Lectures 1-8 - Computer Security Notes

Lecture Notes CS – Intro 1. Aims of security  Confidentiality  Integrity  Availability  Authenticity  Non-Repudiation 2. Confidentiality  Certain information must be kept secret from unauthorised access.  Importance of confidentiality o Loss of revenue o Loss of reputation o Loss of clients/customers o Embarrassment o You may be in breach of a legal/moral/ethical obligation to keep information confidential  Ensuring confidentiality o Encryption o Access Control 3. Integrity  ensures that information and systems have not been altered in an unauthorised way  Breaches o Malfunctions o Unauthorised changes ▪ People ▪ Malware  Ensuring integrity o Regular backups o Checksums o Data correcting codes 4. Availability  information or systems are accessible and modifiable in a timely fashion by those authorized to do so  lack of availability is often referred to as a denial of service. 5. Authenticity  Verification of claim 6. Non-Repudiation/Accountability 7. Statistics on computer abuse  Attacks may never be detected  Attacks may never be reported  DifÏculties in quantifying loss. 8. Security is difÏcult to sell  Management may ask o What does it cost? o What do we get? o How much will it cost to maintain? o Will we need to train our staff? 9. Ethics and legal issues 08.05 Week 2 Lecture Notes CS – Threats & Threat Agents 10. What is a threat  A possible danger 11. Vulnerabilities  A flaw or weakness in the design, implementation or operation of a system  How open something is to an attack  Threats act on or exploit vulnerabilities.  The possibility of being attacked or harmed. 12. Risk control  Defence  Mitigation  Acceptance  Transferal  Termination 13. Instinctive risk assessment  Risk assessment is instinctive on a day to day basis  We autonomously assess the risk involved with everyday life 14. Real vs Perceived risk 15. Generic Threat Categories  Interception o Unauthorised entry  Modification o Breach of integrity o Data, structure, OS  Fabrication o Creating new information within a system  Interruption o An asset is lost, unavailable or unusable o Breech of availability o Physically destroying hardware o Erasing programs or files o Disconnecting a power or network cable 16. Specific Threats  Intrusion  Hacking o For specific gain o As a job  Espionage o Obtaining information in a secretive manner o Via network or system intrusions o Dumpster diving o Social engineering ▪ “hi im Calling from IT…” Destruction of hardware Destruction of software Destruction of data Hardware theft Software theft Data theft Injection of trafÏc/data Corruption of data Eavesdropping/Surveillance o Electronic o Optical o Profiling of web browsing habits  Social engineering  Malware o Malicious + Software = malware  Information Warfare o Misuse of information of gain an advantage Threat agencts/attackers  The source of these threats  Examples o Malware writers o Hackers o Fraudsters o White collar criminals o Organised crimes o Governents Motivations of attackers  Financial  Emotional  Ideological  Opportunity  Compulsion Capabilities of attackers  Organised/disorganised  Individual/group  Resources Risk Aversion  How risk adverse is the attacker  Does the attacker fear being caught? Threat modelling  Attack trees o Used to model threats on a given asset o Graphical representation of the way that we can attack an asset.  One to many relationship o Always has to go to multiple options o One will not work          17. 18. 19. 20. 21. 22. Controls and Safeguards  Prevention o Firewalls o Security gurads o Passwords o cryptography  Detection o Security guards o Log file analysis o Intrusion detection Systems  Responsive o Law enforcement o Forensic analysis 23. Determining appropriate control  Depends on context o Environmental o Situational 08.12 Week 3 Lecture Notes CS – Malware 24. What is malware  Software designed to infiltrate, damage or disrupt a computer system without the owners informed consent 25. Consequences  Steal your personal info  Monitor computer activity  Used to install additional software  Display forced advertising  Enable profiteering scams  Use your computer resources 26. Evolution of malware  90’s o Hack against web servers o To prove you are a skilled