Aggressive Aging manages the connections table capacity and the memory expenditure of the firewall to increase durability and stability. Aggressive Aging uses small timeouts that Check Point designates as “aggressive timeouts.” If an established connection is determined to be idle for longer than the defined (by protocol) aggressive timeout, the inspection engine will mark it eligible for deletion from the state table. As soon as the connections table or memory consumption attains a user-defined threshold (or high-water mark), Aggressive Aging is initiated. You can configure Aggressive Aging timeouts on a per-service basis.

When the set threshold is surpassed, the start of a new incoming connection triggers the deletion of 10 connections from the eligible for deletion table. An additional 10 connections are deleted for each fresh connection until the memory consumption or the connections capacity drops under a predefined low-water mark.

In the event that no eligible for deletion connections exist, the firewall will not delete connections. The table is verified following every subsequent connection that surpasses the high-water mark. The timeout configuration is a primary aspect of memory consumption configuration. Low timeout values will result in connections being removed earlier from the table to make it easier for the firewall to process additional connections at the same time. When memory consumption surpasses the threshold, using shorter timeouts can preserve the connectivity of a majority of the traffic through the firewall.

The chief advantage of Aggressive Aging is that is begins to function when the firewall has existing memory and prior to the connections table becoming completely filled. This feature diminishes the likelihood of connectivity issues that can occur due to circumstances involving low resources.

Aggressive Aging allows the firewall gateway to process an increased volume of unanticipated network traffic as may occur during a DoS attack.

In implementing the TCP/IP protocol stack, a number of systems fail to correctly deal with the reassembly of overlapping IP fragments (see http://insecure.org/sploits/linux.fragmentation.teardrop.html for details).

Conveying multiple IP fragments to the target that are created with overlapping fragment offsets where one fragment is completely enclosed inside the offset of the other can result in the host incorrectly allocating memory. This would remotely crash the vulnerable system that received the packets. Teardrop is a widely available attack tool that exploits this vulnerability. Teardrop is closely related to syndrop, a modified version that exploits a Microsoft SYN sequence bug.

SmartDefense blocks attacks that rely on overlapping IP fragment offsets. The default action is to block attacks and log them as Virtual defragmentation error: Overlapping fragments. Check Point SmartDefense blocks such attacks by default and provides the administrator with the ability to construct alerts, e-mail notices, Simple Network Management Protocol (SNMP) traps, and user-defined actions when these attacks occur.

The Ping of Death is a malformed PING request that is sent in a series of fragment packets, which when reassembled by the target exceeds the maximum IP packet size (65,535 octets). This results in a system that is vulnerable to crashing (see http://insecure.org/sploits/ping-o-death.html for details).

SmartDefense blocks this type of attack by default. The firewall logs blocked attacks with Virtual defragmentation error: Packet too big. SmartDefense provides the administrator with the ability to construct alerts, e-mail notices, SNMP traps, and user-defined actions when these attacks occur.

A LAND attack involves the attacker sending a TCP SYN packet (a connection initiation), giving the target with the source and destination addresses set as the target’s address. It also uses the same port on the target host as both source and destination. Land.c is an easily obtainable attack tool designed to exploit this vulnerability (see http://insecure.org/sploits/land.ip.DOS.html for further information).

Check Point SmartDefense blocks this attack by default and provides the administrator with the ability to construct alerts, e-mail notices, SNMP traps, and user-defined actions when these attacks occur.

An attacker sometimes directly targets security devices such as firewalls. In advanced firewalls, state information regarding connections is maintained in a state table. The state table includes connection-oriented TCP and connectionless non-TCP protocols. Attackers can send high volumes of non-TCP traffic in an effort to fill up a firewall’s state table. This results in a denial of service by preventing the firewall from accepting new connections. Unlike TCP, non-TCP traffic does not provide mechanisms to “reset” or clear a connection.

SmartDefense can restrict non-TCP traffic from occupying more than a predefined percentage of a Check Point enforcement point’s state table. This eliminates the possibility of this class of attack.

The Packet Sanity option executes a number of Layer 3 and Layer 4 “sanity” checks. These incorporate substantiating packet size, an inspection of UDP and TCP header lengths, dropping IP options, and verifying the TCP flags to ensure that packets have not been selectively crafted by a malicious user. This process also checks that all packet parameters are accurately defined as per standards (such as the RFCs). This validation is always enforced. However, administrators can configure whether logs and/or alerts will be delivered for packets that violate these requirements.

