with NMAP, Vulnerability Assessment with OpenVAS Lab 2: Remote Access Trojan (RAT) using Reverse TCP Meterpreter Lab 3: Escalating Privileges and Installing a Backdoor Lab 4: Collecting Information with Spyware: Screen Captures and Keyloggers Lab 5: Social Engineering Attack: Credentials Harvesting and Remote Access through Phishing Emails Lab 6: SQL Injection Attack on a Web Application Lab 7: Cross-site Scripting (XSS) Attack on a Web Application Lab 8: Denial of Service (DoS) Attacks: SYN/FIN/RST Flood, Smurf attack, and SlowLoris Lab 9: Cryptographic Hashing and Symmetric Encryption Lab 10: Asymmetric Encryption: RSA, Digital Signatures, Diffie-Hellman Lab 11: Public Key Infrastructure: Certificate Authority, Digital Certificate Lab 12: Configuring a Stateful Packet Filter using iptables Lab 13: Online Dictionary Attack against a Login Webpage Lab 14: Intrusion Detection and Prevention using Suricata Lab 15: Packet Sniffing and Relay Attack Lab 16: DNS Cache Poisoning Lab 17: Man in the Middle Attack using ARP Spoofing Lab 18: Understanding Buffer Overflow Attacks in a Vulnerable Application Lab 19: Conducting Offline Password Attacks 5

Organization of Lab Manuals Each lab starts with a section Overview Objectives Lab settings: passwords, device names Roadmap: organization of the lab Section 1 Background information (theory) of the topic being covered (e.g., malware fundamentals) Section 1 is optional (i.e., the reader can skip this section and move to lab directions) Section 2 n Step-by-step directions 6

Pod Design Attacker in the WAN running Kali Victim in the internal network running Windows 10 Web, DNS, and Mail servers in the DMZ zone Border router interconnect the networks Border router implements basic security policy: Attacker cannot initiate connections to devices in the internal network 7

Examples Vulnerability assessment using OpenVAS 8

Examples Keylogger Deploying a Spyware Victim Attacke r Screen capture 9

Examples Social engineering and phishing emails Victim Attacker 10

Examples Creating a digital certificate and deploying it on an Apache web server X.509 certificate Certificate deployed on a production grade web server 11

Examples Detecting and blocking SYN Flood attack using Suricata IDS/IPS Incoming rate after mitigation Incoming rate before mitigation 12

Intro to P4 Lab Series 13

Can the Data Plane be Programmable? Evolution of the computing industry 1970s 1970s-80s 1990s-2000s 2010s 2017 1. Vladimir Gurevich, Introduction to P4 and Data Plane Programmability, https://tinyurl.com/2p978tm9. 14 14

P4 Programmable Switches P41 programmable switches permit a programmer to program the data plane Define and parse new protocols Customize packet processing functions Measure events occurring in the data plane with high precision Offload applications to the data plane 1. P4 stands for stands for Programming Protocol-independent Packet Processors 15 15

P4 Programmable Switches P41 programmable switches permit a programmer to program the data plane Define and parse new protocols Customize packet processing functions Measure events occurring in the data plane with high precision Offload applications to the data plane Reproduced from N. McKeown. Creating an End-to-End Programming Model for Packet Forwarding. Available: https://www.youtube.com/watch?v=fiBuao6YZl0&t=4216s 16 16

P4 Programmable Switches The relay server makes it possible for two devices behind NAT to connect with each other relays the RTP RTP Information at relay server Device IP - port IPA - PA Allocated IP - port IPR - PRA A B IPB - PB IPR - PRB IPA - pA IPB - pB A B 17 17

P4 Programmable Switches P4 switches permit programmer to program the data plane Add proprietary features; e.g., emulate RTP relay server Parse packet headers, including UDP packets carrying RTP traffic Header inspection, identifying media sessions using the 5-tuple Modify fields, IP addresses and ports Programmable chip P4 code 18 18

Implementation Results P4 switches permit programmer to program the data plane Add proprietary features; e.g., emulate RTP relay server Parse packet headers, including UDP packets carrying RTP traffic Header inspection, identifying media sessions using the 5-tuple Modify fields, IP addresses and ports Application example: media (voice) relay server 19 19

Library on Security Applications with P4 20

Library on Security Applications with P4 Experiments Lab 1: Introduction to Mininet Lab 2: Introduction to P4 and BMv2 Lab 3: P4 Program Building Blocks Lab 4: Parser Implementation Lab 5: Introduction to Match-action Tables Lab 6: Implementing a Stateful Packet Filter for the ICMP protocol Lab 7: Implementing a Stateful Packet Filter for the TCP protocol Lab 8: Detecting and Mitigating the DNS Amplification Attack Lab 9: Identifying Heavy Hitters using Count-min Sketches (CMS) Lab 10: Limiting the Impact of SYN Flood by Probabilistically Dropping Packets Lab 11: Blocking Application Layer Slow DDoS Attack (Slowloris) Lab 12: Implementing URL Filtering through Deep Packet Inspection and String Matching 21

Organization of Lab Manuals Each lab starts with a section Overview Objectives Lab settings: passwords, device names Roadmap: organization of the lab Section 1 Background information (theory) of the topic being covered (e.g., malware fundamentals) Section 1 is optional (i.e., the reader can skip this section and move to lab directions) Section 2 n Step-by-step directions 22

Other P4 Libraries 23

Introduction to P4 Lab Series Lab Experiments Lab 1: Introduction to Mininet Lab 2: Introduction to P4 and BMv2 Lab 3: P4 Program Building Blocks Lab 4: Parser Implementation Lab 5: Introduction to Match-action Tables (Part 1) Lab 6: Introduction to Match-action Tables (Part 2) Lab 7: Populating and Managing Match-action Tables Lab 8: Checksum Recalculation and Packet Deparsing Lab Exercises Exercise 1: Building a Basic Topology Exercise 2: Compiling and Testing a P4 Program Exercise 3: Parsing UDP and RTP Exercise 4: Building a Simplified NAT Exercise 5: Configuring Tables at Runtime Exercise 6: Building a Packet Reflector 24

P4 Applications and Custom Processing Lab Series Lab 1: Introduction to Mininet Lab 2: Introduction to P4 and BMv2 Lab 3: P4 Program Building Blocks Lab 4: Defining and processing custom headers Lab 5: Monitoring the Switch s Queue using Standard Metadata Lab 6: Collecting Queueing Statistics using a Header Stack Lab 7: Measuring Flow Statistics using Direct and Indirect Counters Lab 8: Rerouting Traffic using Meters Lab 9: Storing Arbitrary Data using Registers Lab 10: Calculating Packets Interarrival Times using Hashes and Registers Lab 11: Generating Notification Messages from the Data Plane using Digests 25