CSCI-235 Micro-Computer in Science Privacy & Security

© Prentice-Hall, Inc Privacy in Cyberspace Privacy refers to an individuals ability to restrict the collection, use, and sale of confidential personal information Privacy refers to an individuals ability to restrict the collection, use, and sale of confidential personal information The Internet is eroding privacy through the selling of information collected through Web sites The Internet is eroding privacy through the selling of information collected through Web sites Few laws regulate selling personal information Few laws regulate selling personal information

© Prentice-Hall, Inc Cookies Cookies are small files that are written to an individuals hard drive whenever a Web site is visited Cookies are small files that are written to an individuals hard drive whenever a Web site is visited Legitimate purposes of cookies include recording information for future use. Example: retail sites using shopping carts Legitimate purposes of cookies include recording information for future use. Example: retail sites using shopping carts Questionable practices include banner ad companies tracking a users browsing actions and placing banner ads on Web sites based on those actions Questionable practices include banner ad companies tracking a users browsing actions and placing banner ads on Web sites based on those actions

© Prentice-Hall, Inc Cookies A small text file stored on your hard drive A small text file stored on your hard drive File is sent back to the server each time you visit that site File is sent back to the server each time you visit that site Stores preferences, allowing Web site to be customized Stores preferences, allowing Web site to be customized Stores passwords, allowing you to visit multiple pages within the site without logging in to each one Stores passwords, allowing you to visit multiple pages within the site without logging in to each one Tracks surfing habits, targeting you for specific types of advertisements Tracks surfing habits, targeting you for specific types of advertisements

© Prentice-Hall, Inc Example of Cookies

© Prentice-Hall, IncSecurity Hacker – someone who attempts to gain access to computer systems illegally Hacker – someone who attempts to gain access to computer systems illegally Originally referred to as someone with a high degree of computer expertise Originally referred to as someone with a high degree of computer expertise

© Prentice-Hall, Inc Definition of a Hacker Hacker noun (see Raymond, 1991) Hacker noun (see Raymond, 1991) A person who enjoys learning the details of computer systems and how to stretch their capabilities – as opposed to the most users of computers, who prefer to learn only the minimum amount necessary A person who enjoys learning the details of computer systems and how to stretch their capabilities – as opposed to the most users of computers, who prefer to learn only the minimum amount necessary One who programs enthusiastically or who enjoys programming rather than just theorizing about programming One who programs enthusiastically or who enjoys programming rather than just theorizing about programming

© Prentice-Hall, Inc Definition of a Hacker Person who Person who is an expert or enthusiastic of any kind is an expert or enthusiastic of any kind enjoys the intellectual challenge of creatively overcoming or circumventing limitations enjoys the intellectual challenge of creatively overcoming or circumventing limitations Used as a compliment Used as a compliment

© Prentice-Hall, Inc First Network Hack (Telephone) John Draper (AKA Capn Crunch) John Draper (AKA Capn Crunch) 1970s: 1970s: Free long distance calls using a whistle found in a cereal box Free long distance calls using a whistle found in a cereal box Whistle emits the same frequency as AT&T long lines to indicate a line was ready to route a new call (2600 Hz) Whistle emits the same frequency as AT&T long lines to indicate a line was ready to route a new call (2600 Hz)

© Prentice-Hall, Inc First Network Hack (Telephone) Flaw: Flaw: AT&T took cost cutting measures AT&T took cost cutting measures The signaling and voice used the same circuit The signaling and voice used the same circuit This flaw made the system vulnerable to anybody that can generate 2600 Hz This flaw made the system vulnerable to anybody that can generate 2600 Hz Solution: Solution: Now signaling takes place on a separate path from the one you talk on Now signaling takes place on a separate path from the one you talk on

© Prentice-Hall, Inc Computer Viruses Computer viruses are malicious programs that infect a computer system causing various problems with its use Computer viruses are malicious programs that infect a computer system causing various problems with its use Viruses replicate and attach themselves to programs in the system Viruses replicate and attach themselves to programs in the system There are more than 20,000 different computer viruses with the number growing daily There are more than 20,000 different computer viruses with the number growing daily

© Prentice-Hall, Inc How Virus Infections Spread Virus Infections spread by: Virus Infections spread by: Inserting a disk with an infected program and then starting the program Inserting a disk with an infected program and then starting the program Downloading an infected program from the Internet Downloading an infected program from the Internet Being on a network with an infected computer Being on a network with an infected computer Opening an infected attachment Opening an infected attachment

© Prentice-Hall, Inc Virus Myths You cannot get infected by simply being online You cannot get infected by simply being online If you download and execute an infected file, you can get infected If you download and execute an infected file, you can get infected Although most viruses (e.g., the Melissa virus) are in attachments that must be opened, it is possible to get infected by viewing an Although most viruses (e.g., the Melissa virus) are in attachments that must be opened, it is possible to get infected by viewing an

