Cyberlaw is a term that encapsulates the legal issues related to use of communicative, transactional, and distributive aspects of networked information devices and technologies.
Malaysia has a vision towards a knowledge-based society and economy where ICT serves as a driver for restructuring of economy and employment.
Prerequisites include access to infrastructure and development of information, knowledge and applications.
Crime is hard to define
Crime is hard to define due to the slow but constant creating and changing laws, as well as many roles can a computer do in a crime.
Computer crime is hard to prosecute due to:
• Lack of understanding
• Lack of physical evidence
• Lack of recognition of assets
• Lack of political impact
• Complexity of case
• Juveniles
The organization who governs the cyberlaw is the Malaysian Communications and Multimedia Commission (Suruhanjaya Komunikasi dan Multimedia Malaysia).
Certification authorities that are licensed in Malaysia are Digicert and MSC Trustgate.
The Malaysian cyberlaws include:
Digital Signature Act 1997 – regulation of the public key infrastructure, PKI.
Copyright (Amendment) Act 1997 – protection of the expression of thoughts and ideas from unauthorized copying and/or alteration
Telemedicine Act 1997 – regulation of the practice of teleconsultations in the medical profession.
Computer Crimes Act 1997 - to ensure that misuse of computers is an offense.
Communications and Multimedia Act 1998 - defines the roles and responsibilities of those providing communication and multimedia services
It is difficult to accept the existence of the internet and electronic transactions.
There are three aspects that are related to trust, confidence and acceptability : -
Trust and confidence from protection of confidentiality and privacy given to personal data
Trust and confidence from security of electronic transactions
Acceptability of the internet from efforts to optimize positive use of internet and minimize negative impacts
Thursday, October 29, 2009
Lecture 9 : The Legal and Ethical Issues in Somputer Security
A law is a rule of conduct or action prescribed or formally recognized as binding or enforced by a controlling authority. Categories of law include
• Civil law
• Criminal law
• Tort law
• Private law
• Public law
Ethics is a set of moral principles or values or principles of conduct governing an individual or group.
The key difference between laws and ethics is that laws carry sanctions of a governing authority and ethics do not. Ethics in turn are based on cultural mores: the fixed moral attitudes or customs of a particular group.
Law Ethics
Formal, documented
Interpreted by courts
Established by legislature representing everyone
Applicable to everyone
Priority determined by courts if two laws conflict
Enforceable by police and courts
Described by unwritten principles
Interpreted by individuals
Presented by philosophers, religions, professional group
Personal choice
Priority determined by individual if two principles conflict
Different cultures may have different ethics. Ethical differences may include:
• The consideration of ethics in the use of computers
• Nationalities behavior conflicts with the ethics of another national group
There is an understanding towards software license infringement, but individuals felt that their use of software is not piracy, or the society permitted piracy in some way.
Lack of disincentives and punitive measures explains this unobliviousness of the intellectual property laws.
Unilateral studies condemned viruses, hacking and other illicit activities as an unacceptable behavior.
Low degree of tolerance for illicit system may be a function of the easy association between common crimes.
Individuals may have the possibility of misusing corporate resources.
Differences in computer ethics are not exclusively international, but are found among individuals within the same social circle.
IT personnels have the responsibilities of deterring unethical acts and to use policy, education, training, and technology to protect information systems.
Three general categories of unethical and illegal behavior are:
• Ignorance
• Accident
• Intent
The current best method for preventing an illegal/unethical activity is deterrence.
Copyrights are designed to protect the expression of ideas, which applies to creative and original work. Patent applies to the result of science, technology and engineering which protects new and useful device or process for carrying out an idea.
The owner of originality must keep trade secrets by any means. However, its protection can be simply broken through reverse engineering.
Open source software can be affected by copyright protection through:
• Controlling the right to copy the software
• Controlling the right to distribute the software
• Subject to fair use
• Ease of filing
• Sue if copy sold
• Ownership of copyright
Information is treated as an object which is considered:
• Not depletable
• Can be replicated
• Minimal margin cost
• Value is timely
• Often intangibly transferred
Legal issues related to information include:
• Information commerce
Problem – how to ensure software developer/publisher receives just compensation for software usage?
Solution – copy protection, freeware, controlled distribution.
• Electronic publishing
Problem – assurance that publisher receives fair compensation for work
Solution – cryptographic-based technical solutions
• Electronic commerce
Problem – how to prove conditions of delivery
Solution - Digital signatures and other cryptographic protocols
Rights of employees and employers include
• Ownership of a patent
• Ownership of a copyright
• Work for hire
• Licenses
• Trade secret protection
• Employment contracts
We should all know that computer crimes are hard to prosecute due to:
low computer literacy (lack of understanding)
no physical clues (lack of physical evidence)
intangible forms of assets
considered as juvenile crime
Lack of political impact
To examine ethical issues, we must
1. Understand the situation. Determine the issues involved.
2. Know several theories of ethical reasoning
3. List the ethical principles involved
4. Determine which principles outweigh others.
• Civil law
• Criminal law
• Tort law
• Private law
• Public law
Ethics is a set of moral principles or values or principles of conduct governing an individual or group.
The key difference between laws and ethics is that laws carry sanctions of a governing authority and ethics do not. Ethics in turn are based on cultural mores: the fixed moral attitudes or customs of a particular group.
Law Ethics
Formal, documented
Interpreted by courts
Established by legislature representing everyone
Applicable to everyone
Priority determined by courts if two laws conflict
Enforceable by police and courts
Described by unwritten principles
Interpreted by individuals
Presented by philosophers, religions, professional group
Personal choice
Priority determined by individual if two principles conflict
Different cultures may have different ethics. Ethical differences may include:
• The consideration of ethics in the use of computers
• Nationalities behavior conflicts with the ethics of another national group
There is an understanding towards software license infringement, but individuals felt that their use of software is not piracy, or the society permitted piracy in some way.
Lack of disincentives and punitive measures explains this unobliviousness of the intellectual property laws.
Unilateral studies condemned viruses, hacking and other illicit activities as an unacceptable behavior.
Low degree of tolerance for illicit system may be a function of the easy association between common crimes.
Individuals may have the possibility of misusing corporate resources.
Differences in computer ethics are not exclusively international, but are found among individuals within the same social circle.
IT personnels have the responsibilities of deterring unethical acts and to use policy, education, training, and technology to protect information systems.
Three general categories of unethical and illegal behavior are:
• Ignorance
• Accident
• Intent
The current best method for preventing an illegal/unethical activity is deterrence.
Copyrights are designed to protect the expression of ideas, which applies to creative and original work. Patent applies to the result of science, technology and engineering which protects new and useful device or process for carrying out an idea.
The owner of originality must keep trade secrets by any means. However, its protection can be simply broken through reverse engineering.
Open source software can be affected by copyright protection through:
• Controlling the right to copy the software
• Controlling the right to distribute the software
• Subject to fair use
• Ease of filing
• Sue if copy sold
• Ownership of copyright
Information is treated as an object which is considered:
• Not depletable
• Can be replicated
• Minimal margin cost
• Value is timely
• Often intangibly transferred
Legal issues related to information include:
• Information commerce
Problem – how to ensure software developer/publisher receives just compensation for software usage?
Solution – copy protection, freeware, controlled distribution.
• Electronic publishing
Problem – assurance that publisher receives fair compensation for work
Solution – cryptographic-based technical solutions
• Electronic commerce
Problem – how to prove conditions of delivery
Solution - Digital signatures and other cryptographic protocols
Rights of employees and employers include
• Ownership of a patent
• Ownership of a copyright
• Work for hire
• Licenses
• Trade secret protection
• Employment contracts
We should all know that computer crimes are hard to prosecute due to:
low computer literacy (lack of understanding)
no physical clues (lack of physical evidence)
intangible forms of assets
considered as juvenile crime
Lack of political impact
To examine ethical issues, we must
1. Understand the situation. Determine the issues involved.
2. Know several theories of ethical reasoning
3. List the ethical principles involved
4. Determine which principles outweigh others.
Lab 8 : Wireless Security
In this lab session, we were introduced to the methods of hacking wireless networks. The weakest of the encrypted wireless networks is the Wireless Equivalence Privacy (WEP).
