ECT 250: Survey of e-commerce technology
Security
Terminology
• Computer security is the protection of assets from
unauthorized access, use, alteration, or destruction.
• There are two types of security:
– Physical security including such devices as
alarms, fireproof doors, security fences, vaults.
– Logical security is non-physical protection.
• A threat is an act or object that poses a danger to
computer assets.
• A countermeasure is a procedure, either physical or
logical that recognizes, reduces, or eliminates a
threat.
2
Risk analysis
The countermeasure will depend both on the cost
associated with the threat and the likelihood that
the threat will occur.
• High probability, low impact: Contain and control
• High probability, high impact: Prevent
• Low probability, low impact: Ignore
• Low probability, high impact: Insurance or backup
Example: CTI computer systems under threat from
(1) virus, (2) fire, (3) earthquake, (4) theft
3
Types of threats
• Physical threats
– Natural phenomena: Earthquake, storm, tornado
– Arson, electrical shutdown, power surge
– Theft, sabotage
• Logical threats
– Impostors
– Eavesdroppers
– Thieves
4
Security terminology
• Secrecy
Protecting against unauthorized data disclosure,
and ensuring the authenticity of the data source.
Example: Use of stolen credit card numbers
• Integrity
Preventing unauthorized data modification.
Example: Changing of an e-mail message
• Necessity
Preventing data delays or denials.
Example: Delaying a purchase order for stock
5
Security policy
• Any organization concerned about protecting its
e-commerce assets should have a security policy.
• A security policy is a written statement describing
what assets are to be protected, why they are to be
protected, who is responsible for that protection,
and which behaviors are acceptable and not.
• The policy should address physical security, network
security, access authorizations, virus protection,
and disaster recovery.
6
History
• Early computer security measures:
– Computers were kept in locked central rooms
– Access was granted only to select individuals
– No one could remotely access the machine
• Modern systems are more complex:
– Remote processing
– Electronic transmission of information
– Widespread use of the Internet
7
E-commerce threats
E-commerce security is best studied by examining
the overall process, beginning with the consumer
and ending with the commerce server.
This analysis produces a three part structure:
1. Client security
2. Communication channel security
3. Server security
First, however, we will consider issues surrounding
copyright and intellectual property.
8
Copyright and IP
• Copyright is the protection of expression and it
typically covers items such as books, essays,
music, pictures, graphics, sculptures, motion
pictures, recordings, architectural works.
• Intellectual property is the ownership of ideas
and control over the representation of those
ideas.
• The U.S. Copyright Act of 1976 protects items
for a fixed period of time. Each work is
protected when it is created. A copyright
notice is not necessary.
9
Threats
The widespread use of the Internet has resulted in an
increase in intellectual property threats.
• It is very easy to reproduce an exact copy of anything
found on the Internet.
• Many people are unaware of copyright restrictions
protecting intellectual property.
• See Intellectual Property Resources on the Internet.
• A related issue is cybersquatting which is the practice
of registering a trademark of another company as a
domain name.
10
Protecting copyrights and IP
• Enforcing existing copyright laws can be difficult.
• Some methods for protecting digital IP include:
– Digital copyright laws
– Electronically locking files
– Digital watermarks
11
Digital watermarks
• Steganography is the practice of hiding information
within other information.
Example: “See everyone? Lucky Larry!”
What does it mean?
• Example of conventional watermark: $20 bill
• A digital watermark is a digital code or stream
embedded into a file. They do not affect the
quality of the file and may be undetectable.
• The presence of a watermark can indicate that the
file was stolen.
12
Outline
E-commerce security is best studied by examining
the overall process, beginning with the consumer
and ending with the commerce server.
This analysis produces a three part structure:
1. Client security
2. Communication channel security
3. Server security
13
Secrecy vs. privacy
Secrecy
• The prevention of unauthorized information
disclosure.
• A technical issue involving physical and logical
mechanisms.
• Example: Encryption of e-mail.
Privacy
• The protection of individual rights to non-disclosure.
• The law enforces privacy protection.
• Example: Employers reading employees’ e-mail.
