Chapter 6: Computer and Network Security Ethics for the Information Age Fourth Edition by Michael J. Quinn Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6.1 Introduction Computers getting faster and less expensive Utility of computers increasing - - Web surfing - Shopping - Managing personal information Increasing use of computers → growing importance of computer security Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-3 Viruses Virus: piece of self-replicating code embedded within another program (host) Viruses associated with program files Chapter Overview Introduction Viruses, worms, and Trojan horses Phreaks and hackers Denial-of-service attacks Online voting Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Viruses, Worms, and Trojan Horses Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-4 How a Virus Replicates VirusP CPU Virus Q P R File system (a) Virus CPU - Hard disks, floppy disks, CD-ROMS - attachments How viruses spread - Diskettes or CDs - - Files downloaded from Internet Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-5 P Virus Q P R File system (b) Virus P Virus CPUVirus Q P R File system Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley (c) 1-6 1

Attachment with Possible Virus Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-7 History of Viruses Well-known viruses - Brain - Michelangelo - Melissa - Love Bug Viruses today - Good news: Commercial antivirus software - Bad news: Few people keep up-to-date Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-9 How an Virus Spreads 3 CPU 2 Address Virus book 1 Attachment Internet File system 4 Virus Attachment Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-8 Worms Worm - Self-contained program - Spreads through a computer network - Exploits security holes in networked computers Famous worms - WANK - Code Red - Sapphire (Slammer) - Blaster - Sasser Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-10 How a Worm Spreads W W Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Three Kinds of Buffer Overflow Attack Returnaddress (a) Local variables Parameters Target variable W buffer (b) buffer Returnaddress W buffer (c) code code 1-11 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

Conficker (Downadup) Worm Appeared on Windows computers in November 2008 Uses a buffer overflow attack to spread to new computers Particularly difficult to eradicate Rate of new infections roughly the same as rate of eradications Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley The Internet Worm Robert Tappan Morris, Jr. - Graduate student at Cornell - Released worm onto Internet from MIT computer Effect of worm - Spread to 6,000 Unix computers - Infected computers kept crashing or became unresponsive - Took a day for fixes to be published Impact on Morris - Suspended from Cornell - 3 years’ probation hours community service - $150,000 in legal fees and fines 1-13 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-14 Ethical Evaluation Kantian evaluation - Morris used others by gaining access to their computers without permission Social contract theory evaluation - Morris violated property rights of organizations Utilitarian evaluation - Benefits: Organizations learned of security flaws - Harms: Time spent by those fighting worm, unavailable computers, disrupted network traffic, Morris’s punishments Morris was wrong to have released the Internet worm Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-15 Bot Networks Bot: A software program that responds to commands from a program on another computer Some bots support legitimate activities - Internet Relay Chat - Multiplayer Internet games Other bots support illegitimate activities - Distributing spam - Collecting person information for ID theft - Distributed denial-of-service attacks Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-17 Trojan Horses Trojan horse: program with benign capability that masks a sinister purpose Remote access Trojan: Trojan horse that gives attack access to victim s computer - Back Orifice - SubSeven RAT servers often found within files downloaded from erotica/porn Usenet sites Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-16 Defensive Measures System administrators play key role Authorization: determining that a user has permission to perform a particular action Authentication: determining that people are who they claim to be Firewall: a computer monitoring packets entering and leaving a local area network Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

Hackers (original meaning) Original meaning - Explorer - Risk-taker 6.3 Phreaks and Hackers Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Steve Russell Invented First Video Game, Then Gave It Away Computer History Museum Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley - Technical virtuoso Hacker ethic - Hands-on imperative - Free exchange of information - Mistrust of authority - Value skill above all else - Optimistic view of technology 1-19 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-20 Hackers (evolved meaning) Meaning of “hacker” changed - Movie WarGames - Teenagers accessing corporate or government computers Dumpster diving Social engineering - Malicious acts Destroying databases Stealing confidential personal information 1-21 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-22 Phone Phreaking Phone phreak: someone who manipulates phone system to make free calls Most popular methods - Steal long-distance telephone access codes - Guess long-distance telephone access codes - Use a “blue box” to get free access to long- distance lines Access codes posted on “pirate boards” Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-23 The Cuckoo’s Egg Clifford Stoll: system administrator at Lawrence Berkeley Laboratory Tracked accounting error, discovered unauthorized user Hacker was accessing military computers FBI, CIA, NSA, AFOSI, DIA joined search Trail led to group of West German hackers Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