Wired Equivalent Privacy (WEP) is a deprecated algorithm to secure IEEE 802.11 wireless networks. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks. When introduced in 1997,[1] WEP was intended to provide confidentiality comparable to that of a traditional wired network.
In this lab session, we have used a Backtrack version 2 to crack a router's passphrase which is set up with a 64-bit encryption. For my own, I've used a Backtrack version 3 because previously I was exploring on how to hack WEP networks myself.
For the information of you readers out there, Backtrack is a Linux distribution designed to do penetration tests.
Tools included that are necessary for our lab session are:
Kismet - a wireless network detector and packet sniffer
airmon - a tool that can help you set your wireless adapter into monitor mode(rfmon)
airodump - a tool for capturing packets from a wireless router(otherwise known asan AP)
aireplay - a tool for forging ARP requests
aircrack - a tool for decrypting WEP keys
iwconfig - a tool for configuring wireless adapters. You can use this to ensure that your wireless adapter is in "monitor" mode which is essential to sending fake ARP requests to the target router
macchanger - a tool to view and/or spoof MAC address
We firstly used Kismet to monirot wirelss traffic.
Data is collected with Airodump to collect ARP replies from the target AP.
The third step is to associate the wireless card with the AP by using aireplay.
The fourth step is to start injecting packets with aireplay.
Lastly, we decrypt the WEP key using Aircrack.
Wired Equivalent Privacy (WEP) is a deprecated algorithm to secure IEEE 802.11 wireless networks. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks. When introduced in 1997,[1] WEP was intended to provide confidentiality comparable to that of a traditional wired network.
In this lab session, we have used a Backtrack version 2 to crack a router's passphrase which is set up with a 64-bit encryption. For my own, I've used a Backtrack version 3 because previously I was exploring on how to hack WEP networks myself.
For the information of you readers out there, Backtrack is a Linux distribution designed to do penetration tests.
Tools included that are necessary for our lab session are:
Kismet - a wireless network detector and packet sniffer
airmon - a tool that can help you set your wireless adapter into monitor mode(rfmon)
airodump - a tool for capturing packets from a wireless router(otherwise known asan AP)
aireplay - a tool for forging ARP requests
aircrack - a tool for decrypting WEP keys
iwconfig - a tool for configuring wireless adapters. You can use this to ensure that your wireless adapter is in "monitor" mode which is essential to sending fake ARP requests to the target router
macchanger - a tool to view and/or spoof MAC address
We firstly used Kismet to monirot wirelss traffic.
Data is collected with Airodump to collect ARP replies from the target AP.
The third step is to associate the wireless card with the AP by using aireplay.
The fourth step is to start injecting packets with aireplay.
Lastly, we decrypt the WEP key using Aircrack.
Lecture 8 : Wireless Security
Wireless Security is covered in this lecture session. The components of 802.11 or also known as Wi-Fi are wireless station and access point. The Wi-Fi focuses on Layer 1 and 2 in the OSI model. It has two modes namely infrastructure and ad-hoc mode.
RTS/CTS (Request to Send / Clear to Send) is the optional mechanism used by the 802.11 wireless networking protocol to reduce frame collisions introduced by the hidden terminal problem. Originally the protocol fixed the exposed terminal problem as well, but modern RTS/CTS include ACKs and do not solve the exposed terminal problem.
In Wi-Fi we have three kinds namely 802.11a, 802.11b and 802.11g.
When a Wi-Fi client enters range of one or more APs, APs does the following:
• Send beacons
• Beacon includes SSID
• AP chosen on signal strength and observed error rates
• Accepts client – client tunes to AP channel
Wi-Fi client checks for stronger and more reliable APs and re-associate with the new AP.
Re-associations with APs are done when moving out of range, high error rates, and high network traffic.
AP has 14 channels and only three channels don’t overlap.
Open System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are not encrypted.
Access points have Access Control Lists (ACL), a list of allowed MAC addresses. However, they are sniffable and spoofable.
As we all know that wireless LAN uses radio signal. This signal is usually weakened by walls, floors and other radio interferences. The way to solve this problem is by using a directional antenna since it allows interception over longer distances and provides focused reception.
Three basic services provided for the Wi-Fi environment are authentication, integrity and confidentiality.
Security services provided by the 802.11b are shared key authentication and Wired Equivalence Privacy (WEP encryption).
Wired Equivalent Privacy (WEP) is a deprecated algorithm to secure IEEE 802.11 wireless networks. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks.
RC4 (also known as ARC4 or ARCFOUR meaning Alleged RC4, see below) is the most widely-used software stream cipher and is used in popular protocols such as Secure Sockets Layer (SSL) (to protect Internet traffic) and WEP (to secure wireless networks).
In two devices that use Shared Key Encryption, the steps that occur are as follows:
1. The station sends an authentication request to the access point.
2. The access point sends challenge text to the station.
3. The station uses its configured 64-bit or 128-bit default key to encrypt the challenge text, and it sends the encrypted text to the access point.
4. The access point decrypts the encrypted text using its configured WEP key that corresponds to the station's default key. The access point compares the decrypted text with the original challenge text. If the decrypted text matches the original challenge text, then the access point and the station share the same WEP key, and the access point authenticates the station.
5. The station connects to the network.
In WEP safeguards, shared secret key is required for association with access point, sending and receiving data. Messages are encrypted for confidentiality and possess checksum for integrity. But the management traffic still broadcasts SSID.
An initialization vector (IV) is a block of bits that is required to allow a stream cipher or a block cipher to be executed in any of several streaming modes of operation to produce a unique stream independent from other streams produced by the same encryption key, without having to go through a (usually lengthy) re-keying process.
To commit a passive WEP attack, the attacker collects all traffic. By this, he/she could collect two messages:
• Encrypted with same key and IV
• Statistical attacks to reveal plaintext
• Plaintext XOR Ciphertext = Keystream
For active WEP attack, if the attacker knows plaintext and ciphertext pair, the keystream is known, the attacker can create correctly encrypted messages and the AP is deceived into accepting the message.
A bit-flipping attack is an attack on a cryptographic cipher in which the attacker can change the ciphertext in such a way as to result in a predictable change of the plaintext, although the attacker is not able to learn the plaintext itself.
Some vendors allow limited WEP keys from the passphrase created by users into only 21 bits of entropy in 40bit key. But this key is weaker and easier to be cracked.
A brute force attack is a strategy used to break the encryption of data. It involves traversing the search space of possible keys until the correct key is found. With this, ciphertext is captured with IV and 240 possible secret keys are searched. Lastly ciphertext is decrypted.
WEP has extended to 128 bits, which means 104 bit secret key and 24 bit IV is available. So, this makes It harder to decrypt.
Weakness of WEP:
• The initialization vector is too small (16 million IV values).
• The integrity check value (ICV) algorithm is not appropriate.
• WEP’s use of RC4 is weak.
• Authentication messages can be easily forged.
WEP cracking tools include:
• WEPCRACK – first tool to demonstrate attack using IV weakness
• AIRSNORT – Automated tool that sniffs, searches for weaker IVs, records encrypted data until key is derived.
Ways to generate WEP traffic include:
• Capture encrypted ARP request packets
• Anecdotally lengths of 68, 118 and 368 bytes appear appropriate
• Replay encrypted ARP packets to generate encrypted ARP replies.
The above ways are implemented into Aireplay.
For this entire lesson, we know that wireless LAN is not reliable and cannot be trusted. We still need firewall between WLAN and Backbone, extra authentication, IDS at WLAN/Backbone junction, and assessments on vulnerabilities in WLAN.
