ECT 250: Survey of e-commerce technology Security.

ECT 250: Survey of e-commerce technology

Security

2

• Computer security is the protection of assets fromunauthorized access, use, alteration, or destruction.

• There are two types of security:– Physical security including such devices as

alarms, fireproof doors, security fences, vaults.– Logical security is non-physical protection.

• A threat is an act or object that poses a danger to computer assets.

• A countermeasure is a procedure, either physical orlogical that recognizes, reduces, or eliminates a threat.

Terminology

3

The countermeasure will depend both on the costassociated with the threat and the likelihood thatthe threat will occur.• High probability, low impact: Contain and control• High probability, high impact: Prevent• Low probability, low impact: Ignore• Low probability, high impact: Insurance or backup

Example: CTI computer systems under threat from(1) virus, (2) fire, (3) earthquake, (4) theft

Risk analysis

4

• Physical threats– Natural phenomena: Earthquake, storm, tornado– Arson, electrical shutdown, power surge– Theft, sabotage

• Logical threats– Impostors– Eavesdroppers– Thieves

Types of threats

5

• SecrecyProtecting against unauthorized data disclosure, and ensuring the authenticity of the data source.Example: Use of stolen credit card numbers

• IntegrityPreventing unauthorized data modification.Example: Changing of an e-mail message

• NecessityPreventing data delays or denials.Example: Delaying a purchase order for stock

Security terminology

6

• Any organization concerned about protecting itse-commerce assets should have a security policy.

• A security policy is a written statement describingwhat assets are to be protected, why they are to beprotected, who is responsible for that protection,and which behaviors are acceptable and not.

• The policy should address physical security, networksecurity, access authorizations, virus protection,and disaster recovery.

Security policy

7

• Early computer security measures:– Computers were kept in locked central rooms– Access was granted only to select individuals– No one could remotely access the machine

• Modern systems are more complex:– Remote processing– Electronic transmission of information– Widespread use of the Internet

History

8

E-commerce security is best studied by examining the overall process, beginning with the consumerand ending with the commerce server.

This analysis produces a three part structure:1. Client security2. Communication channel security3. Server security

First, however, we will consider issues surroundingcopyright and intellectual property.

E-commerce threats

9

• Copyright is the protection of expression and ittypically covers items such as books, essays,music, pictures, graphics, sculptures, motionpictures, recordings, architectural works.

• Intellectual property is the ownership of ideasand control over the representation of thoseideas.

• The U.S. Copyright Act of 1976 protects itemsfor a fixed period of time. Each work isprotected when it is created. A copyrightnotice is not necessary.

Copyright and IP

10

The widespread use of the Internet has resulted in anincrease in intellectual property threats.• It is very easy to reproduce an exact copy of anything

found on the Internet.• Many people are unaware of copyright restrictions

protecting intellectual property.• See Intellectual Property Resources on the Internet.• A related issue is cybersquatting which is the practice

of registering a trademark of another company as adomain name.

Threats

11

• Enforcing existing copyright laws can be difficult.• Some methods for protecting digital IP include:

– Digital copyright laws– Electronically locking files– Digital watermarks

Protecting copyrights and IP

12

• Steganography is the practice of hiding informationwithin other information.Example: “See everyone? Lucky Larry!”What does it mean?

• Example of conventional watermark: $20 bill• A digital watermark is a digital code or stream

embedded into a file. They do not affect thequality of the file and may be undetectable.

• The presence of a watermark can indicate that thefile was stolen.

Digital watermarks

13

E-commerce security is best studied by examining the overall process, beginning with the consumerand ending with the commerce server.

This analysis produces a three part structure:1. Client security2. Communication channel security3. Server security

Outline

14

Secrecy• The prevention of unauthorized information

disclosure.• A technical issue involving physical and logical

mechanisms.• Example: Encryption of e-mail.Privacy • The protection of individual rights to non-disclosure.• The law enforces privacy protection.• Example: Employers reading employees’ e-mail.

