Data Security

Chapter 6
Introduction
 Computer virus have become today’s headline
news
 With the increasing use of the Internet, it has
become easier for virus to spread
 Virus show us loopholes in software
 Most virus are targeted at the MS Windows OS
Internet Use for
 Privacy
 The ability of an individual or group to seclude
themselves or information about themselves
and thereby reveal themselves by selectively.

Authentication
• The act of establishing or conforming
something(or someone) as authentic, that is, that
claims made by or about the thing are true.
Who is vulnerable?
 Financial institutions and banks
 Internet service providers
 Pharmaceutical companies
 Government and defense agencies
 Contractors to various government
agencies
 Multinational corporations
 ANYONE ON THE NETWORK

5
Enemies
 Hackers
 Access systems in an unauthorized manner.
 Hackers have no malicious intent
(i.e., they do not intend to cause harm).
• They are only motivated by curiosity, personal
satisfaction, or gaining reputation etc.

 Crackers
 Individuals who cause damages to information
systems with a malicious intent often for financial
gains.
 Identity Theft
 In the Internet sometimes you have to disclose your
personal information such as name, telephone numbers
and email addresses
 To make online purchases you need to give your credit
card number
 However, you got to be careful when you disclose your
personal information over the Internet
Identity Theft (cont.)
 Identity theft is the act of using someone’s Identity and
good reputation by another individual for financial gains
 One of the fastest growing crimes in United States
 A popular way to obtain private information is by using
phishing scams
 In phishing scams attacker sends an
email to the victim which looks like
a legitimate request for victims
personal information
 Preventing Identity Theft
 Do not disclose your private information over emails
 Always check whether a website is a trusted one before
you enter any sensitive information
 Always check whether the website supports secure
transactions (others cannot see the information you send
to secure sites)
 Always read privacy policies given on websites
Malicious Software

 These are software that can cause harm to

your data and information systems (e.g.,
Viruses, Worms, Trojan Horses, Spyware etc)
Types of Vulnerabilities
 Virus
A malicious code that infects software on a computer,
thereby causing undesired results, such as changing
system settings, deleting files, disabling functions, and
some even hardware damage (flashing the CMOS).
A virus spread by making copies of itself and spreading.
It may spread between files or disks, but the defining
character is that it can recreate itself on it’s own
without traveling to a new host.

• There are estimated 30,000 computer viruses in

existence
• Over 300 new ones are created each month
• First virus was created to show loopholes in software
 Symptoms of Virus Attack
 Computer runs slower than usual
 Computer no longer boots up
 Screen sometimes flicker
 PC speaker beeps periodically
 System crashes for no reason
 Files/directories sometimes disappear
 Denial of Service (DoS)

 You can protect your machine by using an

updated anti-virus software.
 Virus through the Internet

 Today almost 87% of all viruses are spread through

the internet (source: ZDNet)
 Transmission time to a new host is relatively low, on
the order of hours to days
Types of Vulnerabilities…(cont.)
 Worms
◦ Has similar properties to a virus
◦ Spread over network connection
◦ Worms replicate
◦ Has the capability of moving from location to location(PC
to PC) thereby doing some damage and going somewhere
else.
◦ Can spread and cause damage on its own without attaching
to another program
◦ Even if you scan your machine, the worm will not be found
◦ First worm released on the Internet was called Morris
worm, it was released on Nov 2, 1988.
◦ Recent e.g. CodeRed, BugBear, SoBig etc.
 Worms…(cont.)
E.g.

 Bubbleboy

◦ requires WSL (windows scripting language), Outlook or

Outlook Express, and IE5
◦ Does not work in Windows NT
◦ Effects Spanish and English version of Windows
◦ 2 variants have been identified
◦ May cause DoS
 Worms…(cont.)
 How Bubbleboy works

◦ Bubbleboy is embedded within an email message of HTML

format.
◦ a VbScript while the user views a HTML page
◦ a file named “Update.hta” is placed in the start up directory
◦ upon reboot Bubbleboy executes
◦ changes the registered owner/organization
 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\RegisteredOwner = “Bubble Boy”
 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\RegisteredOrganization = “Vandalay Industry”
◦ using the Outlook MAPI address book it sends itself to each
entry
◦ marks itself in the registry
 HKEY_LOCAL_MACHINE\Software\Outlook.bubbleboy =
“OUTLOOK.Bubbleboy1.0 by Zulu”
Macro

 Specific to certain applications

 Comprise a high percentage of the viruses
 Usually made in WordBasic and Visual Basic
for Applications (VBA)
 Macro
E.g.

 Melissa

◦ requires Outlook or Outlook Express Word 97 SR1

or Office 2000
◦ 105 lines of code (original variant)
◦ received either as an infected template or email
attachment
◦ lowers computer defenses to future macro virus
attacks
◦ may cause DoS
◦ infects template files with it’s own macro code
◦ 80% of of the 150 Fortune 1000 companies were
affected
Macro
 How Melissa works

◦ the virus is activated through a MS word document

◦ document displays reference to pornographic websites
while macro runs
◦ 1st lowers the macro protection security setting for
future attacks
◦ checks to see is it has run in current session before
 HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Melissa =
“by Kwyjibo”
◦ propagates itself using the Outlook MAPI address book
(emails sent to the first 50 addresses)
Types of Vulnerabilities…(cont.)
 Trojans

A class of software that enters into your system

pretending to be something else, or a part of
another software.
Hidden
Leaks information
Usually does not reproduce
Keyloggers, adware, spyware, could all enter into
your system as trojans.
Trojan Horse
 Features of Back Orifice
◦ pings and query servers
◦ reboot or lock up the system
◦ list cached and screen saver password
◦ display system information
◦ logs keystrokes
◦ edit registry
◦ server control
◦ receive and send files
◦ display a message box
Types of Vulnerabilities…(cont.)
 Spyware

