Lecture about network and host security to NII students

Editor's Notes

• #3: Do you remember Y2K problem? about fifteen years ago. It is said that date function of many computers include embedded microprocessors will become faulty at midnight of the last day of 1999. At that time, in many computer programs, only two digits were provided to store year part of date and time data for saving computer memory usage. At the midnight, 99 will change to 00, and and it was believed that it will cause logical error in many computer programs. But nothing happened. There and then, we have had many attacks and password cracking trying to get control of networked computers.
• #4: Today I will talk about these topics. At first I’ll present a few basic concepts in computer and network security.
• #5: English is very convenient, because we can distinguish the difference between a term “internet” or “internetworking” and the Internet. A term internet or internetworking means an idea or concept of connecting computer networks. On the other hand, A proper noun, the Internet is a global network made by connecting existing smaller IP networks. The Internet is not Web system nor Web browsing. The Internet is an infrastructure of these applications. We can see and buy movies, musics through the Internet. Television sets, Video recorders, air conditioners are now connected to the Internet and controlled through the Internet. But these become another security risk.
• #6: CIA of the keyword of security. C for confidentiality. Avoid sniffing of confidential information. Limits accessing to the confidential information. Integrity keep tracking of changes.
• #8: Now I show you current trends and topics about IT security. Last year, severe bugs and defects were found in basic software or protocols to which the Internet depends on.
• #26: Malware is a generic name of software which is installed without consent and harms computers. Current malware becomes complicated and has many functions. So they aren’t suit to these classification.
• #27: Old computer viruses displays messages or simple animations on the screen of PC. Those are developed by developers’ technical interests to demonstrate their technical capabilities. For the reason, old style viruses are very active to copy them to other files or other systems. So such viruses can be easily found by monitoring infected systems’ behavior or network traffic. However, current viruses do their functions quietly to avoid disclosure, update themselves through network. They may be part of so called bot nets. It is thought that anti-virus softwares can find only 70% of existing viruses. New viruses are increasing daily. One can buy viruses or virus generation tools from markets. It is said that the cost of a virus is several hundred yens. CodeRed and Nimda were notable ones.
• #28: Worm is a program replicating itself to another system by using security holes. It may have payloads. Major payload program of worm is “backdoor” program. When backdoor program is installed, it reports the IP address of the infected computer to the developer of the worm and wait commands from her or she. The Slammer and Blaster were known.
• #29: Trojan horse is named after the Greek myth. A trojan horse seems like a useful program but malicious codes are in it. This types of software does not have an ability of self replication nor infection like viruses or worms.
• #30: A spyware is a software for spying the system to which it was installed. An adware display advertisements to screen. This type of software is malicious only when it is installed without consumers’ consent. Many free software does such activity. But we can use such software in spite of giving our private information or accepting advertisements. So it is free. Many softwares for smart phone have such ability also. Of course, good developers of such software declares that what his/her software does.
• #31: Have you ever seen a red of yellow alert popping up during web surfing? Such alert informs you that your system is found infected or needs garbage collection, and recommends to download and install a software. Ransomware is a software which limits the accessibility to the computer which it infect. And requests ransom paid to the developer of the software to remove limitation it sets. Cryptware is a kind of ransomware. It encrypts files in the system which it infect. And demands money to decode encrypted files. But it is lucky you get control of your computer back by paying. To avoid this type of software, do neglect such pop up alerts.
• #32: Animals are gathering to the watering hole for drinking water. Lion may catch preys there easily by waiting there.
• #33: This type of attack is prepared carefully and precisely. Attackers first get control of web sites where victims often visit. Then they set malware to push to the victims browsers when they visit those sites again. Such malware is crafted and customized to fit into the victims' culture, so it is very difficult to find it by ordinary anti-malware. Such targeted attacks are called as spear attack.
• #34: GOM Player is a popular software for viewing video contents. It can handle many types of video format. The distribution site was compromised and contaminated files were placed there. The EmEditor is quite useful text editor. When the software is started, it makes an access to the site, whether software updates are available or not. The attacker uses this function to install malware. I heard that none of users are infected because the malware was designed to work only when accesses come from only a few sites.
• #36: Software has bugs. Some bugs cause severe security problems. Such bug is called Security hole. So bug fix is necessary to keep system’s safety and soundness. Microsoft releases software update on every second Tuesday. The day is called the black Tuesday. In Japan, it’s Wednesday. But do not try to update on that day. Windows Update may cause troubles, because of updates may have bugs. Latest Windows update which released in last December cause hang up on many computers. Recovery from troubles in software update is a hard task. So wait several days or a week before the update.
• #37: Complete bugless software does not exist.
• #39: The IP address of the routers are same. I left my office to go home. When I came back home and connected my computer to my home LAN, a red alert pop ups to tell that my home router is cracked. And the software tells that it blocks all network connections. The reason is simple, but I can’t find the way to unlock the situation. So I should uninstall the software.
• #40: Update of the “firefox” browser is often. When she started the firefox, and it told her that the update was available. So, she did that update. Next time, she started the firefox, she saw a pop up alert displayed by her anti-virus software. It told that the browser was modified lately and possible poisoning of the software. We may click “yes” to such query, because almost such queries expect “yes” by default. But in this case, she should select “No” button to continue using the firefox browser. Our default action, clicking “yes”, to any query may harm.
• #41: “Request policy” is a tool to avoid off-site javascript like “google search”, “google analytics”, “double click”, and so on. Allowing such script may cause privacy problems or security problems. A cookie or cookies may be extracted when browsing such site.. .
• #45: If
• #46: If your system is infected by malware, stop using the system and call to consult the appropriate person. If your organization provides the incident handling guideline, you should follow the procedure on it.
• #48: Software updates by the manufacturer sometimes cause system trouble like blue screen. In such case, you should recover your system from so called “Safe mode”. If the system is coming up, we are very lucky. On Windows, we can use “System Restore” to undo the changes made on the system. On Mac, “Time machine” is helpful.