Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Chapter 6: Computer and Network Security Ethics for the Information Age Forth Edition by Michael J. Quinn

1-2 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-2 Chapter Overview Introduction Viruses, worms, and Trojan horses Phreaks and hackers Denial-of-service attacks Online voting

1-3 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-3 Introduction Computers getting faster and less expensive Utility of computers increasing – –Web surfing –Shopping –Managing personal information Increasing use of computers  growing importance of computer security

1-4 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-4 Viruses (1/2) Virus: piece of self-replicating code embedded within another program (host) Viruses associated with program files –Hard disks, floppy disks, CD-ROMS – attachments How viruses spread –Diskettes or CDs – –Files downloaded from Internet

1-5 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-5 Viruses (2/2) Well-known viruses –Brain –Michelangelo –Melissa –Love Bug Viruses today –Commercial antivirus software –Few people keep up-to-date

1-6 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-6 Worms Worm –Self-contained program –Spreads through a computer network –Exploits security holes in networked computers Famous worms –WANK –Code Red –Sapphire (Slammer) –Blaster –Sasser

1-7 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-7 The Internet Worm Robert Tappan Morris, Jr. –Graduate student at Cornell –Released worm onto Internet from MIT computer Effect of worm –Spread to 6,000 Unix computers –Infected computers kept crashing or became unresponsive –Took a day for fixes to be published Impact on Morris –Suspended from Cornell –3 years’ probation hours community service –$150,000 in legal fees and fines

1-8 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-8 Ethical Evaluation Kantian evaluation –Morris used others by gaining access to their computers without permission Social contract theory evaluation –Morris violated property rights of organizations Utilitarian evaluation –Benefits: Organizations learned of security flaws –Harms: Time spent by those fighting worm, unavailable computers, disrupted network traffic, Morris’s punishments Morris was wrong to have released the Internet worm

1-9 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-9 Trojan Horses Trojan horse: program with benign capability that masks a sinister purpose Remote access Trojan: Trojan horse that gives attack access to victim’s computer –Back Orifice –SubSeven RAT servers often found within files downloaded from erotica/porn Usenet sites provide the attacker with complete control of the victim's system. Attackers usually hide these Trojan horses in games and other small programs that unsuspecting users then execute on their PCs.

1-10 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-10 Bot Networks Bot: A software program that responds to commands from a program on another computer Some bots support legitimate activities –Internet Relay Chat –Multiplayer Internet games Other bots support illegitimate activities –Distributing spam –Collecting person information for ID theft –Distributed denial-of-service attacks

1-11 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-11 Defensive Measures System administrators play key role Authorization: determining that a user has permission to perform a particular action Authentication: determining that people are who they claim to be Firewall: a computer monitoring packets entering and leaving a local area network –Ex: packet filter which accepts packets only from trusted computer on the Internet

1-12 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-12 Mon Hackers (1/2) Original meaning (1950s) –Explorer –Risk-taker –Technical virtuoso –Make a system do something never done before MIT developed a system to control movement of trains Hacker ethic –Hands-on imperative Access to computers that might teach you something about the work –Free exchange of information –Mistrust of authority---  promote decentralization –Value skill above all else  not degrees, position, … –Optimistic view of technology  computer can change your life to the better

1-13 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-13 Hackers (2/2) Meaning of “hacker” changed –Movie WarGames (1983) –Teenagers accessing corporate or government computers by trying to get user names and passwords: Dumpster diving –Looking through garbage for interesting bits of information Social engineering: manipulation of a person inside an organization to gain access to confidential info. –A hacker calling a system admin. Pretending he is his boss’s boss and asks for revealing passwords. –Modern use of hacking means Malicious acts Computer break-ins Destroying databases Stealing confidential personal information

1-14 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-14 Phone Phreaking Phone phreak: someone who manipulates phone system to make free calls Most popular methods –Steal long-distance telephone access codes –Guess long-distance telephone access codes –Use a “blue box” to get free access to long- distance lines --- mimic the actual frequency Access codes posted on “pirate boards” by phreaks to share codes and credit card No.

1-15 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-15 Penalties for Hacking Examples of illegal activities –Accessing without authorization any Internet computer –Transmitting a virus or worm –Trafficking in computer passwords –Intercepting a telephone conversation, , or any other data transmission –Accessing stored messages without authorization –Adopting another identity to carry out an illegal activity Maximum penalty: 20 years in prison + $250,000 fine

1-16 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-16 Denial-of-Service Attacks Denial-of-service attack: an intentional action designed to prevent legitimate users from making use of a computer service Goal of attack: disrupt a server’s ability to respond to its clients About 4,000 Web sites attacked each week Asymmetrical attack: a single person can harm huge organization (multinational organization) Asymmetrical attack that may prove popular with terrorists –Ex: mafiaboy Dos of amazon, yahoo, cnn, ebay, dell

1-17 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-17 SATAN Security Administrator Tool for Analyzing Networks (SATAN) Allows administrators (especially novices) to test their systems Could be used by a hacker to probe other computers for security weaknesses Critics worried SATAN would turn unskilled teenagers into hackers That never happened

1-18 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-18 Motivation for Online Voting 2000 U.S. Presidential election closely contested Florida pivotal state Most Florida counties used keypunch voting machines Two voting irregularities traced to these machines –Hanging chad –“Butterfly ballot” in Palm Beach County

1-19 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-19

1-20 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-20 Benefits of Online Voting More people would vote Votes would be counted more quickly No ambiguity with electronic votes Cost less money Eliminate ballot box tampering Software can prevent accidental over-voting Software can prevent under-voting

1-21 Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-21 Risks of Online Voting Gives unfair advantage to those with home computers More difficult to preserve voter privacy –The system records the ballot as well as the identity of voter More opportunities for vote selling –X:voter, y: candidate, z: broker who watch voting of x from his PC Obvious target for a DDoS attack Security of election depends on security of home computers –Susceptible to vote-changing virus or RAT Susceptible to phony vote servers –Redirected to phony server, getting credentials, then vote on your behalf from the actual site No paper copies of ballots for auditing or recounts