See: E-lessons in the Chicago Tribune
14
Cookies
• Cookies are files that store identifying information
about clients for the purposes of personalization.
See The Cookie FAQ for more information.
• Malicious programs can read cookies to gain private
information. Many sites do not store sensitive
data in cookies.
• Cookies are not inherently bad, but it is wise to learn
about them. Software exists that enables you to
identify, manage, display, and eliminate cookies.
See Cookie Crusher, and Cookie Pal.
15
Anonymous browsing
• Since many Web sites gather information about
visitors to their sites, you are constantly giving
away information such as your IP address.
• There are portals that allow you to surf the Web
anonymously by visiting their portal first.
• Their site acts as a firewall, preventing any leaks
in information.
• Example: Anonymizer.com
16
Client threats
• Malicious code is a program that causes damage
to a system.
• Malicious code can affect both the server and the
client. Typically servers engage in much more
thorough detection and disinfection.
• Examples:
 Virus or worm
 Trojan horses
 Malicious mobile code in active content
17
Viruses
• Macro virus (Anna Kournikova)
– 75-80% of all viruses
– Application specific
– Spread through e-mail attachments
• File-infecting virus
– Infects executable files (.com, .exe, .drv, .dll)
– Spread through e-mail and file transfer
• Script viruses (ILOVEYOU)
– Written in scripting languages (VBScript,
JavaScript)
– Activated by clicking a .vbs or .js file
18
Worms
• Viruses are often combined with a worm.
• A worm is designed to spread from computer to
computer rather than from file to file.
• A worm does not necessarily need to be activated
by a user or program for it to replicate.
• Example: ILOVEYOU virus was both a script
virus and a worm that propagated by sending
itself to the first 50 people in a user’s Microsoft
Outlook address book.
19
Trojan horse programs
• Malicious active content may be embedded
into a seemingly innocuous Web page.
• A Trojan horse is a program hidden inside
another program or Web page that masks its
true purpose.
• Origin of the name?
20
Active content
• Active content, programs embedded in Web pages,
can be a threat to clients.
• Active content displays moving graphics, downloads
and plays audio, places items into shopping carts,
computes the total invoice amount, etc.
• Active content can be implemented in a variety of
ways:
– Java
– JavaScript
– ActiveX
21
Java
• Java is a high-level, object-oriented programming
language developed by Sun Microsystems.
• It was created for embedded systems, but its most
popular use has been in Web pages where applets
implement client-side applications.
• Java is platform independent.
• It reduces the load on servers by downloading work
onto the client’s machine.
22
Java sandbox
• To counter security problems, a special security
model called the Java sandbox was created.
• The Java sandbox confines Java applet actions to
a set of rules defined by a security model.
• These rules apply to all untrusted Java applets,
those that have not been proven to be secure.
• The sandbox prevents applets from performing
file input or output and from deleting files.
• All applets from a local file system are trusted
and have full access to system resources.
23
JavaScript
• JavaScript is a scripting language developed by
Netscape to enable Web page designers to build
active content.
• When you download embedded JavaScript code
it executes on your machine. It does not operate
under the sandbox model.
• For this reason it can invoke privacy and integrity
attacks by destroying your disk, copying credit
card numbers, recording the URLs of pages you
visit, etc. Secure connections do not help.
• JavaScript programs must be explicitly run.
24
ActiveX controls
• ActiveX is an object that contains programs and
properties that Web designers place on pages
to perform certain tasks.
• ActiveX controls only run on Windows machines.
• When embedded ActiveX controls are downloaded,
they are run on the client machine.
• Examples: Flash, Shockwave
• Once downloaded, ActiveX controls have access to
system resources, including the operating system.
25
Graphics and plug-ins
Graphics:
• Some graphics file formats have been designed to
contain instructions on how the graphic is to be
rendered.
• Code embedded into the graphic is a potential threat.
Plug-ins:
• A browser plug-in is a program that enhances the
capabilities of the browser. They handle things like
playing audio clips and displaying movies.
• Many plug-ins work by executing commands buried
within the media they are displaying.
26
Protecting client computers
The primary task in protecting a client machine is
the monitoring of active content. Each browser
handles this in a different way.