PING (ICMP echo request) is a protocol that is commonly used to confirm whether a remote system is available. The client sends an echo request, and the server responds with an echo reply. This packet also encapsulates the initial client’s IP data. A malicious user can issue an ICMP echo request to a target host with an oversize echo data field to compromise the security and availability of the client’s system. This could cause a buffer overflow. This is different from the Ping of Death, in which the PING request is malformed through a manipulation of IP fragments.

The Max PING Size check can restrict the maximum requested data echo size. The default maximum is 548 bytes as defined from the maximum size in the protocol definition. Administrators can also configure whether logs and/or alerts will be issued for offending packets.

When an IP packet exceeds the allowed size transported on a particular network, it is divided into a number of smaller IP packets and transmitted as fragments. In an attempt to conceal an attack or exploit, an attacker might break the data section of a single packet into several fragmented packets. Without reassembling the fragments, it is not always possible to detect such an attack. Consequently, malicious content that is split across fragments can traverse some firewalls. In contrast, a Check Point enforcement point collects and reassembles all the fragments of a given IP packet, verifying that the options for the fragments are consistent (e.g., that Time To Live [TTL] is the same for all fragments) so that security checks can be run against the complete packet contents.

The IP Fragments page allows an administrator to configure whether fragmented IP packets can traverse Check Point gateways. It is also possible to allow fragments, setting a limit on the number of fragments allowed, and to set a timeout period for holding unassembled fragments before discarding them. These measures help to protect against DoS attacks that seek to overwhelm the resources of perimeter security devices by flooding them with spurious packet fragments.

Network Quota enforces a limit on the number of connections that are allowed to the same source IP address. When a certain source exceeds the number of allowed connections, Network Quota can either block all new connection attempts from that source, or track the event. This capability is useful in protecting against DoS attacks, and it can help to limit worm propagation by recognizing an inappropriate increase in traffic from an infected source.

The Network Quota protection enforces a limit on the number of connections that are allowed from the same source IP address. When the number of connection requests from a certain source exceeds the configured limit, Client Quota generates an alert and/or blocks all new connections from that source. This feature is particularly useful for preventing DDoS attacks from overwhelming a server.

TCP is a connection-oriented protocol with a defined “handshake” process. To begin a connection, a client sends a SYN (Synchronize) connection request to a target host. The host then replies with an ACK (Acknowledge) response. Finally, the client responds back with a SYN-ACK reply. This process is essential to TCP communications and is used to synchronize the two hosts before communications can begin.

SYN flood attacks consist of initiating a TCP handshake (SYN) and not sending the final reply (SYN-ACK) to the server’s response (ACK) in the handshaking sequence. This results in the server maintaining an open record in its pending connection queue. As a server’s pending connection queue is limited in size, it is relatively simple to completely fill the queue with a flood of fake SYNs. As a result, the server is unable to accept valid TCP connections, resulting in a denial of service.

SmartDefense protects against SYN flood attacks on both protected servers and the Check Point enforcement point. This control keeps attackers from overwhelming servers with false SYN requests. SmartDefense provides two varieties of defense modes against SYN attacks and routinely switches between them as needed:

The Passive SYN Gateway control is the default action for SYN protection. Using this mode, the Check Point enforcement point monitors TCP handshake progression. All SYN requests are passed to the target server, and a timer is tracked for each request. If the requesting client does not reply to the target host’s ACK response inside the configured time frame, a TCP reset is delivered to the server, making it drop the connection from the server’s pending connection queue.

As the timeout period is shorter than the pending connection table, this reduces the quantity of pending TCP sessions. This mode provides increased SYN protection at an optimized performance.

When SmartDefense detects a predefined number of unanswered SYN requests per given time period, it switches to SYN Relay Defense. SYN Relay Defense counters the attack by making sure the three-way handshake is completed (i.e., that the connection is valid) before sending a SYN packet to the target host. SYN Relay Defense also ensures that the protected server does not receive any invalid connection attempts, which is advantageous if the server has limited memory or often reaches an overloaded state. In these ways, SYN Relay Defense is a high-performance kernel-level process, which acts as a relay mechanism at the connection level.

