About This eBook

ePUB is an open, industry-standard format for eBooks. However, support of ePUB and its many features varies across reading devices and applications. Use your device or app settings to customize the presentation to your liking. Settings that you can customize often include font, font size, single or double column, landscape or portrait mode, and figures that you can click or tap to enlarge. For additional information about the settings and features on your reading device or app, visit the device manufacturer’s Web site.

Many titles include programming code or configuration examples. To optimize the presentation of these elements, view the eBook in single-column, landscape mode and adjust the font size to the smallest setting. In addition to presenting code and configurations in the reflowable text format, we have included images of the code that mimic the presentation found in the print book; therefore, where the reflowable format may compromise the presentation of the code listing, you will see a “Click here to view code image” link. Click the link to view the print-fidelity code image. To return to the previous page viewed, click the Back button on your device or app.

Computer Security Fundamentals

Fifth Edition

Dr. Chuck Easttom

Computer Security Fundamentals, Fifth Edition

Copyright © 2023 by Pearson Education, Inc.

All rights reserved. This publication is protected by copyright, and permission must be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions, request forms, and the appropriate contacts within the Pearson Education Global Rights & Permissions Department, please visit www.pearson.com/permissions.

No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein.

ISBN-13: 978-0-13-798478-7
ISBN-10: 0-13-798478-2

Library of Congress control number: 2022917281

ScoutAutomatedPrintCode

Trademarks

All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Pearson cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

Microsoft® Windows®, and Microsoft Office® are registered trademarks of the Microsoft Corporation in the U.S.A. and other countries. This book is not sponsored or endorsed by or affiliated with the Microsoft Corporation.

Warning and Disclaimer

Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The author and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book.

Microsoft and/or its respective suppliers make no representations about the suitability of the information contained in the documents and related graphics published as part of the services for any purpose. All such documents and related graphics are provided “as is” without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information, including all warranties and conditions of merchantability, whether express, implied or statutory, fitness for a particular purpose, title and non-infringement. In no event shall Microsoft and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use or performance of information available from the services.

The documents and related graphics contained herein could include technical inaccuracies or typographical errors. Changes are periodically added to the information herein. Microsoft and/or its respective suppliers may make improvements and/or changes in the product(s) and/or the program(s) described herein at any time. Partial screen shots may be viewed in full within the software version specified.

Special Sales

For information about buying this title in bulk quantities, or for special sales opportunities (which may include electronic versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding interests), please contact our corporate sales department at corpsales@pearsoned.com or (800) 382-3419.

For government sales inquiries, please contact governmentsales@pearsoned.com.

For questions about sales outside the U.S., please contact intlcs@pearson.com.

Editor-in-Chief

Mark Taub

Product Line Manager

Brett Bartow

Executive Editor

James Manly

Development Editor

Christopher Cleveland

Managing Editor

Sandra Schroeder

Project Editor

Mandie Frank

Indexer

Ken Johnson

Proofreader

Donna Mulder

Technical Editor

Lewis Heuermann

Publishing Coordinator

Cindy Teeters

Designer

Chuti Prasertsith

Compositor

codeMantra

Pearson’s Commitment to Diversity, Equity, and Inclusion

Pearson is dedicated to creating bias-free content that reflects the diversity of all learners. We embrace the many dimensions of diversity, including but not limited to race, ethnicity, gender, socioeconomic status, ability, age, sexual orientation, and religious or political beliefs.

Education is a powerful force for equity and change in our world. It has the potential to deliver opportunities that improve lives and enable economic mobility. As we work with authors to create content for every product and service, we acknowledge our responsibility to demonstrate inclusivity and incorporate diverse scholarship so that everyone can achieve their potential through learning. As the world’s leading learning company, we have a duty to help drive change and live up to our purpose to help more people create a better life for themselves and to create a better world.

Our ambition is to purposefully contribute to a world where:

Images Everyone has an equitable and lifelong opportunity to succeed through learning.

Images Our educational products and services are inclusive and represent the rich diversity of learners.

Images Our educational content accurately reflects the histories and experiences of the learners we serve.

Images Our educational content prompts deeper discussions with learners and motivates them to expand their own learning (and worldview).

While we work hard to present unbiased content, we want to hear from you about any concerns or needs with this Pearson product so that we can investigate and address them.

Images Please contact us with concerns about any potential bias at https://www.pearson.com/report-bias.xhtml.

Credits

Figure 3.3, Figure 3.4: Mozilla Corporation

Figure 3.5, Figure 13.8: Google

Figure 3.6: HMA

Figure 3.7, Figure 6.11, Figure 13.1, Figure 13.2: Verizon Communications

Figure 4.2, Figure 4.3: Praetox Technologies

Figure 5.2: CEXX.ORG

Figure 5.3 - Figure 5.5: Actiance, Inc

Figure 5.6: Symantec Corporation

Figure 5.7: McAfee, LLC

Figure 5.8, Figure 5.9: Avast Software s.r.o.

Figure 5.10: MalwareBytes

Figure 6.1: Netcraft Ltd

Figure 6.2: Internet Archive

Figure 6.3: NMAP.ORG

Figure 6.4: Massimiliano Montoro

Figure 6.5, Figure 6.6: Shodan

Figure 6.8: Slashdot Media

Figure 6.9: TeraBIT Virus Maker

Figure 6.12: Digital Pharmacist Inc

Figure 7.1: Carnegie Mellon University

Figure 7.2: New Africa/Shutterstock

Figure 7.3: SJ Travel Photo and Video/Shutterstock

Figure 7.4: Reed Kaestner/Getty Images

Figure 7.5: IDRIX

Figure 9.2: Cisco, Inc

Figure 9.4, Figure 9.6, Figure 9.8: Linus Torvalds

Figure 11.4 - Figure 11.8: Tenable, Inc.

Figure 11.9, Figure 11.10: The OWASP Foundation Inc

Figure 11.11, Figure 11.12: Shodan

Figure 11.13, Figure 11.14: OffSec Services Limited

Figure 11.15 - Figure 11.17: Sparta

Figure 11.18: Subgraph

Figure 11.19: Pentest-Tools.com

Figure 11.20: United States Department of Commerce

Figure 12.1: 8studio/123RF

Figure 12.2: Sinn Féin

Figure 12.3: BBC

Figure 12.4, Figure 12.5: AELE

Figure 12.6: David Carney

Figure 12.7: People Drug Store

Figure 12.8: ccPal Store

Figure 13.3: Internet Oracle, Inc

Figure 13.4: U.S. Securities and Exchange Commission

Figure 13.5: Federal Bureau of Investigation

Figure 13.6: Texas Department of Public Safety

Figure 13.7: U.S. Department of Justice

Figure 13.9 - Figure 13.11: Maltego Technologies

Figure 14.1 - Figure 14.5: Exterro, Inc

Figure 14.6, Figure 14.7, Figure 14.11: PassMark™ Software

Figure 14.8, Figure 14.9: Defiant Technologies, LLC

Figure 14.10: robwilson39/123RF

Cover: JLStock/Shutterstock

Contents at a Glance

Introduction

1 Introduction to Computer Security

2 Networks and the Internet

3 Cyber Stalking, Fraud, and Abuse

4 Denial of Service Attacks

5 Malware

6 Techniques Used by Hackers

7 Industrial Espionage in Cyberspace

8 Encryption

9 Computer Security Technology

10 Security Policies

11 Network Scanning and Vulnerability Scanning

12 Cyber Terrorism and Information Warfare

13 Cyber Detective

14 Introduction to Forensics

15 Cybersecurity Engineering

Glossary

Appendix A: Resources

Appendix B: Answers to the Multiple Choice Questions

Index

Table of Contents

Introduction

Chapter 1: Introduction to Computer Security

Introduction

How Seriously Should You Take Threats to Network Security?

Identifying Types of Threats

Malware

Compromising System Security

DoS Attacks

Web Attacks

Session Hijacking

Insider Threats

DNS Poisoning

New Attacks

Assessing the Likelihood of an Attack on Your Network

Basic Security Terminology

Hacker Slang

Professional Terms

Concepts and Approaches

How Do Legal Issues Impact Network Security?

Online Security Resources

CERT

Microsoft Security Advisor

F-Secure

SANS Institute

Summary

Chapter 2: Networks and the Internet

Introduction

Network Basics

The Physical Connection: Local Networks

Faster Connection Speeds

Wireless

Bluetooth

Other Wireless Protocols

Data Transmission

How the Internet Works

IP Addresses

Uniform Resource Locators

What Is a Packet?

Basic Communications

History of the Internet

Basic Network Utilities

IPConfig

Ping

Tracert

Netstat

NSLookup

ARP

Route

PathPing

Other Network Devices

Advanced Network Communications Topics

The OSI Model

The TCP/IP Model

Media Access Control (MAC) Addresses

Cloud Computing

Summary

Chapter 3: Cyber Stalking, Fraud, and Abuse

Introduction

How Internet Fraud Works

Investment Offers

Auction Fraud

Identity Theft

Phishing

Cyber Stalking

Real Cyber Stalking Cases

How to Evaluate Cyber Stalking

Crimes Against Children

Laws About Internet Fraud

Protecting Yourself Against Cybercrime

Protecting Against Investment Fraud

Protecting Against Identity Theft

Secure Browser Settings

Protecting Against Auction Fraud

Protecting Against Online Harassment

Summary

Chapter 4: Denial of Service Attacks

Introduction

DoS Attacks

Illustrating an Attack

Distributed Reflection Denial of Service Attacks

Common Tools Used for DoS Attacks

Low Orbit Ion Cannon

XOIC

TFN and TFN2K

Stacheldraht

DoS Weaknesses

Specific DoS Attacks

TCP SYN Flood Attacks

Smurf IP Attacks

UDP Flood Attacks

ICMP Flood Attacks

The Ping of Death

Teardrop Attacks

DHCP Starvation

HTTP POST DoS Attacks

PDoS Attacks

Registration DoS Attacks

Login DoS Attacks

Land Attacks

DDoS Attacks

Yo-Yo Attack

Login Attacks

CLDAP Reflection

Degradation of Service Attacks

Challenge Collapsar Attack

EDoS

Real-World Examples of DoS Attacks

Google Attack

AWS Attack

Boston Globe Attack

Memcache Attacks

DDoS Blackmail

Mirai

How to Defend Against DoS Attacks

Summary

Chapter 5: Malware

Introduction

Viruses

How a Virus Spreads

Types of Viruses

Virus Examples

The Impact of Viruses

Machine Learning and Malware

Rules for Avoiding Viruses

Trojan Horses

The Buffer-Overflow Attack

The Sasser Virus/Buffer Overflow

Spyware

Legal Uses of Spyware

How Is Spyware Delivered to a Target System?

Pegasus

Obtaining Spyware Software

Other Forms of Malware

Rootkits

Malicious Web-Based Code

Logic Bombs

Spam

Advanced Persistent Threats

Deep Fakes

Detecting and Eliminating Viruses and Spyware

Antivirus Software

Anti-Malware and Machine Learning

Remediation Steps

Summary

Chapter 6: Techniques Used by Hackers

Introduction

Basic Terminology

The Reconnaissance Phase

Passive Scanning Techniques

Active Scanning Techniques

Actual Attacks

SQL Script Injection

Cross-Site Scripting

Cross-Site Request Forgery

Directory Traversal

Cookie Poisoning

URL Hijacking

Command Injection

Wireless Attacks

Cell Phone Attacks

Password Cracking

Malware Creation

Windows Hacking Techniques

Penetration Testing

NIST 800-115

The NSA Information Assessment Methodology

PCI Penetration Testing Standard

The Dark Web

Summary

Chapter 7: Industrial Espionage in Cyberspace

Introduction

What Is Industrial Espionage?

Information as an Asset

Real-World Examples of Industrial Espionage

Example 1: Hacker Group

Example 2: Company Versus Company

Example 3: Nuclear Secrets

Example 4: Uber

Example 5: Foreign Governments and Economic Espionage

Trends in Industrial Espionage

Industrial Espionage and You

How Does Espionage Occur?

Low-Tech Industrial Espionage

Spyware Used in Industrial Espionage

Steganography Used in Industrial Espionage

Phone Taps and Bugs

Spy for Hire

Protecting Against Industrial Espionage

Trade Secrets

The Industrial Espionage Act

Spear Phishing

Summary

Chapter 8: Encryption

Introduction

Cryptography Basics

History of Encryption

The Caesar Cipher

Atbash

Multi-Alphabet Substitution

Rail Fence

Scytale

Polybius Cipher

Enigma

Binary Operations

Modern Cryptography Methods

Single-Key (Symmetric) Encryption

Modification of Symmetric Methods

Public Key (Asymmetric) Encryption

PGP

Legitimate Versus Fraudulent Encryption Methods

Digital Signatures

Hashing

MD5

SHA

RIPEMD

MAC and HMAC

Rainbow Tables

Steganography

Historical Steganography

Steganography Methods and Tools

Cryptanalysis

Frequency Analysis

Modern Cryptanalysis Methods

Cryptography Used on the Internet

Quantum Computing Cryptography

Summary

Chapter 9: Computer Security Technology

Introduction

Virus Scanners

How Does a Virus Scanner Work?

Virus-Scanning Techniques

Commercial Antivirus Software

Firewalls

Benefits and Limitations of Firewalls

Firewall Types and Components

Firewall Configurations

Types of Firewalls

Commercial and Free Firewall Products

Firewall Logs

Antispyware

IDSs

IDS Categorization

Identifying an Intrusion

IDS Elements

Snort

Honey Pots

Database Activity Monitoring

SIEM

Other Preemptive Techniques

Authentication

Digital Certificates

SSL/TLS

Virtual Private Networks

Point-to-Point Tunneling Protocol

Layer 2 Tunneling Protocol

IPsec

Wi-Fi Security

Wired Equivalent Privacy

Wi-Fi Protected Access

WPA2

WPA3

Summary

Chapter 10: Security Policies

Introduction

What Is a Policy?

Important Standards

ISO 17999

NIST SP 800-53

ISO 27001

ISO 27002

ISO 17799

Defining User Policies

Passwords

Internet Use

Email Usage

Installing/Uninstalling Software

Instant Messaging

Desktop Configuration

Bring Your Own Device

Final Thoughts on User Policies

Defining System Administration Policies

New Employees

Departing Employees

Change Requests

Security Breaches

Virus Infection

DoS Attacks

Intrusion by a Hacker

Defining Access Control

Development Policies

Standards, Guidelines, and Procedures

Data Classification

DoD Clearances

Disaster Recovery

Disaster Recovery Plan

Business Continuity Plan

Impact Analysis

Disaster Recovery and Business Continuity Standards

Fault Tolerance

Zero Trust

Important Laws

HIPAA

Sarbanes-Oxley

Payment Card Industry Data Security Standards

Summary

Chapter 11: Network Scanning and Vulnerability Scanning

Introduction

Basics of Assessing a System

Patch

Ports

Protect

Policies

Probe

Physical

Securing Computer Systems

Securing an Individual Workstation

Securing a Server

Securing a Network

Scanning Your Network

NESSUS

OWASP Zap

Shodan

Kali Linux

Vega

OpenVAS

Testing and Scanning Standards

NIST 800-115

NSA-IAM

PCI -DSS

National Vulnerability Database

Getting Professional Help

Summary

Chapter 12: Cyber Terrorism and Information Warfare

Introduction

Actual Cases of Cyber Terrorism

China’s Advanced Persistent Threat

India and Pakistan

Russian Hackers

Iran–Saudi Tension

Weapons of Cyber Warfare

Stuxnet

Flame

StopGeorgia.ru Malware

FinFisher

BlackEnergy

Regin

NSA ANT Catalog

Economic Attacks

Military Operations Attacks

General Attacks

Supervisory Control and Data Acquisitions (SCADA)

Information Warfare

Propaganda

Information Control

Disinformation

Actual Cases of Cyber Terrorism

Future Trends

Machine Learning/Artificial Intelligence

Positive Trends

Negative Trends

Defense Against Cyber Terrorism

Terrorist Recruiting and Communication

TOR and the Dark Web

Summary

Chapter 13: Cyber Detective

Introduction

General Searches

Email Searches

Company Searches

Court Records and Criminal Checks

Sex Offender Registries

Civil Court Records

Other Resources

Usenet

Google

Maltego

Summary

Chapter 14: Introduction to Forensics

Introduction

General Guidelines

Don’t Touch the Suspect Drive

Imaging a Drive with Forensic Toolkit

Can You Ever Conduct Forensics on a Live Machine?

Document Trail

Secure the Evidence

Chain of Custody

FBI Forensics Guidelines

U.S. Secret Service Forensics Guidelines

EU Evidence Gathering

Scientific Working Group on Digital Evidence

Locard’s Principle of Transference

The Scientific Method

Standards

Forensics Reports

Tools

Finding Evidence on a PC

Finding Evidence in a Browser

Finding Evidence in System Logs

Windows Logs

Linux Logs

Getting Back Deleted Files

Operating System Utilities

net sessions

openfiles

fc

netstat

The Windows Registry

Specific Entries

Mobile Forensics: Cell Phone Concepts

Cell Phone State

Cell Phone Components

Cellular Networks

iOS

Android

What You Should Look For

The Need for Forensic Certification

Expert Witnesses

Federal Rule 702

Daubert

Additional Types of Forensics

Network Forensics

Virtual Forensics

Summary

Chapter 15: Cybersecurity Engineering

Introduction

Defining Cybersecurity Engineering

Cybersecurity and Systems Engineering

Applying Engineering to Cybersecurity

Standards

RMF

ISO 27001

ISO 27004

NIST SP 800-63B

SecML

SecML Concepts

Misuse-Case Diagram

Security Sequence Diagram

Data Interface Diagram

Security Block Diagram

Modeling

STRIDE

PASTA

DREAD

Summary

Glossary

Appendix A: Resources

Appendix B: Answers to the Multiple Choice Questions

Index

About the Author

Dr. Chuck Easttom is the author of 37 books, including several on computer security, forensics, and cryptography. He has also authored scientific papers on digital forensics, cyber warfare, cryptography, and applied mathematics. He is an inventor with 25 computer science patents. He holds a doctor of science degree in cybersecurity (dissertation topic: a study of lattice-based algorithms for post quantum cryptography), a Ph.D. in Computer Science (dissertation topic: “A Systematic Framework for Network Forensics Using Graph Theory”), and a Ph.D. in Nanotechnology (dissertation topic: “The Effects of Complexity on Carbon Nanotube Failures”) and three master’s degrees (one in applied computer science, one in education, and one in systems engineering). He also holds more than 70 industry certifications (CISSP, CEH, etc.). He is a frequent speaker at cybersecurity, computer science, and engineering conferences. He is a Distinguished Speaker and senior member of the ACM and a senior member of the IEEE. You can find out more about Dr. Easttom and his research at www.ChuckEasttom.com.

About the Technical Reviewer

Lewis Heuermann (CISSP, Data+) is a military veteran, cybersecurity consultant, and professor. He has worked as a systems engineer, network engineer, network defense analyst, and cyber risk management consultant. Lewis has taught and developed curriculum for college-level courses on network defense, information systems management, cyber defense programming using Python, and data analytics courses using SQL and Tableau tools. He holds several industry certifications, including Tableau Desktop Specialist and CompTIA Data+ certifications.

Dedication

This book is dedicated to my wife, Teresa,
who has helped me become who I am.

Acknowledgments

The creation of a book is not a simple process and requires the talents and dedication of many people to make it happen. With this in mind, I would like to thank the folks at Pearson for their commitment to this project. The editors have been integral to making this book a success.

We Want to Hear from You!

As the reader of this book, you are our most important critic and commentator. We value your opinion and want to know what we’re doing right, what we could do better, what areas you’d like to see us publish in, and any other words of wisdom you’re willing to pass our way.

We welcome your comments. You can email or write to let us know what you did or didn’t like about this book—as well as what we can do to make our books better.

Please note that we cannot help you with technical problems related to the topic of this book.

When you write, please be sure to include this book’s title and author as well as your name and email address. We will carefully review your comments and share them with the author and editors who worked on the book.

Email: feedback@community@informit.com

Reader Services

Register your copy of Computer Security Fundamentals at www.pearsonitcertification.com for convenient access to downloads, updates, and corrections as they become available. To start the registration process, go to www.pearsonitcertification.com/register and log in or create an account.* Enter the product ISBN 9780137984787 and click Submit. When the process is complete, you will find any available bonus content under Registered Products.

*Be sure to check the box indicating that you would like to hear from us to receive exclusive discounts on future editions of this product.

Introduction

It has been more than 17 years since the publication of the original edition of this book. A great deal has happened in the world of computer security since that time. This edition is updated to include newer information, updated issues, and revised content.

This book is a guide for any computer-savvy person. This means system administrators who are not security experts and anyone who has a working knowledge of computers and wishes to know more about cybercrime and cyber terrorism could find this book useful. However, the core audience will be students who wish to take a first course in security but may not have a thorough background in computer networks. The book is in textbook format, making it ideal for introductory computer security courses that have no specific prerequisites. That lack of prerequisites means that people outside the normal computer science and computer information systems departments could also avail themselves of a course based on this book. This might be of particular interest to law enforcement officers, criminal justice majors, and even business majors with an interest in computer security.

As was previously mentioned, this book is intended as an introductory computer security book. In addition to the numerous footnotes, the appendixes will guide you to a plethora of additional resources. There are also review questions and practice exercises with every chapter. Appendix B provides the answers to the multiple choice questions for your review. Exercises and projects are intended to encourage you to explore, so answers will vary.

This book assumes that you are a competent computer user. That means you have used a computer at work and at home, are comfortable with email and web browsers, and know what words like RAM and USB mean. For instructors considering using this book as a textbook, students should have a basic understanding of PCs but need not have had formal computer courses. For this reason, the book includes a chapter on basic networking concepts to get those students up to speed. Those with more knowledge, such as system administrators, will find some chapters of more use than others. Feel free to simply skim any chapter that you feel is too elementary for you.

Chapter 1

Introduction to Computer Security

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Identify the top threats to a network: security breaches, denial of service attacks, and malware

Images Understand essential security concepts

Images Assess the likelihood of an attack on your network

Images Define key terms such as cracker, penetration tester, firewall, and authentication

Images Compare and contrast perimeter and layered approaches to network security

Images Use online resources to secure your network

Introduction

Since the first edition of this book, the prevalence of online transactions has increased dramatically. In 2004 we had e-commerce via websites; in 2023 we have Internet-connected cars, the Internet of Things (IoT), as well as an expanded use of e-commerce websites. We also have smart homes and smart medical devices. Internet traffic is far more than just humorous YouTube videos or Facebook updates about our vacations. Now it is the heart and soul of commerce, both domestic and international. Internet communication even plays a central role in military operations and diplomatic relations. In addition to smart phones, we now have smart watches and even vehicles that have Wi-Fi hotspots and smart technology. Our lives are inextricably intertwined with the online world. We file our taxes online, shop for homes online, book vacations online, and even look for dates online.

Because so much of our business is transacted online, a great deal of personal information is stored in computers. Medical records, tax records, school records, and more are all stored in computer databases. Personal information is often called personally identifiable information (PII), and health-related data is usually termed personal health information (PHI). This leads to some very important questions:

Images How is information safeguarded?

Images What are the vulnerabilities to these systems?

