Computer Viruses and Worms Overview

Chapter 7: Computer and Network Security

• Chapter covers computer and network security, including hacking, malware, cybercrime, and online voting.

Learning Objectives

• Introduction to computer security
• Hacking definitions and methods
• Types of Malware
• Cybercrime and cyberattacks
• Online voting

7.1 Introduction

• Increasing computer use highlights the growing importance of computer security.
• Lack of security leads to harmful consequences like stolen information and extortion.
• Computer systems can be weaponized, impacting governments and organizations.

7.2 Hacking

• Original meaning of "hacker" involved exploration, risk-taking, and system innovation (e.g., MIT Tech Model Railroad Club).
• Modern meaning of "hacker" is someone who gains unauthorized access to computers and networks.
• Methods for gaining login names and passwords include eavesdropping, dumpster diving, social engineering, brute-force searches, and dictionary attacks.

Password Dos and Don'ts

• Avoid short, dictionary-based passwords.
• Do not reuse passwords.
• Utilize strong, complex passwords.
• Enable two-factor authentication when available.
• Have password recoveries sent to a secure email address.

Computer Fraud and Abuse Act

• Criminalizes various hacker activities, such as transmitting damaging code, gaining unauthorized access to computers, transmitting classified information, and trafficking in passwords.
• Maximum penalty includes 20 years in prison and a $250,000 fine.

Electronic Communications Privacy Act

• Illegal to intercept phone conversations, emails, or other data transmissions.
• Criminal to access stored email messages without authorization.

FBI and the Locked iPhone

• December 2015: Syed Farook and Tashfeen Malik killed and wounded people in California. FBI recovered an iPhone 5C from the perpetrator but it was encrypted.
• February 2016: FBI asked Apple to create a new version of iOS to disable passcode security features. Apple refused.
• FBI persuaded a US magistrate for an order.
• Apple argued that creating a "backdoor" for the FBI would harm the security of all iPhones.

Sidejacking

• Sidejacking is hijacking an open web session by capturing user cookies.
• Sidejacking is frequently achievable with unencrypted wireless networks.
• Internet security community long warned about this phenomenon, but ecommerce didn't act upon it for years.

Case Study: Firesheep

• October 2010: Eric Butler released a Firesheep Firefox extension.
• Firesheep allowed easy sidejacking of web sessions.
• In its first week, more than 500,000 downloads occurred.
• Firesheep brought media attention to security issues.
• Early 2011: Facebook and Twitter introduced new ways to increase site security.

Act Utilitarian Analysis for Firesheep

• Release of Firesheep helped focus media's attention on security.
• Benefits: improved security by prompting changes to Facebook and Twitter.
• Harms: minimal evidence suggesting Firesheep increased malicious activity in online theft.
• Conclusion: Releasing Firesheep, according to Act Utilitarianism, was likely a good act.

Virtue Ethics Analysis for Firesheep

• Butler's actions helped the public understand security issues on unencrypted networks.
• Butler's actions reflected an interest in protecting privacy and good.
• Butler's courage in taking responsibility for the program and the benevolence in making the software freely.

Kantian Analysis for Firesheep

• Accessing someone else's account is an invasion of privacy and therefore wrong.
• Butler created a tool for malicious activities; therefore, he had some moral responsibility for the misuse of Firesheep.
• Butler's hope that public pressure would prompt improvement of site security led to negative outcomes when he was willing to tolerate short-term increase in privacy violations.
• Treating victims as mere tools was ethically objectionable.
• Butler's release of Firesheep was wrong under a Kantian framework.

7.3 Malware

• Virus: A self-replicating code embedded within other programs (like documents or executables).
• Viruses are often included in downloaded software.
• Viruses are often associated with:
  • Hard disks
  • Floppy disks
  • CDs/DVDs
  • Email attachments
• Viruses spread via:
  • Diskettes or CDs
  • Email attachments
  • Files downloaded from the Internet

Email Attachments with Possible Virus

• Email attachments can conceal viruses.

How an Email Virus Spreads

• Users open attachments containing viruses.
• The virus reads the user's address book.
• The virus sends emails with virus-containing attachments.

Antivirus Software Packages

• Antivirus software is used to detect and destroy viruses.
• Antivirus software needs to be kept up-to-date.
• Consumers need to be cautious of fake antivirus applications.

Worm

• Worm: A self-contained program that spreads through a computer network, often exploiting vulnerabilities.
• It spreads by exploiting security holes in interconnected computers.
• Examples include the:
  • Internet Worm (Morris Worm)
  • Sasser Worm
  • Conficker Worm
  • Other instant messaging worms

The Internet Worm

• Released by Robert Tappan Morris.
• Infected Unix computers.
• Led to widespread computer crashes.
• Resulted in significant penalties for Morris.

Ethical Evaluation of the Internet Worm

• Kantian evaluation— Morris used others by gaining access without authorization.
• Social contract theory evaluation – violated organizations’ property rights.
• Benefits—organizations learned about their security vulnerabilities.
• Harms—waste of time, unavailable computers, disrupted network traffic, and Morris's punishment.
• Virtue ethics evaluation— Morris misused the Internet and did not take responsibility for the consequences of his actions.
• Conclusion—Morris acted wrongly, exhibiting poor ethical character.

Sasser Worm

• Launched in 2004.
• Infected 18 million computers.
• Disrupted the operations of companies (Delta Airlines, European Commission, Australian railroads, British Coast Guard).
• German juvenile Sven Jaschan confessed and received 30 hours of community service.

Instant Messaging Worms (e.g., Choke and Hello, Kelvir, Palevo)

• Malware spreads through instant messaging services.
• Some required users to delete or downgrade their systems to remove the worms.

