Security Aspects

Written and reviewed by Rohit Singh, Computer Science & Commerce faculty at UniDrill (MCA, Osmania University · 6 years teaching). Based on NCERT Computer Science Class XII, Chapter 12.

Why is a computer that never connects to anything the safest one?

A computer with no link to any other device or network cannot be attacked through a network, and a computer with no link is also not very useful. The world is moving towards full connectivity, so we cannot hide our devices from the network. We have to defend them instead. Network security is the protection of a device and its data from illegitimate access or misuse. A threat is any way to exploit a weakness (vulnerability) in a network or communication system to cause harm or damage someone's reputation.

This chapter follows one story: the attackers (malware, hackers, network attacks) and the defenders (antivirus, firewalls, HTTPS, careful habits).

Malware: the seven names to separate

Malware is short for MALicious softWARE. It is any software built to damage hardware, steal data or cause other trouble to the user. The same few questions separate all the types: does it need a host file, does it spread on its own, and what does it want?

Some facts attached to each name are frequent exam questions. The term computer virus was coined by Fred Cohen in 1985. Well known viruses include CryptoLocker, ILOVEYOU, MyDoom, Sasser, Netsky, Slammer and Stuxnet. Example worms are Storm Worm, Sobig, MSBlast, Code Red, Nimda and the Morris Worm. The ransomware WannaCry infected almost 200,000 computers in 150 countries in May 2017, encrypting data and demanding payment in Bitcoin. A Trojan is named after the wooden horse of ancient Troy: it looks like a gift but hides soldiers inside.

Worked example: name the malware. Read each case and decide which malware it is.

The common wrong answer in the first case is virus. A virus would copy itself into other files, and this program does not.

Pause and predict: A program replicates and spreads to other computers through the network, but the user never opened any infected file. Is it a virus or a worm?

Check your answer: A worm. A virus needs a human to open or run an infected file, while a worm replicates on its own and does not need a host.

Keyloggers and the virtual keyboard. A keylogger can be software, or a hardware device such as a thin transparent keyboard placed over the real one. If you must sign in on an unknown computer, use an online virtual keyboard. It helps because the layout changes each time, so a keylogger cannot easily work out which key was pressed.

How malware reaches you, and the signs

Signs of infection include repeated pop ups asking you to visit a site or download software, a changed browser homepage, mass emails sent from your account, a slow computer that crashes, unknown programs starting at boot, programs opening and closing by themselves, sudden loss of storage space, and programs or files appearing or disappearing.

Prevention is a habit list. Use antivirus and keep it updated, apply software updates and patches, configure browser security, take regular backups, use a firewall, never use pirated software (choose Free and Open Source Software instead), scan removable drives before copying, avoid clicking links or attachments from unsolicited emails, and avoid typing sensitive data on unknown computers or public Wi-Fi. Look for the lock icon in the address bar while paying online. Never install an "antivirus" offered in a pop up. Close such an ad with the X icon at the top right and not with the "close" button inside it, and cancel the installation straight away if it has begun.

Antivirus: five ways to catch malware

An antivirus (also called anti-malware) was first built to find and remove viruses, and now prevents, detects and removes many kinds of malware.

A virus signature is a consecutive sequence of bytes found in a certain malware sample. It sits inside the malware or infected file and not in clean files.

Pause and predict: Your antivirus has not updated for two years. Why is it almost as bad as having none?

Check your answer: Its signature database (VDF) does not contain the signatures of new malware, so new malware passes unnoticed.

Beyond the textbook. For the exam: learn the five methods and the line "an antivirus with an outdated VDF is as good as no antivirus". In reality: because attackers change their code constantly, modern products combine all these methods. A signature catches the known, a sandbox or behaviour check catches the strange, and updates keep the databases current.

Spam, HTTP and HTTPS

Spam is unwanted data, an email, a message or an advertisement. The best known form is email spam: a mailing list of addresses receives repeated advertisement links and invitations that clutter the inbox and often trick people into buying something or downloading malware. Email services have automatic spam filters, and you can mark a message as spam so that it stops arriving in the inbox.

HTTP and HTTPS are both protocols for how data moves over the World Wide Web between browser and server.

Beyond the textbook. For the exam: HTTPS needs an SSL digital certificate and encrypts data. In reality: the modern secure layer is called TLS, the successor of SSL, though the certificate is still commonly called an SSL certificate. Also, the padlock only says that the connection is encrypted. It does not prove the website is honest, so you still need to check the address carefully.

Firewall: the first barrier

A firewall is a network security system that protects a trusted private network from unauthorised access or traffic from an untrusted outside network such as the Internet. It can be software, hardware or both. It works as a network filter: using predefined security rules, it watches and controls incoming and outgoing traffic. For example, a school firewall can allow the accountant to reach the finance server but stop students from reaching it. Because worms travel across networks, the firewall acts as the first barrier against them.

Cookies

A cookie is a small file or data packet stored on the client's computer by a website. The name comes from the "magic cookie", a packet of data that a program receives and sends back unchanged. A cookie is edited only by the website that created it, and the user's computer is only the host that stores it. Cookies keep browsing information, such as the items in a shopping cart, login details, language preference or recently viewed pages.

Normally cookies do not infect a computer. The risks are special kinds: supercookies (some malware disguises as these), zombie cookies (recreated after being deleted) and third party cookies (share your data for advertising or tracking, such as showing ads for an item you searched earlier). So be careful when you allow a site to store cookies.

Hackers and crackers

Hackers are people with deep knowledge of computer systems, operating systems, networks and programming. They use it to find loopholes and weaknesses. What separates them is intent.

A hacktivist is a hacker who aims to bring about political and social change.

Beyond the textbook. For the exam: a grey hat is neutral and hacks for fun. In reality: entering a system without permission is an offence under cyber law whatever the intention is. What makes the work of a white hat acceptable is that the owner has authorised the testing.

Network security threats

Denial of Service (DoS). An attacker stops authorised users from reaching a service by overloading it with illegitimate requests, for example by flooding a web server with packets from different IP addresses until it cannot serve genuine users. A server crash can be recovered by a restart, but flooding is hard to recover from because genuine requests are mixed in.

Distributed Denial of Service (DDoS). The flood comes from many compromised computers, called zombies, spread across the world. The attacker installs a malicious program called a bot on each, and the whole network of zombies is a botnet.

Intrusion problems. Network intrusion is any unauthorised activity on a network. Besides DoS, Trojans and worms, three more attacks are listed.

Snooping and eavesdropping. Snooping (also called sniffing) is the secret capture and analysis of network traffic by a program or utility with traffic monitoring capability. The packets are copied and put back, as if nothing happened. If data is not encrypted, it is exposed. Network administrators also use snooping for troubleshooting, and hubs or switches may have a SPAN (Sniffer Port Analyser) port for it. Eavesdropping is the unauthorised real time interception of a private communication, such as phone calls (VoIP), instant messages, video conferences or fax. On old phone lines it was called wiretapping. A laptop or phone with a built in microphone or camera can be hacked using rootkit malware.

Exam traps

60-second revision

Where this chapter connects