© Prentice-Hall, Inc Types of Viruses File Infectors File Infectors Attach themselves to program files Attach themselves to program files Spread to other programs on the hard drive Spread to other programs on the hard drive Are the most common type of virus Are the most common type of virus Boot Sector Viruses Boot Sector Viruses Attach themselves to the boot sector of a hard drive Attach themselves to the boot sector of a hard drive Execute each time the computer is started Execute each time the computer is started May lead to the destruction of all data May lead to the destruction of all data

© Prentice-Hall, Inc More Rogue Programs Time Bombs Time Bombs Also called logic bombs Also called logic bombs Harmless until a certain event or circumstance activates the program Harmless until a certain event or circumstance activates the program Worms Worms Resemble a virus Resemble a virus Spread from one computer to another Spread from one computer to another Control infected computers Control infected computers Attack other networked computers Attack other networked computers Trojan Horses Trojan Horses Disguise themselves as useful programs Disguise themselves as useful programs Contain hidden instructions Contain hidden instructions May erase data or cause other damage May erase data or cause other damage

© Prentice-Hall, Inc Identity Theft Identity theft is one of the fastest growing crimes in the United States and Canada Identity theft is one of the fastest growing crimes in the United States and Canada Identity theft occurs when enough information about an individual is obtained to open a credit card account in their name and charge items to that account Identity theft occurs when enough information about an individual is obtained to open a credit card account in their name and charge items to that account Examples of information needed are name, address, social security number, and other personal information Examples of information needed are name, address, social security number, and other personal information Laws limit liability to $50 for each fraudulent charge Laws limit liability to $50 for each fraudulent charge An individuals credit report is affected by identity theft An individuals credit report is affected by identity theft

© Prentice-Hall, Inc Using Firewalls Firewalls are programs that are designed to prohibit outside sources from accessing the computer system Firewalls are programs that are designed to prohibit outside sources from accessing the computer system A personal firewall is designed to protect home computers from unauthorized access while being connected to the Internet A personal firewall is designed to protect home computers from unauthorized access while being connected to the Internet

© Prentice-Hall, Inc Using Antivirus Programs They use pattern-matching techniques to examine program files for patterns of virus code They use pattern-matching techniques to examine program files for patterns of virus code Two drawbacks: Two drawbacks: They cannot find viruses not in their database They cannot find viruses not in their database They cannot find new viruses that alter themselves to evade detection They cannot find new viruses that alter themselves to evade detection Use antivirus programs that offer frequent updates and monitor system functions Use antivirus programs that offer frequent updates and monitor system functions Check disks that were used on another system for viruses Check disks that were used on another system for viruses

© Prentice-Hall, Inc Backing Up Data Back up programs and data regularly Back up programs and data regularly Store backups away from the computer system Store backups away from the computer system Types of backups: Types of backups: Full backups – Back up everything stored on the computer once a month Full backups – Back up everything stored on the computer once a month Incremental backups – Daily or weekly back up of only those files that have changed since the last back up Incremental backups – Daily or weekly back up of only those files that have changed since the last back up

© Prentice-Hall, Inc The Encryption Debate Encryption is the coding and scrambling process by which a message is made unreadable except by the intended recipient Encryption is the coding and scrambling process by which a message is made unreadable except by the intended recipient Encryption is needed for electronic commerce Encryption is needed for electronic commerce

The Encryption Debate Encryption is the coding and scrambling process by which a message is made unreadable except by the intended recipient Encryption is the coding and scrambling process by which a message is made unreadable except by the intended recipient Encryption is needed for electronic commerce Encryption is needed for electronic commerce

Simplified Data Communications Model

Encryption Basics A readable message is called plaintext A readable message is called plaintext An encryption algorithm is a formula used to make plaintext unreadable An encryption algorithm is a formula used to make plaintext unreadable The coded message is called ciphertext The coded message is called ciphertext I LOVE YOU V YBIR LBH

Encryption Basics Symmetric key encryption are encryption techniques that use the same key to encrypt and decrypt a message Symmetric key encryption are encryption techniques that use the same key to encrypt and decrypt a message Strong encryption refers to encryption methods that are used by banks and military agencies and are nearly impossible to break Strong encryption refers to encryption methods that are used by banks and military agencies and are nearly impossible to break

Symmetric Encryption or conventional / private-key / single-key or conventional / private-key / single-key sender and recipient share a common key sender and recipient share a common key all classical encryption algorithms are private-key all classical encryption algorithms are private-key was only type prior to invention of public- key in 1970s was only type prior to invention of public- key in 1970s

