1. CH # 5 Top – 2 The Tension Between Security and Other Values
Can there be too much security? The answer is yes.
Contrary to what some my believe, security is no an absolute good.
Computer security adds overhead and expense to business operations, and also gives criminals new opportunities to hide their intentions and their crimes.

2. Security vs. ease of use
There are inevitable tensions b/w security and ease of use.
When traditional merchants are so fearful of robbers that they do business in shops locked behind security gates, ordinary customers are discouraged from walking in. The same can be true on the web.
The more security measures added, the more difficult a site is to use, and the slower it becomes.
Digital security is purchased at the price of slowing down processes .
Too much security can harm profitability, while not enough security can potentially put you out of business.

3. Security vs. Public Safety and The Criminal uses of the Internet
There is also an inevitable (expected) tension b/w the desires of individuals to anonymously (to hide their identity) and the needs of public officials to maintain public safety than can threatened by criminals or terrorists.
Use of technology by criminals to plan crimes or threaten nation- state.
Terrorists are also fond users of the Internet and have been for many years.
Encrypted files sent via e – mail were used by Ramsey Yousef – a member of the Al Qaeda responsible for bombing the World Trade Center in 1993, as American Says.
Encrypted files used to hide plans for bombing 11 U.S. airliners.

4. Security vs. Public Safety and The Criminal uses of the Internet
Aum Shinrikyo religious cult (party) in Japan that spread poison gas in the Tokyo subway in march 1995 ( killing 12 and hospitalizing 6,000 people ) stored their records detailing plans for attacks on other countries on computers using powerful form of encryption called RSA (which stands for Rivest, Shamir and Adleman) .
Fortunately, authorities were lucky to find the encryption key stored on a floppy disk.

5. Ch #5 Top - 3 a) Security Threats in the E-commerce Environment
Three key points of vulnerability (Weakness):
Client
Server
Communications pipeline

6. A Typical E-commerce Transaction
SOURCE: Boncella, 2000.
Figure 5.3, Page 273

7. Vulnerable Points in an E-commerce Environment
SOURCE: Boncella, 2000.
Figure 5.4, Page 274

8. b) Most Common Security Threats in the E-commerce Environment
Now days the average computer user must be aware of the potential threats their computer faces each time you connect to the world wide web. It is a dangerous place for a computer and the security threats are growing everyday.

9. Malicious code
Malicious code ( some times referred to as “ malware” ) includes a variety of threats such as viruses, worms, Trojan horses.
A Microsoft test in 2007 of its malicious software removal tool found that 62% of 5.7 millions home and business PCs had active malware installed.

10. Malicious code - Virus
A virus is a small program designed to infect your computer and cause errors, computer crashes, and even destroy your computer hardware.
Unlike spyware, a virus can grow and replicate itself and spread to other files.
Most computer viruses deliver a “playload.”
The playload may be relatively benign, such as the display of a message or image, or it may be highly destructive – destroying files, reformatting the computer’s hard drive, or causing programs to run improperly.

11. Malicious code - Virus
Computer viruses fall into several major categories as follows.
Macro viruses – are application specific, meaning that the virus affects only the application for which it was written, such as Microsoft Word, Excel, PDF, or PowerPoint.
When user open infected document, the virus copies itself/replicate to the templates in the application, so that when new documents are created, they are infected with the macro virus as well.
Macro virus can easily be spread when sent in an e – mail attachment or by flash drive from one computer to another along with infected documents (word, excel, PDF etc).

12. Malicious code - Virus
File - Infecting viruses – usually infect executable files, such as *.com, *exe, *dll files. These type of viruses may activate every time, when the infected file is executed by copying themselves into other executable files.
File – infecting viruses are also easily spread through e – mails and any file transfer system.

13. Malicious code - Virus
Script viruses – are written in script programming languages such as VBScript (visual Basic Script) and JavaScript.
The viruses are activated simply by double – clicking an infected *.vbs or *.js file.