Images What steps are taken to ensure that these systems and data are safe?

Images Who can access my information?

Images How is that information used?

Images Who is this information shared with? Third parties?

Fyi: Where Is the Internet Going?

Obviously, the Internet has expanded, as previously mentioned. We now have smart phones, smart watches, even smart cars. We have the Internet of Things (IoT), which involves devices communicating on the Internet. Smart homes and medical devices, including implantable medical devices, are the current trends. What do you think the next 10 years will bring?

Unfortunately, not only have technology and Internet access expanded since the original publication of this book but so have the dangers. How serious is the problem? According to a 2021 article,¹ cybercrime losses are expected to reach $6 trillion per year. Global spending on cybersecurity is also increasing. Global spending on cybersecurity was $125 billion in 2020 and is expected to exceed $174 billion by 2024.

1. https://financesonline.com/cybersecurity-statistics/

An article in Cybercrime Magazine² states that ransomware alone cost $20 billion in 2021. The same article predicts that a growing percentage of cryptocurrency transactions involve illegal trade. Another article, from Fortinet,³ asserts that 36 billion records were exposed in the first three quarters of 2020. The same article reports that July 2020 alone saw a 653% increase in malicious activity compared to the same month in 2019. It is clear that cyber threats are increasing on every front.

2. https://cybersecurityventures.com/top-5-cybersecurity-facts-figures-predictions-and-statistics-for-2019-to-2021/

3. https://www.fortinet.com/resources/cyberglossary/cybersecurity-statistics

In spite of daily horror stories, however, many people (including some law enforcement professionals and trained computer professionals) lack adequate understanding about the reality of these threats. Clearly the media focuses attention on the most dramatic computer security breaches, not necessarily giving an accurate picture of the most plausible threat scenarios. It is not uncommon to encounter the occasional system administrator whose knowledge of computer security is inadequate.

This chapter outlines current dangers, describes the most common types of attacks on personal computers and networks, teaches you how to speak the lingo of both hackers and security professionals, and outlines the broad strokes of what it takes to secure your computer and your network.

In this book, you will learn how to secure both individual computers and entire networks. You will also find out how to secure data transmission, and you will complete an exercise to find out about your region’s laws regarding computer security. Perhaps the most crucial discussion in this chapter is what attacks are commonly attempted and how they are perpetrated. In this first chapter we set the stage for the rest of the book by outlining what exactly the dangers are and introducing you to the terminology used by both network security professionals and hackers. All of these topics are explored more fully in subsequent chapters.

How Seriously Should You Take Threats to Network Security?

The first step in understanding computer and network security is to formulate a realistic assessment of the threats to those systems. You cannot protect assets if you don’t have an understanding of what you are protecting and what threats you are protecting against. You need to have a clear picture of the dangers in order to adequately prepare a defense. Since the first edition of this book, I have discussed two extreme attitudes regarding computer security—and those extremes still exist today. The first group assumes that there is no real threat. Subscribers to this belief feel that there is little real danger to computer systems and that much of the negative news is simply unwarranted panic. They often believe taking only minimal security precautions should ensure the safety of their systems. The prevailing sentiment is, if our organization has not been attacked so far, we must be secure. If decision makers subscribe to this point of view, they tend to push a reactive approach to security. They will wait to address security issues until an incident occurs—the proverbial “closing the barn door after the horse has already gotten out.” If you are fortunate, the incident will have only minor impact on your organization and will serve as a much-needed wakeup call. If you are unfortunate, then your organization may face serious and possible catastrophic consequences. One major goal of this book is to encourage a proactive approach to security.

People who subscribe to the opposite viewpoint overestimate the dangers. They tend to assume that numerous talented hackers are an imminent threat to their system. They may believe that any teenager with a laptop can traverse highly secure systems at will. Such a worldview makes excellent movie plots, but it is simply unrealistic. The reality is that many people who call themselves hackers are less knowledgeable than they think they are. These people have a low probability of being able to compromise any system that has implemented even moderate security precautions.

This does not mean that skillful hackers do not exist, of course. However, they must balance the costs (financial, time) against the rewards (ideological, monetary). “Good” hackers tend to target systems that yield the highest rewards. If a hacker doesn’t perceive your system as beneficial to these goals, he is less likely to expend the resources to compromise your system. It is also important to understand that real intrusions into a network take time and effort. Hacking is not the dramatic process you see in movies. I often teach courses in hacking and penetration testing, and students are usually surprised to find that the process is actually a bit tedious and requires patience.

Later in this book we will discuss cyber warfare, a topic that necessarily involves highly skilled hackers with substantial resources. And it is not just government agencies that are targets of such attacks. However, it is inaccurate to assume that the cyber equivalent of James Bond is just waiting to attack every small business network.

Both extremes of attitudes regarding the dangers to computer systems are inaccurate. It is certainly true that there are people who have the understanding of computer systems and the skills to compromise the security of many, if not most, systems. A number of people who call themselves hackers, though, are not as skilled as they claim to be. They have ascertained a few buzzwords from the Internet and may be convinced of their own digital supremacy, but they are not able to affect any real compromises to even a moderately secure system.

The truly talented hacker is no more common than the truly talented concert pianist. Consider how many people take piano lessons at some point in their lives. Now consider how many of those ever truly become virtuosos. The same is true of computer hackers. There are many people with mediocre skills, but truly skilled hackers are not terribly common. Keep in mind that even those who do possess the requisite skills need to be motivated to expend the time and effort to compromise your system.

A better way to assess the threat level to your system is to weigh the attractiveness of your system to potential intruders against the security measures in place. This is the essence of threat analysis. You examine your risks, vulnerabilities, and threats in order to decide where to put the most effort in cybersecurity.

Insider threats are another issue to keep in mind. Such threats encompass malicious and intentional damage from insiders, as well as simple negligence and ignorance. The most robust technical security can be subverted by poor security habits on the part of the users. This threat will also be discussed in detail as you journey through this book.

Keep in mind, too, that the most common external threats to any system are not hackers but malware and denial of service (DoS) attacks. Malware includes viruses, worms, Trojan horses, and logic bombs. Malware does not generally require a highly skilled technical attacker. It just requires one employee opening the wrong attachment or clicking on the wrong link.

Security audits always begin with risk assessment, and that is what we are describing here. First you need to identify your assets. Clearly, the actual computers, routers, switches, and other devices that make up your network are assets. But it is more likely that your most important assets lie in the information on your network. Identifying assets begins with evaluating the information your network stores and its value. Does your network contain personal information for bank accounts? Perhaps medical information, health care records? In other cases, your network might contain intellectual property, trade secrets, or even classified military data.

Once you have identified the assets, you need to take inventory of the threats to your assets. Certainly, any threat is possible, but some are more likely than others. This is very much like what one does when selecting home insurance. If you live in a flood plain, then flood insurance is critical. If you live at a high altitude in a desert, it may be less critical. We do the same thing with our data. If you are working for a defense contractor, then foreign state-sponsored hackers are a significant threat. However, if you are the network administrator for a school district, then your greatest threat is likely to be juveniles attempting to breach the network. It is always important to realize what the threats are for your network.

Once you have identified your assets and inventoried the threats, you need to find out what vulnerabilities your system has. Every system has vulnerabilities. Identifying your network’s specific vulnerabilities is a major part of risk assessment.

The knowledge of your assets, threats, and vulnerabilities will give you the information needed to decide what security measures are appropriate for your network. You will always have budget constraints, so you need to make wise decisions in selecting security controls. Using good risk assessment is how you make wise security decisions.

Note

There are a number of industry certifications that emphasize risk assessment. The Certified Information Systems Security Professional (CISSP) puts significant emphasis on this issue. The Certified Information Systems Auditor (CISA) places even more focus on risk assessment. One or more appropriate industry certifications can enhance your skillset and make you more marketable as a security professional. There are many other certifications, including the CompTIA Advanced Security Practitioner (CASP) and Security+ certifications.

There are methods and formulas for quantifying risk. A few simple formulas are provided here. In order to calculate the loss from a single incident, you multiply the asset value by the percentage of that asset that is exposed:

Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF)

What this formula means is that in order to calculate the loss from a single incident, you start with the asset value, and multiply that by the percentage of the asset that is exposed. Let us assume you have a laptop that was purchased for $1000. It has depreciated by 20%, meaning there is 80% of its value left. If that laptop is lost or stolen, $1000 (AV) × .8 (EF) = $800 (SLE). Now this is rather oversimplified and does not account for the value of the data. But it does illustrate the point of the formula. Now to go forward and calculate the loss per year, you use the following formula:

Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO)

Using the previous SLE of $800, if you expect to lose 3 laptops per year, then the ARO = $800 × 3, or $2400.

Obviously, these formulas have some subjectiveness to them. (For example, ARO is usually estimated based on industry trends and past incidents.) But they can help you to understand the risk you have. This will help guide you in determining what resources to allocate to addressing the risk.

Once you have identified a risk, you really have only four choices:

Images Acceptance: This means you find the impact of the risk to be less than the cost of addressing it, or the probability is so remote that you do nothing. This is not the most common approach but is appropriate in some scenarios.

Images Avoidance: This means ensuring that there is zero chance of the risk occurring. If you are concerned about a virus being introduced to your network via USB and you shut down all USB ports, you have avoided the risk.

Images Transference: This involves transferring responsibility for the damages should the risk be realized. This is commonly done via cyber threat insurance.

Images Mitigation: With this approach, which is the most common approach, you take steps to reduce either the likelihood of the event occurring or the impact. For example, if you are concerned about computer viruses, you might mitigate that via antivirus software and policies about attachments and links.

This is basic risk assessment. Before spending resources to address a threat, you must do this type of basic threat assessment. How likely is the threat to be realized? If it is realized, how much damage would it cause you? For example, I personally don’t employ any security on my website. Yes, someone could hack it, but if they did, the impact would be negligible. There is no data on that website at all—no database back end, no files, no logins, and so on. The only information on the website is information I freely give to anyone, without even recording who gets the information. Thus, for this website, the impact of a breach would be only negligible, thus making expenditure of resources on security unacceptable. At the other extreme are major e-commerce sites. These sites invest a great deal of resources on security because breach of such a website would immediately cost significant money and damage the organization’s reputation in the long term.

Identifying Types of Threats

As discussed in the previous section, identifying your threats is a key part of risk assessment. Some threats are common to all networks; others are more likely with specific types of networks. Various sources have divided threats into different categories based on specific criteria. In this section we will examine threats that have been divided into categories based on the nature of the attack. Most attacks can be categorized as one of seven broad classes:

Images Malware: This is a generic term for software that has a malicious purpose. It includes virus attacks, worms, adware, Trojan horses, and spyware. This is the most prevalent danger to your system. One reason the relatively generic term malware is now widely used is that many times a piece of malware does not fit neatly into one of these categories.

Images Security breaches: This group of attacks includes any attempt to gain unauthorized access to your system. This includes cracking passwords, elevating privileges, breaking into a server,…all the things you probably associate with the term hacking.

Images DoS attacks: These are designed to prevent legitimate access to your system. And, as you will see in later chapters, this includes distributed denial of service (DDoS).

Images Web attacks: This is any attack that attempts to breach your website. Two of the most common such attacks are SQL injection and cross-site scripting.

Images Session hijacking: These attacks are rather advanced and involve an attacker attempting to take over a session.

Images Insider threats: These are breaches based on someone who has access to your network misusing his access to steal data or compromise security.

Images DNS poisoning: This type of attack seeks to compromise a DNS server so that users can be redirected to malicious websites, including phishing websites.

There are other attacks, such as social engineering. Some experts might organize things a bit differently. The preceding list is just an attempt to provide a basic categorization of attack types. This section offers a broad description of each type of attack. Later chapters go into greater detail on each specific attack, how it is accomplished, and how to avoid it.

Malware

Malware is a generic term for software that has a malicious purpose. This section discusses four types of malware: viruses, Trojan horses, spyware, and logic bombs. Trojan horses and viruses are the most widely encountered. One could also include rootkits in the malware category, but these usually spread as viruses and thus are regarded as simply a specific type of virus.

According to Malwarebytes:

Malware, or “malicious software,” is an umbrella term that describes any malicious program or code that is harmful to systems. Hostile, intrusive, and intentionally nasty, malware seeks to invade, damage, or disable computers, computer systems, networks, tablets, and mobile devices, often by taking partial control over a device’s operations. Like the human flu, it interferes with normal functioning.⁴

4. https://www.malwarebytes.com/malware/

We still think primarily of computer viruses when we think of malware. The key characteristic of a computer virus is that it self-replicates. A computer virus is similar to a biological virus; both are designed to replicate and spread. The most common method for spreading a virus is using the victim’s email account to spread the virus to everyone in his address book. Some viruses don’t actually harm the system itself, but almost all of them cause network slowdowns due to the heavy network traffic caused by virus replication.

The Trojan horse gets its name from an ancient tale. The city of Troy was besieged for an extended period of time. The attackers could not gain entrance, so they constructed a huge wooden horse and one night left it in front of the gates of Troy. The next morning the residents of Troy saw the horse and assumed it to be a gift, so they rolled the wooden horse into the city. Unbeknownst to them, several soldiers were hidden inside the horse. That evening the soldiers left the horse, opened the city gates, and let their fellow attackers into the city. An electronic Trojan horse works similarly, appearing to be benign software but secretly downloading a virus or some other type of malware onto a computer from within.

Another category of malware currently on the rise is spyware. Spyware is software that literally spies on what you do on your computer. Spyware can be as simple as a cookie—a text file that your browser creates and stores on your hard drive—that a website you have visited downloads to your machine and uses to recognize you when you return to the site. However, that flat file can then be read by the website or by other websites. Any data that the file saves can be retrieved by any website, so your entire Internet browsing history can be tracked. Spyware may also consist of software that takes periodic screenshots of the activity on your computer and sends them to the attacker.

Another form of spyware, called a key logger, records all of your keystrokes. Some key loggers also take periodic screenshots of your computer. Data is then either stored for later retrieval by the person who installed the key logger or is sent immediately back via email. We will discuss specific types of key loggers later in this book.

A logic bomb is software that lays dormant until some specific condition is met. That condition is usually a date and time. When the condition is met, the software does some malicious act, such as delete files, alter system configuration, or perhaps release a virus. In Chapter 5, “Malware,” we will examine logic bombs and other types of malware in detail.

Compromising System Security

Next we will look at attacks that breach your system’s security. This activity is commonly referred to as hacking, though that is not the term hackers themselves use. We will delve into appropriate terminology in just a few pages; however, it should be noted at this point that cracking is the appropriate word for intruding into a system without permission, usually with malevolent intent. Any attack that is designed to breach your security, either via some operating system flaw or any other means, can be classified as cracking.

Essentially any technique to bypass security, crack passwords, breach Wi-Fi, or in any way actually gain access to the target network fits into this category. That makes this a very broad category indeed.

However, not all breaches involve technical exploits. In fact, some of the most successful breaches are entirely nontechnical. Social engineering is a technique for breaching a system’s security by exploiting human nature rather than technology. This was the path that the famous hacker Kevin Mitnick most often used. Social engineering uses standard con techniques to get users to give up the information needed to gain access to a target system. The way this method works is rather simple: The perpetrator gets preliminary information about a target organization and leverages it to obtain additional information from the system’s users.

Following is an example of social engineering in action. Armed with the name of a system administrator, you might call someone in the business’s accounting department and claim to be one of the company’s technical support personnel. Mentioning the system administrator’s name would help validate that claim, allowing you to ask questions in an attempt to ascertain more details about the system’s specifications. A savvy intruder might even get the accounting person to say a username and password. As you can see, the success of this method is based on how well the prospective intruder can manipulate people and actually has little to do with computer skills.

The growing popularity of wireless networks gave rise to new kinds of attacks. One such activity is war-driving. This type of attack is an offshoot of war-dialing. With war-dialing, a hacker sets up a computer to call phone numbers in sequence until another computer answers to try to gain entry to its system. War-driving is much the same concept, applied to locating vulnerable wireless networks. In this scenario, the hacker simply drives around trying to locate wireless networks. Many people forget that their wireless network signal often extends as much as 100 feet (thus, past walls). At the DEF CON convention for hackers, there is sometimes a war-driving contest where contestants drive around the city trying to locate as many vulnerable wireless networks as they can. These sorts of contests are now common at various hacking conventions. (DEF CON is the largest and oldest hacking conference in the world.)

Recent technological innovations have introduced new variations of war-driving/dialing. Now we have war-flying. The attacker uses a small private drone equipped with Wi-Fi sniffing and cracking software, flies the drone in the area of interest, and attempts to gain access to wireless networks.

Of course, Wi-Fi hacking is only one sort of breach. Password cracking tools are now commonly available on the Internet. We will examine some of them later in this book. There are also exploits of software vulnerabilities that allow one to gain access to the target computer.

DoS Attacks

In a DoS attack, the attacker does not actually access the system. Rather, this person simply blocks access from legitimate users. One common way to prevent legitimate service is to flood the targeted system with so many false connection requests that the system cannot respond to legitimate requests. DoS is a very common attack because it is so easy.

In recent years a proliferation of DoS tools have been available on the Internet. One of the most common such tools is the Low Orbit Ion Cannon (LOIC). Because these tools can be downloaded for free from the Internet, anyone can execute a DoS attack, even without technical skill.

We also have variations, such as the DDoS attack. This attack uses multiple machines to attack the target. Given that many modern websites are hosted in network clusters or even in clouds, it is very difficult for a single attacking machine to generate enough traffic to take down a web server. But a network of hundreds or even thousands of computers certainly can. We will explore DoS and DDoS attacks in more detail in Chapter 4, “Denial of Service Attacks.”

Web Attacks

By their nature, web servers have to allow communications. Oftentimes, websites allow users to interact with the website. Any part of a website that allows for user interaction is also a potential point for attempting a web-based attack. SQL injections involve entering SQL (Structured Query Language) commands into login forms (username and password text fields) in an attempt to trick the server into executing those commands. The most common purpose is to force the server to log in the attacker, even though the attacker does not have a legitimate username and password. While SQL injection is just one type of web attack, it is the most common.

SQL Injection

SQL injection is still quite common, though it has been known for many years. Unfortunately, not enough web developers take the appropriate steps to remediate the vulnerabilities that make such an attack possible. Given the prevalence of this type of attack, it warrants a bit more detailed description.

Consider one of the simplest forms of SQL injection, used to bypass login screens. The website was developed in some web programming language, such as PHP or ASP.NET. The database is most likely a basic relational database such as Oracle, SQL Server, MySQL, or PostgreSQL. SQL is used to communicate with the database, so we need to put SQL statements into the web page that was written into some programming language. That will allow us to query the database and see if the username and password are valid.

SQL is relatively easy to understand; in fact, it looks a lot like English. There are commands like SELECT to get data, INSERT to put data in, and UPDATE to change data. In order to log in to a website, the web page has to query a database table to see if that username and password are correct. The general structure of SQL is like this:

Click here to view code image

select column1, column2 from tablename

or:

Click here to view code image

select * from tablename;
Conditions:
select columns from tablename where condition;

For example:

Click here to view code image

SELECT * FROM tblUsers WHERE USERNAME = 'jsmith'

This statement retrieves all the columns or fields from a table named tblUsers where the username is jsmith.

The problem arises when we try to put SQL statements into our web page. Recall that the web page was written in some web language such as PHP or ASP.NET. If you just place SQL statements directly in the web page code, an error will be generated. The SQL statements in the programming code for the website have to use quotation marks to separate the SQL code from the programming code. A typical SQL statement might look something like this:

Click here to view code image

"SELECT * FROM tblUsers WHERE USERNAME = '" + txtUsername.Text +' AND PASSWORD = '" +
txtPassword.Text +"'".

If you enter username jdoe and the password password, this code produces this SQL command:

Click here to view code image

SELECT * FROM tblUsers WHERE USERNAME = 'jdoe' AND PASSWORD = 'password'

This is fairly easy to understand even for nonprogrammers. And it is effective. If there is a match in the database, that means the username and password match. If no records are returned from the database, that means there was no match, and this is not a valid login.

The most basic form of SQL injection seeks to subvert this process. The idea is to create a statement that will always be true. For example, instead of putting an actual username and password into the appropriate text fields, the attacker will enter ' or '1' = '1 into the username and password boxes. This will cause the program to create this query:

Click here to view code image

SELECT * FROM tblUsers WHERE USERNAME = '' or '1' = '1' AND PASSWORD = '' or
'1' = '1'.

This tells the database and application to return all records where the username and password are blank or if 1 = 1. It is highly unlikely that the username and password are blank. But I am certain that 1 = 1 always. Any true statement can be substituted. Examples are a = a and bob = bob.

The tragedy of this attack is that it is so easy to prevent. If the web programmer would simply filter all input prior to processing it, then this type of SQL injection would be impossible. Filtering means that before any user input is processed, the web page programming code looks through that code for common SQL injection symbols, scripting symbols, and similar items. It is true that each year fewer and fewer websites are susceptible to these attacks. However, there are still many sites that are vulnerable. SQL injection is still one of the top vulnerabilities in websites, according to OWASP (The Open Web Application Security Project).⁵ Subsequent chapters provide more coverage of most of these attacks, including tools used for them.

5. https://owasp.org/www-community/attacks/SQL_Injection

It should be noted that the OWASP top 10 list has been published every few years since 2003. The most recent list was published in 2021. Injection is on the list every time. This illustrates a serious problem with cybersecurity. There is a known vulnerability—one that has been known for almost 20 years—yet it still is among the top 10 vulnerabilities found in real computer systems. It is easy to focus on exciting and exotic attacks, but just patching and correcting known vulnerabilities is the foundation of cybersecurity.

Cross-Site Scripting

Cross-site scripting is a type of attack that is closely related to SQL injection. It involves entering data other than what was intended, and its success depends on the web programmer not filtering input. The perpetrator finds some area of a website that allows users to type in text that other users will see and then instead injects client-side script into those fields.

Note

Before I describe this particular crime, I would point out that the major online retailers such as eBay and Amazon.com are not susceptible to this attack; they do filter user input.

To better understand this process, let’s look at a hypothetical scenario. Let’s assume that ABC Online Book Sales has a website. In addition to shopping, users can have accounts with credit cards stored, post reviews, and more. The attacker first sets up an alternate web page that looks as close to the real one as possible. Then the attacker goes to the real ABC Online Book Sales website and finds a rather popular book. He goes to the review section, but instead of typing in a review, he types in this:

Click here to view code image

<script> window.location = "http://www.fakesite.com"; </script>

Now when users go to that book, this script will redirect them to the fake site, which looks a great deal like the real one. The attacker then can have the website tell the user that his session has timed out and to please log in again. That would allow the attacker to gather a lot of account and password information. That is only one scenario, but it illustrates the attack.

Session Hijacking

Performing session hijacking can be rather complex. For that reason, it is not a very common form of attack. Simply put, the attacker monitors an authenticated session between the client machine and the server and takes over that session. We will explore specific methods of how this is done later in this book.

A 1985 paper written by Robert T. Morris, titled “A Weakness in the 4.2BSD Unix TCP/IP Software,” defined the original session hijacking. By predicting the initial sequence number, Morris was able to spoof the identity of a trusted client to a server. This is much harder to do today.

