CSCD 303 Essential Computer Security Fall 2017

1. CSCD 303Essential Computer Security Fall 2017 Lecture 17 – Internet Security Reading: See links end of Lecture

2. Overview • Internet Security • Threats • Web Technology • Web 2.0 • Active Content • Javascript • Java Applets • ActiveX Controls • VBScript • Ajax

3. Internet Security Introduction There are currently over 1 Billion websites on the web That number is growing as more of the world gets connected and technology makes it easier for people to have a voice and online presence via Websites • Everyone can be an author …. Over a third of the websites online are powered by four key platforms: WordPress, Joomla!, Drupal, and Magento. WordPress is leading market with over 60% market share

4. Internet Security Introduction • Implications for Web Site Security • According to a 2016 Web Security Report by Sucuri • Large influx of unskilled webmasters and service providers responsible for the deployment and administrations of these sites. • Google currently blacklists close to ~20,000 websites a week for malware and another ~50,000 a week for phishing. • March 2016, Google reports over 50 million website users greeted with warning that websites visited were either trying to steal information or install malicious software. https://sucuri.net/website-security/website-hacked-report

5. Watch Live Web Sites Get Hacked Want to view websites hacked in real time? http://www.internetlivestats.com/watch/websites-hacked/

6. Internet Security • Knowing how the Internet works and understanding the technologies used, allows us to better defend our content and figure out how its being attacked • Technologies used today, makes the Internet more popular than ever and unsafe at the same time • Major problem is Internet has evolved from storing content to user created content

7. Web Threats

8. Infected Websites – Lots !!!! • Google warns 760,000 websites: 'You've been hijacked' - but many are infected again in days • Google is urging website operators to sign up for its security notifications after a study of 760,935 hijacked websites revealed the difficulties in cleaning up infections that expose visitors to malware • Previous studies have found that sites running on WordPress, Joomla, and Drupal faced a higher risk of compromise because hackers focused on platforms with the largest marketshare. http://www.zdnet.com/article/google-warns-760000-websites-youve-been-hijacked-but-many-are-infected-again-in-days/

9. More Security Threats 2013 http://blog.spikes.com/blog/2013/1/11/the-top-security-threat-of-2013-is-the-web-browser • Recognition among security authorities that drive-by malware from web links is #1 threat facing networks today • Attackers are moving into targeting browser plugins • Java, Adobe Reader and Adobe Flash • Drive-by download attacks are almost exclusively launched through compromised legitimate websites which are used by attackers to host malicious links and actual malicious code

10. Web Technology • Useful to understand how Web works • As technical people, have basic understanding of clients/servers • Look at details and some stats on both browsers and Web Servers • Which browsers would you guess are most popular today? Nice page of ALL Web browsers, even text based http://www.webdevelopersnotes.com/design/browsers_list.php3

11. Web Browser Stats 2017 Chrome IE/Edge Firefox Safari Opera October 76.1 % 4.1 % 12.1 % 3.3 % 1.2 % September 76.5 % 4.2 % 12.8 % 3.2 % 1.2 % August 76.9 % 4.3 % 13.1 % 3.0 % 1.2 % 2013 Chrome IE/Edge Firefox Safari Opera December 55.8 % 9.0 % 26.8 % 3.8 % 1.9 % November 54.8 % 10.5 % 26.8 % 4.0 % 1.8 % October 54.1 % 11.7 % 27.2 % 3.8 % 1.7 % http://www.w3schools.com/browsers/browsers_stats.asp

12. Web Server Stats https://news.netcraft.com/archives/2017/09/11/september-2017-web-server-survey.html • Based on annual survey sites, Netcraft reports that Apache has a 41 % share in 2017 while IIS has 10% Apache 414,118 41.41% 410,616 41.06% -0.35 Microsoft 101,909 10.19% 101,163 10.12% -0.07

13. Web ServerOperating Systems http://httpd.apache.org/ • Apache has been the most widely used web server on the Internet since the early days of the Web. It still is dominant • Underlying operating system is mostly – Linux Over years, this has proven to be the most reliable and flexible platform for running high-quality web hosting services worldwide. http://www.ntchosting.com/apache-server-linux.html • Windows based hosts use the IIS (Internet Information Services) Server and of course run on some version of Windows

14. Web Browser Functions • Browser interprets and displays HTML files • Supposed to conform to specifications maintained W3C (World Wide Web Consortium) organization • Standards organization for web • Current Version HTML 5 as of 2014 https://www.w3.org/standards/techs/html#w3c_all

15. Plug-ins Enhance Browsers • Visit web page that includes more than simple HTML content • Likely to need plug-in applications • Flash Player most needed plug-in • 75% of the animated advertisements you see online are Flash .swf movies • Adobe Acrobat Reader .pdf, next most needed • Most government forms, online application forms, multitude of other documents use .pdf format on the Web • Movie/audio player to run .mov, .mp3, .wav, .au, and .avi files • Windows Media Player is .. most popular

16. Browser and Web Server State • Neither Browsers or Web Servers keep “state” • What does this mean? • How can browsers and Web Servers keep state?