The maximum transmission unit (MTU) of a given network link specifies the largest permissible size of an IP packet on that link. PMTU, or “path” MTU, refers to the smallest MTU in the path (i.e., all of the links) from one device to another.

In a small PMTU attack, the attacker deceives a server into transporting large quantities of data using very small packets by setting the PMTU to a very small value. As each packet has a relatively large related overhead in the IP and other headers, the target server can be filled to capacity. The Minimal MTU size configuration option sets a minimum permissible size for packets in a data stream, allowing FireWall-1 to deny connections that attempt to set this size unreasonably low. You should be careful when configuring this option because an exceedingly small value will not prevent an attack, whereas an unnecessarily large value might result in legitimate requests being dropped.

The Sequence Verifier matches the current TCP packet’s sequence numbers against a state kept for that TCP connection. Packets that match the connection in terms of TCP session but have sequence numbers that do not make sense are either dropped or stripped of data.

The first thing that happens when a TCP connection is established is a synchronization of numbers linking the client and the server. This occurs in a process called the TCP three-way handshake. In this progression, the client notifies the server about the sequence numbers for the client side of the connection, and the server notifies the client about the sequence numbers for the server side of the connection. The sequence of numbers chosen during the three-way handshake stage is called the Initial Sequence Number (ISN).

The mere fact that there is dissimilarity among the various algorithms for the different operating systems creates a unique fingerprint for every system. By sending successive SYN requests and checking the difference between the ISNs, a potential attacker can determine the operating system that the server is running. SmartDefense prevents this kind of reconnaissance from occurring by creating a difference between the sequence numbers used by the server and the sequence numbers perceived by the client.

Each IP packet has a field called Time To Live (TTL). Each router along the path or route decrements this value by one. When a router decrements this value to zero it drops the packet and sends an ICMP notification (destination unreachable) to the source. Usually, when a host sends a packet, it sets the TTL to a value that is large enough that the packet can reach its destination under ordinary circumstances. Different operating systems use different default initial values for TTL. Because of this, an attacker can speculate as to the number of routers between it and the sending machine by making an informed postulation concerning the original TTL.

Further, knowledge of the initial TTLs used offers additional information concerning what operating system the host is running. SmartDefense can amend the TTL field of all packets (or selectively on only all outgoing packets) to a given number. Using this approach it is not possible to know how many internal routers (hops) are between the target and the listener, and the listener cannot utilize any knowledge of the default TTL value to speculate as to the operating system of the source host.

IP packets have a 16-bit field called the ID, which is used when an IP packet is fragmented. The ID allows the receiving machine to know which virtual packet the fragmented packets belong to. Although two IP packets must have two distinct IP IDs, there is no official specification as to how to assign the IP ID to each packet.

Different operating systems use different algorithms for assigning IP IDs to packets. Consequently, an attacker can use this information to understand what operating system generated a particular packet. SmartDefense can replace the original IP ID with one generated by the Check Point enforcement point, thus disguising the algorithm used by the original operating system and consequently disguising the operating system’s characteristics from prospective attackers.

The DShield.org Storm Center produces a Block List report, which lists address ranges that merit blocking and is regularly updated. The SmartDefense Storm Center Module retrieves and adds this list to the Security Policy in a manner that makes every update instantly effective. SmartDefense enables the system administrator to decide whether to block all the malicious IP addresses received from DShield.org, or whether to block addresses for specific gateways. Additionally, SmartDefense provides the system administrator with the option of being informed using logs, alerts, e-mail messages, and so on when IP addresses from within the IP address ranges in the Block List attempt to contact the network.

Logs can be sent to the Storm Center to help other organizations combat the threats that SmartDefense and Web Intelligence detected. Administrators can decide which Check Point log type to send to the Storm Center.

The logs submitted to the Storm Center contain the following information:

To protect a client’s privacy, SmartDefense can delete information from the destination IP address in the submitted log that could be used for identification. Administrators can configure a mask size that defines how much of an internal address to delete. This ensures the privacy of the organization while allowing the Storm Centers to correlate the attack data.

