1
CS5038 The Electronic Society
Security 1: Security and Crime Online
We’ll begin with a look at what’s out there. In Security 2, we’ll think about it all a bit more conceptually.
• Roots• Types of Attacks• Some Security Problems and Perspectives• Major security issues in online systems• Security Risk Management• Security Technologies• Government Intrusion• Government Power
2
Roots of Crime and Protection
• Conflicts of interest between actors (individuals, organizations, grous, states).
• E.g. I have something I want to keep, you also want it, resolution = ?
• You are in my way, resolution = ?
• Social institutions (the law, government) define certain types of (perceived) injustice relating to actual situations to be crimes.
• Protection mechanisms and systems created by individuals and society to reduce risks and try to control crime.
3
Roots of Crime
• Various groups have given a lot of though to this:• The police• The legal profession• Criminologists• Sociologists
• e.g., social motivations and causes• Philosophers
• E.g., individual moral issues and decisions• Economists
• E.g., self-interested rationality, mis-aligned incentives, conflicts of interest
• Politicians.
4
The Columbo Theory •Popular accounts of criminal law, and some real policemen often like to talk about means, motive and opportunity for crimes.
• (but Criminologists don’t accept this).
•Individuals with general methods to take advantage of others
• Means•Individuals with competing interests
• Motive•Individuals presented with scenarios to act
• Opportunity
5
Online Crime• Think about the MMO in the online environment
• Same people• Same basic motives• Similar conflicts of interest
• Different environment:• Different means are available• Different opportunities for crime• Different prevalence of types of crime• Different `implementation’ of crimes
Some Types of crime online• Financially motivated
• Probably the biggest and fastest growing chunk
• Theft, fraud. • Stolen credit card details, hacked bank accounts• Unlawful file-sharing, downloading copyright material
• Defamation, libel• Breaches of privacy• Exploitation of vulnerable groups (children etc.)• Commission of other crimes• Industrial espionage and sabotage• State attacks on states
6
7
Types of Attacks
• Depends on MMO, but opportunities here are vulnerabilities.• Physical: burglary to steal machine.• Shoulder surfing – e.g., observe user id and password entry• Social engineering: partly non-technical
e.g. phone or e-mail employee posing as administrator (spear-)phishing
•Technical Attacks:• Exploit vulnerabilities in applications • Exploit vulnerabilities in operating systems• Exploit vulnerabilities in networks
•Mixtures of the above
8
Types of Attacks• Port scanning: look for protocol vulnerabilities
• Packet sniffing: listen to data packets on network
• DNS spoofing: change DNS tables or router maps
• Denial of Service (DOS):
• Attacks via vulnerabilities in communications protocols
• Indirect attacks via third parties (e.g. security certificate providers)
• Code breaking: discovery of cryptographic keys
• Malicious code: (next slide)
9
Types of Attacks• Malicously-used data/simple program manipulations
• SQL injection attacks• Buffer overflow: hide code at the end of a long entry
• Malicious programs:Viruses – propagate locallyWorms – propagate between systemsMacro viruses and macro worms (inside applications)Trojans (Trojan horses) – e.g., posing as a game, keylogging
10
Attack Sophistication Vs. Intruder Knowledge
Source: Special permission to reproduce the CERT ©/CC graphic © 2000 by Carnegie Melon University, in Electronic Commerce 2002 in Allen et al. (2000).
www.cert.org
11
Sophistication Increase• There are more and more sophisticated attacks out there.• There are lots of sophisticated attackers out there.
BUT• A lot of the crime is committed by those with very limited knowledge and skills (script kiddies)
• Relatively easy and low-risk (compared to trad. Crime)• There is a whole technology stack (ready made tools), social community to support crime online, and even a supply chain.
Hack toolsCrime forums and markets for criminal goodsBlack-hat researchers, those who search for zero-day attacks in applications, operating systems and networks, malware writers, packers who build trojans inside innocent-looking files.
12
Some Security Problems Security and ease of use can be in conflict
e.g., passwords, electronic wallets/credit card Security takes a back seat to market pressures
e.g., trying to hurry the time to market Security architectures are often only as strong as their weakest
points IT monoculture gives asymmetry in effort/reward for attackers
and defenders Security of a site depends, to some extent, on the security of the
whole Internet – DOS, e-mail, … . Knowledge of vulnerabilities is increasing faster than it can be
combated – hackers share secrets and write tools Flaws in common applications – Outlook, Word, Acrobat, … Under-reporting
Why might a company not report a crime?
13
Security Perspectives
User perspective Is Web server owned and
operated by legitimate company?
Web page and form contain some malicious code content?
Will Web server distribute user’s information to another party?
(or allow to be stolen)
Company perspective Will the user attempt to
break into the Web server or alter the site?
Will the user try to disrupt the server so it is not available to others?
Filling a form at a simple marketing site:
Both perspectives Is network connection free from eavesdropping? Has information sent back and forth between server and
browser been altered?
14
Major security issues in online systems
Privacy and/or Confidentiality trade secrets, business plans, health records, credit card
numbers, records of web activity
Authentication – for Web page, e-mail Something known – password Something possessed – smartcard Something unique – signature, biometrics
Integrity – protect data from being altered or destroyed Financial transaction
Non-repudiation – not denying that you bought something
Later, we’ll look at the ontology of security issues more carefully.
