The Tension Between Security and Other Values

1. CH # 5 Top 2 The Tension Between Security and Other Values Can there be too much security? The answer is yes. Contrary to what some my believe, security is no an absolute good. Computer security adds overhead and expense to business operations, and also gives criminals new opportunities to hide their intentions and their crimes. Slide 5-1

2. Security vs. ease of use There are inevitable tensions b/w security and ease of use. When traditional merchants are so fearful of robbers that they do business in shops locked behind security gates, ordinary customers are discouraged from walking in. The same can be true on the web. The more security measures added, the more difficult a site is to use, and the slower it becomes. Digital security is purchased at the price of slowing down processes . Too much security can harm profitability, while not enough security can potentially put you out of business.

3. Security vs. Public Safety and The Criminal uses of the Internet There is also an inevitable (expected) tension b/w the desires of individuals to anonymously (to hide their identity) and the needs of public officials to maintain public safety than can threatened by criminals or terrorists. Use of technology by criminals to plan crimes or threaten nation- state. Terrorists are also fond users of the Internet and have been for many years. Encrypted files sent via e mail were used by Ramsey Yousef a member of the Al Qaeda responsible for bombing the World Trade Center in 1993, as American Says. Encrypted files used to hide plans for bombing 11 U.S. airliners.

4. Security vs. Public Safety and The Criminal uses of the Internet Aum Shinrikyo religious cult (party) in Japan that spread poison gas in the Tokyo subway in march 1995 ( killing 12 and hospitalizing 6,000 people ) stored their records detailing plans for attacks on other countries on computers using powerful form of encryption called RSA (which stands for Rivest, Shamir and Adleman) . Fortunately, authorities were lucky to find the encryption key stored on a floppy disk.

5. Ch #5 Top - 3 a) Security Threats in the E- commerce Environment Three key points of vulnerability (Weakness): 1. Client 2. Server 3. Communications pipeline Slide 5-5

6. A Typical E-commerce Transaction Figure 5.3, Page 273 Slide 5-6 SOURCE: Boncella, 2000.

7. Vulnerable Points in an E-commerce Environment Figure 5.4, Page 274 Slide 5-7 SOURCE: Boncella, 2000.

8. b) Most Common Security Threats in the E-commerce Environment Now days the average computer user must be aware of the potential threats their computer faces each time you connect to the world wide web. It is a dangerous place for a computer and the security threats are growing everyday. Slide 5-8

9. Malicious code Malicious code ( some times referred to as malware ) includes a variety of threats such as viruses , worms , Trojan horses . A Microsoft test in 2007 of its malicious software removal tool found that 62% of 5.7 millions home and business PCs had active malware installed.

10. Malicious code - Virus A virus is a small program designed to infect your computer and cause errors, computer crashes, and even destroy your computer hardware. Unlike spyware, a virus can grow and replicate itself and spread to other files. Most computer viruses deliver a playload. The playload may be relatively benign, such as the display of a message or image, or it may be highly destructive destroying files, reformatting the computers hard drive, or causing programs to run improperly.

11. Malicious code - Virus Computer viruses fall into several major categories as follows. Macro viruses are application specific, meaning that the virus affects only the application for which it was written, such as Microsoft Word, Excel, PDF, or PowerPoint. When user open infected document, the virus copies itself/replicate to the templates in the application, so that when new documents are created, they are infected with the macro virus as well. Macro virus can easily be spread when sent in an e mail attachment or by flash drive from one computer to another along with infected documents (word, excel, PDF etc).

12. Malicious code - Virus File - Infecting viruses usually infect executable files, such as *.com, *exe, *dll files. These type of viruses may activate every time, when the infected file is executed by copying themselves into other executable files. File infecting viruses are also easily spread through e mails and any file transfer system.

13. Malicious code - Virus Script viruses are written in script programming languages such as VBScript (visual Basic Script) and JavaScript. The viruses are activated simply by double clicking an infected *.vbs or *.js file.

14. Malicious code - Worms Malware that is designed to spread from computer to computer. Scope of worms are networks Viruses are often combined with a worm. Worm is more dangers than a virus , reason is simple Viruses infect a single computer, and may destroy but produce very little crash but a worm that can propagate from one computer to another, perhaps to millions.

