Downloaded 151 times
Uploaded byDamian T. Gordon
Operating Systems: Computer Security
The document covers various aspects of cybersecurity, including operating system functionalities, types of attacks like denial-of-service (DoS) and distributed denial-of-service (DDoS), and different forms of malware such as viruses, worms, and trojans. It discusses specific incidents like the 'I Love You' worm and the Gh0st RAT trojan, along with the implications of the USA PATRIOT Act on surveillance and security. Additionally, it explores the evolution of wiretapping and cyber attacks against organizations, like those initiated by Bollywood against piracy.
More Related Content
Similar to Operating Systems: Computer Security
More from Damian T. Gordon
Operating Systems: Computer Security
- 1.
- 2.
- 3.
- 4. The operatingsystem uses a number of different ways to protect the system: ◦ Your credentials (e.g. username and password) ◦ Your authorisation (e.g. drwxr-x-r--) ◦ Your location (e.g. inside/outside the LAN) ◦ Your behaviour (e.g. deleting lots of files) ◦ The firewall
- 6. Denial-of-Service (DoS)Attack Wiretapping Viruses Worms Trojans
- 8. Makes the“victim” computer unavailable to its users. Typically used on computers that act as Web Servers.
- 9. Works bymaking the “victim” computer perform a task over and over again, thus preventing it from doing other jobs. For example, if the computer is supposed to take orders from customers, and the first step is for the “victim” computer to identify itself to the customer computer, a DoS attack might keep making the “victim” computer identify itself and therefore unable to do other work.
- 10. A DistributedDenial-of-Service (DDoS) is where the attack source is more than one, often thousands of, unique IP addresses. It is like to a group of people crowding the entry door to a shop, and not letting legitimate customers enter into the shop or business, disrupting normal operations.
- 11. How doesit work? There are a variety of approaches that can work, we’ll look at a HTTP POST DoS attack.
- 12. How doesit work? There are a variety of approaches that can work, we’ll look at a HTTP POST DoS attack. HTTP POST Attack
- 13. A legitimateHTTP POST header, which includes a 'Content-Length' field to specify the size of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely slow rate (e.g. 1 byte/110 seconds). HTTP POST Attack
- 14. Due tothe entire message being complete, the target server will attempt to obey the 'Content-Length' field in the header, and wait for the entire body of the message to be transmitted, which can take a very long time. HTTP POST Attack
- 15. The attackerestablishes hundreds or even thousands of such connections, until all resources for incoming connections on the server (the victim) are used up, hence making any further (including legitimate) connections impossible until all data has been sent. HTTP POST Attack
- 16. Bollywood versusAnonymous
- 17. Bollywood versusAnonymous Bollywood is the nickname for the Hindi language film industry, based in Mumbai, the capital of Maharashtra in India. Bollywood is also one of the largest centres of film production in the world, and is more formally referred to as Hindi cinema.
- 18. Bollywood versusAnonymous Anonymous are a loosely associated international network of activist and hacktivist groups. The group became known for a series of well- publicized publicity stunts and Denial-of-Service (DoS) attacks on government, religious, and corporate websites.
- 19. Bollywood versusAnonymous Anonymous are a loosely associated international network of activist and hacktivist groups. The group became known for a series of well- publicized publicity stunts and Denial-of-Service (DoS) attacks on government, religious, and corporate websites.
- 20. Bollywood versusAnonymous Bollywood was unhappy with the torrent sites:
- 21. Bollywood versusAnonymous In 2010, several Bollywood companies hired Aiplex Software to launch DDoS attacks on websites that did not respond to takedown notices.
- 22. Bollywood versusAnonymous Piracy activists then created Operation Payback in September 2010 in retaliation
- 24. Bollywood versusAnonymous The original plan was to attack Aiplex Software directly, but upon finding some hours before the planned DDoS that another individual had taken down the firm's website on their own, Operation Payback moved to launching attacks against the websites of copyright stringent organisations Motion Picture Association of America (MPAA) and International Federation of the Phonographic Industry, giving the two websites a combined total downtime of 30 hours.
- 25. Bollywood versusAnonymous In the following two days, Operation Payback attacked a multitude of sites affiliated with the MPAA, the Recording Industry Association of America (RIAA), and British Phonographic Industry. Law firms such as ACS:Law, Davenport Lyons and Dunlap, Grubb & Weaver (of the US Copyright Group) were also attacked.
- 27. Wiretapping hasbeen around since the 1890s, it’s simply a matter of gaining access to the transmission media and using a device to intercept the signals.