See: E-lessons in the Chicago Tribune

Secrecy vs. privacy

15

• Cookies are files that store identifying informationabout clients for the purposes of personalization.See The Cookie FAQ for more information.

• Malicious programs can read cookies to gain privateinformation. Many sites do not store sensitivedata in cookies.

• Cookies are not inherently bad, but it is wise to learnabout them. Software exists that enables you to identify, manage, display, and eliminate cookies.See Cookie Crusher, and Cookie Pal.

Cookies

16

• Since many Web sites gather information aboutvisitors to their sites, you are constantly givingaway information such as your IP address.

• There are portals that allow you to surf the Webanonymously by visiting their portal first.

• Their site acts as a firewall, preventing any leaksin information.

• Example: Anonymizer.com

Anonymous browsing

17

• Malicious code is a program that causes damageto a system.

• Malicious code can affect both the server and theclient. Typically servers engage in much morethorough detection and disinfection.

• Examples: Virus or worm Trojan horses Malicious mobile code in active content

Client threats

18

• Macro virus (Anna Kournikova)– 75-80% of all viruses– Application specific– Spread through e-mail attachments

• File-infecting virus– Infects executable files (.com, .exe, .drv, .dll)– Spread through e-mail and file transfer

• Script viruses (ILOVEYOU)– Written in scripting languages (VBScript,

JavaScript)– Activated by clicking a .vbs or .js file

Viruses

19

• Viruses are often combined with a worm.• A worm is designed to spread from computer to

computer rather than from file to file.• A worm does not necessarily need to be activated

by a user or program for it to replicate.• Example: ILOVEYOU virus was both a script

virus and a worm that propagated by sendingitself to the first 50 people in a user’s MicrosoftOutlook address book.

Worms

20

• Malicious active content may be embedded into a seemingly innocuous Web page.

• A Trojan horse is a program hidden inside another program or Web page that masks its true purpose.

• Origin of the name?

Trojan horse programs

21

Active content

• Active content, programs embedded in Web pages,can be a threat to clients.

• Active content displays moving graphics, downloadsand plays audio, places items into shopping carts,computes the total invoice amount, etc.

• Active content can be implemented in a variety ofways:– Java– JavaScript– ActiveX

22

• Java is a high-level, object-oriented programminglanguage developed by Sun Microsystems.

• It was created for embedded systems, but its mostpopular use has been in Web pages where appletsimplement client-side applications.

• Java is platform independent.• It reduces the load on servers by downloading work

onto the client’s machine.

Java

23

• To counter security problems, a special securitymodel called the Java sandbox was created.

• The Java sandbox confines Java applet actions toa set of rules defined by a security model.

• These rules apply to all untrusted Java applets,those that have not been proven to be secure.

• The sandbox prevents applets from performing file input or output and from deleting files.

• All applets from a local file system are trustedand have full access to system resources.

Java sandbox

24

• JavaScript is a scripting language developed byNetscape to enable Web page designers to buildactive content.

• When you download embedded JavaScript codeit executes on your machine. It does not operateunder the sandbox model.

• For this reason it can invoke privacy and integrityattacks by destroying your disk, copying credit card numbers, recording the URLs of pages you visit, etc. Secure connections do not help.

• JavaScript programs must be explicitly run.

JavaScript

25

• ActiveX is an object that contains programs andproperties that Web designers place on pagesto perform certain tasks.

• ActiveX controls only run on Windows machines.• When embedded ActiveX controls are downloaded,

they are run on the client machine.• Examples: Flash, Shockwave• Once downloaded, ActiveX controls have access to

system resources, including the operating system.

ActiveX controls

26

Graphics:• Some graphics file formats have been designed to

contain instructions on how the graphic is to berendered.

• Code embedded into the graphic is a potential threat.Plug-ins:• A browser plug-in is a program that enhances the

capabilities of the browser. They handle things likeplaying audio clips and displaying movies.

• Many plug-ins work by executing commands buriedwithin the media they are displaying.

Graphics and plug-ins

27

The primary task in protecting a client machine isthe monitoring of active content. Each browserhandles this in a different way.

