Upload
christopher-rogers
View
224
Download
0
Tags:
Embed Size (px)
Citation preview
Computer Systems SecurityPart I
ET4085 Keamanan Jaringan TelekomunikasiTutun Juhana
School of Electrical Engineering and InformaticsInstitut Teknologi Bandung
2
Computer systems security is all about the security threats that can compromise an operating system
and the data held within
Threats: viruses, Trojans, and spyware are
3
COMPUTER SYSTEMS SECURITY THREATS
4
Malicious Software
• Malicious software, or malware, is software designed to infiltrate a computer system and possibly damage it without the user’s knowledge or consent– Viruses– Worms– Trojan horses– Spyware– Rootkits– Adware– and other types of undesirable software.
5
Viruses
• A virus is code that runs on a computer without the user’s knowledge; it infects the computer when the code is accessed and executed
• For viruses to do their dirty work, they first need to be executed by the user in some way– A virus needs some sort of carrier
• A virus also has reproductive capability and can spread copies of itself throughout the computer if it is first executed by the user
• By infecting files accessed by other computers, the virus can spread to those other systems as well
6
• Viruses types– Boot sector - Initially loads into the first sector of
the hard drive; when the computer boots, the virus then loads into memory.
– Macro - Usually placed in documents and e-mailed to users in the hopes that the user will open the document, thus executing the virus.
– Program - Infects executable files
7
• Viruses types (2)– Polymorphic - Can change every time is it executed in an
attempt to avoid antivirus detection.– Stealth - Uses various techniques to go unnoticed by antivirus
programs.– Armored - These protect themselves from antivirus programs by
tricking the program into thinking that it is located in a different place from where it actually resides • Essentially, it has a layer of protection that it can use against the
person who tries to analyze it; it will thwart attempts by analysts to examine its code.
– Multipartite - A hybrid of boot and program viruses that attacks the boot sector or system files first and then attacks the other
8
Worms• Worms are much like viruses except
they self-replicate whereas a virus does not
• With worms, the user doesn’t need to access and execute the malware
• Worms take advantage of backdoors and security holes in operating systems and applications– They look for other systems on the
network or through the Internet that are running the same applications and replicate to those other systems
9
Trojan Horses
10
• Trojan horses, or simply Trojans, appear to perform wanted functions but are actually performing malicious functions behind the scenes
• These are not technically viruses and can easily be downloaded without noticing them
11
• Remote access Trojans (RATs) are the most common type of Trojan (ex: Back Orifice or NetBus)– their capability to allow an
attacker higher administration privileges than the owner
• When a target computer is controlled by an attacker, it could easily become a robot (or simply a bot), carrying out the plans of the attackers at their command
12
Spyware• Spyware is a type of malicious software either
downloaded unwittingly from a website or installed along with some other third-party software
• Usually, this malware collects information about the user without the user’s consent.
• Spyware is also associated with advertising (those pop-ups that just won’t go away!) and could possibly change the computer configuration – Adware usually falls into the realm of spyware because it
pops up advertisements based on what it has learned from spying on the user
• Grayware is another general term that describes applications that are behaving improperly but without serious consequences– It is associated with spyware, adware, and joke programs
13
Rootkits
• A rootkit is a type of software designed to gain administrator-level control over a computer system without being detected– The term is a combination of the words “root”
(meaning the root user in a UNIX/Linux system or administrator in a Windows system) and “kit” (meaning software kit)
– Usually, the purpose is to perform malicious operations on a target computer at a later date without the knowledge of the administrators or users of that computer
14
• Rootkits are difficult to detect because they are activated before the operating system has fully booted
• A rootkit might install hidden files, processes, and hidden user accounts.
• Because rootkits can be installed in hardware or software, they can intercept data from network connections, keyboards, and so on
15
• Rootkits can target the BIOS, boot loader, kernel, and more
• Example: Evil Maid
16
Spam
• Spam is the abuse of electronic messaging systems such as e-mail, broadcast media, instant messaging, and so on
• Spammers send unsolicited bulk messages indiscriminately, usually without benefit to the actual spammer, because the majority of spam is either deflected or ignored
• The bulk of network-based viruses are transferred through spam e-mails
17
Summary of Malware Threats
18
WAYS TO DELIVER MALICIOUS SOFTWARE
19
• Malware is not sentient (...not yet) and can’t just appear out of thin air
• it needs to be transported and delivered to a computer or installed on a computer system in some manner
20
Malware transportation– Direct physical access– Via Software, Messaging, and Media– Active Interception– Privilege Escalation– Backdoors– Logic Bombs– Botnets and Zombies
21 Direct physical access
22 Via Software, Messaging, and Media
23 Active Interception (inception)
24 Privilege Escalation
the act of exploiting a bug or design flaw in a software or firmware application to gain access to resources that normally would’ve been protected from an application or user
25 Backdoors
Backdoors are used in computer programs to bypass normal authentication andother security mechanisms in placeOriginally, backdoors were used by developers as a legitimate way of accessing an application, but soon after they were implemented by attackers who would use backdoors to make changes to operating systems, websites, and network devicesQuite often, it is installed via a Trojan horse
Example: Back Orifice (completely new application that would act as a backdoor), which enables a user to control a Windows computer from a remote location.
26 Logic Bombs
Logic bombs are code that has, in some way, been inserted into software to initiate one of many types of malicious functions when specific criteria are met
malware
malware delivery system
27 Botnets and Zombies
malware can be distributed throughout the Internet by a group of compromised computers known as a botnet (controlled by a master computer (where the attacker resides))The individual compromised computers in the botnet are called zombies
Leads to distributed
denial of service (DDoS)
28
Columbo is an American detective mystery television film series, starring Peter Falk as Columbo, a homicide detective with the LAPD (wikipedia)