Cracking and Computer Security

Size: px

Start display at page:

Download "Cracking and Computer Security"

Lester Hancock
10 years ago
Views:

1 Cracking and Computer Security Ethics and Computing Chapter 4 Summer 2001 CSE 4317: Computer Security 1 Motivation Computer security is crucial for trust Cracking activity is harmful, costly and unethical Legal system is slow to adapt Security measures are mostly effective Many systems don t use them Lack of expertise Inconvenience Summer 2001 CSE 4317: Computer Security 2 1

costly and unethical Legal system is slow to adapt Security measures are mostly effective Many

2 Codes of Ethics AITP Do not exploit the weakness of a computer system for personal gain or personal satisfaction ACM Respect privacy of others Access computers only when authorized Summer 2001 CSE 4317: Computer Security 3 Codes of Ethics IEEE Avoid injuring others, their property, reputation, or employment by false or malicious action Software Engineering Use the property of a client or employer only in ways properly authorized, and with the client s or employer s knowledge and consent Summer 2001 CSE 4317: Computer Security 4 2

their property, reputation, or employment by false or malicious action Software Engineering Use the property of a client or employer

3 Hacking vs. Cracking Traditional Hacker Self-motivated Technically accomplished Creative Productive Positive Summer 2001 CSE 4317: Computer Security 5 Hacking vs. Cracking Unethical Hacker or Cracker Self-motivated Technically accomplished Creative Not productive Not positive Summer 2001 CSE 4317: Computer Security 6 3

Productive Positive Summer 2001 CSE 4317: Computer Security 5 Cracking

4 What is Cracking? Illegitimate use of a computer system Legitimate use You use a valid account assigned for your use by a legitimate administrator of the system Your use is consistent with the established policies for the system Software you create not intended to circumvent established policies Summer 2001 CSE 4317: Computer Security 7 Cracker Activities Trojan horse programs Virus programs Worm programs Logic bomb programs Sniffing Spoofing Flooding Summer 2001 CSE 4317: Computer Security 8 4

administrator of the system Your use is consistent with the established policies for the system Software you create not

5 Trojan Horse Programs Masquerades as a legitimate program Hides unwanted functions Trojan horse login program Can also be self-replicating Summer 2001 CSE 4317: Computer Security 9 Virus Programs Self replicating Means of delivery Downloaded software Floppy disk Web Avoid detection Expand existing code Replace existing code Polymorphic E.g., Melissa Summer 2001 CSE 4317: Computer Security 10 5

Self replicating Means of delivery Downloaded software Floppy disk Email Web Avoid detection Expand

6 Worm Programs Similar to viruses Short-lived Spread via the network Swamp resources E.g., Internet Worm Summer 2001 CSE 4317: Computer Security 11 Logic Bomb Programs Waits for some condition Disrupts normal system operation Summer 2001 CSE 4317: Computer Security 12 6

, Internet Worm Summer 2001 CSE 4317: Computer Security 11 Logic

7 Sniffing and Spoofing Sniffing Monitor network activity for login/password sequences IP spoofing Masquerading as a machine with privileged access to target machine Summer 2001 CSE 4317: Computer Security 13 Flooding Ping flooding Denial-of-service attacks Flooding target machine with bogus traffic to block legitimate traffic SYN (synchronization) flooding Flood target computer with SYN requests whose ACKnowledgement is never returned Summer 2001 CSE 4317: Computer Security 14 7

Denial-of-service attacks Flooding target machine with bogus traffic to block legitimate traffic SYN (synchronization)

8 Who Are Crackers? Profiles Novice Student Tourist Crasher Thief Summer 2001 CSE 4317: Computer Security 15 Novice Crackers Young, emotionally immature Surface-level interest in security Willing to try proven methods, but unlikely to originate new techniques Little thought to consequences Summer 2001 CSE 4317: Computer Security 16 8

Security 15 Novice Crackers Young, emotionally immature Surface-level interest in