The primary issue is trust of the site providing the
active content.
One way to improve trust is through the use of
digital certificates.
27
Digital certificates
• A digital certificate, or digital ID, is an attachment
to a Web page or e-mail message verifying the
identity of the creator of the page/message.
• It identifies the author and has an expiration date.
• A page or message with a certificate is signed.
• The certificate is only a guarantee of the identity of
the author, not of the validity of the page/code.
• Certificates are obtained from a Certificate Authority
(CA) that issues them to an individual or an
organization. Example: VeriSign
• Identification requirements vary.
28
Security in Internet Explorer
• Provides content warnings
• Reacts to ActiveX and Java-based content
• Uses Microsoft Authenticode technology that:
– Verifies who signed the code
– Checks if the code has been modified since
it was signed
• If a publisher has not attached a code you can
set the browser to not download the page.
• It is up to you to designate which companies you
trust using “zones”.
29
Authenticode
• When a page with a certificate is downloaded:
– The certificate is detached
– The identity of the CA is verified
– The integrity of the program is checked
• A list of trusted CAs is built into the browser along
with their public keys.
• Both the certificate and the key must match.
30
Security zones
• You can specify different security settings based
on the origin of the information being downloaded.
• There are four zones:
– Internet: Anything not classified in another way
– Local intranet: The internal network
– Trusted sites
– Restricted sites: Web sites you do not trust
31
Security levels
• High: Safer but less functional; less secure features
are disabled; cookies are disabled.
• Medium: Safe but functional browsing; prompts
before downloading potentially unsafe content;
unsigned ActiveX will not be downloaded.
• Medium-low: Downloads everything with prompts;
most content will be run without prompts; unsigned
ActiveX will not be downloaded.
• Low: Minimal safeguards; most content will be
downloaded and run without prompts; all active
content can be run.
32
Security settings
• The Custom Level button allows you to alter the
defaults provided by a specific level.
• All protections are a choice between running and
not running active content.
• No monitoring of code occurs during execution.
33
Netscape Navigator
• You can control whether active content (Java
or Javascript) will be downloaded.
• This is done using the Preferences dialog box.
• On the Advanced tab you can specify what
should be done for images, Java, JavaScript,
style sheets, and cookies.
• A message will be sent when Java or JavaScript
is downloaded indicating whether the content
is signed. A risk assessment is given.
34
Outline
E-commerce security is best studied by examining
the overall process, beginning with the consumer
and ending with the commerce server.
This analysis produces a three part structure:
1. Client security
2. Communication channel security
3. Server security
35
Communication channel threats
• The Internet was designed for redundancy, not
secure communications. The DOD intended to
encrypt all information moving in the network.
• The Internet remains in its insecure state.
• It is impossible to guarantee that every computer
through which information passes is safe, secure,
and non-hostile.
• The possible security violations include secrecy,
integrity, and necessity threats.
36
Sniffer programs
• E-mail transmissions can be compromised by the
theft of sensitive or personal information.
• Sniffer programs record information as it passes
through a particular router.
• This can capture:
– Passwords
– Credit card numbers
– Proprietary corporate product information
37
Integrity threats
• An integrity threat is also called active wiretapping.
• This occurs when an unauthorized party alters a
message in a stream of information.
• Cyber vandalism is the electronic defacing of an
existing Web site’s page. This occurs when an
individual replaces content on the site.
• Masquerading or spoofing occurs when perpetrators
substitute the address of their site for a legitimate
site and then alter an order or other information
before passing it along.
38
Necessity threats
• Also known as delay or denial threats, the purpose
is to disrupt or deny normal processing.
• Slowing processing can render a service unusable.
• The most famous example of a denial attack is the
Robert Morris Internet Worm attack, perpetrated
in 1988.
39
Encryption
• Since the Internet is inherently insecure, any
secret information must be encrypted.
• Encryption is the coding of information using
a program and a key to produce a string of
unintelligible characters.
• The study of encryption is called cryptography.
The name comes from krupto (secret) and
grafh (writing).
• Cryptography is not related to steganography.
