Introduction to Computer Security
Course IntroductionPavel Laskov
Computer security in numbers
New malicious code samples observed (Symantec)
Technische Universität Berlin
Gefährliches Internet
»
Internet als Risikofaktor?
»
Omnipräsenz von Angriffen, Würmern und Viren
»
Massive Schäden bei Unternehmen und Bürgern
»
Zunehmende Kriminalisierung von Schadsoftware
0 750.000 1.500.000 2.250.000 3.000.000
2002 2003 2004 2005 2006 2007 2008 2009
What lurks behind the statistics?
Malware previously used for fun is now used for profit. 78% of end user attacks involved stealing of login data 76% of phishing attacks targeted financial sector Average cost of data breach in 2008 in the USA: 6.7M $. Hacking is no longer the realm of “script-kiddies”.
60% of malicious code threats representnewattacks. The biggest risk resides not in butin frontof a computer.
Why would anyone want something from me? What does my Windows want to update again? I have already bought an antivirus, so I am safe.
Why are computer systems insecure?
Growing complexity of computer systems large number of components, complex interaction High competition
short “time-to-market”, high ROI
Leveraging of risks through high connectivity worm outbreaks, botnets
Slow incident response
“incident hiding”, manual handling Human error
Human error: lessons learned
Users make errors
elaborate social engineering design time pressure
Significant monetary motivation Business efficiency via Internet
Acrobat Reader JBIG2 exploit: a timeline
Exploit discovered: ???
First public warnings: 19.-20.02 Adobe Reader 9.0 patched: 10.03 Adobe Reader 8.1.3 patched: 18.03 Adobe Reader Linux patched: 26.03
Recognition by antivirus system as of mid-April 2009: 6/39 (15.39%)
Infection without a click
Select a thumbnail view.
Hover a mouse over a document.
Do nothing: the Windows Desktop Search (if not de-activated) will find it and open!
Potential consequences of an infection
Start a keylogger
Start a botnet (zombie) client
Security instruments
Security instruments
Prevention Detection
Security instruments
Prevention Detection
What will you learn?
Findamental concepts of computer security dry, but important!
Basic security goals and mechanisms authentication, access control, encryption, etc. Practical security instruments
Windows and Linux security. Further selected topics
network security software security
web application and browser security ‘
Coarse administration
Lectures:
Wed, 10:00–12:00 (ct), A301 Formalities:
Credit hours (diploma): 2 SWS (lectures) + 1 SWS (exercises) Credit points (B.Sc.): 3 LP (lectures) + 1 LP (exercises) Exams and grading:
diploma: oral exam by appointment, graded certificate for exercises
B.Sc: written exam at the end of semester, 30% of the final grade from exercises
Office hours: by appointment Course web page:
Homework assignments
Meetings:
Tue, 10:00–12:00 (ct), A301 First meeting: 26.04
4 homework assignments to be solved individually Evaluation and grade:
diploma: a grade reflects the percentage of points acquired. B.Sc.: a grade contributes 30% to the final grade.
Bibliography
Dieter Gollmann. Computer Security.
Wiley & Sons, 2006.
Ross Anderson. Security Engineering.
Wiley & Sons, 2001.
Bruce Schneier.
Secrets and Lies: Digital Security in a Networked World.
A typical web application
Legitimate user
Browser
Webserver
Attack: interception of communication
Legitimate user
Browser
Webserver
Internet
Attacker
Security goal: confidentiality
Prevention of unauthorized reading of data Prevention of unauthorized learning of information Potential abuse scenarios:
Discovery of confidential information (e.g. details of a business contract)
Discovery of authentication credentials (e.g. password sniffing) Enforcement intruments:
Symmetric or asymmetric cryptography Anonymization techniques
A typical web application
Legitimate user
Browser
Webserver
Attack: identity spoofing
Legitimate user
Browser
Webserver
Internet
Fake webserver Attacker
Security goal: authentication
Verification of an identity of a person or a computer Prerequisite for access control
Authentication methods:
Shared secrets (e.g. password or PIN)
Ticket systems (identity cards, digital certificates) Challenge-response techniques
Biometric techniques
Human authentication: CAPTCHA’s, Turing test, etc. Authentication risks: identity theft
A typical web application
Legitimate user
Browser
Webserver
Attack: injection of malicious code
Legitimate user
Browser
Webserver
Internet
Attacker Malware
XSS attack
Security goal: integrity
Prevention of malicious tampering of data Potential abuse scenarios:
Fraudulent modification of data (e.g. 100,000¤instead of
100¤in an online transaction request)
Injection of malicious code in downloaded software
Evading detection by modification of a compromized operating system
Enforcement instruments:
A typical web application
Legitimate user
Browser
Webserver
Attack: server overload
Legitimate user
Browser
Internet
Security goal: availability
A joint objective of security and dependability
May be caused by attacks as well as natural phenomena, such as design errors or flash crouds.
Enforcement instruments: Detection of DoS-attacks
Router and firewall reconfiguration Service redundancy
A typical web application
Legitimate user
Browser
Webserver
Attack: transaction denial by a user
Legitimate user
Browser
Webserver
Internet
Credit card charded Transaction cancelled
Security goal: accountability
An audit trail of security-related events A key instrument of detection/response
A stronger form of accountability isnon-repudiation: unforgeable evidence that a certain action occurred. Similar attacks as integrity
Enforcement instruments: Integrity checks
Read-only audit
Summary
Security is not a solution but an ongoing process.
Security can only be achieved by a combination of technical and organizational measures.
One of the biggest security risks is a user.
Security is a big challenge but lots of fun as well: a great field of study and research.
Next lecture
The economics of computer security Security threats
