Data Security 1. 1 What is the function of the Jump instruction? 2 What are the main parts of the virus code? 3 What is the last act of the virus?

Transcription

1 UNIT 18 Dt Seurity 1 STARTER Wht stories do you think followed these hedlines? Compre nswers within your group. 1 Love ug retes worldwide hos. 2 Hkers rk Mirosoft softwre odes. 3 We phone sm. Wht other types of omputer rime re there? Mke list within your group. READING Study this digrm whih explins how one type of virus opertes. Try to nswer these questions. 1 Wht is the funtion of the Jump instrution? 2 Wht re the min prts of the virus ode? 3 Wht is the lst t of the virus? ORIGINAL strting instrution UNINFECTED PROGRAM INFECTED PROGRAM JUMP instrution MISDIRECTION routine REPRODUCTION routine TRIGGER routine VIRUS CODE PAYLOAD routine Fig 1 How virus infets progrm originl strting instrution, plus ode to return ontrol to the progrm s originlly written

2 Sn this text to hek your nswers to Tsk 3. Ignore ny prts whih do not help you with this tsk. THE ANATOMY OF A VIRUS A iologil virus is very smll, simple orgnism tht infets living ells, known s the host, y tthing itself to them nd using them to reprodue itself. This often uses hrm to the host ells. Similrly, omputer virus is very smll progrm routine tht infets omputer system nd uses its resoures to reprodue itself. It often does this y pthing the operting system to enle it to detet progrm files, suh s COM or EXE files. It then opies itself into those files. This sometimes uses hrm to the host omputer system. When the user runs n infeted progrm, it is loded into memory rrying the virus. The virus uses ommon progrmming tehnique to sty resident in memory. It n then use reprodution routine to infet other progrms. This proess ontinues until the omputer is swithed off. The virus my lso ontin pylod tht remins dormnt until trigger event tivtes it, suh s the user pressing prtiulr key. The pylod n hve vriety of forms. It might do something reltively hrmless suh s displying messge on the monitor sreen or it might do something more destrutive suh s deleting files on the hrd disk. When it infets file, the virus reples the first instrution in the host progrm with ommnd tht hnges the norml exeution sequene. This type of ommnd is known s JUMP ommnd nd uses the virus instrutions to e exeuted efore the host progrm. The virus then returns ontrol to the host progrm whih then ontinues with its norml sequene of instrutions nd is exeuted in the norml wy. To e virus, progrm only needs to hve reprodution routine tht enles it to infet other progrms. Viruses n, however, hve four min prts. A misdiretion routine tht enles it to hide itself; reprodution routine tht llows it to opy itself to other progrms; trigger tht uses the pylod to e tivted t prtiulr time or when prtiulr event tkes ple; nd pylod tht my e firly hrmless joke or my e very destrutive. A progrm tht hs pylod ut does not hve reprodution routine is known s Trojn. Now red the whole text to find the nswers to these questions. 1 How re omputer viruses like iologil viruses? 2 Wht is the effet of virus pthing the operting system? 3 Why re some viruses designed to e loded into memory? 4 Wht exmples of pylod does the writer provide? 5 Wht kind of progrms do viruses often tth to? 6 Mth eh virus routine to its funtion. Routine Funtion 1 misdiretion 2 reprodution 3 trigger 4 pylod d does the dmge tthes opy of itself to nother progrm hides the presene of the ode deides when nd how to tivte the pylod 7 How does Trojn differ from virus?

3 126 UNIT 18 Dt Seurity 1 LANGUAGE WORK Wht is the reltionship etween these tions? 1 A dte or event ours. 2 The trigger routine runs. 3 The pylod routine tivtes. 4 The hrd disk is wiped. These events form prt of use nd effet hin. We n desrie the links etween eh event in numer of wys: Using use + to V or mke + V. 1 A dte or event ours whih uses the trigger routine to run. te or event ours whih mkes the trigger routine run. Putting the events in sequene nd using ustive ver. 3 The trigger routine runs, whih tivtes the pylod routine. Using when luse. 4 When the trigger routine runs, the pylod routine tivtes. Desrie the effets of these viruses nd other destrutive progrms. 1 logi om-exmple A dismissed employee's nme is deleted from the ompny's pyroll. A logi om is tivted. All pyroll reords re destroyed. 2 Form (Boot setor virus) A ertin dte ours. A trigger routine is tivted. Keys eep when pressed nd floppies re orrupted. 3 Beijing (Boot setor virus) The opertor strts up the omputer for the one hundred nd twenty-ninth time. A trigger routine is tivted. The sreen displys, 'Bloody! June 4,1989'. 4 AntiEXE The infeted progrm is run. The oot setor is orrupted. The disk ontent is overwritten. d Dt is lost.

