Unit 4 Computer Security
Unit 4 Computer Security
1 Introduction to Viruses
Computer viruses are man-made computer programs, and they share some of
logical viruses. A computer virus passes from computer to the behaviors of bio
computer like a biological virus passes from
person to person. A biological virus causes damage to the human
infecting cells; similarly, a computer virus when once executed, getsbody and it has to reproduce itself by
to cause
damage to a computer and can replicate itself in a activated and spreads in the system
Internet. Computer viruses have come a long way fromn the earlycomputer and over the network or the
frst PC virus was created in 1981 by Richard days of personal computers (PC). The
Skrenta, the virus called Elk Cloner. In these days of
high-speed Internet connections and e-mail everywhere, computer
code are often spreading as attachmentsto e-mail viruses and other types of malicious
rate. They get into a computer system by means of messages and they are increasing at an unprecedented
that is, without the knowledge of the hardware or software and operate transparently,
to many different types of malware and
computer user. The term virus is also commonly used to refer
adware programs. There are many different types of computer
viruses circulating in thecyber world such as computer
has a different way of working. They can viruses, worms, Trojans, and Spyware, but each
destroy your data and prevent your computer from working.
Viruses
Avirus is a small piece of software that
attaches itself to a computer or a file. It can replicate itself and
circulate to other files throughout in a computer system over the
Small network or the Internet. They are the
programming codes attached within the code of some other programs that once executed, get acti
Vated and spread in the system. A virus can only spread from one
Program of the device is taken to an uninfected computer. It can computer to another when the host
itself. Viruses are often spread as attachments to the infect other programs by modifying
programs or to
disks and compact disks (CDs). For example, if the vìrus is sent as e-mail messages or by sharing fles
infects the omputer in which the attachment is opened. If a virus isanattached
e-mail attachment, then it also
to a program suchsuch asas a
8/INTRODUCTION TO CYBER
380 e
CHAPTER
SECURITY
the virus runs too. A virus
can corrupt or
word document program runs, your e-mail
word document, cach
timc the unusable, use program to spread itself to
computer or makc a computer Viruses can be disguised as
everything on your hard before opening any attachment,attachments
delete files on your disk.
delete be sure
other computers, or even vidco files. So
and you
funny images, greeting cards, or audio viruses are harmlcss but others can be very destructive. These
of
source of the attachment. Many
your computer. In addition to beine Se
know the intentionally to damagedestructive functions. Some viruses
programs are designed and crcated
designed to perform different software, or files. The
may cause
reproduce, viruses may be hardware,
mildly annoving effects, while others can damage your
Love Bug (2000), Nimda (2001), etc. examples
The vari-
only
Jerusalem (1987), Michelangclo (1992),
of viruses are below:
are discussed
ous tvpcs of viruses to the boot sector program that is
read b.
virus that attaches itself
1, Boot sector virus: A resides in the fe
booting up). This boot sector program
computer upon starting (known as or CD and it is loaded when you start your computer. Ir is the
Dart of the hard disk, Aoppy disk, initiates all basic programs. Aboe:
computer that helps to startup and
most important part of a command and installs itself before the operating system is loaded
sector virus replaces the jump program that overwrites the boot sector program and
makes
The boot sector virus is an infected upon
unstable; therefore, the boot sector virus starts to spread rapidly
the computer system very sofrware
computer. These are normally spread by infected floppy disks, free Band
each startup of the Boot" and
malicious programs. Examples of a boot sector virus are "Parity
CDs, and other
they utilize
AntiEXE.
viruses cannot attach themselves to just any program, rather
2. Macro virus: Macro macro is an
programming language to distribute themnselves. A
another application's macro
program commands automatically, and many Microsoft applications
instruction that carries out most common types of macro
MS Excel make use of these macros. The two
like MS Word and
Excel viruses. A macro virus is often written in scripting languages
viruses are MS Word and MS Word, MS Access, or MS Excel and
associated hles
documents such as MS
to infect and damnage MS Excel spreadsheet. The macro viruses are typl
or template and
like MS Word document user accesses an infected MS Word document
or an
similar documents. If a
cally spread to other allow the virus macros to be executed. Some example
infected MS Excel spreadsheet, then it can
Showoff, Adam, Wazzu, and Laroux. .com
of macro viruses are Concept, Nuclear, that attach themselves to or replace
3. File viruses: These viruses are the most common kind extensions
.dry, etc.
