MODULE 4

Computer and Program Security

1
 SYLLABUS
• Introduction to computer security
– Threats
– Vulnerabilities
– Controls
• Browser attack types
• Web attacks targeting users
• Email attack types
• Introduction to program security
– Non-malicious programming oversights
– Malware.
2
 What Is Computer Security?

• What is computer security?

• Computer security basically is the
protection of computer systems and
information from harm, theft, and
unauthorized use. It is the process of
preventing and detecting unauthorized
use of your computer system.

3
 What Is Computer Security?
• Information security is securing information from
unauthorized access, modification & deletion
• Application Security is securing an application by building
security features to prevent from Cyber Threats such as SQL
injection, DoS attacks, data breaches and etc.
• Computer Security means securing a standalone machine by
keeping it updated and patched
• Network Security is by securing both the software and
hardware technologies
• Cybersecurity is defined as protecting computer systems,
which communicate over the computer networks
4
 C-I-A
Confidentiality means Confidentiality measures are designed
to prevent sensitive information from unauthorized access
attempts

Integrity involves maintaining the consistency, accuracy and

trustworthiness of data over its entire lifecycle. Data must not
be changed in transit, and steps must be taken to ensure data
cannot be altered by unauthorized people

Availability means information should be consistently and

readily accessible for authorized parties. This involves properly
maintaining hardware and technical infrastructure and systems
that hold and display the information.
5
Relationship between Confidentiality
Integrity and Availability

• In fact, these three characteristics can be independent, can overlap,

and can even be mutually exclusive.

Confidentiality

Secure

Integrity Availability
• Threat
• A cyber threat is a malicious act that seeks to steal or
damage data or discompose the digital network or system.
Threats can also be defined as the possibility of a
successful cyber attack to get access to the sensitive data
of a system unethically. Examples of threats include
computer viruses, Denial of Service (DoS) attacks, data
breaches, and even sometimes dishonest employees.
• Types of Threat
• Threats could be of three types, which are as follows:
• Intentional- Malware, phishing, and accessing someone’s
account illegally, etc. are examples of intentional threats.
• Unintentional- Unintentional threats are considered
human errors, for example, forgetting to update the
firewall or the anti-virus could make the system more
vulnerable.
• Natural- Natural disasters can also damage the data, they
are known as natural threats.

7
• Vulnerability:
• In cybersecurity, a vulnerability is a
flaw in a system’s design, security
procedures, internal controls, etc., that
can be exploited by cybercriminals. In
some very rare cases, cyber
vulnerabilities are created as a result
of cyberattacks, not because of
network misconfigurations. Even it can
be caused if any employee anyhow
downloads a virus or a social
engineering attack.

8
• Types of Vulnerability
• Vulnerabilities could be of many types, based on different
criteria, some of them are:
• Network- Network vulnerability is caused when there are
some flaws in the network’s hardware or software.
• Operating system- When an operating system designer
designs an operating system with a policy that grants
every program/user to have full access to the computer,
it allows viruses and malware to make changes on behalf
of the administrator.
• Human- Users’ negligence can cause vulnerabilities in the
system.
• Process- Specific process control can also cause
vulnerabilities in the system.
9
Controls
We can group controls into three largely independent classes. The following
list shows the classes and several examples of each type of control.

• Physical controls stop or block an attack by using something tangible

too, such as walls and fences – locks – (human) guards – sprinklers and
other fire extinguishers

• Procedural or administrative controls use a command or agreement that

– requires or advises people how to act; for example, – laws, regulations –
policies, procedures, guidelines – copyrights, patents – contracts,
agreements

• Technical controls counter threats with technology (hardware or

software), including – passwords – program or operating system access
controls – network protocols – firewalls, intrusion detection systems –
encryption – network traffic flow regulators
10
Threat Vulnerability Risks
Risk

Take advantage of vulnerabilities in the Known as the weakness in hardware,

The potential for loss or destruction of
1. system and have the potential to steal software, or designs, which might allow
data is caused by cyber threats.
and damage data. cyber threats to happen.