In addition to flags (syn, ack, syn-ack), the packet header will contain the sequence number that is intended to be used by the client to reconstitute the data sent over the stream in the correct order. (We will explore network packet flags in Chapter 2, “Networks and the Internet.”)

The Morris attack and several other session hijacking attacks require the attacker to be connected to the network and to simultaneously knock the legitimate user offline and then pretend to be that user. As you can probably imagine, it is a complex attack.

Insider Threats

Insider threats are a type of security breach. However, they present such a significant issue that we will deal with them separately. An insider threat occurs when someone inside your organization either misuses his access to data or accesses data he is not authorized to access.

The most obvious case is that of Edward Snowden. For our purposes, we can ignore the political issues connected with his case and focus solely on the issue of insiders accessing information and using it in a way other than what was authorized. Yes, this is indeed an old story, but it is so central to the topic of insider threats that we must cover it.

In 2009 Edward Snowden was working as a contractor for Dell, which manages computer systems for several U.S. government agencies. Later he was a contractor for Booz Allen Hamilton. In March 2012 he was assigned to an NSA location in Hawaii. While there, he convinced several people at that location to provide him with their login and password information, under the pretense of performing network administrative duties. Some sources dispute whether or not this is the specific method he used, but it is the one most widely reported. Whatever method he used, he accessed and downloaded thousands of documents that he was not authorized to access.

Again, ignoring the political issues and the content of the documents, our focus is on the security issues. Clearly, there were inadequate security controls in place to detect Edward Snowden’s activities and to prevent him from disclosing the content of confidential documents. While your organization may not have the high profile that the NSA has, any organization is susceptible to insider threats. Theft of trade secrets by insiders is a common business concern and has been the focus of many lawsuits against former employees. In both Chapter 7, “Industrial Espionage in Cyberspace,” and Chapter 9, “Computer Security Technology,” we will see some countermeasures to mitigate this threat.

Another, far more recent case occurred in 2021. There were a series of incidents in March and April of 2021 wherein an employee of the Dallas police department deleted 23 terabytes of data affecting 17,500 cases.⁶ This act, while quite damaging, was not intentional. The employee simply lacked appropriate training and skills. The employee was fired. This case study illustrates how negligence or ignorance can be just as damaging as intentional malfeasance.

6. https://www.keranews.org/government/2022-02-24/dallas-data-loss-report-reveals-it-worker-was-not-trained-for-the-job

In another recent incident, in November 2021, a former employee of South Georgia Medical Center was arrested for downloading data to a USB device, including protected health information of 41,692 individuals.⁷ The employee was charged with felony computer theft and related crimes. This case is still under investigation, so the suspect is considered innocent until and unless convicted in a court of law; however, the incident does initially appear to have been intentional malfeasance.

7. https://www.valdostadailytimes.com/news/local_news/ex-hospital-worker-arrested-in-sgmc-data-breach/article_7ca92b22-a2e5-5541-b3b3-38472d3706b1.xhtml

While Edward Snowden is an obvious example of insider threats, that is only one example. A common scenario is when someone who has legitimate access to some particular source of data chooses either to access data he is not authorized to access or to use the data in a manner other than how he has been authorized to use it. Here are a few examples:

Images A hospital employee who accesses patient records to use the data to steal a patient’s identity, or someone with no access at all who accesses records

Images A salesperson who takes a list of contacts with him when he leaves the company

This is actually a much greater problem than many people appreciate. Within an organization, information security is often more lax than it should be. Most people are more concerned with external security than internal security, and it is often rather easy to access data within an organization. In my career as a security consultant, I have seen networks where sensitive data is simply placed on a shared drive with no limitations on access to it—so anyone on the network can access the data. In a case such as this, when information is taken, no crime has been committed. However, in other cases, employees purposefully circumvent security measures to access data they are not authorized to access. The most common method is to simply log in with someone else’s password. That enables the perpetrator to access the resources and data to which that other person has been granted access. Unfortunately, many people use weak passwords or, worse, they write their password somewhere on their desk. Some users even share passwords. For example, suppose a sales manager is out sick but wants to check to see if a client has emailed her. So she calls her assistant and gives him her login so he can check her email. This sort of behavior should be strictly prohibited by company security policies, but it still occurs. The problem is that now two people have the sales manager’s login. Either one could use it or reveal it to someone else (accidentally or on purpose). So there is a greater chance of someone using that manager’s login to access data he has not been authorized to access.

The National Institute of Standards and Technology, in the publication NIST800-53,⁸ defines an insider as “any person with authorized access to any organizational resource, to include personnel, facilities, information, equipment, networks, or system.” The standard further defines an insider threat as “the threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation. This threat can include damage through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of organizational resources or capabilities.”

8. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

DNS Poisoning

Most of your communication on the Internet will involve DNS, or Domain Name System. DNS is what translates the domain names you and I understand (like www.ChuckEasttom.com) into IP addresses that computers and routers understand. DNS poisoning involves using one of several techniques to compromise that process and redirect traffic to an illicit site, often for the purpose of stealing personal information.

Here is one scenario whereby an attacker might execute a DNS poisoning attack: The attacker creates a phishing website that spoofs a bank that we will call ABC Bank. The attacker wants to lure users there so he can steal their passwords and use them on the real bank website. Since many users are too smart to click on links, he will use DNS poisoning to trick them.

The attacker creates his own DNS server. (Actually, this part is relatively easy.) Then he puts two records in that DNS server. The first is for the ABC Bank website, pointing to his fake site rather than the real bank site. The second entry is for a domain that does not exist. The attacker can search domain registries until he finds one that does not exist. For illustration purposes, we will refer to this as XYZ domain.

Then the attacker sends a request to a DNS server on the target network. That request purports to be from any IP address within the target network and is requesting the DNS server resolve the XYZ domain.

Obviously, the DNS server does not have an entry for the XYZ domain since it does not exist. So, it begins to propagate the request up its chain of command and eventually to its service provider DNS server. At any point in that process, the attacker sends a flood of spoofed responses claiming to be from a DNS server that the target server is trying to request records from but that are actually coming from his DNS server and offering the IP address for XYZ domain. At that point the hacker’s DNS server offers to do a zone transfer, exchanging all information with the target server. That information includes the spoofed address for ABC Bank. Now the target DNS server has an entry for ABC Bank that points to the hacker’s website rather than the real ABC Bank website. Should users on that network type in the URL for ABC Bank, their own DNS server will direct them to the hacker’s site.

This attack, like so many others, depends on vulnerabilities in the target system. A properly configured DNS server should never perform a zone transfer with any DNS server that is not already authenticated in the domain. However, the unfortunate fact is that there are plenty of DNS servers that are not properly configured.

New Attacks

Most, if not all, of the threats discussed in the first four editions of this book are still plaguing network security. Malware, DoS, and other such attacks are just as common today as they were 5 years ago or even 10 years ago.

The past few years have seen an increase in doxing. Doxing is the process of finding personal information about an individual and broadcasting it, often via the Internet. This can be any personal information about any person; however, it is most often used against public figures. It has even been the case that a previous director of the CIA was the target of doxing.⁹ A 2021 article in US News and World Report¹⁰ states that 41% of web users experience some form of doxing.

9. http://gawker.com/wikileaks-just-doxxed-the-head-of-the-cia-1737871619

10. https://www.usnews.com/360-reviews/privacy/what-is-doxxing

Hacking of medical devices first gained public attention in 2013 and has become a growing concern. Hacker Barnaby Jack first revealed a vulnerability in an insulin pump that could allow an attacker to take control of the pump and cause it to dispense the entire reservoir of insulin in a single does, thus killing the patient. To date there have been no confirmed incidents of this having actually been done, but it is disturbing nonetheless. Similar security flaws have been found in pacemakers. In 2018, the U.S. Food and Drug Administration (FDA) published a list of medical devices that are not secure.¹¹ So, this problem appears to be getting worse.

11. https://www.fda.gov/news-events/press-announcements/fda-informs-patients-providers-and-manufacturers-about-potential-cybersecurity-vulnerabilities

In July 2015 it was revealed that Jeep vehicles could be hacked and shut down during normal operation. This means that a hacker could cause a Jeep to stop in the middle of heavy, high-speed traffic, potentially causing a serious automobile accident. The hacking of cars has become more widespread. DEF CON in 2016 had a car hacking village. A 2021 article in Car and Driver magazine reports 150 automotive cybersecurity incidents—actual breaches, not just vulnerabilities that could be exploited—in 2019.¹²

12. https://www.caranddriver.com/news/a37453835/car-hacking-danger-is-likely-closer-than-you-think/

More recently, the Internet of Things has created a new set of targets for attackers. Smart homes and offices, with their integrated Internet-enabled devices, make attractive targets for attackers. For example, ransomware has been created for smart thermostats. A 2021 article¹³ reports 1.51 billion IoT breaches in the first half of 2021. This is an increase of 639 million since 2020. Clearly, IoT attacks are becoming more common, and this trend is expected to continue.

13. https://www.iotworldtoday.com/2021/09/17/iot-cyberattacks-escalate-in-2021-according-to-kaspersky/

All of these attacks show a common theme: As our lives become more interconnected with technology, new vulnerabilities emerge. Some of these vulnerabilities are not merely endangering data and computer systems but potentially endangering lives.

Assessing the Likelihood of an Attack on Your Network

How likely are these attacks? What are the real dangers facing you as an individual or your organization? What are the most likely attacks, and what are your vulnerabilities? Let’s take a look at what threats are out there and which ones are the most likely to cause you or your organization problems.

At one time, the most likely threat to individuals and large organizations was the computer virus. And it is still true that in any given month, several new virus outbreaks will be documented. New viruses are being created all the time, and old ones are still out there. However, there are other very common attacks, such as spyware. Spyware is quickly becoming an even bigger problem than viruses.

After viruses, the most common attack is unauthorized usage of computer systems. Unauthorized usage includes everything from DoS attacks to outright intrusion of your system. It also includes internal employees misusing system resources. The first edition of this book referenced a survey by the Computer Security Institute of 223 computer professionals showing over $445 million in losses due to computer security breaches. In 75% of the cases, an Internet connection was the point of attack, while 33% of the professionals cited the location as their internal systems. A rather astonishing 78% of those surveyed detected employee abuse of systems/Internet. This statistic means that in any organization, one of the chief dangers might be its own employees. In 2022, similar threats still exist, with only slight changes in the percentages.

The 2014 Data Breach Investigation Report from Verizon surveyed 63,437 security incidents with 1367 confirmed breaches in 95 countries. This survey showed significant employee abuse of the network as well as many of the familiar attacks we have already discussed in this chapter. The 2015 Data Breach Investigation Report did not show significant improvement. In 2022, the situation was not improved. In fact, as mentioned earlier in the chapter, the damage from cybercrime is increasing every year.

Basic Security Terminology

Before you embark on the rest of this chapter and this book, it is important to know some basic terminology. The security and hacking terms in this section provide a basic introduction to computer security terminology, and they are an excellent starting point to help you prepare to learn more about computer security. Additional terms will be introduced throughout the text and listed in the Glossary at the end of this book.

The world of computer security takes its vocabulary from both the professional security community and the hacker community.

Hacker Slang

You probably have heard the term hacker used in movies and in news broadcasts. Most people use it to describe any person who breaks into a computer system. In the hacking community, however, a hacker is an expert on a particular system or systems, a person who simply wants to learn more about the system. Hackers feel that looking at a system’s flaws is the best way to learn about that system. For example, someone well versed in the Linux operating system who works to understand that system by learning its weaknesses and flaws would be a hacker.

This process does often mean seeing if a flaw can be exploited to gain access to a system. This “exploiting” part of the process is where hackers differentiate themselves into three groups:

Images A white hat hacker, upon finding some flaw in a system, will report the flaw to the vendor of that system. For example, if a white hat hacker were to discover some flaw in Red Hat Linux, he would email the Red Hat company (probably anonymously) and explain exactly what the flaw is and how it was exploited. White hat hackers are often hired specifically by companies to do penetration tests. The EC Council even has a certification test for white hat hackers: the Certified Ethical Hacker test.

Images A black hat hacker is the person normally depicted in the media. Once she gains access to a system, her goal is to cause some type of harm. She might steal data, erase files, or deface websites. Black hat hackers are sometimes referred to as crackers.

Images A gray hat hacker is normally a law-abiding citizen but in some cases will venture into illegal activities.

Regardless of how hackers view themselves, intruding on any system is illegal. This means that technically speaking all hackers, regardless of the color of the metaphorical hat they may wear, are in violation of the law. However, many people feel that white hat hackers actually perform a service by finding flaws and informing vendors before those flaws are exploited by less ethically inclined individuals.

Script Kiddies

A hacker is an expert in a given system. As with any profession, hacking includes its share of frauds. So, what is the term for someone who calls himself a hacker but lacks the expertise? The most common term for this sort of person is script kiddy. Yes, that is an older resource, but the term still means the same thing. The name comes from the fact that the Internet is full of utilities and scripts that one can download to perform some hacking tasks. Many of these tools have easy-to-use graphical user interfaces that allow those with very little or no skill to operate them. A classic example is the Low Orbit Ion Cannon tool for executing a DoS attack. Someone who downloads such a tool without really understanding the target system is considered a script kiddy. A significant number of the people you are likely to encounter who call themselves hackers are, in reality, mere script kiddies.

Ethical Hacking: Penetration Testers

When and why would someone give permission to another party to hack his system? The most common answer is in order to assess system vulnerabilities. Such a person used to be called a sneaker, but now the term penetration tester is far more widely used. Whatever the term, the person legally breaks into a system in order to assess security deficiencies, as portrayed in the 1992 film Sneakers, starring Robert Redford, Dan Aykroyd, and Sidney Poitier. More and more companies are soliciting the services of such individuals or firms to assess their vulnerabilities.

Anyone hired to assess the vulnerabilities of a system should be both technically proficient and ethical. Run a criminal background check and avoid those people with problematic pasts. There are plenty of legitimate security professionals available who know and understand hacker skills but have never committed security crimes. If you take to its logical conclusion the argument that hiring convicted hackers means hiring talented people, you could surmise that obviously those in question are not as good at hacking as they would like to think because they were caught.

Most importantly, giving a person with a criminal background access to your systems is on par with hiring a person with multiple DWI convictions to be your driver. In both cases, you are inviting problems and perhaps assuming significant civil liabilities.

Also, some review of their qualifications is clearly in order. Just as there are people who claim to be highly skilled hackers yet are not, there are those who will claim to be skilled penetration testers yet lack the skills truly needed. You would not want to inadvertently hire a script kiddy who thinks she is a penetration tester. Such a person might then pronounce your system quite sound when, in fact, it was simply a lack of skills that prevented the script kiddy from successfully breaching your security. Later in this book, in Chapter 11, “Network Scanning and Vulnerability Scanning,” we discuss the basics of assessing a target system. In Chapter 11 we also discuss the qualifications you should seek in any consultant you might hire for this purpose.

Phreaking

One specialty type of hacking involves breaking into telephone systems. This subspecialty of hacking is referred to as phreaking. The New Hacker’s Dictionary¹⁴ actually defines phreaking as “the action of using mischievous and mostly illegal ways in order to not pay for some sort of telecommunications bill, order, transfer, or other service.” Phreaking requires rather significant knowledge of telecommunications, and many phreakers have some professional experience working for a phone company or other telecommunications business. Often this type of activity is dependent upon specific technology required to compromise phone systems more than simply knowing certain techniques.

14. https://mitpress.mit.edu/9780262680929/the-new-hackers-dictionary/

Professional Terms

Most hacker terminology, as you may have noticed, is concerned with the activity (phreaking) or the person performing the activity (penetration tester). In contrast, security professional terminology describes defensive barrier devices, procedures, and policies. This is quite logical because hacking is an offensive activity centered on attackers and attack methodologies, whereas security is a defensive activity concerned with defensive barriers and procedures.

Security Devices

The most basic security device is the firewall. A firewall is a barrier between a network and the outside world. Sometimes a firewall takes the form of a standalone server, sometimes a router, and sometimes software running on a machine. Whatever its form, a firewall filters traffic entering and exiting the network. A proxy server is often used with a firewall to hide the internal network’s IP address and present a single IP address (its own) to the outside world.

Firewalls and proxy servers guard the perimeter by analyzing traffic (at least inbound traffic and in many cases outbound traffic as well) and blocking traffic that has been disallowed by the administrator. These two safeguards are often augmented by an intrusion detection system (IDS). An IDS simply monitors traffic, looking for suspicious activity that might indicate an attempted intrusion. We will examine these technologies and others in Chapter 9.

Security Activities

In addition to devices, there are security activities. Authentication is the most basic security activity. It is merely the process of determining if the credentials given by a user or another system (such as a username and password) are authorized to access the network resource in question. When you log in with your username and password, the system will attempt to authenticate that username and password. If it is authenticated, you will be granted access.

Another crucial safeguard is auditing, which is the process of reviewing logs, records, and procedures to determine if these items meet standards. This activity will be mentioned in many places throughout this book and will be a definite focus in a few chapters.

The security and hacking terms that we have just covered are only an introduction to computer security terminology, but they provide an excellent starting point that will help you prepare for learning more about computer security. Additional terms will be introduced throughout the text as needed and compiled in the Glossary at the end of the book.

Concepts and Approaches

The approach you take toward security influences all subsequent security decisions and sets the tone for the entire organization’s network security infrastructure. Before we delve into various network security paradigms, let us take a moment to examine a few concepts that should permeate your thinking about security.

The first concept is the CIA triangle. This does not refer to clandestine operations involving the Central Intelligence Agency; rather, it is a reference to the three pillars of security: confidentiality, integrity, and availability. When you are thinking about security, your thought processes should always be guided by these three principles. First and foremost, are you keeping the data confidential? Does your approach help guarantee the integrity of data? And does your approach still make the data readily available to authorized users?

While the CIA triangle is a staple of all security courses and certifications, more sophisticated models have been developed. The McCumber cube describes security using a multifaceted approach. The McCumber cube provides a way of evaluating security of a network, looking at all aspects. It was described in detail in 2004 in the book Assessing and Managing Security Risk in IT Systems: A Structured Methodology. It looks at security as a three-dimensional cube where dimensions are goals, information states, and safeguards. The McCumber cube has the advantage of being a natural expansion of the CIA triangle into three dimensions. This is advantageous because the CIA triangle is widely known and understood in the cybersecurity community. This makes the transition to the McCumber cube, and subsequently a taxonomy based on the McCumber cube, easier. Any taxonomy must be readily learned and applied by security professionals in order to be effective. You can see the McCumber cube in Figure 1.1.

Figure 1.1 The McCumber cube.

Another important concept to keep in mind is least privileges. This means that each user or service running on your network should have the least number of privileges/access required to do the job. No one should be granted access to anything unless it is absolutely required for the job.

Network security paradigms can be classified based on either the scope of security measures taken (perimeter, layered) or how proactive the system is.

In a perimeter security approach, the bulk of security efforts are focused on the perimeter of the network. This focus might include firewalls, proxy servers, password policies, or any technology or procedure to make unauthorized access of the network less likely. Little or no effort is put into securing the systems within the network. In this approach, the perimeter is secured, but the various systems within that perimeter are often vulnerable.

There are additional issues regarding perimeter security that include physical security. These issues can include fences, closed-circuit TV, guards, locks, and so on, depending on the security needs of the organization.

The perimeter approach is clearly flawed, so why do some companies use it? Small organizations might use the perimeter approach if they have budget constraints or inexperienced network administrators. A perimeter method might be adequate for small organizations that do not store sensitive data, but it rarely works in a larger corporate setting.

A layered security approach is one in which not only is the perimeter secured, but individual systems within the network are also secured. All servers, workstations, routers, and hubs within the network are secure. One way to accomplish this is to divide the network into segments and secure each segment as if it were a separate network, so if the perimeter security is compromised, not all the internal systems are affected. This is the preferred method and should be used whenever possible.

You should also measure your security approach by how proactive/reactive it is. This is done by gauging how much of the system’s security infrastructure and policies are dedicated to preventive measures and how much of the security system is designed to respond to attack. A passive security approach takes few or no steps to prevent an attack. A dynamic or proactive defense is one in which steps are taken to prevent attacks before they occur.

One example of this defense is the use of IDSs, which work to detect attempts to circumvent security measures. These systems can tell a system administrator that an attempt to breach security has been made, even if that attempt is not successful. IDSs can also be used to detect various techniques intruders use to assess a target system, thus alerting a network administrator to the potential for an attempted breach before the attempt is even initiated.

In the real world, network security is usually not completely in one paradigm or another; it is usually a hybrid approach. Networks generally include elements of both security paradigms. The two categories also combine. One can have a network that is predominantly passive but layered or one that is primarily perimeter but proactive. It can be helpful to consider approaches to computer security along a Cartesian coordinate system, as illustrated in Figure 1.2, with the x axis representing the level of passive–active approaches and the y axis depicting the range from perimeter to layered defense.

Figure 1.2 The security approach guide.

The most desirable hybrid approach is a layered paradigm that is dynamic—that is, in the upper-right quadrant of the figure.

How Do Legal Issues Impact Network Security?

An increasing number of legal issues affect how one approaches computer security. If your organization is a publicly traded company or a government agency or does business with either one, there may be legal constraints regarding your network security. Even if your network is not legally bound to these security guidelines, it’s useful to understand the various laws impacting computer security. You may choose to apply them to your own security standards.

One of the oldest pieces of legislation in the United States that affects computer security is the Computer Security Act of 1987.¹⁵ It requires government agencies to identify sensitive systems, conduct computer security training, and develop computer security plans. This law was a vague mandate ordering federal agencies in the United States to establish security measures, but it did not specify standards.

15. https://csrc.nist.gov/csrc/media/projects/ispab/documents/csa_87.txt

This legislation established a legal mandate to enact specific standards, paving the way for future guidelines and regulations. It also helped define terms, such as what information is considered “sensitive.” This quote is found in the legislation itself:

The term “sensitive information” means any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

This definition of the word sensitive should be kept in mind because it indicated that more than just Social Security information and medical history information must be secured.

When considering what information needs to be secured, simply answer this question: Would the unauthorized access or modification of this information adversely affect your organization? If the answer is yes, then you must consider that information sensitive and in need of security precautions.

Another more specific federal law that applied to mandated security for government systems was OMB Circular A-130 (specifically, Appendix III). This document required that federal agencies establish security programs containing specified elements. It also described requirements for developing standards for computer systems and for records held by government agencies.

Most states have specific laws regarding computer security, such as the Computer Crimes Act of Florida, the Computer Crime Act of Alabama, and the Computer Crimes Act of Oklahoma. If you’re responsible for network security, you might find yourself part of a criminal investigation. This could be an investigation into a hacking incident or employee misuse of computer resources. A list of computer crime laws (organized by state) can be found at http://criminal.findlaw.com/criminal-charges/cyber-crimes.xhtml.

Caution

Privacy Laws

It is critical to keep in mind that any law that governs privacy (such as the Health Insurance Portability and Accountability Act of 1996 [HIPAA]) also has a direct impact on computer security. If your system is compromised, and thus data that is covered under any privacy statute is compromised, you may need to prove that you exercised due diligence in protecting that data. If it can be shown that you did not take proper precautions, you might be found civilly liable.

Online Security Resources

As you read this book, and when you move out into the professional world, you will have frequent need for additional security resources. Appendix A, “Resources,” includes a more complete list of resources, but this section highlights a few of the most important ones you may find useful now.