hacker ect  2000 o Monetary value can be established at the same time 27. Malware explosion  As more devices are being used ect… more people are developing malware from it 28. Why does a system become vulnerable to malware  Flaws or bugs in software  Over privileged users or system processes  Design of software or a system  Poorly implemented Standard Operating Environment (SOE) practices 29. Malware specimens  Zeus Trojan horse  o Toolkit (can specify what the malware does) o Commonly spread by FaceBook messages o Installed via drive-by-downloads and phishing o Works on Microsoft Windows only o Attacker fine tunes their Trojan to steal information of interest to them only o Awakes when a particular site is accessed Psyb0t o Targets Linux based ADSL routers o Infection occurs from an internal IP address o Initially pre-populated with 6000 usernames and 13,000 passwords o Generally exploits poorly configured devices o When part of a botnet is receives commands via IRC command and control servers 30. Classifying malware  Propagation o How it moves through devices/networks ect  Concealment o Self hiding o Provide desirable functionality  Payload o What is caries/functionality of the program 31. Viruses  Can infect other programs by modifying them  Phases o Dormant ▪ Waiting of trigger event o Propagation ▪ Replicating to programs/disk o Triggering ▪ By event to execute payload o Execution ▪ Of payload  Types o File virus ▪ Infecting a highly used program i.e. a game or operating system files will result in continuous re-infection and propagation o Macro virus (macro language) ▪ Infects files with macro code ▪ Commonly infects MS OfÏce documents o Boot sector virus ▪ Infects the code in the boot sector of hard disk o Encrypted virus ▪ Payload and replication mechanism is encrypted ▪ Virus = decryption engine + encrypted body ▪ Encryption remains the same throughout the life of the virus o Stealth virus ▪ Hides itself from AV detection ▪ May copy data from non-infected files to itself to avoid detection o Polymorphic virus (change appearance of) ▪ Mutates with every infection ▪ Changing encryption/decryption keys ▪ Data appending / data pre-pending o Metamorphic virus ▪ Mutates and rewrites itself with every iteration ▪ Adding useless instructions and loops 32. Worms  Spreads without needing to insert itself into other files and usually without human interaction  Most worms spread by exploiting vulnerabilities or poorly configured systems  Firewalls can be used  Worm Propagation o Scan for targets on network o Locate a target with a vulnerability that could be exploited by the worm o Exploit the identified vulnerability and establishes itself on that host o Repeats the process by scanning for new targets that can be exploited 33. Trojan horses  Appear desirable but have malicious content within  Types o Simple / ‘classic’ Trojan horse ▪ A calculator program that looks and acts as a calculator, but every time the 7 button is pressed it deletes a random file from the hard drive o Remote access Trojan horse ▪ A backdoor into a system and allow an attacker to execute or monitor actions on the victim’s computer o Indirect Trojan horse ▪ Use infected computer to launch attacks 34. Root Kits  And application designed to hide the fact that an operating system has been infected  Three components o Concealment o Command and control o Surveillance  Run on infected device with admin/root access  May alter/hide security setÝngs, process, files, system drives, network ports and system services  Can typically be removed with AV software but (some) damage to the system may be unrepairable  Types o Kernel mode o Firmware rootkits Botnet Controller 35. BotNets (Attacker)  Malware that turns host into a zombie  A zombie is a machine controlled by a master Attack Commands Bot net: Attack Actions 36. Logic Bomb  Performs a malicious action as a result of a logic condition Vic  Example tim o A programmer puts code into software for the payroll system that makes the program crash should it ever process two consecutive payrolls without paying him 37. Spyware  Spys on everything you do and records information 38. Adware  Spyware but then sends specific ads to computer 39. Ransomware  Kidnaps computer and charges to