- 28. Wireless wiretappingworks in the exact same way, except that there is no need to have physical contact with the transmission media. This is why we should encrypt wireless transmissions.
- 30. There aretwo forms of wiretapping: ◦ Passive Wiretapping is where you are recording the data transmitted, but not interfering with it. ◦ Active Wiretapping is where you are recording the data and also modifying it before it is sent onto the receiver.
- 31. The USAPATRIOT Act Title II: Enhanced Surveillance Procedures USA Patriot Act
- 32. The USAPATRIOT Act Title II: Enhanced Surveillance Procedures Section 209 made it easier for authorities to gain access to voicemail as they no longer must apply for a wiretap order, and instead just apply for a normal search warrant. The FBI can secretly conduct a physical search or wiretap on U.S. citizens to obtain evidence of crime without proving probable cause, as the Fourth Amendment explicitly requires. USA Patriot Act
- 33. The USAPATRIOT Act On February 9, 2016, the FBI asked Apple Inc. to create a new version of the phone's iOS operating system that could be installed and run in the phone's random access memory to disable certain security features that Apple refers to as "GovtOS“, the FBI had recovered an Apple iPhone 5C owned by the San Bernardino County, California government, that had been issued to its employee, Syed Rizwan Farook, one of the shooters involved in the December 2015 San Bernardino attack. The attack killed 14 people and seriously injured 22. USA Patriot Act What it doesn’t cover
- 34. The USAPATRIOT Act Apple declined due to its policy to never undermine the security features of its products. The FBI responded by successfully applying to a United States magistrate judge, Sherri Pym, to issue a court order, mandating Apple to create and provide the requested software. The order was not a subpoena, but rather was issued under the All Writs Act of 1789. USA Patriot Act What it doesn’t cover
- 35. The USAPATRIOT Act On February 16, 2016, Apple chief executive officer Tim Cook released an online statement to Apple customers, explaining the company's motives for opposing the court order. He also stated that while they respect the FBI, the request they made threatens data security by establishing a precedent that the U.S. government could use to force any technology company to create software that could undermine the security of its products. USA Patriot Act What it doesn’t cover
- 36. The USAPATRIOT Act On March 28, 2016, the FBI said it had unlocked the iPhone with the third party's help, and an anonymous official said that the hack's applications were limited; the Department of Justice vacated the case. USA Patriot Act What it doesn’t cover
- 37. For moredetail: In September 2015, Apple released a white paper detailing the security measures in its iOS 9 operating system. The iPhone 5C model can be protected by a four- digit PIN code. After more than ten incorrect attempts to unlock the phone with the wrong PIN, the contents of the phone will erase the AES encryption key that protects its stored data. https://www.apple.com/business/docs/iOS_Secu rity_Guide.pdf USA Patriot Act What it doesn’t cover
- 39. A ComputerVirus is a program that alters the way a computer works without permission of the user. It is typically self-executing and self-replicating.
- 40. A Virusis typically written for a specific operating system, so a virus that works on Windows usually won’t work on Linux. Virus writers exploit vulnerabilities in a specific operating systems.
- 41. Most vulnerableoperating systems and applications in 2014
- 42. Boot SectorVirus File Infector Virus Macro Virus Multipartite Virus Polymorphic Virus
- 43. Boot SectorVirus: Infects the boot sector. There are two types of boot sector viruses: ◦ Master Boot Record (MBR): A MBR can contain code that locates and invokes its volume record. ◦ Volume Boot Record (VBR): A VBR can contain code that loads and invokes the operating system.
- 44. File InfectorVirus: Perhaps the most common type of virus, the file infector takes root in a host file. This type of virus may end up deleting the file that was originally infected, or it may rewrite it or replace it with something else. Usually infects .COM and .EXE files.
- 45. Macro Virus:This is a virus that can be hidden in data files, like Word documents and Spreadsheets. Disable macros on files that you don’t trust.
- 46. Multipartite Virus:A virus of this type may spread in multiple ways, and it may take different actions on an infected computer depending on variables, such as the operating system installed or the existence of certain files. Can infect boot sector and files.
- 47. Polymorphic Virus:A polymorphic Virus can mutate over time or after every contaminated file and changes the code that is used to deliver the payload.