It is pretty easy to search for unauthorized APs, ad-doc networks and clients. We can easily do port-scanning for unknown SNMP agents and web/telnet interfaces, plus war-walking where you can walk around with your laptop and sniff data packets, identify IP addresses and detect signal strength.
There are also wireless intrusion detection tools to counter this above attacks, such as Airmagnet, AirDefense, Trapeze, Aruba, etc.
AP’s security should be reviewed. Firewalls and router ACLs should be utilized and limit the usage of AP administration interfaces. Configuration of APs should be done at SSID, WEP keys, and community string and password policy.
Station protection includes personal firewalls, VPN from station into Intranet, host intrusion detection, configuration scanning.
Locations of APs should be set at the center of buildings. Radio signal should be pointed using a directional antenna.
Temporal Key Integrity Protocol (TKIP) implements a key mixing function that combines the secret root key with the initialization vector before passing it to the RC4 initialization.
Wi-Fi Protected Access (WPA and WPA2) is a certification program created by the Wi-Fi Alliance to indicate compliance with the security protocol created by the Wi-Fi Alliance to secure wireless computer networks. This protocol was created in response to several serious weaknesses researchers had found in the previous system, WEP (Wired Equivalent Privacy).
WPA has two modes being the:
• pre-shared mode which uses pre-shared keys
• Enterprise mode which uses the Extensible Authentication Protocol (EAP), the transport for authentication.
Practical WPA attacks include:
• Dictionary attack on pre-shared key mode
• Denial of Service (DoS) attack
RTS/CTS (Request to Send / Clear to Send) is the optional mechanism used by the 802.11 wireless networking protocol to reduce frame collisions introduced by the hidden terminal problem. Originally the protocol fixed the exposed terminal problem as well, but modern RTS/CTS include ACKs and do not solve the exposed terminal problem.
In Wi-Fi we have three kinds namely 802.11a, 802.11b and 802.11g.
When a Wi-Fi client enters range of one or more APs, APs does the following:
• Send beacons
• Beacon includes SSID
• AP chosen on signal strength and observed error rates
• Accepts client – client tunes to AP channel
Wi-Fi client checks for stronger and more reliable APs and re-associate with the new AP.
Re-associations with APs are done when moving out of range, high error rates, and high network traffic.
AP has 14 channels and only three channels don’t overlap.
Open System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are not encrypted.
Access points have Access Control Lists (ACL), a list of allowed MAC addresses. However, they are sniffable and spoofable.
As we all know that wireless LAN uses radio signal. This signal is usually weakened by walls, floors and other radio interferences. The way to solve this problem is by using a directional antenna since it allows interception over longer distances and provides focused reception.
Three basic services provided for the Wi-Fi environment are authentication, integrity and confidentiality.
Security services provided by the 802.11b are shared key authentication and Wired Equivalence Privacy (WEP encryption).
Wired Equivalent Privacy (WEP) is a deprecated algorithm to secure IEEE 802.11 wireless networks. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks.
RC4 (also known as ARC4 or ARCFOUR meaning Alleged RC4, see below) is the most widely-used software stream cipher and is used in popular protocols such as Secure Sockets Layer (SSL) (to protect Internet traffic) and WEP (to secure wireless networks).
In two devices that use Shared Key Encryption, the steps that occur are as follows:
1. The station sends an authentication request to the access point.
2. The access point sends challenge text to the station.
3. The station uses its configured 64-bit or 128-bit default key to encrypt the challenge text, and it sends the encrypted text to the access point.
4. The access point decrypts the encrypted text using its configured WEP key that corresponds to the station's default key. The access point compares the decrypted text with the original challenge text. If the decrypted text matches the original challenge text, then the access point and the station share the same WEP key, and the access point authenticates the station.
5. The station connects to the network.
In WEP safeguards, shared secret key is required for association with access point, sending and receiving data. Messages are encrypted for confidentiality and possess checksum for integrity. But the management traffic still broadcasts SSID.
An initialization vector (IV) is a block of bits that is required to allow a stream cipher or a block cipher to be executed in any of several streaming modes of operation to produce a unique stream independent from other streams produced by the same encryption key, without having to go through a (usually lengthy) re-keying process.
To commit a passive WEP attack, the attacker collects all traffic. By this, he/she could collect two messages:
• Encrypted with same key and IV
• Statistical attacks to reveal plaintext
• Plaintext XOR Ciphertext = Keystream
For active WEP attack, if the attacker knows plaintext and ciphertext pair, the keystream is known, the attacker can create correctly encrypted messages and the AP is deceived into accepting the message.
A bit-flipping attack is an attack on a cryptographic cipher in which the attacker can change the ciphertext in such a way as to result in a predictable change of the plaintext, although the attacker is not able to learn the plaintext itself.
Some vendors allow limited WEP keys from the passphrase created by users into only 21 bits of entropy in 40bit key. But this key is weaker and easier to be cracked.
A brute force attack is a strategy used to break the encryption of data. It involves traversing the search space of possible keys until the correct key is found. With this, ciphertext is captured with IV and 240 possible secret keys are searched. Lastly ciphertext is decrypted.
WEP has extended to 128 bits, which means 104 bit secret key and 24 bit IV is available. So, this makes It harder to decrypt.
Weakness of WEP:
• The initialization vector is too small (16 million IV values).
• The integrity check value (ICV) algorithm is not appropriate.
• WEP’s use of RC4 is weak.
• Authentication messages can be easily forged.
WEP cracking tools include:
• WEPCRACK – first tool to demonstrate attack using IV weakness
• AIRSNORT – Automated tool that sniffs, searches for weaker IVs, records encrypted data until key is derived.
Ways to generate WEP traffic include:
• Capture encrypted ARP request packets
• Anecdotally lengths of 68, 118 and 368 bytes appear appropriate
• Replay encrypted ARP packets to generate encrypted ARP replies.
The above ways are implemented into Aireplay.
For this entire lesson, we know that wireless LAN is not reliable and cannot be trusted. We still need firewall between WLAN and Backbone, extra authentication, IDS at WLAN/Backbone junction, and assessments on vulnerabilities in WLAN.
It is pretty easy to search for unauthorized APs, ad-doc networks and clients. We can easily do port-scanning for unknown SNMP agents and web/telnet interfaces, plus war-walking where you can walk around with your laptop and sniff data packets, identify IP addresses and detect signal strength.
There are also wireless intrusion detection tools to counter this above attacks, such as Airmagnet, AirDefense, Trapeze, Aruba, etc.
AP’s security should be reviewed. Firewalls and router ACLs should be utilized and limit the usage of AP administration interfaces. Configuration of APs should be done at SSID, WEP keys, and community string and password policy.
Station protection includes personal firewalls, VPN from station into Intranet, host intrusion detection, configuration scanning.
Locations of APs should be set at the center of buildings. Radio signal should be pointed using a directional antenna.
Temporal Key Integrity Protocol (TKIP) implements a key mixing function that combines the secret root key with the initialization vector before passing it to the RC4 initialization.
Wi-Fi Protected Access (WPA and WPA2) is a certification program created by the Wi-Fi Alliance to indicate compliance with the security protocol created by the Wi-Fi Alliance to secure wireless computer networks. This protocol was created in response to several serious weaknesses researchers had found in the previous system, WEP (Wired Equivalent Privacy).
WPA has two modes being the:
• pre-shared mode which uses pre-shared keys
• Enterprise mode which uses the Extensible Authentication Protocol (EAP), the transport for authentication.
Practical WPA attacks include:
• Dictionary attack on pre-shared key mode
• Denial of Service (DoS) attack
Lab 7 : Security in Network
In this lab, we are taught on how to
• Identify the vulnerabilities of FTP.
• Using Wireshark to capture FTP username and password.
• Explain what is IPSec.
• Enabling IPSec for securing FTP session
Short for IP Security, a set of protocols developed by the IETF to support secure exchange of packets at the IPlayer. IPsec has been deployed widely to implement Virtual Private Networks (VPNs).