SmartDefense integrates with the SANS DShield.org Storm Center in the following manner (see Figure 7.1):

Figure 7.1. How SmartDefense Integrates with the DShield.org Network Storm Center

To manually configure the blocking of malicious IPs, follow these steps:

A host port scan is a reconnaissance attack directed at a specific host or network. A scan can determine which services a host offers. For instance, a host port scan could determine that a specified host has TCP ports 23, 25, and 110 open, denoting that it may offer the Telnet, Simple Mail Transfer Protocol (SMTP), and Post Office Protocol 3 (POP3) services.

An IP sweep scan looks for a specific open port and determines which hosts are listening in on that port. For example, network worms employ IP sweep scans when they try to find machines they can propagate themselves. For example, the Blaster worm looks for the Remote Procedure Call (RPC) service—searching the complete network looking for that single open service.

The SMTP Security Server allows for the stringent validation of SMTP. It protects against malicious mail messages, provides SMTP-centered security, prevents attempts to bypass the rulebase making use of mail relays, and prevents DoS and spam mail attacks.

Usually, the SMTP Security Server is activated by specifying resources in the rulebase. However, selecting Configuration applies to all connections will forward all SMTP connections to the SMTP Security Server and will enforce the defined settings on all connections; selecting Configurations apply only to connections related to rule base defined objects means that these configurations will apply only to SMTP connections for which a resource is defined in the rulebase.

The settings in this section apply only if an SMTP resource is defined, even if all connections in the SMTP Security Server window are checked. The SMTP Security Server does not provide authentication, as there is no person at the system who can be challenged for an authentication. The SMTP Security Server does provide content security that enables the security administrator to supply e-mail address translation by hiding “From” addresses behind a standard generic address that conceals internal network structures and actual internal users, executes e-mail filtering based on SMTP addresses and IP addresses, and strips MIME attachments of particular classes from e-mail.

Here is a summary of the settings on this page:

SmartDefense offers options that enable limitations on e-mail messages delivered to the network making use of POP3/IMAP. These options make it possible to recognize and stop malicious behavior. For example, SmartDefense can limit the length of a username and password. An attacker can send a long string of characters when it is not expected and may result in a buffer overflow attack that could crash the machine. Additionally, SmartDefense can verify and restrict binary data enclosed in POP3/IMAP messages.

SmartDefense can test POP3/IMAP usernames and passwords against the user database defined in VPN-1/FireWall-1. Based on this information, administrators can configure SmartDefense to restrict connections when the username and password are identical. SmartDefense ensures that POP3 and IMAP traffic adheres to the established protocols and security best practices. SmartDefense monitors the communication state of connections and can, for example, drop a LIST command if the user was not first authenticated as required by the protocol. In addition, SmartDefense can limit the number of NOOP commands issued. The NOOP command (No Operation) is rarely employed by e-mail clients but is used in selected DoS attacks.

Particularly for FTP when issuing the PORT command as part of the FTP control session, the originating host specifies an arbitrary destination address and port for the data connection. However, this behavior also means that an attacker can open a connection to a port of his or her choosing on a host that may not be the originating client.

Making this connection to an arbitrary host for unauthorized purposes is the FTP Bounce attack. SmartDefense protects against FTP Bounce attacks by allowing only FTP sessions in which the control and data session IP addresses match. Administrators can also configure preferred tracking options.

The FTP Security Server provides authentication services and content security based on FTP commands (PUT/GET); filename restrictions; and CVP checking (e.g., viruses and other malware). In addition, the FTP Security Server logs FTP GET and PUT commands, as well as associated filenames.

The FTP Security Server is characteristically enabled by specifying rules in the firewall security policy. If you select the Configuration applies to all connections option, the firewall will forward all FTP connections to the FTP Security Server.

For security reasons, it is possible to limit the FTP commands allowed to pass through the firewall.

Prevent Known Ports Checking allows you to select whether to allow the FTP Security Server to connect to well-known ports. Thus, it provides a second layer of protection against selected bounce attacks. Even if the attacker manages to bounce a connection, the FTP Security Server will not let the bounce connect to any port running a known service. SmartDefense blocks attempts to issue FTP PORT commands to connect to well-known TCP or UDP port numbers (e.g., TCP port 23 for Telnet and TCP 80 for HTTP).

To conform to the FTP specifications, the PORT command has the originating host specify an arbitrary destination and port for data connection. By using different representations of the same number, attackers can attempt to bypass restrictions and PORT connections. SmartDefense blocks connections that implement multiple representations of the same number in an FTP PORT command.