4 UNIT 18 Dt Seurity Csde (File virus - COM files only) A prtiulr dte ours. The pylod is triggered. Chrters on text mode sreen slide down to the ottom. 6 mro virus-exmple An infeted doument is opened in the word proessor. The virus mro is exeuted. The virus ode is tthed to the defult templte. d The user sves nother doument. e The virus ode tthes to the sved doument. f The sved doument is opened in the wordproessor. g The virus destroys dt, displys messge or plys musi. Some vers eginning or ending with en hve ustive mening. Reple the words in itlis in these sentenes with the pproprite form of en ver from this list. enle enrypt ensure enode enhne righten enourge enlrge widen 1 A MIDI messge mkes sound into ode s 8-it ytes of digitl informtion. 2 The teher is using new progrm to give ourge to hildren to write stories. 3 The new version of SimCity hs een mde etter in mny wys. 4 A gtewy mkes it possile for dissimilr networks to ommunite. 5 You n onvert dt to seret ode to mke it seure. 6 Mke sure the mhine is disonneted efore you remove the se. 7 Designers n offer good ides for mking your wesite righter. 8 Eletroni reders llow you to mke the print size lrger. 9 Progrmmers write softwre whih mkes the omputer le to rry out prtiulr tsks. 10 You n mke the piture on your monitor wider.

5 128 UNIT 18 Dt Seurity 1 PROBLEM-SOLVING Deide in your group wht these kinds of omputer rime re. Then mth the rimes to the short desriptions whih follow. 1 Slmi Shving 2 Denil of Servie ttk 3 Trojn Horse 4 Trpdoors 5 Mil oming 6 Softwre Piry 7 Piggyking 8 Spoofing 9 Defing 10 Hijking d e f g h i j Leving, within ompleted progrm, n illiit progrm tht llows unuthorised - nd unknown - entry. Using nother person's identifition ode or using tht person's files efore he or she hs logged off. Adding oneled instrutions to omputer progrm so tht it will still work ut will lso perform prohiited duties. In other words, it ppers to do something useful ut tully does something destrutive in the kground. Triking user into reveling onfidentil informtion suh s n ess ode or redit-rd numer. Inundting n emil ddress with thousnds of messges, therey slowing or even rshing the server. Mnipulting progrms or dt so tht smll mounts of money re deduted from lrge numer of trnstions or ounts nd umulted elsewhere. The vitims re often unwre of the rime euse the mount tken from ny individul is so smll. Unuthorised opying of progrm for sle or distriuting to other users. Swmping server with lrge numers of requests. Redireting nyone trying to visit ertin site elsewhere. Chnging the informtion shown on nother person's wesite.

6 UNIT 18 Dt Seurity SPEAKING Work in pirs, A nd B. You oth hve detils of reent omputer rime. Find out from your prtner how his/her rime operted nd its effets. Tke notes of eh stge in the proess. Student A Your omputer rime is on pge 187. Student B Your omputer rime is on pge 193. WRITING Using your notes from Tsk 9, write n explntion of the omputer rime desried y your prtner. When you hve finished, ompre your explntion with your prtner's detils on pge 187 or 193. WHEN YOU HAVE FINISHED THE READING SECTION ON THE FOLLOWING PAGES, COME BACK TO THESE ADDITIONAL EXERCISES 3 Mrk eh of the following sttements with True or Flse: A messge enrypted with puli key n e derypted y nyone. To send seure messge you must know the reipient's puli key. Seure messges re normlly enrypted using privte key efore they re sent. d A messge n e reonstruted from its MAC. e Two messge n often hve the sme MAC. f A digitl ertifite is sent to lient in n enrypted form. g A digitl ertifite should e signed y trusted digitl-ertifite issuer. h A MAC is used to hek tht messge hs not een tmpered with. 4 Put the following sentenes, out sending seure emil, in the orret order: d The messge is derypted with the reipient's privte key. The messge is reeived y the reipient. The messge is enrypted with the reipient's puli key. The messge is sent y the sender.