Legion of Doom Elite group of hackers/phreaks recruited by “Lex Luthor” LOD member Robert Riggs copied E911 Document from a Bell South Computer Craig Neidorf published edited E911 Document in his BBS magazine, Phrack Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley U.S. v. Riggs Riggs and Neidorf arrested - Charged with wire fraud - Interstate transportation of stolen property valued at $79,449 - Computer fraud Riggs pleaded guilty to wire fraud; went to federal prison Neidorf pleaded not guilty - Defense showed similar info being sold for < $25 - Prosecution moved to dismiss charges 1-25 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-26 Steve Jackson Games Steve Jackson Games (SJG) published role- playing games and operated BBS Loyd Blankenship - Key SJG employee - LOD member - Published E911 document on his own BBS Secret Service raided SJG and seized computers, looking for copy of E911 Document Led to creation of Electronic Frontier Foundation EFF backed successful SJG lawsuit of Secret Service Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-27 Penalties for Hacking Examples of illegal activities - Accessing without authorization any Internet computer - Transmitting a virus or worm - Trafficking in computer passwords - Intercepting a telephone conversation, , or any other data transmission - Accessing stored messages without authorization - Adopting another identity to carry out an illegal activity Maximum penalty: 20 years in prison + $250,000 fine Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-29 Retrospective Parallels between hackers and those who download MP3 files - Establishment overvalues intellectual property - Use of technology as a “joy ride” - Breaking certain laws considered not that big a deal Parallels between response of Secret Service and response of RIAA - Cyberspace is real - Those who break the law can be identified - Illegal actions can have severe consequences Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Denial-of-Service Attacks Denial-of-service attack: an intentional action designed to prevent legitimate users from making use of a computer service Goal of attack: disrupt a server’s ability to respond to its clients About 4,000 Web sites attacked each week Asymmetrical attack that may prove popular with terrorists Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

Attacks that Consume Scarce Resources SYN flood attack Smurf attack Fill target computer’s hard disk - bombing - Worm - Break-in followed by file copying Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley How a SYN Flood Attack Works Attacker SYN SYN Target SYN-ACK ACK (a) (b) 1-31 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-32 How a Smurf Attack Works ping Attacker Target ping Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-33 Defensive Measures Physical security of server Benchmarking Disk quota systems Disabling unused network services Turning off routers’ amplifier network capability Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-34 Distributed Denial-of-Service Attacks Attacker gains access to thousands of computers Launches simultaneous attack on target servers Defensive measures - Secure computers to prevent hijackings - Check for forged IP addresses Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley The Rise and Fall of Blue Security Part I: The Rise Blue Security: An Israeli company selling a spam deterrence system Blue Frog bot would automatically respond to each spam message with an opt-out message Spammers started receiving hundreds of thousands of opt-out messages, disrupting their operations 6 of 10 of world’s top spammers agreed to stop sending spam to users of Blue Frog 1-35 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

The Rise and Fall of Blue Security Part II: The Fall One spammer (PharmaMaster) started sending Blue Frog users times more spam PharmaMaster then launched DDoS attacks on Blue Security and its business customers Blue Security could not protect its customers from DDoS attacks and virus-laced s Blue Security reluctantly terminated its anti-spam activities Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-37 Attacks on Twitter and Other Social Networking Sites Massive DDoS attack made Twitter service unavailable for several hours on August 6, 2009 Three other sites attacked at same time: Facebook, LiveJournal, and Google All sites used by a political blogger from the Republic of Georgia Attacks occurred on first anniversary of war between Georgia and Russia over South Ossetia Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-39 Fourth of July Attacks 4 th of July weekend in 2009: DDoS attack on governmental agencies and commercial Web sites in United States and South Korea Attack may have been launched by North Korea in retaliation for United Nations sanctions Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-38 SATAN Security Administrator Tool for Analyzing Networks (SATAN) Allows administrators to test their systems Could be used to probe other computers Critics worried SATAN would turn unskilled teenagers into hackers That never happened Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-40 Motivation for Online Voting 2000 U.S. Presidential election closely contested Florida pivotal state Most Florida counties used keypunch voting 6.5 Online Voting machines Two voting irregularities traced to these machines - Hanging chad - “Butterfly ballot” in Palm Beach County Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-41 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

The Infamous “Butterfly Ballot”Benefits of Online Voting More people would vote Votes would be counted more quickly No ambiguity with electronic votes Cost less money Eliminate ballot box tampering Software can prevent accidental over-voting Software can prevent under-voting AP/Wideworld Photos Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-43 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-44 Risks of Online Voting Gives unfair advantage to those with home computers More difficult to preserve voter privacy More opportunities for vote selling Obvious target for a DDoS attack Security of election depends on security of home computers Susceptible to vote-changing virus or RAT Susceptible to phony vote servers No paper copies of ballots for auditing or recounts Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-45 Utilitarian Analysis Suppose online voting replaced traditional voting Benefit: Time savings - Assume 50% of adults actually vote - Suppose voter saves 1 hour by voting online - Average pay in U.S. is $18.00 / hour - Time savings worth $9 per adult American Harm of DDoS attack difficult to determine - What is probability of a DDoS attack? - What is the probability an attack would succeed? - What is the probability a successful attack would change the outcome of the election? Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 1-46 Kantian Analysis The will of each voter should be reflected in that voter’s ballot The integrity of each ballot is paramount Ability to do a recount necessary to guarantee integrity of each ballot There should be a paper record of every vote Eliminating paper records to save time and/or money is wrong Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley Conclusions Existing systems are highly localized Widespread tainting more possible with online system No paper records with online system Evidence of tampering with online elections Relying on security of home computers means system vulnerable to fraud Strong case for not allowing online voting 1-47 Copyright © 2011 Pearson Education, Inc. Publishing as Pearson Addison-Wesley