Chapter 6:

Computer and Network Security

Ethics for the Information Age

Forth Edition

by
Randy G. Tabaog, LPT

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley

 Chapter Overview

• Introduction
• Viruses, worms, and Trojan horses
• Phreaks and hackers
• Denial-of-service attacks
• Online voting

1-2

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-2

 Introduction

• Computers getting faster and less expensive

• Utility of computers increasing
– Email
– Web surfing
– Shopping
– Managing personal information
• Increasing use of computers  growing
importance of computer security
1-3

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-3

 Viruses (1/2)

• Virus: piece of self-replicating code embedded

within another program (host)
• Viruses associated with program files
– Hard disks, floppy disks, CD-ROMS
– Email attachments
• How viruses spread
– Diskettes or CDs
– Email
– Files downloaded from Internet

1-4

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-4

 Viruses (2/2)

• Well-known viruses
– Brain
– Michelangelo
– Melissa
– Love Bug
• Viruses today
– Commercial antivirus software
– Few people keep up-to-date

1-5

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-5

 Worms

• Worm
– Self-contained program
– Spreads through a computer network
– Exploits security holes in networked computers
• Famous worms
– WANK
– Code Red
– Sapphire (Slammer)
– Blaster
– Sasser

1-6

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-6

 The Internet Worm

• Robert Tappan Morris, Jr.

– Graduate student at Cornell
– Released worm onto Internet from MIT computer
• Effect of worm
– Spread to 6,000 Unix computers
– Infected computers kept crashing or became unresponsive
– Took a day for fixes to be published
• Impact on Morris
– Suspended from Cornell
– 3 years’ probation + 400 hours community service
– $150,000 in legal fees and fines

1-7

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-7

 Ethical Evaluation
• Kantian evaluation
– Morris used others by gaining access to their computers
without permission
• Social contract theory evaluation
– Morris violated property rights of organizations
• Utilitarian evaluation
– Benefits: Organizations learned of security flaws
– Harms: Time spent by those fighting worm, unavailable
computers, disrupted network traffic, Morris’s
punishments
• Morris was wrong to have released the Internet
worm
1-8

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-8

 Trojan Horses
• Trojan horse: program with benign capability that
masks a sinister purpose
• Remote access Trojan: Trojan horse that gives
attack access to victim’s computer
– Back Orifice
– SubSeven
• RAT servers often found within files downloaded
from erotica/porn Usenet sites
• provide the attacker with complete control of the
victim's system. Attackers usually hide these Trojan
horses in games and other small programs that
unsuspecting users then execute on their PCs. 1-9

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-9

 Bot Networks
• Bot: A software program that responds to
commands from a program on another computer
• Some bots support legitimate activities
– Internet Relay Chat
– Multiplayer Internet games
• Other bots support illegitimate activities
– Distributing spam
– Collecting person information for ID theft
– Distributed denial-of-service attacks

1-10

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-10

 Defensive Measures
• System administrators play key role
• Authorization: determining that a user has
permission to perform a particular action
• Authentication: determining that people are
who they claim to be
• Firewall: a computer monitoring packets
entering and leaving a local area network
– Ex: packet filter which accepts packets only
from trusted computer on the Internet
1-11

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-11

 Mon 29-11 Hackers (1/2)
• Original meaning (1950s)
– Explorer
– Risk-taker
– Technical virtuoso
– Make a system do something never done before
• MIT developed a system to control movement of trains
• Hacker ethic
– Hands-on imperative
• Access to computers that might teach you something about the
work
– Free exchange of information
– Mistrust of authority--- promote decentralization
– Value skill above all else  not degrees, position, …
– Optimistic view of technology  computer can change
your life to the better 1-12

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-12

 Hackers (2/2)

• Meaning of “hacker” changed

– Movie WarGames (1983)
– Teenagers accessing corporate or government
computers by trying to get user names and passwords:
• Dumpster diving
– Looking through garbage for interesting bits of information
• Social engineering: manipulation of a person inside an
organization to gain access to confidential info.
– A hacker calling a system admin. Pretending he is his boss’s boss
and asks for revealing passwords.
– Modern use of hacking means ------- Malicious acts
• Computer break-ins
• Destroying databases
• Stealing confidential personal information
1-13

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-13

 Phone Phreaking

• Phone phreak: someone who manipulates

phone system to make free calls
• Most popular methods
– Steal long-distance telephone access codes
– Guess long-distance telephone access codes
– Use a “blue box” to get free access to long-
distance lines --- mimic the actual frequency
• Access codes posted on “pirate boards” by
phreaks to share codes and credit card No.
1-14

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-14

 Penalties for Hacking
• Examples of illegal activities
– Accessing without authorization any Internet computer
– Transmitting a virus or worm
– Trafficking in computer passwords
– Intercepting a telephone conversation, email, or any
other data transmission
– Accessing stored email messages without
authorization
– Adopting another identity to carry out an illegal activity
• Maximum penalty: 20 years in prison + $250,000 fine

1-15

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-15

 Denial-of-Service Attacks
• Denial-of-service attack: an intentional action
designed to prevent legitimate users from
making use of a computer service
• Goal of attack: disrupt a server’s ability to
respond to its clients
• About 4,000 Web sites attacked each week
• Asymmetrical attack: a single person can harm
huge organization (multinational organization)
• Asymmetrical attack that may prove popular with
terrorists
– Ex: mafiaboy ---2000 --- Dos of amazon, yahoo, cnn,
ebay, dell
1-16

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-16

 SATAN

• Security Administrator Tool for Analyzing

Networks (SATAN)
• Allows administrators (especially novices)
to test their systems
• Could be used by a hacker to probe other
computers for security weaknesses
• Critics worried SATAN would turn unskilled
teenagers into hackers
• That never happened
1-17

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-17

 Motivation for Online Voting

• 2000 U.S. Presidential election closely contested

• Florida pivotal state
• Most Florida counties used keypunch voting
machines
• Two voting irregularities traced to these
machines
– Hanging chad
– “Butterfly ballot” in Palm Beach County

1-18

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-18

 1-19

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-19

 Benefits of Online Voting

• More people would vote

• Votes would be counted more quickly
• No ambiguity with electronic votes
• Cost less money
• Eliminate ballot box tampering
• Software can prevent accidental over-voting
• Software can prevent under-voting

1-20

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-20

 Risks of Online Voting
• Gives unfair advantage to those with home computers
• More difficult to preserve voter privacy
– The system records the ballot as well as the identity of voter
• More opportunities for vote selling
– X:voter, y: candidate, z: broker who watch voting of x from his PC
• Obvious target for a DDoS attack
• Security of election depends on security of home
computers
– Susceptible to vote-changing virus or RAT
• Susceptible to phony vote servers
– Redirected to phony server, getting credentials, then vote on your
behalf from the actual site
• No paper copies of ballots for auditing or recounts
1-21

Copyright © 2009 Pearson Education, Inc. Publishing as Pearson Addison-Wesley 6-21