IPsec protocol suites contain various protocols for performing functions:
• Internet key exchange (IKE and IKEv2)
• Authentication Header (AH)
• Encapsulating Security Payload (ESP)
We are also demo’ed on how to capture FTP username and password using Wireshark. In this demonstration we need 2 Windows 2003 VMs with one of them installing Wireshark and FTP, as well as an administrator account. One VM will act as a server and one acting as client.
To learn more on how to sniff passwords on FTP using Wireshark, please visit
http://www.securitytube.net/Password-Sniffing-with-Wireshark-(Laura-Chappell)-video.aspx
To ensure security in FTP transactions, IPsec is used. IPSec will encrypt the data sent using normal FTP connection, thus only the authorized party can see the content. There are actually a lot of ways of using IPsec. One of it is using a built-in IPsec setting in Windows 2003. Basically authentication methods and security policies can be set. Besides that, a secure server can also be set.
For more information on how to implement IPsec in Windows 2003, please visit
http://www.enterprisenetworkingplanet.com/netsecur/article.php/3489911
• Identify the vulnerabilities of FTP.
• Using Wireshark to capture FTP username and password.
• Explain what is IPSec.
• Enabling IPSec for securing FTP session
Short for IP Security, a set of protocols developed by the IETF to support secure exchange of packets at the IPlayer. IPsec has been deployed widely to implement Virtual Private Networks (VPNs).
IPsec protocol suites contain various protocols for performing functions:
• Internet key exchange (IKE and IKEv2)
• Authentication Header (AH)
• Encapsulating Security Payload (ESP)
We are also demo’ed on how to capture FTP username and password using Wireshark. In this demonstration we need 2 Windows 2003 VMs with one of them installing Wireshark and FTP, as well as an administrator account. One VM will act as a server and one acting as client.
To learn more on how to sniff passwords on FTP using Wireshark, please visit
http://www.securitytube.net/Password-Sniffing-with-Wireshark-(Laura-Chappell)-video.aspx
To ensure security in FTP transactions, IPsec is used. IPSec will encrypt the data sent using normal FTP connection, thus only the authorized party can see the content. There are actually a lot of ways of using IPsec. One of it is using a built-in IPsec setting in Windows 2003. Basically authentication methods and security policies can be set. Besides that, a secure server can also be set.
For more information on how to implement IPsec in Windows 2003, please visit
http://www.enterprisenetworkingplanet.com/netsecur/article.php/3489911
Lecture 7 Security in Applications
In this lesson, we are taught about application security.
We covered on email security. Normally the security features provided in email is as follows:
• Confidentiality
• Data origin authentication
• Message integrity
• Non-repudiation of messages
• Key management
Multipurpose Internet Mail Extensions (MIME) is an Internet standard that extends the format of e-mail to support:
Text in character sets other than ASCII
Non-text attachments
Message bodies with multiple parts
Header information in non-ASCII character sets
Threats enabled by email are as follows:
• Disclosure of sensitive information
• Exposure of systems to malicious code
• Exposure of systems to denial of service attack
• Spamming
S/MIME (Secure / Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of e-mail encapsulated in MIME. S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption).
Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications.
Web security includes:
• Security of server
• Security of client
• Network security between a browser and server.
SSL/TLS is used in web browsers and servers to support ‘secure e-commerce’ over HTTP. SSL architecture provides two layers which are SSL Record Protocol and Upper Layer Carrying.
Secure Shell or SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices. SSH provides security at the application layer.
SSH applications include:
• WRQ SSH supports SSH protocol 2 and sftp file transfers.
• SecureCRT from Van Dyke Technologies, Inc. supports the sftp protocol via its vcp command.
• SSH Communications Security offers a free client for non-commercial use.
SET is an open encryption and security specification designed to protect credit card transactions on the internet.
Drawbacks of SET are:
• Two pairs of public keys per entity
• Assumes full PKI is available
• Merchant does not see payment instrument used
As we all know how the Internet works, I will not explain on that. The thing that we should concern about is how to secure the web. The web can be secured with these methods:
• Authentication
• Access control via address
• Multilayer security
What most interests me about application security is biometrics. Biometrics refers to methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits. In information technology, in particular, biometrics is used as a form of identity access management and access control. It is also used to identify individuals in groups that are under surveillance.
Verification is a one-to-one comparison which confirms a claimed identity while identification is a one-to-many comparison which establishes the identity of a subject from a set of enrolled persons.
Biometric characteristics can be divided in two main classes:
Physiological are related to the shape of the body. Examples include, but are not limited to fingerprint, face recognition, DNA, hand and palm geometry, iris recognition, which has largely replaced retina, and odor/scent.
Behavioral are related to the behavior of a person. Examples include, but are not limited to typing rhythm, gait, and voice. Some researchers have coined the term behaviometrics for this class of biometrics.
Static biometric methods:
Fingerprint recognition
Retinal scan
Iris scan
Hand geometry
Dynamic biometric methods:
Signature recognition
Speaker recognition
Keystroke dynamics
We covered on email security. Normally the security features provided in email is as follows:
• Confidentiality
• Data origin authentication
• Message integrity
• Non-repudiation of messages
• Key management
Multipurpose Internet Mail Extensions (MIME) is an Internet standard that extends the format of e-mail to support:
Text in character sets other than ASCII
Non-text attachments
Message bodies with multiple parts
Header information in non-ASCII character sets
Threats enabled by email are as follows:
• Disclosure of sensitive information
• Exposure of systems to malicious code
• Exposure of systems to denial of service attack
• Spamming
S/MIME (Secure / Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of e-mail encapsulated in MIME. S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption).
Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications.
Web security includes:
• Security of server
• Security of client
• Network security between a browser and server.
SSL/TLS is used in web browsers and servers to support ‘secure e-commerce’ over HTTP. SSL architecture provides two layers which are SSL Record Protocol and Upper Layer Carrying.
Secure Shell or SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices. SSH provides security at the application layer.
SSH applications include:
• WRQ SSH supports SSH protocol 2 and sftp file transfers.
• SecureCRT from Van Dyke Technologies, Inc. supports the sftp protocol via its vcp command.
• SSH Communications Security offers a free client for non-commercial use.
SET is an open encryption and security specification designed to protect credit card transactions on the internet.
Drawbacks of SET are:
• Two pairs of public keys per entity
• Assumes full PKI is available
• Merchant does not see payment instrument used
As we all know how the Internet works, I will not explain on that. The thing that we should concern about is how to secure the web. The web can be secured with these methods:
• Authentication
• Access control via address
• Multilayer security
What most interests me about application security is biometrics. Biometrics refers to methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits. In information technology, in particular, biometrics is used as a form of identity access management and access control. It is also used to identify individuals in groups that are under surveillance.
Verification is a one-to-one comparison which confirms a claimed identity while identification is a one-to-many comparison which establishes the identity of a subject from a set of enrolled persons.
Biometric characteristics can be divided in two main classes:
Physiological are related to the shape of the body. Examples include, but are not limited to fingerprint, face recognition, DNA, hand and palm geometry, iris recognition, which has largely replaced retina, and odor/scent.
Behavioral are related to the behavior of a person. Examples include, but are not limited to typing rhythm, gait, and voice. Some researchers have coined the term behaviometrics for this class of biometrics.
Static biometric methods:
Fingerprint recognition
Retinal scan
Iris scan
Hand geometry
Dynamic biometric methods:
Signature recognition
Speaker recognition
Keystroke dynamics
Lab 6 : Database Security
This lab session covered the issues of database security. We should:
• Understand the importance of security issues specifically in database systems and the problem related to information protection
• Investigate the potential implementation of security mechanism in the database management system and operating system
We were exposed about the security issues that are specific to database systems, the problem of protecting information in statistical database and examine the potential interactions between security mechanism in the database management system and underlying operating system.