14. Malicious code - Worms
Malware that is designed to spread from computer to computer.
Scope of worms are networks
Viruses are often combined with a worm.
Worm is more dangers than a virus , reason is simple
Viruses infect a single computer, and may destroy but produce very little crash but a worm that can propagate from one computer to another, perhaps to millions.

15. Malicious code - Worms
A worm does not necessarily need to be activated by a user or program in order for it to replicate itself.
For example, the Slammer worm, which targeted a known vulnerability in Microsoft’s SQL Server database software, infected more than 90% of vulnerable computers worldwide within 10 minutes of its release on the Internet.

16. Malicious code - Trojan Horses
A Trojan horse appears to be benign, but then does something other than expected.
TheTrojan horse is not itself a virus because it does not replicate, but is often a way for viruses or other malicious code such as bots or rootkits.
The term Trojan horse refers to the huge wooden horse that Greeks gave their opponents (People of Troy), the Trojans – gift that actually contained hundreds of Greek Soldiers.
Once the people Troy let the massive horse within their gates, the soldiers revealed themselves and captured the city.

17. Malicious code - Trojan Horses
A Trojan horse may masquerade as a game, but actually hide a program to steal your passwords and e – mail them to another person (who send trojan horse).
RootKit: a program whose aim is to subvert (weaken) control of the computer’s operating system )
Bot: type of malicious code that can be covertly installed on a computer when attached to the internet. Once installed, the bot responds to external commands sent by the attacker and your computer becomes a “zombie,” and is able to be controlled by an external third party (who programmed it ).
Botnet: collection of captured bot computers used for malicious actvities such as participating in a DDoS attacks.

20. Guessing passwords
Another common attack is to guess a user's password. This style of attack is manual or automated.
Manual attacks are difficult, and only successful if the attacker knows something about the shopper.
For example, if the shopper uses their child's name as the password.
Automated attacks have a higher likelihood of success, because the probability of guessing a user ID/password becomes more significant as the number of tries increases.
Tools exist that use all the words in the dictionary to test user ID/password combinations, or that attack popular user ID/password combinations. The attacker can automate to go against multiple sites at one time.

21. Spyware Adware Browser parasites Unwanted Programs
Applications that install themselves on a computer, typically without the user’s informed consent. Such
Spyware
Adware
Browser parasites

22. Spywares A program used to obtain information such as
a user’s keystrokes, copies of e – mail and instant messages, and even take screenshots ( and thereby capture passwords or other confidential data)
A common spyware type is a keylogger which records keystrokes typed on your keyboard.
This is how people lose their bank account or personal details.
Other spyware will record your actions and browsing habits on the internet.
Any information collected by spyware is usually with the intent to sell.

23. Spywares Example 1: Don’t Try
One example of spyware is SpySheriff, which claims to be a spyware removal program but is actually a spyware application you have no control over it.
Example 2: Try it
Try It it may be use for track other users activities on you computer because its install by you and you have total control over it .

26. Adwares
Adware is exactly as the name suggests, software with advertising. Adware is software that displays advertisements on your computer.
Adwares is typically used to call for pop – up ads to display when the user visits certain sites. Adware can be downloaded and sometimes included in free programs.
some pop-up windows will have a button that says "Close Window." The close button is actually an install button. When the user clicks the close button, more adware is installed on his computer.
The most common changes that adware makes on a computer are to the Internet browser. It can change the homepage and add a toolbar to the browser.
If you get attacked by pop-up ads when you're not even connected to the Internet, you may have adware on your computer.

28. Adwares
If you attempt to visit a particular Web site but are diverted to another site without your permission, you may be infected with adware.
Adware may be contain spyware that can track your online activities, collect your web surfing habits, addresses, and purchase preferences. It can also gather information about the hardware and software installed on your home computer and sends that information to marketers.
Example: Alexa Toolbar, Zingo search , purityScan are examples of adware programs that open the webpages or display pop – up ads of partner sites when certain keywords are used in Internet searches.
Windows Live messenger and Yahoo messenger contain adware.
Self - Study
What is Adware?
Adware is software that displays advertisements on your computer. It gets installed on your computer along with other programs or when you are cruising the Internet. Almost every computer gets infected with adware at some point in time. Adware can cause minor computer problems to major computer problems. A computer that is infected with a lot of different adware programs will likely experience a lot of problems, including a slowdown of the operating system and changes in computer settings. Slowdown of the Operating System
Adware programs run constantly in the background, usually without the user's knowledge. Any program that runs uses up processor resources and memory. When multiple adware programs are running simultaneously, the processor and memory can get overloaded, and the computer will run very slowly. Sometimes the computer is so overloaded that it barely functions at all. Basically, the more adware programs that are on a computer, the slower the computer will run. Changes in Computer Settings
The most common changes that adware makes on a computer are to the Internet browser. It can change the homepage and add a toolbar to the browser. These changes to the browser do not necessarily slow down the computer's performance, but they do cause an annoyance to the computer user. Adware Multiplies
Many adware programs cause additional adware programs to install on a computer. There are two main ways that this happens. Some adware installs additional adware without any actions being taken by the user. Other adware programs trick the user into installing more adware. It does this by opening up pop-up windows. When the user clicks on the pop-up window, more adware is installed. Adware pop-up windows can be very tricky. For example, some pop-up windows will have a button that says "Close Window." The close button is actually an install button. When the user clicks the close button, more adware is installed on his computer. Getting Rid of Adware
There are many programs available on the Internet that remove adware. Unfortunately, some of the supposed adware removal programs actually put adware on your computer. Two good adware programs are Ad-Aware and Spybot. Both programs offer free and paid versions. Computers that are severely infected may need to be cleaned by a professional. Tips to Avoid Adware
Follow these four tips to minimize adware infection: 1) Never install programs or download files from any source that you do not trust 100 percent. 2) Do not open any attachments that you do not trust 100 percent. 3) Always close a pop-up window by clicking on the "x" at the top corner of the window. 4) Run an adware scan on your computer at least once a week. Using more than one program is even better, because not every program can catch every piece of adware.

29. Browser Parasites
A browser parasite is a program that can monitor and change the settings of a user’s browser, for instance, changing the browser home page, or sending information about the sites visited to a remote computer.
Browser Parasites often a component of adware.
For example, websearch toolbar is adware component that modifies IE default home page and search settings.

31. Phishing
Phishing is any deceptive, online attempt by a third party to obtain confidential information for financial gain. Phishing attacks do not involve malicious code but instead rely on straightforward misrepresentation and fraud, so – called “ social engineering” techniques.
Examples:
1. The most popular e – mail scam letter.
2. You receive a contain message you won a lottery but first deposit some amount in the following account a/c ______.

32. Example: 1

33. This is an example of a typical phishing e – mail that seeks
to obtain personal information.

34. Hacking and Cybervandalism
Hacking: A hacker is an individual who intends to gain unauthorized access to a computer system.
Cracker: Within the hacking community, a term typically used to denote a hacker with criminal intent.
The terms hacker and cracker tends to be used interchangeably.
Hackers and crackers gain unauthorized access by finding weaknesses in the security procedures of web sites and computer systems.
Cybervandalism: Intentionally disrupting , defacing , or even destroying the site is called Cybervandalism.

35. Hacking and cybervandalism
Groups of hackers called tiger teams are sometimes used by corporate security departments to test their own security measures.
By hiring hackers to break into the system from outside, they company, can identify weaknesses in the computer system’s.
Types of hackers:
White Hats: “good” hackers who help organizations locate and fix security flaws.
Whites hats do their work under contract, with agreement from clients that they will no be prosecuted for their efforts to break in.

36. Hacking and cybervandalism
Black Hats: Hackers who act with the intention of causing harm.
They break into web sites and reveal the confidential information they find. They believe strongly that information should be free and they share it with others.
Grey Hats: hackers who believe they are pursuing some greater good by breaking in and revealing systems flaws.
Grey hats discover weaknesses in a system’s security, and then publish the weakness without disrupting the site or attempting to profit from their finds.