CIFS, the Common Internet File System (sometimes called SMB for Server Message Block), is a protocol for sharing files and printers in a Microsoft environment. The protocol is widely implemented by Microsoft operating systems. CIFS has many known vulnerabilities, including Null Session exploits and Host Announcement flooding. In addition, many worms that have infected a host exploit CIFS as a means of propagation.

The SANS Institute has acknowledged that unprotected Windows networking shares is one of the top 20 critical threats to Internet security (www.sans.org/top20). This is mainly due to the frequency of exploits that target this vulnerability.

The File and Print Sharing control lets administrators configure worm signatures that can detect and block worm attacks at the Check Point enforcement point. This detection takes place in the kernel and does not require a security server.

Both iMesh and Grokster are identified in the SmartView Tracker as KaZaA.

Gnutella, Bearshare, Shareaza, and Morpeheus are identified in the SmartView Tracker as Gnutella. The following peer-to-peer applications are also detected.

SmartDefense recognizes Yahoo! Messenger when used for messaging, voice, video, and file transfer.

SmartDefense recognizes ICQ when used for messaging, voice, video, and file transfer and defeats peer-to-peer firewall traversal. Most peer-to-peer applications include firewall traversal features, which look for open ports in the firewall. SmartDefense can detect peer-to-peer applications attempting to traverse any open port.

This also prevents HTTP masquerading. Many peer-to-peer applications can hide by encapsulating their communications in HTTP. SmartDefense can detect and block these connections.

SmartDefense can defeat peer-to-peer proxies as well. In a number of peer-to-peer applications, peer nodes communicate location information in a comparable means as dynamic routing protocols. This information allows an internal peer to commence a connection from inside the network, traversing firewalls that consider any connection initiated from inside the network as safe. SmartDefense blocks these classes of connections.

MSN Messenger uses SIP for real-time voice, video, and collaboration communication. Just like other network applications, an attacker can exploit MSN Messenger in an attack.

This control provides several security controls for MSN Messenger. SmartDefense can block all MSN Messenger traffic or restrict specific allowable actions, including file transfer, application sharing, white boards, and remote assistant. In addition, SmartDefense will apply the general SIP controls as configured in SmartDashboard.

By selecting the UDP protocol enforcement option, administrators can configure VPN-1/FireWall-1 to monitor DNS traffic to ensure compliance with DNS RFCs, meaning that the DNS packets are correctly formatted and contain only DNS-related information. DNS RFCs include 1034, 1035, 1996, 2136, 2317, 2535, and 2671. SmartDefense will test several RFC-defined parameters, including lengths, counters, header flags, domain format, and resource record format, among others.

A black list is a group of URL addresses that have been prohibited. SmartDefense contains a black list for the purpose of filtering out undesirable traffic. SmartDefense will not permit a user to access a domain address particular in the black list. You can update the domain black list manually or automatically as part of the SmartDefense Service.

To reduce DNS traffic, name servers maintain cache. Each DNS record includes a TTL value, which tells the DNS server how long the record can be stored in the cache before it should expire. Cache poisoning occurs when DNS caches mapping information that was deliberately altered from a remote name server. The DNS server caches the incorrect information and sends it out as the requested information. As a result, e-mail messages and URL addresses can be redirected and the information sent by a user can be captured and corrupted.

In addition to the controls and capabilities offered through firewall policies (these include VoIP domains, network address translator [NAT] traversal, and more), SmartDefense provides enhanced security capabilities for VoIP protocols. One of these is dynamic ports, which open firewall ports only when needed. For instance, FireWall-1 opens only the ports that have been negotiated during VoIP call setup, including those transmitted inside the protocol.

Flow enforcement monitors the state of communication between VoIP endpoints and ensures that they follow the flow defined by the individual RFCs. This helps to prevent hijackers from interjecting malicious traffic outside the regular call session process (e.g., sending fake call termination notices in an attempt to deceive a billing system).

H.323 is an International Telecommunication Union (ITU) standard that specifies the components, protocols, and procedures that provide multimedia communication services, as well as real-time audio, video, and data communications over packet networks, including IP-based networks.