40
Terminology
• Unencrypted data is called plaintext.
• Encrypted data is called ciphertext.
• A key is a string of digits that acts as a password.
• Only the intended receivers should have the key
that transforms the ciphertext into plaintext.
• A cipher or cryptosystem is a technique or
algorithm for encrypting messages.
• Cryptographic ciphers have a long history.
41
Early cipher systems
• Ciphers were used as far back as the ancient
Egyptians. Text was encrypted by hand.
• The two main types of ciphers were used:
– Substitution cipher: Every occurrence of a
given letter is replaced by a different one.
Example: “a” by “b”, “b” by “c”, etc.
“Uftujoh, uftujoh”
– Transposition cipher: The ordering of the
letters is shifted to form new words.
Example: Plaintext = example
Ciphertext = eape xml
42
Modern cipher systems
• Modern cryptosystems are digital; the algorithms
are based on the individual bits of a message
rather than letters of the alphabet.
• Computer information is stored as binary strings,
sequences of 0’s and 1’s.
• Encryption and decryption keys are binary strings
of a given key length.
Example: 128-bit encryption systems.
43
Knowledge needed
• Someone can know the details of an encryption
algorithm and yet not be able to decipher an
encrypted message without the key.
• The resistance of the encrypted message depends
on the size, in terms of bits, of the key used in
the encryption procedure. The longer the key,
the more computing power and time it takes to
break the code.
Example: 128-bit encryption systems.
44
Types of cryptosystems
There are two main types of cryptosystems:
• Private-key cryptography
Also known as symmetric or secret-key
encryption, it uses a single key to both
encrypt and decipher the message.
• Public-key cryptography
Also known as asymmetric encryption, it uses
a public key to encrypt messages and a private
key to decipher messages.
45
Private-key cryptography
Suppose that Alice wishes to send Bob a message:
• They exchange a secret key.
• Alice encodes the message using the secret key.
• The ciphertext is sent to the Bob.
• Bob decodes the message using the secret key.
Problems with this approach:
• How do Alice and Bob exchange the secret key?
• There is no authentication of the sender.
• What if both wish to communicate with Chris?
46
Key distribution center
• A key distribution center shares a different key
with each user in the network.
• When Alice and Bob want to communicate, they
obtain a session key from the KDC.
• They communicate using the session key.
• If Chris wants to communicate with Alice, they
obtain a new session key, improving security.
• If the KDC is compromised, the security of the
entire network is at risk.
47
DES
• Data Encryption Standard (DES) is a 56-bit
private-key encryption algorithm developed
by the NSA and IBM in the 1950s.
• Cryptoanalysts no longer believe that 56-bit
keys are secure. See Cracking the 56-bit DES
system.
• The current standard is to use Triple DES, three
DES systems in a row, each with its own key.
• Work is underway on the Advanced Encryption
Standard (AES).
48
Public-key cryptography
• Public-key cryptography uses two related keys.
• The private key is kept secret by its owner.
• The public key is freely distributed.
• When someone wishes to communicate with Alice
they use Alice’s public key to encode their
message. Alice then uses her private key to
decode the message.
• Although the two keys are mathematically related,
it would require enormous computing power to
deduce the private key from the public one.
49
Authentication
• If a customer sends a message to a merchant using
the merchant’s public key, the customer knows
that only the merchant can decipher the message.
• Similarly if the customer sends a message using the
customer’s private key, the merchant can decipher
it using the customer’s public key thus identifying
the customer.
• Both together give two way authentication.
Example: Merchant to customer
– First encode using the customer’s public key.
– Use the merchant’s private key on the result.
50
RSA
• The mostly commonly used public-key system
is RSA (named for its inventors: Ron Rivest, Adi
Shamir, and Leonard Adleman).
• Invented in 1977 at MIT.
• Most secure e-commerce transactions on the
Internet use RSA products. See the RSA security
page.
• RSA is built into many Web browsers, commerce
servers, and e-mail systems.
Examples: Internet Explorer, Apache Web Server,
Netscape Communicator.
51
PGP
• Another common public-key system is PGP
(Pretty Good Privacy).
