Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
University of Waterloo
Textbook Chapter 08
Juliet
Romeo
Contemporary Security
Challenges and Vulnerabilities
The architecture of a Web-based application typically includes a Web client, a server, and corporate
information systems linked to databases. Each of these components presents security challenges and
vulnerabilities. Floods, fires, power failures, and other electrical problems can cause disruptions at any point
in the network.
Figure 8-1
10
FBI
UPS
Order
11
12
Return-Path: hacker@example.ca
This is what address you will send an email to should you "Reply" to an email sent to you
From: TD Customer Service <customer-support@tdcanadatrust.com>
To: to-be-hacked@user.ca
Subject: TD Customer Service Account Update
Date: Thursday, 06 Oct 2011 13:27:26 +0300
Importance: high
This tells what kind of text the email contains, and whether or not it is plain text, HTML
formatted, or another format
Content:
Dear Customer,
We are currently upgrading our system. Please click the following link, log into your
account and verify your information.
http://easyweb.td.com/
Sincerely,
TD Customer Support Group
13
15
16
What happened
Some hacker got control of several hundred UW email accounts and used them to sent mass e-mails
to Hotmail, presumably attempting to crash it.
Hotmail identified the problem (all e-mails from UW
server) and as the only means of defense, rejected
all e-mails from UW accounts
Denial of service to all UW users.
17
the
Webofficial
click robot
@AP,
twitter handle of the respected Associated Press news
http://en.wikipedia.org/wiki/Click_fraud
agency, sent out a message at about 1:07 p.m. ET, saying "Breaking: Two
Cyberterrorism
Cyberwarfare:
Exploitation
Explosions
in the Whiteand
House
and Barack Obama
is Injured." of
The AP
computer
systems
quickly
said it was
hacked. by terrorists or political parties as a
mean of warfare
Killplunged
switch bill
The Dow
more than 140 points and bond yields fell. Within six
Adware
is any
software
package
which
automatically
minutes,
the Dow
recovered
its losses
and was
trading
with triple-digit
downloads,
displays,
or plays
advertisements
to ain the S&P
gains.
Reuters estimated
that the
temporary
loss of market cap
without
500computer,
alone totaledoften
$136.5
billion. users permission and in the
form of pop-up
Spyware
is software that (secretly) installs on a users
Source:
http://www.cnbc.com/id/100646197
machine and collects information about the user without
their knowledge.
Keylogger is a form of spyware
Germanys probe into state use of spyware on people.
19
Replay attack
A valid data transmission is maliciously repeated at
a later time.
Salami attack
How to add smalls into large
20
21
Figure 4-8
22
Figure 4-7
23
Definition:
24
25
26
Authentication
Access Control
Data Confidentiality
Data Integrity
Availability
Non-Repudiation
Two possibilities:
Sender denied sending
Receiver denied receiving
28
29
30
Firewall
Provide authentication and access control
Example: packet filtering firewall, proxy firewall
Antivirus software
Provide data and system integrity, access control
Example: Norton, Trend Micro, AVG etc.
Hardware Controls
Provide authentication, access control, availability
Example: dedicated hardware, smartcard, fingerprint scan,
retina scan, VPN dongle, backup etc
Security software
Service provided depends on type of security software used
(authentication, confidentiality, integrity, access control etc.)
User awareness
Core of any implementation
31
In 2011
http://www.theglobeandmail.com/news/technology
/tech-news/top-25-most-hacked-passwordsrevealed/article2244739/
In 2013
http://newsfeed.time.com/2014/01/20/the-25worst-passwords-of-2013/
32
33
Reactive approach
Need to update frequently and backup data
Proper set up
34
Transformation
based on a key
PHHW PH DIWHU
WKH WRJD SDUWB
35
Key Size
(bits)
Number of
Alternative Keys
Time required at
106 Decryption/s
32
2.15 milliseconds
56
10 hours
128
168
37
Romeo
38
39
40
MD5
http://www.whatsmyip.org/hash_generator/
SHA1
http://www.tech-faq.com/sha-1-generator
http://nsfsecurity.pr.erau.edu/crypto/sha1.html
Interesting tools
http://www.whatsmyip.org/
41
42
eBay first creates a pair of keys, one public key and one private key
It then submits the public key to VeriSign to get a certificate
The certificate contains information about eBay and its public key
VeriSign is the biggest certificate authority
The browser then extracts eBays public key from the certificate.
It then randomly generates a symmetric key and encrypts it using
eBays public key and sends it back to eBay.
Since it is encrypted with eBays public key, it can be decrypted only by eBays private
key.
eBay then decrypts the systematic key with its private key.
Now Romeo and eBay shares a symmetric key and all subsequent
conversation can be encrypted using this symmetric key.
43
44
Drawbacks
High overhead to hide relatively few info bits
Become useless once comprised
45
47
48
Common solutions
Encrypt the transmission!
WEP (not recommended), WPA1 and WPA2
49
Patches
Vendors release small pieces of software to repair flaws
However, the amount of software in use can mean
exploits created faster than patches be released and
implemented
50
Called SOX in US
Internal controls must be put in place to govern
information in financial statements
52
53
54
Authorization Policies
Determine the levels of access for different users
Often based on security profiles
55
Figure 8-4
56
Business measures:
Technical measures:
57
Figure 8-5
59
60