Basic Terminology plaintext - the original message plaintext - the original message ciphertext - the coded message ciphertext - the coded message cipher - algorithm for transforming plaintext to ciphertext cipher - algorithm for transforming plaintext to ciphertext key - info used in cipher known only to sender/receiver key - info used in cipher known only to sender/receiver encipher (encrypt) - converting plaintext to ciphertext encipher (encrypt) - converting plaintext to ciphertext decipher (decrypt) - recovering ciphertext from plaintext decipher (decrypt) - recovering ciphertext from plaintext cryptography - study of encryption principles/methods cryptography - study of encryption principles/methods cryptanalysis (codebreaking) - the study of principles/ methods of deciphering ciphertext without knowing key cryptanalysis (codebreaking) - the study of principles/ methods of deciphering ciphertext without knowing key cryptology - the field of both cryptography and cryptanalysis cryptology - the field of both cryptography and cryptanalysis

Symmetric Cipher Model

Requirements two requirements for secure use of symmetric encryption: two requirements for secure use of symmetric encryption: a strong encryption algorithm a strong encryption algorithm a secret key known only to sender / receiver a secret key known only to sender / receiver Y = E K (X) X = D K (Y) assume encryption algorithm is known assume encryption algorithm is known implies a secure channel to distribute key implies a secure channel to distribute key

Classical Substitution Ciphers where letters of plaintext are replaced by other letters or by numbers or symbols where letters of plaintext are replaced by other letters or by numbers or symbols

Caesar Cipher earliest known substitution cipher earliest known substitution cipher by Julius Caesar by Julius Caesar first attested use in military affairs first attested use in military affairs replaces each letter by k-th letter on replaces each letter by k-th letter on Example ( what is k ? ): Example ( what is k ? ): meet me after the toga party PHHW PH DIWHU WKH WRJD SDUWB

Caesar Cipher can define transformation (with k = 3) as: can define transformation (with k = 3) as: a b c d e f g h i j k l m n o p q r s t u v w x y z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C mathematically give each letter a number mathematically give each letter a number a b c d e f g h i j k l m n o p q r s t u v w x y Z then have Caesar cipher as: then have Caesar cipher as: Y = E K (X) X Y = E K (X) = (X + k) mod 26 X = D K (Y) Y X = D K (Y) = (Y – k) mod 26 EXAMPLE: Encrypt howdy using key k = 5

Cryptanalysis of Caesar Cipher only have 26 possible ciphers only have 26 possible ciphers A maps to A,B,..Z A maps to A,B,..Z could simply try each in turn could simply try each in turn a brute force search a brute force search given ciphertext, just try all shifts of letters given ciphertext, just try all shifts of letters

© Prentice-Hall, Inc

Private-Key Cryptography traditional private/secret/single key cryptography uses one key traditional private/secret/single key cryptography uses one key shared by both sender and receiver shared by both sender and receiver if this key is disclosed communications are compromised if this key is disclosed communications are compromised also is symmetric, parties are equal also is symmetric, parties are equal

Public-Key Cryptography probably most significant advance in the 3000 year history of cryptography probably most significant advance in the 3000 year history of cryptography uses two keys – a public & a private key uses two keys – a public & a private key asymmetric since parties are not equal asymmetric since parties are not equal uses clever application of number theoretic concepts to function uses clever application of number theoretic concepts to function complements rather than replaces private key cryptography complements rather than replaces private key cryptography

Public-Key Cryptography public-key/two-key/asymmetric cryptography involves the use of two keys: public-key/two-key/asymmetric cryptography involves the use of two keys: a public-key, which may be known by anybody, and can be used to encrypt messages, and verify signatures a public-key, which may be known by anybody, and can be used to encrypt messages, and verify signatures a private-key, known only to the recipient, used to decrypt messages, and sign (create) signatures a private-key, known only to the recipient, used to decrypt messages, and sign (create) signatures is asymmetric because is asymmetric because those who encrypt messages or verify signatures cannot decrypt messages or create signatures those who encrypt messages or verify signatures cannot decrypt messages or create signatures

Public-Key Cryptography

Public-Key Characteristics Public-Key algorithms rely on two keys with the characteristics that it is: Public-Key algorithms rely on two keys with the characteristics that it is: computationally infeasible to find decryption key knowing only algorithm & encryption key computationally infeasible to find decryption key knowing only algorithm & encryption key computationally easy to en/decrypt messages when the relevant (en/decrypt) key is known computationally easy to en/decrypt messages when the relevant (en/decrypt) key is known

Digital Signatures and Certificates Digital signatures are a technique used to guarantee that a message has not been tampered with Digital signatures are a technique used to guarantee that a message has not been tampered with Digital certificates are a technique used to validate ones identity Digital certificates are a technique used to validate ones identity