A Very Quick Overview of Internet Security

Dr. Michael Ward, June 2003

What is the Internet?

In the simplest terms, the Internet is a world-wide collection of network devices (switches, routers, hubs,...) connected by physical media (fiber optics, copper cabling,....) that provide a means of communcation between hosts (personal computers, mainframes, supercomputers, telephone equipment,...).

Brief History of the Internet:

Ethernet

Ethernet is a means of network communication usually running over category 5(6) wiring or coaxial cabling. Ethernet allows for a variety of speeds during communcation, but the most common are 10 megabytes per second, 100 megabytes per second, and 1 gigabyte per second. The earliest form of Ethernet required each host to monitor the network to wait until the "line was clear." Later forms of Ethernet (switched Ethernet) allows multiple hosts to communicate at the same time.

TCP/IP

TCP (Transmission Control Protocol) and IP (Internet Protocol) are two separate communication protocols. IP provides the means of communication as each host on the Internet has an IP "address" which functions much like a zip code allowing data to be transmitted between those hosts. TCP controls how that data is packaged and sent. If IP provides the zip code and postal service, than TCP is the letter and envelope.

URL

Uniform Resource Locator. http://www.google.com is a URL.

Ports

Shortened form of TCP Port. While each host on the Internet has an IP address, each host can be "speaking" and "listening" on more than one port (similar to more than one P.O. Box at a single address). Web browsers communicate with web servers on TCP port 80 (usually). FTP uses port 21, etc.

Hackers, Crackers, and ScriptKiddies

Over the last dozen or so years, most of the mainstream media have labeled all persons engaged in overcoming computer security measures as hackers, no matter what the motivation of these persons. The term hacker historically refers to someone who benevolently tests a system's security and then details how it was done to the system's administrator so that corrective measures can be taken. Hackers are often refered to as the whitehats. Crackers are the evil hackers out to take over your PC, steal your money, and cause havok by writing viruses and trojans. They are the blackhats. Crackers often create write scripts, small programs that automatically exploit a system without the need for an expertise. Why? To cause more havok. ScriptKiddies are those persons who run these scripts, compromising computer systems without knowing exactly how they did it.

Why worry about Internet Security?

SQL/Slammer aka Sapphire:

"Although the worm caused roughly $1 billion in damage by some estimates, its most significant casualty may be the perception that companies can remain secure by keeping up with software patches and other protective updates. The truth of the matter, security experts say, is that companies need to begin treating such attacks as inevitable and focus on limiting their damage, rather than expending every effort trying to create an ironclad perimeter....The SQL Slammer worm, at 376 bytes of computer code, is much smaller than either Code Red's estimated 4KB (4,096 bytes) or Nimda's 60KB (61,440 bytes). Exploiting a hole that had been announced and patched by Microsoft six months earlier to the day, the worm inundated other computers on the Internet with a copy of itself. The worm's small size meant that it could send itself out in a single data package, or packet, that automatically infected the victim by loading Slammer into memory. That efficiency made Slammer the fastest-spreading worm to date, infecting 90 percent of all vulnerable servers in its first 10 minutes..."

http://news.com.com/2009-1001-983540.html

How did the SQL worm "infect" its victims?

There's an old computer saying, "Security, Convenience, or Speed. Pick any two." Windows is the most popular operating system in the world and it's designed to be easy to use, this makes it a popular target of crackers. Windows XP is the first "out of the box" secure version of Windows. Windows users must be vigilant in applying patches to their systems due to something called a buffer overflow. Microsoft defines a buffer overflow as, " A buffer overflow attack in which a malicious user exploits an unchecked buffer in a program and overwrites the program code with their own data. If the program code is overwritten with new executable code, the effect is to change the program's operation as dictated by the attacker. If overwritten with other data, the likely effect is to cause the program to crash."

Simple translation: If a cracker (or worm) can cause a buffer overflow, they can run programs of their choosing. With the SQL/Slammer worm, a well know buffer overflow existed in the SQL database program running on Windows and was exploited to infect the server. Once a server was infected, it would attempt to infect other servers. The code for SQL worm was about the same size as this paragraph.