SmartDefense supports H.323 Version 2, which includes H.225 Version 2 and H.245 Version 3. It performs the following application layer checks:

SIP is a VoIP protocol transported over UDP. SIP is one of the most widely accepted VoIP protocols with integration in many applications, including Microsoft Windows XP and MSN Messenger. SIP is an application-layer control protocol required for the creation, modification, and termination of sessions with one or more participants. SmartDefense Application Intelligence ensures that packets match the RFC 3261 for SIP over UDP/IP specifications (SIP over TCP is unsupported). It also inspects SIP-based Instant Messaging protocols, and it protects against DoS attacks as well as against penetration attempts such as connection hijacking and connection manipulation.

SmartDefense validates the expected usage of SIP. For example, if an end-of-call message is sent immediately after the start of the call, the call will be denied because this behavior is characteristic of a DoS attack. Application-level checks include:

The Media Gateway Control Protocol (MGCP) is a protocol for controlling telephony gateways from external call control devices called call agents (also known as Media Gateway Controllers). MGCP is a client/server protocol, which means it assumes limited intelligence at the edge (endpoints) and intelligence at the core (call agent). In this it differs from SIP and H.323, which are peer-to-peer protocols.

SmartDefense provides full network-level security for MGCP. SmartDefense enforces stringent compliance with RFC 2705, RFC 3435 (Version 1.0), and ITU TGCP specification J.171.

Additionally, SmartDefense affords inspection of fragmented packets, anti-spoofing, and security against DoS attacks. SmartDefense restricts handover locations and controls signaling and data connections. NAT on MGCP is not supported. SmartDefense can perform additional content security checks for MGCP connections, thereby providing a greater level of protection. MGCP-specific Application Intelligence security is configured via SmartDefense. Three options are available with this control:

The Skinny Client Control Protocol (SCCP) controls telephony gateways from external call control devices (call agents, or Media Gateway Controllers). SCCP is a VoIP protocol used in many Cisco voice implementations.

SmartDefense provides full connectivity and network-level security for SCCP-based VoIP communication. All SCCP traffic is inspected, and authentic traffic is allowed to pass while attacks are blocked. All SmartDefense capabilities are supported by this control, including anti-spoofing and protection against DoS attacks. SmartDefense restricts handover locations, and controls signaling and data connections. Fragmented packets are examined and secured, making use of kernel-based streaming. NAT on SCCP devices is not supported.

SmartDefense tracks state and verifies that the state is valid for all SCCP messages. For a number of key messages, it also verifies the existence and correctness of the message parameters.

New SIP features to enhance VoIP include:

Two properties control whether small proposals are used—one for pre-NG with Application Intelligence, and the other for NG with Application Intelligence:

The VPN capabilities of the Application Intelligence feature allow the administrator to validate digital certificates used against the Certificate Revocation List and monitor for preshared secret vulnerability. This provides protection against:

SmartDefense includes some important capabilities. For example, with strict protocol enforcement, SmartDefense checks and verifies protocol fields. This prevents worms and other attacks from making use of malformed MS-RCP packets for attacks. In addition, with protocol flow enforcement, SmartDefense monitors communication sessions to ensure that the state and flow adhere to the protocol. For example, SmartDefense ensures that new MS-RPC sessions start with a call to the server EndPointMapper (these are commonly called the portmapper or rpcbind) which is defined as part of the MS-RPC protocol. This is done to first establish the ports to be used for the application session.

Dynamic port allocation is used so that SmartDefense only needs to open ports as they are negotiated during the MS-RPC session. This minimizes the number of ports and length of time these ports are open on the firewall. Specific application identification is implemented for each application in an MS-RPC environment. This defines a globally unique identifier (GUID). Applications such as Microsoft Outlook have an assigned GUID. SmartDefense recognizes GUIDs and will restrict MS-RPC calls to only those applications permitted in the firewall policy.

All Web Intelligence controls have a monitor-only mode that enables you to evaluate what impact the control will have on a system’s connectivity. It does this by examining logs to review traffic that Web Intelligence has distinguished as possibly being unsafe, while still transmitting uninterrupted traffic flow.

It is possible to activate each Web Intelligence defense individually for a specific Web server. If the control is challenging on a particular Web server, it can be disabled (turned off) for that Web server.

Advanced defenses such as Cross-Site Scripting, Command Injection, SQL Injection, and Malicious Code Protectors include changeable security-level settings. If a difficulty with connectivity occurs on a particular Web server, the security level can be reduced individually for that Web server.