View
217
Download
0
Tags:
Embed Size (px)
Citation preview
COS 125
DAY 9
Agenda
Capstone Projects Proposals (over) Due Timing of deliverables is 10% of Grade Missing 6 proposals 1st progress report due March 7
Next week we will begin doing Web pages Next Quiz is Feb 26 (nest Tuesday) over
the rest of HITW test 20 M/C, 4 Short essays, One extra Credit
Today we will discuss Protecting Yourself on the Internet
Protecting yourself on the Internet
One of the most talked about subjects in the last few years
Great demand for Internet Security Specialists
Prompted the need for a new field of study Information Assurance New Program of Study at UMFK
Is the Internet SAFE?
Dangers Hackers
Worms, viruses, Trojans, DOS & DDOS Privacy
Snooping Spy ware
Criminal Phishers Internet fraud Con Men (Dot Con) Pedophiles and perverts
Questions Do these things only happen on the Internet? Is online better or worse than offline?
How Firewalls Work
Firewall check Packets in and out of Networks Decide which packets go through and
which don’t Work in both directions Only one part of Security
Firewalls
Attack Prevention System
Corporate Network
HardenedClient PC
Hardened ServerWith Permissions
Internet
Attacker
AttackMessage
AttackMessage
Firewall
XStops MostAttack Messages
Packet Filter Firewall
PacketFilter
Firewall
IP-H
IP-H
TCP-H
UDP-H Application Message
Application Message
IP-H ICMP Message
Arriving Packets
Permit
Deny
Corporate Network The Internet
Examines Packets in IsolationFast but Misses Some Attacks
How Personal Firewalls work
Software version of a standard Hardware firewall
Controls packets in and out of one PC in much the same way as a Hardware Firewall does
Personal Firewalls
Many available—some free Not all work!
Even if is a good firewall…a bad configuration makes it “leaky”
My recommendation is Free
Sygate Personal Firewall Not Free (around $60)
Norton Internet Security
How Hackers Hack
Many Techniques Social Engineering
Get someone to give you their password Cracking
Guessing passwords A six letter password (no caps)
> 300 million possibilities Merriam-Webster's citation files, which were begun in the 1880s, now contain 15.7
million examples of words used in context and cover all aspects of the English vocabulary.
http://www.m-w.com/help/faq/words_in.htm Buffer Overflows
Getting code to run on other PCs Load a Trojan or BackDoor
Snoop and Sniff Steal data
Denial of Service (DOS) Crash or cripple a Computer from another computer
Distributed Denial of Service (DDOS) Crash or cripple a Computer from multiple distributed computers
DOS attacks
Kill the PC with one packet Exploits problem in O/S
Teardrop WinNuke
Kill the PC with lots of packets Smurf Frag Tribal Flood Network
SMURF Attack
Image from www.circlemudd.org
Attacks Requiring Protection
Denial-of-Service (DoS) Attacks Make the system unavailable (crash it or make
it run very slowly) by sending one message or a stream of messages. Loss of availability
Single Message DOS Attack(Crashes the Victim)
Server Attacker
Attacks Requiring Protection
Denial-of-Service (DoS) Attacks Make the system unusable (crash it or make it
run very slowly) by sending one message or a stream of messages. Loss of availability.
Message Stream DOS Attack(Overloads the Victim)
Server Attacker
Distributed Denial-of-Service Attacks
Distributed DOS (DDoS) Attack:Messages Come from Many Sources
Server
DoS Attack Packets
DoS Attack PacketsComputer with
Zombie
Computer withZombie
Attacker
AttackCommand
AttackCommand
Attacks Requiring Protection Malicious Content
Viruses Infect files
propagate by executing infected program Payloads may be destructive
Worms propagate by themselves
Trojan horses appear to be one thing, such as a game, but
actually are malicious Snakes:
combine worm with virus, Trojan horses, and other attacks
Trojan’s and BackDoors
The trick is get the a backdoor (unauthorized entry) on a machine
Easy way Get the user to load it himself Cracked Software (WAREZ) Free Software (KAZAA)
Hard Way Get a password Create a buffer overflow
Microsoft can teach you how Most Common Trojans and backdoors
SubSeven ServU Netbus Back Orifice
If have download cracked software (illegal) or have loaded KAZAA chances are that you have been hacked!