15. Malicious code - Worms A worm does not necessarily need to be activated by a user or program in order for it to replicate itself. For example, the Slammer worm, which targeted a known vulnerability in Microsofts SQL Server database software, infected more than 90% of vulnerable computers worldwide within 10 minutes of its release on the Internet.

16. Malicious code - Trojan Horses A Trojan horse appears to be benign, but then does something other than expected. TheTrojan horse is not itself a virus because it does not replicate, but is often a way for viruses or other malicious code such as bots or rootkits. The term Trojan horse refers to the huge wooden horse that Greeks gave their opponents (People of Troy), the Trojans gift that actually contained hundreds of Greek Soldiers. Once the people Troy let the massive horse within their gates, the soldiers revealed themselves and captured the city.

17. Malicious code - Trojan Horses A Trojan horse may masquerade as a game , but actually hide a program to steal your passwords and e mail them to another person (who send trojan horse). RootKit: a program whose aim is to subvert (weaken) control of the computers operating system ) Bot: type of malicious code that can be covertly installed on a computer when attached to the internet. Once installed, the bot responds to external commands sent by the attacker and your computer becomes a zombie, and is able to be controlled by an external third party (who programmed it ). Botnet: collection of captured bot computers used for malicious actvities such as participating in a DDoS attacks.

20. Guessing passwords Another common attack is to guess a user's password. This style of attack is manual or automated. Manual attacks are difficult, and only successful if the attacker knows something about the shopper. For example, if the shopper uses their child's name as the password. Automated attacks have a higher likelihood of success, because the probability of guessing a user ID/password becomes more significant as the number of tries increases. Tools exist that use all the words in the dictionary to test user ID/password combinations, or that attack popular user ID/password combinations. The attacker can automate to go against multiple sites at one time.

21. Unwanted Programs Applications that install themselves on a computer, typically without the users informed consent. Such Spyware Adware Browser parasites

22. Spywares A program used to obtain information such as a users keystrokes , copies of e mail and instant messages, and even take screenshots ( and thereby capture passwords or other confidential data) A common spyware type is a keylogger which records keystrokes typed on your keyboard. This is how people lose their bank account or personal details. Other spyware will record your actions and browsing habits on the internet. Any information collected by spyware is usually with the intent to sell.

23. Spywares Example 1: Dont Try One example of spyware is SpySheriff , which claims to be a spyware removal program but is actually a spyware application you have no control over it. Example 2: Try it Try It http://www.keylogger.in/ it may be use for track other users activities on you computer because its install by you and you have total control over it .

26. Adwares Adware is exactly as the name suggests, software with advertising. Adware is software that displays advertisements on your computer. Adwares is typically used to call for pop up ads to display when the user visits certain sites. Adware can be downloaded and sometimes included in free programs. some pop-up windows will have a button that says "Close Window." The close button is actually an install button. When the user clicks the close button, more adware is installed on his computer. The most common changes that adware makes on a computer are to the Internet browser. It can change the homepage and add a toolbar to the browser. If you get attacked by pop-up ads when you're not even connected to the Internet, you may have adware on your computer.

28. Adwares If you attempt to visit a particular Web site but are diverted to another site without your permission, you may be infected with adware. Adware may be contain spyware that can track your online activities, collect your web surfing habits, email addresses, and purchase preferences. It can also gather information about the hardware and software installed on your home computer and sends that information to marketers. Example: Alexa Toolbar, Zingo search , purityScan are examples of adware programs that open the webpages or display pop up ads of partner sites when certain keywords are used in Internet searches. Windows Live messenger and Yahoo messenger contain adware.

29. Browser Parasites A browser parasite is a program that can monitor and change the settings of a users browser, for instance, changing the browser home page, or sending information about the sites visited to a remote computer. Browser Parasites often a component of adware. For example, websearch toolbar is adware component that modifies IE default home page and search settings.

31. Phishing Phishing is any deceptive, online attempt by a third party to obtain confidential information for financial gain. Phishing attacks do not involve malicious code but instead rely on straightforward misrepresentation and fraud, so called social engineering techniques. Examples: 1. The most popular e mail scam letter. 2. You receive a e-mail contain message you won a lottery but first deposit some amount in the following account a/c ______.