2. Generally, can’t be controlled. Can be controlled. Can be controlled.

3. It may or may not be intentional. Generally, unintentional. Always intentional.

Reducing data transfers, downloading

Vulnerability management is a process of files from reliable sources, updating the
software regularly, hiring a professional
Can be blocked by managing the identifying the problems, then
4. vulnerabilities. categorizing them, prioritizing them, and
cybersecurity team to monitor data,
resolving the vulnerabilities in that order. developing an incident management
plan, etc. help to lower down the
possibility of cyber risks.

Can be detected by identifying

Can be detected by penetration testing
Can be detected by anti-virus software mysterious emails, suspicious pop-ups,
5. and threat detection logs.
hardware and many vulnerability
observing unusual password activities, a
scanners.
slower than normal network, etc.

11
 Controls Available
• Encryption
• cleartext or plaintext, and transform them so that they are
unintelligible to the outside observer; the transformed
data are called enciphered text or ciphertext.

– Encryption clearly addresses the need for

confidentiality of data.

– Additionally, it can be used to ensure integrity;

• data that cannot be read generally cannot easily be
changed in a meaningful manner.
 Controls Available
• Encryption does not solve all computer security problems, and
other tools must complement its use.
– if encryption is not used properly, it may have no effect
on security or could even degrade the performance of
the entire system.

• Weak encryption can actually be worse than no encryption at all,

– because it gives users an unwarranted sense of
protection.

• Therefore, we must understand those situations in which encryption

is most useful as well as ways to use it effectively.
 Controls Available
• Software/Program Controls
– Programs must be secure enough to prevent outside attack
– They must also be developed and maintained so that we can be confident of the
programs' dependability.

• Program controls include the following:

– Internal program controls: parts of the program that enforce security restrictions,
• i.e. access limitations in a database management program
– Operating system and network system controls: limitations enforced by the operating
system or network to protect each user from all other users
• i.e. chmod on UNIX: (Read, Write, Execute) vs. (Owner, Group, Other)

– Independent control programs: application programs,

• i.e. password checkers, intrusion detection utilities, or virus scanners,
that protect against certain types of vulnerabilities
 Controls Available
• Development controls:
– quality standards under which a program is designed, coded
(implementation), tested, and maintained to prevent
software faults from becoming exploitable vulnerabilities
• i.e. Penetration testing (pen testing or ethical hacking), is the
practice of testing a computer system, network or web application
to find security vulnerabilities that an attacker could exploit.

• Software controls frequently affect users directly ?

– i.e. when the user is interrupted and asked for a password
before being given access to a program or data.
– Because they influence the usability of the system, software controls must be carefully
designed.
• Ease of use and capabilities are often competing goals in the design
of a collection of software controls.
 Controls Available
• Hardware Controls
– Numerous hardware devices have been created to assist in
providing computer security. These devices include a
variety of means, such as
• hardware or smart card implementations of encryption
• locks or cables limiting access or deterring theft
• devices to verify users' identities
• firewalls
• intrusion detection systems
• circuit boards that control access to storage media
 Controls Available
• Policies and Procedures
– Sometimes, we can rely on agreed-on procedures or policies among
users rather than enforcing security through hardware or software
means
• i.e. frequent changes of passwords
– We must not forget the value of community standards and expectations
when we consider how to enforce security.

• Physical Controls
– i.e. locks on doors,
– guards at entry points,
– backup copies of important software and data, and
– physical site planning that reduces the risk of natural disasters.
 identification and Authentication

Identification is asserting who a person is.

Authentication is proving that asserted identity

Identities are typically public or well known.

Authentication should be private

18
If you send email to someone, you implicitly
send along your email account ID so the other
person can reply to you.
Your bank account number is printed on checks
you write; your debit card account number is
shown on your card, and so on. In each of these
cases you reveal a part of your identity.
Authentication, on the other hand, should be
reliable. Although identifiers may be widely
known or easily determined, authentication
should be private.