as .sys, before
files with other
and .exe files; although, in some cases, they can affect file always
executes
The vast majority of PC-based viruses are .com programs. Since .com exploitedby
this characteristic is exist-
any other program of the same name with different extension, naame as of the
the virus programmers for creating the infected hidden fle with the same Anothervery
original Ale.largeitisand
ing .exe fle but with the extension .com so that it executes before theprogram how. viruses.
common fle is .exe file. All.exe files begin with a header that tells the is usedfor
the
how much memory it needs to allocate followed by the blank space, whichsize.
So the virus is accommodated with the .exe file itself without changing its transportth
vehicle to victims
4. E-mail virus: An e-mail virus is a virus that uses e-mail messages as a People in theidenit-
virus. These viruses spread by mailing their copy automatically to all the or
no clear
address book. This often results in spamming and bulk e-mail lists that have
able sender.
5.
sIteCross-site scripting virus: A
and scripting cross-site
applvulicatniocrns.abilitics
" 381
web
These (such as cookic
can
scripfiles)
ting tovirus (XSSV) is atype of
Worms
A
worm is a
cnter a user's replicate. They work onvirus that urilizes
computer through asecurity hole. site cross
mul tiple browsers
through
ers via a
a nctwork.
sclf-containcd
attachmcnt
A
or uses program that
comput er attaches itself to another ile
program
space in worm does not netw orks and
on the your system like a modify the 6lessecurity holes to and circulates to
in 1988 at computer. The frst computer virus because
Cornell does. worm repl
does i c at
note itself to otherother files
E-mail Worms, down the InternetThissiforgniworm
ficantwasworm was written
It
effectively shut University. simply multiplies until
by a
have to attach comput
it flls all itself to
Instant
File-sharing Networks Messaging several daysnamed as
in 1988.Morris worm student
or Robert Tappanavai lMorris
able
(2001), Sla mmer Worms. The Worms,
Worm (2007), Worm (2003), SoBigexamplesInternet of worms Worms,
There
IRC
are
dif Internet worm that had
ferent
are (Internet types of worms like
(2003)
2003 andinfected
many 75000 CONFICKER
comput
websites e WORM
rs
(2003),
(G MarchMyDoom (2004),
running 2009), and Netsky (2004),
relay
Morris (1988), Melissa chat) Worms, and
(1999),
Sasser Code Red
in a Stuxnet
and single
October
day in
January 2004.down. The Microsoft SQL 2000 Servers
went
2007 in South Storm Worm MyDoom worm infected a within
(July (2004), Storm
2010).10Theminutes in Worm
Slammer
industrial
The main software known as SCADA (2007) infected 50 quarter of a million January
Korea. Stuxnet (July
2010) was desigmillion
for difference between (supervisory ned to comput ers betweencomput ers
January
of itself ng; it is a stand-alone virus and a wormcontrolis thatandadata
replictoatiother a
acqui sit
attack
io n).
a
particular piece of
computer
a machine.network by
computers on theselnetwork.
f-executTherefore,
ing program. It usesa a computernot need a host document
worm does
consuming more bandwidth, the damage
whereas networkits to send copies
worm can localize
caused by a virus is mostlydamage the to
Trojan
ATrojan
Horses localized to
horse is simply a
omputer
and hiddenTrojan horse is a computer program that appears
in the host stand-alone not program thatlegitimate
hiaving a useful and computer; it doesmalicious
but
is hidden in acarries a terrible payload.
