Computer Security: Threats and Attacks

Computer Security Threats and Attacks

• A threat is a potential violation of security, posing a danger to computer security or privacy through a person, act, or object.
• Actions taken to cause a violation are called attacks, and those who execute them are attackers.

Types of Threats

• Disclosure involves unauthorized access to information, sometimes called snooping or interception.
• Deception involves acceptance of false data through modification, spoofing, repudiation of origin, or denial of receipt.
• Disruption involves interruption or prevention of correct operation.
• Usurpation involves unauthorized control of a system part.

Attacks

• An attack is a security threat aimed at obtaining, altering, destroying, removing, implanting, or revealing information without permission, affecting individuals and organizations.
• Security attacks can threaten goals such as confidentiality, integrity, availability, and authentication.
• Taxonomy of attacks relative to security goals:
  • Snooping and traffic analysis threaten confidentiality.
  • Modification, masquerading, replaying, and repudiation threaten integrity.
  • Denial of service threatens availability.
• Snooping is unauthorized data access, while traffic analysis obtains information by monitoring online traffic.
• Modification involves intercepting and changing messages, whereas masquerading or spoofing impersonates someone else.
• Replaying reuses a captured message, and repudiation involves message senders or receivers denying having sent or received a message.
• Denial of Service (DoS) attacks are common and can slow down or interrupt a system's service.

Types of Attacks: Passive vs. Active

• Categorization involves classifying attacks as either passive or active.
• Passive attacks aim to learn or use information without affecting system resources.
• There are two types of passive attacks: release of message contents (sniffing) and traffic analysis.
• Release of message contents involves an opponent learning the contents of transmissions, also known as interception.
• Traffic analysis determines the location, identity, frequency, and length of exchanged messages.

Active Attacks

• An active attack alters system resources or operations, involving online actions where the intruder controls transmitted data.
• The attacker can modify, extend, delete, or replay data, masquerade as a different entity, modify messages in transit, add or delete messages, or cause a denial of service.
• Categories of active attacks:
  • Spoofing or masquerading (fabrication) attacks authenticity.
  • Modification or alteration attacks integrity.
  • Delay affects availability.
  • Denial of Service (DoS) degrades or interrupts service, affecting availability.
• Spoofing or Masquerading:
  • Involves impersonation by falsifying data to gain illegitimate advantage.
  • It lures a victim into believing they communicate with a different entity.
• Modification or Alteration:
  • It consists if an unauthorized change of information
  • Encompasses deception, disruption, and usurpation if modified data is relied upon or controls system operation.
  • Active wiretapping alters network data.

Types of Active Attacks

• Delay:
  • Involves a temporary inhibition of a service.
  • Can be a form of usurpation.
  • Attackers manipulate system control structures to delay message delivery.
• Denial of Service (DOS):
  • Attackers overwhelm resources, making them unavailable to legitimate traffic.
  • This includes blocking legitimate user access.
  • It's considered a form of usurpation.

Summary of Attacks by Category

• Snooping, traffic analysis, and message content release are passive attacks, threatening confidentiality.
• Modification, masquerading, replaying, and repudiation are active attacks, threatening integrity.
• Denial of Service and delay are active attacks, threatening availability.

Types of Threats/Attacks

• Physical attacks involve stealing, breaking, or damaging computing devices.
• Denial of Service (DoS) attacks.
• Malware attacks are a generic term for software with malicious purposes.
• Hacking (intrusion) attacks are attempts gaining unauthorized system access, possibly malicious.
• Hackers:
  • They are skilled computer experts.
  • They gain unauthorized access to computers -There are three types:
    • Ethical hackers (White hat): They gain access to fix weaknesses, perform testing, and assess vulnerabilities.
    • Cracker (black hat): They gain unauthorized access for personal gain, often stealing data.
    • Grey hat (both): They break into systems without authority to identify and reveal weaknesses to the owner.

Malware Attacks

• Examples are viruses, worms, Trojan horses, spyware, and logic bombs.
• Virus:
  • Replicates itself inside other programs, usually without knowledge.
  • Similar to a biological, and spreads on its own.
  • Varies damage depending on the intention of the writer.
• Worm:
  • It is an independent program that duplicates itself across computers, usually on networks.
  • Classified has virus or worms.
  • It can creates of denial of service.
• Trojan Horse:
  • Is benign appearing software that downloads a virus or malware.

More Malware Attacks

• Spyware: It spies on computer activity.
  • Tracking cookies save data, which allows tracking Internet browser history.
  • Keyloggers record keystrokes to capture usernames and passwords.
  • Legal uses of spyware involve employer monitoring of employee tech use, parental monitoring of home computers and protecting children from online predators.
• Adware: Downloads to PCs when visiting websites.
  • It causes no harm to files or gathers sensitive information from a PC, but saturates with adds.
  • Counter exploitation website (www.cexx.org) provides a list of spyware and how to remove it.
  • The Spyware Guide ((www.spywareguide.com) lists spyware that can be gotten from the Internet.

How Malware Attack Affects you

• Logic bomb lays dormant until a specific condition is met, and performs a malicious act like deleting files.
• Bacterium or Rabbit.
  • Absorbs all of some class of resource
• Nonvirus or a hoax.
  • Perpetrators send an email, and instructs people to delete some file when it is really a virus.
• Software attacks viruses/worms:
  • First, the Virus should search for and detect objects to infect.

How to Deal with Infections

• Installation into the infectable object:
  • Writing on the boots sector
  • Scan computer or connections for connections

Effects:

• Virus Term virulent mean to spread rapidly or infects new targets.
• General infection process:
  • Read your email ad nauseum
  • Add some for all executable or auto-executable programs
  • Write a macro on all programs
  • Includes triggering mechanisms like dates, number of infections, or first use.
  • Payloads can do anything a legitimate program can, including displaying messages, deleting files, formatting the hard disk, overloading memory or changing system settings.
• Virus Writers: Adolescents. -Ethically average w/ above intelligence
  • College Students not normal and express writing viruses as not “wrong” -- Adult Virus creators: Ethically writing virus software.
• Three Methods for virus prevention are scanners activity monitoring and change detection

Anti-Virus

• Generic integrity checking and virus specific solutions are available for most computer systems.
  • Scanner checks matching signatures activity monitors if a program is behaving in a consistent way, and change detection software Three categories

Preventing Virus Infection

• Identification of known viruses, detections of viruses being used
• If the virus is blocked/ deleted this means it has been disinfected.
• For additional safety the object can be overridden of rewritten completely.
• Use a virus scanner.
• Do not open un known emails from unknown people
• Do not click "Security Alerts" as Microsoft does nit send out these

Internet Fraud

• Internet fraud does not require technical experience, and takes 3 forms.
• The amount of commerce online allows endless possibilities form scammers

Scams

• This includes outrageous sums of money with minimal investment
• Sending email that suggest that one can make an outrageous sum of money with a minimal investment.

Identity Theft

• One person takes the others identity.
• Attempt is usually to make purchases otherwise its obtaining credit cards and getting credit in another person's name.
• Phishing is one of the most common ways of identity theft, by getting others to provide you with personal information.
• An example is sending an email from the bank, where they must verify account from clicking a link, but the link is a set up by the attacker.