- 48. The NatasVirus Natas Virus
- 49. The NatasVirus Natas is a memory-resident stealth virus which is highly polymorphic, that affects master boot records, boot sectors of diskettes, files .COM and also .exe programs. Natas Virus
- 50. The NatasVirus Natas (Satan spelled backwards) is a computer virus written by James Gentile, a then 18-year-old hacker from San Diego, California who went by the alias of "Little Loc" and later "Priest". The virus was made for a Mexican politician who wanted to win the Mexican elections by affecting all the Mexican Federal Electoral Institute (IFE) computers with a floppy disk. Natas Virus
- 51. The NatasVirus The virus first appeared in Mexico City in May 1992, spread by a consultant using infected floppy disks. The virus became widespread in Mexico and the southwest United States. The virus also made its way to the other side of the USA, infecting computers at the United States Secret Service knocking their network offline for approximately three days. Natas Virus
- 52. The NatasVirus When a file infected with Natas is executed, it becomes memory resident, taking up 5,664 bytes in memory and infects the master boot record and COMMAND.COM. The virus infects files when they are executed, opened or copied, appending its 4,746 bytes to .COM, .EXE and .OVL files. Natas Virus
- 54. A computerworm is program that replicates itself in order to spread to other computers (often using a computer network). Unlike a computer virus, it does not need to attach itself to an existing program
- 55. Worms usuallyslow down processor time, and take up memory space, they also typically take up network bandwidth. Some worms that have been created are designed only to spread, and do not attempt to change the systems they pass through. However, as the Morris worm and Mydoom showed, even these worms can cause major disruption by increasing network traffic.
- 56. Since thestart of computer networks there have been attempts to create useful worms, for example, the Nachi family of worms tried to download and install patches from Microsoft's website to fix vulnerabilities in the host system—by exploiting those same vulnerabilities.
- 57. In practice,although this may have made these systems more secure, it generated considerable network traffic, rebooted the machine in the course of patching it, and did its work without the consent of the computer's owner. Several worms, like XSS worms, have been written to research how worms spread. For example, the effects of changes in social activity or user behaviour.
- 58. The ILOVEYOUWorm “I love you” worm
- 59. The ILOVEYOUWorm ILOVEYOU, sometimes referred to as Love Letter, was a computer worm that attacked tens of millions of Windows personal computers on and after May 4th, 2000. it started spreading as an email message with the subject line "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.txt.vbs“ “I love you” worm
- 60. The ILOVEYOUWorm The worm did damage on the local machine, overwriting random types of files (including Office files, image files, and audio files; however after overwriting MP3 files the virus would hide the file), and sent a copy of itself to all addresses in the Windows Address Book used by Microsoft Outlook. “I love you” worm
- 61. The ILOVEYOUWorm The worm originated in the Philippines, thereafter across the world, moving first to Hong Kong, then to Europe, and finally the United States, as employees began their workday that Friday morning. The outbreak was later estimated to have caused US $5.5- 8.7 billion in damages worldwide, and estimated to cost the US $15 billion to remove the worm. “I love you” worm
- 63. A Trojanis a malicious program that misrepresents itself to appear useful, routine, or interesting in order to persuade a victim to install it.
- 64. Trojans aregenerally spread by some form of social engineering, for example where a user is duped into executing an e-mail attachment disguised to be unsuspicious, (e.g., a routine form to be filled in), or by downloading. Unlike computer viruses and worms, Trojans generally do not attempt to inject themselves into other files or otherwise propagate themselves.
- 65. Types ofthings Trojans do: ◦ Destructive Behaviour ◦ Use of Resources, or Identity ◦ Money, Theft, or Ransom ◦ Data Theft ◦ Spying, Surveillance, or Stalking
- 66. Destructive Behaviour ◦Crashing the computer or device. ◦ Modification or deletion of files. ◦ Data corruption. ◦ Formatting disks, destroying all contents. ◦ Spread malware across the network. ◦ Spy on user activities and access sensitive information.
- 67. Use ofResources, or Identity ◦ Use of the machine as part of a botnet (e.g. to perform automated spamming) ◦ Using computer resources for mining cryptocurrencies ◦ Using the infected computer as proxy for illegal activities and/or attacks on other computers. ◦ Infecting other connected devices on the network.