• Used to encrypt e-mail messages and files.
• PGP is freely available for non-commercial
use. See the MIT Distribution Center.
52
Key agreement protocols
• A drawback of public-key algorithms is that they
are not efficient for sending large amounts of
information.
• Public-key algorithms can be used to exchange
private keys.
• The process by which two parties exchange keys
over an insecure medium is a key agreement
protocol.
• The most common key agreement protocol is a
digital envelope.
53
Digital envelopes
The basic idea:
• A message is encrypted using a secret key.
• The secret key is encrypted using a public key.
• Only the receiver can decipher the secret key.
Example:
• Alice encrypts a message using a secret key.
• Alice encrypts the secret key using Bob’s public key.
• Alice sends both to Bob.
• Bob decrypts the secret key using his private key.
• He then uses that key to decipher the message.
54
Key management
• Most compromises in security result from poor key
management, e.g. the mishandling of private keys
resulting in key theft.
• An important part of management is the generation
of keys.
• The key length must be sufficiently long.
• A key generation algorithm that is unintentionally
constructed to select keys from a small subset of
all possible keys may allow a third party to crack
the encryption.
• Key generation algorithms must be random.
55
Secure protocols
• Secure sockets layer (SSL)
The purpose is to secure connections between
two computers.
Developed by Netscape communications.
• Secure Hypertext Transfer Protocol (S-HTTP)
The purpose is to send individual messages
securely.
Developed by CommerceNet.
56
SSL
• To begin, a client sends a message to a server.
• The server responds by sending its digital
certificate to the client for authentication.
• Using public-key cryptography, the client and
server negotiate session keys to continue.
• Once the keys are established, the transaction
proceeds using the session keys and digital
certificates.
• All information exchanged is encoded.
• See Figure 6-17 on page 221.
57
Types of communication
SSL resides on top of TCP/IP in the Internet
protocol suite.
As a result it can secure many different types
of communications:
• FTP sessions
• Telnet sessions
• HTTP sessions: S-HTTP
58
SSL key length
Secure Sockets Layer comes in two strengths:
1. 40-bit
2. 128-bit
Both refer to the length of the session key generated
by every encrypted transaction.
The 40-bit version is available for export, but U.S.
firms may only use the 128-bit version in products
intended for the U.S. market.
59
Secure protocols
• Secure sockets layer (SSL)
The purpose is to secure connections between
two computers.
Developed by Netscape communications.
• Secure Hypertext Transfer Protocol (S-HTTP)
The purpose is to send individual messages
securely.
Developed by CommerceNet.
60
Limitation
Although SSL protects information as it is being
transmitted, it does not protect information once
it is stored in the merchant’s database.
The data needs to be encrypted and/or the server
secured to protect information that was previously
transmitted.
61
Secure HTTP
• Secure HTTP (S-HTTP) is an extension of HTTP.
• It is concerned with securing individual messages.
• Works at the application level.
• Security features:
– Client and server authentication (using RSA)
– Symmetric encryption for communication
– Message digests
– The client and server may use separate S-HTTP
techniques simultaneously. Example: The
client may use private keys and the server may
use public keys.
62
Establishing contact
• The details of S-HTTP security are conducted
during the initial negotiation session.
• Security details are specified in special packet
headers that are exchanged.
• Once the client and server have agreed to the
security implementations that will be enforced
between them, all subsequent messages are
wrapped in a secure envelope.
63
Security techniques
• The client and server can specify that a security
feature is required, optional, or refused.
• When a feature is required it must be used or
the connection will be terminated.
• Features:
– Use of private-key encryption
– Server authentication
– Client authentication
– Message integrity
64
Transaction integrity
• It is difficult to prevent integrity violations, but
techniques can enable integrity violations to be
detected; information can then be re-sent.
• The basic idea:
– A hashing algorithm is applied to produce a
message digest.
– The message digest is encrypted to produce a
digital signature.
65
Message digest
• A hashing function is applied to the message.
• This produces a number that is based on the
length and content of the message. Good
hash algorithms have few collisions.
• The message digest is appended to the message.
• The receiver recalculates the message digest.