remove it  Locks files, computer, sectors ect 40. Scareware  Scars you into thinking that your computer is compromised or has done something wrong 41. Countermeasures  Signatures o Each malware specimen is unique o Sometimes false positives occur  Shield vs on demand scanning o Shield ▪ Background process ▪ Scans when a file is touched o On demand ▪ Scan on explicit user request or according to a regular schedule ▪ Scan on a specific type of a file program ect  08.19 Week 4 Lecture Slides CS – Crypto 1 42. Terminology  Encryption o Used to establish confidential communication over an insecure channel  Cipher o An algorithm used to encrypt  Plaintext o The original readable message  Cipher text o The encrypted message  Cryptography o The creation or development of encrypting or decrypting data  Cryptanalysis o The study of breaking encryption  Cryptology o Combination of cryptography and cryptanalysis  Codes o Replacing a phrase or message with a word or symbol o ‘Be right back’ = BRB  Ciphers o Replacing individual characters, digits or bits o ‘Be right back’ = cf sjhiu cbdl  Caewsar Cipher o Basic o Only 26 possibilities 43. Ciphers categorised Ciphers Classical Substitution Transposition Modern Symmetric Asymmetric Stream Block 44. Systematic Encryption  Sender>encrypt>shared secret key>cipher text>Shared key>Decrypt>receiver  Key distribution can be a problem 45. Asymmetric Encryption  Utilises a private key and a public key  Private Key o Must be kept secret  Public Key o Can be given to the public 46. Block ciphers  Plain text/ciper text have a fixed length  Breaks up into a certain number of blocks 47. Stream Cipher  Symmetric cryptosystem where cipher text C is obtained as the exclusive OR of the plaintext message M and a pseudo-random binary vector S generator from the secret key Message>▼  Seed>keystream generator>key stream > XOR cipher text 48. Symmetric Block ciphers  Data Encryption Standard (DES) o Developed by IBM in 1977 o 64 bit blocks, 56 bit keys  Triple DES (3DES) o Effective key length of 168 bits o Tried to resurrect DES, but computationally inefÏcient o Cipher text = EKC(DKB(EKA(P)))  Advanced Encryption Standard (AES) o Selected by NIST in 2001 through open international competition and public discussion o 128-bit blocks o 128, 192 and 256 bit key lengths o Exhaustive key search attack is not currently possible 49. Symmetric Stream Cipher  RC4 o Rivest Cipher 4 designed by Ron Rivest from RSA Security in 1987 o Used in SSL and WEP o Simple and computationally efÏcient o Key sizes range from 40 – 2048bits  RSA o Designed by Rivest, Shamir and Adelman (RSA) o It is easy to multiply 2 numbers and calculate a product, but difÏcult to take a product and determine all of its factors o Usually deals with very large prime numbers o Common key lengths are 512, 1024, 2048 or even 4096 bits 50. Steganography  Hiding data within a picture 51. 08.26 Week 5 Lecture Notes CS – Data Integrity 1 2 3 4 Parity Bits Check sums Cryptographic Hash Functions  Complex mathematical algorithm  Examples ○ MD4 ,MD5 ○ SHA1, SHA256, SHA512 ○ RIPEMD160 ○ PANAMA ○ TIGER ○ And many others  MD5 ○ Developed by Ron Rivest in 1991 ○ Outputs 128 bit hash values ○ Widely used in legacy applications ○ Considered academically broken ○ Faster than SHA-1  Sha-1 ○ Developed by NSA and approved by NIST ○ Outputs 160 bit hash values ○ Contains less implementation issues than MD5 (as it should!) ○ Is computationally more intensive than MD5 ○ Superseded by the SHA-2 family ○ SHA-256, SHA-384 and SHA-512 Hash function  Common uses include ○ Digital signatures ○ Intrusion detection systems ○ Secure communications protocols ○ Storage of passwords ○ Verifying that evidence has not been tampered with  Collisions ○ When two entirely different digital objects produce the same hash output ○ Hash function collisions are a negative trait ○ Hash algorithms must have a very low collision rate ○ The probability that two objects happen to result in the same digest value is so small that it is not even worth considering ○ The results of hash functions are routinely used in a court of law to prove that two binary objects are identical HMAC ○ MACs are Message Authentication Codes ○ HMACs combine hash functions and secret keys to not only provide integrity but also authenticity ○ Instead of just taking the object as an input to the hash function, a HMAC or keyed hash function also takes a symmetric key that is typically not shared. ○ Basically a password for your hashing values DIGITAL Signatures  Sender uses signing algorithm to sign message  Message and signature are sent to the receiver  The receiver receives the message and the signature and applies the verifying algorithm to the combination.  