I get at least one of these a day.
SubSeven Control
Snoop and Sniff
Dangers of Wireless Networking
Wi-Fi was designed as an OPEN technology which provides EASE of ACCESS It’s the hacker’s dream environment See wireless_insecurity.pdf Also
http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm
Common hacks Wardriving Evil twin Cloning Snooping
802.11 (in)Security Attackers can lurk outside your
premises In “war driving,” drive around sniffing out
unprotected wireless LANs In “drive by hacking,” eavesdrop on
conversations or mount active attacks.
Site with 802.11 WLAN
OutsideAttacker
DoonesburyJuly 21, 2002
Evil twin hack
Masquerade as a legitimate WiFi access point
Classic man in the middle attack
WiFi (& Cell) Cloning
Since all wireless technologies require broadcasting of some sort all you need to do is listen in Scanner
For any device to “connect” it must Indentify, Validate, verify, provide a code or
some mechanism Ex, MAC’s, EISN’s, SSN, WEP secrets, etc
Since you can “listen” you can also record Record the first part of any connection Replay it You have just “cloned” the original device
How Viruses Work
Getting Rid of Viruses
Get a good Virus Projection Software Free (not Recommended)
Anti-Vir Avast AVG
Not Free Norton AntiVirus MacAfee
Free for UMFK students umfk http://www.umfk.maine.edu/it/antivirus/default.cfm
Update definition files often
How Worms work
Worms are pieces of software that self replicate over networks
“Choke” networks Famous Worms
Morris worm – the first worm Code Red – went after IIS servers Melissa – e-mail worm Slammer - SQL worm Blaster – Windows RPC worm MyDoom – another e-mail worm that creates a
BackDoor on your computer
Privacy Issues
Cookie Problems WebTracking Web BUGs
Clear Gifs technology Passports Spyware
Cookie Invasion
Cookie can be used to monitor your web behavior Tracking cookies Used by Internet Marketing agencies
like Doubleclick Why --- Consumer Profiling
You go to yahoo and search for “stereo”
All of a sudden you see a pop-up ad for Crutchfield.com
Web Tracking
Web tracking is used to for the same reasons –Profiling
Instead on monitoring on the User Side all Monitoring is done on the server side Monitors packets Read web logs
Web Tracking report
Web Logs
Web Bugs
Web Bugs are used to gather information about a users From “bugging” a room
Down by embedding a piece of code monitoring software in a image link Works on WebPages and HTML e-mail Often called Clear gifs
Small 1X1 pixels Transparent Made so that uses don’t see them
Every Time the Web Bugs is loaded it gathers info about the user that activated the web bug and sends it off to a remote server
DoubleClick Clear GIFs
Passports
Internet Passports are a user allowed Authentication and data collection tool Used to prove identity Sued to collect data
Tied to a specific browser on a specific PC not the user If someone uses your PC it can make believe
he is you Can be used on Multiple web sites Not widely used
Spyware
Software that sits on your computer Monitors everything that you do and sends out reports to
Marketing agencies Usually ties to a POP-UP server
Top Spyware I-Look Up CoolWebSearch N-CASE GATOR DoubleClick
If you have ever loaded up ICQ Loaded on your PC you have Spyware
If you have ever had KAZAA loaded on your PC you have Spyware
If you have loaded Quicken or TurboTax you have Spyware C-Dilla
How Phishing Works
Phishing is “fishing for suckers!” Send a e-mail that mimics the real
thing and get the recipient to give their password
Getting Rid of it all!