This is a class of applications that spy on the

users activities.
They may provide others access to your system,
display unwanted banner ads, or steal your
confidential information
 Symptoms

 Targeted Pop-ups SPYWARE

 Slow Connection SPYWARE / TROJAN
 Targeted E-Mail (Spam) SPYWARE
 Unauthorized Access TROJAN HORSE
 Spam Relaying TROJAN HORSE
 System Crash SPYWARE /TROJAN
 Program Customisation SPYWARE
 Effects
• Allows remote access
– To spy
– To disrupt
– To relay a malicious connection, so as to disguise the
attacker’s location (spam, hacking)
– To access resources (i.e. bandwidth, files)
– To launch a DoS attack
Operation
 Listen for connections
 Memory resident
 Start at boot-up
 Disguise presence
 Rootkits integrate with kernel
 Password Protected
Similarities / Differences
Spyware Trojan Horses
Commercially Motivated Malicious

Internet connection required Any network connection required

Initiates remote connection Receives incoming connection

Purpose: To monitor activity Purpose: To control activity

Collects data and displays pop-ups Unauthorized access and control

Legal Illegal

Not Detectable with Virus Checker Detectable with Virus Checker

Age: Relatively New (< 5 Years) Age: Relatively Old ( > 20 Years)

Memory Resident Processes

Surreptitiously installed without user’s consent or understanding

Creates a security vulnerability

Types of Vulnerabilities…(cont.)
 Spam
Spam is “unsolicited” email – email that is sent without
permission.
This normally consists of credit cards, stock reports, etc.
Replying to a spammer and asking him not to sent emails is
pointless.
Best thing to do is to use a spam filter , which filter out the
spam mail and send it to another folder, or delete it.
 Adware
This is software that courses various advertisements to
display on your system as pop-ups or pop-unders while you
are browsing on-line.
 Keyloggers
This is software/hardware that monitors your keystrokes
and records them/publishes them.
This attempt to capture passwords, credit card numbers,
and other sensitive information.
 Attacks on Passwords
 Brute force attack
 Here the attacker tries all possible combinations for a
password until he gets the correct one
 There are programs written to do this task

 Dictionary attack
 The attacker tries all the words in a dictionary with the
hope of discovering the password (including names,
places, etc.)
 There are dictionaries of frequently used passwords that
can be used for this purpose
 Attacks on Passwords…(cont.)

 Keystroke Monitoring
 Attacker tries to obtain a password by looking at your key
strokes while you enter your password

 Dumpster diving
 Attacker searches through trash bins with the hope of
finding written down passwords or other confidential
information
 Strong Passwords
 Passwords are not stored in clear-text (i.e., readable)
format in your computer
 It is possible for someone to find out your password
either by guessing it or by carrying out a password attack.
 Cannot be easily guessed by others or cracked by
password cracking programs
 Strong passwords are essential to protect your
information
For example, “sdfo839f” is a good password
 Password Best Practices
 Always use a password of a minimum of eight characters
 Do not use your name, birthday, name of a close relative as
your password since these can be easily guessed
 Use non-dictionary words for your password
 Always use a combination of uppercase/lowercase characters,
numbers.
 Use at least one special character in your password
(e.g., !,#,$,@)
 Change your password at least twice every month
 Never write down your password in books, pieces of paper,
diary etc.
 Never send your password via email or disclose it to someone
even if you trust that person
 Preventing Malicious Software (cont.)
 Always use a virus scanner and keep it up to date with latest
updates
 Enable auto-protect features of your virus scanner
 Use a spyware scanner to scan and remove spyware and
update it regularly
 Never download content from unknown web sites
 Never open email attachments coming from unknown sources
 sources
Preventing Malicious Software (cont.)
 Use a personal firewall
 Keep your operating system
updated with latest updates
and patches
 Never click “yes” in unknown
popup ads that appear.
Always close them using “x”
on the upper right hand
corner
Tracking Cookies
 Cookies
 A Cookie is a small text file sent to the user from a
website.
◦ Contains Website visited
◦ Provides client-side personalisation
◦ Supports easy Login
 Cookies are controlled by…
◦ Website’s Application Server
◦ Client-side Java Script
 The website is effectively able to ‘remember’ the user and
their activity on previous visits.
Web Proofing
 The process of tracking the behavior of
users including
◦ the sites they go to
◦ How much time they spend there
◦ What they do there etc.
 Protection/Prevention
 Knowledge
 Proper configurations
 Run only necessary programs
 Anti-virus software
 Identifying Secure Websites
 Secure websites have a URL starting with https://

 There is a closed padlock icon at the bottom of the

browser status bar
 Solutions

Short Term Long Term

• Add Spyware to Anti-Virus
 Firewall
 Virus Checker • Automatic maintenance

 Spyware Remover • Legislation

 Frequent OS updates • Education on problems
 Frequent back-up • Biometric access
 Learning problems • Semantic web (and search)
 Encryption
 Encryption makes your data unreadable to others
 Encryption takes your normal messages (called clear text)
and changes it to an unreadable format called cipher text
 Example:
Take the word “Hello” and replace each letter by three
letters ahead in the alphabet.
You end up with “Khoor”
which is unreadable
Chapter Review
 What is Computer Security?
 What is Network Security?
 What is Internet Security?
 Information Security is concerned with three (03)
main areas. Name and describe those areas.
 When we doing instant chatting (Skype, gtalk, etc.)
viruses can attack our machine. How could that
happen and how can we avoid it?
 What does antivirus software do?
 Briefly explain term Data Encryption with its process.
 How can you protect your privacy on the Internet?
Briefly explain.