1. SECURITY

2. The Security Problem
Security must consider external environment of the system, and protect the system resources
Intruders (crackers) attempt to breach security
Threat is potential security violation
Attack is attempt to breach security
Attack can be accidental or malicious

3. Categories
Breach of confidentiality: This type of violation involves unauthorized reading of data (or theft of information). Typically, a breach of confidentiality is the goal of an intruder.
Breach of integrity : This violation involves unauthorized modification of data.
Breach of availability : This violation involves unauthorized destruction of data.
Theft of service :This violation involves unauthorized use of resources.
Denial of service : This violation involves preventing legitimate use of the system. Denial- of-service, or DOS, attacks are sometimes accidental.

4. Methods
Masquerading (breach authentication) in which one participant in a communication pretends to be someone else (another host or another person)
A replay attack consists of the malicious or fraudulent repeat of a valid data transmission. Sometimes the replay comprises the entire attack—for example, in a repeat of a request to transfer money.
man-in-the-middle attack, in which an attacker sits in the data flow of a communication, masquerading as the sender to the receiver, and vice versa.

5. Standard Security Attacks

6. To protect a system, we must take security measures at four levels:
Physical. The site or sites containing the computer systems must be physically secured against armed or surreptitious entry by intruders.
Human. Authorizing users must be done carefully to assure that only appropriate users have access to the system.
Operating system. The system must protect itself from accidental or purposeful security breaches.
Network. Much computer data in modern systems travels over private leased lines, shared lines like the Internet, wireless connections, or dial-up lines.

7. Program Threats
Trojan Horse
A code segment that misuses its environment is called a Trojan horse.
Exploits mechanisms for allowing programs written by users to be executed by other users
Spyware, pop-up browser windows, covert channels
Another variation on the Trojan horse is spyware. Spyware sometimes accompanies a program that the user has chosen to install.
The goal of spyware is to download ads to display on the user's system, create pop-up browser windows when certain sites are visited, or capture information from the user's system and return it to a central site.

8. Trap Door
The designer of a program or system might leave a hole in the software that only she is capable of using. This type of security breach (or trap door
A clever trap door could be included in a compiler
Trap doors pose a difficult problem because, to detect them, we have to analyze all the source code for all components of a system

9. Logic Bomb
Program that initiates a security incident under certain circumstances.
A programmer, for example, might write code to detect if she is still employed; if that check failed, a daemon could be spawned to allow remote access, or code could be launched to cause damage to the site.
Stack and Buffer Overflow
The stack- or buffer-overflow attack is the most common way for an attacker outside the system, on a network or dial-up connection, to gain unauthorized access to the target system.

10. C Program with Buffer-overflow Condition
#include <stdio.h>
#define BUFFER SIZE 256
int main(int argc, char *argv[]) {
char buffer[BUFFER SIZE];
if (argc < 2)
return -1;
else {
strcpy(buffer,argv[1]);
return 0; }

11. A virus is a fragment of code embedded in a legitimate program.
Viruses
Viruses are self-replicating and are designed to "infect" other programs.
They can wreak havoc in a system by modifying or destroying files and causing system crashes and program malfunctions.
A virus is a fragment of code embedded in a legitimate program.
Usually borne via or as a macro
How do viruses work?
Once a virus reaches a target machine, a program known as a virus dropper inserts the virus onto the system.

12. The virus dropper is usually a Trojan horse.
Once installed, the virus may do any one of a number of things.
There are literally thousands of viruses, but they fall into several main categories:
File. A standard file virus infects a system by appending itself to a file.
Boot. A boot virus infects the boot sector of the system, executing every time the system is booted and before the operating system is loaded
Macro. Most viruses are written in a low-level language, such as assembly or C
Source code. A source code virus looks for source code and modifies it to include the virus and to help spread the virus.
Polymorphic. This virus changes each time it is installed to avoid detection by antivirus software.

13. A Boot-sector Computer Virus

14. Encrypted. An encrypted virus includes decryption code along with the encrypted virus, again to avoid detection.
Stealth. This tricky virus attempts to avoid detection by modifying parts of the system that could be used to detect it.
Tunneling. This virus attempts to bypass detection by an antivirus scanner by installing itself in the interrupt-handler chain
Multipartite. A virus of this type is able to infect multiple parts of a system, including boot sectors, memory, and files.
Armored. An armored virus is coded to make itself hard for antivirus researchers to unravel and understand.