The SQL worm was only a warning, as it only required a reboot to remove the worm and caused no physical damage (it didn't erase any files) to the server. It was small, fast, and incredibly efficient at spreading, really a masterpiece of coding.

Windows is not alone in its vulnerability to buffer overflows, MacOS X (and 9), FreeBSD, Linux, OpenBSD, AIX, Solaris, HPUX are also susceptible. Crackers need to be able to establish a connection to a system to effect it, firewalls effectively prevent this.

Malware

Malware is software specifically designed to disrupt or alter the behavior of a computer without the knowledge of its operator. Viruses(worms) (programs designed to infect and spread) and trojans (disguised programs) fall in this category.

Spyware and Adware

The number of companies producing software that secretly monitor surfing habits seems to be growing. Most of these spyware programs analyze a user's surfing habits, and then target commercial ads toward the user via browser "pop-up" windows or by redirecting the browser to another web page. Spyware itself is most often installed unknowingly by a user when it is "bundled" with another program, most often freeware. Spyware can also be installed by a single click when a user visits a cleverly crafted web page touting specialized freeware. The terms spyware and adware are often used interchangibly.

Spyware programs also often download and install other programs to "help" in their information gathering. The cumulative effect of spyware, other than the loss of privacy, is a slower and more problematic PC. Almost all spyware programs target the Windows operating system.

Peer 2 Peer Programs

Kazaa, Gnutella, LimeWire, eDonkey are all examples of PC to PC file sharing programs commonly in use today. For the most part, these programs are used for the trading of copyrighted materials such as music (mp3s) and movies. Aside from the legal issues, P2P software opens a user up a new variety of viruses.

Firewalls

Network and computer based firewalls are named from their firefighting counterparts. They are used to prevent access to a certain area, in this case your PC. Firewalls come in two flavors, hardware and software. Hardware firewalls are most often included in cable-modem or ADSL based routers. These routers allow one network connection to be shared amoung a household full of computers. Software firewalls are programs installed on a PC to protect it from outside attack. Software firewalls can also monitor "outgoing" connections and thereby detect most spyware/adware programs. Windows XP and MacOS X have basic built-in firewalls, but these programs are not activated by default. ALL COMPUTERS CONNECTED TO THE INTERNET VIA ADSL OR CABLE MODEM SHOULD HAVE SOME FORM OF FIREWALL!!! These computers are often left on, making them more "ripe" targets for attack by crackers than those PCs connected by modem. A very good free (for personal use) firewall for Windows is Zonealarm. http://www.zonealarm.com

Online Purchasing

The Internet, along with companies like Amazon, has made shopping easy and convenient for a variety of products. It has also made credit card fraud easier than ever. Here are some tips to help ensure safe online transactions.

Passwords

Often the weakest part of any on line system's security is the passwords of its users. People have a bad habit of using the same password for everything, and the password is usually the name of a relative or pet. These are easily guessed by the black hats. Passwords should be unique, and have a mixture of letters and numbers. For example, the password "wireless" could be changed to "w1r3l3$$" which would be much more difficult to guess and crack. Cracking a password refers to using a dictionary attack (program using dictionary words) to continiously guess until the correct password is found.

Social Engineering

Also known as "shuck and jive" if you're from Hazard county. This is where a black hat attempts to fool a victim into revealing sensitive computer information, most often passwords, through email or phone conversations.

So I've got a firewall, virus protection, and I'm being careful surfing, am I safe?

The short answer is no, but you're a lot safer than if you had none of those protections. A good firewall will stop ~99% of all hacking attempts (unless the user does something foolish, like opening an email attachments without scanning it for viruses.) Updated antivirus programs will keep your PC safe from infection. Protecting your PC is like protecting your house, you do the best you can but it is still possible for a determined attacker to get in. The only truly "hack proof" computer is the one that is not on.

Suggested Links

Tightening Windows Security

http://www.techspot.com/tweaks/windows_security/index.shtml

Understanding MacOS X Security

http://www.securemac.com/macosxsecurity.php

List of Exploits, Cracker tools, and how-to articles:

http://neworder.box.sk/

If I had to read one book on Hacking it would be:

Hackers Beware by Eric Cole. Available at amazon.com for ~$35