If the result is true, the message is accepted; otherwise it is rejected Digital Certificates   5 6 09.02 Week 6 Lecture Notes CS – Identification & Authorisation 52. Identification  Establishing who you are 53. Authentication  Establishing that the entity is actually who they say they are  Mordern tech uses multi factor authentication 54. Authorisation  Establishing what the entity is allowed to do 55. Notes  Different techs can be used for authentication or identification or both 56. 3 approaches  Something you know o Password ▪ Most commonly used o Answers to questions o usernames  Something you have o Id card  Something you are o Biometrics 57. Password attacks often occur off-line using (off line means lifting the hast data base to an external system to test against to eliminate the limit on the number of tests you can perform)  Dictionary attacks  Brute force attacks  Hybrid attacks o These can be very computationally intensive o An i7 processor can crack most passwords quite quickly o What about a cluster of computers? o What about a GPU? Or a cluster of GPUs? 58. Password Salts  A random collection of characters added to a the start of end of a pass  Stored in plaintext  Increases the size of the password 59. Biometric scanning  Fingerprint  Eye scan  Photo  Voice  keystrokes  Walking style (gait analysis)  Two types of errors o False acceptance ▪ Scan accepts the wrong person o False rejection ▪ Scan fails to recognise the correct person  Problems o To many variables that can change that would influence the reliability of a scanner 09.09 Week 7 Lecture Notes CS – Hardware & Data Security 60. Early Computers  Security issues were hardware issues  Security was controlled by physical access control to the room 61. Modern Computers  Mobile  Interconnected  Multi functioning 62. BYOD  Use of personal devices for work purposes  Essential company data is now stored on pers devices 63. Threats Against Hardware  Theft  Environmental  Physical Destruction  Accidental damage  Loss/misplacement  Hardware age/stress  Theft of hardware to steal the data inside 64. Environmental Threats  Electricity o Spikes of electricity can cause damage to digital services o Equipment requires steady uninterrupted power supply  Water/ACTs of God o Flood o heatwave 65. Physical Destructions  Hardware could be damaged deliberately or accidentally  Backups are the #1 means to resolve destruction based issues  Access control  Redundant computers/servers/equipment 66. Hard ware theft remedies  Microdot technology  RFID tagging  CCTV monitoring  Access card control  Physical storage of portables  Data at rest encryption  Mobile device tracking 67. Ellectrical issue mitigation strategies  Uninterrupted power supply o Provides instant power o Battery backup for constant power o Encompasses power surge/spike protection 68. Hard ware encryption  Provides constant encryption for all data  Hard drives could be encrypted/decrypted on the fly by main-boards or by dedicated cards 69. Data Storage  Data is stored on 1 sector at a time  A sector is typically 512 bytes Exam Overview • 2 hours working time, 5 minutes reading time • 11 questions – 10 short answer (4 marks each) • 1-3 sentences each 1 attack tree (10 marks) Will be asked about real world examples Which part of the security is breached o Confidentiality o Availability o Integrity o Authenticity o Non-repudiation/accountability 70. How would you convince them to purchase, apply and use security  Scare tactics Consequences o Relevant to their context/situation  Use of statistics o Frequency of attacks being carried out to similar business/individuals  Demonstrate ease of use of new system o Simplicity 71. Understand security  Threat  Risk  Vulnerabilities 72. Types of threats  Real vs perceived 