DEGREE PROJECT IN NETWORK SERVICES AND SYSTEMS 120 CREDITS, SECOND CYCLE STOCKHOLM, SWEDEN 2016 Empirical Testing of the CySeMoL Tool for Cyber Security Assessment – Case Study of Linux Server and MySQL TALVIA RABBANI KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING Acknowledgements This report is a Master Thesis that was started in February 2014. It has been done at the Department of Industrial Information and Control System (ICS) at the Royal Institute of Technology. I would like to give a special and sincere thanks to my supervisor, professor Pontus Johnson at the Department of ICS, Royal Institute of Technology for his time, support, patience and guidance. And to my family for all love and support – Thank you. Talvia Rabbani November 2015 Abstract In this Master Thesis, several common applications used with MySQL and Linux server are modelled using the Enterprise Architecture Analysis Tool (EAAT) and the Cyber Security Modelling Language (CySeMoL), both developed by the Department of Industrial Information and Control System (ICS) at KTH. The objective of this study is to use the CySeMoL tool to evaluate the feasibility and correctness of the tool by simulating some particular type of attacks on a real life Linux server. A few common applications with MySQL on a Linux server and two Linux operating system services are modelled and explained together with their detailed information and defense mechanisms. A real life penetration test has then been carried out in order to validate the simulated results from the tool. The results of the analysis suggest that the security vulnerability predictions done by CySeMoL on a Linux server has good predictive performance. Sammanfattning: I denna Masteruppsats modelleras ett antal vanliga applikationer på en MySQL- och Linuxplattform med hjälp av Enterprise Architecture Analysis Tool (EAAT) tillsammans med Cybersecurity Modeling Language (CySeMoL). Båda dessa är utvecklade vid avdelningen för industriella informations- och styrsystem (ICS) på KTH. Syftet med denna studie är att validera korrektheten av CySeMoL-verktygets sårbarhetsprediktioner genom att simulera ett antal specifika cyberattacker mot en Linuxplattform. Ett antal vanligt förekommande applikationer på en MySQL-plattform samt två operativsystemstjänster i en Linuxserver modelleras. Penetrationstest utförs därefter för att validera resultaten som simuleras i CySeMoL-verktyget. Studien visar att CySeMols förutsägelser stämmer väl med resultaten av penetrationstesterna. Keywords: Cyber Security, CySeMoL, EAAT, Operating System, Server, Application Modeling. Content 1. Introduction ……………………………………………………………………………... 7 1.1 Background………………………………………………………………………… 7 1.2 Purpose of this thesis……………………………………………………………….. 7 1.3 Work Phase and Methodology……………………………………………………… 8 1.4 Thesis Structure…………………………………………………………………….. 9 2. Literature/Theory ……………………………………………………………………… 10 2.1 Overview of Security Analysis Tools……………………………………………... 10 2.2 CySeMoL…………………………………………………………………………. 11 2.3 EAAT……………………………………………………………………………... 13 2.4 UML and OCL……………………………………………………………………. 14 2.5 P2AMF……………………………………………………………………………. 14 3. Model……………………………………………………………………………………. 16 3.1 Selection of software and services………………………………………………… 16 3.1.1 CentOS 7.1 for Linux distribution…………………………………… 17 3.1.2 MySQL database server……………………………………………… 17 3.1.3 PHP for server scripting language……………………………………. 18 3.1.4 Apache web server…………………………………………………… 19 3.1.5 Pure-FTPd server…………………………………………………….. 19 3.1.6 WordPress web application…………………………………………... 19 3.1.7 PHPMyAdmin web application……………………………………… 20 3.1.8 ISPconfig 3 web application…………………………………………. 20 3.1.9 ClamAV antivirus……………………………………………………. 20 3.1.10 Linux service selection……………………………………………….. 20 3.2 Model Description……………………………………………………………….. 22 3.2.1 Network……………………………………………………………… 22 3.2.2 Asus RT-N66U………………………………………………………. 23 3.2.3 LAMP Communication………………………………………………. 24 3.2.4 Wordpress……………………………………………………………. 26 3.2.5 PHPMyAdmin……………………………………………………….. 27 3.2.6 ClamAnti-Virus…………………………………………………….... 29 3.2.7 Pure-FTPd……………………………………………………………. 30 3.2.8 Ispconfig 3 Control Panel…………………………………………….. 31 3.2.9 Daemons……………………………………………………………... 33 3.3 Model Settings……………………………………………………………………. 34 3.3.1 Defense mechanism of Operating System……………………………. 35 3.3.2 Defense mechanism of Application Server……………………………35 3.3.3 Defense mechanism of Application Client…………………………… 35 3.3.4 Defense mechanism of Software Product……………………………. 35 3.3.5 Defense mechanism of Web Application…………………………...... 37 3.3.6 Defense mechanism of Data Store…................................................... 37 3.3.7 Defense mechanism of Password Authentication Mechanism……….. 38 3.3.8 Defense mechanism of Network Zone……………………………….. 