Basic Computer Security

1. Basic Computer Security Sankardas Roy Department of Computing and Information Sciences Kansas State University

2. Acknowledgement Most of the slides and demonstration were prepared by Professor Xinming (Simon) Ou Department of Computing and Information Sciences Kansas State University

3. We all hear of computer malware • Viruses, Worms, Bots, Rootkits, Spyware, … • Malware is a computer program with malicious intent (Malicious-softWare) • But how do they get onto your computer?

4. First path: You installed them! • Common-sense Test 1: • You got an email with the subject line: “You received a greeting card from Hallmark!”, and an attachment file “Card.jpg .exe”. • Should you open the attachment?

5. First path: You installed them! • Common-sense Test 2: • You browsed to the website of company A and wanted to watch a video posted there. When you clicked the link, a window popped up which said : “In order to view this movie, you need to install the Wonderful video player provided by company A.”, and there were two buttons bellow: “Install” and “Cancel”. • Which button would you click?

6. First path: You installed them! • Common-sense Test 3: • You wanted to install a free PDF printer driver found on the Web. At the beginning of the installation, a license agreement dialog popped up and there is this sentence in the agreement: “In installing this software, you agree that a browser toolbar will be installed which will collect certain usage information…”. • Do you want to agree to the EUL?

7. Key Points • When you run a program, you are essentially giving out everything you can do on your computer to the program • It is like giving someone the key to your house, and wait for him to return the key to you when he is done!

8. Second Path: You are hacked! • Common-sense Test 4: • You got an email with the subject line: “You received a greeting card from Hallmark!”, and an attachment file “Card.jpg”. • Should you open the attachment?

9. Second Path: You are hacked! • Common-sense Test 5: • In light of the death of Michael Jackson, you searched the Web for his songs. You found one at a website with a link to a music file which can be opened by your music player. • Shall you open the music file?

10. Second Path: You are hacked! • Common-sense Test 6: • You went to a website, on which there is a link to something you are interested in. • Shall you click on that link?

11. Key Points • You can get malware even without invoking a malicious executable file • There may be vulnerabilities in your computer’s software—operating system or applications • Software vulnerabilities can be exploited when exposed to malicious input • If a vulnerable but otherwise benign program receives a malicious input, it can cause malicious code to be executed with your privilege

12. Explanation with an Example • Browser (e.g. IE from Microsoft) is a program • runs on your computer when you open a page • browser may not have any malicious intent • The webpage (e.g. CIS 490 home page) which you browse works as an input to IE • this is typically a .html/.htm file • this may contain the attacker’s script • If your browser tries to open the above page • your computer can be compromised • the attacker can control your computer now

13. Attack Demo: A Sketch Diagram browser webserver webpage bot listening agent Attacker’s machine Victim’s machine

14. Demonstration

15. Drive-by Download • What you have just seen is called “drive-by download” • Your computer gets compromised while browsing the Web through a vulnerability in the browser, one of its plugins, or some other program that is invoked automatically on downloaded files • A successful exploit gives an attacker full privilege on a computer, which can enable him to • change your computer’s settings • install other malicious programs • steal your personal information • use your computer to attack other computers • and many more…

16. Perhaps we shall stay at “good” websites? 1.3% of the incoming search queries to Google’s search engine returned at least one malicious URL in the result page. Provos, et al., 2008

17. How about anti-malware software? Provos, et al., 2008

18. The difficulty of detecting malware • Theoretical concern: • There can be no general mechanized process for determining what a piece of code may do • Implication for us: • There is a bound on how well we can detect malicious content

19. Total #vulnerabilities reported in NVD

20. What we can do to reduce the risk • Keep your firewall on • Keep your software up-to-date • do not browse the web until you have updated your system • Having some anti-malware system could help reduce the attack surface • but do not think you are safe and can do whatever you want • Every end user needs to take part!

21. Firewall • What is a firewall? • a tool which can control the incoming and outgoing network connections of a computer • What does it protect the computer from? • mainly remote attackers • How to make the firewall ON? • this may depend on the OS • we will briefly discuss it for Windows • will briefly discuss it for Mac too

22. Configuring the Firewall on Windows: Part I

23. Configuring the Firewall on Windows: Part II

24. Configuring the Firewall on Mac: Part I

25. Configuring the Firewall on Mac: Part II

26. Configuring Firewall on Mac: Part III

27. Configuring Firewall on Mac: Help Center

28. Updating Software • Types of software • Operating System (Windows, Mac) • Other software (e.g. Adobe Flash, Java, etc.) • Why update • vendors fix recent bugs and release update • How to get the update • nowadays OS updates itself (requires reboot) • other software shows the user “update request” and may require reboot • you should not delay the update

29. Windows: Managing Updates

30. Mac: Managing Updates

31. Mac: Checking the Available Updates

32. Get an Anti-virus Running • You may get Trend Micro anti-virus free • from the KSU ITS website • Install an antispyware tool • Windows Defender/MSE is free from Microsoft • Defender is installed by default in Windows 7 • The anti-virus should regularly update itself • to get the new attack signatures from the vendor • this requires your computer to have an Internet connection • It should always run in the background • also should periodically scan the whole computer

33. An Anti-virus for Windows: MSE

34. Checking the Update Status of MSE

35. Another Anti-virus: Windows Defender

36. Windows General Security Options

37. Windows: Changing the Account Password

38. Windows: User Account Control Settings

39. Mac General Security Options: Part I

40. Mac General Security Options: Part II

41. The Autorun Problem of Windows OS • Another common-sense test: Say you have got a USB flash drive (a.k.a. jump/pen/thumb drive) from someone. • You are told that the media has some valuable information, music, video, e-book, etc. • Shall you hook the drive into your computer to see what the content is? • Caution: Just hooking the drive can install a malware in your computer without your notice

42. How to disable the Autorun Feature • You should disable Autorun in Windows XP • It can be done by updating the registry (regedit4) • Microsoft has disabled Autorun in Windows 7 • Mac does not have Autorun feature • Reference for more information: http://blogs.computerworld.com/the_best_way_to_disable_autorun_to_be_protected_from_infected_usb_flash_drives

43. Summary • We discussed a few computer security problems • Also discussed the common countermeasures • Reminder: Homework 1 is due • before the next week’s class (1 pm on Jan 31) • You can submit electronically at k-state online • Next class (Jan 31) will be held in Room 127