Basic Computer Security Sankardas Roy Department of Computing and Information Sciences Kansas State University.

Basic Computer Security

Sankardas RoyDepartment of Computing and Information Sciences

Kansas State University

Acknowledgement

Most of the slides and demonstration were prepared by

Professor Xinming (Simon) OuDepartment of Computing and Information Sciences

Kansas State University

2

We all hear of computer malware

• Viruses, Worms, Bots, Rootkits, Spyware, …– Malware is a computer program with malicious

intent (Malicious-softWare)

• But how do they get onto your computer?

3

First path: You installed them!

• Common-sense Test 1:– You got an email with the subject line: “You

received a greeting card from Hallmark!”, and an attachment file “Card.jpg .exe”.

– Should you open the attachment?

4

First path: You installed them!

• Common-sense Test 2:– You browsed to the website of company A and

wanted to watch a video posted there. When you clicked the link, a window popped up which said : “In order to view this movie, you need to install the Wonderful video player provided by company A.”, and there were two buttons bellow: “Install” and “Cancel”.

– Which button would you click?

5

First path: You installed them!

• Common-sense Test 3:– You wanted to install a free PDF printer driver

found on the Web. At the beginning of the installation, a license agreement dialog popped up and there is this sentence in the agreement: “In installing this software, you agree that a browser toolbar will be installed which will collect certain usage information…”.

– Do you want to agree to the EUL?

6

Key Points

• When you run a program, you are essentially giving out everything you can do on your computer to the program– It is like giving someone the key to your house,

and wait for him to return the key to you when he is done!

7

Second Path: You are hacked!

• Common-sense Test 4:– You got an email with the subject line: “You

received a greeting card from Hallmark!”, and an attachment file “Card.jpg”.

– Should you open the attachment?

8

Second Path: You are hacked!

• Common-sense Test 5:– In light of the death of Michael Jackson, you

searched the Web for his songs. You found one at a website with a link to a music file which can be opened by your music player.

– Shall you open the music file?

9

Second Path: You are hacked!

• Common-sense Test 6:– You went to a website, on which there is a link to

something you are interested in. – Shall you click on that link?

10

Key Points

• You can get malware even without invoking a malicious executable file– There may be vulnerabilities in your computer’s

software—operating system or applications– Software vulnerabilities can be exploited when

exposed to malicious input• If a vulnerable but otherwise benign program

receives a malicious input, it can cause malicious code to be executed with your privilege

11

Explanation with an Example• Browser (e.g. IE from Microsoft) is a program

– runs on your computer when you open a page– browser may not have any malicious intent

• The webpage (e.g. CIS 490 home page) which you browse works as an input to IE– this is typically a .html/.htm file– this may contain the attacker’s script

• If your browser tries to open the above page– your computer can be compromised– the attacker can control your computer now

12

Attack Demo: A Sketch Diagram

13

Attacker’s machine Victim’s machine

webserver browser

listening agent bot

webpage

Demonstration

Drive-by Download• What you have just seen is called “drive-by download”

– Your computer gets compromised while browsing the Web through a vulnerability in the browser, one of its plugins, or some other program that is invoked automatically on downloaded files

• A successful exploit gives an attacker full privilege on a computer, which can enable him to– change your computer’s settings– install other malicious programs– steal your personal information– use your computer to attack other computers– and many more…

15

Perhaps we shall stay at “good” websites?

Provos, et al., 20081.3% of the incoming search queries to Google’s search engine returned at least one malicious URL in the result page.

16

How about anti-malware software?

Provos, et al., 2008

17

The difficulty of detecting malware

• Theoretical concern: – There can be no general mechanized process for

determining what a piece of code may do

• Implication for us:– There is a bound on how well we can detect

malicious content

18

Total #vulnerabilities reported in NVD

19

What we can do to reduce the risk

• Keep your firewall on• Keep your software up-to-date

– do not browse the web until you have updated your system

• Having some anti-malware system could help reduce the attack surface– but do not think you are safe and can do whatever

you want• Every end user needs to take part!

20

Firewall

21

• What is a firewall?– a tool which can control the incoming and

outgoing network connections of a computer

• What does it protect the computer from?– mainly remote attackers

• How to make the firewall ON? – this may depend on the OS– we will briefly discuss it for Windows – will briefly discuss it for Mac too

Configuring the Firewall on Windows: Part I

22

Configuring the Firewall on Windows: Part II

23

Configuring the Firewall on Mac: Part I

24

Configuring the Firewall on Mac: Part II

25

Configuring Firewall on Mac: Part III

26

Configuring Firewall on Mac: Help Center

27

Updating Software• Types of software

– Operating System (Windows, Mac) – Other software (e.g. Adobe Flash, Java, etc.)

• Why update– vendors fix recent bugs and release update

• How to get the update– nowadays OS updates itself (requires reboot)– other software shows the user “update request”

and may require reboot – you should not delay the update

28

Windows: Managing Updates

29

Mac: Managing Updates

30

Mac: Checking the Available Updates

31

Get an Anti-virus Running• You may get Trend Micro anti-virus free

– from the KSU ITS website• Install an antispyware tool

– Windows Defender/MSE is free from Microsoft– Defender is installed by default in Windows 7

• The anti-virus should regularly update itself– to get the new attack signatures from the vendor– this requires your computer to have an Internet

connection• It should always run in the background

– also should periodically scan the whole computer 32

An Anti-virus for Windows: MSE

33

Checking the Update Status of MSE

34

Another Anti-virus: Windows Defender

35

Windows General Security Options

36

Windows: Changing the Account Password

37

Windows: User Account Control Settings

38

Mac General Security Options: Part I

39

Mac General Security Options: Part II

40

The Autorun Problem of Windows OS• Another common-sense test: Say you have got a USB

flash drive (a.k.a. jump/pen/thumb drive) from someone. – You are told that the media has some valuable information,

music, video, e-book, etc.– Shall you hook the drive into your computer to see what the

content is?• Caution: Just hooking the drive can install a malware in

your computer without your notice

41

How to disable the Autorun Feature• You should disable Autorun in Windows XP

– It can be done by updating the registry (regedit4)

• Microsoft has disabled Autorun in Windows 7

• Mac does not have Autorun feature

• Reference for more information: http://blogs.computerworld.com/

the_best_way_to_disable_autorun_to_be_protected_from_infected_usb_flash_drives

42

Summary• We discussed a few computer security problems• Also discussed the common countermeasures• Reminder: Homework 1 is due

– before the next week’s class (1 pm on Jan 31)– You can submit electronically at k-state online

• Next class (Jan 31) will be held in Room 127

43