Conficker Worm

• 2008 Windows computer worm.
• Widely circulated among computers using older software.
• Often found in legacy systems of factories and healthcare facilities.

Cross-Site Scripting

• Downloading malware without knowing.
• Web sites used by others to view posted documents or comments used to inject malware.
• Victims download malicious code from web servers when clicking links or reading comments.

Drive-By Downloads

• Malware unknowingly downloaded by visiting a compromised website.
• Pop-up windows prompt users for consent and downloads.
• Google's search engine occasionally returns a malicious link resulting in drive-by-downloads.

Trojan Horses and Backdoor Trojans

• Trojan horse: A program with a benign capability that conceals a sinister purpose.
• Backdoor Trojan: A type of Trojan that grants attackers access to the victim's computer.

Ransomware

• Malware that extorts money from the victim, often by encrypting victims files and asking for payments to release them.
• Installed via:
  • Drive-by downloads
  • Trojan Horses
  • Email attachments
  • Other means.

Rootkits

• A set of programs that provides privileged access to the computer.
• Activated whenever the computer is started.
• Uses security privileges to prevent recognition by the user.

Spyware and Adware

• Spyware: Software communicating over the internet without user knowledge.
• Monitors web surfing.
• Logs keystrokes.
• Captures snapshots of the computer screen.
• Sends reports back to the host computer.
• Adware: displays pop-up advertisements.
• Backdoor Trojans sometimes used to install spyware/adware.

Bots

• Bots are Trojan backdoor programs that respond to commands from another computer.
• First bots involved in legitimate activities such as internet relay chat/multiplayer games.
• Later bots were also used for illegal activities such as distributing spam/collecting personal information for theft and denial of service attacks.

Bots and Botnets

• Bot: a backdoor Trojan program that responds to commands from another computer.
• Botnet: a collection of infected computers controlled by the same command-and-control software.
• Botnet herders distribute spam and launch distributed denial-of-service attacks.

Protecting Your Internet-Connected Devices

• Keep security patches up-to-date on systems.
• Install and maintain anti-malware.
• Examine manufacturer's precautions before purchasing an Internet-connected device.
• Change default passwords on devices immediately upon connection to the Internet.
• Never use the same password on multiple devices.
• If possible, replace insecure Internet-of-Things (IoT) devices.

Security Risks of "Bring Your Own Device"

• 87% of US companies rely on employees using their personal devices for work purposes.
• The advantages of BYOD include reduced investments in hardware.
• Productivity and employee job satisfaction also improve when employees are allowed to use their personal tech for work.
• The risks of BYOD include corporate data breaches, especially when devices are lost or stolen.

"Bring Your Own Device" Policy Questions

• The concerns related to this policy regarding the security of employed devices.
• The apps that employers permit employees to utilize on personal devices.
• The type of technical support the company offers.
• In case of data breaches, the company's control over personal worker data.
• Company procedure for removing company data from employee devices.

7.4 Cyber Crime & Cyberattacks

• Phishing: Large-scale efforts to acquire user information.
• Spear Phishing: A variant where targeted users are selected.
• SQL Injection: Attacks on improperly secured database-driven web applications.
• Denial-of-Service Attacks (DoS): Attacks disrupting computer services.
• Distributed Denial-of-Service Attacks (DDoS): Attacks from numerous computers.

Internet-of-Things Devices Co-opted for DDoS Attacks

• IoT devices like network routers, security cameras, baby monitors, are often vulnerable to use in DDoS attacks.

Cyber Espionage

• Large-scale government hacking. Hundreds of terabytes of stolen data, dozens of countries.
• People's Liberation Army suspected of involvement.

Anonymous

• Loosely organized hacktivism group with various political aims.

Actions Attributed to Anonymous

• Cyberattacks often related to protests or social/political issues.

Convictions of Anonymous Members

• Numerous people arrested and convicted for Anonymous-related cyber activities.
• Examples of specific individuals and prison sentences provided.

7.5 Online Voting

• The 2000 US Presidential election, particularly in Florida, highlights the issues with using traditional voting machines.
• Two voting irregularities included:
  • Hanging chads
  • The "Butterfly ballot" design

Benefits of Online Voting

• Increase voter participation - more people would participate at a quicker rate.
• Faster vote counting.
• Eliminates ambiguity present in traditional voting.
• Reduced costs.
• Eliminates ballot-box tampering and potential manipulation.
• Accurate vote counts through software protections against over/under-voting.

Risks of Online Voting

• Possible bias in digital voting since some may rely on home computers over others.
• Voter privacy is more threatened in electronic voting.
• More opportunities to sell votes.
• Online voting is often a target for attacks such as denial-of-service.
• Vulnerability to software and/or hard drive manipulation/hacks affecting votes.
• Lack of physical ballots for auditing or recounts.

Utilitarian Analysis of Online Voting

• Time savings from online voting is weighed against the increased risk of DDoS attacks.
• The probability of a successful attack that changes the outcome of the election needs a determination.

Kantian Analysis of Online Voting

• Voter's will to be reflected in their ballots - integrity of the votes is necessary.
• Recounts require the ability to verify votes – integrity is paramount.
• A paper record of each vote is crucial for auditing and recounting, protecting vote integrity.
• Electronic voting may decrease costs, but the lack of paper records means a loss of auditability, impinging upon vote integrity.
• Eliminating paper votes may seem cost-effective, but at the expense of vote integrity.

Summary of Cyber Security

• Cyber security issues highlight the trade-off between security and convenience.
• Individuals can become infected with malware in several ways.
• Internet-of-Things (IoT) devices are a new vector for cyberattacks.
• Issues need to be addressed regarding when cyberattacks become acts of war.