1. CSCD 303 Essential Computer Security Fall 2018
Lecture 2 - Security Overview
Reading: CompTIA Text Chapter 1

2. Overview Topics Threats Difficulty of computer security
Look at popular statistics
Overview of threats
Difficulty of computer security
Questions for you

3. Motivation for Studying Computer Security
Why is it important to study computer security?
As developers, you are either going to be part of the solution or part of the problem
The vulnerabilities that are exploited in software are introduced by ignorant programmers
Most programmers today are unaware of how software is compromised

4. Motivation for Computer Security
Most people …
Concerned about computer security … but do not actively practice it
e-safety-survey2012
Ninety-percent of Americans agree that a safe and secure Internet is crucial to our nation’s economic security
and yet
Ninety-percent say they do not feel completely safe from viruses, malware and hackers while on Internet
So, what can happen as a result of a computer security breach? What have you personally observed?

5. Motivation for Computer Security
Consequences of Security breach
Threats are real!
Identity theft, malware, stolen resources for botnets, credit card theft (lots), loss of privacy
Feelings of insecurity doing anything online
Look at statistics to help us understand the need for computer security

6. Symantec Threat Report 2010-2011
d=malicious_activity_by_source

7. The Geographic Distribution of Cybercrime
Top Countries
United States
China/Asia

8. Symantec Threat Report Browser Vulnerabilities

10. Symantec Threat Report Summary - 2011
Symantec blocked over 5.5 billion malware attacks in 2011
81% increase over 2010
Web based attacks increased by 36% with over 4,500 new attacks / day
403 million new variants of malware were created in 2011
41% increase of 2010
50% of targeted attacks were aimed at companies with less than employees

11. Symantec Threat Report Summary - 2016
Symantec discovered more than 430 million new unique pieces of malware in 2015, up 36 percent from the year before
In 2015, on average one Zero day vulnerability was discovered per week – 125% increase from previous year
What is a Zero Day vulnerability?
A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it

12. Symantec Threat Report Summary - 2016
Continuing ….
In 2015, 9 mega breaches were reported totals of 429, 000,000 –
Nearly ½ Billion records were exposed !!!!
Web Attacks
1,000,000 Web attacks daily
Cyber criminals take advantage of vulnerable websites with an estimated 75% of all legitimate websites vulnerable – unpatched vulnerabilites

13. Trends Security Getting Better?

14. Average smart phone now has more computing
power than Space Shuttle
Point-of-sale terminals at a coffee shop are all connected to company’s central financial system
Many cars have satellite navigation and Bluetooth connections
An Internet-connected thermostat can control home temperatures

15. TrendMicro Report 2012
Dangerous applications targeting users of Google's Android platform
Increased from nearly 30,000 in June to almost 175,000 in September 2012
My comment:
This is a natural progression as importance of Smart phones continues to increase

16. Symantec Threat Report 2016

17. Symantec Malware Signatures
Symantec concluded 2011 with approximately 15.5M signatures
green – New Signatures blue - cumulative

18. Malware Trends 2017 In 2016, count was 6,834,446 new malware specimens
This is an increase of 32.9%. On average this is 780 per hour
From AV-Test, institute for anti-malware products

19. More Symantec Stats Phishing Attacks by Sector
ISP's
Phishing Incentive is
largely financial

20. More Symantec Stats
Once attackers have obtained financial information or other personal details
Names, addresses,and government identification numbers
Frequently sell data on underground economy
Most popular item for sale
What would you guess?
Credit card numbers
Organized groups figured out ways to use those cards to obtain and use those funds

21. More Symantec Stats
Some groups in underground economy specialize in manufacturing blank plastic cards with magnetic stripes
Encoded with stolen credit card and bankcard data
Requires high level of sophistication, cards often produced in one country, imprinted, and then shipped to countries from where stolen data originated

22. More Symantec Stats
Popularity of items for sale on underground economy

23. Trojan Named Gozi
In 2007, SecureWorks Security Research Group discovered Trojan captured credentials of Internet banking and e- commerce websites
Trojan, Gozi, forwarded captured credentials to online database - were being sold to the highest bidder
SecureWorks Security Research Group uncovered a cache of stolen information
Over 10,000 records containing
Online banking user credentials
Patient healthcare information
Employee login information for confidential government and law enforcement applications
Further investigation data offered for sale by Russian hackers for amount totaling over $2 million

24. Techrepublic Predictions 2013
2013/9038
The major cyber-security challenges to businesses through will come from
1. Increase in Exploit Kits
We expect to see exploit kits targeting Windows 8, MAC OS X
and mobile devices in 2013
2. Increase in mobile device cyber-security threats
Threats threaten targeted mobile devices
3. Increase in sophistication of threats
Ransomware attacks lock down a computer, device, or
service and holds all the data hostage, DDoS will grow

25. Predictions – 2017 Did They Happen? Yes.
Locky wallpaper
Ransomeware
The Ransomware Epidemic: 23 Million Spam s Distribute Locky in a Single Day – September 4, 2017
spam- s-distribute-locky-in-a-single-day.html
s, which use the subject lines "please print," "documents," "photo," "images," "scans" and "pictures," hold ZIP attachments containing VBS files
When opened, the VBS file downloads Locky ransomware, which then encrypts all files on the victim's system and demands 0.5 bitcoins (approximately $2,450) to decrypt them
Other ransomware too, Locky is just one !!!

