1. CSC 382: Computer SecuritySlide #1 CSC 382: Computer Security Threats

2. CSC 382: Computer SecuritySlide #2 What are threats? What threats can you think of to your home? To your money (including bank accounts, checks, credit and debit cards)? To your home computer?

3. CSC 382: Computer SecuritySlide #3 What are threats? Home: –Burglary –Fire –Vandalism Money (cash/credit): –Theft. –Counterfeiting. –Signature forgery. –Identity theft. Computer: –Viral/worm infection. –Adware/spyware. –Denial of service. –Data destruction. –Physical destruction (overheat, flash “ROM” overwriting) –Use of computer for felonious purposes.

4. CSC 382: Computer SecuritySlide #4 Digital Threats: More of the Same Theft Vandalism Extortion Con Games Fraud Stalking Voyeurism

5. CSC 382: Computer SecuritySlide #5 Digital Threats: What’s Different Automation –Salami Attack from Office Space. Action at a Distance –Volodya Levin, from St. Petersburg, Russia, stole over $10million from US Citibank. Arrested in London. –Operators of CA BBS tried and convicted in TN court because TN had d/led pornography f/ CA. Technique Propagation –Criminals share techniques rapidly and globally.

6. CSC 382: Computer SecuritySlide #6

7. CSC 382: Computer SecuritySlide #7 Survival Time

8. CSC 382: Computer SecuritySlide #8 Current Threat Information SANS Internet Storm Center Bugtraq CERT Packet Storm Risks Digest

9. CSC 382: Computer SecuritySlide #9 Who are the Attackers? Hackers vs Crackers Levels of attackers –Developer Finds new security vulnerabilities Writes tools and exploits –User Understands tools; modifies tools/exploits –Script Kiddie

10. CSC 382: Computer SecuritySlide #10 Who are the Attackers? Criminals. –1993: Thieves installed bogus ATM at Manchester Mall. Saved account#s + PINs. Organized crime. –2000: Mafia-led organization members arrested for attempt to steal $680million from Bank of Sicily. Malicious insiders. –2001: Mike Ventimiglia deletes files of his employer, GTE. $200,000 damage. Industrial espionage. –2001: Verdicts in Cadence Design Systems vs. Avant against 7 employees incl CEO. 5 sentenced to jail.

11. CSC 382: Computer SecuritySlide #11 Who are the Attackers? Press. –1998: Cincinnati Enquirer reporter Michael Gallagher breaks into Chiquita Fruits voicemail to expose illegal activities. Police. –1997: LAPD illegal wiretapping scandal. Terrorists. –1999: DOS attacks and web defacements against NATO country computers during Kosovo bombings. National Intelligence. –2000: Former CIA Directory Woolsey admitted to using ECHELON information to help US companies win foreign contracts.

12. CSC 382: Computer SecuritySlide #12 What Are Our Defences? Firewalls Virus Scanners Spyware Scanners Patches Backups Prevent Detect Respond Recover

13. CSC 382: Computer SecuritySlide #13 What Are The Attacks? Phishing Malware Ransomware Spyware Botnets

14. CSC 382: Computer SecuritySlide #14 Phishing E-mail

15. CSC 382: Computer SecuritySlide #15 Phishing Site

16. CSC 382: Computer SecuritySlide #16 Malware Trojan Horses Viruses Worms

17. CSC 382: Computer SecuritySlide #17 Ransomware

18. CSC 382: Computer SecuritySlide #18 Spyware and Adware Most Trojan Horses, some infect directly. –Browser hijacking –Pop-up advertisements –Keystroke and network logging –Steal confidential data from email and files 80% of PCs are infected with spyware (Oct 2004 AOL/NCSA survey.)

19. CSC 382: Computer SecuritySlide #19 Rootkits Execution Redirection File Hiding Process Hiding Network Hiding User Program Rootkit OS

20. CSC 382: Computer SecuritySlide #20 Botnets Worm or direct attack usurps control of PC, then installs control software to listen for instructions. Instructions can include: Attempt to infect other PCs Send spam message Launch DOS attack Upgrade attack and control software Virus writers sell botnets to spammers for $0.10/compromised PC

21. CSC 382: Computer SecuritySlide #21 Future of Attacks VM Rootkits Mobile Malware Gone in 20 Minutes RFID Viruses Virtual Property Theft

22. CSC 382: Computer SecuritySlide #22 Key Points Computer crimes same as pre-computer crimes. Differences in digital threats –Automation –Action at a distance –Technique propagation Digital threats –Phishing –Malware –Ransomware –Spyware –Botnets

23. CSC 382: Computer SecuritySlide #23 References 1.Alexander Gostev et. al., “Malware Evolution: January – March 2006,” Virus List, http://www.viruslist.com/en/analysis?pubid=184012401, April 12, 2006. http://www.viruslist.com/en/analysis?pubid=184012401 2.The Honeynet Project, Know Your Enemy, 2nd edition, Addison-Wesley, 2004. 3.John Leyden, "The illicit trade in compromised PCs," The Register, Apr 30 2004. 4.Stuart McClure, Joel Scambray, and George Kurtz, Hacking Exposed, 5th edition, McGraw-Hill, 2005. 5.Rachna Dhamija and J. D. Tygar, "The Battle Against Phishing: Dynamic Security Skins," Proceedings of the Symposium on Usable Privacy and Security (SOUPS), July 2005. 6.SANS Internet Storm Center, http://isc.sans.org/survivalhistory.php 7.Schneier, Bruce, Beyond Fear, Copernicus Books, 2003. 8.Ed Skoudis, Counter Hack Reloaded, Prentice Hall, 2006 9.Stuart Staniford, Vern Paxson, and Nicholas Weaver, "How to 0wn the Internet in Your Spare Time," Proceedings of the 11th USENIX Security Symposium, 2002. 10.Richard Stiennon, "Spyware: 2004 Was Only the Beginning," CIO Update, Jan 26 2005. 11.Thompson, Ken, “Reflections on Trusting Trust”, Communication of the ACM, Vol. 27, No. 8, August 1984, pp. 761-763 ( http://www.acm.org/classics/sep95/)

24. CSC 382: Computer SecuritySlide #24 Extra Slides

25. CSC 382: Computer SecuritySlide #25 Classes of Threats Disclosure –unauthorized access to data –Examples copyright infringement unauthorized CC use Deception –acceptance of false data –Examples Anti-spam filter techniques “Social engineering”

26. CSC 382: Computer SecuritySlide #26 Classes of Threats Disruption –interruption of correct system operation –Examples: DDOS attacks Usurpation –unauthorized control of system component –Example: Nicholas Jacobsen Controlled T-mobile’s systems in 2004 Monitored e-mail, downloaded web-cam photos Sold customer records (incl SSN, voicemail pw, etc)

27. CSC 382: Computer SecuritySlide #27 Types of Threats Snooping –interception of data –Examples: Reading email, or intercepting cleartext passwords. ECHELON. Modification –Examples: Changing student grades in War Games. Web site defacing (>1500/month recorded at attrition.org in 2001) Spoofing –impersonation –Examples: Spam emails almost always spoof source address. The many Citibank phishing scams.

28. CSC 382: Computer SecuritySlide #28 Types of Threats Repudiation of Origin –Deny ordering goods. Denial of Receipt –Deny receipt of payment or goods. –Examples eBay Credit card payments. Denial of Service –Examples: 2000: “Mafiaboy” DDOS takes down Amazon, eBay, Yahoo. Filling up disk with spam, unauthorized copies of files.