17. Browsers and Web ServerState Defined • This means user data is not persisted from one Web page to next in a Web site • Web developers refer to practice of tracking users as maintaining state • Series of interactions that a particular user has with a site is a session

18. Browser State • How do browsers keep state? • Cookies!!! • Cookies, small text files stored in your computer's browser directory or other directory • Cookies • Created when you use your browser to visit website that uses cookies to keep track of your movements within site, • Helps resume where you left off, • Remembers registered login, theme selection, preferences, and other customized selections

19. Browser Cookies • Two types of cookies are used • Session cookies, • Temporary cookies remain in cookie file of your browser until you leave the site • These cookies only stored in memory • Persistent cookies, • Remain cookie file, browser for much longer • Have an expiration date

20. Browser Cookies http://en.wikipedia.org/wiki/HTTP_cookie Each cookie has values for six fields: * Name - Name of the cookie * Value - ID string set by Web site * Domain - Of Web site issuing cookie * Path - “/” means the cookie is valid anywhere on that domain * Expires - Cookie expires on that date * Secure (used for cookies that require a SSL connection)‏

21. Can Cookies Be Malicious? • What do you think? • Use of Cookies • To collect demographic information about who visits Web site. Sites often use this information to track how often visitors come to the site and how long they remain on the site. • To personalize the user's experience on the Web site. • Cookies do not act maliciously on computer systems. They are merely text files that can be deleted at any time - they are not plug ins nor are they programs. • Cookies do contain personal information .. that you give to site https://www.webopedia.com/DidYouKnow/Internet/Cookies.asp

22. Can Cookies Be Malicious? • Popular view … previous slide. • Cookies can violate privacy, but are not generally malware or compromise security • Other views, say … Yes. Cookies can be evil !!! Involved in • Cross Site Request Forgery Attack (XSRF) • Session Fixation • XSS – Cross Site Scripting, Cookie Tossing Attack http://resources.infosecinstitute.com/risk-associated-cookies/ Other resources: https://www.bitdefender.com/support/cookie-threats-1.html

23. Evolution of Web Technologies

24. Problem • All research shows, Internet based attacks appear to be increasing • Why is this?

25. Evolved from Web 1.0 to 2.0 • Most people agree that Web 2.0 is • Interactive and social • Facilitating collaboration between people • User content is the norm • This is distinct from the early web (Web 1.0) which was a static information dump where people read websites but rarely interacted with them

26. Web 2.0 • How do you define Web 2.0? • Web "as Platform," where software applications built on Web as opposed to desktop • Customers are building content • Activities of users generating content ... ideas, text, videos, pictures create value to web site ... • Nice YouTube Video of “Us as Web” http://www.youtube.com/watch?v=NLlGopyXT_g

27. Web 2.0 vs. Web 1.0

28. Web 2.0 Technologies

29. Web 2.0 • Web 1.0 • Pull information • Read information • HTML (Web pages)‏ • Web 2.0 • Push information • Read / write (cooperate and collaborate)‏ • XML, RSS= Rich Site Summary, Mash-ups • What's a mash-up?

30. Mash-up Defined • A mashup • Web site that combines content data from more than one source to create a new user experience • "mashup" comes from pop music term, refers to two or more songs combined into a new song • Example • Most common Google product used for mashups is Google Maps

31. Security and Web 2.0 • Why is Web 2.0 more Insecure? • User generated content • Do you trust your users? • Easier to upload or infect content • More complicated technologies behind Web 2.0 • Active content – scripts and other automatic components • Combined content from many sources • Advertising often contributes vulnerabilities

32. Web 2.0 Increases Threat • Popularity of Web 2.0 sites has changed way we communicate and use web • Created an irresistible target for malware authors Social-networking sites, blogs, and wikis • Malware authors take advantage of these sites, opening up yet another front in security defenses and hackers http://www.scmagazineus.com/ How-to-protect-against-Web-20-threats/article/34711/

