16/11/2013

1
Intruders
Masquerader - An individual who is not authorized to use
the computer and who penetrates a systems access
controls to exploit a legitimate users account
Misfeasor- A legitimate user who access the data
programs or resources for which access is not
authorized
Clandestine user- An individual who seizes the
supervisory control of the system and uses the control to
evade auditing and access controls
The Masquerader is an outsider. Misfeasor and
Clandestine user can be either an outsider or insider
Intruder attacks range from benign to serious
The objective of the intruder is to gain access to a
system
Generally this requires the intruder to acquire information
that should have been protected. Normally this
information is user password
Typically a system must maintain a file that associates
the password with each authorized user. If such a file is
stored with no protection, then it is easy to gain access
to learn passwords.
16/11/2013
2
Techniques for learning password
Try default passwords used with standard
accounts that are shipped with system
Try all short passwords
Try words in the system online directory
Collect information about users names and
family members name
Try users phone no and room no
Tap the line between a remote user and host
system
Intrusion detection
If the intrusion is detected quickly enough, the
intruder can be identified and ejected before any
damage.
Intrusion detection is based on the assumption
that the behavior of the intruder differs from that
of legitimate user
Approaches are
1. Statistical anomaly detection
2. Rule based detection
16/11/2013
3
Viruses
Virus is a piece of program that can infect other
programs by modifying them
Biological viruses can take over the machinery of living
cell and makes thousands of replicas of original virus
A computer virus carries in its instructional code the
recipe for making perfect copies itself
A typical virus becomes embedded in a program on a
computer. Whenever an infected computer comes into
contact with an uninfected piece of software, a fresh
copy of the virus passes into the new program
Infection spreads from computer to computer by
unsuspecting users who either swap disks or send
programs to one another over network
Phases of virus
Dormant phase- The virus is idle. Will be
activated by some event such as date or
presence of other program
Propagation phase- The virus places an
identical copy of itself into other program . Each
infected program will now have a clone of the
virus
Triggering phase- the virus is activated to
perform the function for which it was intended
Execution phase- The function is performed
16/11/2013
4
Structure of virus
A virus can be prepended or post pended to an
executable program or it can be embedded in some
other fashion
The infected program when invoked will first execute the
virus code and then execute the original code of the
program
If the infection phase of the program is reasonably rapid ,
a user is unlikely to notice any difference between the
execution of an infected and uninfected program. This
virus is easily detected because an infected version of a
program is longer than corresponding uninfected one
Types of viruses
Parasitic virus- Attaches itself to executable files and
replicates
Memory resident virus- lodges in main memory as a part
of resident program. From that point it infects every
program that it executes
Boot sector virus- Infects the master boot records and
spreads when a system is booted
Polymorphic virus- mutates with every infection. The
detection of this virus is impossible. A portion of virus
called mutation engine creates a random encryption key
to encrypt the remainder of the virus. When an infected
program is invoked, the virus uses the stored random
key to decrypt the virus. When the virus replicates, a
different random key is selected
16/11/2013
5
Stealth virus- A virus designed to hide itself from
detection of antivirus software
Macro viruses- infect micro soft word documents. Any
operating system that supports words can be infected.
Macro virus are easily spread through electronic mail
E mail virus- Most spreading like Melissa virus. If the
recipient opens the email attachment, the word macro is
activated and the email virus sends itself to everyone in
the mailing list in users email package.
Worms
A worm is a program that can replicates itself
and send copies from computer to computer
across network connections. upon arrival, the
worm may be activated to replicate and
propagate again
An email virus has some characteristics of a
worm because it propagates itself form system
to system. But still it is a virus because it
requires a human to move it forward
Worms use network connections to spread from
system to system.
16/11/2013
6
To replicates, a network worm uses some sort of
network vehicles
A worm can mail a copy of itself to other
systems
A worm executes a copy of itself on another
system. (remote execution facility)
A worm logs onto a remote system as a user
and then copy itself from one system to other
(remote login capability)
A worm has 4 phases-dormant phase,
propagation phase, triggering phase and
execution phase
The propagation phase generally performs
1. search for other systems to infect
2. establish connection with remote system
3. copy itself to the remote system and cause the copy to
run
The network worm may attempt to determine whether a
system has been infected before copying itself to the
system
The worm known as Morris worm is designed to spread
on UNIX system. When a copy begins execution ,its first
task is to discover other hosts known to host. For each
discovered host, the worm tires a number of methods for
gaining access
16/11/2013
7
Antivirus approaches
Do not allow the virus to get into the system
Detection - Once the infection has occurred,
determine that it has occurred and locate the
virus
Identification- Once detection has been
achieved, identify the specific virus
Removal remove all traces of virus from the
infected program and restore it to its original
state
Generation of antivirus systems
First generation simple scanners
Needs a virus signature to identify a virus
Another type of first generation scanner
maintain a record of the length of
programs and look for changes in length
16/11/2013
8
Second generation
Search for probable virus infection. A scanner
may look for encryption key. Once the key is
discovered, the scanner can decrypt the virus to
identify it.
Another second generation approach is integrity
checking. A checksum can be appended to each
program. If a virus infects the program without
changing the checksum, integrity check will
catch the change. If a virus can change the
checksum, encrypted hash fn can be used
Third generation memory resident programs
that identify a virus by its action rather than
structure. No need of signature.
