Introduction to Computer Security
Course Introduction
Pavel Laskov
Wilhelm Schickard Institute for Computer Science
Computer security in headlines
» Internet als Risikofaktor?
» Omnipräsenz von
Computer
in und
numbers
Angriffen,security
Würmern
Viren
» Massive Schäden bei Unternehmen und Bürgern
» Zunehmende Kriminalisierung von Schadsoftware
Schadcode
pro observed
Jahr (Symantec)
NewNeuer
malicious
code samples
(Symantec)
3.000.000
2.250.000
1.500.000
750.000
0
2002 2003 2004 2005 2006 2007 2008 2009
Technische Universität B
What lurks behind the statistics?
Malware previously used for fun is now used for profit.
78% of end user attacks involved stealing of login data
76% of phishing attacks targeted financial sector
Average cost of data breach in 2008 in the USA: 6.7M $.
Hacking is no longer the realm of “script-kiddies”.
60% of malicious code threats represent new attacks.
The biggest risk resides not in but in front of a computer.
Why would anyone want something from me?
What does my Windows want to update again?
I have already bought an antivirus, so I am safe.
Why are computer systems insecure?
Growing complexity of computer systems
large number of components, complex interaction
High competition
short “time-to-market”, high ROI
Leveraging of risks through high connectivity
worm outbreaks, botnets
Slow incident response
“incident hiding”, manual handling
Human error
What can go wrong will go wrong!
Human error: a case study
Human error: a case study
Human error: a case study
Human error: a case study
Human error: a case study
Human error: a case study
Human error: lessons learned
Users make errors
elaborate social engineering design
time pressure
Significant monetary motivation
Business efficiency via Internet
Acrobat Reader exploit
Acrobat Reader JBIG2 exploit: a timeline
Exploit discovered: ???
First public warnings: 19.-20.02
Adobe Reader 9.0 patched: 10.03
Adobe Reader 8.1.3 patched: 18.03
Adobe Reader Linux patched: 26.03
Recognition by antivirus system as of mid-April 2009: 6/39
(15.39%)
Infection without a click
Select a thumbnail view.
Hover a mouse over a document.
Do nothing: the Windows Desktop Search (if not
de-activated) will find it and open!
Potential consequences of an infection
Start a keylogger
Start a botnet (zombie) client
Download further code from a remote site
Security instruments
Security instruments
Prevention
Security instruments
Detection
Prevention
Security instruments
Reaction
Detection
Prevention
What will you learn?
Findamental concepts of computer security
dry, but important!
Basic security goals and mechanisms
authentication, access control, encryption, etc.
Practical security instruments
Windows and Linux security.
Further selected topics
network security
software security
web application and browser security
‘
Coarse administration
Lectures:
Wed, 10:00–12:00 (ct), A301
Formalities:
Credit hours (diploma): 2 SWS (lectures) + 1 SWS (exercises)
Credit points (B.Sc.): 3 LP (lectures) + 1 LP (exercises)
Exams and grading:
diploma: oral exam by appointment, graded certificate for
exercises
B.Sc: written exam at the end of semester, 30% of the final
grade from exercises
Office hours: by appointment
Course web page:
http://www.cogsys.cs.unituebingen.de/lehre/ss11/introd comp sec.html
Homework assignments
Meetings:
Tue, 10:00–12:00 (ct), A301
First meeting: 26.04
4 homework assignments to be solved individually
Evaluation and grade:
diploma: a grade reflects the percentage of points acquired.
B.Sc.: a grade contributes 30% to the final grade.
Bibliography
Dieter Gollmann.
Computer Security.
Wiley & Sons, 2006.
Ross Anderson.
Security Engineering.
Wiley & Sons, 2001.
Bruce Schneier.
Secrets and Lies: Digital Security in a Networked World.
Wiley & Sons, 2004. (fun to read)
A typical web application
Legitimate user
Internet
Browser
Webserver
Attack: interception of communication
Legitimate user
Internet
Browser
Webserver
Credit card number
Attacker
Security goal: confidentiality
Prevention of unauthorized reading of data
Prevention of unauthorized learning of information
Potential abuse scenarios:
Discovery of confidential information (e.g. details of a business
contract)
Discovery of authentication credentials (e.g. password sniffing)
Enforcement intruments:
Symmetric or asymmetric cryptography
Anonymization techniques
A typical web application
Legitimate user
Internet
Browser
Webserver
Attack: identity spoofing
Legitimate user
Internet
Browser
Webserver
Attacker
Fake webserver
Security goal: authentication
Verification of an identity of a person or a computer
Prerequisite for access control
Authentication methods:
Shared secrets (e.g. password or PIN)
Ticket systems (identity cards, digital certificates)
Challenge-response techniques
Biometric techniques
Human authentication: CAPTCHA’s, Turing test, etc.
Authentication risks: identity theft
A typical web application
Legitimate user
Internet
Browser
Webserver
Attack: injection of malicious code
Legitimate user
Internet
Malware
Browser
Webserver
XSS
attack
Attacker
Security goal: integrity
Prevention of malicious tampering of data
Potential abuse scenarios:
Fraudulent modification of data (e.g. 100,000¤ instead of
100¤ in an online transaction request)
Injection of malicious code in downloaded software
Evading detection by modification of a compromized operating
system
Enforcement instruments:
Integrity checking using cryptographic hash functions
A typical web application
Legitimate user
Internet
Browser
Webserver
Attack: server overload
Server overloaded
Legitimate user
Internet
Browser
Security goal: availability
A joint objective of security and dependability
May be caused by attacks as well as natural phenomena,
such as design errors or flash crouds.
Enforcement instruments:
Detection of DoS-attacks
Router and firewall reconfiguration
Service redundancy
Virtualization
A typical web application
Legitimate user
Internet
Browser
Webserver
Attack: transaction denial by a user
Legitimate user
Internet
Browser
Webserver
Transaction cancelled
Credit card charded
Security goal: accountability
An audit trail of security-related events
A key instrument of detection/response
A stronger form of accountability is non-repudiation:
unforgeable evidence that a certain action occurred.
Similar attacks as integrity
Enforcement instruments:
Integrity checks
Read-only audit
Digital certificates and trusted third parties
Summary
Security is not a solution but an ongoing process.
Security can only be achieved by a combination of technical
and organizational measures.
One of the biggest security risks is a user.
Security is a big challenge but lots of fun as well: a great
field of study and research.
Next lecture
The economics of computer security
Security threats
Security design principles