Computer Systems Security Part I ET4085 Keamanan Jaringan Telekomunikasi Tutun Juhana School of Electrical Engineering and Informatics Institut Teknologi Bandung

Computer systems security is all about the security threats that can compromise an operating system and the data held within Threats: viruses, Trojans, and spyware are 2

COMPUTER SYSTEMS SECURITY THREATS 3

Malicious Software Malicious software, or malware, is software designed to infiltrate a computer system and possibly damage it without the user’s knowledge or consent – Viruses – Worms – Trojan horses – Spyware – Rootkits – Adware – and other types of undesirable software. 4

Viruses A virus is code that runs on a computer without the user’s knowledge; it infects the computer when the code is accessed and executed For viruses to do their dirty work, they first need to be executed by the user in some way – A virus needs some sort of carrier A virus also has reproductive capability and can spread copies of itself throughout the computer if it is first executed by the user By infecting files accessed by other computers, the virus can spread to those other systems as well 5

Viruses types – Boot sector - Initially loads into the first sector of the hard drive; when the computer boots, the virus then loads into memory. – Macro - Usually placed in documents and ed to users in the hopes that the user will open the document, thus executing the virus. – Program - Infects executable files 6

Viruses types (2) – Polymorphic - Can change every time is it executed in an attempt to avoid antivirus detection. – Stealth - Uses various techniques to go unnoticed by antivirus programs. – Armored - These protect themselves from antivirus programs by tricking the program into thinking that it is located in a different place from where it actually resides Essentially, it has a layer of protection that it can use against the person who tries to analyze it; it will thwart attempts by analysts to examine its code. – Multipartite - A hybrid of boot and program viruses that attacks the boot sector or system files first and then attacks the other 7

Worms Worms are much like viruses except they self-replicate whereas a virus does not With worms, the user doesn’t need to access and execute the malware Worms take advantage of backdoors and security holes in operating systems and applications – They look for other systems on the network or through the Internet that are running the same applications and replicate to those other systems 8

Trojan Horses 9

Trojan horses, or simply Trojans, appear to perform wanted functions but are actually performing malicious functions behind the scenes These are not technically viruses and can easily be downloaded without noticing them 10

Remote access Trojans (RATs) are the most common type of Trojan (ex: Back Orifice or NetBus) – their capability to allow an attacker higher administration privileges than the owner When a target computer is controlled by an attacker, it could easily become a robot (or simply a bot), carrying out the plans of the attackers at their command 11

Spyware Spyware is a type of malicious software either downloaded unwittingly from a website or installed along with some other third-party software Usually, this malware collects information about the user without the user’s consent. Spyware is also associated with advertising (those pop-ups that just won’t go away!) and could possibly change the computer configuration – Adware usually falls into the realm of spyware because it pops up advertisements based on what it has learned from spying on the user Grayware is another general term that describes applications that are behaving improperly but without serious consequences – It is associated with spyware, adware, and joke programs 12

Rootkits A rootkit is a type of software designed to gain administrator-level control over a computer system without being detected – The term is a combination of the words “root” (meaning the root user in a UNIX/Linux system or administrator in a Windows system) and “kit” (meaning software kit) – Usually, the purpose is to perform malicious operations on a target computer at a later date without the knowledge of the administrators or users of that computer 13

Rootkits are difficult to detect because they are activated before the operating system has fully booted A rootkit might install hidden files, processes, and hidden user accounts. Because rootkits can be installed in hardware or software, they can intercept data from network connections, keyboards, and so on 14

Rootkits can target the BIOS, boot loader, kernel, and more Example: Evil Maid 15

Spam Spam is the abuse of electronic messaging systems such as , broadcast media, instant messaging, and so on Spammers send unsolicited bulk messages indiscriminately, usually without benefit to the actual spammer, because the majority of spam is either deflected or ignored The bulk of network-based viruses are transferred through spam e- mails 16

Summary of Malware Threats 17

WAYS TO DELIVER MALICIOUS SOFTWARE 18

Malware is not sentient (...not yet) and can’t just appear out of thin air it needs to be transported and delivered to a computer or installed on a computer system in some manner 19

20

Direct physical access 21

Via Software, Messaging, and Media 22

Active Interception (inception) 23

Privilege Escalation the act of exploiting a bug or design flaw in a software or firmware application to gain access to resources that normally would’ve been protected from an application or user 24

Backdoors Backdoors are used in computer programs to bypass normal authentication and other security mechanisms in place Originally, backdoors were used by developers as a legitimate way of accessing an application, but soon after they were implemented by attackers who would use backdoors to make changes to operating systems, websites, and network devices Quite often, it is installed via a Trojan horse Example: Back Orifice (completely new application that would act as a backdoor), which enables a user to control a Windows computer from a remote location. 25

Logic Bombs Logic bombs are code that has, in some way, been inserted into software to initiate one of many types of malicious functions when specific criteria are met malware malware delivery system 26

Botnets and Zombies malware can be distributed throughout the Internet by a group of compromised computers known as a botnet (controlled by a master computer (where the attacker resides)) The individual compromised computers in the botnet are called zombies Leads to distributed denial of service (DDoS) 27

Columbo is an American detective mystery television film series, starring Peter Falk as Columbo, a homicide detective with the LAPD (wikipedia) 28