The primary issue is trust of the site providing theactive content.

One way to improve trust is through the use of digital certificates.

Protecting client computers

28

• A digital certificate, or digital ID, is an attachmentto a Web page or e-mail message verifying theidentity of the creator of the page/message.

• It identifies the author and has an expiration date.• A page or message with a certificate is signed.• The certificate is only a guarantee of the identity of

the author, not of the validity of the page/code.• Certificates are obtained from a Certificate Authority

(CA) that issues them to an individual or anorganization. Example: VeriSign

• Identification requirements vary.

Digital certificates

29

• Provides content warnings• Reacts to ActiveX and Java-based content• Uses Microsoft Authenticode technology that:

– Verifies who signed the code– Checks if the code has been modified since

it was signed• If a publisher has not attached a code you can

set the browser to not download the page.• It is up to you to designate which companies you

trust using “zones”.

Security in Internet Explorer

30

• When a page with a certificate is downloaded:– The certificate is detached– The identity of the CA is verified– The integrity of the program is checked

• A list of trusted CAs is built into the browser alongwith their public keys.

• Both the certificate and the key must match.

Authenticode

31

• You can specify different security settings basedon the origin of the information being downloaded.

• There are four zones: – Internet: Anything not classified in another way– Local intranet: The internal network– Trusted sites– Restricted sites: Web sites you do not trust

Security zones

32

• High: Safer but less functional; less secure featuresare disabled; cookies are disabled.

• Medium: Safe but functional browsing; promptsbefore downloading potentially unsafe content; unsigned ActiveX will not be downloaded.

• Medium-low: Downloads everything with prompts;most content will be run without prompts; unsignedActiveX will not be downloaded.

• Low: Minimal safeguards; most content will bedownloaded and run without prompts; all activecontent can be run.

Security levels

33

• The Custom Level button allows you to alter thedefaults provided by a specific level.

• All protections are a choice between running andnot running active content.

• No monitoring of code occurs during execution.

Security settings

34

• You can control whether active content (Javaor Javascript) will be downloaded.

• This is done using the Preferences dialog box.• On the Advanced tab you can specify what

should be done for images, Java, JavaScript,style sheets, and cookies.

• A message will be sent when Java or JavaScriptis downloaded indicating whether the contentis signed. A risk assessment is given.

Netscape Navigator

35

E-commerce security is best studied by examining the overall process, beginning with the consumerand ending with the commerce server.

This analysis produces a three part structure:1. Client security2. Communication channel security3. Server security

Outline

36

• The Internet was designed for redundancy, notsecure communications. The DOD intended toencrypt all information moving in the network.

• The Internet remains in its insecure state.• It is impossible to guarantee that every computer

through which information passes is safe, secure,and non-hostile.

• The possible security violations include secrecy, integrity, and necessity threats.

Communication channel threats

37

• E-mail transmissions can be compromised by thetheft of sensitive or personal information.

• Sniffer programs record information as it passesthrough a particular router.

• This can capture:– Passwords– Credit card numbers– Proprietary corporate product information

Sniffer programs

38

• An integrity threat is also called active wiretapping.• This occurs when an unauthorized party alters a

message in a stream of information.• Cyber vandalism is the electronic defacing of an

existing Web site’s page. This occurs when anindividual replaces content on the site.

• Masquerading or spoofing occurs when perpetratorssubstitute the address of their site for a legitimatesite and then alter an order or other informationbefore passing it along.

Integrity threats

39

• Also known as delay or denial threats, the purposeis to disrupt or deny normal processing.

• Slowing processing can render a service unusable.

• The most famous example of a denial attack is theRobert Morris Internet Worm attack, perpetratedin 1988.

Necessity threats

40

• Since the Internet is inherently insecure, anysecret information must be encrypted.

• Encryption is the coding of information usinga program and a key to produce a string ofunintelligible characters.

• The study of encryption is called cryptography.The name comes from krupto (secret) andgrafh (writing).