• Understand the importance of security issues specifically in database systems and the problem related to information protection
• Investigate the potential implementation of security mechanism in the database management system and operating system
We were exposed about the security issues that are specific to database systems, the problem of protecting information in statistical database and examine the potential interactions between security mechanism in the database management system and underlying operating system.
Lecture 6 : Security in Networks
In this lecture, we are introduced on what is meant by a computer network, personnel who causes security problems, network security issues and its controls.
Basically a network is a computing environment with more than one independent processor. Network resources include computers, OS, programs, processes and people.
Below is the illustration on the network architecture.
A network enables us the send and receive messages, executing programs, obtaining status information on local and other network users.
The types of network is shown below:
The basic network topologies that we are all already familiar with are star, mesh, ring and bus topology.
We have also learned the Open Systems Interconnection model.
The seven layers of the OSI model is as shown below:
Individuals who cause security problems are hackers, spies, students, businessmen, ex-employees, stockbrokers, terrorists, and etc.
The areas where network security problems can occur are as follows:
• Authentication
• Secrecy
• Non-repudiation
• Integrity control
Disadvantages of computer networks:
• Accidental sharing because inadequate access control.
• Complexity where a network may consist of two or more systems with different OS and different mechanisms for hosting a connection.
• Unknown perimeters where one host maybe a node on two or more networks.
• Many points of vulnerabilities
• Unknown paths
• Label format differences
• Anonymity
Hacking phases involve:
• Reconnaissance
• Scanning
• Gaining access
• Maintaining access
• Covering tracks
We have security exposures as a threat in networks, in terms of privacy, data integrity, authenticity, covert channels, impersonating, eavesdropping and denial of service. Packet replay is another network threat, which refers to recording and retransmitting of message packets in a network. Packet modification involves a system intercepting and modifying a packet destined for another system.
Network security controls consists of encryption, strong authentication, Kerberos and firewalls.
Encryption has two types being link encryption and end-to-end encryption, SSH encryption
A firewall is an access control device that filters all network traffic (internal access and external services). There are four types of firewall being:
• Packet filter
• Circuit level proxy
• Stateful packet filter
• Application level proxy
There are many ways in configuring a firewall because third party software has them. Please visit the software manufacturer website for further details.
Internet Protocol security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.
Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
Intrusion Detection System is a device or software tool that monitors activity to identify malicious or suspicious events.
IDS components include:
• Sensor to generate security events
• Console to monitor events and alerts and control the sensors
• Central engine that records logged by the sensors in a database and uses system rules to generate alerts from security events received
Types of IDS include:
• Signature-based IDS
• Heuristic-based IDS
Limitations of IDS:
• Compensating for weak or missing security mechanisms in the protection infrastructure.
• Instantaneously detecting, reporting, and responding to an attack, when there is a heavy network or processing load.
• Detecting newly published attacks or variants of existing attacks
• Effectively responding to attacks launched by sophisticated attackers
• Automatically investigating attacks without human intervention.
• Resisting attacks that are intended to defeat or circumvent them
• Compensating for problems with the fidelity of information sources
• Dealing effectively with switched networks
Basically a network is a computing environment with more than one independent processor. Network resources include computers, OS, programs, processes and people.
Below is the illustration on the network architecture.
A network enables us the send and receive messages, executing programs, obtaining status information on local and other network users.
The types of network is shown below:
The basic network topologies that we are all already familiar with are star, mesh, ring and bus topology.
We have also learned the Open Systems Interconnection model.
The seven layers of the OSI model is as shown below:
Individuals who cause security problems are hackers, spies, students, businessmen, ex-employees, stockbrokers, terrorists, and etc.
The areas where network security problems can occur are as follows:
• Authentication
• Secrecy
• Non-repudiation
• Integrity control
Disadvantages of computer networks:
• Accidental sharing because inadequate access control.
• Complexity where a network may consist of two or more systems with different OS and different mechanisms for hosting a connection.
• Unknown perimeters where one host maybe a node on two or more networks.
• Many points of vulnerabilities
• Unknown paths
• Label format differences
• Anonymity
Hacking phases involve:
• Reconnaissance
• Scanning
• Gaining access
• Maintaining access
• Covering tracks
We have security exposures as a threat in networks, in terms of privacy, data integrity, authenticity, covert channels, impersonating, eavesdropping and denial of service. Packet replay is another network threat, which refers to recording and retransmitting of message packets in a network. Packet modification involves a system intercepting and modifying a packet destined for another system.
Network security controls consists of encryption, strong authentication, Kerberos and firewalls.
Encryption has two types being link encryption and end-to-end encryption, SSH encryption
A firewall is an access control device that filters all network traffic (internal access and external services). There are four types of firewall being:
• Packet filter
• Circuit level proxy
• Stateful packet filter
• Application level proxy
There are many ways in configuring a firewall because third party software has them. Please visit the software manufacturer website for further details.
Internet Protocol security (IPsec) is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a data stream.
Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
Intrusion Detection System is a device or software tool that monitors activity to identify malicious or suspicious events.
IDS components include:
• Sensor to generate security events
• Console to monitor events and alerts and control the sensors
• Central engine that records logged by the sensors in a database and uses system rules to generate alerts from security events received
Types of IDS include:
• Signature-based IDS
• Heuristic-based IDS
Limitations of IDS:
• Compensating for weak or missing security mechanisms in the protection infrastructure.
• Instantaneously detecting, reporting, and responding to an attack, when there is a heavy network or processing load.
• Detecting newly published attacks or variants of existing attacks
• Effectively responding to attacks launched by sophisticated attackers
• Automatically investigating attacks without human intervention.
• Resisting attacks that are intended to defeat or circumvent them
• Compensating for problems with the fidelity of information sources
• Dealing effectively with switched networks
Lab 5 Application Security
In this lab, we are focusing on security in web applications. We should be able to describe the flaw of web application and its exploitation, exploit web applicaion vulnerabilities, as well as explaining the prevention methods that can be taken to overcome web application vulnerabilities.
We have been introduced on the Open Web Application Security Project (OWASP), an open community focusing on improving the security of application software. Free materials are provided, such as articles on secure programming, security testing guide, and much more. So, join in the OWASP community at http://www.owasp.org
We have also being exposed with the usage of WebGoat and WebScarab. WebGoat is basically a simulation toolkit used to demonstrate how to exploit the vulnerabilities of a poorly designed web application. WebGoat is designed with the J2EE framework for convenience of users in understanding security issues by applying security knowledge they have into exploting a real vulnerability in WebGoat application.
Along with this simulation tool there is the WebScarab, a tool for anyone who needs to expose the workings of an HTTP(S) based application, whether to allow developers to debug application problems, or to allow a security specialist to identify vulnerabilities in such a way that the application has been designed or implemented.
In our first task, we did a hacking simulation using WebGoat and WebScarab.
For more information on how to use WebScarab and WebGoat
http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
and
http://yehg.net/lab/pr0js/training/webgoat.php
Cross-side scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into webpages viewed by other users. An exploited XSS vulnerability can be used by hackers to bypass access controls.
Several steps in preventing XSS include:
Input validation
Strong output encoding
Specify the output encoding
Do not use "blacklist" validation
Watch out for canonicalization errors
We also learned how to do an XSS attack. The basic idea is to apply a script such as shown below to create a false login page so that you can harvest the username and password keyed in by the user.
Script Example
Phishing with XSS
The script is then pasted on the above screen. A login page will be created using the Javascript page above. User then logs in with username and password. The username and password will be send across the world to a server that gathers login information.
The next thing we've learnt is about the injection flaws. This flaw allows attackers to relay malicious code through a web application to another system. Various attacks include calls to the operating system via system calls, the use of external programs via shell commands, as well as calls to backend databases via SQL ( or referred to as SQL injection).
The example PHP code shown above can be manipulated by entering
in which it returns all the data from the User Table.