Keeping Your PC Spyware Free Michael P. Matis © 2004 UMM Information Technology Instructions Software
Crypto, Digital Signature and Digital Certificates
Cryptography provides security by using encryption Ensures privacy
Digital Signatures are just like a real signature DCMA makes them just as legally binding as a
signed paper document Digital Certificates uses Cryptographic
techniques to prove Identity
Digital Signature
SenderReceiver
DS Plaintext
Add Digital Signature to Each MessageProvides Message-by-Message Authentication
Encrypted for Confidentiality
Digital Signature: Sender
DS
Plaintext
MD
Hash
Sign (Encrypt) MD withSender’s Private Key
To Create the Digital Signature:
1. Hash the plaintext to create
a brief message digest; This is
NOT the digital signature
2. Sign (encrypt) the message
digest with the sender’s private
key to create the digital
Signature
Digital Signature
SenderEncrypts Receiver
Decrypts
Send Plaintext plus Digital SignatureEncrypted with Symmetric Session Key
DS Plaintext
Transmission
Digital Signature: Receiver
DSReceived Plaintext
MDMD
1.Hash
2.Decrypt withTrue Party’sPublic Key
3.Are they Equal?
1. Hash the receivedplaintext with the samehashing algorithm the
sender used. This givesthe message digest
2. Decrypt the digitalsignature with the sender’spublic key. This also should
give the message digest.
3. If the two match, the message is authenticated;The sender has the true
Party’s private key
Public Key Deception Impostor
“I am the True Person.”
“Here is TP’s public key.” (Sends Impostor’s public key)
“Here is authenticationbased on TP’s private key.”
(Really Impostor’s private key)
Decryption of message from Verifierencrypted with Impostor’s public key,
so Impostor can decrypt it
Verifier
Must authenticate True Person.
Believes now has TP’s public key
Believes True Personis authenticated
based on Impostor’s public key
“True Person,here is a message encrypted
with your public key.”
CriticalDeception
Digital Certificates Digital certificates are electronic documents
that give the true party’s name and public key
Applicants claiming to be the true party have their authentication methods tested by this public key
If they are not the true party, they cannot use the true party’s private key and so will not be authenticated
Digital certificates follow the X.509 Standard
Digital Signatures and Digital Certificates
Public key authentication requires both a digital signature and a digital certificate to give the public key needed to test the digital signature
DS Plaintext
Applicant
Verifier
Certificate Authority
DigitalCertificate:True Party’sPublic Key
Government Invasions of Privacy?
NSA Echelon (no warrants required) Internet Wire Taps FBI has the ability to tap into your Internet Traffic FBI has DragonWare which contains three parts:
Carnivore - A Windows NT/2000-based system that captures the information
Packeteer - No official information released, but presumably an application for reassembling packets into cohesive messages or Web pages
Coolminer - No official information released, but presumably an application for extrapolating and analyzing data found in the messages
FBI’s Carnivore http://www.epic.org/privacy/carnivore/foia_documents.htm
l More on Carnivore
http://computer.howstuffworks.com/carnivore.htm
Echelon
Global Electronic Spy network http://www.hermetic.ch/crypto/echelon/
echelon.htm It exists but little is known on exactly how it works
The basics Collect all electronic conversations Crack all encrypted stuff Search all conversations for “key words”
Find the “speakers”
Carnivore
Work Place Snooping
Workplaces have similar Techniques available to them Often ties to an “acceptable Use policy”
you had to sign when you went to work Generally, if the the e-mail account and
Internet access was made available to you by your employer in order to do you work, they have a legal right to monitor your use of it
Parental Controls
How do you prevent Children from wandering into the “seedy” side of the Internet?
By Creating Laws? The Communication Decency Act was
ruled unconstitutional by the US Supreme Court on “Freedom of Speech issues”
Jurisdiction Problems
Parental Controls Software
Many Companies make Internet filtering Software that doesn’t allow access to “bad” sites How do you tell if a site is “Bad”?
Known bad Sites Bad words in URL or Content
Keeping Kids Safe http://www.kiks.org/
Free Software http://www.we-blocker.com/