• Cryptography is not related to steganography.

Encryption

41

• Unencrypted data is called plaintext.• Encrypted data is called ciphertext.• A key is a string of digits that acts as a password.• Only the intended receivers should have the key

that transforms the ciphertext into plaintext.• A cipher or cryptosystem is a technique or

algorithm for encrypting messages.• Cryptographic ciphers have a long history.

Terminology

42

• Ciphers were used as far back as the ancientEgyptians. Text was encrypted by hand.

• The two main types of ciphers were used:– Substitution cipher: Every occurrence of a

given letter is replaced by a different one.Example: “a” by “b”, “b” by “c”, etc.“Uftujoh, uftujoh”

– Transposition cipher: The ordering of theletters is shifted to form new words.Example: Plaintext = exampleCiphertext = eape xml

Early cipher systems

43

• Modern cryptosystems are digital; the algorithmsare based on the individual bits of a messagerather than letters of the alphabet.

• Computer information is stored as binary strings,sequences of 0’s and 1’s.

• Encryption and decryption keys are binary stringsof a given key length.Example: 128-bit encryption systems.

Modern cipher systems

44

• Someone can know the details of an encryptionalgorithm and yet not be able to decipher anencrypted message without the key.

• The resistance of the encrypted message dependson the size, in terms of bits, of the key used inthe encryption procedure. The longer the key,the more computing power and time it takes tobreak the code.Example: 128-bit encryption systems.

Knowledge needed

45

There are two main types of cryptosystems:• Private-key cryptography

Also known as symmetric or secret-key encryption, it uses a single key to both encrypt and decipher the message.

• Public-key cryptographyAlso known as asymmetric encryption, it usesa public key to encrypt messages and a privatekey to decipher messages.

Types of cryptosystems

46

Suppose that Alice wishes to send Bob a message:• They exchange a secret key.• Alice encodes the message using the secret key.• The ciphertext is sent to the Bob.• Bob decodes the message using the secret key.

Problems with this approach:• How do Alice and Bob exchange the secret key?• There is no authentication of the sender.• What if both wish to communicate with Chris?

Private-key cryptography

47

• A key distribution center shares a different key with each user in the network.

• When Alice and Bob want to communicate, theyobtain a session key from the KDC.

• They communicate using the session key.• If Chris wants to communicate with Alice, they

obtain a new session key, improving security.• If the KDC is compromised, the security of the

entire network is at risk.

Key distribution center

48

• Data Encryption Standard (DES) is a 56-bitprivate-key encryption algorithm developedby the NSA and IBM in the 1950s.

• Cryptoanalysts no longer believe that 56-bitkeys are secure. See Cracking the 56-bit DESsystem.

• The current standard is to use Triple DES, threeDES systems in a row, each with its own key.

• Work is underway on the Advanced EncryptionStandard (AES).

DES

49

• Public-key cryptography uses two related keys.• The private key is kept secret by its owner.• The public key is freely distributed.• When someone wishes to communicate with Alice

they use Alice’s public key to encode theirmessage. Alice then uses her private key to decode the message.

• Although the two keys are mathematically related,it would require enormous computing power todeduce the private key from the public one.

Public-key cryptography

50

• If a customer sends a message to a merchant usingthe merchant’s public key, the customer knows that only the merchant can decipher the message.

• Similarly if the customer sends a message using thecustomer’s private key, the merchant can decipher it using the customer’s public key thus identifying the customer.

• Both together give two way authentication.Example: Merchant to customer– First encode using the customer’s public key.– Use the merchant’s private key on the result.

Authentication

51

• The mostly commonly used public-key system is RSA (named for its inventors: Ron Rivest, AdiShamir, and Leonard Adleman).

• Invented in 1977 at MIT.• Most secure e-commerce transactions on the

Internet use RSA products. See the RSA security page.

• RSA is built into many Web browsers, commerceservers, and e-mail systems.Examples: Internet Explorer, Apache Web Server,Netscape Communicator.

RSA

52

• Another common public-key system is PGP(Pretty Good Privacy).