- 68. Money, Theft,or Ransom ◦ Electronic money theft ◦ Installing ransomware such as CryptoLocker
- 69. Data Theft ◦Data theft, including for industrial espionage ◦ User passwords or payment card information ◦ User personally identifiable information ◦ Trade secrets
- 70. Spying, Surveillance,or Stalking ◦ Keystroke logging ◦ Watching the user's screen ◦ Viewing the user's webcam ◦ Controlling the computer system remotely
- 71. The Gh0stRAT Trojan Gh0st RAT Trojan
- 72. The Gh0stRAT Trojan Gh0st RAT is a Trojan horse for the Windows platform that was used to hack into some of the most sensitive computer networks on Earth. It is a cyber spying computer program. The "Rat" part of the name refers to the software's ability to operate as a "Remote Administration Tool". Gh0st RAT Trojan
- 73. The Gh0stRAT Trojan It can: ◦ Take full control of the remote screen. ◦ Provide real time as well as offline keystroke logging. ◦ Provide live feed of webcam, and microphone. ◦ Download remote binaries on the infected remote host. ◦ Take control of remote shutdown and reboot of host. ◦ Disable infected computer remote keyboard input. ◦ Enter into shell of remote infected host with full control. ◦ Provide a list of all the active processes. Gh0st RAT Trojan
- 74. The Gh0stRAT Trojan Gh0st Rat was originally made by the C.Rufus Security Team in 2005. Just as with other well-featured “off-the-shelf” trojans like Poison Ivy, Hupigon and DarkComet it has been used by all sorts of people – from script kiddies to resourceful targeted attack actors. Gh0st RAT Trojan
- 75. The Gh0stRAT Trojan In less than two years (2007-2009) Gh0st Rat infiltrated at least 1,295 computers in 103 countries, including many belonging to embassies, foreign ministries and other government offices, as well as the Dalai Lama’s Tibetan exile centres in India, Brussels, London and New York. Gh0st RAT Trojan
- 77. An unintentionalattack is any breach of security that was not as a result of a planned intrusion. For example, if two processes are updating the same record and it results in an incomplete modification of the record, that is an unintentional attack.
- 78. The Year2000 problem (aka the Millennium bug, or the Y2K bug) was caused by programmers who reduced the four-digit year to two digits. This made the year 2000 indistinguishable from 1900.
- 79. Unintentional Denial-of-Service When Michael Jackson died in 2009, websites such as Google and Twitter slowed down or even crashed. Many sites' servers thought the requests were from a virus or spyware trying to cause a denial-of-service attack, warning users that their queries looked like "automated requests from a computer virus or spyware application".
- 81. System protectionis multifaceted, four protection methods include: ◦ Antivirus Software ◦ Firewalls ◦ Patch Management ◦ Authentication
- 82. Antivirus Softwareis used to protect systems from attack by malicious software.
- 83. The softwarecan be preventative, diagnostic, or a combination of both. As new viruses are identified security vendors and government agencies provide information and updates about them.
- 84. Antivirus softwareis usually capable of repairing files infected by a virus, but it generally cannot repair the damage done by worms, Trojans, and blended approaches. This is since viruses usually add code to an existing file, whereas worms, Trojans, and blended approaches usually fully replace files.
- 85. Examples ofAntivirus software include: ◦ Bitdefender Antivirus Plus ◦ Kaspersky Anti-Virus ◦ Webroot SecureAnywhere AntiVirus ◦ Emsisoft Anti-Malware ◦ F-Secure Anti-Virus 2015 ◦ Malwarebytes Anti-Exploit ◦ McAfee AntiVirus Plus ◦ Panda Antivirus Pro ◦ Trend Micro Antivirus+ Security ◦ VoodooSoft VoodooShield
- 86. A firewallis a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules.
- 87. Network firewallscan be software programs running on general purpose hardware, or hardware-based firewall computer appliances, that filter traffic between two or more networks. Firewall appliances may also offer other functionality to the internal network they protect such as acting as a DHCP or VPN server for that network.
- 88. Network firewallscan be software programs running on general purpose hardware, or hardware-based firewall computer appliances, that filter traffic between two or more networks. Firewall appliances may also offer other functionality to the internal network they protect such as acting as a DHCP or VPN server for that network.
- 89. Firewalls typically: ◦Log activities that access the internet ◦ Maintain access control based on the senders’ and receivers’ IP addresses ◦ Maintain access control based on the services being requested ◦ Hide the internal network from unauthorized users ◦ Verify that virus protection is installed and running ◦ Perform authentication based on the source of a request from the Internet
- 90. Firewalls usea combination of packet filtering and proxy servers. ◦ Packet Filtering means that the firewall reviews all of the header information of each packet coming into the computer and going out to make sure there is noting suspicious present. ◦ Proxy Servers sit in between the local computer and network, and intercept all requests to the local computer from the network, and verify them before passing them onto the local computer.