40 3.3.9 Defense mechanism of Protocol……………………………………… 40 4. Prediction ………………………………………………………………………………. 43 4.1 OperatingSystem.compromise and OperatingSystem.AccessThroughUI………... 43 4.2 Operatingsystem.aRPSpoof………………………………………………………. 45 4.3 OperatingSystem.findExploit……………………………………………………...46 4.4 Networkinterface.aRPSpoof……………………………………………………… 48 4.5 NetworkZone.access……………………………………………………………... 48 4.6 ApplicationServer.Compromise………………………………………………….. 50 5. Evaluation……………………………………………………………………………… 51 5.1 OperatingSystem.compromise and OperatingSystem.AccessThroughUI…………... 51 5.2 Operatingsystem.aRPSpoof…………………………………………………………. 54 5.3 OperatingSystem.findExploit……………………………………………………….. 55 5.4 Networkinterface.aRPSpoof………………………………………………………… 60 5.5 NetworkZone.access………………………………………………………………... 60 5.6 ApplicationServer.Compromise…………………………………………………….. 63 6. Discussion of the Results……………………………………………………………….. 65 7. Conclusions……………………………………………...……………………………… 67 8. References 9. Appendix 1 10. Appendix 2 vi Chapter 1 Introduction In this chapter, at first, the background information is briefly introduced. Then, the purpose of this thesis is presented. The work phase and the methodology is explained in the next section. Finally the structure of the thesis is described. 1.1 Background The vast growth of the Internet has brought many technological advances like electronic commerce applications, social networks, information distribution and easy access to information. Organizations across the world generate large amounts of sensitive data daily and transfer those through the internet. This vast growth of the Internet has also brought risks in the network. There are significant risks when transferring sensitive information through the internet because of deficiencies regarding network security. There is a possibility for an organization to be hacked by an attacker. The nature of security risks concerning the internet is increasing quickly and constantly. Therefore, cybersecurity was developed to protect networks, computers, programs and data from attack, damage and unauthorized access. The task of cyber security, not only requires ensuring the security of end systems but of the entire network. Nevertheless, it is complex and difficult to manage cybersecurity of an entire enterprise system. To estimate the cyber security of the whole system the enterprise needs experts, for example network penetration testers. There are some delimitations of hiring these type of experts for example, the time that they need to study the whole system, the expertness of their work [1]. Depending on these difficulties, there is a need for a security assessment tool to estimate the cyber security for enterprise networks; a tool that can evaluate possible attacks that could occur in the targeted network in graphical approach for understanding the vulnerabilities of the system in an easy way without having any security experts. With this in mind, the department of Industrial Information and Control Systems (ICS) at KTH, developed an attack graph tool called Cyber Security Modeling Language (CySeMoL) by which the cyber security of each system in an enterprise architecture can be analyzed and evaluated with a probabilistic method [2]. 1.2 Purpose of This Thesis CySeMoL has been developed for system-level assessment of cyber security of information system architectures. It has been tested in various case studies for example- within the electric power industry, power substation automation systems as well as office environments [2]. However, CySeMoL has not been particularly applied in a typical operating system environment. 7 The purpose of this master thesis project is to use the CySeMoL tool to evaluate the feasibility and correctness of the tool by simulating the attacks on a real life Linux server containing a set of commonly used applications. To carry out and accomplish the objectives of this project, common applications used with MySQL server will be installed in a Linux environment. Next, the architecture of the operating system with the applications will be modeled in the CySeMoL tool. The probability of succeeding of certain kinds of attacks will be investigated using the CySeMoL tool and thereafter validating the correctness of the results by comparing it to real time penetration testing in the installed Linux operating system. 1.3. Work Phase and Methodology The master thesis project can be divided into these following work phases: Literature study Data collection Model implementation Predict the probabilities of attacks Evaluate the results In the beginning of the thesis, the fundamental concept and knowledge about CySeMoL and EAAT are essential. Without a comprehensive knowledge of how CySeMoL works it is impossible