1. Level 2 Diploma Unit 11 IT Security
Threats to security (2)
Level 2 Diploma
Unit 11 IT Security

2. Categories of threats Covered last week This week
Weak external security
Unauthorised uses
Unauthorised removal or copying
This week
Malware
Theft or loss
Poor folder and file permissions

3. What is malware? Malware - short for malicious software
a variety of forms of hostile, intrusive, or annoying software or program code
Virus
Worm
Trojan horse
Rootkit
Backdoor
Spyware
Botnet
Keystroke logger
Dialer
Adware

4. Purpose of malware
Started as experiments or pranks, such as the Melissa virus 
Then changed to destroy files on a hard disk
Worms vandalised web pages
Originally spread on diskettes or in Word documents

5. Melissa Virus Released 26th March 1999 Used stolen e-mail address
Caused $80 million dollars damage
ed itself to 1st fifty addresses ‘Outlook’ with attachment such as list.doc
Looked like from known associate
Opened document infected normal.dot template

6. Melissa virus
Sent document from your pc – data security breach, damage to trust, delays, cost of removal
When the day number equals the number of minutes in the current time (e.g., at 11:06 on the 6th day of the month), the Melissa virus inserted the following text in whatever document was then being edited in Word on the victim's computer: Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here.

7. Purpose of malware
Given Internet access, malicious software is now designed for a profit
take control of users' computers for black- market exploitation
Infected "zombie computers" are used to
send  spam,
to host contraband data such as child pornography
engage in distributed denial-of-service attacks as a form of extortion

8. Purpose of malware Spyware programs monitor a users' web browsing
display unsolicited advertisements
redirect money or advertising revenue to the spyware creator
Spyware programs do not spread like viruses
they are installed by
exploiting security holes
or are packaged with user-installed software, such as peer-to-peer applications

9. Research Task Give a definition and example of one of the following:
Virus
Worm
Trojan horse
Rootkit
Backdoor
Spyware
Botnet
Keystroke logger
Dialler
Adware
Phishing

10. Virus or worm Virus Worm
a program that has infected some executable software and, when run, causes the virus to spread to other executables.
Viruses may contain a payload that performs other actions, often malicious.
A virus requires a user to trigger it spreading
Worm
a program that actively transmits itself over a network to infect other computers.
It may carry a payload
It does not require a user to do anything

11. Trojan horses Concealment helps get the malware installed
When a malicious program is disguised as something innocuous or desirable, users may be tempted to install it without knowing what it does.
Typical subject: "This is The Free Download Sex Movies, you can find it Here"
This is the technique of the Trojan horse or Trojan.

12. Trojan examples Torpig
affects Windows, turning off anti-virus applications.
allows access to the computer
modifies data
steals confidential information (such as user passwords and other sensitive data)
installs more malware on the victim's computer
has stolen the details of about 500,000 online bank accounts and credit and debit cards

13. Rootkit Once malware is installed, it needs to remain concealed
A rootkit:
Modifies the operating system kernel
Makes itself invisible in the task and process lists
May use the name of legitimate files
Makes its own files unreadable
Can run copies of itself and restart them if they are stopped

14. Backdoors A backdoor is a method of bypassing normal authentication
malware can install one or more backdoors
allows easier access in the future for
Installation of more malware
Collecting saved key logger data
Triggering spam attacks

15. Spyware
Spyware collects small pieces of information about users without their knowledge
Spyware programs can
collect Internet surfing habits
collect sites that have been visited
install additional software
redirect Web browsers
change computer settings, resulting in
slow connection speeds
different home pages

16. Botnet a collection of compromised computers (called zombie computers)
installed via worms, Trojans or backdoors
remotely controlled
botnets are rented out to
send out spam messages
perform denial of service attacks
billions of messages can be created per day 

17. Key stroke loggers Hardware Software Connected between keyboard and PC
Can be wirelessly interrogated
Software
Malware based
Captures passwords, form submissions, clipboard, screen shots
Transmit data to web sites, or wireless

18. Dialler diallers connect non-broadband PCs
fraudulent diallers connect to premium-rate numbers
some diallers promise special content, such as:
software for download (usually illegal) 
trojans posing as MP3s
trojans posing as pornography,
programs such as cracks and keygens

19. Adware
Software which automatically plays, displays, or downloads advertisements to a computer
Some adware can be classified as spyware e.g. BonziBUDDY
corrupted many of the user's system files
displayed obscene advertisements
logged browsing details and sent them to various third parties

20. Loss or theft Devices and data which are easily lost or stolen Laptops
Mobile phones
USB drives and smart cards (flash memory)
CDs and DVDs

21. Software errors Failing to apply security patches
Automatic update turned off
Especially important for
Operating systems
Browsers

22. Poorly written software
complexity increases the probability of operating system design flaws
default permissions grant every program and every user full access to the entire system
exploitable bugs in a software program
unchecked user input can allow unintended direct execution of commands or SQL statements

23. Folder and file permissions
To complete task 1 of your assignment you need to do some research.
Go to : (for this step only)
Access the Word document on Wiki, lesson 3

24. Tasks (criteria P1, M1 and D1)
You have been put in charge of the security of the computing department’s IT systems
You have been asked to write a report
Describe the potential security threats that might damage the system and compromise its data (P1)
Evaluate which of these threats are the most likely to occur and give your reasons (M1)
Explain what the impact of these threats would be on the users of the system (D1)