CSCD 303Essential Computer SecurityWinter 2014

Lecture 2 - Security OverviewReading: Chapter 1

Overview

• Topics– Threats

– Look at popular statistics– Overview of threats

– Difficulty of computer security– Security definitions– Questions for you

Motivation for Computer Security• Most people … –Concerned about computer security

… but do not actively practice it

http://blogs.mcafee.com/consumer/online-safety-survey2012

• So, what can happen as a result of computer security breach?

Motivation for Computer Security• Consequences of Security breach– Threats are real!– Identity theft, malware, stolen resources

for botnets, credit card theft (lots)– Privacy ... Corporate and government

threats• You need to know how to protect your

privacy!!!

– Look at a few statistics to motivate the need for computer security

http://www.symantec.com/threatreport/topic.jsp?id=threat_activity_trends&aid=malicious_activity_by_source

SymantecThreat Report2010-2011

Symantec Threat ReportBrowser Vulnerabilities

Symantec Threat ReportSummary

• Symantec blocked over 5.5 billion malware attacks in 2011– 81% increase over 2010

• Web based attacks increased by 36% with over 4,500 new attacks / day

• 403 million new variants of malware were created in 2011– 41% increase of 2010

• 50% of targeted attacks were aimed at companies with less than 2500 employees

• Overall number of vulnerabilities discovered in 2011 dropped 20%

TrendMicro Report 2012 Dangerous applications targeting users

of Google's Android platform Increased from nearly 30,000 in June to almost

175,000 in September 2012 Third quarter of 2012 released today by global

cloud security leader Trend Micro

My comment:

This is a natural progression as importance of Smart phones continues to increase

Android Risk Predicted vs Actual

TrendMicro Statistics

Final Word from TrendMicro• At the end of the day... all mobile apps are

essentially web clients ... are as insecure as a browser

Fake versions of legitimate Android apps are most prevalent type of Android malware• Report discusses data stealers like Solar

Charge and service abusers like Live Wallpapers in China and fake versions of best-selling apps from Russia raise concerns about open nature of Android ecosystem

http://www.infosecisland.com/blogview/22607-TrendMicro-Q3-Security-Report.html

Symantec Malware SignaturesSymantec concluded 2011 with

approximately 15.5M signatures

green – New Signatures blue - cumulative

More Symantec Stats

Phishing Incentive islargely financial

ISP's

More Symantec Stats

• Once attackers have obtained financial information or other personal details– Names, addresses,and government

identification numbers– Frequently sell data on underground

economy–Most popular item for sale

• What would you guess?• Credit card numbers

– Organized groups figured out ways to use those cards to obtain and use those funds

More Symantec Stats

• Some groups in underground economy specialize in manufacturing blank plastic cards with magnetic stripes– Can be encoded with stolen credit card

and bankcard data– Requires highly organized level of

sophistication, cards often produced in one country, imprinted, and then shipped to countries from where stolen data originated

More Symantec Stats

• Popularity of items for sale on underground economy

Trojan Named Gozi• In 2007, SecureWorks Security Research Group

discovered Trojan captured credentials of Internet banking and e-commerce websites http://www.secureworks.com/research/threats/gozi/

– Trojan, Gozi, forwarded captured credentials to online database - were being sold to the highest bidder

• SecureWorks Security Research Group uncovered a cache of stolen information– Over 10,000 records containing

• Online banking user credentials• Patient healthcare information• Employee login information for confidential government

and law enforcement applications

• Further investigation data offered for sale by Russian hackers for amount totaling over $2 million

Conficker Worm• In 2009, new threat, a new worm!

• Also known as Downup, Downandup, Conflicker, and Kido

– SRI researcher reported in March 2009,– “Cumulative census of Conficker.A indicates

it affected more than 4.7 million IP addresses, while Conficker.B, has affected 6.7 million IP addresses”• Exploit used by Conficker known in

September/2008• Chinese hackers were reportedly first to produce

a commercial package to sell this exploit (for $37.80)

Conficker Worm• Exploit causes Windows 2000, XP, 2003

servers, and Vista to execute arbitrary code segment without authentication

• Spreads itself primarily through buffer overflow vulnerability in Server Service on Windows computers.• Worm uses a specially crafted RPC request to

execute code on target computer

– Affects systems with firewalls enabled, but which operate with print and file sharing enabled• Patch for this exploit was released by Microsoft

on October 23 2008

Techrepublic Predictions 2013http://www.techrepublic.com/blog/security/cybersecurity-challenges-in-2013/9038