CERT

The Computer Emergency Response Team (CERT; www.cert.org) is sponsored by Carnegie Mellon University. CERT was the first computer incident-response team, and it is still one of the most respected in the industry. Anyone interested in network security should visit the site routinely. On the website you will find a wealth of documentation, including guidelines for security policies, cutting-edge security research, and more.

Microsoft Security Advisor

Because so many computers today run Microsoft operating systems, another good resource is the Microsoft Security Response Center website: https://www.microsoft.com/en-us/msrc?rtc=1. This site is a portal to all Microsoft security information, tools, and updates. If you use any Microsoft software, you should visit this website regularly.

F-Secure

The F-Secure corporation maintains a website at www.f-secure.com. This site is, among other things, a repository for detailed information on virus outbreaks. Here you will find not only notifications about a particular virus but detailed information about the virus, such as how the virus spreads, and ways to recognize the virus, and, possibly, specific tools for cleaning an infected system of a particular virus.

SANS Institute

The SANS Institute website (www.sans.org) is a vast repository of security-related documentation. On this site you will find detailed documentation on virtually every aspect of computer security you can imagine. The SANS Institute also sponsors a number of security research projects and publishes information about those projects on its website.

Summary

Network security is a complex and constantly evolving field. Practitioners must stay on top of new threats and solutions and be proactive in assessing risk and protecting their networks. The first step in understanding network security is to become acquainted with the actual threats posed to a network. Without a realistic idea of what threats might affect your systems, you will be unable to effectively protect them. It is also critical that you acquire a basic understanding of the terminology used by both security professionals and those who would seek to compromise your security.

Test Your Skills

Multiple Choice Questions

1. You are trying to explain security to a nontechnical manager. She has taken a rather extreme view of computer security. Which of the following is one of the extreme viewpoints about computer security discussed in this chapter?

A. The federal government will handle security.

B. Microsoft will handle security.

C. There are no imminent dangers to your system.

D. There is no danger if you use Linux.

2. You have just taken over as network security administrator for a small community college. You want to take steps to secure your network. Before you can formulate a defense for a network, what do you need?

A. Appropriate security certifications

B. A clear picture of the dangers to be defended against

C. To finish this textbook

D. The help of an outside consultant

3. Mary is teaching an introductory cybersecurity course to freshmen. She is explaining to them the major threats. Which of the following is not one of the three major classes of threats?

A. Attempts to intrude on the system

B. Online auction fraud

C. Denial of service attacks

D. A computer virus

4. Being able to define attack terms is an important skill for a cybersecurity professional. What is a computer virus?

A. Any program that is downloaded to your system without your permission

B. Any program that self-replicates

C. Any program that causes harm to your system

D. Any program that can change your Windows Registry

5. Being able to define attack terms is an important skill for a cybersecurity professional. What is spyware?

A. Any software that monitors your system

B. Only software that logs keystrokes

C. Any software used to gather intelligence

D. Only software that monitors what websites you visit

6. What is a penetration tester?

A. A person who hacks a system without being caught

B. A person who hacks a system by faking a legitimate password

C. A person who hacks a system to test its vulnerabilities

D. A person who is an amateur hacker

7. Elizabeth is explaining various hacking terms to a class. She is in the process of discussing the history of phone system hacking. What is the term for hacking a phone system?

A. Telco-hacking

B. Hacking

C. Cracking

D. Phreaking

8. What is malware?

A. Software that has some malicious purpose

B. Software that is not functioning properly

C. Software that damages your system

D. Software that is not properly configured for your system

9. What is war-driving?

A. Driving and seeking a computer job

B. Driving while using a wireless connection for hacking

C. Driving looking for wireless networks to hack

D. Driving and seeking rival hackers

10. What is the name for the hacking technique that involves using persuasion and deception to get a person to provide information to help compromise security?

A. Social engineering

B. Conning

C. Human intel

D. Soft hacking

11. There are many threats on the Internet. Which one is currently the most common may change over time, but certain threats have always been more common than others. Which of the following is the most common threat on the Internet?

A. Auction fraud

B. Phreaking

C. Computer viruses

D. Illegal software

12. What are the three approaches to security?

A. Perimeter, layered, hybrid

B. High security, medium security, low security

C. Internal, external, and hybrid

D. Perimeter, complete, none

13. Defining your security strategy is an important step in securing a network. You are trying to classify devices based on the approach they take to security. An intrusion detection system is an example of which of the following?

A. Proactive security

B. Perimeter security

C. Hybrid security

D. Good security practices

14. Which of the following is the most basic security activity?

A. Authentication

B. Firewalls

C. Password protection

D. Auditing

15. The most desirable approach to security is one that is which of the following?

A. Perimeter and dynamic

B. Layered and dynamic

C. Perimeter and static

D. Layered and static

16. As of 2022, which of the following is the fastest-growing target for cyber attacks?

A. IoT

B. Servers

C. Laptops

D. USB devices

17. Which of the following types of privacy law affects computer security?

A. Any state privacy law

B. Any privacy law applicable to your organization

C. Any privacy law

D. Any federal privacy law

18. The first computer incident-response team is affiliated with what university?

A. Massachusetts Institute of Technology

B. Carnegie Mellon University

C. Harvard University

D. California Technical University

19. Which of the following is the best definition of the term sensitive information?

A. Any information that has an impact on national security

B. Any information that is worth more than $1,000

C. Any information that, if accessed by unauthorized personnel, could damage your organization in any way

D. Any information that is protected by privacy laws

20. Which of the following is the best description of doxing?

A. A DoS malware attack

B. Framing someone for a crime

C. Putting personal information out in the public domain

D. Stealing personal information

Exercises

EXERCISE 1.1: How Many Virus Attacks Have Occurred This Month?

Using some website resource, such as www.f-secure.com, look up recent computer virus outbreaks.

How many virus outbreaks have occurred in the past 7 days?

Write down how many outbreaks have occurred in the past 30 days, 90 days, and 1 year.

Are virus attacks increasing in frequency?

EXERCISE 1.2: Learning About Cookies as Spyware

Get an idea of what kind of information cookies store. You might find the following websites helpful:

www.allaboutcookies.org

www.howstuffworks.com/cookie1.htm

Write a brief essay explaining in what way cookies can invade privacy.

EXERCISE 1.3: Hacker Terminology

1. Use the Hacker’s Dictionary at http://www.outpost9.com/reference/jargon/jargon_toc.xhtml to define the following hacker terms:

A. Alpha geek

B. Grok

C. Red Book

D. Wank

EXERCISE 1.4: Using Security Resources

Using one of the preferred web resources listed in this chapter, find three policy or procedure documents from that resource.

List the documents you selected.

Write a brief essay explaining why those particular documents are important to your organization’s security.

EXERCISE 1.5: Learning About the Law

Using the Web, journals, books, or other resources, find out if your state or territory has any laws specific to computer security. You might find the following websites helpful:

www.pbs.org/wgbh/pages/frontline/shows/hackers/blame/crimelaws.xhtml

www.cybercrime.gov

List three laws that you find for your region and provide a brief one- or two-sentence description of each.

Projects

PROJECT 1.1: Learning About a Virus

Using web resources from Appendix A and sites such as www.f-secure.com, find a virus that has been released in the past 6 months.

Research how the virus spread and what damage it caused.

Write a brief (half- to one-page) paper on this virus. Explain how the virus worked, how it spread, and any other essential information you can find.

PROJECT 1.2: Considering the Law (a Group Project)

Write a description of a computer law that you would like to have passed, along with specifics related to its implementation, enforcement, and justification.

PROJECT 1.3: Recommending Security

Using the Web, journals, or books, locate security recommendations from any reputable source, such as the SANS Institute. Any of the sites mentioned in the “Online Security Resources” section of this chapter would be a good choice.

List five of those recommendations.

Explain why you agree or disagree with each of these five recommendations.

Case Study

In this case study we will consider a network administrator for a small, family-oriented video store. The store is not part of a chain of stores and has a very limited security budget. It has five machines for employees to use to check out movies and one server on which to keep centralized records. That server is in the manager’s office. The administrator takes the following security precautions:

Images Each machine is upgraded to Windows 10, with the personal firewall turned on.

Images Antivirus software has been installed on all machines.

Images A tape backup is added to the server, and tapes are kept in a file cabinet in the manager’s office.

Images Internet access to employee machines is removed.

Now consider these questions:

What have these actions accomplished?

What additional actions might you recommend?

Chapter 2

Networks and the Internet

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Identify each of the major protocols used in network communication (for example, FTP and Telnet) and what use you can make of each of them

Images Understand the various connection methods and speeds used on networks

Images Compare and contrast various network devices

Images Identify and explain various network protocols

Images Understand how data is transmitted over a network

Images Explain how the Internet works and the use of IP addresses and URLs

Images Recount a brief history of the Internet

Images Use network utilities such as ping, IPConfig, and tracert

Images Describe the OSI model of network communication and the use of MAC addresses

Introduction

To be able to manage network security, you will need knowledge about how computer networks operate. This might seem rather obvious, but it is surprising how many people ignore this fundamental issue. If you already have a strong working knowledge of network operations, you may choose to skim this chapter or perhaps give it a quick read as a review. If you are new to computer networking, studying this chapter will give you a basic introduction to how networks and the Internet work, including a history of the Internet. This understanding of networks and the Internet will be crucial to your comprehension of later topics presented in this book. However, keep in mind that if the topics of this chapter are new to you, then this chapter is only the bare minimum for someone in cybersecurity. It is really hard to know too much, and you should consider augmenting your knowledge of computer technology, networks, and related topics.

In this chapter we will begin by examining the basic technologies, protocols, and methods used for networks and the Internet to communicate. Then we will take a look at the history of the Internet. This information forms the background knowledge you will need to understand various cyber attacks and how they are defended against. In the exercises at the end of the chapter, you will be able to practice using some protective methods, such as IPConfig, tracert, and ping.

Network Basics

Getting two or more computers to communicate and transmit data is a process that is simple in concept but complex in application. Consider all the factors involved. First, you need to physically connect the computers. This connection usually requires either a cable that plugs into your computer or wireless connection. The cable then is plugged either directly to another computer or into a device that will, in turn, connect to several other computers.

Of course, wireless communication is being used with more frequency, and wireless connection, obviously, doesn’t require a cable. However, even wireless communication relies on a physical device to transmit the data. There is a card in most modern computers called a network interface card, or NIC. If the connection is through a cable, the part of the NIC that is external to the computer has a connection slot that looks like a telephone jack, only slightly bigger. Wireless networks also use a NIC; but rather than having a slot for a cable to connect to, the wireless network uses radio signals to transmit to a nearby wireless router or hub. A wireless router, hub, or NIC must have an antenna to transmit and receive signals. These devices are connective devices that will be explained in detail later in this chapter.

The Physical Connection: Local Networks

As mentioned, using cables is one of the ways that computers are connected to each other. The cable connection used with traditional NICs (meaning not wireless) is an RJ-45 connection. (RJ is short for Registered Jack, which is an international industry standard.) In contrast to the computer’s RJ-45 jacks, standard telephone lines use RJ-11 jacks. The biggest difference between jacks involves the number of wires in the connector, also called the terminator. Phone lines have four wires (though some have six wires), whereas RJ-45 connectors have eight wires.

If you look on the back of most computers or the connection area of a laptop, you will probably find two ports that, at first glance, look like phone jacks. One of the two ports is probably for a traditional modem and accepts a standard RJ-11 jack. The other port is larger and accepts an RJ-45 jack. It would be extremely rare to find a modern computer that did not have a NIC.

This standard connector jack must be on the end of the cable. The cable used in most networks today is a Category 5 or Category 6 cable, abbreviated as Cat 5 cable or Cat 6 cable. The specifications for cable are laid out in ISO/IEC 11801. Table 2.1 summarizes the various categories of cable and their uses.

Table 2.1 Cable Types and Uses

Category

Specifications

Uses

1

Low-speed analog (less than 1MHz)

Telephone, doorbell

2

Analog line (less than 10MHz)

Telephone

3

Up to 16MHz or 100Mbps (megabits per second)

Voice transmissions

4

Up to 20MHz/100Mbps

Data lines, Ethernet networks

5

100MHz/100Mbps

Most common a few years ago; still widely used

6

1000Mbps (some get 10Gbps)

Most common type of network cable

6a

10Gbps

High-speed networks

7

10Gbps

Very high-speed networks

8

40Gbps

Very high-speed networks

The type of cable used in connecting computers is also often referred to as unshielded twisted-pair (UTP) cable. In UTP, the wires in the cable are in pairs, twisted together without additional shielding. As you can see in Table 2.1, each subsequent category of cable is somewhat faster and more robust than the last. It should be noted that although Cat 4 can be used for networks, it almost never is used for that purpose, as it is simply slower, less reliable, and an older technology. You will usually see Cat 5 cable and, increasingly, Cat 6. You should note that we are focusing on UTP because that is what is found most often. There are other types of cable, such as shielded twisted-pair (STP), but they are not nearly as common as UTP.

Fyi: Cable Speed

Category 6 cable is for Gigabit Ethernet and has become quite common. In fact, some networks are now using Cat 7. Cat 5 cable works at speeds of up to 100Mbps, whereas Cat 6 works at 1000Mbps. Cat 6 is widely available and has been for several years. However, for Cat 6 to truly function properly, you need hubs/switches and NICs that also transmit at gigabit speeds; thus, the spread of gigabit Ethernet has been much slower than many analysts expected. We will discuss hubs, switches, NICs, and other hardware in more detail later in this chapter.

As shown in Table 2.1, a key specification is speed, measured in Mbps, or megabits per second (though gigabits per second, or Gbps, speeds are becoming more common). You are probably already aware that ultimately everything in a computer is stored in a binary format—namely, in the form of a 1 or a 0. These units are called bits. It takes 8 bits, which equals 1 byte, to represent a single character such as a letter, number, or carriage return. Remember that the data specification for each cable is the maximum that the cable can handle. A Cat 5 cable can transmit up to 100 mega (million) bits per second. This is known as the bandwidth of the cable. If multiple users are on a network, all sending data, that traffic uses up bandwidth rather quickly. Any pictures transmitted also use a lot of bandwidth. Simple scanned-in photos can easily reach 2 megabytes (2 million bytes, or 16 million bits) or much larger. And streaming media, such as video, is perhaps the most demanding in terms of bandwidth.

If you simply want to connect 2 computers, you can have the cable go directly from one computer to the other. You would have to use a crossover cable, but you could connect 2 computers directly. But what do you do if you want to connect more than 2 computers? What if you have 100 computers that you need to connect on a network? There are three devices that can help you to accomplish this task: the hub, the switch, and the router. These each use Cat 5 or Cat 6 cable with RJ-45 connectors and are explained in the following sections.

The Hub

The simplest connection device is the hub. A hub is a small box-shaped electronic device into which you can plug network cables. It will have 4 or more (commonly up to 24) RJ-45 jacks, called ports. A hub can connect as many computers as it has ports. (For example, an 8-port hub can connect eight computers.) You can also connect one hub to another; this strategy is referred to as “stacking” hubs. Hubs are quite inexpensive and simple to set up: Just plug in the cable. However, hubs have a downside. If you send a packet (a unit of data transmission) from one computer to another, a copy of that packet is actually sent out from every port on the hub. All these copies leads to a lot of unnecessary network traffic. This occurs because the hub, being a very simple device, has no way of knowing where a packet is supposed to go. Therefore, it simply sends copies of the packet out all of its ports. While you may go to your favorite electronics store and buy something called a “hub,” true hubs no longer exist. What you are really getting is a switch, which we will discuss later in this section.

The Repeater

A repeater is a device used to boost signal. Basically if your cable needs to go further than the maximum length (which is 100 meters for UTP), then you need a repeater. There are two types of repeaters: amplifiers and signals. Amplifier repeaters simply boost the entire signal they receive, including any noise. Signal repeaters regenerate the signal, and thus don’t rebroadcast noise.

The Switch

A switch is basically an intelligent hub; it works and looks exactly like a hub, with one significant difference. When a switch receives a packet, it sends that packet only out the port for the computer to which it needs to go. A switch is essentially a hub that is able to determine where a packet is being sent. It makes this determination based on the MAC (Media Access Control) address, found in the Ethernet header of the packet. More details on MAC addresses and packet headers will be provided later in this chapter.

The Router

Finally, if you wish to connect two or more networks, you use a router. A router is similar in concept to a hub or switch, as it relays packets; but it is far more sophisticated. To begin with, a router directs traffic based on the IP address found in the IP header of a packet. You can program most routers and control how they relay packets. Most routers have interfaces that allow you to configure them. More robust routers also offer more programming possibilities. The specifics of how you program a router are different from vendor to vendor, and there are entire books written on just programming routers. It is not possible to cover specific router programming techniques in this book; however, you should be aware that most routers are programmable, allowing you to change how they route traffic. Also, unlike when using a hub or switch, the two networks connected by a router are still separate networks.

Faster Connection Speeds

So far we have looked at the connections between computers on a local network, but there are faster connection methods. In fact, your Internet service provider or the company for which you work probably has a much faster connection to the Internet. Table 2.2 summarizes the most common highspeed connection types and their speeds.

Table 2.2 Internet Connection Types

Connection Type

Speed

Details

DS0

64Kbps

Standard phone line.

ISDN

128Kbps

2 DS0 lines working together to provide a high-speed data connection.

T1

1.54Mbps

24 DS0 lines working as one, where 23 of the lines carry data, and 1 carries information about the other lines. This type of connection has become common for schools and businesses.

T3

43.2Mbps

672 DS0 lines working together; the equivalent of 28 T1 lines.

OC3

155Mbps

All OC lines are optical and do not use traditional phone lines. OC3 lines are quite fast and very expensive. They are often found at telecommunications companies.

OC12

622Mbps

The equivalent of 336 T1 lines, or 8064 phone lines.

OC48

2.5Gbps

The equivalent of 4 OC12 lines.

It is common to find T1 connection lines in many locations. A cable modem can sometimes achieve speeds comparable to that of a T1 line. Note that cable connections are not included in Table 2.2 simply because their actual speeds vary greatly, depending on a variety of circumstances, including how many people in the immediate vicinity are using the same cable modem provider. You are not likely to encounter OC lines unless you work in telecommunications.

Wireless

Today, most of us use wireless networking, or Wi-Fi. The Institute of Electrical and Electronics Engineers (IEEE) standard 802.11 provides guidelines for wireless networking. Various letter designations are used to denote different wireless speeds. The various wireless speeds, starting from the oldest to the most recent, are listed here:

Images 802.11a: This was the first widely used Wi-Fi; it operated at 5GHz and was relatively slow.

Images 802.11b: This standard operated at 2.4GHZ and had an indoor range of 125 feet with a bandwidth of 11Mbps.

Images 802.11g: There are still many of these wireless networks in operation, but you can no longer purchase new Wi-Fi access points that use 802.11g. This standard includes backward compatibility with 802.11b. 802.11g has an indoor range of 125 feet and bandwidth of 54Mbps.

Images 802.11n: This standard was a tremendous improvement over preceding wireless networks, providing bandwidth of 100Mbps to 140Mbps and operating at frequencies of 2.4GHz or 5.0GHz over an indoor range of up to 230 feet.

Images IEEE 802.11n-2009: This technology provides bandwidth of up to 600Mpbs with the use of four spatial streams at a channel width of 40MHz. It uses multiple-input multiple-output (MIMO), in which multiple antennas coherently resolve more information than is possible using a single antenna.

Images IEEE 802.11ac: This standard, which was approved in January 2014, has throughput of up to 1Gbps and at least 500Mbps. It uses up to 8 MIMO.

Images IEEE 802.11ad Wireless Gigabyte Alliance: This standard supports data transmission rates up to 7Gbps, which is more than 10 times faster than the highest 802.11n rate.

Images IEEE 802.11af: Also referred to as “White-Fi” and “Super Wi-Fi,” this standard, which was approved in February 2014, allows WLAN operation in TV white space spectrum in the VHF and UHF bands between 54MHz and 790MHz.

Images 802.11ah: This standard, which was published in 2017, uses sub-1GHz bands that don’t require FCC licensing.

Images 802.11aj: This standard is a rebranding of 802.11ad for use in the 45GHz unlicensed spectrum available in some regions of the world (specifically China).

Images 802.11ax: This standard, which is a successor to 802.11ac, is sometimes referred to as Wi-Fi 6. It was approved in February 2021 and is designed to work in dense environments (that is, where there are other completing signals).

Images 802.11be: This standard is designed for extremely high throughput (EHT). Speeds are expected to reach 40Gbps. It will use the 2.4 and 5GHz bands that have been used with Wi-Fi for years, and it will also work in the 6GHz band. This standard is still being developed as of this writing; the initial draft was published in 2021.

The methods for securing Wi-Fi have evolved over the years. First there was Wired Equivalent Privacy (WEP), then Wi-Fi Protected Access (WPA), then WPA2, and more recently WPA3.

WEP uses the stream cipher RC4 to secure the data and a CRC-32 checksum for error checking. Standard WEP (known as WEP-40) uses a 40-bit key with a 24-bit initialization vector (IV) to effectively form 64-bit encryption. 128-bit WEP uses a 104-bit key with a 24-bit IV.

Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way its IV is used also opens WEP to a related key attack. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets.

WPA uses Temporal Key Integrity Protocol (TKIP), which is a 128-bit per-packet key, meaning that it dynamically generates a new key for each packet.

WPA2 is based on the IEEE 802.11i standard and uses Advanced Encryption Standard (AES) with the Counter Mode-Cipher Block Chaining (CBC)-Message Authentication Code (MAC) Protocol (CCMP), which provides data confidentiality, data origin authentication, and data integrity for wireless frames.

WPA3 requires attackers to interact with your Wi-Fi for every password guess they make, making it much harder and time-consuming to crack. With WPA3’s Wi-Fi Easy Connect, however, you can connect a device by merely scanning a QR code on your phone. One of the important new security features is that with WPA3, even open networks will encrypt your individual traffic.

Bluetooth

Bluetooth is short-distance radio using the 2.4GHz to 2.485GHz frequency. The IEEE standardized Bluetooth as IEEE 802.15.1, but it no longer maintains the standard. This standard enables devices to discover other Bluetooth devices within range. The name comes from king Harald “Bluetooth” Gormsson, a tenth-century Danish king who united the tribes of Denmark. The idea behind the Bluetooth technology is that it unites communication protocols. (The king’s nickname has been explained a few different ways. One explanation is that he had a bad tooth that was blue. Another is that he was often clothed in blue.) The speed and range of Bluetooth depend on the version, as outlined in Table 2.3.

Table 2.3 Bluetooth Bandwidth and Range

Version

Bandwidth

Range

3.0

25Mbps

10 meters (33 feet)

4.0

25Mbps

60 meters (200 feet)

5.0

50Mbps

240 meters (800 feet)

Minor enhancements were made to Bluetooth version 5.0, and versions 5.1, 5.2, and 5.3 each made minor improvements to 5.0. For example, 5.3 which was released in July 2021, included improved encryption key handing as well as channel classification improvements.

Other Wireless Protocols

There are several other wireless communication protocols, including the following:

Images ANT+: This wireless protocol is often used with sensor data such as in bio sensors or exercise applications.