26. Predictions – 2017 Did They Happen? Yes.
DDoS Attacks
Security gaps in IoT devices allowed cyber thieves to launch largest distributed denial‐of‐service (DDoS) attacks in history during 2016
In Sept and Oct 2016, attackers leveraged hundreds of thousands of IoT devices with weak passwords to launch DDoS attacks using the Mirai botnet
Service outages for prominent websites included Airbnb, Netflix, Reddit, Twitter, Spotify and others
Mobile Security Threats
Already covered, Android, IoS first in 2015, vulnerable to many malware and other attacks including Ransomeware

27. Difficulty of Computer Security

28. General Comments Online security mirrors offline security
Motivation and psychology similar for
“online and offline” worlds
“Where there is money, there is crime ...”
Difference between online and offline is
Harder to track, capture and convict online criminals
Plus, several aspects of online attacks magnify their effects

29. “Computer Security is Difficult”
Why do you think this is true or is it?

30. Computer Security Difficult?
Has computer security gotten more difficult than 19 years ago? Since 1995.
Computer History Timeline

31. Computer Security is Difficult
Why is this so?
1. Automation of attacks
Tools enable attackers to access thousands of computers quickly
Slammer worm, 2003, infected 75,000 computers in 11 minutes, continued to scan 55 million computers / sec
Blaster worm, 2003, infected 138,000 in first 4 hours, and over 1.4 million computers

32. Computer Security is Difficult
2. Sophistication of attacks
Sophisticated tools globally available
MPack and other Trojans exhibit traits
Once installed, used to view confidential information that can then be used in identity theft or fraud
They can also be used to launch phishing attacks or to host phishing Web sites
Finally, they can be used as spam zombies

33. Computer Security is Difficult
3. Software vulnerabilities high
Hard for software vendors to keep up with vulnerabilities discovered, less than 6 days from discovery of vulnerability to creation of exploit
CMU/CERT
Software Vulnerabilities
Vulnerabilities
1995 – 171
2005 – 5990
Years

34. Computer Security is Difficult
4. Zero Day attacks
A vulnerability discovered by attacker, not developer. So you have a zero day grace period. Must scramble to find vulnerability and patch it
Example:
Hacker released attack code that exploited an unpatched vulnerability in Apple' Quicktime 1 week after company updated media player to plug nine other serious vulnerabilities

35. Computer Security is Difficult
5. No Borders, No Boundaries
Attackers can be distant from targets
Instead of worrying about criminals in your home town, worry about all criminals in world
And, how do you prosecute people across country borders?
Not easy !!!!

36. Computer Security is Difficult
5. No Borders, No Boundaries
Example: In 1995, 29 year old hacker from Russia made $12,000,000 breaking into Citibank computers
Most of the Money was later recovered but expediting hacker from Russia to stand trial was difficult … didn't happen
He was later apprehended in London and extradited to the US to stand trial
Got three years ... see link at end of lecture

37. Computer Security is Difficult
6. Technique Propagation
Publish attacks so everyone can use them
Damage can grow exponentially
Only need a few skilled people, many use their exploits and this amplifies the damage of attacks
So, search in Google for string,
“How to write a virus?”
Comes back with 134,000,000 hits!
Some good advice on writing viruses

38. Computer Security is Difficult
7. Badly Designed Security Controls, users are required to make security decisions
Most users do not have enough knowledge to make the decisions they are required to make
How many will click Cancel?

39. Introduction Summary Computer Security is challenging
Many exploits, vulnerabilities in software, complexity of systems and uneducated users
A lot to learn, but practical
You will likely be using computing devices your entire lives
We need to protect ourselves in the physical world, and we need to protect ourselves in the digital world
Part of this class will be to learn how to protect ourselves and all those around us !!!

40. References Wiki page on Russian Hacker Symantec Security Threat Report
Symantec Security Threat Report
Law Firm IT Manager Shows Gozi Video to Backdoor Service
Trend Micro Reports and Information
and-analysis/

41. References Continued Zues trojan – Nasty exploit
bytes/zeus-trojan-evades-antivirus-software-trusteer-says/
eSecurityPlanet – Latest Threats
Kapersky Labs Site

42. The End
Next Time: Security Definitions, Passwords/Identity and Authentication