73. Generic threats  Interception/disclosure  Modification  Fabrication  Interruption 74. Attack tree  30 nodes  Specific  Naming of tools/programs 75. Malware  Types o Trojan o Worm o Ransomware o Virus o Scareware o Rootkit o Botnet  Make a table  Devise criteria  Comparison table o Distribution o Infection types o Purposes o Weaknesses o Outcomes o Consequences   Trojan Worm Propagation Acts like legitimate program Scan, locate Concealment Acts like legitimate program Payload Remote access, monitoring , file deletion File vulnerability, exploit, repeat RansomWar e Virus Scarware Rootkit Replicates to programs/dis k deletion or backdoor creation Encrypted/Stealth/polymnorphic/ metamorphic/ Can be kernel or firmware rootkit Provide access to admin /root access 76. Codes vs cyphers  Asymmetric o Public key and private key  Symmetric o Singular key used to encrypt the data  Strengthes and weaknesses comparison table o Third party server o Technical skills  Draw a diagram  Draw a table  Digital signature process  Certifying authorities  Digital certificates o Used to provide authentication of a public key o What are the key components 77. Biometrics  3 examples of o Authorisation ▪ What a user is allowed to do by the system o Identification ▪ Username ▪ Fingerprints ▪ o Authentication ▪ Password ▪  How to hack crack passs o How would you lift from win os o What is the tech approach to cracking the pass o Pwdump>dump pass hashes > john the ripper > crack station  Physiological vs behavioural o Difference and types 78. File systems  Fat32 vs ntfs o Which is more secure  Windows nt logon process o Module 8 o Use graph 79. Open source vs commercial software  Which is better  What is shell code  Open source o Develops cant hide things o Open to more scrutiny  Commercial o Financial incentive o Pubic scrutiny o Support structure  Would you trust open source or commercial encryption software o Depends on the complexity of the key?? 80. Networks  Dif between IPv4 and IPv6  IPv4 o 32-bit numeric address (IPv4) is written in decimal as four numbers separated by periods. o IPv6 addresses are 128-bit IP address written in hexadecimal and separated by colons. o  Network scanning/recon tools  Wired vs wired networking o Pros and cons  Exam Notes – possible questions 81. Aims of security  Confidentiality  Integrity  Availability  Authenticity  Non-Repudiation 82. THREAT TREES  Threat trees will be in the exam  Will be worth 20% of the exam GetÝng a password for a computer login o No Password o Password ▪ Crack (software)  Online  OfÒine Brute force  Brutus program Dictionary attack  Hash each word and compare to password hash Rainbow tables  Backwards engineers crypto function  Rainbowcrack program Character Set  A defined type of characters  EG 2 numbers the a 5 letter word…ectk  Key logger0  ▪ Social Engineering  Bribe Pay money  Blackmail Obtain incriminating evidence  Threaten Physical Job opportunity Social life  Steal Find written copy Use cameras to record screen  Espionage Cameras Audio recording Drug 83. Malware (7 types)  RAT o Remote Access Trojan ▪ A backdoor into a system and allow an attacker to execute or monitor actions on the victim’s computer  Trojan  Worm  Ransomware  Virus  Scareware  Rootkit  Botnet   84. Encryption  Which is more trustworthy o Commercial or open source o Freeware o Shareware o Government backdoors o Master decryption keys 85. 3 approaches to identification and authentication  Something you know o Password ▪ Most commonly used o Answers to questions o usernames  Something you have o Id card  Something you are o Biometrics Week 8 Lecture Notes CS – OS Security 86. What is an OS  Interface between the user and computer hardware  Manages how applications access resources o Hard disks o CPU o RAM o Input devices o Output devices o Network interfaces 87. OS Security Concepts  Identification Authentication, Authorisation  Separation and protection of objects  Auditing  Permissions and File System Security 88. Separation of Objects 89. Identfication and authorisation  Passwords still heavily relied upon as a means of authentication  Smartcards, tokens making some progress  Consumer oriented biometric devices are becoming prominent for mobile computing devices 90. Authorisation