Images Zigbee: This standard was developed by a consortium of electronics manufacturers for mainly residential applications of wireless devices related to appliances and security. It is based on the 802.15.4 standard. What appears to be confusing is that the standard is represented by the name “Zigbee” rather than a number. The term Zigbee is used similarly to the way the term Wi-Fi is used.

Images Z-Wave: This wireless communications protocol is used primarily for home automation. It uses a low-energy radio for appliance-to-appliance communication using a mesh network.

Images 6LoWPAN: IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN) was originally standardized as RFC 4944 in 2007 and has been updated several times since then, most recently with RFC 8066 in 2017.

Images Thread: Thread is an IPv6 protocol designed specifically for IoT. It works with low-power devices and creates a mesh network. Thread uses 6LoWPAN.

Images DASH7: This protocol for RFID (radio frequency identification) uses the frequencies 433MHz, 868MHz, and 915MHz, and it can achieve ranges up to 2 kilometers.

Images WirelessHART: This wireless sensing technology, which not a lot of readers are likely to be familiar with, is based on the Highway Addressable Remote Transducer (HART) protocol. It is used for process automation applications.

Data Transmission

We’ve seen, briefly, the physical connection methods; but how is data actually transmitted? To transmit data, a packet is sent. The basic purpose of a cable is to transmit packets from one machine to another. It does not matter whether the packets are part of a document, a video, an image, or just some internal signal from the computer. So what, exactly, is a packet? As we discussed earlier, everything in a computer is ultimately stored as 1s and 0s, called bits, which are grouped into sets of eight, each called a byte. A packet is a certain number of bytes divided into a header and a body. The header is 20 bytes at the beginning of the packet that tells you where the packet is coming from, where it is going, and more. The body contains the actual data, in binary format, that you wish to send. The aforementioned routers and switches work by reading the header portion of any packets that come to them. This process is how they determine where the packet should be sent.

Protocols

There are different types of network communications for different purposes. The different types of network communications are called protocols. A protocol is, essentially, an agreed-upon method of communication. In fact, this definition is exactly how the word protocol is used in standard, noncomputer usage, too. Each protocol has a specific purpose and normally operates on a certain port. (Ports are discussed in more detail later.) Some of the most important, and most commonly used, protocols are listed in Table 2.4.

Table 2.4 TCP/IP Protocols

Protocol

Purpose

Port(s)

FTP (File Transfer Protocol)

For transferring files between computers.

20 and 21

TFTP (Trivial File Transfer Protocol)

A quicker but less reliable form of FTP.

69

SSH (Secure Shell)

Used to securely connect to a remote system.

22

Telnet

Used to remotely log on to a system. You can then use a command prompt or shell to execute commands on that system. Popular with network administrators.

23

SMTP (Simple Mail Transfer Protocol)

Sends email.

25

Whois

A command that queries a target IP address for information.

43

DNS (Domain Name System)

Translates URLs into web addresses.

53

HTTP (Hypertext Transfer Protocol)

Displays web pages.

80

POP3 (Post Office Protocol version 3)

Retrieves email.

110

NNTP (Network News Transfer Protocol)

Used for network newsgroups (Usenet newsgroups). You can access these groups over the Web via www.google.com and selecting the Groups tab.

119

NetBIOS

An older Microsoft protocol that is for naming systems on a local network.

137, 138, or 139

IMAP (Internet Message Access Protocol)

More advanced protocol for receiving email. Widely replacing POP3.

143

IRC (Internet Relay Chat)

Used for chat rooms.

194

SMB (Server Message Block)

Used for Windows Active Directory.

445

HTTPS

Encrypted HTTP; used for secure websites.

443

SMTPS (Simple Mail Transfer Protocol Secure)

Encrypted SMTP.

465

POP3S (Post Office Protocol version 3 Secure)

Encrypted POP3.

995

IMAPS (Internet Message Access Protocol Secure)

Encrypted IMAP.

993

Each of these protocols will be explained in more detail, as needed, in later chapters of this book. You should also note that this list is not complete, as there are dozens of other protocols; but these are the basic protocols we will be discussing in this book. All of these protocols are part of a suite of protocols referred to as TCP/IP (Transmission Control Protocol/Internet Protocol). But no matter the particular protocol being used, all communication on networks takes place via packets that are transmitted according to certain protocols, depending on the type of communication that is occurring.

Ports

You may be wondering what a port is, especially since we’ve already talked about the ports that are the connection locations on the back of your computer, such as serial ports, parallel ports, and RJ-45 and RJ-11 ports. A port, in networking terms, is a handle, or a connection point. It is a numeric designation for a particular pathway of communications. You can think of a port as a channel number on your television. You may have one cable coming into your TV, but you can tune to a variety of channels. There are 65,535 network communications ports on your computer. This is true regardless of type of computer or operating system. The combination of your computer’s IP address and port number is referred to as a socket. All network communication, regardless of the port used, comes into your computer via the connection on your NIC.

So, the picture we’ve drawn of networks, to this point, is one of machines connected to each other via cables, and perhaps to hubs, switches, or routers. These networks transmit binary information in packets using certain protocols and ports.

How the Internet Works

Now that you have a basic idea of how computers communicate with each other over a network, it is time to discuss how the Internet works. The Internet is essentially a large number of networks that are connected to each other. Therefore, the Internet works exactly the same way as your local network. It sends the same sort of data packets, using the same protocols. These various networks are simply connected to main transmission lines called backbones. The points where the backbones connect to each other are called network access points (NAPs). When you log on to the Internet, you probably use an Internet service provider (ISP). That ISP has a connection either to the Internet backbone or to yet another provider that has a backbone. So, logging on to the Internet is a process of connecting your computer to your ISP’s network, which is, in turn, connected to one of the backbones on the Internet.

IP Addresses

With tens of thousands of networks and millions of individual computers communicating and sending data, a predictable problem arises. That problem is ensuring that the data packets go to the correct computer. This task is accomplished in much the same way as traditional “snail” mail letter is delivered to the right person: via an address. With network communications, this address is a special one, referred to as an “IP” address. An IP address can be IP version 4 or version 6.

IPv4

An IP address is a series of four values, separated by periods. (An example would be 107.22.98.198.) Each of the three-digit numbers must be between 0 and 255; thus, the address 107.22.98.466 would not be valid. These addresses are actually four binary numbers; you just see them in decimal format. Because each of these numbers is really just a decimal representation of 8 bits, they are often referred to as octets. So there are four octets in an IPv4 address. Recall that a byte is 8 bits (1s and 0s), and an 8-bit binary number converted to decimal format will be between 0 and 255. So you don’t have to do the math yourself, I will tell you that this rule means there are a total of over 4.2 billion possible IP addresses. You should not be concerned, however, that we will run out of new IP addresses soon. There are methods already in place (which are discussed later) to extend the use of addresses.

Fyi: Converting Binary Numbers

For those readers not familiar with converting decimal to binary, there are several methods, one of which is shown here. You should be aware that the computer will do this for you in the case of IP addresses, but here’s one way—and perhaps the simplest—this is done:

Divide repeatedly by 2, using “remainders” rather than decimal places, until you get down to 1. For example, to convert decimal 31 to binary:

31/2 = 15 remainder 1

15/2 = 7 remainder 1

7/2 = 3 remainder 1

3/2 = 1 remainder 1

1/2 = 0 remainder 1

Now read the remainders from bottom to top: The binary equivalent is 11111.

IP addresses fall into two groups: public and private. Public IP addresses are for computers connected to the Internet. No two public IP addresses can be the same. However, a private IP address, such as one on a private company network, only has to be unique in that network. It does not matter if other computers in the world have the same IP address because this computer is never connected to those other worldwide computers. Often network administrators use private IP addresses that begin with a 10, such as 10.102.230.17.

It should also be pointed out that often an ISP will buy a pool of public IP addresses and assign them to you when you log on. An ISP might own 1000 public IP address and have 10,000 customers. Because all 10,000 customers will not be online at the same time, the ISP simply assigns an IP address to a customer when he logs on, and the ISP unassigns the IP address when the customer logs off.

The address of a computer tells you a lot about that computer. The first byte (or the first decimal number) in an address tells you to what class of network that machine belongs. Table 2.5 summarizes the five network classes.

Table 2.5 Network Classes

Class

IP Range for the First Byte

Use

A

0–126

Extremely large networks. No Class A network IP addresses are left. All of them have been used.

B

128–191

Large corporate and government networks. All Class B IP addresses have been used.

C

192–223

The most common group of IP addresses. Your ISP probably has a Class C address.

D

224–247

These are reserved for multicasting (transmitting different data on the same channel).

E

248–255

Reserved for experimental use.

These five classes of networks will become more important later in this book (or should you decide to study networking on a deeper level). Observe Table 2.5 carefully, and you probably will discover that the IP range 127 was not listed. It is omitted because this range is reserved for testing. The IP address 127.0.0.1 designates the machine you are on, regardless of that machine’s assigned IP address. This address is often referred to as the loopback address. That address will be used often in testing your machine and your NIC. We will examine its use a bit later in this chapter, in the section “Basic Network Utilities.”

These particular classes are important as they tell you what part of the address represents the network and what part represents the node. For example, in a Class A address, the first octet represents the network, and the remaining three octets represent the node. In a Class B address, the first two octets represent the network, and the second two represent the node. And finally, in a Class C address, the first three octets represent the network, and the last octet represents the node.

There are also some very specific IP addresses and IP address ranges you should be aware of. The first, as previously mentioned, is 127.0.0.1, or the loopback address. It is another way of referring to the network interface card of the machine you are on.

Private IP addresses are another issue to be aware of. Certain ranges of IP addresses have been designated for use within networks. They cannot be used as public IP addresses but can be used for internal workstations and servers. Those IP addresses are

Images 10.0.0.10 to 10.255.255.255

Images 172.16.0.0 to 172.31.255.255

Images 192.168.0.0 to 192.168.255.255

Sometimes people who are new to networking have trouble understanding public and private IP addresses. A good analogy is an office building. Within a single office building, each office number must be unique. You can only have one office 305. And within that building, if you discuss office 305, it is immediately clear what you are talking about. But there are other office buildings, many of which have their own office 305. You can think of private IP addresses as office numbers. They must be unique within their network, but there may be other networks with the same private IP address.

Public IP addresses are more like traditional mailing addresses: They must be unique worldwide. When communicating from office to office you can use the office number, but to get a letter to another building you have to use the complete mailing address. It is much the same with networking. You can communicate within your network using private IP addresses, but to communicate with any computer outside your network, you have to use public IP addresses.

One of the roles of a gateway router is to perform network address translation (NAT), which involves replacing the private IP address on an outgoing packet with the public IP address of the gateway router so that the packet can be routed through the Internet.

Subnetting

We have already discussed IPv4 network addresses; now let’s turn our attention to subnetting. If you are already familiar with this topic, feel free to skip this section. For some reason, this topic tends to give networking students a great deal of trouble, so we will begin with a conceptual understanding. Subnetting is simply chopping up a network into smaller portions. For example, if you have a network using the IP address 192.168.1.x (where x is the address of a specific computer), then you have allocated 255 possible IP addresses. What if you want to divide that into two separate subnetworks? Subnetting is how you do that.

More technically, the subnet mask is a 32-bit number that is assigned to each host to divide the 32-bit binary IP address into network and node portions. You cannot just put in any number you want. The first value of a subnet mask must be 255; the remaining three values can be 255, 254, 252, 248, 240, or 224. Your computer will take your network IP address and the subnet mask and use a binary AND operation to combine them.

It might surprise you to know that you already have a subnet mask even if you have not been subnetting. If you have a Class C IP address, then your network subnet mask is 255.255.255.0. If you have a Class B IP address, then your subnet mask is 255.255.0.0. And finally, if it is Class A, your subnet mask is 255.0.0.0.

Now think about these numbers in relationship to binary numbers. The decimal value 255 converts to 11111111 in binary. So you are literally “masking” the portion of the network address that is used to define the network, and the remaining portion is used to define individual nodes. Now if you want fewer than 255 nodes in your subnet, then you need something like 255.255.255.240 for your subnet. If you convert 240 to binary, it is 11110000. That means the first three octets and the first 4 bits of the last octet define the network. The last 4 bits of the last octet define the node. That means you could have as many as 1111 (in binary) or 15 (in decimal) nodes on this subnetwork. This is the basic essence of subnetting.

CIDR

Subnetting only allows you to use certain, limited subnets. Another approach is CIDR, or classless interdomain routing. Rather than define a subnet mask, you have the IP address followed by a slash and a number. That number can be any number between 0 and 32, which results in IP addresses like these:

192.168.1.10/24 (basically a Class C IP address)

192.168.1.10/31 (much like a Class C IP address with a subnet mask)

When you use CIDR, rather than having classes with subnets, you have variable-length subnet masking (VLSM) that provides classless IP addresses. This is the most common way to define network IP addresses today.

IPv6

You have probably heard of IP version 6, or IPv6, as an extension of IPv4. Essentially, IP version 4 is limited to 4.2 billion IP addresses. Even with the use of private IP addresses, we will run out of available IP addresses. Think of all the computers, printers, routers, servers, smart phones, tablets, and so on connected to the Internet. IP version 6 was designed to alleviate this problem. And if you looked around in the network settings described in the last section, you probably saw the option to enable IPv6. IPv6 utilizes a 128-bit address (instead of a 32-bit address), so there is no chance of running out of IP addresses in the foreseeable future. IPv6 also utilizes a hex numbering method in order to avoid long addresses such as 132.64.34.26.64.156.143.57.1.3.7.44.122.111.201.5. An example of an IPv6 hex address is3FFE:B00:800:2::C.

IPv6 involves no subnetting, but it does use CIDR. The network portion is indicated by a slash followed by the number of bits in the address that are assigned to the network portion, such as:

/48

/64

There is a loopback address for IPv6, and it can be written as ::/128. Other differences between IPv4 and IPv6 are described here:

Images Link-/machine-local address: This is the IPv6 version of IPv4’s APIPA (Automatic Private IP Addressing) address. If a machine is configured for dynamically assigned addresses and cannot communicate with a DHCP server, it assigns itself a generic IP address. DHCP, or Dynamic Host Configuration Protocol, is used to dynamically assign IP addresses within a network. IPv6 link-/machine-local IP addresses all start with fe80::. So if your computer has this address, that means it could not get to a DHCP server and therefore made up its own generic IP address.

Images Site-/network-local address: This is the IPv6 version of the IPv4 private address. Site-/network-local addresses are real IP addresses, but they only work on the local network and are not routable on the Internet. All site-/network-local IP addresses begin with FE and have C to F for the third hexadecimal digit: FEC, FED, FEE, or FEF.

Images The managed address configuration flag (M flag): When the M flag is set to 1, the device should use DHCPv6 to obtain a stateful IPv6 address.

Images Other stateful configuration flag (O flag): When the O flag is set to 1, the device should use DHCPv6 to obtain other TCP/IP configuration settings. In other words, it should use the DHCP server to set things like the IP address of the gateway and DNS servers.

Images M flag: This indicates that the machine should use DHCPv6 to retrieve an IP address.

This is the essence of IPv6. You still have all the same utilities you used with IPv4. However, there is a number 6 after the ping or traceroute, so if your computer has IPv6 enabled, you can use the following:

ping6 www.yahoo.com

We will be discussing ping, traceroute, and other commands later in this chapter.

Uniform Resource Locators

After you connect to your ISP, you will, of course, want to visit some websites. You probably type names, rather than IP addresses, into your browser’s address bar. For example, you might type in www.chuckeasttom.com to go to my website. Your computer or your ISP must translate the name you typed in (called a uniform resource locator [URL]) into an IP address. The DNS protocol, mentioned in Table 2.4, handles this translation process. So you are typing in a name that makes sense to humans, but your computer is using a corresponding IP address to connect. If that address is found, your browser sends a packet (using HTTP) to port 80. If that target computer has software that listens and responds to such requests (for example, web server software such as Apache or Microsoft Internet Information Server), then the target computer will respond to your browser’s request, and communication will be established. This method is how web pages are viewed.

When you receive an Error 404: File Not Found, what you are seeing is that your browser received back a packet (from the web server) with error code 404, denoting that the page you requested could not be found. There are a series of error messages that the web server can send back to your web browser to indicate different situations. Many of these problems the browser handles itself, and you never see the error message. All error messages in the 400 series are client errors. This term means something is wrong on your side, not with the web server. Messages in the 500 series are server errors, which means there is a problem on the web server. The 100 series messages are simply informational; 200 series messages indicate success (you usually do not see these, the browser simply processes them); and 300 series messages are redirectional, meaning the page you are seeking has moved, and your browser is then directed to the new location.

Using email works the same way as visiting websites. Your email client will seek out the address of your email server. Then your email client will use either POP3 to retrieve your incoming email or SMTP to send your outgoing email. Your email server (probably at your ISP or your company) will then try to resolve the address you are sending to. If you send something to chuck@chuckeasttom.com, your email server will translate that email address into an IP address for the email server at yahoo.com, and your server will send your email there. Note that there are newer email protocols available, but POP3 is still the most commonly used.

Many readers are probably familiar with chat rooms. A chat room, like the other methods of communication we have discussed, works with packets. You first find the address of a chat room, and then you connect. The difference here is that your computer’s chat software is constantly sending packets back and forth, unlike email, which only sends and receives when you tell it to (or on a predetermined time interval).

Remember that a packet has a header section, and that header section contains your IP address and the destination IP address that you are going to (as well as other information). This packet structure will become important as we proceed through this book.

What Is a Packet?

We have mentioned network packets and how they are routed through a network and through the Internet. What we have not discussed is exactly what a packet is. You probably know that network traffic is really a lot of 1s and 0s that are in turn transmitted as voltages (over UTP), light wave (over optic cable), or radio frequencies (over Wi-Fi). The data is divided into small chunks called packets.

A packet is divided into three sections: the header (actually there are at least three headers, but we will get to that in just a moment), the data, and the footer. The header contains information about how to address the packet, what kind of packet it is, and related data. The data portion is obviously the information you want to send. The footer serves both to show where the packet ends and to provide error detection.

As just mentioned, there are usually at least three headers. In normal communication a packet usually has an Ethernet header, a TCP header, and an IP header. Each contains different information. Combined they have several pieces of information that will be interesting for forensic investigations.

Let’s begin with the TCP header. It contains information related to the transport layer of the OSI model. (We will be discussing the OSI model later in this chapter.) It contains the source and destination port for communications. It also has the packet number, such as packet 10 of 21.

There is also an IP header. The most obvious useful information is source and destination addresses. The IP header has the source IP address, the destination IP address, and the protocol. The IP header also has a version number, showing if this is a version 4.0 or 6.0 IP packet. The size variable describes how large the data segment is. There is also information regarding the protocol this packet represents.

The Ethernet header contains information regarding the source MAC address and destination MAC address. When a packet gets to the last network segment in its journey, it is the MAC address that is used to find the NIC that the packet is being sent to.

Basic Communications

The packet headers described in the previous section also contain some signal bits. These are single bit flags that are turned on to indicate some type of communication. A normal network conversation starts with one side sending a packet with the SYN (synchronize) bit turned on. The target responds with both SYN and ACK (acknowledge) bits turned on. Then the sender responds with just the ACK bit turned on, and communication commences. After a time, the original sender terminates the communication by sending a packet with the FIN (finish) bit turned on.

There are some attacks that depend on sending malformed packets. For example, in the common denial of service (DoS) attack, the SYN flood is based on flooding the target with SYN packets but never responding to the SYN/ACK that is sent back. Some session hijacking attacks use the RST command to help hijack communications.

History of the Internet

At this point, you should have a basic understanding of how networks and the Internet work, as well as some familiarity with IP addresses, protocols, and packets. It is also helpful to know the history of the Internet, as many find that this overview helps put all of the material learned thus far into historical perspective.

The Internet traces its roots to the Cold War. One positive thing that can be said about the Cold War is that it was a time of significant investment in science and technology. In 1957, after the Soviet Union launched the Sputnik satellite, the U.S. government formed the Advanced Research Projects Agency (ARPA) within the Defense Department. ARPA’s sole purpose was to fund and facilitate research into technology. Obviously, this aim would include weapons technology, but the total focus would also include communications technology.

In 1962, a study by the Rand Corporation proposed devising a communication method wherein data was sent in packets between locations. If a packet was lost, the originator of the message would automatically re-send the message. This idea was a precursor to the Internet communication methodologies that would eventually arise.

In 1968, ARPA commissioned the construction of ARPANET, a simple Internet web of four points (called nodes): UCLA, Stanford, UC Berkeley, and the University of Utah. Although no one knew it at the time, this small web was the birth of what would become the Internet. At this point, ARPANET had only these four nodes connected.

The year 1972 was a milestone for the development of the Internet in more than one sense. That year ARPA was renamed DARPA, the Defense Advanced Research Projects Agency. Also that year, Ray Tomlinson invented the first email program. At this point, four years after the birth of ARPANET, there were 23 hosts on the network. (A host is a machine with data on it, to which you can connect; for example, a web server is a host.)

The following year, 1973, would mark the birth of TCP/IP, the protocol that allowed the various computers to communicate in a uniform fashion, regardless of their hardware or operating system.

In 1974, Vint Cerf published a paper on TCP and, for the first time in computer history, used the term Internet. In 1976, Ethernet cable was developed (the same cabling we use today), and DARPA began to require the use of TCP/IP on its network. That year also marked the beginning of widespread distribution of the UNIX operating system. The development of UNIX and the Internet would go hand in hand for many years to come. By this time, 8 years after the birth of ARPANET, there were 111 hosts on the network.

In 1979, a major development occurred: the birth of Usenet newsgroups. These groups are essentially bulletin boards open to the entire world. (Today you can access these groups via newsgroup reader software or via the Web by navigating to www.google.com and selecting Groups. There are thousands of newsgroups devoted to every topic imaginable.) Just 2 years later, the National Science Foundation (NSF) created CSNET for universities and research centers that were not part of ARPANET. That same year, Cerf proposed connecting CSNET and ARPANET. By 1981, the University of Wisconsin had created DNS (Domain Name System) so that people could find nodes on the network via a name rather than by using the actual IP address. At that point, there were 562 hosts on the network.

The early 1980s saw enormous growth in the early Internet. DARPA divided its ARPANET into military and nonmilitary segments and allowed more people to use the nonmilitary segment. And the NSF introduced the T1 line (a very fast connection). In 1986, the Internet Engineering Task Force (IETF) was formed to oversee the creation of standards for the Internet and Internet protocols. By that time, the Internet consisted of 2308 hosts.

A pivotal year for Internet development turned out to be 1990. That year, Tim Berners-Lee, working at CERN laboratories in Europe, developed Hypertext Transfer Protocol (HTTP) and gave the world its very first web pages. Via HTTP and Hypertext Markup Language (HTML), people could publish ideas on the Internet for anyone (with a connection) to view. By 1990, there were more than 300,000 hosts on the Internet. (Fast-forward to 2004: Tim Berners-Lee receives the first Millennium Prize for contributions to technology. He is widely regarded as the father of the World Wide Web [WWW].)

