Overview of Computer Security and Threats

Loading…

An Overview of Computer
Security
Why Computer Security?
• Most online transactions involve using computers
and database
• Technology has become a need as opposed to a
preference
• This progression in technology attracted many
network and database users to use them
• Information shared and stored about users attract
intruders to seek destruction and monetary gain
Why Computer Security? (cont’d.)
• Individuals and business assets are not the only
ones that are under threat, for example…
• Water supplies, electricity grids, and gas and oil
production depend on a computer network to
thrive
• Breach could have disastrous impact
Why Computer Security? (cont’d.)
• The view of intruders is no longer some lonely hacker
residing in the basement of his/her parent’s home
• It has transformed into a collection of hacking brigades
professionally trained by the militaries of nations around
the globe
• Therefore, computer security has become an issue of global
importance
• As networks become more sophisticated, so do intruders
• Fingerprinting techniques are also used by intruders to obtain
information about their targets, e.g., nmap
• Fast-flux detection
A Secure Data Environment
• Approach: Multiple layers of security
• Most effective approach to minimizing risk of data
breach
• Multiple layers mean more difficult to access the data
A Secure Data Environment -
Example
• Multiple security layers to protect against malicious
e-mail attachments
• User awareness training (such as avoiding e-mail with
certain file extensions)
• Filter on exchange server to remove known malicious
attachments
• Firewall configured to deny certain types of traffic, e.g.,
blocking non-TCP SYN packets
• For a breach to occur now, the firewall, exchange
servers, and user all must be fooled into allowing
the attachment
A Secure Data Environment
(cont’d.)
• How to create a secure environment?
• No need to reinvent the wheel! Use a set of established
procedures, standards, policies, and tools
• Helps protect against theft, misuse, and attacks
• Helps deal with permission and access to the data structure
A Secure Data Environment
(cont’d.)
• How to create a secure environment? (cont’d.)
• Common computer security features
• Access control
• Authentication
• Hardware and software monitors and logs
• Encryption
A Secure Data Environment
(cont’d.)
• How to create a secure environment? (cont’d.)
• Network security
• Arguably biggest security concern
• Some hardware and software devices used to secure a
network:
• Firewalls
• Antivirus programs
• Network monitors
• Intrusion detections systems, proxy servers, and authentication
servers
• Honeypots
Who Are We Securing Ourselves
Against?
• Must understand what poses a threat
• Outsiders are not the only threats to our network
• Insiders pose greater threats
Hackers vs. Crackers
• Who is a hacker?
• The term is used in a negative meaning
• It is a person who has mastered firmware and software
of modern computer systems
• Person who enjoys exploration and analysis of network
security
• Without intent to cause harm
• Who is a cracker?
• Person who breaks into a network to destroy or steal
information
Hackers vs. Crackers
• Types of online intruders:
• White hat:
• Ethical hacker: A hacker who tests systems and provides
security consultation
• Grey hat:
• An individual who wavers between being a hacker and a
cracker
• They sometimes act in goodwill and other times in malice
• Black hat:
• Someone who breaks into a system with a malicious intent
Hackers vs. Crackers
• Types of online intruders: (cont’d):
• Hacktivist:
• Hackers and crackers who use networks to share their
ideologies (social, political, economic, etc.)
• Script kiddie:
• An amateur cracker who uses programs and scripts written by
others
• e.g., Downloading cracking tools and gaining access to a
network to steal information
Social Engineers
• People who manipulate others to gain access to:
• Systems
• Unauthorized areas
• Confidential information
• They often build trust with authorized users
• Use deception and trickery to convince people to break
normal security policies
• e.g., Asking for a password
Computer Users
• Threats caused by user error
• Major contributing factors
• Lack of education
• Disregard of policy
• Examples of most common user errors:
• Poor habits (computers unlocked and unattended)
• Password error (writing passwords on sticky notes)
• Disregard for company policy (downloading unauthorized software)
• e.g., Stuxnet
• Opening unknown e-mail attachments
Computer Users
• Examples of most common user errors: (cont’d.)
• Inappropriate disclosure (giving information over the
phone to a social engineer)
• Procrastination (failing to report computer issues in a
timely manner)
Network and Database
Administrators
• Not often viewed as threats to networks they run
• However, room for human error exists
• e.g., iCloud
• Common mistake
• Not removing a user’s rights and account credentials
The Internet
• ~4.13 billion Internet users
• ~2 billion Web sites
• Over 85% of US residents have Internet access
• Threats on the Internet continue to increase as
internet usage increases
• 600,000 viruses on networks today
The Internet (cont’d.)
• Hijacking
• Web pages are modified to
• Distribute malicious code
• Redirect user to attacker’s Web site
• e.g., Babylon Toolbar
• Changes the browser homepage and the default search engine to
isearch.babylon.com
• Malware
• Short for malicious software
• Often intended to be harmful and destructive
The Internet (cont’d.)
• Spoofing
• e.g., Fraudulent Web site made to look identical to legitimate Web
site
• Used to draw in a user to gather personal information (such as a password)
• Can be done by registering a domain name that is a slight misspelling of
legitimate site (example: Bank0famerica)
• e.g., IP spoofing (modify the source)
• Web browser
• Built-in programming language can be manipulated
• e.g., Internet Explorer certificate issue
The Internet (cont’d.)