The major cyber-security challenges to businesses through 2013 will come from

1. Increase in Exploit Kits We expect to see exploit kits targeting Windows 8, MAC OS X and mobile devices, particularly Android based, in 2013

2. Increase in mobile device cyber-security threats Threats threaten targeted mobile devices at the point of commerce 3. Increase in sophistication of threats Ransomware attacks lock down a computer, device, or service and holds all the data hostage, DDoS will grow

Return from the Dead Exploits that come back • Links to exploits that return again and again

– Gozi – 2007 and ongoing

http://www.trustdefender.com/blog/2010/02/28/gozi-a-perfect-example-of-an-older-trojan-re-inventing-itself/

– Storm Worm http://community.ca.com/blogs/securityadvisor/archive/2010/04/26/the-come-back-of-storm-worm.aspx

Conficker – 2009 and ongoing http://www.zdnet.com/blog/hardware/making-sense-

of-the-latest-conficker-update/4131

Difficulty of Computer Security

General Comments

• Online security mirrors offline • Motivation and psychology similar for

“online and offline” world• “Where there is money, there is crime ...”• Difference between online and offline is – Harder to track, capture and convict

online criminals– Plus, several aspects of online attacks

magnify their effects

“Computer Security is Difficult”

• Why do you think this is true or is it?

Computer Security Difficult?

Has computer security gotten more difficult than 19 years ago? Since 1995.

http://www.computerhope.com/history/1995.htm

Computer Security is Difficult

• Why is this so?1. Automation of attacks• Tools enable attackers to access

thousands of computers quickly• Slammer worm, 2003, infected

75,000 computers in 11 minutes, continued to scan 55 million computers / sec• Blaster worm, 2003, infected 138,000

in first 4 hours, and over 1.4 million computers

Computer Security is Difficult

2. Sophistication of attacks– Convergence of threats by sophisticated

tools

• MPack and other Trojans exhibit traits– Once installed, they can be used to view

confidential information that can then be used in identity theft or fraud

– They can also be used to launch phishing attacks or to host phishing Web sites

– Finally, they can be used as spam zombies

Computer Security is Difficult3. Software vulnerabilities high– Hard for software vendors to keep up with

vulnerabilities discovered, less than 6 days from discovery of vulnerability to creation of exploit

CMU/CERTSoftware Vulnerabilities

http://www.cert.org/stats/

Years

Vulnerabilities

1995 – 171

2005 – 5990

Computer Security is Difficult4. Zero Day attacks – A vulnerability discovered by attacker, not

developer. So you have a zero day grace period. Must scramble to find vulnerability and patch it– Example:• Hacker released attack code that exploited an

unpatched vulnerability in Apple' Quicktime week after company updated media player to plug nine other serious vulnerabilities, September 18, 2008

• Apple updated player five times since beginning 2008, and fixed more than 30 flaws!!

Computer Security is Difficult

5. No Borders, No Boundaries– Attackers can be distant from targets– Instead of worrying about criminals in your

home town, worry about all criminals in world– And, how do you prosecute people across

country borders?– Think this is easy?

Computer Security is Difficult

5. No Borders, No Boundaries

– Example: In 1995, 29 year old hacker from Russia made $12,000,000 breaking into Citibank computers–Most of the Money was later recovered but

expediting hacker from Russia to stand trial was difficult– He was later apprehended in London and

extradited to the US to stand trial– Got three years ... see link at end of lecture

Computer Security is Difficult

6. Technique Propagation– Publish attacks so everyone can use them– Damage can grow exponentially – Only need a few skilled people, many use

their exploits and this amplifies the damage of attacks– So, search in Google for string, “How to write a virus?”– Comes back with 68,800,000 hits!– Some good advice on writing viruses

Computer Security is Difficult7. Badly Designed Security Controls, users

are required to make security decisions– Most users do not have enough knowledge

to make the kind of decisions they are required to make

– How many will click Cancel?

Computer Security Defined

Definitions

• Information Security– How would you define it?– Information security - protecting

information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction– Terms information security, computer

security and information assurance are frequently used interchangeably

http://en.wikipedia.org/wiki/Information_security

Definitions

• Three common attributes of computer security–What are they?

