1. Chapter 15: Virus and Content Filtering Guide to Computer Network Security

2. Kizza - Guide to Computer Network Security 2 Content filtering is a process of removing unwanted, objectionable, and harmful content before it enters the user network or the user PC. The filtering process can be located in several locations including on a user’s PC, on a server within an organization, as a service provided by an ISP, or by means of a third party site which provides the basis of a closed community

3. Kizza - Guide to Computer Network Security 3 Scanning, Filtering and Blocking Scanning is a systematic process of sweeping through a collection of data looking for a specific pattern. In a network environment, the scanning process may involve a program the sweeps through thousands of IP addresses looking a particular IP address string or a string that represents a vulnerability or a string that represents a vulnerable port number. Filtering is a process of using a computer program to stop an Internet browser on a computer from being able to load certain web pages based upon predetermined criteria like IP addresses. Filtering is a process of using a computer program to stop an Internet browser on a computer from being able to load certain web pages based upon predetermined criteria like IP addresses. Blocking is a process of preventing certain types of information from being viewed on a computer's screen or stored on a computer’s disk.

4. Kizza - Guide to Computer Network Security 4 Content Scanning –scanning is very important in content filtering. –There are two forms of scanning: pattern-based and heuristic scanning. 14.2.1.1 Pattern-based scanning In pattern-based scanning all content coming into or leaving the network, an ISP gateway, or user PC is scanned and checked against a list of patterns, or definitions, supplied and kept up to date by the vendor. The technique involves simply comparing the contents, which can be done in several ways. Nearly all anti-virus software packages work this way. This approach can, however, be slow and resource-intensive. 14.2.1.2 Heuristic scanning Heuristics scanning is done by looking at a section of code and determining what it is doing, then deciding whether the behavior exhibited by the code is unwanted, harmful like viral or otherwise malicious. This approach to scanning, is complex because it involves modeling the behavior of code and comparing that abstract model to a rule set.

5. Kizza - Guide to Computer Network Security 5 Inclusion Filtering –Inclusion filtering is based on the existence of an inclusion list. –The inclusion list is a permitted access list – a “white list” probably vetted and compiled by a third party. Anything on this list is allowable. –The list could be a list of URL for allowable web sites for example; it could be a list of allowable words, or it could be a list of allowable packet signatures for allowable packets.

6. Kizza - Guide to Computer Network Security 6 –Inclusion list approach has problems: The difficulty to come up with a globally accepted set of criteria. This is a direct result of the nature of the Internet as a mosaic of a multitude of differing cultures, religions, and political affiliations. In this case it is almost impossible to come up with a truly accepted global set of moral guidelines. The size of the inclusion list. As more and more acceptable items become available and qualify to be added on the list, there is a potential for the list to grow out of control. Difficulty of finding a central authority to manage the list. In fact this is one of the most difficult aspect of the inclusion list approach to content filtering.

7. Kizza - Guide to Computer Network Security 7 Exclusion Filtering –Another approach to content filtering is the use of an exclusion list. This is the opposite of the inclusion list process we have discussed above. An exclusion list is actually a “black list” of all unwanted, objectionable, and harmful content. The list may contain URLs of sites, words, signatures of packets, patterns of words and phrases. This is a more common form of filtering than inclusion filtering because it deals with manageable lists. Also it does not pre-assume that everything is bad until proven otherwise. –However, it suffers from a list that may lack constant updates and a list that is not comprehensive enough. In fact we see these weaknesses in the virus area. No one will ever have a fully exhaustive list of all known virus signatures, and anti-virus companies are constantly ever updating their master lists of virus signatures.

8. Kizza - Guide to Computer Network Security 8 Other Types of Content Filtering –URL Filtering With this approach, content into or out of a network is filtered based on the URL. It is the most popular form of content filtering especially in terms of denial of access to the targeted site. One of the advantages of URL filtering is its ability to discriminate and carefully choose a site but leave the IP address of the machine that hosts functioning and, therefore, providing other services to the network or PC. –Keyword Filtering Keyword filtering requires that all the inbound or outbound content be scanned, and every syntactically correct word scanned is compared with words either on the inclusive – white list or exclusive black list depending on the filtering regime used

9. Kizza - Guide to Computer Network Security 9 –Packet Filtering Network traffic moves between network nodes based on a packet, as an addressable unit, with two IP-addresses: the source address and the destination addresses. Content is blocked or denied access based on IP-addresses, this means that no content can come from or go to the machine whose address is in the block rules. This kind of blocking is indiscriminate because it blocks a machine based on its addresses not content, which means that a machine may have other good services but they are all blocked.

10. Kizza - Guide to Computer Network Security 10 –Profile filtering This is a new brand of content filters based on the characteristics of the text “seen” so far and the learning cycles “repeats” done to discriminate all further text from this source. However, because of the complexity of the process and the time involved and needed for the filters to “learn”, this method, so far, has not gained popularity. In the pre-processing phase, it needs to fetch some parts of the document and scan it – either text based or content-based, in order to “learn”. This may take time.

11. Kizza - Guide to Computer Network Security 11 –Image analysis filtering –This is a new approach to filter the Internet’s new media and formats based on analyzed images. Although new, this approach is already facing problems of pre-loading images for analysis, high bandwidth making it extremely slow, and syntactic filtering making it indiscriminate semantically.