Internet growth and activity exploded in the 1990s. In 1992, CERN released the invention of web pages to the world at large. In 1993, the first graphical web browser, named Mosaic, was invented. By 1994, Pizza Hut began taking orders via web pages. The Internet has continued to grow; today, there are millions of websites around the world. Every organization has a site, from university departments, government agencies, corporations, schools, and religious groups to nearly any other group you can imagine. Many individuals have personal websites as well. You likely use the Web for banking, shopping, information, and entertainment, and you likely use email on a daily basis. (By the way, I primarily use email for communication, so that is the best way to contact me if you wish: chuck@chuckeasttom.com.) The Internet has become a virtual “living level” of interaction in our society. What company does not have a website? What movie release does not have a website? What political candidate does not have a website? In just over three decades, the Internet has become an integral part of our society.

Basic Network Utilities

Later in this book, you will use information and techniques that are based, in part, on certain techniques anyone can perform on her own machine. There are network utilities that you can execute from a command prompt (Windows) or from a shell (UNIX/Linux). Many readers are already familiar with Windows, so the text’s discussion will execute the commands and discuss them from the Windows command prompt perspective. However, it must be stressed that these utilities are available in all operating systems. In this section, you will read about IPConfig, ping, and tracert utilities.

IPConfig

The first step in studying networks is to get information about your own system. To accomplish this fact-finding mission, you will need to get to a command prompt. In Windows XP, go to the Start menu, select All Programs (in Windows Vista or 7), and then choose Accessories. You will then see an option called Command Prompt. In Windows 10 just type cmd in the search bar. (For Windows 2000 users, the process is identical, except the first option is simply called Programs rather than All Programs.) Next, type in ipconfig. (You could use the same command in UNIX or Linux by typing it once you’re inside the shell.) After typing ipconfig and pressing the Enter key, you should see something much like what is shown in Figure 2.1.

Figure 2.1 IPConfig.

This command gives you some information about your connection to a network (or to the Internet). Most importantly, you find out your own IP address. The command also has the IP address for your default gateway, which is your connection to the outside world. Running the IPConfig command is a first step in determining your system’s network configuration. Most commands that this book will mention, including IPConfig, have a number of parameters, or flags, that can be passed to the commands to make the computer behave in a certain way. You can find out what these commands are by typing in the command, followed by a space, and then typing in a hyphen and a question mark: -?. Figure 2.2 shows the results of using this method for the IPConfig command.

Figure 2.2 IPConfig help.

As you can see in Figure 2.2, there are a number of options you might use to find out different details about your computer’s configuration. The most commonly used method would probably be IPConfig /all, shown in Figure 2.3. You can see that this option gives you much more information. For example, IPConfig /all gives the name of your computer, when your computer obtained its IP address, and more.

Figure 2.3 IPConfig /all.

Ping

Another commonly used command is ping. ping is used to send a test packet, or echo packet, to a machine to find out if the machine is reachable and how long the packet takes to reach the machine. This useful diagnostic tool can be employed in elementary hacking techniques. In Figure 2.4 you see a ping command executed on www.yahoo.com.

Figure 2.4 Ping.

This figure tells you that a 32-byte echo packet was sent to the destination and returned. The TTL (Time to Live) item shows how many intermediary steps, or hops, the packet should take to the destination before giving up. Remember that the Internet is a vast conglomerate of interconnected networks. Your packet probably won’t go straight to its destination; it will take several hops to get there. As with IPConfig, you can type in ping -? to find out various ways you can refine your ping.

Tracert

The tracert command is basically a deluxe version of ping. tracert not only tells you if a packet got to its destination and how long it took but also tells you all the intermediate hops it took to get there. This utility will prove very useful to you later in this book. Figure 2.5 illustrates a tracert to www.yahoo.com. (This same command can be executed in Linux or UNIX, but there it is called traceroute rather than tracert.)

Figure 2.5 Tracert.

With tracert, you can see (in milliseconds) the IP addresses of the intermediate steps listed and how long it took to get to each step. Knowing the steps required to reach a destination can be very important, as you will see later in this book.

Certainly there are other utilities that can be of use to you when working with network communications. However, the three we just examined—IPConfig, ping, and tracert—are the core utilities. These three utilities are absolutely essential to any network administrator, and you should commit them to memory.

Netstat

Netstat is another interesting command. Essentially this command, which is an abbreviation for network status, tells you what connections your computer currently has. Don’t panic if you see several connections; that does not mean a hacker is in your computer. You will see many private IP addresses. This means your network has internal communication going on. You can see this in Figure 2.6.

Figure 2.6 Netstat.

NSLookup

nslookup, which is an abbreviation for name server lookup, is used to connect with your network’s DNS server. Often it can be used just to verify whether the DNS server is running. It can also be used to execute commands. Recall from Chapter 1, “Introduction to Computer Security,” the discussion of DNS poisoning. One of the first steps in DNS poisoning is to see if the target DNS server will perform a zone transfer. (It should not do so with any machine other than another DNS server that is authenticated in the domain.) That can be attempted with nslookup, as shown here:

Click here to view code image

run: nslookup
type: ls -d domain_name <enter>

You can see the basic nslookup command in Figure 2.7.

Figure 2.7 nslookup.

ARP

Address Resolution Protocol (ARP) is used to map IP addresses to MAC addresses. The arp command shows existing IP-to-MAC address mappings that your computer is currently aware of. Figure 2.8 demonstrates the use of the arp -a command.

Figure 2.8 arp -a.

As with other commands, there are a variety of flags for ARP. Here are some of them:

Images -a displays the current ARP cache table.

Images /g does the same as /a.

Images /d deletes a specific entry from the ARP cache table.

Images /s adds a static entry to the ARP cache table.

Route

The route command is used to view the IP routing table. Figure 2.9 shows sample output from the route -print 4 command.

Figure 2.9 route print -4.

Like most other commands, route has flags you can use. Some of the most common flags are summarized here:

Images print prints a specific route; for example, print -4 displays the IPv4 routing table.

Images add adds a route.

Images delete deletes a route.

Images change changes a route.

Images destination sends a command to a specific computer.

PathPing

PathPing provides information similar to tracert/traceroute and ping. It provides detailed information regarding network latency at hops between source and destination. The basic syntax is:

pathping [-n]
       [-h MaximumHops]
       [-g HostList]
       [-p Period]
       [-q NumQueries]
       [-w Timeout]
       [-T]
       [-R]
       [TargetName]

Figure 2.10 shows an example.

Figure 2.10 PathPing.

Other Network Devices

There are other devices involved in networking that work to protect your computer from the outside world, some of which were briefly mentioned in Chapter 1. Now we will review a couple of them in a bit more detail. The two most common are the firewall and the proxy server.

A firewall is essentially a barrier between your network and the rest of the Internet. A personal computer (PC) can be used as a firewall; in many cases, a special router can function as a firewall. Firewalls use a variety of techniques to protect your network, but the most common strategy is packet filtering. In a packet-filtering firewall, each incoming packet is examined. Only those packets that match the criteria you set are allowed through. (Commonly, only packets using certain types of protocols are allowed through.) Many operating systems, such as Windows (all versions since XP) and many Linux distributions, include basic packet-filtering software.

The second very common type of defensive device is a proxy server. A proxy server is almost always a separate computer. You might see the same machine used as both a proxy server and a firewall. A proxy server’s purpose is quite simple: It hides your entire network from the outside world. People trying to investigate your network from the outside will see only the proxy server. They will not see the actual machines on your network. When packets go out of your network, their headers are changed so that the packets have the return address of the proxy server. Conversely, the only way you can access the outside world is via the proxy server. A proxy server and a firewall provide basic network security. It would frankly be negligent to ever run a network that did not have a firewall and proxy server. We examine firewalls in more detail in Chapter 9, “Computer Security Technology.”

Advanced Network Communications Topics

The subjects discussed in this section are not absolutely required for you to understand this book, but they will give you a broader understanding of networks in general. If you have any intention of delving into network security on a professional level, then you will need this information—and much more.

The OSI Model

Let’s begin with the OSI model, or Open Systems Interconnection model, which describes how networks communicate. It outlines the various protocols and activities, and it tells how the protocols and activities relate to each other. This model is divided into seven layers, as shown in Table 2.6, and was originally developed by the International Organization for Standardization (abbreviated ISO) in the 1980s.

Table 2.6 The OSI Model

Layer Number

Layer Name

Description

Protocols

7

Application

This layer interfaces directly with applications and performs common application services for the application processes.

POP, SMTP, DNS, FTP, and so on

6

Presentation

The presentation layer relieves the application layer of concern regarding syntactical differences in data representation within the end-user systems.

5

Session

The session layer provides the mechanism for managing dialogue between end-user application processes.

NetBIOS

4

Transport

This layer provides end-to-end communication control.

TCP, UDP

3

Network

This layer routes information in the network.

IP, Internet Control Message Protocol

2

Data link

This layer describes the logical organization of data bits transmitted on a particular medium. The data link layer is divided into two sublayers: the Media Access Control (MAC) layer and the Logical Link Control (LLC) layer.

Address Resolution Protocol, Serial Line Internet Protocol, Point-to-Point Protocol

1

Physical

This layer describes the physical properties of the various communications media as well as the electrical properties and interpretation of the exchanged signals. In other words, the physical layer is the actual NIC, Ethernet cable, and so forth. This layer is where bits are translated into voltages and vice versa.

None

Many networking students memorize this model. It’s good to at least memorize the names of the seven layers and to understand basically what each one does. From a security perspective, the more you understand about network communications, the more sophisticated your defense can be. The most important thing for you to understand is that the OSI model describes a hierarchy of communication. One layer will only communicate with the layer directly above it or below it.

The TCP/IP Model

While the OSI model is commonly used, the TCP/IP model has been used as well, particularly by Cisco. Should you ever pursue Cisco certification, you will need to know the TCP/IP model. The TCP/IP model has four layers. It does the same activities that the OSI model does but compressed into fewer layers. Table 2.7 shows the TCP model.

Table 2.7 The TCP Model

Layer

Purpose

Application

This layer combines the responsibilities of the application and presentation layers of the OSI model.

Transport

This layer is roughly equivalent to the transport and session layers of the OSI model. This layer is responsible for message delivery and error detection.

Internet

This layer is responsible for traffic going from source to destination. It is roughly equivalent to the network layer of the OSI model.

Network Access

This is roughly equivalent to the physical and data link layers of the OSI model. This layer is responsible for transmission of the actual signals.

Media Access Control (MAC) Addresses

A MAC address is a unique address for a NIC. (MAC is also a sublayer of the data link layer of the OSI model.) Every NIC in the world has a unique address that is represented by a 6-byte hexadecimal number, and ARP is used to convert IP addresses to MAC addresses. When you type in a web address, DNS is used to translate that into an IP address; then ARP translates that IP address into a specific MAC address of an individual NIC.

Similar to the 48-bit MAC address is the EUI-64, which is a 64-bit address that identifies a physical network card. EUI, which stands for Enhanced Unique Identifier, was standardized in RFC 2373. EUI-64 is used in IPv6 addressing.

Cloud Computing

The National Institute of Standards and Technology (NIST) defines cloud computing as “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”¹

1. https://www.govinfo.gov/app/details/GOVPUB-C13-74cdc274b1109a7e1ead7185dfec2ada

There are three primary classifications of clouds:

Images Public clouds are defined by NIST as clouds that offer their infrastructure or services to the general public or a large industry group.

Images Private clouds are clouds used specifically by a single organization without offering the services to an outside party. There are also hybrid clouds, which combine the elements of private and public clouds. Hybrid clouds are essentially private clouds that have some limited public access.

Images Community clouds are midway between private and public clouds. They are systems wherein several organizations share a cloud for specific community needs. For example, several computer companies might join to create a cloud devoted to common security issues.

Customers sometimes use more than one cloud provider, for various purposes. With multicloud, multiple different cloud vendors are used heterogeneously, mitigating dependency on a single vendor. Cloud assets (applications, virtual servers, and so on) are hosted across multiple different public clouds. It is also possible to include private clouds in the architecture. Polycloud is similar, but in this case the different public clouds are used not for flexibility and redundancy but rather for the specific services each provider offers.

Cloud computing is quickly becoming ubiquitous, and it is possible to use cloud resources for a variety of purposes. A few common purposes are listed here:

Images Software as a service (SaaS)

Images Platform as a service (PaaS)

Images Infrastructure as a service (IaaS)

Images Desktop as a service (DaaS)

Images Information technology management as a service (ITMaaS)

Images Mobile backend as a service (MBaaS)

Images Security as a service (SECaaS or SaaS)

Cloud computing is expanding. One recent expansion has been the use of fog computing. Fog computing, sometimes called fogging or fog networking, is an architecture that uses edge devices for processing. There are two aspects to fog computing: the control plane and the data plane. Fog networking is often used in IoT.

In March 2018 NIST released NIST Special Publication 500-325, Fog Computing Conceptual Model, that defines fog computing as a horizontal, physical, or virtual resource paradigm that resides between smart end devices and traditional cloud computing or the data center.

There are many security standards to guide you in securing cloud resources. The most obvious is ISO 27017, which provides guidance for cloud security. It applies the guidance of ISO 27002 to the cloud and adds seven new controls:

Images CLD.6.3.1: This control discusses agreement on shared or divided security responsibilities between the customer and cloud provider.

Images CLD.8.1.5: This control addresses how assets are returned or removed from the cloud when a contract is terminated.

Images CLD.9.5.1: This control states that the cloud provider must separate the customer’s virtual environment from other customers or outside parties.

Images CLD.9.5.2: This control states that the customer and the cloud provider both must ensure that virtual machines are hardened.

Images CLD.12.1.5: This control states that it is solely the customer’s responsibility to define and manage administrative operations.

Images CLD.12.4.5: This control states that cloud providers’ capabilities must enable the customer to monitor their own cloud environment.

Images CLD.13.1.4: This control states that the virtual network environment must be configured so that it meets the security policies of the physical environment.

ISO 27018, which is closely related to ISO 27017, defines privacy requirements in a cloud environment. It focuses on how the customer and cloud provider must protect personally identifiable information (PII).

The Federal Risk and Authorization Management Program (FedRAMP) is a U.S. government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. Third-party assessment organizations (3PAOs) play a critical role in the FedRAMP security assessment process, as they are the independent assessment organizations that verify cloud providers’ security implementations and provide the overall risk posture of a cloud environment for a security authorization decision.

Another standard to consider is NIST SP 800-144, “Guidelines on Security and Privacy in Public Cloud Computing,” which covers authentication, service level agreements (SLAs), and other security measures for cloud computing.

Even the U.S. National Security Agency offers guidance on cloud security:²

2. https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF

Images While not a base component of cloud architectures, encryption and key management (KM) form a critical aspect of protecting information in the cloud.

Images While cloud service providers (CSPs) are generally responsible for detecting threats to the underlying cloud platform, customers bear the responsibility of detecting threats to their own cloud resources.

Images With incident response, CSPs are uniquely positioned to respond to incidents internal to the cloud infrastructure and bear responsibility for doing so. Incidents internal to customer cloud environments are generally the customer’s responsibility, but CSPs may provide support to incident-response teams.

Images With patching/updating, CSPs are responsible for ensuring that their cloud offerings are secure and rapidly patch software within their purview but usually do not patch software managed by the customer (for example, operating systems in IaaS offerings). Because of this, customers should vigilantly deploy patches to mitigate software vulnerabilities in the cloud. In some cases CSPs offer managed solutions in which they perform operating system patching as well.

Summary

This chapter cannot make you a networking expert. However, you should now have a basic understanding of how networks and the Internet work. Before you move on to subsequent chapters, you should make certain you completely understand basic hardware such as switches, NICs, routers, and hubs. You should also be familiar with the basic protocols presented in this chapter. It is important that you be comfortable with the utilities presented. It is strongly suggested that you experiment with these utilities extensively. It is also important that you be comfortable with the basics of the OSI model. Many students struggle with it at first, but at least make sure you have a general understanding of it before you move on to Chapter 3, “Cyber Stalking, Fraud, and Abuse.”

The material in this chapter will be critical in later chapters. If you are new to this material, you should thoroughly study this chapter before continuing. In the exercises at the end of this chapter, you will be able to practice using IPConfig, tracert, and ping.

Test Your Skills

Multiple Choice Questions

1. Malek is purchasing cable to use in setting up small office networks. He wants to stock up on commonly used cable. What type of cable do most networks use?

A. Net cable

B. STP

C. Phone cable

D. UTP

2. You are assigned to attach connectors to segments of cable. What type of connector is used with network cables?

A. RJ-11

B. RJ-85

C. RJ-12

D. RJ-45

3. What type of cable is used in most networks?

A. Unshielded twisted-pair

B. Shielded twisted-pair

C. Unshielded untwisted-pair

D. Shielded untwisted-pair

4. John is trying to simply connect three computers in a small network. He does not need any sort of routing capability and is not concerned about network traffic. What is the simplest device for connecting computers?

A. NIC

B. Interface

C. Hub

D. Router

5. Sharice is trying to teach a new technician basic networking terms. What should she tell this new technician NIC stands for?

A. Network interface card

B. Network interaction card

C. Network interface connector

D. Network interaction connector

6. Which of the following is a device used to connect two or more networks?

A. Switch

B. Router

C. Hub

D. NIC

7. Juan has just installed a new T1 line in a medical office. The front desk receptionist has asked what speed they can expect. A T1 line sends data at what speed?

A. 100Mbps

B. 1.54Mbps

C. 155Mbps

D. 56.6Kbps

8. Which of the following best describes polycloud?

A. Using a private and public cloud

B. Using cloud and local resources

C. Using more than one cloud provider for resilience and redundancy

D. Using more than one cloud provider for the services offered

9. What protocol translates web addresses into IP addresses?

A. DNS

B. TFTP

C. DHCP

D. SMTP

10. What protocol is used to send email, and on what port does it work?

A. SMTP, port 110

B. POP3, port 25

C. SMTP, port 25

D. POP3, port 110

11. Gunther is setting up encrypted remote communications so that the server administrators can remotely access servers. What protocol is used for remotely logging on to a computer in a secure manner?

A. SSH

B. HTTP

C. Telnet

D. SMTP

12. Mohammed needs to open a firewall port so that web traffic can be passed through the firewall. What protocol is used for web pages, and on which port does it work?

A. HTTP, port 21

B. HTTP, port 80

C. DHCP, port 80

D. DHCP, port 21

13. What is the name for the point where the backbones of the Internet connect?

A. Connectors

B. Routers

C. Network access points

D. Switches

14. You are examining a list of IP addresses. Some are internal, some are external, and some are not valid. Which of the following is not a valid IP address?

A. 127.0.0.1

B. 295.253.254.01

C. 131.156.5.2

D. 245.200.11.1

15. What class of address is the IP address 193.44.34.12?

A. A

B. B

C. C

D. D

16. The IP address 127.0.0.1 always refers to your what?

A. Nearest router

B. ISP

C. Self

D. Nearest NAP

17. Internet addresses of the form www.chuckeasttom.com are called what?

A. User-friendly web addresses

B. Uniform resource locators

C. User-accessible web addresses

D. Uniform address identifiers

18. Which U.S. government agency created the distributed network that formed the basis for the Internet?

A. Advanced Research Projects Agency

B. Central Intelligence Agency

C. NASA

D. Department of Energy

19. Which of the following was one of the three universities involved in the original distributed network set up by a government agency?

A. UC Berkeley

B. Harvard

C. MIT

D. Princeton

20. You are explaining the history of networking to a group of first-year students. What did Vint Cerf invent?

A. The World Wide Web

B. Email

C. TCP

D. The first computer virus

21. You are explaining the history of networking to a group of first-year students. What did Tim Berners-Lee invent?

A. The World Wide Web

B. Email

C. TCP

D. The first computer virus

22. John is working with command-line utilities to gather diagnostic information about a computer that cannot connect to the network. Which utility provides information about a machine’s network configuration?

A. Ping

B. IPConfig

C. Tracert

D. MyConfig

23. Sheryl is explaining the OSI model to new technicians at her company. She is trying to explain what protocols operate at the various layers of the OSI model. At what layer of the OSI model does TCP operate?

A. Transport

B. Application

C. Network

D. Data link

24. Which layer of the OSI model is divided into two sublayers?

A. Data link

B. Network

C. Presentation

D. Session

25. Which of the following is a unique hexadecimal number that identifies your network card?

A. NIC address

B. MAC address

C. NIC ID

D. MAC ID

Exercises

EXERCISE 2.1: Using IPConfig

Open your command prompt or type cmd in the search bar in Windows 10 or 11.

Type in ipconfig.

Use the output of the IPConfig command to find out information about your computer.

Write down your computer’s IP address, default gateway, and subnet mask.

EXERCISE 2.2: Using Tracert

Open your command prompt or type cmd in the search bar in Windows 10.

Type in tracert www.chuckeasttom.com.

Note what hops your computer takes to get to www.chuckeasttom.com.

Repeat steps 2 and 3 with www.whitehouse.gov and http://home.pearsonhighered.com/.

Notice that the first few hops are the same. Write down what hops are taken to reach each destination and what hops are the same. Then briefly describe why you think some of the intermediate steps are the same for different destinations.

EXERCISE 2.3: NSLOOKUP

Go to the command prompt or type cmd in the search bar in Windows 10.

Type nslookup www.chuckeasttom.com.

Note that this command gives you the actual name of the server, as per the hosting company’s naming conventions; its IP address; and any aliases under which that server operates.

EXERCISE 2.4: More About IPConfig

Open your command prompt or type cmd in the search bar in Windows 10.

Use the -? flag with the IPConfig command to find out what other options you have with IPConfig. You should notice a number of options, including /all, /renew, and others.

Now try ipconfig /all. What do you see now that you didn’t see when you simply used ipconfig in Exercise 2.1?

EXERCISE 2.5: More About Ping

Open your command prompt or type cmd in the search bar in Windows 10.

Use the -? flag on the ping command and find out what other options you have with ping. You should notice several additional options, such as -w, -t, -n, and -i.

Try ping www.chuckeasttom.com.

Try the option ping -n 2 www.chuckeasttom.com. Then try ping -n 7 www.chuckeasttom.com. What differences do you notice?

Projects

PROJECT 2.1: Learning About DNS

Using web resources, look up the DNS protocol. You may find the following website to be of help: www.freesoft.org/CIE/Topics/75.htm.

Look up these facts: Who invented the DNS protocol? What is its purpose? How is it used?

Write a brief paper describing what the protocol does. Mention a bit about who invented it, when, and how it works.

PROJECT 2.2: Learning About Your System

Find out if your school or business uses switches, hubs, or both. Why does your group use these? You can find out by simply asking the network administrator or the help desk. Make sure you tell them that you are seeking this information for a class project.

Write a brief paper explaining your findings and any changes you would make if you could. For example, if your organization uses only hubs, would you change that method? If so, why?

PROJECT 2.3: Learning About NetStat

At the command prompt, type netstat. Notice the information it provides you. You should see the IP addresses or names of servers that are currently connected to your computer. If you are using a home computer, you will need to log on to your Internet service provider to see anything.

Caution

Stopping NetStat

Note that with many versions of Windows, for the next steps you need to use the Ctrl+Break key combination to stop netstat before starting it again with a new option.

Now type in netstat -? to see what options are available for this command. You should see -a, -e, and others.

Now type in netstat -a and note the information you see.

Finally, try netstat -e. What do you see now?