15. System and Network Threats
Worms
A worm is a process that uses the spawn mechanism to ravage system performance.
The worm spawns copies of itself, using up system resources and perhaps locking out all other processes.
Internet worm
Exploited UNIX networking features (remote access) and bugs in finger and send mail programs
The worm was made up of two programs, a grappling hook program and the main program. Named l1.c

16. finger user-name@hostname
Morris exploited the UNIX networking utility rsh for easy remote task execution.
The worm searched these special files for site names that would allow remote execution without a password
finger
The command returns a person's real and login names along with other information that the user may have provided, such as office and home address and telephone number, research plan.
With each new access, the worm program searched for already active copies of itself

17. The Morris Internet Worm

18. Port Scanning
Port scanning is not an attack but rather is a means for a cracker to detect a system's vulnerabilities to attack.
Port scanning typically is automated, involving a tool that attempts to create a TCP/IP connection to a specific port or a range of ports.
nmap (from isa very versatile open-source utility for network exploration and security auditing.
Nessus (from performs a similar function, but it has a database of bugs and their exploits

19. Denial of Service
DOS attacks are aimed not at gaining information or stealing resources but rather at disrupting legitimate use of a system or facility.
Overload the targeted computer preventing it from doing any useful work
Distributed denial-of-service (DDOS) come from multiple sites at once

20. Cryptography as a Security Tool
Broadest security tool available
In an isolated computer, the operating system can reliably determine the sender and recipient of all inter process communication.
In a network of computers, A networked computer receives bits from the wire with no immediate and reliable way of determining what machine or application sent those bits.
Cryptography is used to constrain the potential senders and/or receivers of a message.
Based on secrets (keys)

21. Encryption
An encryption algorithm enables the sender of a message to ensure that only a computer possessing a certain key can read the message.
Encryption algorithm consists of
Set of K keys
Set of M Messages
Set of C Ciphertext (encrypted messages)
A function E : K → (M→C). That is, for each k  K, E(k) is a function for generating ciphertexts from messages
Both E and E(k) for any k should be efficiently computable functions
A function D : K → (C → M). That is, for each k  K, D(k) is a function for generating messages from ciphertexts
Both D and D(k) for any k should be efficiently computable functions

22. Secure Communication over Insecure Medium

23. An encryption algorithm must provide this essential property: Given a ciphertext c  C, a computer can compute m such that E(k)(m) = c only if it possesses D(k).
Thus, a computer holding D(k) can decrypt ciphertexts to the plaintexts used to produce them, but a computer not holding D(k) cannot decrypt ciphertexts
Since ciphertexts are generally exposed it is important that it be infeasible to derive D(k) from the ciphertext
There are two main types of encryption algorithms:
symmetric
asymmetric

24. Symmetric Encryption Same key used to encrypt and decrypt
E(k) can be derived from D(k), and vice versa
DES is most commonly used symmetric block- encryption algorithm
Encrypts a block of data at a time
DES works on a chunk of bits at a time, is a known as a block cipher.
Triple-DES considered more secure
Advanced Encryption Standard (AES), twofish algorithm is fast and compact.
RC4 is most common symmetric stream cipher, but known to have vulnerabilities
Encrypts/decrypts a stream of bytes (i.e., wireless transmission) – e.g.., WEP
Key is a input to pseudo-random-bit generator
Generates an infinite keystream

25. Asymmetric Encryption
Public-key encryption based on each user having two keys:
public key – published key used to encrypt data
private key – key known only to individual user used to decrypt data
Must be an encryption scheme that can be made public without making it easy to figure out the decryption scheme
Most common is RSA block cipher
Efficient algorithm for testing whether or not a number is prime
No efficient algorithm is known for finding the prime factors of a number

26. Formally, it is computationally infeasible to derive D(kd , N) from E(ke , N), and so E(ke , N) need not be kept secret and can be widely disseminated
E(ke , N) (or just ke) is the public key
D(kd , N) (or just kd) is the private key
N is the product of two large, randomly chosen prime numbers p and q (for example, p and q are 512 bits each)
Encryption algorithm is E(ke , N)(m) = mke mod N, where ke satisfies kekd mod (p−1)(q −1) = 1
The decryption algorithm is then D(kd , N)(c) = ckd mod N

27. For example, make p = 7and q = 13
We then calculate N = 7∗13 = 91 and (p−1)(q−1) = 72
We next select ke relatively prime to 72 and< 72, yielding 5
Finally, we calculate kd such that kekd mod 72 = 1, yielding 29
We how have our keys
Public key, ke, N = 5, 91
Private key, kd , N = 29, 91
Encrypting the message 69 with the public key results in the ciphertext 62
Ciphertext can be decoded with the private key
Public key can be distributed in cleartext to anyone who wants to communicate with holder of public key