To learn more about injection flaws, please visit http://www.owasp.org/index.php/Injection_Flaws
Malicious File execution is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will exploit the weaknesses by performing
Remote code execution
Remote root kit installation and complete system compromise
On Windows, internal system compromise may be possible through the use of PHP’s SMB file wrappers
This vulnerability can be prevented by:-
• Strongly validate user input using "accept known good" as a strategy
• Add firewall rules to prevent web servers making new connections to external web sites and internal systems. For high value systems, isolate the web server in its own VLAN
or private subnet
• Check user supplied files or filenames cannot obviate other controls, such as tainting data in the session object, avatars and images, PDF reports, temporary files, and so on
• Consider implementing a chroot jail or other sand box mechanisms such as virtualization to isolate applications
from each other
PHP: Disable allow_url_fopen and allow_url_include in
php.ini and consider building PHP locally to not include this functionality. Very few applications need this functionality
and thus these settings should be enabled on a per
application basis
• PHP: Disable register_globals and use E_STRICT to find
uninitialized variables
• PHP: Ensure that all file and streams functions (stream_*)
are carefully vetted
We have been introduced on the Open Web Application Security Project (OWASP), an open community focusing on improving the security of application software. Free materials are provided, such as articles on secure programming, security testing guide, and much more. So, join in the OWASP community at http://www.owasp.org
We have also being exposed with the usage of WebGoat and WebScarab. WebGoat is basically a simulation toolkit used to demonstrate how to exploit the vulnerabilities of a poorly designed web application. WebGoat is designed with the J2EE framework for convenience of users in understanding security issues by applying security knowledge they have into exploting a real vulnerability in WebGoat application.
Along with this simulation tool there is the WebScarab, a tool for anyone who needs to expose the workings of an HTTP(S) based application, whether to allow developers to debug application problems, or to allow a security specialist to identify vulnerabilities in such a way that the application has been designed or implemented.
In our first task, we did a hacking simulation using WebGoat and WebScarab.
For more information on how to use WebScarab and WebGoat
http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
and
http://yehg.net/lab/pr0js/training/webgoat.php
Cross-side scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into webpages viewed by other users. An exploited XSS vulnerability can be used by hackers to bypass access controls.
Several steps in preventing XSS include:
Input validation
Strong output encoding
Specify the output encoding
Do not use "blacklist" validation
Watch out for canonicalization errors
We also learned how to do an XSS attack. The basic idea is to apply a script such as shown below to create a false login page so that you can harvest the username and password keyed in by the user.
Script Example
Phishing with XSS
The script is then pasted on the above screen. A login page will be created using the Javascript page above. User then logs in with username and password. The username and password will be send across the world to a server that gathers login information.
The next thing we've learnt is about the injection flaws. This flaw allows attackers to relay malicious code through a web application to another system. Various attacks include calls to the operating system via system calls, the use of external programs via shell commands, as well as calls to backend databases via SQL ( or referred to as SQL injection).
The example PHP code shown above can be manipulated by entering
in which it returns all the data from the User Table.
To learn more about injection flaws, please visit http://www.owasp.org/index.php/Injection_Flaws
Malicious File execution is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will exploit the weaknesses by performing
Remote code execution
Remote root kit installation and complete system compromise
On Windows, internal system compromise may be possible through the use of PHP’s SMB file wrappers
This vulnerability can be prevented by:-
• Strongly validate user input using "accept known good" as a strategy
• Add firewall rules to prevent web servers making new connections to external web sites and internal systems. For high value systems, isolate the web server in its own VLAN
or private subnet
• Check user supplied files or filenames cannot obviate other controls, such as tainting data in the session object, avatars and images, PDF reports, temporary files, and so on
• Consider implementing a chroot jail or other sand box mechanisms such as virtualization to isolate applications
from each other
PHP: Disable allow_url_fopen and allow_url_include in
php.ini and consider building PHP locally to not include this functionality. Very few applications need this functionality
and thus these settings should be enabled on a per
application basis
• PHP: Disable register_globals and use E_STRICT to find
uninitialized variables
• PHP: Ensure that all file and streams functions (stream_*)
are carefully vetted
Wednesday, October 21, 2009
Lecture 5 Database Security
In this lecture Encik Mohd Zaki covered on the security which focuses on the database domain. It is very essential to secure data in the database, considering that information is a very valuable asset in enterprise companies. People actually wants ro secure confidential information from hackers, as well as from legal parties, to restrict and deny unauthorized access. The basic database concepts had also been covered in this lecture such as database, DBA and DBMS. A database offers many advantages over a simple file system, such as shared access, minimal data redundancy, data consistency, data integrity, and controlled user access.
Basically there are four levels of enforcing database security that we should know about. This includes the physical security, OS security, DBMS security, and data encryption. The first three levels of security are not satisfatory in providing solutions to security issues because of the following:
Difficulty of controlling the disclosure of raw data
Invalid to control the disclosure of sensitive data
Hard to control the disclosure of confidential data in a distributed database system.
Hard to verify that the origin of a data item is authentic.
Therefore, using data encryption is appropriate at this point, which eliminates data disclosure. Besides that, intruders are unable to alter ciphertext without encryption key, which means data integrity is preserved.
A database must achieve a level that users are able to trust the accuracy of data values. In accordance to that, data must be protected from corruption from outside influences. Updates from authorized-only individuals are necessary. Backing up is easiest way of protecting data.
With means of maintaining element integrity, the DBMS does the following:
Field checks
User access control
Changelogs
Auditability is essential in a database, which involves the trailing user transactions with the database, but trailing all accesses is impractical. The audit trail includes the access at the record, field and element levels. There seems to be a possibility that auditability can be done over reporting, but what if some data problems are ignored and not reported?
Access control for database is almost similar to the OS access control, except that there are more complicated database problems when dealing with records and fields. This type access control concerns with inference of one field from another.
The DBMS can require rigorous user authentication. The DBMS usually runs an application on top of the OS. This system design implies that there is no trusted path from the DBMS to the operating system. With this, the DBMS is forced to do its own authentication.
There are problems in availability of data for multiple users that accesses the database. There is a need for arbitration of two users' request for the same record inside a database. Or in any case that the DBMS may withhold non-protected data to avoid revealing protected data.
A DBMS usually suffers the failure of the computing system in the middle of modifying data. So, a solution to that is the two-phase update. The first phase involves the intent phase (DBMS gathers resources to perform update) and the commit phase(writing a commit flag to the database). The second phase would be making permanent changes. Actions before the commit phase cannot be repeated, but the updates of phase two can be repeated. Data repair can also be done in the second phase, in case that the system fails during the second phase and the database consequently contains incomplete data.
The DBMS also maintains additonal information in detecting internal data inconsistencies Types of additonal information include:
Error Detection and Correction Codes
-Parity Checks
-Cyclic Redundancy Checks (CRC)
-Hamming Codes
Shadow Fields
-Copy of entire attributes or records
-Second copy as replacement
Recovery
-Backup
-Changelogs
Concurrency/Consistency
-Simultaneous read
-Modification requires one to be locked out
-Query-update cycle as single uninterrupted operation
Monitors
-Range Comparison
-State constraints
-Transition constraints
Sensitive data is well defined as data that should not be made public. They are called that way because inherently and declared sensitive, they're of a sensitive record, not to mention sensitive in accordance to previously disclosed information.
The DBMS also makes decisions on whether to permit an access to a user, considering the following factors:
Availability of data
Assurance of authenticity
Acceptability of access
Types of sensitive data disclosures includes:
Exact data
Bounds
Negative result
Existence
Probable value
It is difficult to determine which data are sensitive and how to protect sensitive data. In the end, we need to achieve a balance in securing data in a precise manner.
Security vs Precision
Inference is how do you derive sensitive data from non-sensitive ones. The inference problem is a subtle vulnerability in database security.
There are ways to do direct and indirect attacks on a database. In a direct attack, one determines values of sensitive fields by seeking them directly with queries that yield a few records. The indirect attack infers a final result on one or more intermediate statistical results, but this approach requires work outside the database. To explain in specific, a statistical attack seeks to use some apparently anonymous statistical measure to infer individual data.