12. Kizza - Guide to Computer Network Security 12 Location of Content Filters there are four best locations to install content filters. –Filtering on the end user’s computer –Filtering at the ISP’s computer –Filtering by an Organization Server –Filtering by a Third Party

13. Kizza - Guide to Computer Network Security 13 Virus Filtering Virus –A computer virus is a self-propagating computer program designed to alter or destroy a computer system resource. The term virus is derived from a Latin word virus which means poison. For generations, even before the birth of modern medicine, the term had remained mostly in medical circles, meaning a foreign agent injecting itself in a living body, feeding on it to grow and multiply –The virus is, so far the most popular form of computer system attack because of the following factors: Ease of generation. Considering all other types of system attacks, viruses are the easiest to generate because the majority of them are generated from computer code. Scope of reach. Because of the high degree of interconnection of global computers, the speed at which viruses are spread is getting faster and faster

14. Kizza - Guide to Computer Network Security 14 –Self-propagating nature of viruses. The new viruses now are far more dangerous than their counterparts several years ago. New viruses self- propagate which gives them the ability to move fast and create more havoc faster –Mutating viruses. The new viruses are not only self-propagating which gives them speed, they are also mutating which gives them a double punch of delaying quick eradication and consuming great resources and, therefore, destroying more in their wake, fulfilling the intended goals of the developers. –Difficult to apprehend the developer

15. Kizza - Guide to Computer Network Security 15 Viruses Infection/Penetration There are three ways viruses infect computer systems: boot sector, macro penetration, and parasites –Boot Sector Penetration - A boot sector is usually the first sector on every disk. In a boot disk, the sector contains a chunk of code that powers up a computer. In a non-bootable disk, the sector contains a File Allocation Table (FAT), which is automatically loaded first into computer memory to create a roadmap of the type and contents of the disk for the computer to access the disk. Viruses imbedded in this sector are assured of automatic loading into the computer memory.

16. Kizza - Guide to Computer Network Security 16 –Macros Penetration - macros are small language programs that can only execute after imbedding themselves into surrogate programs. The rising popularity in the use of script in web programming is resulting in micro virus penetration as one of the fastest forms of virus transmission. –Parasites - These are viruses that attach themselves to a healthy executable program and wait for any event where such a program is executed. Because of spread of the Internet, this method of penetration is the most widely used and the most effective.

17. Kizza - Guide to Computer Network Security 17 Source of Virus Infection Computer viruses, just like biological viruses have many infection sources. –Movable Computer Disks –Internet Downloadable Software –Email Attachments –Platform-Free Executable Applets and Scripts

18. Kizza - Guide to Computer Network Security 18 Types of Viruses Just like living viruses, there are several types of digital (computer) viruses and there are new brands almost every the other day –Virus Classification Based on Transmission Trojan horse viruses Polymorphic viruses Stealth virus Retro virus Multipartite virus Armored virus Companion virus Phage virus

19. Kizza - Guide to Computer Network Security 19 –Virus Classification Based on Outcomes Error-generating Virus Data and Program Destroyers System Crusher Computer Time Theft Virus Hardware Destroyers Logic/Time Bombs

20. Kizza - Guide to Computer Network Security 20 Content Filtering Content filtering takes place at two levels: –Application level where the filtering is based on URL which may, for example, result in blocking a selected web page or an FTP site, –Network level based on packet filtering which may require routers to examine the IP address of the every incoming or outgoing traffic packet.

21. Kizza - Guide to Computer Network Security 21 Application Level Filtering –filtering is based on several things that make up a the blocking criteria including URL, keyword, and pattern. –also located at a variety of areas including at the user’s PC, at the network gateway, at a third party’s server, and at an ISP –The effectiveness of application level blocking using proxy servers is limited as a result of technical and non-technical factors: Technical Issues –Use of translation services in requests can result in requested content from unwanted servers and sites –The Domain Name server can be bypassed –The reliability of the proxy server may be a problem

22. Kizza - Guide to Computer Network Security 22 Non-technical issues –ISPs problems –The costs of creating and maintaining a black list Packet Level Filtering and Blocking –In packet level filtering and blocking, the filtering entity has a black list consisting of “forbidden” or “bad” IP addresses. –The blocking and filtering processes then work by comparing all incoming and outgoing packet IP addressees against the IP addressees on the supplied black list. –The effectiveness of packet level blocking is limited by both technical and non-technical problems:

23. Kizza - Guide to Computer Network Security 23 Technical Issues –Packet level blocking is indiscriminate –Routers can easily be circumvented –Black listed IP addresses are constantly changing –Use of non-standard port numbers Non-technical Issues –Increased operational costs and ISP administrative problems:

24. Kizza - Guide to Computer Network Security 24 Filtered Materials Nudity Mature Content SexGamblingViolence/Profanity Gross Depiction Drug /Drug Culture and Use Intolerance/Discrimination Satanic or Cult CrimeTastelessness Terrorism/ Militant/Extremists

25. Kizza - Guide to Computer Network Security 25 Spam Spam is unsolicited automated email. Because Internet use is more than 60 percent email, spamming affects a large number of Internet users. There are several ways we can fight spam including the following: –Limit email addresses posted in a public electronic place –Refrain from filling out online forms that require email address –Use email addresees that are NOT easy to guess –Practice using multiple email addresses –Use a Spam filter –Spam Laws