desired replicate or copy itself. host program or
rer as cute little dancing function such as in the form of a Trojan insertedof
frogs joke program, horse has the
appearance
prograrms,
by they are
installed
on the screen, or
software of some sort. movie or music hle, screen
alhgurlaoiwionnsg,
intruders on your
system and then function from inside.
easy access to your
erase your disk, send your computer without your
When you run or click on such
These programs damage
Horomput
se er with avirus. There
credit card numbers and knowledge, change your system con-
passwords to astranger, or infect your
Ylling ViKeTrroyujalosn,ggiTheng Serving
are various types of Trojan
Vinus, File horses like
Trojan Horse Virus, Distributed Denial The Remote
of ServiceAdministration Trojan
Irojan Horse Virus, The Password Atack Trojan Horse
back Horse Virus, Some of the ex Stealing Trojan Horse Virus, and The System
OrifcTre ojan
stop a (1998, 2000), and Clagger (2006). Agood horses are AOL variants, Netbus (1998),
examples of Trojan
horse. firewall progranm is the most effective means
CHAPTER 8/INTRODUCTION TO CYBER
382 " SECURITY
Spyware
Thesetwoand
wordsAdware
are often uscd together and it is difficult to draw a clear distinction between the two.
generally considered to be softwarethat is secretly installed on a computer without the
spyware is
A knowledge when the user installs other sofrware or the website executes a script on the computer.
users
It runs in the background of your computer. Spyware is used to monitor users' webs browsing, keystroke
activity, take screen snapshots, sending e-mail and chatlogging, take personal information, business
information, processing capacity, slow your Internet connection, etc. and report their findings to the
third party. These programs do not spread like viruses but are diffhcult to remove w
requesting
out assistance. Most spyware come bundled with free programs that you download from the Internet.
decreases the overall perfotmance of your computer. Adware, on the other hand
Spware program display unsolicited advertisements for third-party prod
crally refers to any program that features to
serviccs. Adwarc generally comes with an uninstaller and can be easily removed from asvse
and products that runin the background of the Computer
Adware software are not spyware. They are also
monitoring mechanism on the system.
and display advertiscments but do not installany
Concept Check
What are the different types of viruses?
What is the difference between virus and
Worms?
computer and the Internet. These obscene materials (pornographic pictures, videos, and photos)
are available for downloading and online distribution that may harm the mind of the adolescent.
4. E-mail spoofing: Aspoofed e-mail is the one when you receive an e-mail mesage that appears to
originate from onc source but actually has been sent from another source. In e-mail spoofing, the
e-mailer hides his/her identity from the recipient, so that the recipient has no idea as to who sent
the message. E-mail spoofing may affect in many ways such as destroying the relationship and may
cause monetary damage.
5. Denial of service: Denial of service (DoS) attack means preventing legitimate users of a service
from using that service. It generally occurs when aweb server is Aooded with excessive requests for
information more than it can handle. This causes the web server to crash, thereby denying aucho
rized users the service offered by the resource. It is important to note that in addition to being
the target of a DoS attack, it is possible for your computer to be used as a participant in a DoS
attack on another system. For example, websites like Amazon, CNN, Yahoo, and eBay! have been
brought down in the past.
6. Gyber stallking: Cyber stalking is stalking some person by following and watching a person's
movement over a long period across the Internet in a way that is annoying or frightening by
sending e-mail, false accusations, posting threatening messages on the bulletin boards, making
harassing phone calls, or leaving written messages on the chatrooms. So cyber stalking describes
the use of ICT ["Information and Communication Technologies"; it refers to technologies that
provide accessto information through telecommunications medium including Internet, instant
messaging, voice over IP (VolP), wireless networks, cell phones, video-conferencing, social net
working websites like Facebook and other communication mediums] in order to harass one or
more victims. It is a growing social problem that can affect computer users anywhere in the world.
Normally, majority of the victims are women.