7 130 UNIT 18 Dt Seurity 1 SPECIALIST READING B Flnd the nswers to these questions in the following text. 1 Wht does dt enryption provide? privy integrity uthentition 2 A messge enrypted with the reipient's puli key n only e derypted with the sender's privte key the sender's puli key the reipient's privte key 3 Wht system is ommonly used for enryption? 4 Wht is the opposite of 'enrypt'? 5 A messge-digest funtion is used to: uthentite user rete MAC enrypt messge 6 Wht informtion does digitl ertifite give to lient? Sfe Dt Trnsfer Seure trnstions ross the Internet hve three gols. First, the two prties engging in trnstion (sy, n emil or usiness purhse) don't wnt third prty to e le to red their trnsmission. Some form of dt enryption is neessry to prevent this. Seond, the reeiver of the messge should e le to detet whether someone hs tmpered with it in trnsit. This lls for messge-integrity sheme. Finlly, oth prties must know tht they're ommuniting with eh other, not n impostor. This is done with user uthentition. Tody's dt enryption methods rely on tehnique lled puli-key ryptogrphy. Everyone using puli-key system hs puli key nd privte key. Messges re enrypted nd derypted with these keys. A messge enrypted with your puli key n only e derypted y system tht knows your privte key. For the system to work, two prties engging in seure trnstion must know eh other's puli keys. Privte keys, however, re losely gurded serets known only to their owners. When I wnt to send you n enrypted messge, This shows the omplex proess tht's required to send dt seurely ross open ommunition lines while stisfying the three si tenets of seure trnsfer: dt enryption, interferene prevention, nd user uthentifition. Puli Sender Messgedigest funtion Messgeuthentition ode 1 The sender tkes doument nd produes messgeuthentition ode (MAC) using messge-digest funtion. 2 The sender enrypts the MAC with their privte key. 3 The sender tthes the enrypted MAC to the doument nd enrypts oth with the reipient's puli key. 4 When the reipient reeives the doument, they n derypt it with their privte key. Sender 5 The reipient produes lol opy of the doument's MAC using the sme messge-digest funtion the sender used. Reipient Reipient 7 The reipient ompres its lol opy of the MAC to the sender's unenrypted MAC. If the two mth, then the reipient 6 The reipient derypts the sender's knows the doument hsn't een tmpered with nd tht only MAC using the sender's puli key. the sender ould hve reted the originl messge.

8 UNIT 18 Dt Seurity I use your puli key to turn my messge into gierish. I know tht only you n turn the gierish k into the originl messge, euse only you know your privte key. Pulikey ryptogrphy lso works in reverse - tht is, only your puli key n deipher your privte key's enryption. To mke messge tmper-proof (providing messge integrity), the sender runs eh messge through messge-digest funtion. This funtion within n pplition produes numer lled messge-uthentition ode (MAC). The system works euse it's lmost impossile for n ltered messge to hve the sme MAC s nother messge. Also, you n't tke MAC nd turn it k into the originl messge. The softwre eing used for given exhnge produes MAC for messge efore it's enrypted. Next, it enrypts the MAC with the sender's privte key. It then enrypts oth the messge nd the enrypted MAC with the reipient's puli key nd sends the messge. When the reipient gets the messge nd derypts it, they lso get n enrypted MAC. The softwre tkes the messge nd runs it through the sme messge-digest funtion tht the sender used nd retes its own MAC. Then it derypts the sender's MAC. If the two re the sme, then the messge hsn't een tmpered with. The dynmis of the We ditte tht useruthentition system must exist. This n e done using digitl ertifites. A server uthentites itself to lient y sending n unenrypted ASCII-sed digitl ertifite. A digitl ertifite ontins informtion out the ompny operting the server, inluding the server's puli key. The digitl ertifite is 'signed' y trusted digitlertifite issuer, whih mens tht the issuer hs investigted the ompny operting the server nd elieves it to e legitimte. If the lient trusts the issuer, then it n trust the server. The issuer 'signs' the ertifite y generting MAC for it, then enrypts the MAC with the issuer's privte key. If the lient trusts the issuer, then it lredy knows the issuer's puli key. The dynmis nd stndrds of seure trnstions will hnge, ut the three si tenets of seure trnstions will remin the sme. If you understnd the sis, then you're lredy three steps hed of everyone else. B Re-red the text to find the nswers to these questions. 1 Mth the funtions in Tle 1 with the keys in Tle 2. Tle 1 to enrypt messge for sending to derypt reeived messge to enrypt the MAC of messge d to enrypt the MAC of digitl signture Tle 2 i ii iii sender's privte key trusted issuer's privte key the reipient's privte key iv the reipient's puli key 2 Mth the terms in Tle A with the sttements in Tle B. Tle A d e f Gierish Impostor Deipher MAC Tenets Tmper Tle B i ii iii Messge-uthentition ode Prinipl fetures Meningless dt iv Person pretending to e someone else v vi Mke unuthorised hnges Convert to meningful dt Additionl exerises on pge 129 [Jeff Downey, 'Power User Tutor', PC Mgzine, August 1998]