9 Student Crackers Serious technical interest in security Desire to experiment with cracker techniques Perceived benign intent of learning or educating Summer 2001 CSE 4317: Computer Security 17 Tourist Crackers Talents of Student Less benign, peeping tom motivation Break in and look around s Databases System tools Other machines Summer 2001 CSE 4317: Computer Security 18 9

Security 17 Tourist Crackers Talents of Student Less benign, peeping tom motivation Break in

10 Crasher High level of technical expertise Motivated by desire to crash system Vandal Desire to create more problems than just crashing system Especially defacing public web pages Summer 2001 CSE 4317: Computer Security 19 Thief Explicit criminal activity Stealing credit card numbers or other valuable data Altering records Summer 2001 CSE 4317: Computer Security 20 10

Summer 2001 CSE 4317: Computer Security 19 Thief Explicit criminal activity Stealing credit

11 Other Cracker Profiles Spy Terrorist Angered ex-employee Spurned suitor Summer 2001 CSE 4317: Computer Security 21 Case Study U.S. vs. Craig Neidorf [1990] Electronic newsletter Phrack Unauthorized access to computer and telecommunications systems Roadmap to 911 phone system Denning article and responses Summer 2001 CSE 4317: Computer Security 22 11

12 Case Study 911 information claimed proprietary Neidorf (16) charged with fraud and theft Hacking phone system or phreaking Defense showed 911 information available to the public Charges dropped Summer 2001 CSE 4317: Computer Security 23 Case Study: Denning Unauthorized access 6 months in prison Unauthorized access with harmful intent 5 years Unauthorized modification 5 years Summer 2001 CSE 4317: Computer Security 24 12

CSE 4317: Computer Security 23 Case Study: Denning Unauthorized access 6 months in prison Unauthorized

13 Responses Parker, SRI Swift punishment Encourage good behavior Levy, author of Hackers: Heroes Crackers, as a whole, beneficial Spafford, Purdue Amount of damage considered in sentencing, not conviction Summer 2001 CSE 4317: Computer Security 25 Responses Rotenberg, CPSR Charges should not have been filed Actions were not directly harmful Bloombecker, NCCCD Crackers reflect our social values Technological competence and impatience with the property rights of others We continue to reward wizardry and ignore ethical behavior Summer 2001 CSE 4317: Computer Security 26 13

should not have been filed Actions were not directly harmful Bloombecker, NCCCD Crackers reflect our social values Technological competence and

14 Responses Stallman, GNU Project Unauthorized access harms no one and should not be a crime Laws against unauthorized access reflect the urge to control, stifling free society Penalties will drive crackers to paranoia and eventually crime Summer 2001 CSE 4317: Computer Security 27 Policies and Laws UTA Computer and Information Technology Usage Policy UTA Network Usage Guidelines Texas Computer Crimes Statute Summer 2001 CSE 4317: Computer Security 28 14

and Laws UTA Computer and Information Technology Usage Policy http://www.uta.edu/uta/wwwteam/citup.html UTA Network Usage Guidelines http://www.

15 Security Measures Risk analysis Identify system weaknesses Audit logs Altered by crackers if kept on disk Firewalls Packet filtering Summer 2001 CSE 4317: Computer Security 29 Security Tools COPS SATAN Tripwire Computer Emergency Response Team (CERT) Summer 2001 CSE 4317: Computer Security 30 15

Computer Security 29 Security Tools COPS SATAN Tripwire Computer Emergency

16 Prevention Better security measures More widespread use of measures Better laws, stiffer penalties Cracking is not cool slogans Education Ethics Summer 2001 CSE 4317: Computer Security 31 Points to Remember Crackers different from hackers Cracker activities are unethical, unprofessional, and usually illegal Legal system is adapting to better handle cracker crimes WWW and e-commerce increase the potential for harm Organizations lax in use of security measures Summer 2001 CSE 4317: Computer Security 32 16

activities are unethical, unprofessional, and usually illegal Legal system is adapting to better handle cracker crimes WWW and

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft) 1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction