Security
Issues
Who is at Risk
Everyone on the Internet should be aware of the many computer
security issues that can arise. More companies than ever are
dependent on computers, more of these machines are networked,
and more home PC's are on-line than ever before, all this
means a huge playground for those who would disrupt normal
computer usage.
Hardware is at risk where it is public access. Examples of
such situations include games console demo booths and public
Internet and e-mail access stands.
Software is a more worrying area, with almost limitless scope
for security being compromised. Tests commissioned by the
government in America at the Lawrence Livermore Labs and conducted
on a wide range of operating systems found them all to be
flawed in the security area. In many cases security seems
to be an afterthought and as a result trap doors are common.
The following example shows such an occurrence in the Microsoft
Corporation.
"A bug has surfaced in the Microsoft jet database engine,
allowing hackers to delete files and plant viruses when a
PC is connected to the Internet. Microsoft claimed it only
affected Office '97 and older applications. It was later discovered
that office 2000 was also affected, albeit in a different
way." - November 1999 Computer Shopper
Networks too are at risk from attack, with many valuable files
and a wealth of processor power proving to be just too attractive.
Whilst this makes unautherised access more attractive, autherised
users in powerful positions such as network managers and programmers
are more tempted that ever to abuse their exclusive knowledge.
Even the casual web surfer is now at risk in one form or another.
Attacks are being made on PDA systems and WAP phones.
Those in contact with the Internet and information systems
are waking up to a dazzling range of security issues.
What Are The Risks
Hacker Threat
In 1986 there were 100,000 hackers, it doesn't bear thinking
about what kind of figure that is in 2000.
Hackers are a serious threat to the security of any machine.
Well-organised groups with set agendas are commonplace and
can cause serious damage even to some of the giants of the
web as the following example shows:
"After details on how to gain access to any of the 50
million Hotmail e-mail accounts appeared on a hacker's web
site, it became possible to read, send and delete e-mail that
belonged to someone else ... Microsoft says the code might
have been leaked by Microsoft engineers who have a back door
into the Hotmail service." - November 1999 Computer Shopper
There are a few approaches to hacking a system, if it is a
more unusual system, unusual approaches work. For example
the discovery of this software loophole in the 80's:
"Hackers have found ways of getting more than their cash
limit each week. The ATM's (automatic Teller Machines) belonging
to one clearing bank could be 'cheated' in this way: you asked
for your maximum amount and then, when the transaction was
almost complete, the ATM asked you, 'Do You Want Another Transaction
Yes/No?' If you responded 'Yes' you could then ask for –
and get- your credit limit again, and again, and again."
-The New Hackers Handbook p 45-46
However, more usual systems today run the Microsoft OS –
Windows, or perhaps Linux/ BeOS and are attached to the Internet
via a phone line. Such systems can be hacked by dialing into
them. A 'War Dialer' is used to attempt to connect to a machine
by sequentially trying phone numbers through a PC's modem
and recording results. Once a system is found dialing up to
it presents a command prompt, from where hacking can commence.
Telnet, a console application that comes with Windows machines
can also be used to hack into machines on a large network
to allow fraudulent e-mail usage and other hacker activities.
When a user is on-line obtaining their IP address allows
a hacker to use specialist tools to get access to their
system. Examples include 'finger' and WHOIS. Finger is a
Telnet (or other console) method of getting information
about an ISP or other server. It is capable of providing
user names and log on times. You might type for example
finger john@aol.com and the system would return (version
dependent) information to you. WHOIS can be a stand-alone
program or web based, but is essentially a tool for collecting
information.
These methods of hacking give information about systems,
usually enough to begin to attempt access. The activities
that follow are meant to be innocent and hacking information
you might come across will urge you to behave in a considerate
manner from this point on. This however isn't always the
case, as countless cases have proved with such giants as
the BBC falling fowl of malicious hackers.
Web Site Issues
There are many web sites on the Internet, which are not
what they seem, and present a substantial security risk.
The worst of these involve your credit card. There are many
ways in which you can fool a user into giving their valuable
credit card details; all it takes is a little Java-Script
and an anonymous Hotmail Account. This example web page
shows such a scam.
In addition web sites are often the source of many of the
files that damage your PC or introduce the threat in the
first place. As is the case with the next few sections of
this text.