28. Encryption and Decryption using RSA Asymmetric Cryptography

29. Authentication Constraining set of potential senders of a message
Complementary and sometimes redundant to encryption
Also can prove message unmodified
Algorithm components
A set K of keys
A set M of messages
A set A of authenticators
A function S : K → (M→ A)
That is, for each k  K, S(k) is a function for generating authenticators from messages
Both S and S(k) for any k should be efficiently computable functions
A function V : K → (M× A→ {true, false}). That is, for each k  K, V(k) is a function for verifying authenticators on messages
Both V and V(k) for any k should be efficiently computable functions

30. Basis of authentication
Creates small, fixed-size block of data (message digest, hash value) from m
Hash Function H must be collision resistant on m
Must be infeasible to find an m’ ≠ m such that H(m) = H(m’)
If H(m) = H(m’), then m = m’
The message has not been modified
Common message-digest functions include MD5, which produces a 128-bit hash, and SHA-1, which outputs a 160-bit hash

31. The first type of authentication algorithm uses symmetric encryption
The first type of authentication algorithm uses symmetric encryption. In a message- authentication code (MAC), a cryptographic checksum is generated from the message using a secret key.
The second main type of authentication algorithm is a digital-signature algorithm, and the authenticators thus produced are called digital signatures.

32. Key Distribution With symmetric algorithms, both parties need the key.
Consider the man-in-the-middle attack Here, the person who wants to receive an encrypted message sends out his public key, but an
attacker also sends her "bad" public key.
The person who wants to send the encrypted message knows no better and so uses the bad key to encrypt the message.
The attacker then happily decrypts it.
The problem is one of authentication

33. Man-in-the-middle Attack on Asymmetric Cryptography

34. Public key digitally signed a trusted party
A digital certificate is a public key digitally signed by a trusted party.
Proof of who or what owns a public key
Public key digitally signed a trusted party
Trusted party receives proof of identification from entity and certifies that public key belongs to entity
Certificate authority are trusted party – their public keys included with web browser distributions
They vouch for other authorities via digitally signing their keys, and so on

35. Encryption Example - SSL
SSL – Secure Socket Layer (also called TLS)
SSL 3.0 is a cryptographic protocol that enables two computers to communicate securely
Cryptographic protocol that limits two computers to only exchange messages with each other
Very complicated, with many variations
Used between web servers and browsers for secure communication (credit card numbers)
The server is verified with a certificate assuring client is talking to correct server
Asymmetric cryptography used to establish a secure session key (symmetric encryption) for bulk of communication during session
Communication between each computer then uses symmetric key cryptography

36. User Authentication
Crucial to identify user correctly, as protection systems depend on user ID
User identity most often established through passwords, can be considered a special case of either keys or capabilities
Also can include something user has and /or a user attribute
Passwords must be kept secret
Frequent change of passwords
Use of “non-guessable” passwords
Log all invalid access attempts
Passwords may also either be encrypted or allowed to be used only once

37. Encrypted Passwords
The UNIX system uses encryption to avoid the necessity of keeping its password list secret
Given a function value f(x), however, it is impossible to compute x*.
This function is used to encode all passwords. Only encoded passwords are stored.
When a user presents a password, it is encoded and compared against the stored encoded password

38. One Time Password
In this one-time password system, the password
One-time password systems are implemented in various ways.
Commercial implementations, such as SecurlD, use hardware calculators is different in each instance.
Another variation on one-time passwords is the use of a code book, or one-time pad, which is a list of single-use passwords.

39. Biometrics
Another variation on the use of passwords for authentication involves the use of biometric measures
Palm- or hand-readers are commonly used to secure physical access
These readers match stored parameters against what is being read from hand-reader pads.
These devices read your finger's ridge patterns and convert them into a sequence of numbers.

40. Implementing Security Defenses
Defense in depth is most common security theory – multiple layers of security
Security policy describes what is being secured
Vulnerability assessment compares real state of system / network compared to security policy
Intrusion detection endeavors to detect attempted or successful intrusions
Signature-based detection spots known bad patterns
Anomaly detection spots differences from normal behavior
Can detect zero-day attacks
False-positives and false-negatives a problem
Virus protection
Auditing, accounting, and logging of all or specific system or network activities

41. Intrusion Detection
Intrusion detection, strives to detect attempted or successful intrusions into computer systems and to initiate appropriate responses to the intrusions.
The types of inputs examined to detect intrusive activity. These may include user- shell commands, process system calls, and network packet headers or contents.
The second approach, typically called anomaly detection, attempts through various techniques to detect anomalous behavior within computer systems.