Chapter 3

Cyber Stalking, Fraud, and Abuse

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Know the various types of Internet investment scams and auction frauds

Images Know specific steps to take to avoid fraud on the Internet

Images Have an understanding of what identity theft is and how it is done

Images Know specific steps that can be taken to avoid identity theft

Images Understand what cyber stalking is and be familiar with relevant laws

Images Know how to configure a web browser’s privacy settings

Images Know what laws apply to these computer crimes

Introduction

Fraud on the Internet is a growing problem. Each year there seems to be more fraud than the previous year. Besides hacking and virus creation, both mentioned in Chapter 1, “Introduction to Computer Security,” there are other dangers. Fraud is one of the most common dangers of the Internet. As more people utilize the Internet as a conduit for commerce, there arise greater opportunities for fraud. Fraud has been a part of life for as long as civilization has existed; in past centuries “snake oil” salesmen roamed from place to place, selling fake cures and elixirs. The Internet makes such fraud even easier. In fact, many experts would consider fraud to be the most prevalent danger on the Internet. There are multiple reasons for the popularity of Internet fraud among con artists. First, committing Internet fraud does not require the technical expertise that hacking and virus creation require. Second, there are a great number of people engaging in various forms of online commerce, and this large amount of business creates a great many opportunities for fraud.

There are many avenues for fraud on the Internet. In this chapter, we will explore the various major types of fraud, what the law says, and what you can do to protect yourself. Fortunately for some readers, this particular chapter is not particularly technical because most Internet fraud does not rely on in-depth technological expertise. Internet fraud merely uses the computer as a venue for many of the same fraud schemes that have been perpetrated throughout history.

Cyber stalking is also a significant issue. Cyber stalking can range from online harassment to in-person harassment to violent crimes including murder. Cyber stalking is a serious crime and needs to be taken seriously.

How Internet Fraud Works

There are a variety of ways that fraud can be perpetrated via the Internet. The U.S. Securities and Exchange Commission (SEC) lists several types of Internet fraud on its website;¹ we will briefly discuss each of them and others, but it is not possible for us to cover every variation of each fraud scheme that has been used on the Internet. Such an undertaking would fill an entire book and possibly several volumes. What we can do is to cover the most common scams and try to extrapolate some general principles that you can apply to any potential fraud. If you use these specific cases to extrapolate some general principles, then you should be prepared to avoid most fraud schemes.

1. https://www.sec.gov/reportspubs/investor-publications/investorpubscyberfraudhtm.xhtml

Often when there is some disaster in the news, there are also charitable organizations seeking funds to alleviate the plight of the disaster survivors. At the same time, criminals take advantage of the disaster to perpetrate fraud. During the height of the COVID-19 epidemic, for example, there were multiple fraud schemes related to COVID-19. Many government organizations worked to combat this fraud. In one exemplary incident, Alexander Leszczynski of Florida is alleged to have used fictitious charitable entities to engage in fraud such as applying for Paycheck Protection Program (PPP) loans.² As another example of fraud related to the pandemic, the state of North Carolina reported that identity theft cases rose 168% during the pandemic.³

2. https://www.justice.gov/usao-mdfl/pr/us-attorney-announces-results-multi-faceted-strategy-combat-fraud-related-covid-19-0

3. https://abc11.com/identity-theft-id-report-pandemic/12044238/

Investment Offers

Investment offers are nothing new. Even some legitimate stockbrokers make their living by cold calling—that is, simply calling people (perhaps from the phone book) and trying to get them to invest in specific stocks. This practice is employed by some legitimate firms, but it is also a favorite con game for perpetrators of fraud. The Internet has allowed investment offers—both genuine and fraudulent—to be more easily disseminated to the general public. Most readers are probably familiar with investment offers flooding their inbox on a regular basis. Some of these email notifications try to entice you to become directly involved with a particular investment plan; other emails offer seemingly unbiased information from investors, free of charge. (Unfortunately, much of this advice is not as unbiased as it might appear to be.) While legitimate online newsletters can help investors gather valuable information, keep in mind that some online newsletters are fraudulent.

Common Schemes

One of the more common schemes involves sending out an email that suggests that you can make an outrageous sum of money with a very minimal investment. Perhaps the most famous of these schemes has been the Nigerian fraud. In this scenario, an email is sent to a number of random email addresses. Each one contains a message purporting to be from a relative of some deceased Nigerian doctor or government official. The deceased person will be someone you would associate with significant social standing, thus increasing the likelihood that you would view the offer more favorably. The offer goes like this: A person has a sum of money he wishes to transfer out of his country, and for security reasons, he cannot use normal channels. He wishes to use your bank account to “park” the funds temporarily. If you allow him access to your account, you will receive a hefty fee. If you do agree to this arrangement, you will receive, via normal mail, a variety of very official-looking documents, enough to convince most casual observers that the arrangement is legitimate. You will then be asked to advance some money to cover items such as taxes and wire fees. If you actually send any money, you lose it, and you will never hear from these individuals again.⁴

4. https://www.aarp.org/money/scams-fraud/info-2019/nigerian.xhtml

Now consider this investment scam, and variations of it, from a logical point of view. If you had large sums of money you needed to transfer, would you send it to a person in a foreign country whom you had never met? Wouldn’t you be worried that the recipient would cash out her account and take the next plane to Rio? If a person needs to transfer money internationally, why doesn’t he just transfer the money to an account in The Bahamas? Or cash out the account and send it via FedEx or UPS to a storage facility in the United States? The point is that there are many ways a person could get money out of a country without trusting some stranger he has never seen before. That fact alone should indicate to you that this offer is simply not legitimate. This concept is the first general principle you should derive concerning fraud. In any offer, consider the point of view of the person offering it. Does it sound as if he is taking an inordinately large risk? Does the deal seem oddly biased in your favor? Put yourself in his position. Would you engage in the deal if you were in his position? If not, then this factor is a sign that the deal might not be what it seems.

Investment Advice

Blatant fraud schemes like the Nigerian scheme just discussed are not the only investment pitfall on the Internet. Some companies pay the people who write online newsletters to recommend their stocks. While this activity isn’t actually illegal, U.S. federal securities laws do require newsletters to disclose that the authors were paid to proffer this advice. Such laws are in place because when the writers are recommending any product, their opinion might be swayed by the fact that compensation is being provided to them for that opinion. Many online investment newsletters do not provide this disclosure, which means that the “unbiased” stock advice you are getting could actually be quite biased. Rather than getting the advice of an unbiased expert, you may be getting a paid advertisement. This pitfall is one of the most common traps of online investment advice; it is more common than the blatant frauds.

Sometimes these online stock bulletins can be part of a wider scheme, often called a pump and dump. A classic pump and dump is rather simple. The con artist purchases large amounts of a stock that is virtually worthless. The con artist then artificially inflates the value in several ways. One common method is to begin circulating rumors on various Internet bulletin boards and chat rooms that the stock is about to go up significantly. Often it is suggested by the trickster that the company has some new innovative product due to come out in the next few weeks. Another method is to simply push the stock on as many people as possible. The more people vying to buy a stock, the higher its price will rise. If both methods are combined, it is possible to temporarily double or triple the value of the worthless stock. The perpetrator of the fraud, who purchased volumes of the stock at a very low price before executing this scheme, dumps the stock when its price goes as high as she thinks it can. In a short time, and certainly by the time the company’s next quarterly earnings report is released, the stock returns to its real value. This sort of scheme has been very popular in the past several decades; thus, you should always be wary of such “insider” information. If a person is aware that Company X is about to release an innovative new product that will drive up her stock value, why would she share that information with total strangers?

The SEC lists several tips for avoiding pump and dump scams:⁵

5. www.sec.gov/investor/pubs/pump.htm

Images Consider the source. Especially if you are not well versed in the market, make sure you accept advice only from well-known and reputable stock analysts.

Images Independently verify claims. Do not simply accept someone else’s word about anything.

Images Research. Read up on the company, the claims about the company, its stock history, and so forth.

Images Beware of high-pressure tactics. Legitimate stock traders do not pressure customers into buying. They help customers pick stocks that customers want. If you are being pressured, that is an indication of potential problems.

Images Be skeptical. A healthy dose of skepticism can save you a lot of money. As the saying goes, “If it sounds too good to be true, it probably is.”

Images Research the opportunity. Make sure you thoroughly research any investment opportunity.

These types of fraud depend on the greed of the victim. It is not my intent to blame victims of fraud, but it is important to realize that if you allow avarice to do your thinking for you, you are a prime candidate to be a victim of fraud. Your 401(k) or IRA may not earn you exorbitant wealth overnight, but it is steady and relatively safe. (No investment is completely safe.) If you are seeking ways to make large sums of money with minimal time and effort, then you are an ideal target for perpetrators of fraud.

In Practice

Practically speaking, the recommended way to handle online investments is to participate in them only if you initiated the discussion with a reputable broker. This would mean you would never respond to or participate in any investment offer that was sent to you via email, online ads, and so on. You would only participate in investments that you initiated with well-known brokers. Usually such brokers are traditional investment firms with long-standing reputations that now simply offer their services online. It is also important to check out any broker with the SEC.

Auction Fraud

Online auction sites, such as eBay, can be a wonderful way to find merchandise at very good prices. I routinely use such auctions to purchase goods. However, any auction site can be fraught with peril. Will you actually get the merchandise you ordered? Will it be “as advertised”? Most online auctions are legitimate, and most auction websites take precautions to limit fraud related to users’ transactions. But problems still occur. In fact, the U.S. Federal Trade Commission (FTC) lists the following four categories of online auction fraud:⁶

6. https://www.onguardonline.gov/articles/0020-shopping-online

Images Failure to send the merchandise

Images Sending something of lesser value than advertised

Images Failure to deliver in a timely manner

Images Failure to disclose all relevant information about a product or terms of the sale

The first category, failure to deliver the merchandise, is the most clear-cut case of fraud and is fairly simple. Once you have paid for an item, no item arrives. The seller simply keeps your money. In organized fraud, the seller will simultaneously advertise several items for sale, collect money on all the auctions, and then disappear. Typically, the entire process is done with a fake identification, using a rented mailbox and an anonymous email service. The person then walks away with the proceeds of the scam.

The second category of fraud, delivering an item of lesser value than the one advertised, can become a gray area. In some cases, it is outright fraud. The seller advertises something about the product that simply is not true. For example, the seller might advertise a signed copy of the first printing of a famous author’s book but then instead ship you a fourth printing with either no autograph or one that is unverified. However, in other cases of this type of problem, it can simply be that the seller is overzealous or frankly mistaken. The seller might claim his baseball was signed by a famous athlete but not be aware himself that the autograph is a fraud.

The second category is closely related to the fourth item on the FTC list: failure to disclose all relevant facts about the item. For example, a book might be an authentic first printing and autographed but be in such poor physical condition as to render it worthless. This fact may or may not be mentioned in advance by the seller. Failure to be forthcoming with all the relevant facts about a particular item might be the result of outright fraud or simply of the seller’s ignorance. The FTC also lists failure to deliver a product on time as a form of fraud. It is unclear whether or not that is fraud in many cases or merely woefully inadequate customer service.

The FTC lists three other areas of bidding fraud that are growing in popularity on the Internet:⁷

7. https://www.onguardonline.gov/articles/0020-shopping-online

Images Shill bidding: This occurs when fraudulent sellers (or their “shills”) bid on the seller’s items to drive up the price.

Images Bid shielding: This occurs when fraudulent buyers submit very high bids to discourage other bidders from competing for the same item. The fake buyers then retract their bids so that people they know can get the item at a lower price.

Images Bid siphoning: This occurs when con artists lure bidders from legitimate auction sites by offering to sell the “same” item at a lower price. Their intent is to trick consumers into sending money without proffering the item. By going offsite, buyers lose any protections the original site may provide, such as insurance, feedback forms, or guarantees.

Shill Bidding

Shill bidding is probably the most common of these three auction frauds. It is not very complex. If the perpetrator is selling an item at an auction site, she will also create several fake identities. She will use these fake identities to bid on the item and thus drive up the price. It is very difficult to detect if such a scheme is in operation. However, a simple rule of thumb on auctions is to decide, before you start bidding, what your maximum price is. And then, under no circumstances do you exceed that price by even one penny.

Bid Shielding

While shill bidding may be difficult to combat, bid shielding can be addressed fairly easily by the proprietors of the auction site. Many of the major auction sites, such as eBay, have taken steps to prevent bid shielding. The most obvious is to revoke bidding privileges for bidders who back out after they have won an auction. So if a person puts in a very high bid to keep others away and then at the last moment retracts his bid, he might lose his ability to remain a user on that auction site.

Bid Siphoning

Bid siphoning is a less common practice than the other forms of auction fraud. In this scheme, the perpetrator places a legitimate item up for bid on an auction site. But then, in the ad for that item, she provides links to sites that are not part of the auction site. The unwary buyer who follows those links might find himself on an alternative site that is a “setup” to perpetrate some sort of fraud.

All of these tactics have a common aim: to subvert the normal auction process. The normal auction process is an ideal blend of capitalism and democracy. Everyone has an equal chance to obtain the product in question if she is willing to outbid the other shoppers. The buyers themselves set the price of the product, based on the value they perceive the product to have. In my opinion, auctions are an excellent vehicle for commerce. However, unscrupulous individuals will always attempt to subvert a process for their own goals.

Identity Theft

Identity theft is a growing problem and a very troubling one. The concept is rather simple, though the process can be complex, and the consequences for the victim can be quite severe. The idea is simply for one person to take on the identity of another. This is usually attempted to make purchases; but identity theft can be done for other reasons, such as to obtain credit cards or even a driver’s license in the victim’s name. If the perpetrator obtains a credit card in someone else’s name, then he can purchase products, and the victim of this fraud is left with debts she was not aware of and did not authorize.

In the case of getting a driver’s license in the victim’s name, this fraud might be attempted to shield the perpetrator from the consequences of her own poor driving record. For example, a person might get your driving information to create a license with her own picture. Perhaps the criminal in this case has a very bad driving record and even warrants out for immediate arrest. Should the person be stopped by law enforcement officers, she can show the fake license. When the police officer checks the license, it is legitimate and has no outstanding warrants. However, the ticket the criminal receives will be going on your driving record because it is your information on the driver’s license. It is also unlikely that the perpetrator of that fraud will actually pay the ticket, so at some point you—whose identity was stolen—will receive notification that your license has been revoked for failure to pay a ticket. Unless you can then prove, with witnesses, that you were not at the location the ticket was given at the time it was given, you may have no recourse but to pay the ticket in order to reestablish your driving privileges.

The U.S. Department of Justice defines identity theft in this manner:⁸

8. https://www.justice.gov/criminal-fraud/identity-theft/identity-theft-and-identity-fraud

Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person’s personal data in some way that involves fraud or deception, typically for economic gain.

The Internet has made the process of stealing a person’s identity even easier than it used to be. Many states now have court records and motor vehicle records online. In some states, a person’s Social Security number is used as the driver’s license number. So if a criminal gets a person’s Social Security number, he can look up that person’s driving record, perhaps get a duplicate of the person’s license, find out about any court records concerning that person, and, on some websites, even run the person’s credit history. Later in this book, we will examine using the Internet as an investigative tool. Like any other tool, it can be used for benign or malevolent purposes. The same tools you can use to do a background check on a prospective employee can be used to find out enough information to forge someone else’s identity.

An exemplary case from 2022 involves a man from New York City who is accused of trying to steal thousands of dollars from someone else’s bank account.⁹ The individual, James Chandler, is alleged to have used a fake driver’s license and gone to the bank attempting to withdraw funds. Identity theft is also perpetrated by organized groups. In 2022 there were reports of a group known as “the Felony Lane Gang,” which would steal debit cards, checks, driver’s licenses, or similar material from gym lockers or parked cars and then use those items at banks to take funds.¹⁰

9. https://wnyt.com/top-stories/north-greenbush-police-say-id-theft-suspect-caught-red-handed/

10. https://wnyt.com/archive/duo-charged-in-felony-lane-gang-crimes-2/

Fyi: Alternate Means of Identity Theft

A perpetrator can conduct identity theft without using the Internet. A ring of criminals in the Dallas–Fort Worth metroplex were working with waiters in restaurants. When the waiter took your credit card or debit card to pay for the meal, he would also use a small handheld device (kept hidden in a pocket) to scan in your credit card information. He would then give this information to the identity theft ring, which could either make online purchases or use the stolen information to produce fake credit cards with your name and account data. The only way to avoid this sort of danger is to never use your credit or debit card unless it is going to be processed right in front of you. Do not let someone take your card out of your sight to process it.

Phishing

One of the more common ways to accomplish identity theft is via a technique called phishing, which is the process of trying to induce the target to provide personal information. For example, an attacker might send out an email purporting to be from a bank and telling recipients that there is a problem with their bank account. The email then directs them to click on a link to the bank website, where they can log in and verify their account. However, the link really goes to a fake website set up by the attacker. When the target goes to that website and enters his information, he will have just given his username and password to the attacker.

Many end users today are aware of these sorts of tactics and avoid clicking on email links. But unfortunately, not everyone is so prudent, and this attack still is effective. In addition, attackers have come up with new ways of phishing. One of these methods is called cross-site scripting. If a website allows users to post content that other users can see (such as product reviews), the attacker then posts content, but instead of being a review or other legitimate content, it is a script (JavaScript or something similar). Now when other users visit that web page, instead of loading a review or comment, their browsers will load the attacker’s script. That script may do any number of things, but it is common for the script to redirect the end user to a phishing website. If the attacker is clever, the phishing website looks identical to the real one, and end users are not aware that they have been redirected. Cross-site scripting can be prevented by web developers filtering all user input. Cross-site scripting will be dealt with in more detail in Chapter 6, “Techniques Used by Hackers.”

Phishing emails have become more sophisticated over the years. One particular phishing scam that began in 2018 exploits exposed passwords and the possible embarrassment of the victim. The scam works like this: The attacker gets a list of exposed passwords from a site such as https://haveibeenpwned.com and then emails people from that list. The email claims the attacker has malware on the victim’s computer and validates that claim by sharing the victim’s password. The email then claims to have spyware on the computer, which has observed the victim viewing pornography and pleasuring himself while doing so. The email claims to have taken over the web cam and to have video proof. The attacker says that if a certain amount of money is not deposited in a bitcoin wallet within 24 hours, he will send the video to colleagues and family members. This is an example of a rather sophisticated phishing scam. First, the attacker gains credibility by using a real password. Then that attacker exploits the fact that if enough emails are sent out, at least some will be received by those who fall for the allegation (that is, that they have visited pornography sites and been caught behaving in an embarrassing manner). This scheme shows that attackers are becoming better at their attack methodology. (More advanced forms of phishing, such as spear phishing and whaling, will be discussed in Chapter 7, “Industrial Espionage in Cyberspace.”)

Cyber Stalking

Stalking, which has often been a prelude to violent acts, including sexual assault and homicide, has received a great deal of attention in the past few years. Many states have passed a variety of anti-stalking laws. However, stalking has expanded into cyberspace. Cyber stalking involves using the Internet to harass another person; or, as the U.S. Department of Justice puts it:¹¹

11. https://www.justice.gov/ovw/stalking

Although there is no universally accepted definition of cyber stalking, the term is used in this report to refer to the use of the Internet, e-mail, or other electronic communications devices to stalk another person. Stalking generally involves harassing or threatening behavior that an individual engages in repeatedly, such as following a person, appearing at a person’s home or place of business, making harassing phone calls, leaving written messages or objects, or vandalizing a person’s property. Most stalking laws require that the perpetrator make a credible threat of violence against the victim; others include threats against the victim’s immediate family; and still others require only that the alleged stalker’s course of conduct constitute an implied threat. While some conduct involving annoying or menacing behavior might fall short of illegal stalking, such behavior may be a prelude to stalking and violence and should be treated seriously.

If someone uses the Internet to harass, threaten, or intimidate another person, then the perpetrator is guilty of cyber stalking. The most obvious example is sending threatening email. The guidelines on what is considered “threatening” can vary a great deal from jurisdiction to jurisdiction. But a good rule of thumb is that if the email’s content would be considered threatening in normal speech, then it will probably be considered a threat if sent electronically. Other examples of cyber stalking are less clear. If you request that someone quit emailing you, yet she continues to do so, is that a crime? Unfortunately, there is no clear answer on that issue. The truth is that it may or may not be considered a crime, depending on factors such as the content of the emails, the frequency, the prior relationship between the recipient and the sender, and the jurisdiction.

Real Cyber Stalking Cases

The following cases are real-life examples of cyber stalking. Examining the facts in these cases might help you to get an idea of what legally constitutes cyber stalking. While many of the cases discussed here are recent, some older cases are also discussed to give you a complete understanding of this issue:

Images This first case is old, but it is a pivotal case in the history of cyber stalking. In the first successful prosecution under California’s cyber stalking law, prosecutors in the Los Angeles District Attorney’s Office obtained a guilty plea from a 50-year-old former security guard who used the Internet to solicit the rape of a woman who rejected his romantic advances. The defendant terrorized his 28-year-old victim by impersonating her in various Internet chat rooms and online bulletin boards, where he posted, along with her telephone number and address, messages that she fantasized about being raped. On at least six occasions, sometimes in the middle of the night, men knocked on the woman’s door, saying they wanted to rape her. The former security guard pled guilty in April 1999 to one count of stalking and three counts of solicitation of sexual assault. He faced up to 6 years in prison.

Images In California, Johao Chavarri, an active duty Marine, is alleged to have created numerous online accounts to stalk, harass, and threaten women who would not acquiesce to his demands to send him nude photos. Chavarri was arrested in 2022 and eventually pled guilty.

Images In 2021 Barry Goldberg pled guilty to stalking a teenage girl online. He met the victim online, posing as a fictious high school male who was dying of cancer. He eventually began a campaign of harassment, threats, and coercion, including pressuring the teen girl to send him pornographic videos.

Images In October 2017 Heriberto Latigo was sentenced to 5 years in prison for his cyber stalking crimes. The issues began in 2013, when he was involved in a romantic relationship with a woman. Latigo forced the woman to send him nude pictures of herself, harassed her online, and blackmailed her. After the relationship ended, he continued to blackmail his victim for sexual favors and sent her violent images as threats.

Images In September 2018 Joel Kurzynski pled guilty to cyber stalking charges. Kurzynski was a former information technology professional. Beginning in 2017, he conducted a campaign including death threats and hate speech against two individuals he knew. He created fake profiles of his victims on social media sites and used those profiles to seek sadomasochistic or underage relationships. Kurzynski was sentenced to 30 months in prison and 3 years of supervised release after that.

Images Robert James Murphy was the first person charged under federal law for cyber stalking. He was accused of violating Title 47 of U.S. Code 223, which prohibits the use of telecommunications to annoy, abuse, threaten, or harass anyone. Murphy was accused of sending sexually explicit messages and photographs to his ex-girlfriend. This activity continued for a period of years. He was charged and eventually pled guilty to two counts of cyber stalking.

Images In 2022 Mathew Hardy of England was convicted of using social media to contact women and then stalk them online. He spread various lies about his targets to their family members, friends, and co-workers, such as asserting that they were having affairs with bosses or even relatives.