Virus Threat
There have been a great many well publicised cases of viruses
causing havoc in the computer world of late. There are also,
a great many types of viruses and ways you might come across
one. For example they might come to you via a 'Trojan Horse'
or ICQ as described later in the text.
More conventionally however, they come as misleadingly named
files, or as part of a larger seemingly useful program downloaded
from the Internet.
Many infections are the result of the use of portable media
such as floppy disks, CD-ROM, and ZIP disks. A user of a
home computer may, for example, unknowingly bring back a
virus from the Network they use at their office or University.
Or, in more sinister circumstances, a user of a network
may deliberately expose the system to a virus.
Viruses have somehow managed to manifest themselves in the
mind of the average user as some mysterious evil force,
perhaps because of their name. In actual fact, they are
nothing more than programs written with varying levels of
creativity. Much like other programs. It is not illegal
to write a virus even; in reality a virus is just a malicious
program and a very broad term.
A virus can work at both extremities and in all places along
the way. One virus for example was known to make one of
the keyboard keys beep every time you pressed a given key.
Annoying yes, terminal, not really. At the other end of
the scale a virus can destroy a hard disks contents, remove
or scramble files and cost a lot of money. A virus however,
cannot damage hardware however this is a common misconception.
A virus can be written in any programming language such
as Visual C++ or Visual Basic. They can even be written
as 'macros' for the Microsoft Office package. This involves
using the programs own macro programming language to spread
and infect files. Macro files do not affect your programs,
just your documents.
E-mail has become the dominant residence for virus activities
of late. Programs and scripts can be hidden or disguised
and attached to E-mail and distributed with ease. From there
they can easily infect unknowing users and cause major problems.
E-mail offers a unique advantage to those who would code
a virus, the ability for it to reproduce as easily as its'
biological counterpart. The 'Melissa' virus for example
used Outlook Express to send itself to the first 50 (yes
50) people in the address book and infect them as well.
It is frightening to think about how quickly this could
spread. This program will demonstrate this, follow the instructions
on the page – virus simulation.
ICQ
ICQ (I Seek You) is an instant message service. Messages
can be sent to any user on your contact list instantly,
files can be transferred, voice messages sent and so on.
It ought to be innocent enough, but there are ways that
this very common program can be twisted to more antisocial
purposes. As you will guess from the next section, the possibilities
for Trojan distribution are vast. Viruses may also be passed
on through ICQ. Specific tools that add on to ICQ are available
to make it into a security threat.
Bombing a user with countless messages they didn't ask for
is the most common source of such happenings, this can occur
because your ICQ will accept messages from anywhere, not
just from the sever. This is very dangerous. The same discrepancy
allows you to detect hidden IP's from other users even if
they chose to conceal it with the aid of a small crack,
which modifies the program. Your client must know the IP
in order to send the message as it is not sent through a
server. In an ideal situation, only the server would know
the IP.
This is just the tip of the problem however. Those users
with ICQ's home page have no idea how much trouble they
could land themselves in. This page is hosted on your computer;
the program allows you to see HTML files and so on in the
home page. With a little trickery however, you can get to
other directories like c:\windows and download what ever
you want by connecting to the site using Telnet.
ICQ can also be used to get your port # to go with the IP
and to crash other peoples ICQ in a stunning variety of
ways.
Fortunately in the ICQ community, messages are frequently
passed around informing people of these disruptive users,
so they usually end up on everybody's ignore list.
Trojan Horse
Trojan Horse programs are the security conscious users nightmare.
They make it easy to access, and more frighteningly, totally
control another users system. A user is infected when they
run a misleadingly named executable file. This file adds
the files needed to remote access the PC. Usually just a
server file. From here they are vulnerable. The server file
either acts as a way to upload a larger more powerful server,
or is effective in it's own right. The file works by attaching
to a port and operating like a FTP (file transfer protocol)
system. It receives commands and returns data through this
port.
When an infected PC connects to the web the perpetrator
is presented with a 'Victim on line' message on their client
leaving them free to cause whatever trouble they want, although
some systems require you to have the victims IP address.
Some systems like Back Orifice (pictured) allows a incredible
level of access, screen shots can be captured, mouse pointers
moved, messages popped up and files deleted.
Trojans however are used for various purposes, not just
for simply deleting files. They can for example be used
to record keystrokes on a machine by intercepting them from
the message queue that the specific operating system maintains.