32. Example: 1

33. Example 3 This is an example of a typical phishing e mail that seeks to obtain personal information.

34. Hacking and Cybervandalism Hacking: A hacker is an individual who intends to gain unauthorized access to a computer system. Cracker: Within the hacking community, a term typically used to denote a hacker with criminal intent. The terms hacker and cracker tends to be used interchangeably. Hackers and crackers gain unauthorized access by finding weaknesses in the security procedures of web sites and computer systems. Cybervandalism: Intentionally disrupting , defacing , or even destroying the site is called Cybervandalism.

35. Hacking and cybervandalism Groups of hackers called tiger teams are sometimes used by corporate security departments to test their own security measures. By hiring hackers to break into the system from outside, they company, can identify weaknesses in the computer systems. Types of hackers: White Hats: good hackers who help organizations locate and fix security flaws. Whites hats do their work under contract, with agreement from clients that they will no be prosecuted for their efforts to break in.

36. Hacking and cybervandalism Black Hats: Hackers who act with the intention of causing harm. They break into web sites and reveal the confidential information they find. They believe strongly that information should be free and they share it with others. Grey Hats: hackers who believe they are pursuing some greater good by breaking in and revealing systems flaws. Grey hats discover weaknesses in a systems security, and then publish the weakness without disrupting the site or attempting to profit from their finds.

37. Spoofing (Pharming) & spam (junk) web sites Spoofing: Misrepresenting self by using fake e-mail address and redirecting a Web link to a new, fake Web site is called Spoofing. Spoofing a website is also called Pharming. How it work: Links that are designed to lead to one site users to to a totally unrelated site. Spoofing threatens the integrity, confidentiality, Authenticity and privacy of a site. For example, if hackers redirect customers to a fake web site that looks almost exactly like the true site, they can then collect and process orders, credit card info, usernames/passwords, effectively stealing business from the true sites. As it is done in the case of City Bank.

38. Spoofing (Pharming) & spam (junk) web sites Spam Web sites ( also misrepresenting self ): typically appear on search results, and do not involve e- mail. Spam web sites that promise to offer some product or service, but in fact are a collection of advertisements for other sites, some of which contain malicious code. Recent research on junk web sites found more that 30% of the results on keywords drugs and ringtones led to fake webpages supported by major advertisers.

39. Credit card fraud/theft The purpose may be to obtain goods without paying, or to obtain unauthorized funds from an account. When a credit card is lost or stolen, it remains usable until the holder notifies the issuer that the card is lost. Most issuers have free 24-hour telephone numbers to encourage prompt reporting. Still, it is possible for a thief to make unauthorized purchases on a card until it is canceled.

40. Credit card fraud/theft

41. Credit card fraud/theft The only common security measure on all cards is a signature panel, but signatures are relatively easy to forge. Self-serve payment systems ( gas stations , kiosks, etc.) are common targets for stolen cards, as there is no way to verify the card holder's identity.

42. Credit card fraud/theft In E Commerce, mail and Internet are major routes for Credit card fraud against merchants who sell and ship products. On the Internet card is not physically present (called CNP Card Not Present) the merchant must rely on the holder presenting the online information.

43. Credit card fraud/theft But Credit card numbers are stored in databases on the servers. Today the most frequent cause of stolen cards and card information is systematic hacking of a corporate server where the information on millions of credit card purchases are stored.

44. Credit card fraud/theft The largest and most damaging mass credit card theft to date occurred at TJX Companies, owner of 2,500 retail stores. Information from 47.5 million credit and debit cards was stolen by hackers who gained access to TJXs customer information database via a poorly protected wireless local area network in 2003. the theft was not discovered until 2006, and was not reported until 2007. the information was sold on underground economy sites to criminals who subsequently mad hundreds of thousands of purchases, both offline and online.

45. Denial of service (DoS) attack In DoS attack, hackers flood a website with useless page requests that crush the sits web servers. The denial of service attack is one of the best examples of impacting site availability. It involves getting the server to perform a large number of mundane (ordinary) tasks, exceeding the capacity of the server to cope (handle) with any other task. For example, if everyone in a large meeting asks you your name all at once, and every time you answer, they ask you again. You have experienced a personal denial of service attack.