PAIN – for payment systems
15
Security Risk ManagementDefinitions involved in risk management
Assets – anything of value worth securing Threat – eventuality representing danger to an asset Vulnerability – weakness in a safeguard
Risk Assessment
Determine organizational objectives Cannot safeguard against everything – limit to satisfying objectives Example: if a website is to service customer complaints, then top
priority is to ensure no disruption – rather than protect data Inventory assets – value and criticality of all assets on network Delineate threats – hackers, viruses, employees, system failure Identify vulnerabilities - http://www.cve.mitre.org/cve/ Quantify the value of each risk
e.g., Risk = Asset x Threat x Vulnerability (e.g., Symantec.com) Is this realistic?
16
Security TechnologiesFirewall:
Like a bouncer, has rules to determine if data is allowed entry
Virtual Private Network (VPN): Encryption – scramble communications
Intrusion Detection Systems (IDS): Automatically review logs of file accesses and violations Analyze suspicious activity for known patterns of attack
Intrusion Prevention Systems (IPS): Similar to IDSs Actively block connections, code proliferation
17
Government Protecting CitizensIdentity Cards:
The national Registration Act: outbreak of World War II Help police know if citizens rightfully belonged to the UK
After War: member of public charged with not producing ID card when requested to by a policeman.
Case went to appeal: Lord Chief Justice Lord Goddard:
“This Act was passed for security purposes and not for the purposes for which, apparently, it is now sought to be used.”
Ruling underlined public’s disquiet with the way that ID cards had slowly become a compulsory feature of everyday life in the UK
Cards repealed in 1952Based on essay by: Steven McGhee
18
Government Protecting Citizens
Attempts at reintroducing ID cards made at various times over the intervening years
After 9/11 attacks, ID cards started to look more likely
Compulsory for foreign nationals resident in the UK from late 2008. Seems to be now known as the `biometric residence permit’.
Voluntary for British nationals from 2009 onwards.
Cancelled Jan 2011.
Compulsory for workers in certain high-security professions (airport)
ID Card
19
1. Symbol meaning a chip is embedded in the card
2. ID card number
3. Citizenship. Foreign nationals in the UK are being given different cards.
4. Place of birth
5. Signature - digitally embedded in the card
6. Date of card issue and date it becomes invalid
7. Photo taken to biometric standards
8. Biometric chip holds fingerprint record
9. Swipe zone. Information which can be automatically read by computer
ID Cards Arguments put forward by the Government:
Fight against ID theft Prevention of illegal immigration Fight against terrorism Reduce benefit fraud “help safeguard civil liberties” (in direct contrast to
critics)James Hall (chief executive of the Passport and Identity Cards service). How?
Election issue in 2010: Coalition Government cancelling ID cards; Ed Miliband suggests Labour Government was ‘careless’ with civil liberties (Matthew Norman, The Independent, Monday, 9 August 2010)
This brings us to questions about privacy
20
21
A law-abiding person has nothing to fear?
Why do we need privacy anyway?
If hold certain political beliefs, then might lose job or promotion Someone who has a disease which people fear A person who is homosexual, but whose family does not know A teenage girl secretly visiting her boyfriend of a different race to her family Someone seeking to change job (needs to attend interviews) A woman scouting out places to go to get away from her violent partner Someone going to Alcoholics Anonymous or drugs rehabilitation sessions Someone going to church, synagogue or mosque who fears the scorn of
friends, colleagues or family Someone attending classes of religious instruction prior to converting to
another religion (fears vengeance) A son or daughter visiting an estranged parent without the knowledge of the
parent they live with. An ex-criminal seeking to go straight who must meet his probation officer or
register with the police. (there have been some examples with children.) Authorized people may abuse access to information Information not secure
http://www.samizdata.net/blog/archives/004600.html
22
`Quis custodiet ipsos custodes?’
`Who will watch the watchmen?’
Socrates/Plato
"Power tends to corrupt, and absolute power corrupts absolutely. Great men are almost always bad men, … "
Lord Acton
"Unlimited power is apt to corrupt the minds of those who possess it."
William Pitt, the Elder
23
Separation of Powers: Trias Politica• Model was (first) developed in ancient Greece. Came into
widespread use by the Roman Republic • State divided into branches or estates, each with separate
and independent powers and areas of responsibility. • Normally, roughly:
• Executive: government, policy, direction of state bureaucracy
• Legislature: assembly to deal with formation/change of law and some other issues (tax, budget, depends)
• Judiciary: interprets and applies law.
• What about various, current states? UK, US, EU …• Parliamentary vs. presidential system.
24
Separation of Powers: Trias Politica
• "the independence of the judiciary has to be real, and not merely apparent”
Montesquieu
Judiciary most important of powers – at least often from the point-of-view of the individual
Independent and unchecked.
Also considered the least dangerous – remit is quite confined.
25
Separation of Powers – Need More?
• The Popular
• The Bureaucracy
• The Media (in the UK often referred to as the ‘fourth estate’, the first three being, according to Edmund Burke, the Lords Spiritual (Bishops, the clergy), The Lords Temporal (the nobility), and the Commons (the peasantry))
• The Financial Oligarchy?
26
Questions
• How well are various systems of government able to provide good government for their citizens in the face of rapidly changing technology?• New variations on crimes?• New threats?• New protection needed?• New variations on rights?• How to deal with many organizations operating across
traditional boundaries of nation states?
27
Summary
• Attack Sophistication vs. Intruder Knowledge• Types of Attacks – non-technical, buffer overflow, malicious
code, etc.• Security Problems – ease of use, market pressure, weak links• Security Concerns – e.g., filling a form; who’s watching?• Major security issues in online systems – PAIN• Security Risk Management – assessment, planning,
implementation, monitoring• Security Technologies – firewall, VPN, IDS• Government Protecting Citizens