Security

1
Security

• Hiroshi Toyoizumi
• toyoizumi_at_waseda.jp

2
Todays Contents

1. Examples of Security Threats
2. Computer Virus
3. Cracking
4. Phishing
5. Basic of Cryptography

3
Malicious Mobile Codes Viruses and Worms
Viruses
crackings
4
Laroux Excel Macro Virus
5
Current epidemics
6
Cracking

1. Hijacking your machine.
2. Stepping stone.
3. Tamper with www pages.
4. Leak of important information.

7
Scanning IP addresses
8
Detect Windows shared folder
9
Phishing
eBay (phishing) Asking you to go to the fake
eBay site and submit your information of password
of eBay.
From http//www.cobb.com/phish/ebay.html
10
Detail of Phishing
The scammers typically send out an e-mail that
appears to come from a trusted company such as a
bank or an e-commerce Web site. The phishing
messages attempt to lure people to a bogus Web
site, where they're asked to divulge sensitive
personal information. The attackers can then use
those details to steal money from the victims'
accounts. According to a report from online
privacy watchdog Truste, 7 out of 10 people who
go online have received phishing e-mails, and 15
percent of those have successfully been duped
into providing personal information. From CNET
NEWS http//news.com.com/Caughtinaphishingtrap
/2100-1029_3-5453203.html
11
How to protect cracking

• Anti-virus
• Pacth
• Encryption
• Firewalls
• IDSIntrusion Detection System

12
BlackICE An IDS
13
Secure communication using cryptography

• Encrypt important information.
• Certify the other party.

14
Common key system Cryptograhpy
Cipher text
Plain text
Same key for encrypt and decrypt
15
Give it a try! Cipher communication
Bob
Alice
16
Any problems?

• It is easy to eavesdropping the key on thei
  internet.

17
Public Key Cryptograhpy
Unique keys for encrypt and decrypt
Cipher text
Plain text
18
Give it a try! Public key cipher communication
Bob
Alice
19
Any problems?

• Swiching the public key.
• Man-in-the-middle-attack.

Bob
Alice
20
Digital signature
Plain text
Cipher text

1. A makes a cipher text using the key only known to
   A.
2. B decrypts the cipher text with the public key of
   A
3. This is the proof of the plain text is made by A!

21
Key with digital signature
Bob
Alice
22
Real cipher communication
23
Public key and digital signature
24
Certificate authority
25
e-Government
26
Examples of Topics

• Stop Blaming the Victims
• The author of Sasser
• Adware,Spyware
• Spoofing, Backdoor
• Personal Firewall
• Anti-virus
• Spam
• Intrusion Detection System
• Cookies, Java, Active-x
• Biometric
• Examples of Phishing
• Bots

27
Role Play

• Cast
• Ohta(??) Employee of Microsoft
• Yamada(??) Employee of Takada delivery
• Employees of Waseda Hospital
• Tahara(??) accounting section
• Yano(??) freshman in general affair
• Yamaguchi(??) freshman in general affair

28
Scene 1 Call from Takada delivery

1. Yano Hello, this is Yano, general affair section
   in Waseda Hospital.
2. Yamada Hi, this is Takada delivery calling. It
   seems that one of our customer wrongly faxed her
   address to your company. Could you fax it to us?
3. (after checking the fax machine.)
4. Yano No, we havent received your fax.
5. Yamada You may found it other place Maybe in
   your accounting section? If you find it, please
   fax it to us at 03-1111-1111.
6. Yano OK.

29
Scene 2Call from Microsoft

1. Ohta Hello, this Ohta from Microsoft customer
   service. We found that your PC is sending too
   much viruses on the internet, and we received
   many complaints about it. Please download the
   anti-virus software that I will mention and
   install it on your PC.
2. Yano Sure. Where can I find the software?

30
Scene 3Call from accounting section

1. Tahara This is Tahara from accounting. Could
   you do me a favor?
2. Yamaguchi Yes. What?
3. Thara Our computers are all infected by viruses,
   but I need the address of a patient, Ryoko
   Hirosue. Could you call up the data on your
   screen and fax it to me at accounting section?
4. Yamaguchi No problem.

31
Quiz

• Did you find any security problem in the
  role-play?
• Write them down.
• Describe the counter measures.

32
Steps to obtain the address of Hirosue.

• By pretending Tahara of accounting section, have
  Yamaguchi to fax the address to accounting
  section.
• By pretending a wrong fax, asking Yano to send
  the fax to Takada delivery.
• Each employee did what seems to be OK, but as a
  whole it would make a leak of private information.