37. Spoofing (Pharming) & spam (junk) web sites
Misrepresenting self by using fake address and redirecting a Web link to a new, fake Web site is called Spoofing.
Spoofing a website is also called Pharming.
How it work:
Links that are designed to lead to one site users to to a totally unrelated site.
Spoofing threatens the integrity, confidentiality, Authenticity and privacy of a site.
For example, if hackers redirect customers to a fake web site that looks almost exactly like the true site, they can then collect and process orders, credit card info, usernames/passwords, effectively stealing business from the true sites.
As it is done in the case of City Bank.

38. Spoofing (Pharming) & spam (junk) web sites
Spam Web sites (also misrepresenting self): typically appear on search results, and do not involve .
Spam web sites that promise to offer some product or service, but in fact are a collection of advertisements for other sites, some of which contain malicious code.
Recent research on junk web sites found more that 30% of the results on keywords “ drugs” and “ ringtones” led to fake webpages supported by major advertisers.

39. Credit card fraud/theft
The purpose may be to obtain goods without paying, or to obtain unauthorized funds from an account.
When a credit card is lost or stolen, it remains usable until the holder notifies the issuer that the card is lost.
Most issuers have free 24-hour telephone numbers to encourage prompt reporting.
Still, it is possible for a thief to make unauthorized purchases on a card until it is canceled.

40. Credit card fraud/theft

41. Credit card fraud/theft
The only common security measure on all cards is a signature panel, but signatures are relatively easy to forge.
Self-serve payment systems (gas stations, kiosks, etc.) are common targets for stolen cards, as there is no way to verify the card holder's identity.

42. Credit card fraud/theft
In E – Commerce, mail and Internet are major routes for Credit card fraud against merchants who sell and ship products.
On the Internet card is not physically present (called CNP Card Not Present) the merchant must rely on the holder presenting the online information.
Have you ever eaten at a restaurant, paid with a credit card, and forgotten to get your copy of the credit card receipt?
Did you know that many of these receipts have your credit card number printed right there for anyone to see (and use)?
And, if you've signed them, your signature is also right there for someone to carefully copy.
This can lead to the most simple form of identity theft. With this bit of information, some unscrupulous person can be well on his way to making purchases either by phone or on the Internet using your credit card number.

43. Credit card fraud/theft
But Credit card numbers are stored in databases on the servers.
Today the most frequent cause of stolen cards and card information is systematic hacking of a corporate server where the information on millions of credit card purchases are stored.

44. Credit card fraud/theft
The largest and most damaging mass credit card theft to date occurred at TJX Companies, owner of 2,500 retail stores.
Information from 47.5 million credit and debit cards was stolen by hackers who gained access to TJX’s customer information database via a poorly protected wireless local area network in the theft was not discovered until 2006, and was not reported until the information was sold on underground economy sites to criminals who subsequently mad hundreds of thousands of purchases, both offline and online.

45. Denial of service (DoS) attack
In DoS attack, hackers flood a website with useless page requests that crush the sit’s web servers.
The denial of service attack is one of the best examples of impacting site availability. It involves getting the server to perform a large number of mundane (ordinary) tasks, exceeding the capacity of the server to cope (handle) with any other task.
For example, if everyone in a large meeting asks you your name all at once, and every time you answer, they ask you again. You have experienced a personal denial of service attack.

46. Denial of service (DoS) attack
To ask a computer its name, you use ping. You can use ping to build an effective DoS attack.
DoS attacks typically cause a web site to shut down, making it impossible for users to access the site.
For busy E-commerce sites, these attacks are costly; while the site is shut down, customers cannot make purchases.
And the longer a site is shut down, the more damage is done to a site’s reputation.
Such Attack don’t destroy information or access restricted areas of the server, they destroy the firm online business.