46. Denial of service (DoS) attack To ask a computer its name, you use ping. You can use ping to build an effective DoS attack. DoS attacks typically cause a web site to shut down, making it impossible for users to access the site. For busy E-commerce sites, these attacks are costly; while the site is shut down, customers cannot make purchases. And the longer a site is shut down, the more damage is done to a sites reputation. Such Attack dont destroy information or access restricted areas of the server, they destroy the firm online business.

47. Distributed denial of service (DDoS) attack Hackers use multiple computers to attack target network Distributed DoS is a type of attack used on popular sites, such as Yahoo! ,VeriSign, Microsoft. In this type of attack, the hacker infects computers on the Internet via a virus or other means. The infected computer becomes slaves to the hacker. The hacker controls them at a predetermined time to bombard the target server with useless, but intensive resource consuming requests.

48. Distributed denial of service (DDoS) attack This attack not only causes the target site to experience problems, but also the entire Internet as the number of packets is routed via many different paths to the target.

49. Distributed denial of service (DDoS) attack One way to protect against DoS attacks would be to increase the redundancy of your networks servers. Redundancy mean increase your servers and kept them on different locations. Set effective filters on Friewalls.

50. Sniffing or Sniffing the network Sniffing Eavesdropping (Tap someone) program/software that monitors information traveling over a network. Sniffers enable hackers to steal proprietary information from anywhere on a network, including e mail messages, company files and confidential reports. The threat of sniffing is that confidential or personal information will be made public

51. Sniffing or Sniffing the network There are points in the network where this attack is more practical than others. If the attacker sits in the middle of the network, then within the scope of the Internet, this attack becomes impractical. A request from the client to the server computer is broken up into small pieces known as packets as it leaves the client's computer and is reconstructed at the server. The packets of a request is sent through different routes. The attacker cannot access all the packets of a request and cannot decipher what message was sent.

52. Sniffing or Sniffing the network Example: Attacker Sits In The Middle Of The Network (sniffer cant capture all packets) Take the example of a shopper in Toronto purchasing goods from a store in Los Angeles. Some packets for a request are routed through New York, where others are routed through Chicago.

53. Sniffing or Sniffing the network A more practical location for this attack is near the shopper's computer or the server. Wireless hubs make attacks on the shopper's computer network the better choice because most wireless hubs are shipped with security features disabled. This allows an attacker to easily scan unencrypted traffic from the user's computer.

54. E mail wiretaps E mail wiretaps are a variation on the sniffing threat. An e mail wiretap is hidden code in an e- mail message that allows someone to monitor all succeeding messages forwarded with the original message. E mail wiretaps can be installed on servers and client computers. For instance, USA PATRIOT Act permits the FBI to compel ISPs to install a black box (wire tap program) on their mail servers.

55. Insider jobs or Insider Attacks Single largest financial threat We tend to think of security threats to a business as originating outside the organization. In fact, the largest financial threats to business institutions come not from robberies but from by insiders. Bank employees steal far more money than bank robbers. The same is true for e commerce sites.

56. Insider jobs or Insider Attacks Some of the largest disruptions to service, destruction to service, destruction to sites, and diversion of customer credit data and personal information have come from insiders once trusted employees. A Michigan State University study found that as much as 70% of all identity theft, including credit card theft, is the work of insiders.

57. Insider jobs or Insider Attacks Insiders Expose the data that can then be exploited by others. In September 2007, Citigroup confirmed that it was investigating a data breach that involves the names, social security numbers, and credit card information of over 5,000 customers by an employee of its ABN Amro Mortgage Group unit onto the LimeWire P2P file sharing network.

58. Poorly designed server and client software Many security threats prey on poorly designed server and client software, sometimes in the operating system and sometimes in the application software, including browsers. The very design of the personal computer includes many open communication ports that can be used, and indeed are designed to be used, by external computers to send and receive messages. The port typically attacked is TCP port 445.

59. Poorly designed server and client software May client computer didnt install antivirus program or didnt enable firewall. May be many unwanted programs are in browsers. He have old browser while Inprivate Browsing versions available (such as in firefox, IE) B2C have not proper file permission on server. Database base is nor password protected. For instance, in 2007, Symantec identified 39 vulnerabilities in IE, 34 FireFox browsers, 25 in Apple Safari, and 7 in Opera, Some of these vulnerabilities are critical.

60. Just Concept