- 91. Examples ofFirewalls include: ◦ Bullguard ◦ ZoneAlarm ◦ McAfee ◦ Norton ◦ AVG Anti-virus ◦ Bitdefender ◦ Avira ◦ Kaspersky Lab
- 92. A patchis a piece of software that can be applied to an operating system (or any other software) to correct an issue with that software.
- 93. Most operatingsystems will have several patches after their initial release and usually update the version of the program when successfully installed. Software patches can be found through the software developer's website, or are automatically downloaded after each system restart.
- 94. A securitypatch is a change applied to an operating system to correct a discovered vulnerability. This corrective action will prevent successful exploitation and remove or mitigate a threat’s capability to exploit a specific vulnerability in that operating system.
- 95. Security patchesare the primary method of fixing security vulnerabilities in operating systems. Currently Microsoft releases its security patches once a month, and other operating systems and software projects have security teams dedicated to releasing the most reliable software patches as soon after a vulnerability announcement as possible.
- 96. Authentication isverification that an individual trying to access the system is authorised to do so.
- 97. Let’s considerpasswords, they should be: ◦ Easy to remember ◦ Hard to guess ◦ Changed often ◦ Never written down ◦ Never part of an automated login Passwords are stored on the system in an encrypted format, so when you type in your password, it is encrypted using the same algorithm, and the two encryptions are compared to verify.
- 98. Top 25US Passwords in 2015
- 99. The longerthe password, the better. ◦ A password of eight (8) letters, just using lowercase letters has 268 (208,827,064,576) possible combinations. ◦ A password of ten (10) letters, just using lowercase letters has 2610 (141,167,100,000,000) possible combinations. ◦ A password of eight (8) letters, using all letters and numbers has 958 (6,634,204,300,000,000) possible combinations. ◦ A password of ten (10) letters, using all letters and numbers has 9510 (59,873,694,000,000,000,000) possible combinations.
- 100. Where arethe passwords stored? ◦ On Windows: c:windowssystem32configSAM ◦ On Linux /etc/shadow ◦ On Unix and (some) Apple /etc/passwd
- 101. Salting Someoperating systems (not Windows) make the passwords even harder to guess by adding in a few extra random bits into the encrypted password. So even if two people have the same password, they will be stored differently.
- 102. Alternatives topasswords: ◦ CAPTCHAs ◦ reCAPTCHAs ◦ Smart Cards ◦ Biometrics
- 103. CAPTCHAs CAPTCHA("Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge-response test. The term was coined in 2003 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper, and John Langford. This form of CAPTCHA requires that the user type the letters of a distorted image, sometimes with the addition of an obscured sequence of letters or digits that appears on the screen
- 104. reCAPTCHAs ThereCAPTCHA service supplies subscribing websites with images of words that are hard to read for optical character recognition (OCR) software. The text is obscured with horizontal lines and warped.
- 105. Image reCAPTCHAs In 2014, reCAPTCHA implemented another system in which users are asked to select one or more images from a selection of nine images.
- 106. Smart Cards A smart card, chip card, or integrated circuit card (ICC) is any pocket-sized card that has embedded integrated circuits. Smart cards can be either contact or contactless smart card. Smart cards can provide personal identification, authentication, data storage, and application processing. Smart cards may provide strong security authentication for single sign-on (SSO) within large organizations.
- 107. Biometrics Biometricsauthentication (or realistic authentication) is used as a form of identification and access control. Examples include, but are not limited to fingerprint, palm veins, face recognition, DNA, palm print, hand geometry, iris recognition, retina and odour/scent. Behavioral characteristics are related to the pattern of behavior of a person, including but not limited to typing rhythm, gait, and voice.
- 108.
- 109.
- 110. The operatingsystem uses a number of different ways to protect the system: ◦ Your credentials (e.g. username and password) ◦ Your authorisation (e.g. drwxr-x-r--) ◦ Your location (e.g. inside/outside the LAN) ◦ Your behaviour (e.g. deleting lots of files) ◦ The firewall
- 111. Intentional Attacks ◦Denial-of-Service (DoS) Attack ◦ Wiretapping ◦ Viruses ◦ Worms ◦ Trojans Unintentional Attacks ◦ Parallel writes ◦ Unintentional Denial-of-Service (DoS)
- 112. System protectionis multifaceted, four protection methods include: ◦ Antivirus Software ◦ Firewalls ◦ Patch Management ◦ Authentication CAPTCHAs reCAPTCHAs Smart Cards Biometrics