47. Distributed denial of service (DDoS) attack
Hackers use multiple computers to attack target network
Distributed DoS is a type of attack used on popular sites, such as Yahoo!® ,VeriSign, Microsoft.
In this type of attack, the hacker infects computers on the Internet via a virus or other means.
The infected computer becomes slaves to the hacker.
The hacker controls them at a predetermined time to bombard the target server with useless, but intensive resource consuming requests.

48. Distributed denial of service (DDoS) attack
This attack not only causes the target site to experience problems, but also the entire Internet as the number of packets is routed via many different paths to the target.

49. Distributed denial of service (DDoS) attack
One way to protect against DoS attacks would be to increase the redundancy of your network’s servers.
Redundancy mean increase your servers and kept them on different locations.
Set effective filters on Friewalls.

50. Sniffing or Sniffing the network
Sniffing Eavesdropping (Tap someone) program/software that monitors information traveling over a network.
Sniffers enable hackers to steal proprietary information from anywhere on a network, including e – mail messages, company files and confidential reports.
The threat of sniffing is that confidential or personal information will be made public

51. Sniffing or Sniffing the network
There are points in the network where this attack is more practical than others.
If the attacker sits in the middle of the network, then within the scope of the Internet, this attack becomes impractical.
A request from the client to the server computer is broken up into small pieces known as packets as it leaves the client's computer and is reconstructed at the server.
The packets of a request is sent through different routes. The attacker cannot access all the packets of a request and cannot decipher what message was sent.

52. Sniffing or Sniffing the network
Example: Attacker Sits In The Middle Of The Network (sniffer can’t capture all packets)
Take the example of a shopper in Toronto purchasing goods from a store in Los Angeles. Some packets for a request are routed through New York, where others are routed through Chicago.

53. Sniffing or Sniffing the network
A more practical location for this attack is near the shopper's computer or the server.
Wireless hubs make attacks on the shopper's computer network the better choice because most wireless hubs are shipped with security features disabled.
This allows an attacker to easily scan unencrypted traffic from the user's computer.

54. E – mail wiretaps
E – mail wiretaps are a variation on the sniffing threat. An e – mail wiretap is hidden code in an e- mail message that allows someone to monitor all succeeding messages forwarded with the original message. E – mail wiretaps can be installed on servers and client computers.
For instance, USA PATRIOT Act permits the FBI to compel ISPs to install a black box (wire tap program) on their mail servers.

55. Insider jobs or Insider Attacks
Single largest financial threat
We tend to think of security threats to a business as originating outside the organization. In fact, the largest financial threats to business institutions come not from robberies but from by insiders.
Bank employees steal far more money than bank robbers.
The same is true for e – commerce sites.

56. Insider jobs or Insider Attacks
Some of the largest disruptions to service, destruction to service, destruction to sites, and diversion of customer credit data and personal information have come from insiders once trusted employees.
A Michigan State University study found that as much as 70% of all identity theft, including credit card theft, is the work of “insiders”.

57. Insider jobs or Insider Attacks
Insiders Expose the data that can then be exploited by others.
In September 2007, Citigroup confirmed that it was investigating a data breach that involves the names, social security numbers, and credit card information of over 5,000 customers by an employee of its ABN Amro Mortgage Group unit onto the LimeWire P2P file – sharing network.

58. Poorly designed server and client software
Many security threats prey on poorly designed server and client software, sometimes in the operating system and sometimes in the application software, including browsers.
The very design of the personal computer includes many open communication ports that can be used, and indeed are designed to be used, by external computers to send and receive messages. The port typically attacked is TCP port 445.

59. Poorly designed server and client software
May client computer didn’t install antivirus program or didn’t enable firewall.
May be many unwanted programs are in browsers.
He have old browser while Inprivate Browsing versions available (such as in firefox, IE)
B2C have not proper file permission on server.
Database base is nor password protected.
For instance, in 2007, Symantec identified 39 vulnerabilities in IE, 34 FireFox browsers, 25 in Apple Safari, and 7 in Opera, Some of these vulnerabilities are critical.

60. Just Concept