• If they two do not match, integrity is violated.
Problem: What if an adversary changes both the
message and the message digest?
66
Digital signature
• The sender computes the digest, encrypts it using
her private key, and then appends the encrypted
digest onto the message.
• Only the sender could have created the digital
signature.
• The merchant deciphers the digest, computes his
own digest, and compares the two. If they match
the integrity of the message was preserved.
• For added security, the digital signature and the
message can be encrypted.
67
E-commerce security
E-commerce security is best studied by examining
the overall process, beginning with the consumer
and ending with the commerce server.
This analysis produces a three part structure:
1. Client security
2. Communication channel security
3. Server security
68
Server threats
Server threats can be classified by the means used
to obtain unauthorized access into the server:
• The Web server and its software
• Back-end programs and servers such as ones for
a database
• Common Gateway Interface (CGI) programs
• Other utility programs residing on the server
69
Security levels
• Web servers running on most machines can be
set to run at various privilege levels.
– The highest one allows access to any part of
the system, including sensitive areas.
– The lowest level provides a logical fence that
prevents access to sensitive areas.
– The rule is to use the lowest level needed to
complete a given task.
• Setting up a Web server to run in high privilege
mode can cause potential threats.
70
Entering passwords
• Web servers that require usernames and passwords
can compromise security by revealing them.
• Because the Web server needs the information as
it moves from page to page, it may place that in
a cookie on the client’s machine.
• The server must be careful not to request that the
cookie be transmitted unprotected.
71
Username/password pairs
• Web servers may keep files with username/password
pairs to use for authentication.
• If these files are compromised then the system can be
attacked by people masquerading as others.
• Users who choose passwords badly also pose a threat
to Web server security. Passwords that are easily
guessed, such as birth dates, child or pet names, are
poor choices.
• Administrators often run programs that attempt to
guess users’ passwords as a preventative measure.
72
Database threats
• Because databases hold valuable information, attacks
on them are particularly troubling.
• Security features rely on usernames/passwords.
• Security is enforced using privileges.
• Databases that fail to store usernames/passwords in a
secure manner or fail to enforce privileges can be
compromised.
• During an attack, information may be moved to a less
protected level of the database, giving full access.
73
CGI threats
• CGI implements the transfer of information from
a Web server to another program.
• Like Web servers, CGI scripts can be set to run
unconstrained (with high privilege).
• Defective or malicious CGI scripts can access or
destroy sensitive information.
• Old CGI scripts that have been replaced can be
loopholes for access into the system.
• CGI scripts can reside anywhere and are difficult
to track.
74
Buffer overflows
• A buffer is an area of memory set aside to hold
data read from a file or database.
• Buffers are necessary because I/O operations are
much slower than CPU operations.
• Buffer overflows, either from a buggy program
or as part of a deliberate attack, can result in:
– A computer crash
– Instructions for an attacking program being
written into the return address save area
causing it to be run by the Web server CPU
75
Securing the server
• Access control and authentication
Controlling who and what has access to the
server; includes both users and other servers.
• Firewalls
Inside: Network and machines protected by
the firewall.
Outside: All other networks.
76
Access control
• Authentication via digital certificates and signatures.
• Usernames/passwords
– Usernames are stored as clear text
– Passwords are stored as encrypted text
– A password entered is encrypted and compared
against the encrypted password.
• An access control list gives the users that can access
certain files and folders in the system.
Read, write, and execute permissions may be set
separately.
77
Firewalls
• All traffic from the outside must pass through it.
• Only authorized traffic is allowed to pass.
• The firewall should be immune to attack.
• Operates at the application layer.
• Trusted networks are inside; untrusted ones outside.
• Can be used to separate divisions of a company.
• The same policies should apply to all firewalls.
• Unnecessary software should be stripped off.
78
Types of firewalls
• Packet filters
Filters traffic according to source and destination
(IP address) based on a set of rules.
• Gateway servers
Filter traffic according to the application requested.
Example: Incoming FTP requests granted but outgoing requests denied.
• Proxy servers
Communicate with the Internet on behalf of the
private network. Also used as a cache for Web
pages.
79