• Used to encrypt e-mail messages and files.• PGP is freely available for non-commercial

use. See the MIT Distribution Center.

PGP

53

• A drawback of public-key algorithms is that theyare not efficient for sending large amounts ofinformation.

• Public-key algorithms can be used to exchangeprivate keys.

• The process by which two parties exchange keysover an insecure medium is a key agreement protocol.

• The most common key agreement protocol is a digital envelope.

Key agreement protocols

54

The basic idea:• A message is encrypted using a secret key.• The secret key is encrypted using a public key.• Only the receiver can decipher the secret key.Example:• Alice encrypts a message using a secret key.• Alice encrypts the secret key using Bob’s public key.• Alice sends both to Bob.• Bob decrypts the secret key using his private key.• He then uses that key to decipher the message.

Digital envelopes

55

• Most compromises in security result from poor keymanagement, e.g. the mishandling of private keysresulting in key theft.

• An important part of management is the generationof keys.

• The key length must be sufficiently long.• A key generation algorithm that is unintentionally

constructed to select keys from a small subset ofall possible keys may allow a third party to crackthe encryption.

• Key generation algorithms must be random.

Key management

56

• Secure sockets layer (SSL)The purpose is to secure connections between two computers.Developed by Netscape communications.

• Secure Hypertext Transfer Protocol (S-HTTP)The purpose is to send individual messagessecurely.Developed by CommerceNet.

Secure protocols

57

• To begin, a client sends a message to a server.• The server responds by sending its digital

certificate to the client for authentication.• Using public-key cryptography, the client and

server negotiate session keys to continue.• Once the keys are established, the transaction

proceeds using the session keys and digitalcertificates.

• All information exchanged is encoded.• See Figure 6-17 on page 221.

SSL

58

SSL resides on top of TCP/IP in the Internetprotocol suite.

As a result it can secure many different types of communications:• FTP sessions• Telnet sessions• HTTP sessions: S-HTTP

Types of communication

59

Secure Sockets Layer comes in two strengths:1. 40-bit2. 128-bit

Both refer to the length of the session key generatedby every encrypted transaction.

The 40-bit version is available for export, but U.S.firms may only use the 128-bit version in productsintended for the U.S. market.

SSL key length

60

• Secure sockets layer (SSL)The purpose is to secure connections between two computers.Developed by Netscape communications.

• Secure Hypertext Transfer Protocol (S-HTTP)The purpose is to send individual messagessecurely.Developed by CommerceNet.

Secure protocols

61

Although SSL protects information as it is being transmitted, it does not protect information onceit is stored in the merchant’s database.

The data needs to be encrypted and/or the serversecured to protect information that was previouslytransmitted.

Limitation

62

• Secure HTTP (S-HTTP) is an extension of HTTP.• It is concerned with securing individual messages.• Works at the application level.• Security features:

– Client and server authentication (using RSA)– Symmetric encryption for communication– Message digests– The client and server may use separate S-HTTP

techniques simultaneously. Example: The client may use private keys and the server mayuse public keys.

Secure HTTP

63

• The details of S-HTTP security are conductedduring the initial negotiation session.

• Security details are specified in special packetheaders that are exchanged.

• Once the client and server have agreed to the security implementations that will be enforced between them, all subsequent messages are wrapped in a secure envelope.

Establishing contact

64

• The client and server can specify that a securityfeature is required, optional, or refused.

• When a feature is required it must be used orthe connection will be terminated.

• Features: – Use of private-key encryption– Server authentication– Client authentication– Message integrity

Security techniques

65

• It is difficult to prevent integrity violations, but techniques can enable integrity violations to be detected; information can then be re-sent.

• The basic idea:– A hashing algorithm is applied to produce a

message digest.– The message digest is encrypted to produce a

digital signature.

Transaction integrity

66

• A hashing function is applied to the message.• This produces a number that is based on the

length and content of the message. Goodhash algorithms have few collisions.