19
 Browser Attack Types

• Browsers are programmable devices and signals are

exposed to subtle modification during communication.

In this section we present several attacks passed

through browsers.

From Security in Computing, Fifth

Edition, by Charles P. Pfleeger, et al.
(ISBN: 9780134085043). Copyright 20
2015 by Pearson Education, Inc. All
There are three attack vectors against a browser:
• Go after the operating system so it will impede
the browser’s correct and secure functioning.
• Tackle the browser or one of its components,
add-ons, or plug-ins so its activity is altered.
• Intercept or modify communication to or from
the browser.

From Security in Computing, Fifth

Edition, by Charles P. Pfleeger, et al.
(ISBN: 9780134085043). Copyright 21
2015 by Pearson Education, Inc. All
 Browser Attack Types
• Man-in-the-browser
A man-in-the-browser attack is an example of
malicious code that has infected a browser. Code
inserted into the browser can read, copy, and
redistribute anything the user enters in a browser.
The threat here is that the attacker will intercept and
reuse credentials to access financial accounts and
other sensitive data.
Trojan horse that intercepts data passing through
the browser
22
 Browser Attack Types
• As if intercepting details such as name, account number, and authentication data

were not enough, SilentBanker also changed the effect of customer actions. So, for

example, if a customer instructed the bank to transfer money to an account at

bank A, SilentBanker converted that request to make the transfer go to its own

account at bank B, which the customer’s bank duly accepted as if it had come from

the customer. When the bank returned its confirmation, SilentBanker changed the

details before displaying them on the screen. Thus, the customer found out about

the switch only after the funds failed to show up at bank A as expected.

23
Browser Attack Types

24
• Keystroke Logger
A keystroke logger (or key logger) is either
hardware or software that records all keystrokes
entered. The logger either retains these
keystrokes for future use by the attacker or
sends them to the attacker across a network
connection.

25
Page-in-the-Middle

A page-in-the-middle attack is another type of

browser attack in which a user is redirected to
another page. As an example, when the user
clicks “login” to go to the login page of any site,
the attack might redirect the user to the
attacker’s page, where the attacker can also
capture the user’s credentials

26
• Program Download Substitution
In a download substitution, the attacker
presents a page with a desirable and harmless
program for the user to download,

for example, a browser toolbar or a photo

organizer utility. In addition to the intended
program by the user , the attacker downloads
and installs malicious code.

27
• User-in-the-Middle

A technique where attacker hides behind a

legitimate user of an online service in order to
avoid being traced once his/her malicious
activities are detected.

28
 Web Attacks Targeting Users

Two classes of situations involving web content

• The first kind involves false content, most
likely because the content was modified by
someone unauthorized with these the intent
is to mislead the viewer.
• The second, more dangerous, seeks to harm
the viewer.

29
• False or Misleading Content

An incoherent message, a web page riddled with

grammatical errors, or a peculiar political
position can all alert you that something is
suspicious, but a well-crafted forgery may pass
without question. The falsehoods that follow
include both obvious and subtle forgeries.

30
• Defaced Web Site

• The simplest attack, a website defacement,

occurs when an attacker replaces or modifies
the content of a legitimate web site.
• website modification, the attacker can redirect
a link on the page to a malicious location, for
example, to present a fake login box and
obtain the victim’s login ID and password. All
these attacks attempt to defeat the integrity of
the web page.
31
• Fake Web Site
• Web sites are easy to fake because the
attacker can obtain copies of the images the
real site uses to generate its web site. All the
attacker has to do is change the values of links
to redirect the unsuspecting victim to points
of the attacker’s choosing.
• The attacker can get all the images a real site
uses; fake sites can look convincing.