• SQL injection
• The placement of malicious code in SQL statements, via
web page input
• Intended to
• Manipulate database into sending confidential information
• Modify/delete information from database
• e.g., Heartland attack
• 160 million credit cards were compromised
• Cost $300 million
• The largest such scheme in the US
The Internet (cont’d.)
• Domain name system (DNS) poisoning
• Cracker gains control over DNS server
• Cracker substitutes their site’s IP address for the
legitimate domain name IP address
• User may be fooled into providing personally identifiable
information (PII)
Misleading Applications
• Applications that deceive users into believing their
computer’s security has been breached
• User is convinced to download and purchase fake
antivirus tools
• Tools deliver malware to user’s computer
• User has no knowledge of true security breach
E-mails
• One of most common forms of communication
today
• Common threats to e-mail
• Attachments, phishing, HTML code attacks
E-mails (cont’d.)
• Attachments
• Can be difficult to identify a fake attachment
• Crackers use attachment names and file extensions to
gain trust
• Spoofing e-mail address
• Using a false e-mail address in the “from” and “reply”
fields
• Increases likelihood that user opens the attachment
E-mails (cont’d.)
• Phishing
• Act of trying to phish information out of people
• May include convincing a user to click a link to a crackerowned Web site
• Common technique: Fake holiday and birthday card emails
Tweets/Comments
• Images and links can be included with a tweeted
message
• Youtube comments
• Pay attention to short URLs
Types of Malware
• Malware are
• Capable of performing harmful and destructive tasks on
victim’s computers
• Types of malware:
• Computer viruses
• Worms
• Trojans
• Spyware
• Adware
• Bots
Computer Viruses
• Malware that can spread from one computer to another
without detection
• Degree of danger varies:
• Annoying disturbances
• e.g., Hiding all files (by changing them to system files)
• Destruction of entire systems
• Characteristics found in malicious code:
• Self-encryption
• Virus disguises the way it appears to a network
Computer Viruses (cont’d.)
• Characteristics found in malicious code (cont’d):
• Stealth
• Viruses make changes to the system (e.g., Use of memory,
increase in file size, etc.)
• Antivirus programs regularly check for such changes
(requesting information from the OS)
• Viruses try to hide their tracks to avoid detection by antivirus
programs
• They intercept requests from antivirus program to the OS and
answers them instead
Computer Viruses (cont’d.)
• Characteristics found in malicious code (cont’d):
• Polymorphism
• Ability to change forms to avoid detection
• Code changes its signature each time it infects a file
• e.g., Using a different code for each file
• Makes it difficult to detect
• Residence
• Nonresident virus: Need to be initiated by user
• e.g., Downloading and opening attachment
• Resident virus: Installs itself and does not need a user to
activate it
Computer Viruses (cont’d.)
• Classes of viruses:
• Logic bombs: Viruses that corrupt data when certain
conditions are met
• Time bombs: Time-delayed viruses
• Spyware: Software that intentionally monitors user’s
activities
• e.g., Dr. Cleaner
• Adware: Malware used for marketing purposes
Computer Viruses (cont’d.)
• Virus types:
• Boot sector viruses:
• Boot sector is an area on the drive that contains records needed to boot the
computer
• These viruses load themselves onto the hard drive’s boot sector
• Macro viruses:
• A macro is a small program that helps automate repeated
processes in a document
• They attach to a document
• e.g., Melissa virus of 1999
• Targeted Microsoft Word and Outlook-based systems
• When opened, disabled safeguards for Word
• Sent itself to the first 50 contacts in Outlook
Computer Viruses (cont’d.)
• Virus types (cont’d):
• File-infected viruses:
• Attach themselves to executable file
• User must run to activate
• Multipartite viruses:
• Combine characteristics of boot sector virus and file-infected virus
Worms
• Self-replicating malware
• Share many characteristics with a virus
• But do not need users to travel from one computer to
another
• They can propagate across networks
• How do worms travel?
• Find a weak target (gains an open door to the network)
• Take control of the machine (installs itself)
• Interrogate the machine (searches for a new target)
• Test a new target (sends packets to new target to test its
vulnerabilities)
Trojan Viruses
• Malware that disguises itself
• Hide within programs such as software updates,
games, and movies
• Purpose:
• Gain access to sensitive information
• Destroy files
• Install bigger threats
Types of Trojan Viruses
• Remote access and administration Trojan (RAT)
• Allows attacker to control victim’s computer from a remote
location (creates a backdoor)
• Data-sending Trojan
• Sends information to attacker
• Destructive Trojan
• Randomly deletes files and corrupts the registry (database of
settings)
• Proxy Trojan
• Attacker uses victim’s IP address to commit cybercrime
• File transfer protocol (FTP) Trojan
• Allows attacker to download files from victim’s computer
Bots
• Also known as software robots
• Performs automated tasks for an intruder at a
remote location
• Used for spamming and launching DoS attacks
• e.g., GitHub attack
• The attack peaked at 1.35Tbps
Bots (cont’d)
• Can be hidden in games and other programs
• Able to disguise themselves, and run in the
background (no GUI, stealth)
• e.g., Bitcoin mining
• Many bots controlled together known as a botnet
• Non-malicious bots also exist
• e.g., Chatbots
• AI software that can simulate a conversation (or a chat) with a
user