Passwords and important or sensitive information can be
captured in this way and sent back to the user.
Conclusion
Of course I could never hope to cover all the potential
security threats that exist, but this just goes to show
that there are many areas and activities that deserve some
degree of concern. Despite the grim outlook presented so
far, there are actually more people who do not get attacked
on-line. Nevertheless, the next section moves forward to
take a look at some common methods with which you can protect
yourself.
Protection & Prevention
Firewalls And Proxies
A firewall is one of the major individual entities contributing
to a whole and complete security system. A proxy is often
called a firewall. They differ as follows – a firewall
refers to a Filter Firewall, this type of firewall will
check packets sent and received over the Internet. Packets
are the chunks of information that are sent across the internet,
the Transmission Control Protocol (TCP) breaks data down
into these chunks, and the Internet protocol (IP) sends
them to their destination. The reverse is true at the recipient
end. This is known as TCP/IP. The filter checks the packet
header, which tells it where the packet has come from and
where it is going. According to a set of rules that the
administrator defines, the packet is either allowed to continue
or is destroyed. These types of firewall are more common
and faster and come built into the Linux kernel, but it
is considered to be ineffective against hackers because
for the most part IP can be faked.
The type of Proxy that is used as a Firewall is called an
Application Proxy Server. It works by finding out the destination
application of the packet being checked. If the packet is
heading for an application that has been disallowed by the
administrator then it is not allowed to continue. If the
packet checks out, it is delivered 'personally' by the proxy.
So the Internet does not actually come into contact with
the system and because the Firewall deals with all the packets,
it can log where you have been and what you have done.
With your firewall system you can also disable dangerous
functions touched upon in the hacking section such as 'finger',
log web usage, block certain sites, block unrequeusted incoming
data, and disable net specific features such as FTP (file
transfer protocol).
Firewalls can be used in one of a few ways.
A dedicated Firewall machine can be set up through which
all Internet traffic must come. This is useful when you
have a network that uses a single connection to the Internet.
That way all network users must go through the firewall
to access the Internet and potentially harmful incoming
attacks must also use this route.
On a single machine you can simply set the firewall up there.
Anti-Virus Software
Virus detectors are very complex programs, and cannot be
covered in full here, but what follow is an over view.
Scanning is an important component of virus detection. A
scanner will have the ability to look for recognised sections
of code in programs and files by checking them against its
database. This database is updated via the Internet. The
scanning can also detect typical code fragments so that
it can have a chance of picking up those viruses, which
are unknown to it.
An advanced feature of scanners is the process of running
programs in an isolated section of memory; they can then
be tested for suspect activities. An example of this is
the 'quarantine' feature of Norton Anti-Virus.
Furthermore, virus checkers use a technique called 'Integrity
Checking'. This process involves recording the state of
vital files and then making a comparison at a later date
when the computer may have become infected. Intelligent
software can now differentiate between file corruption and
malicious virus based damage. This is regarded to be a very
effective means of virus detection.
The final major part of a good virus detection system is
monitoring of system processes, in this way, suspect actions
can be stopped as they happen. It has been known however,
for a virus to disable these features.
All that remains for anti virus-software is the removal
of the virus once it is detected. This isn't always as easy
as deleting a file since a virus, by definition, will attempt
to replicate itself and spread across the system. Norton
can repair infected files in many cases so deleting the
files is not an issue.
Conclusion
In order to be secure, the key lesson to be learned is that
it CAN happen to you, and that you must never rely on any
single method of protection. No one solution or safe guard
can ever be complete as with all things in life.
The Internet is full of possibility for all, and that includes
Hackers.
Bibliography
'The Hackers Hand Book', H.Cornwall, 1985
'Computer Trojan Horse', maniac/R a v e N, 1999
'Firewall Tutorial', Freemont Ave Software, 1995-1999
'Hacked Off', Computer Active, 2000
'Computer Security 2nd Edition', Leonard Fine, 1986
'Computer Shopper', Various Articles, --
'The Sunday Times' Robert Winnet, 2000
'GUIDE TO (mostly) HARMLESS HACKING', Unknown Author, 1998
'ICQ Security Tutorial', R a v e N, 2000
'Firewall And Proxy HOWTO', Unknown author, ??
'Firewalls torn Apart', Ankit Fadia, 1999
|