Definitions

• Three common attributes of computer security

1. Confidentiality• Example?• Confidentiality is preventing disclosure of

information to unauthorized individuals or systems• Example, credit card transaction on the

Internet • System enforces confidentiality by

encrypting the card number during transmission or limiting the places where it might appear

Definitions2. Integrity– Integrity means that data cannot be

modified without authorization– Example?– Integrity is violated

• When an employee (accidentally or with malicious intent) deletes important data files,• When a computer virus infects a computer,• When an employee is able to modify his own salary in a payroll database, • When an unauthorized user vandalizes web site

Definitions

3. Availability– Information must be available when

needed– Highly available systems, remain available

at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades– Example of violation?– Ensuring availability also involves

preventing DoS attacks denial-of-service attacks– See following slides ...

DDoS Attack ExampleAvailability Denial

• July 21, 2008, Web site for president of Georgia was knocked offline by distributed denial-of-service (DDOS) attack

• Georgia's presidential Web site was down for about a day, starting early Saturday until Sunday

• Network experts said attack was executed by a botnetDefinition of Botnet

A botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet. Any such computer is referred to as a zombie

Another DDoS Attack• February 16th, 2007• Anti-phishing group, CastleCops.com

was knocked out by massive DDoS, – Volunteer-driven site, run by husband and

wife team had been coping with on-and-off attacks since February 13– An intense wave completely crippled the

server capacity• CastleCops.com just celebrated its fifth

anniversary as a high-profile anti-malware community

• Comment: This site ceased operation Dec. 2008

More Definitions• Vulnerability

• How would you define it?• A security exposure in an operating system or

other system software or application software component

• Databases of vulnerabilities based on version number of the software- If exploited, each vulnerability can potentially

compromise system or network - Government maintains database of

common vulnerabilities and exposures

http://icat.nist.gov/icat.cfm

More Definitions

• Assets• In business and accounting, assets are

everything owned by person or company that can be converted into cash

• Personally, anything that has value• Assets typically need to be protected• Part of the problem is

• Information is not considered assets!

More Definitions

• Exploit• An exploit is piece of software, a

chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability

• Purpose is to cause unintended or unanticipated behavior to occur on computer software or hardware– Gaining control of a computer system or

allowing privilege escalation or a denial of service attack

Exploit Examples

Examples of Exploits for specific platforms:http://www.f-secure.com/v-descs/exploit.shtml

* Exploit: Java/Blackhole * Exploit: JS/Pidief * Exploit: W32/Ani.C * Exploit: HTML/IESlice.BK * Exploit: SymbOS/SMSCurse.A

Malware” is short for “malicious software” - computer programs designed to infiltrate and damage computers without the users consent Viruses Worms Trojan horse Zombie software

Denial of Service (DoS) attack

Malware – Malicious Programs

Sum up Definitions

• Attackers look for vulnerabilities in systems– Typically in software, but others exist– Once they find vulnerability, use an

exploit of some kind to gain access to the system– Looking for assets that have value• Information assets are things like

SSN’s, credit card information or information that leads to identity theft• Other assets are use of computers to

create botnets

Introduction Summary

Computer Security is challengingMany exploits, vulnerabilities in software,

complexity of systems and uneducated users

A lot to learn but not impossibleJust like protecting ourselves in the physical

world, people can protect themselves in the cyber world

Part of this class will be to learn how to protect ourselves and all those around us !!!

References Wiki page on Russian Hackerhttp://en.wikipedia.org/wiki/Vladimir_Levin

Symantec Security Threat Reporthttp://www.symantec.com/business/theme.jsp?

themeid=threatreport

Law Firm IT Manager Shows Gozi Video to Backdoor Service

http://lawfirmit.blogspot.com/2009/04/video-gozi-trojan.html

Trend Micro Reports and Informationhttp://www.trendmicro.com/us/security-intelligence/

research-and-analysis/

References Continued

• Zues trojan – Nasty exploithttp://itknowledgeexchange.techtarget.com/security-

bytes/zeus-trojan-evades-antivirus-software-trusteer-says/

• BackDoor-DTN – Trojanhttp://www.esecurityplanet.com/alerts/article.php/

3808996/36-BackDoor-DTN-Trojan-Exploits-Microsoft-Flaw-to-Give-Attacker-Admin-Privileges.htm

Kapersky Sitehttp://www.securelist.com/en/

The End

Next Time: Attackers– Book, Chapters 1, 2 and 7