32
• Fake Code
For a replacement or update to the popular Adobe
Reader. The link from which it came (www.pdf-
new-2010-download.com) was redirected from
www.adobe-download-center.com; both
addresses seem like the kinds of URLs Adobe
might use to distribute legitimate software.
Whether this attack is meant just to deceive or to
harm depends on what code is actually delivered.
This example shows how malicious software can
masquerade as legitimate.

33
 Web Bug
• If you order flowers online, the florist can obtain your
IP address and set a cookie containing your details so
as to recognize you as a repeat customer.
A web bug allows this tracking across multiple
merchants. Your florist might subscribe to a web tracking
service, which we name ClicksRUs.
The florist includes a web bug in its web image, so when
you load that page, your details are sent to ClicksRUs,
which then installs a cookie.
If you leave the florist’s web site and next go to a bakery’s
site that also subscribes to tracking with ClicksRUs, the
new page will also have a ClicksRUs web bug.
34
 Web Bug
A web bug allows this tracking across multiple merchants. Web bugs and
tracking services are big business

35
• Clickjacking

We are all familiar with the click box “Do you want to delete
this file? [Yes] [No].”
Clickjacking is a technique that essentially causes that prompt
box to slide around so that [Yes] is always under the mouse.
The attacker also makes this box transparent, so the victim is
unaware of clicking anything. Furthermore, a second, visible
image is pasted underneath, so the victim thinks the box being
clicked is something like “For a free prize, click [Here].”
The victim clicks where [Here] is on the screen, but [Here] is
not a button at all; it is just a picture directly under [Yes]
(which is invisible). The mouse click selects the [Yes] button.
36
 Email Attacks

• Another way to attack a user is through email

• The huge amount of email sent and received
daily, it is not surprising that much of it is not
legitimate.
• some illegitimate email can fool professionals.
Attackers using fake email know most people
will spot the forgery

37
• Fake Email Messages as Spam

• An attacker can attempt to fool people with

fake email messages. Probably everyone is
familiar with spam, misleading email, offers to
buy things
• Similar false messages try to get people to
click to download a browser enhancement or
even just click for more detail. Spammers now
use more realistic topics for false messages to
entice recipients to follow a malicious link.
38
• Fake (Inaccurate) Email Header Data

Email attacks succeed is that the headers on email are easy to spoof, and thus

recipients believe the email has come from a safe source. Here we consider precisely

how the spoofing occurs.

Control of email headers is up to the sending mail agent. The header form is

standardized, but within the Internet email network as a message is forwarded to its

destination, each receiving node trusts the sending node to deliver accurate content.

However, a malicious, or even faulty, email transfer agent may send messages with

inaccurate headers, specifically in the “from” fields .

39
• Phishing

• Phishing is an attack that attempts to steal

your money, or your identity, by getting you to
reveal personal information -- such as credit
card numbers, bank information, or passwords
-- on websites that pretend to be legitimate.

40
Protecting Against Email Attacks

 PGP
PGP stands for Pretty Good Privacy.

The PGP processing performs some or all of the following actions, depending
on whether confidentiality, integrity, authenticity.
• Create a random session key for a symmetric algorithm.
• Encrypt the message, using the session key (for message confidentiality).
• Encrypt the session key under the recipient’s public key.
• Generate a message digest or hash of the message; sign the hash by
encrypting it with the sender’s private key (for message integrity and
authenticity).
• Attach the encrypted session key to the encrypted message
• Transmit the message to the recipient. The recipient reverses these steps to
retrieve and validate the message content.
41
• S/MIME
The general MIME specification defines the format and
handling of email attachments. S/MIME (Secure Multipurpose
Internet Mail Extensions) is the Internet standard for secure
email attachments.