The controls for statistical attack includes suppression, concealing, limited response suppression, and combining results.
To conclude, three basic paths to controlling the inference problem are as follows:
suppress obviously sensitive information
track what the user knows
disguise the data
Lab 4 Symmetric and Asymmetric Cryptography
In this lab we are focusing on understanding symmetric and asymmetric cryptography, as well as implementing Caesar Cipher, Vigenere Cipher and the RSA algorithm.
As we all know that there are two types of encipherment in cryptosystems namely symmetric and asymmetric encipherment. Symmetric encipherment can be in the form of substitution, transposition or both. In substitution encipherment, alphabets in the plain text is replaced with another alphabetic character. There are two types of substitution namely monoalphabetic(eg. Caesar cipher) and polyalphabetic(eg. Vigenere cipher) substitution. The transposition encipherment changes the location of characters. Transposition can be either keyed or unkeyed. The asymmetric encipherment uses two keys, which are public key and private key, to encrypt and decrypt.
The Caesar Cipher is formed by shifting the letters of the original alphabet. The example of shift 3 Caesar Cipher is shown below:
plaintext alphabet A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
ciphertext key D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
Cracking the Caesar ciphertext is easy by using brute-force cryptanalysis. The reasons of using the brute-force cryptanalysis are as follows:
The encryption and decryption algorithms are known
There are only 26 keys to try
The language of the plaintext is known and easily recognizable. The pattern is obvious.
Considering that the Caesar ciphertext is easily broken by using the brute-force attack, the Vigenere cipher is introduced in order to improve the deciphering process. The Vigenere cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. Generally, a key is needed to encrypt a plaintext using Vigenere cipher, either using a word or a phrase.
Vigenere Cipher
Asymmetric encipherment uses keypairs namely the public and private key for encryption and decryption. The public key is known to all but the private key is kept secret. The asymmetric keys are usually generated using the RSA algorithm. The following steps involving calculations are required:
Choose two distinct prime numbers, p and q
Compute n=pq
- Compute totient(n) = (p-1)(q-1)
- Choose an integer e such that 1
- Determine d (using modular arithmetic) which satisfies the congruence relation
Regarding encryption, if a person A transmits a public key of (c,e) to person B and keeps the private key secret, person B send a message M to person A. To encrypt message M, it is turned into an integer 0
For decryption however, person A can recover m from c by using the calculation below:
m=c^d (mod n)
Lecture 4 Operating System Security
In this lecture session, we were introduced on the operating system security. In OS security, there are six aspects that protection is necessary to be implemented on:
memory
sharable I/O devices
serially reusable I/O devices, such as printers and tape drives
sharable programs and subprocedures
networks
sharable data
Separation is the basis of protection, which means to keep one user's objects separate from each other users. There are four types of separation process:
Physical separation – different processes use different physical objects.
Temporal separation – processes have different security requirements executed at different times.
Logical separation – users operate under the illusion that no other processes exist, as when an OS constrains a program's accesses so that the program cannot access objects outside permitted domain.
Cryptographic separation – processes conceal their data and computations in a way that they are unintelligible to outside processes.
A security mechanism can offer different levels of protection, such as:
No protection at all
Isolation
Share all or share nothing
Share via access limitation
Share by capabilities
Limit use of an object
The main concern of multiprogramming is preventing a program from affecting data and programs in other users' memory space. Aside from using system software to do all that, protection can also be built using hardware which controls efficient use of memory. Thus, solid protection can be provided at essentially no additional cost.
Methods used for memory protection include:
fence
relocation
base/bound registers
tagged architecture
segmentation
paging
paging + segmentation
The fence is the simplest form of memory protection introduced in single-user operating systems to prevent a faulty user program from destroying part of the resident portion of the operating system. Two implementations of fence are the fixed fence which its memory address was predefined, and the fence register which uses a hardware register.
Relocation is the process of taking a program written as if it began at address 0 and changing all addresses to reflect the actual address at which the program is located in memory.
The variable fence register has the ability to relocate. This fence register has two kinds of registers namely base register which has the addresses offset from the base address in a program (the lower address limit), and the bound register is the upper address limit. With a pair of base/bound registers, a user is perfectly protected from outside users, or you should say that outside users are protected from errors in any other user's programs. However this is not quite effective because erronous addresses inside a user's address space can still affect a program. This problem is solved by adding another pair of base/bounds registers, one for instructions the second for the data space.
Due to the contiguous nature and the all-for-nothing sharing solution of base/bounds registers, the tagged architecture serves as an alternative, where in every word of machine memory has one or more access rights to that word. Operating system instructions has the privilege to set these access bits.
Another protection method is the segmentation, which involves the simple notion of dividing a program into separate parts that has logical unity – exhibits a relationship among all of its code. Segments can be separately relocated, allowing any segment to be placed in any available memoy locations. The security benefits of segmentation are:
each address reference is checkec for protection
many different classes of data items can be assigned different levels of protection
two or more users can share access to a segment, with potentially different access rights
a user cannot generate an address or access to an unpermitted segment
The paging method of protection divides programs into equal-sized "pages", and memory divided into equal-sized units called "page frames". In paging, all pages in the paging approach are of the same size, which makes fragmentation an ease, but the pages have no logical unity. A certain change to a program pushes all subsequent instructions to lower addresses andd moves a few bytes from the end of each page to the start of the next.
We see the benefits of paging and segmentation. By combining the two approaches, desirable features are utilized. This approach retains the logical unity of a segment and permitted differentiated protection for the segments, but it adds an additional layer of translation for each address. Plus, additional hardware improves the efficiency of the implementation.
In multiprogramming environments, there are a number of general objects that are necessary to be protected:
memory
a file or dataset on an auxiliary storage device
a directory of files
a hardware device
a data structure, such as a stack
a table of the operating system
instructions, especially privileged instructions
passwords and the user authentication mechanism
the protection mechanism itself
Several goals in protecting objects would be:
to check every user access to an object
to enforce least privilege, meaning that a subject should have access to the least number of objects necessary to perform tasks.
Verify acceptable usage, meaning that it is necessary to check that activities performed on objects are appropriate.
The simplest method of protecting objects is to use the file directory mechanism. With that, no user can be allowed to write in other user's file directory. Access rights for users can be set in file directories, such as allowing or restricting the read, write and execute command of users. This method is easy to implement because it uses one list per user. However the drawback of this method is that the list can become too large, eg many shared objects are accessible to all users.
Another method that can be used to protect objects is using the access control matrix, which uses a table where each row represents a subject, each column represents an object, and each entry is the set of access rights for the particular subject to the object. The example of access control matrix is shown below:
Access Control Matrix
Another protection method is using the access control list, in which there is one access control list assigned to the object.
Object1: {{A: OWR}, {B: R}, {C: R}, {D: R}}
Object2: {{A: R}, {B: OWR}, {C: R}, {E: R}}
Object3: {{A: OWR}}
Object4: {{B: OWR}, {*: WR}}
Object5: {{B: OWR}, {E: R}}
Access Control List
Basic forms of file protection mechanism are as follows:
Allnone protection which assumes that all users can be trusted
Group protection which separate all users into groups
We did see the drawbacks of the above file protection mechanisms, individual permissions can be set, such as passwords to protect individual files, shortfalls, and temporary acquired permission.
The authentication method of protection can take many forms, such as using passwords, identity badges, and the biometrics.
Lab 3 Authentication and Basic Cryptography
In this lab session, we were being explained about what is meant by authentication and cryptography. We are required to implement Data Encryption and Local Password Policy on Windows 2003 Server Edition. Aside from the operating system, we are required to implement asymmetric cryptography by using an encryption software called Pretty Good Privacy (PGP).
The basic idea of authentication is that when a subject claims that something or an identity is true, verification is necessary. So, authentication enables verifiers to gain confidence that claims are legitimate.