Fourth generation- these include scanning,
activity trap components etc. They limit the
ability of a virus to update files in order to pass
the infection
Advanced antivirus technique
Generic decryption- when a file containing
polymorphic virus is executed, the virus must
decrypt itself to activate it. In order to detect
such a structure, executable files are run
through GD scanner
16/11/2013
9
GD scanner consists of
1. CPU emulator a software based
virtual computer
2. virus signature scanner
3. emulation control module which controls
the execution
Digital Immune System
Approach for virus detection by IBM
Typical Digital immune system
1. a monitoring program on each PC uses a
variety of heuristics based on system behavior,
suspicious changes to program or family of
signatures to infer that a virus is present. The
monitoring program forwards a copy of any
program thought to be infected to an
administrative machine within the organization
2. The administrative machine encrypts the
sample and sends it to a central virus analysis
machine.
16/11/2013
10
3. This machine creates an environment in
which the infected program can be safely run for
analysis. The virus analysis machine then
produces a description for identifying and
removing the virus
4. The resulting prescription is sent back to the
administrative machine
5. The administrative machine forwards the
prescription to the infected client
6. The prescription is also forwarded to the other
clients in the organization
7. Subscribers around the world receive regular
antivirus updates that protect from the new virus
The success of digital immune system depends
on the ability of the virus analysis machine to
detect new and innovative virus. By constantly
analyzing and monitoring the virus in the world,
it should be possible to continuously update the
digital immune software to keep up with the
threat
16/11/2013
11
Firewall Design Principles
Effective means of protecting a local system or
network of systems from network based security
threats while at the same time affording access
to the outside world via wide area networks and
internet.
Firewall characteristics
All traffic from inside to outside and vice versa
must pass through the firewall. This is achieved
by physically blocking all access to the local
network except via the firewall
Only authorized traffic will be allowed to pass
the firewall itself is immune to penetration
Firewall uses four general techniques to control
access and enforce sites security policy
. The firewall may filter traffic on the basis of IP
address or TCP port no
direction control Determines the direction in
which particular service request may be initiated
16/11/2013
12
User control- Control access to service
according to which user( local or external) is
attempting to access it
Behavior control- control how particular services
are used
Capabilities of firewall
A firewall defines a single choke point that
keeps unauthorized users out of protected
network and provide protection from IP spoofing
A firewall provides a location for monitoring
security related events
3. a firewall is a convenient platform for several
internet functions that are not security related.
These include a network address translator
which maps local address to internet addresses
4. the firewall can be used to implement virtual
private networks
Limitations
the firewall can not protect against attacks that
bypass firewall
can not protect transfer of virus infected program
or files
16/11/2013
13
Types of firewall
1. packet filters applies a set of rules to each in coming
and outgoing IP packets and then forward or discard the
packets. Filtering rules are based on source IP address,
destination IP address and source and destination level
address
Application level gateway called as a proxy server
acts as a relay of application level traffic. The user
contacts the gateway using TCP/IP application such as
TELNET or FTP and the gateway asks for the name of
the remote host to be accessed. When the user
responds and provides a valid user ID and authentication
information, the gateway contacts the application in the
remote host
Circuit level gateway
Does not allow an end to end TCP connection.
The gateway sets up two TCP connections, one
between itself and a TCP user on an inner host
and one between itself and outside host
16/11/2013
14
Secure Electronic transaction
Set is an open encryption designed to protect
credit card transactions on the internet.
Current version is SET vi emerged due to the
request from Master card & Visa in 1996, and
developed by IBM, and Microsoft
It is not itself an payment system. It is set of
security protocols and formats that enables the
users to employ the existing credit card payment
structure on an open network in a secure
fashion
SET provides 3 services
1. Provides a secure communication channel
among all parties involved in the transaction
2. provides trust by the use of DX.509 digital
certificates
3. Ensures privacy because the information is
available to the parties in transaction when ever
necessary
16/11/2013
15
SET overview
1. provide confidentiality of payment prevents
the merchant from learning the credit card no
and this is only provided to the issuing bank
2. Integrity of data- SET guarantees that the
information sent from card holders are not
changed in transit. RSA, digital signatures and
Hash functions are used
3. Card holder authentication enables
merchant to verify a card holder is a legitimate
user . Digital certificates are used
4. Merchant authentication- enables card
holders to verify that a merchant has a
relationship with financial institution
5. Ensure the use of best security practices to
protect all legitimate parties in an electronic
commerce transaction
SET participants- card holder, merchant, issuer
16/11/2013
16
Digital certificates
X.509 defines a framework for the provision of
authentication services.
Standard way of performing authentication in
internet
Digital certificates are verified cy certificate
authority
In X.509, a CA issues a certificate binding a
public key to a particular distinguished name
16/11/2013
17
Structure of a certificate
1. version default is version 1.if issuer unique
ID or subject unique ID are present, version 2. If
one or more extensions are present version 3
2. Serial No. An integer no unique within the
issuing CA
3. Signature Algorithm identifier the algorithm
used to sign the certificate with associated
parameters
4. Issuer Name- name of CA
5. subject Name the name of user to whom
this certificate refers
6.Subjects key information the public key of
the subject + identifier of the algorithm of which
this key is to be used
7. issuer unique ID
8. Subject unique ID
9. Extensions
10. signature- it contains the hash code of all
other fields encrypted with CAs private key
16/11/2013
18
Biometric Authentication
Based on the features that can not be lost or
forgotten
It avoids the problems and cost associated with
lost tokens and passwords
based on physical and behavioral
characteristics- face, fingerprint, palm print iris,
voice and signature
Biometric technologies can be used in three
ways
1. To verify that people are who they claim to be
2. to discover the identity of unknown people
3. to screen people against watch list.
Biometric authentication works in 4 stages
Enrolment
Storage
Acquisition
Matching