S/MIME works with a variety of cryptographic algorithms, such

as DES, AES, and RC2 for symmetric encryption.
S/MIME performs security transformations very similar to
those for PGP. PGP was originally designed for plaintext
messages, but S/MIME handles (secures) all sorts of
attachments, such as data files (for example, spreadsheets,
graphics, presentations, movies, and sound). Because it is
integrated into many commercial email packages, S/MIME is
likely to dominate the secure email market.
42
 Malware
• Programs planted by an agent with malicious intent to cause
unanticipated or undesired effects
• Virus
– A program that can replicate itself and pass on malicious code to
other non malicious programs by modifying them
• Worm
– A program that spreads copies of itself through a network
• Trojan horse
– A Trojan Horse Virus is a type of malware that downloads onto a
computer disguised as a legitimate program. an attacker to hide
malicious code within legitimate software to try and gain users'
system access with their software.
43
Types of Malware

From Security in Computing, Fifth Edition,

by Charles P. Pfleeger, et al. (ISBN:
44
9780134085043). Copyright 2015 by
Types of Malware (cont.)

From Security in Computing, Fifth Edition,

by Charles P. Pfleeger, et al. (ISBN:
45
9780134085043). Copyright 2015 by
History of Malware

From Security in Computing, Fifth Edition,

by Charles P. Pfleeger, et al. (ISBN:
46
9780134085043). Copyright 2015 by
History of Malware (cont.)

From Security in Computing, Fifth Edition,

by Charles P. Pfleeger, et al. (ISBN:
47
9780134085043). Copyright 2015 by
 Harm from Malicious Code
• Harm to users and systems:
– Sending email to user contacts
– Deleting or encrypting files
– Modifying system information, such as the Windows registry
– Stealing sensitive information, such as passwords
– Attaching to critical system files
– Hide copies of malware in multiple complementary locations
• Harm to the world:
– Some malware has been known to infect millions of systems,
growing at a geometric rate
– Infected systems often become staging areas for new infections
From Security in Computing, Fifth Edition,
by Charles P. Pfleeger, et al. (ISBN:
48
9780134085043). Copyright 2015 by
 Malware Activation
• One-time execution (implanting)
• Boot sector viruses
• Memory-resident viruses

49
 One-Time Execution
One-Time Execution (Implanting) Malicious code
often executes a one-time process to transmit or
receive and install the infection. Sometimes the
user clicks to download a file, other times the
user opens an attachment, and other times the
malicious code is downloaded silently as a web
page is displayed.

50
 Memory-Resident Viruses
• For frequently used parts of the operating system and
for a few specialized user programs, it would take too
long to reload the program each time it is needed.
Instead, such code remains in memory and is called
“resident” code.
• Virus writers also like to attach viruses to resident code
because the resident code is activated many times
while the machine is running. Each time the resident
code runs, the virus does too. Once activated, the virus
can look for and infect uninfected carriers

51
Boot Sector Viruses

52
 Boot Sector Viruses
When a computer is started, control begins with
firmware that determines which hardware
components are present, tests them, and transfers
control to an operating system.
The boot sector is an especially appealing place to
house a virus. The virus gains control early in the boot
process, before most detection tools are active,
With boot sector attacks, the assailant changes the
pointer to the next part of the operating system to
load.
53
 Stealth
Most viruses maintain stealth by concealing their
action, not announcing their presence, and
disguising their appearance.
several approaches used to transmit code without
the user’s being aware, including downloading as
a result of loading a web page and advertising one
function while implementing another.
Malicious code designers are fairly competent at
tricking the user into accepting malware.
54
• June 2022

17 a) List and explain the countermeasures that can be taken for attacks against identification and authentication.

b) Illustrate Buffer Overflow with a neat diagram and explain.

18 a) List and explain the web attacks targeting users.

b) Distinguish the terms vulnerability, threat and control.

• May 2023

17 a) Explain the four aspects of malicious code infection.

b) Explain any four types of browser attacks.

18 a) Differentiate the terms Threat, Vulnerability and control with example.

b) Classify Web Attacks targeting users.

• Model Question paper

17. (a) Distinguish the terms vulnerability, threat and control.

(b) With the help of suitable examples, explain the security problems created by

incomplete mediation and time-of-check to time-of use.

OR

18. (a) Differentiate between man-in-the-browser attack and page-in-the-middle

attack. 55