Cryptography is the science of hiding information in such a way that its meaning is not unintelliglble to an unauthorized person. Encryption is the process of encoding a message so that its meaning is not obvious while decryption is the reverse process. The common terms for encrypting and decrypting are encoding and decoding.
Cryptosystems use cryptography algorithms, which can be classififed into two categories being the symmetric and asymmetric encipherment. The sole difference that can distinguish symmetric and asymmetric algorithms is the number of keys used in the encryption and decryption process.
Data encryption can also be done using the NTFS. This encryption method is convenient for laptop users because their data stored in the hard drive is encrypted and secure, which makes their data secure and unreadble just in case their laptops are stolen and hacked.
Windows 2003 has a utility which makes it easy to encrypt files to an NTFS partition.
For information on how to encrypt files to an NTFS partition, please visit:
http://technet.microsoft.com
Windows 2003 also has the local password policy setup for the password length. For suthentication in work environments, usernames and passwords are required. What is to be focused here is the password length because short passwords are easy to crack and guessable. With Windows 2000/2003, the local password policy allows you to specify the minimum length for passwords.
For more information on how to setup local password policy for password length, please visit:
http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx
The local password policy can also be set for complexity. The main focus here is the usage of various password characters such as letters, numbers and symbols. So, the local password policy can also specify password characters to be used.
For more information on how to set the local password policy for password complexity, please visit:
http://technet.microsoft.com/en-us/library/cc781633(WS.10).aspx
Windows 2003 has the utility of setting the account lockout polisy where this policy disables an account for a specific amount of time after a certain amount of failed login attempts.
For more information on how to set an account lockup policy, please visit:
http://technet.microsoft.com/en-us/library/cc781491(WS.10).aspx
For encryption and decryption of plaintext, we use the third party software called Pretty Good Privacy. PGP is referred to as a hybrid cryptosystem because it has the best features of both conventional and public key cryptography. With PGP,
For more information on how PGP works, please visit:
http://www.pgpi.org/doc/pgpintro/
Lecture 3 Program Security
In this lecture, we learnt about what it means by a secure program, malicious codes, and the web application vulnerabilities. Besides that, we had also touched on the measures on how to counter malicious code and vulnerabilities by applying software engineering principles and practices, and the protections against program flaws during execution.
From what I’ve understand from the lecture is that a secure program is defined by different perspectives of who is going to evaluate software quality. There are also a number of approaches in judging program security. This includes fixing faults by patching software after conducting penetration tests. There is no doubt that fixes might trigger more faults later results in software failures. There are flaws in software in the software market, but flaws are not the causes of faults followed by failures.
The common flaws that we see in programs are:
validation error
domain error
serialization and aliasing
inadequate identification and authentication
boundary condtion violation
other exploitable logic errors
Non-malicious program errors occur because of unintentional mistakes made by software developers, which causes malfunction. Examples of non-malicious program errors are buffer overflows, incomplete mediation (exposed and uncontrolled data), and Time of Check to Time of Use. These non-malicious program errors may lead to exploitation of malicious programmers, or commonly known as hackers. As I've said earlier in the ealier posts, with small amount of knowledge, a commoner can easily exploit unintentional program errors.
To describe buffer overflow, it is almost similar to attempting to pour two liters of water into a one-liter bottle. Incomplete mediation has something to do with manipulating exposed data such as date and time to cause errors (Note: Usually exposed and uncontrolled data exists in URLs). The Time-to-check to time-to-use flaw is pertaining to mediation that is performed with the "bait and switch" method in the middle, or further known as a serialization or synchronization flaw. It is possible that these three flaws can be combined together as a multistep attack to cause harm to a system.
This is why malicious programmers create malicious codes in order to cause harm or exploit a particular system. Furthermore, malicious codes have the ability to cause as much harm, as well as its prolonged existence, either created by accident or intended.
Types of malicious code that existed today are as follows:
Spywares are a new type of malicious/non-malicious code. It is a term for tracking software deployed without adequate notice, consent, or control for the user. Often the tracking is done by reporting information (anything from browsing history to credit-card or personal details) to a third party.
Below are the effects of viruses and causes:
| Virus Effect | Causes |
| Attach to executable program | Modify file directory Write to executable program |
| Attach to data or control file | Modify directory Rewrite data Append to data Append data to itself |
| Remain in memory | Intercept interrupt by modifying interrupt handler address table Load self in non-transient memory area |
| Infect disks | Intercept interrupt Intercept operating system |
| Conceal self | Intercept system calls that would reveal self and falsify result classify self as "hidden" file |
| Spread infection | Infect boot sector Infect systems program Infect ordinary program Infect data ordinary program reads to control its execution |
| Prevent deactivation | Activate before deactivating program and block deactivation Store sopy to reinfect after deactivation |
The above notes regarding malicious codes are anonymous codes that are not targeted to a specific system, application or a particular purpose. The main focus of the targeted malicious code are trapdoors and salami attack.
Trapdoors are undocumented entry point to a module. It is usually inserted by software developers during code development testing. Its initial purpose is to provide "hooks" by which to connect future modifications and enhancements, or basically to just allow access if the module should have future failures. Aside from its legitimate use, trapdoors allow a programmer access to a program once it is placed in production. The main causes of trapdoors includes programmer's forgetfulness of removing them, programmer's intention to leave them for testing, maintenance, and or later covert means of access.
As for the salami attack, this code merges bits of seemingly inconsequenial data to yield powerful results, for instance programs that often disregard small amounts of money in their interest computations.
The top ten web application vulnerabilities that we normally see in the world today are:
Cross-site scripting
Injection flaws
Malicious file execution
Insecure direct object reference
Cross site request forgery
Information leakage and improper error handling
Broken authentication and session management
Insecure crypto storage
Insecure communications
Failure to restrict URL access
There are a few aspects to control against program threats. We can see some signs that show that there are viruses within a system because they leave certain trails, however sometimes they can be very hard to detect because they can self-modify. A program scanner with a considerably good checksum can be used to detect changes in self-modifying codes.
Viruses may be invisible and hiding in large programs, compilers, database or file managers. The popular hiding place for viruses in within an attachment of emails or a public download file. A virus has phases to go through before it is fully activated – Dormant phase, propagation phase, triggering phase and execution phase.
For preventing virus infection, a system should have a virus detection and identification tool a.k.a. scanners. Removal tools are also essential to clean viruses. What I personally think is that a system should have an internet security package that has antivirus protection to actively protect files from infection. This protection mechanism should include real-time file system protection, document protection, email client protection and web access protection. Nevertheless, daily updates of virus definitions is necessary.
Other ways of preventing virus detection include using only well-known software, do software testing in an isolated PC, and not opening unknown email attachments. Besides that, backups are necessary too.
Lab 2 The Goals of Information Technology Security
In this lab we were taught on what are the goals of IT Security. The main focus in this lab session is for us to be able to determine NTFS and FAT32 partitions, as well as implementing confidentiality, integrity, and availability in Windows Server 2003.
The goals of information security is to achieve three aspects namely confidentiality, integrity and availability and the implementation of a secure computing network environment. However, to achieve the balance between the three elements is a difficult task. Besides that, another goal to achieved is to provide legitimate use of resources which ensures that the resources are from the original source.
Our first task is to use an NTFS partition to secure local resources. Windows Server 2003 has a feature of setting up local file security. The main concern about this part is that you have to check whether there's any corruption of a FAT32 partition on a particular hard-drive, in our case we used a virtual machine. Then, the NTFS conversion can be done with commands typed in the Command Prompt.
The most convenient thing about this lab session is that we are taught to implement data confidentiality, integrity and availability at the same time. We have created two user accounts in Windows 2003 virtual machine, then create folders, then do some settings to the folders. Basically, there's a security option in folders created. Furthermore, it's easier to set user permissions which allows or restrict access of certain users towards a folder in a particular network, which covers the three security principles.
For further details on how to set this in detail, please visit http://technet.microsoft.com .