7. Logic bombs: Logic bombs are event-dependent programs that get activated on the occurence
of a particular predefined event. These predefined events are called trigger events. The trigger may
be the particular date on which the logic bombs may get activated. For example, the logic bomb is
created in such away that on particular date, it transfers small amount of money from everyone's
account in the bank to a particular account. Since the amount is very small, none of the customer
may bother, but the benefiter account may earn a huge amount. This kind of event has occurred
in the past. Some examples are a viruses such as Chernobyl virus that lies dormant throughout
the year and becomes active only on a particular date, or a virus that deletes a database table if a
certain employee gets fired.
8. Hacking: A hacker is an unauthorized user who attempts to or gains access illegally to a computer
system or network to destroy data, stealing, and altering information. Hacking is also the act by
whích other forms of cybercrime, for example, forgery, cyber terrorism, e-terrorism, etc., are com
mited, Hacking is a crime even if there is no visible damage to the system, since it is an invasion
into the privacy of data.
9. Spamming: Spamming is sending of unsolicited bulk commercial e-mail, junk newsgroup post
ings, or instant message to a large number of people usually for advertising or markeing over
the Internet. The people who do this activity are called spammers and they send out hundreds,
CHAPTER 8/INTRODUCTION TO CYBER
384 "
SECURITY
thousands, or even tens of thousands of e-mails to the receiver without their Consent. The spam-
mers can collect e-mail addresses from varioussources such as purchasing from legitimate
Sources
or companies that share c-mail addresses, by hacking, or simply using computer programs that
gencrate addresses randomly based on the domain names of known Internet service providers.
Spamming is irritating but it is not illegal unless it causes damage to the system. You can sowa
vour energy and time to review or remove those unwanted messages by hltering appropriately and
making them as spam or junk mail, so your e-mail will automatically move them to spam folder
or junk folder next time upon receiving such mails.
10, Cyber defamation: It is not different from conventional defamation except that it takes place
with the help of computers or the Internet. This may involve publishing of defamatory matter on
the website or sending an e-mail containing defamatory information to expose anyone to hatred,
contempt, or ridicule. For example, someone (say, Ajay) has hacked the e-mail account of some
one else (say, Vinay) and then he (Ajay) sends defamatory mater about his (Vinay) friend using
his (Vinay) e-mail ID. Defacement of a company'swebsite can cause not just embarrasment but
even loss of sales.
1. Pharming: It is ahacker's attack aiming to defraud Internet surfers by hijacking awebsite's domain
name, or URL, and redirecting users to another (bogus) website where raudulent requests for
information are made. Pharming has become of major concern to businesses hosting e-commerce
nd online banking websites.
12. Phishing: Phishing is afraudulent way of geting confidential information, such as user ID, pass
words, credit card, bank details, etc. through e-mails or an instant message, which look authentic
and appear to come from a legitimate company or person and atempt to get victims to reveal
their personal information. Phishers use a variety of sophisticated devices to steal information -
including pop-up windows. In addition to stealing personal and fnancial data, phishers can infect
computers with viruses and convince people to participate unwillingly in money laundering
13. Crimes related to Intellectual Property Rights: Any unique product of the human intellect thar
dhas commercial value, like sofeware, books, songs, movies, paintings, drawings, etc., are considered
under copyright, so copyrights protect the intellectual properties. The intellectual property crime
refers to the distribution of facts or data for a fee without the owner's consent. The common form
of Intellectual Property Rights (IPR) violation includes software piracy, theftof computer source
code, copyright infringement, trademarks violations, unauthorized circulation of content of any
author, piracy of software or movie DVDs, etc. Almost every information is now available on the
Internet in digital form and it can be made available to anyone using the Internet that may resut
in the violation of copyright. IPR provide different kindsof rights (such as right of reproduction,
distribution, public display, public performance, production of derivative works) to the owner or
an original work. Although some information may be reused in he original form depending upon
the purpose and character of use, amount of work being copied, use for educational purpose, et
without the consent of the owner.
3 GOOD COMPUTER SECURITY
HABITS
" 385
Concept Check
" Differentiate between hardware and soft
ware firewall. How do you check whether the page is
secure or not?