33. Web 2.0 Nightmare • “Every company has plans to move mission critical applications to the Web • Yet, companies don't have web security plan to ensure sites free from exploits and hackers … (accidents waiting to happen)‏” CIO Magazine quote http://cio20.com/2008/01/03/web-20-and-application-security/ • Look at the technologies that enables Web to function

34. Web 3.0 is Coming http://socialmediatoday.com/node/423732 • Web 3.0 is a Marketing Term. Sadly, this is probably most likely way that we'll be using term 'Web 3.0' in future • Within Web 3.0 social networks will be critical conduits through which we design and stumble through our individual contexts, veering out to increasingly social content experiences built by big content providers like Yahoo, AOL, newspapers, blogs and so on • Amazon and eBay have already become large media experiences as we come to enjoy act of browsing as much as act of buying • For example, eBay Motors says 95% of traffic doesn’t come to buy car as much as look at cars • They’re a media channel that sells ads more than they are a marketplace for cars.

35. Active Content

36. Active Content • Used to be Web pages consisted of HTML • Purpose of the Internet was • Download information • View pictures and other graphic images • Fill out input forms • Our Web site, example of what kind of content? http://penguin.ewu.edu/cscd303/

37. Active Content • What is active content? • Web site that is either interactive • Such as Internet polls or • Dynamic, such as animated GIFs, stock tickers, weather maps, moving ads • Embedded objects, streaming video and audio CNN http://cnn.com/

38. Active Content Languages • Implementing Active Content • HTML does not have built in capability to handle active content … this is changing HTML 5 • Embedded video objects, • Dancing bears • Other languages added to Web pages within HTML tags allow expanded capability • What languages implement Active Content?

39. Active Content Languages • Active content implemented mainly through • Javascript • ActiveX Controls • Deprecated in new browsers • Java Applets • Deprecated in new browsers • VBScript • AJAX

40. Javascript • What is it? Has anything to do with Java? • JavaScript, is unrelated to Java programming language • Has common C syntax • JavaScript copies many Java names and naming conventions • Was originally named "LiveScript" • Renamed in a co-marketing deal between Netscape and Sun • Netscape bundling Sun's Java runtime in their then-dominant browser

41. Javascript JavaScript writes functions that are embedded in or included from HTML page Simple Examples • Opening or popping up new window with control over size, position, and attributes of window • Validation of web form input value before submitted to server • Changing images as mouse cursor moves over them … catches user’s attention • Example here http://www.javascripter.net/faq/onmouseo.htm

42. Javascript • JavaScript code runs locally in user's browser • Respond to user actions quickly, making an application feel more responsive • Example: • Gmail is written in JavaScript • JavaScript dispatches requests for information such as the content of an e-mail message

43. HTML code with Javascript <html> <head><title>simple page</title></head> <body> <script type="text/javascript"> document.write ('Hello World!'); </script> <noscript> <p>Your browser either does not support JavaScript, or you have JavaScript turned off.</p> </noscript> </body> </html>

44. Java Applets • Java Applets • The word applet is meant to suggest a small application • Applets were intended to be small programs run over the Internet • Applets can be viewed over Internet, or without any connection to Internet • When you use browser to view page that contains an applet, applet's code is transferred to your system • Executed by browser's Java Virtual Machine (JVM)‏

45. Java Applets • An applet class is compiled in same way as any other Java class • However, applets run differently from other Java programs • Normal way to run applet is to embed it in an HTML document • Then run and viewed through a Web browser

46. Java Applets <html> <head> <title> Vampire Control </title> </head> . . . <applet code="AppletCalculator.class" width=400 height=300> </applet> . . . </html>

47. Active X • ActiveX, set of object-oriented programming technologies and tools from Microsoft! • You create, in ActiveX environment, a component • Self-sufficient program that can be run anywhere in your ActiveX network • Component known as an ActiveX control • ActiveX Microsoft's answer to Java • An ActiveX control is like Java applet • Can be developed in several languages • Visual Basic, • C++ • Java

48. Active X • ActiveX • Renamed Component Object Model (COM)‏ developed by Microsoft for Windows, • Changed to ActiveX in 1996 • A software application can compose one or more components in order to provide needed functionality

49. Active X • Most Microsoft Windows applications • Internet Explorer, Microsoft Office, Microsoft Visual Studio, Windows Media Player, • All … Use ActiveX controls • Encapsulate functionality as ActiveX controls can be embedded in other applications • Internet Explorer also allows ActiveX controls to be embedded inside web pages • Point for us !!!! • Can expand application functionality to the Web!

50. Example Active X Control