• The message digest is appended to the message.• The receiver recalculates the message digest.• If they two do not match, integrity is violated.

Problem: What if an adversary changes both themessage and the message digest?

Message digest

67

• The sender computes the digest, encrypts it usingher private key, and then appends the encrypteddigest onto the message.

• Only the sender could have created the digitalsignature.

• The merchant deciphers the digest, computes his own digest, and compares the two. If they matchthe integrity of the message was preserved.

• For added security, the digital signature and the message can be encrypted.

Digital signature

68

E-commerce security is best studied by examining the overall process, beginning with the consumerand ending with the commerce server.

This analysis produces a three part structure:1. Client security2. Communication channel security3. Server security

E-commerce security

69

Server threats can be classified by the means usedto obtain unauthorized access into the server:• The Web server and its software• Back-end programs and servers such as ones for

a database• Common Gateway Interface (CGI) programs• Other utility programs residing on the server

Server threats

70

• Web servers running on most machines can beset to run at various privilege levels.– The highest one allows access to any part of

the system, including sensitive areas.– The lowest level provides a logical fence that

prevents access to sensitive areas.– The rule is to use the lowest level needed to

complete a given task.• Setting up a Web server to run in high privilege

mode can cause potential threats.

Security levels

71

• Web servers that require usernames and passwordscan compromise security by revealing them.

• Because the Web server needs the information asit moves from page to page, it may place that ina cookie on the client’s machine.

• The server must be careful not to request that thecookie be transmitted unprotected.

Entering passwords

72

• Web servers may keep files with username/passwordpairs to use for authentication.

• If these files are compromised then the system can beattacked by people masquerading as others.

• Users who choose passwords badly also pose a threatto Web server security. Passwords that are easilyguessed, such as birth dates, child or pet names, arepoor choices.

• Administrators often run programs that attempt toguess users’ passwords as a preventative measure.

Username/password pairs

73

• Because databases hold valuable information, attackson them are particularly troubling.

• Security features rely on usernames/passwords.• Security is enforced using privileges.• Databases that fail to store usernames/passwords in a

secure manner or fail to enforce privileges can becompromised.

• During an attack, information may be moved to a lessprotected level of the database, giving full access.

Database threats

74

• CGI implements the transfer of information from a Web server to another program.

• Like Web servers, CGI scripts can be set to rununconstrained (with high privilege).

• Defective or malicious CGI scripts can access ordestroy sensitive information.

• Old CGI scripts that have been replaced can beloopholes for access into the system.

• CGI scripts can reside anywhere and are difficultto track.

CGI threats

75

• A buffer is an area of memory set aside to holddata read from a file or database.

• Buffers are necessary because I/O operations aremuch slower than CPU operations.

• Buffer overflows, either from a buggy programor as part of a deliberate attack, can result in:– A computer crash– Instructions for an attacking program being

written into the return address save area causing it to be run by the Web server CPU

Buffer overflows

76

• Access control and authenticationControlling who and what has access to theserver; includes both users and other servers.

• FirewallsInside: Network and machines protected by the firewall.Outside: All other networks.

Securing the server

77

• Authentication via digital certificates and signatures.• Usernames/passwords

– Usernames are stored as clear text– Passwords are stored as encrypted text– A password entered is encrypted and compared

against the encrypted password.• An access control list gives the users that can access

certain files and folders in the system.Read, write, and execute permissions may be setseparately.

Access control

78

• All traffic from the outside must pass through it.• Only authorized traffic is allowed to pass.• The firewall should be immune to attack.• Operates at the application layer.• Trusted networks are inside; untrusted ones outside.• Can be used to separate divisions of a company.• The same policies should apply to all firewalls.• Unnecessary software should be stripped off.

Firewalls

79

• Packet filtersFilters traffic according to source and destination (IP address) based on a set of rules.

• Gateway serversFilter traffic according to the application requested.Example: Incoming FTP requests granted but out-going requests denied.

• Proxy serversCommunicate with the Internet on behalf of theprivate network. Also used as a cache for Webpages.

Types of firewalls