Clearly, using the Internet to harass people is just as serious a crime as harassing them in person. And it can lead to real-world crimes. This problem has even extended to workplace issues. For example, court cases have held that unwanted email pornography can be construed as sexual harassment. If an employee complains about unwanted email, the employer has a duty to at least attempt to ameliorate the situation. This attempt can be as simple as installing a very inexpensive spam blocker (software that tries to limit or eradicate unwanted email). However, if the employer takes no steps whatsoever to correct the problem, that reticence may be seen by a court as contributing to a hostile work environment. As previously stated, if the stalking act would be considered harassment in person, then it would be considered harassment in cyberspace. Black’s Law Dictionary defines harassment as follows:¹²

12. Black’s Law Dictionary, 1999, West Publishing Company, 7th edition

A course of conduct directed at a specific person that causes substantial emotional distress in such person and serves no legitimate purpose.

Words, gestures, and actions that tend to annoy, alarm, and abuse (verbally) another person.

Usually law enforcement officials need some credible threat of harm in order to pursue harassment complaints. In simple terms, this means that if you are in an anonymous chat room and someone utters some obscenity, that act probably will not be considered harassment. However, if you receive specific threats via email, those threats would probably be considered harassment.

Many states specifically prohibit cyber stalking; and in general, existing anti-stalking laws can be applied to the Internet. In 2001 in California a man was convicted of cyber stalking under existing anti-stalking statutes.¹³ Other countries also have existing anti-stalking laws that can be applied to cyber stalking as well. Canada has had a comprehensive anti-stalking law since 1993. Unfortunately, there are many similar cases. The following are just a few:

13. Identity Theft and Assumption Deterrence Act of 1998, U.S.C. 1028

Images This first case is a bit older, but it illustrates how these crimes can escalate. From 2010, there is the case of 70-year-old Joseph Medico, who met a 16-year-old girl at his church. Medico followed the girl to her car and tried to talk her into going to dinner with him and then back to his home. When she rejected his advances, he began calling and texting her several times a day. His activities escalated until the girl reported the activities and Medico was arrested for stalking.

Images In March 2018 Juan R. McCullum was sentenced to 1 year and 361 days in federal prison on conspiracy and cyber stalking charges. McCullum was a former aide to Virgin Islands Delegate Stacey Plaskett. He pled guilty to circulating nude images and video of a member of Congress and her husband in an attempt to block Mrs. Plaskett’s reelection.

Images In the summer of 2018 Jeron Ramos allegedly shot and killed five people in a Maryland newspaper office. According to court records, this violent attack was preceded by a lengthy harassment campaign including very angry Twitter postings and emails.

Images In 2021 Andy Castillo of Lubbock, Texas, was accused of targeting female real estate agents in the Waco, Texas, area, and threating to sexually assault their children. He is accused of murdering two of the women and was arrested for murder; however, Castillo died in jail and was never convicted of the crimes of which he was accused.

Images In 2018 Ho Ka Terence Yung was convicted of cyber stalking. In this case, the perpetrator did not attempt to directly physically attack the victim but rather to incite violence against the victim. According to court records, Yung was upset that he had been rejected from law school, and he began a campaign of cyber stalking against an admissions officer that included fabricating stories that his victim had raped an 8-year-old girl. Yung also posted ads on Craigslist, pretending to be the victim of the cyber stalking and indicating interest in sadistic and violent sexual activity.

Images In 2022 in Rowlett, Texas, Andrew Beard pled guilty to charges that he first cyberstalked his ex-girlfriend, Alyssa Burkett, and then murdered her. Beard had placed a GPS tracking device on Burkett’s vehicle. He followed her to her workplace in Carrollton, Texas, and shot her. She survived the gunshot, though was wounded, and Beard stabbed her 13 times with a knife.

Images In 2022 in Bartlesville, Oklahoma, Keith Eisenberger is accused of cyberstalking and threatening U.S. Representative Kevin Hern and his family. Eisenberger is alleged to have threatened to assault, kidnap, or murder family members of Hern. The complaint alleges that Eisenberger began contacting Hern shortly after Hern was elected. The messages were alleged to have become increasingly violent over time and to have included phone calls as well as social media messages.

One could fill several volumes with similar cases. The common element of most of these cases is that a computer was used as either an agent or a catalyst for a real-world violent crime. These cases should make it clear that computer crime is not just about hacking, fraud, and property crimes. It is becoming more common for law enforcement officers to find a computer/Internet element in traditional crimes. And I am sure most readers have heard about Craigslist’s “erotic services” ads, which are in reality advertisements for prostitution. As you have seen, although a computer might not always be a part of the crime, it could lead to evidence in a crime. In numerous other cases, criminals have posted Facebook messages, tweets, and YouTube videos containing incriminating evidence and, in some cases, full confessions.

Another phenomenon that has been growing in frequency is referred to as swatting. This occurs when someone calls 911, claiming that a violent crime is in progress and providing the address of the intended victim. The goal is to get police to come with an aggressive tactical response (that is, a SWAT team) and at least significantly frighten the victim. In May 2018 Tyler Barriss pled guilty to such an incident. He had made a swatting call claiming that the victim had shot his own father and was holding relatives hostage in the home. When police showed up at the victim’s home in response to the swatting call, the victim reached for his waistband, and the police believed he was reaching for a gun and shot him.

In 2022 a 15-year-old Georgia teenager was arrested and accused of making multiple swatting calls to online gamers. He stated that someone was in the home, about to kill family members. Police believe the swatting calls included incidents in Connecticut, North Carolina, and Florida.

In 2022 a streamer on the social media platform Twitch, who uses the name PixelKitten, was swatted during a live charity event. Earlier, the swatter is alleged to have sent various pizza orders to PixelKitten’s home in order to harass and taunt her. Then during the live charity event, the swatter called police and claimed there was an armed assailant in PixelKitten’s house who had already shot one victim.

The incidents just described are just a few examples of numerous similar stories. You can find many more with a simple Internet search. Swatting has become an unfortunate aspect of modern life on the Internet. The issue not only causes a great deal of anxiety for the target but wastes police resources. There is also always a possibility of injury or death. Given that police officers involved believe they are responding to an emergency call regarding an armed and dangerous individual in a home, their response can be rather aggressive. It would take only a very minor mistake on the part of officers or the residents of the home to lead to tragedy.

The idea of a death due to swatting is not mere speculation. In 2021 60-year-old Mark Herring of Tennessee was indeed killed in a swatting incident. Herring heard people outside his home and thought they were police. He went outside his home with a firearm. When he saw the police, he dropped the gun, and fortunately he was not accidentally shot. But the stress of the situation induced a heart attack, and Herring died.

How to Evaluate Cyber Stalking

Unfortunately, it is not always clear if a given communication rises to the level of cyber stalking or not. One obvious example of cyber stalking is the sending of threatening email messages. But even the definitions of harass, threaten, and intimidate are somewhat vague. Obviously, if a person sends an email to another person, threatening to kill that person, and provides photos of the recipient to demonstrate that the sender is familiar with the target’s appearance and address, that would clearly be cyber stalking. But what about a situation in which a person is upset with a product and emails a harshly worded message to an executive at the product’s manufacturer? If the email has a vague threat, such as “You will get what you deserve,” is that cyber stalking? This is not an easy question to answer, and no single answer applies to all jurisdictions and all situations. What constitutes threatening, harassing, or intimidating can vary a great deal from jurisdiction to jurisdiction. But a general guideline is that that if the content of the email (or instant message, newsgroup posting, and so on) would be considered threatening in normal speech, then it would probably also be considered a threat if sent electronically.

Another element of a threat is viability. Is the threat credible? On the Internet, people are frequently more vocal and often more hostile than they are in other venues. That means a law enforcement officer must to some extent differentiate between someone simply spouting off or venting versus someone making a real, serious threat.

Law enforcement offers look at means, motive, and opportunity. Did the suspect have the means (that is, the ability) to commit the crime? Did he or she have a motive to commit the crime? Finally, did he or she have an opportunity to commit the crime? However, these three elements are used after a crime has been committed to evaluate possible suspects. They don’t help evaluate threats to determine whether they are credible. How do you determine whether to take a threat seriously? The key is to look for four factors:

Images Credibility: For a threat to be credible, there must be some reasonable expectation that it could be carried out. For example, suppose a woman in Nebraska is on an Internet discussion board and receives a general threat from another user living in Bangkok in the course of a heated debate. In this scenario, the sender very likely has no idea where the recipient lives. Indeed, because many people use screen names on the Internet, the sender may not even know the recipient’s real name, gender, age, or appearance. That means this threat has a very low level of credibility. If, however, the woman in Nebraska receives a threat from the user in Bangkok accompanied with personal information such as her address, her place of work, or a photo of her, that is a very credible threat.

Images Frequency: Unfortunately, people often make ill-advised comments on the Internet. Often, however, a single hostile comment is just a person reacting too emotionally and too quickly online. For this reason, this type of comment is of less concern than a pattern of threats over a period of time. Frequently, stalkers escalate their comments and threats over time, gradually building up to a point where they act violently. While there certainly may be cases in which a single threat warrants investigation, as a general rule, isolated threats are of less concern than a pattern of harassment and threats.

Images Specificity: Specificity refers to how specific the perpetrator is regarding the nature of the threat, the target of the threat, and the means of executing the threat. Of course, it is very important for law enforcement officers to realize that real threats can sometimes be vague. Real threats aren’t always specific, but specific threats are usually real. As an example, an email saying “You will pay for that” is of less concern than an email containing a specific threat of a very specific type of violence, such as “I will wait for you after work and shoot you in the head with my 9mm” along with a photo of the recipient leaving work. (The photo also makes it very credible.) This threat is specific and should be of concern to law enforcement.

Images Intensity: Intensity refers to the general tone of the communications, the nature of the language, and the level of the threat. Graphic and particularly violent threats should always be taken very seriously by law enforcement. Often, when someone is simply venting or reacting emotionally, he may make statements that could be considered threatening. In these cases, however, most people make low-intensity statements, such as threatening to beat someone up. Threats such as these are of less concern than, say, a threat to dismember someone. This is because normal, nonviolent people can lose their temper and want to punch someone in the nose. But normal, nonviolent people don’t usually lose their temper and want to cut someone into pieces with a chainsaw. Anytime a threat is raised to a level that is beyond what a reasonable person might say, even in a hostile situation, that threat becomes of greater concern.

All four of these criteria need not be met for a cyber threat to be considered viable. Law enforcement officers must always rely on their own judgment and should err on the side of caution. A particular officer may feel a given threat is very serious even if several of these criteria are not met. That officer should then treat the threat as a serious concern. And if one or more of these criteria are present, the officer should always treat the matter seriously, regardless of her personal inclinations. A credible, frequent, specific, and intense threat is very often a prelude to real-world violence.

These questions apply not just in the real world but also in cyberspace, where the means and opportunity are significantly expanded.

Crimes Against Children

Of special concern are cyber stalking cases involving minors. Pedophiles now use the Internet extensively to interact with minors and, in many cases, arrange in-person meetings with children. This must be a significant concern for all parents, law enforcement officials, and computer security professionals. Often, pedophiles use chat rooms, online discussion boards, and various other Internet media to meet with children. The discussions often turn sexually explicit and eventually lead to attempts to meet in person. Fortunately, this sort of activity is relatively easy to investigate. The pedophile normally wishes to continue communication with the victim and to escalate communication. The process of cultivating a relationship with the victim is referred to as grooming, and it often includes sending gifts to the victim. A common gift is a cell phone, allowing the pedophile and the victim to communicate through a channel the victim’s parents are not aware exists. While variations exist, the common process is as follows:

The initial conversation the predator initiates with a minor is likely to be about an innocuous topic that is of interest to a minor. During this initial phase, the predator is often looking for key signs that this child might be a likely target. For example, children who feel like they don’t belong, are not getting enough attention from parents, or are going through some major life issue such as parental divorce are likely targets.

Once the predator has identified a potential target, he begins trying to extend the conversations outside the chat room or social page into private chats or emails. He is also likely to be very sympathetic to whatever the child’s problem is. Predators often use flattery with their intended victims. Children who feel like they don’t belong or who have low self-esteem are very susceptible to these sorts of tactics.

The next step is to begin easing sexual content into the conversation. The predator’s intent is to gradually get the child comfortable discussing sexual topics. Usually he is careful to take this phase carefully so as not to cause the targeted child to panic. If this process proceeds far enough, the predator suggests a face-to-face meeting. In some cases the face-to-face meeting is expressly for the purpose of sex; in others, the predator lures the child to a location with the promise of some seemingly benign activity such as video games or a movie.

Of course, there are sometimes deviations from this pattern. Some predators move much more quickly to meet with the child face to face. A predator may also avoid sexual conversations at all and simply try to lure the child out of her house with the intent of forcibly molesting her. Whether the predator chooses to lure the child and then force a sex act or attempts to seduce the child depends on how the predator views the act. It may surprise some readers to discover that some pedophiles actually view themselves not as child molesters but rather as being in a relationship with the child. They actually think their behavior is acceptable and that society simply doesn’t understand. This sort of pedophile is much more likely to use a method of gradually increasing the sexual content and explicitness of the online conversation. Their intent is to seduce the child.

A number of well-publicized sting operations have aimed to catch online predators. In these operations, adults (sometimes law enforcement officers, sometimes not) pose as minors online and wait for a pedophile to approach them and attempt to engage in sexually explicit conversations. These attempts have been quite controversial. Given the nature of the activities, however, it seems unlikely that a non-pedophile adult could accidentally or mistakenly become involved in explicit sexual discussions with a minor. It is even less likely that a non-pedophile adult would attempt to meet in the physical world with a person she believed to be a minor. It would certainly seem that these programs, if conducted properly, can be invaluable in combating online predation.

It should be noted that the U.S. government and many states have online sex offender databases that can be used to look up anyone who might be on the sex offender list. Many of these databases provide photos and birthdates to help prevent misidentifications due to similar names. The following are a few such directories:

Images U.S. Department of Justice: https://www.nsopw.gov

Images Alabama: https://app.alea.gov/Community/wfSexOffenderSearch.aspx

Images New York: http://www.criminaljustice.ny.gov/SomsSUBDirectory/search_index.jsp

Images California: https://oag.ca.gov/sex-offender-reg

Images Kansas: https://www.kbi.ks.gov/registeredoffender/

Images Oklahoma: https://sors.doc.ok.gov/ords/svorp/sors/r/sors/public-search

Images Texas: https://records.txdps.state.tx.us/SexOffenderRegistry

Images Wyoming: https://wyomingdci.wyo.gov/criminal-justice-information-services-cjis/sex-offender-registry

Unfortunately, child predators are a problem everywhere—in every state, city, and nation. Various nations have set up task forces to address these crimes. In the United States, each state has an Internet Crimes Against Children (ICAC) task force (see https://www.icactaskforce.org). In the ICAC program, state, local, and federal authorities work to combat crimes against children. Other nations have similar task forces.

Laws About Internet Fraud

Over the past several years, various legislatures (in the United States and in other countries) have passed laws defining Internet fraud and stating the prescribed punishments. In many cases, existing laws against fraud and harassment are applicable to the Internet as well; however, some legislators have felt that cybercrime warrants its own distinct legislation.

Identity theft has been the subject of various state and federal laws. Most states now have laws against identity theft. This crime is also covered by federal law. In 1998, the federal government passed 18 U.S.C. 1028, also known as the Identity Theft and Assumption Deterrence Act of 1998. This law made identity theft a federal crime.

One nation that has decided to crack down hard on cyber criminals is Romania. Some experts have described Romanian cybercrime law as the strictest in the world. However, what is especially interesting about Romanian law is how specific it is. The crafters of this legislation went to some effort to very specifically define all the terms used in the legislation. This specificity is very important in order to prevent defendants from finding loopholes in laws. Unfortunately, the Romanian government only took such measures after media sources around the world identified the country as a “Citadel for Cybercrime.” The country’s reactive approach to cybercrime is probably not the best solution.

The University of Dayton School of Law has a website devoted to cybercrime.¹⁴ The school has some rather extensive links on cybercrime, cyber stalking, and other Internet-based crimes. As we move forward in the twenty-first century, we can expect to see more law schools with courses dedicated to cybercrime.

An interesting phenomenon has begun in the past few years: Attorneys have begun to specialize in cybercrime cases. The fact that there are lawyers who specialize in this area of law is a strong indicator that Internet crime is a growing problem in modern society.

Protecting Yourself Against Cybercrime

Now that you know about the various types of fraud that are prevalent on the Internet and have looked at the relevant laws, you might be wondering what you can do to protect yourself. There are several specific steps you can take to minimize the chances of being the victim of Internet crime. There are also some clear guidelines for how to proceed if you become a victim.

Protecting Against Investment Fraud

To protect yourself against investment fraud, follow these guidelines:

Images Only invest with well-known, reputable brokers.

Images If something sounds too good to be true, then avoid it.

Images Ask yourself why someone would be informing you of a great investment deal. Why would a complete stranger decide to share an incredible investment opportunity with you?

Images Remember that even legitimate investment involves risk; never invest money that you cannot afford to lose.

Protecting Against Identity Theft

When the issue is identity theft, prevention measures are clear:

Images Do not provide your personal information to anyone unless absolutely necessary. When communicating on the Internet with anyone you do not personally know, do not reveal anything about yourself—not your age, occupation, real name, or anything else.

Images Destroy documents that have personal information on them. If you simply throw away bank statements and credit card bills, then someone rummaging through your trash can get a great deal of personal data. You can obtain a paper shredder from an office supply store or many retail department stores for less than $30. Shred these documents before disposing of them. This rule may not seem like it is related to computer security, but information gathered through nontechnical means can be used in conjunction with the Internet to perpetrate identity theft.

Images Check your credit frequently. Many websites allow you to check your credit and even get your credit score for a nominal fee. (I check my credit twice per year.) If you see any items you did not authorize, you might be a victim of identity theft.

Images If your state has online driving records, check yours once per year. If you see driving infractions that you did not commit, this evidence is a clear sign that your identity is being used by someone else. In Chapter 13, “Cyber Detective,” we will explore in detail how to obtain such records online, often for less than $5.

To summarize, the first step in preventing identity theft is restricting the amount of personal information you make available. The next step is simply monitoring your credit and driving records so that you will be aware if someone attempts to use your identity.

Another part of protecting your identity is protecting your privacy in general. This means preventing others from gaining information about you that you don’t explicitly provide them. That preventive method includes keeping websites from gathering information about you without your knowledge. Many websites store information about you and your visit to their site in small files called cookies. These cookie files are stored on your machine. The problem with cookies is that any website can read any cookie on your machine—even ones that the website you are currently visiting did not create. So if you visit one website and it stores items like your name, the site you visited, and the time you were there, then another website could potentially read that cookie and know where you have been on the Internet. One of the best ways to stop cookies you don’t want is to install anti-spyware software. We will discuss such software in more detail in a later chapter. Right now, let’s look at how to change your Internet settings to help reduce threats to your privacy.

Secure Browser Settings

If you are using Microsoft Edge, you can go to Tools and use the drop-down menu to select Options. After that, you see a screen much like the one shown in Figure 3.1.

Figure 3.1 Microsoft Edge options.

Select Advanced Settings, and you see the screen shown in Figure 3.2. Notice that you can select various levels of general protection against cookies. It is recommended that you select Medium High as the level.

Figure 3.2 Microsoft Edge advanced settings.

Note the Advanced button at the bottom of the screen. This button allows you to block or allow individual websites from creating cookies on your computer’s hard drive. Altering cookie settings on your machine is just one part of protecting your privacy, but it is an important part.

You probably also want to ensure that you have selected the InPrivate Browsing option, shown in Figure 3.2.

If you are working with Firefox, the process is similar. If you select Tools from the drop-down menu and then select Options, you see the screen shown in Figure 3.3.

Figure 3.3 Firefox options.

If you select Privacy & Security on the left side of this screen, you then see a screen much like the one shown in Figure 3.4.

Figure 3.4 Firefox privacy.

As you can see in Figure 3.4, there are a number of privacy settings for you to select, and they are self-explanatory.

If you are using Google Chrome, select Settings, and you see the screen shown in Figure 3.5. Click Advanced at the bottom of the screen to find the security settings.

Figure 3.5 Chrome settings.

With any browser, if you make the security settings too strict, you won’t be able to view many web pages. You will have to experiment a bit with the settings to find the ones that work best for you.

You might also want to take additional steps that can take a bit more technical savvy to execute but that can increase your safety online. The first is to use a VPN service that encrypts your web traffic and routes it through a proxy server. One such product that is easy to use is called Hide My Ass shown in Figure 3.6. (My apologies for the profanity, but that is the name.) You simply launch the app and select where you want your web traffic to route through, then start surfing the web.

Figure 3.6 HMA.

For example, if I use Hide My Ass from my home in a suburb of Dallas, Texas, with the location set to Spain (refer to Figure 3.6), I can visit a website such as Yahoo that bases what it shows on what country it believes users are in, and the site thinks I am in Spain (see Figure 3.7).

Figure 3.7 Yahoo and HMA.

Protecting Against Auction Fraud

Dealing with auction fraud involves a unique set of precautions; here are four good ideas:

Images Use only reputable auction sites. The most well-known site is eBay, but any widely known, reputable site will be a safer gamble than an unknown or obscure site. Such auction sites tend to take precautions to prevent fraud and abuse.

Images If something sounds too good to be true, don’t bid.

Images Some sites allow you to read feedback other buyers have provided on a given seller. Read the feedback and work only with reputable sellers.

Images When possible, use a separate credit card—one with a low limit—for online auctions. That way, should your credit card be compromised, your liability is limited. Using your debit card is simply inviting trouble.

Using online auctions can be a very good way to get valuable merchandise at low prices. However, one must exercise some degree of caution when using these services.

Protecting Against Online Harassment

Consider the following guidelines for protecting yourself from online harassment:

Images If you use chat rooms, discussion boards, and so forth, do not use your real name. Set up a separate email account with an anonymous service, such as Yahoo!, Gmail, or Hotmail. Then use that account and a fake name online. This makes it very hard for an online stalker to find your real identity.

Images If you are the victim of online harassment, keep all the emails in both digital and printed formats. Use some of the investigative techniques we will explore later in this book to try to identify the perpetrator. If you are successful, then you can take the emails and the information on the perpetrator to law enforcement officials.

Images Do not, in any case, ignore cyber stalking. According to the Working to Halt Online Abuse website, 19% of cyber stalking cases escalate to stalking in the real world.

It is not the intent of this chapter or of this book to make you frightened about using the Internet. I routinely use the Internet for entertainment, commerce, and informational purposes. One simply needs to exercise some caution when using the Internet.

Summary

Clearly, fraud and identity theft are very real and growing problems. In this modern age of instant access to information and online purchasing, it is critical that you take steps to protect yourself against this issue. You must work to protect your privacy using steps outlined in this chapter. It is also imperative for law enforcement officers to obtain the skills needed to investigate and solve these sorts of cybercrimes.

Cyber stalking is one area that is often new to both civilians and law enforcement. It is very important that both groups have a clear understanding of what is, and is not, cyber stalking because, unfortunately, cyber stalking cases can escalate into real-world violence.

Test Your Skills

Multiple Choice Questions

1. Candice is discussing Internet fraud with a colleague. She is trying to explain the most common types of fraud. What is the term for the most common type of Internet investment fraud?

A. The Nigerian fraud

B. The Manhattan fraud

C. The pump and dump

D. The bait and switch

2. You have become quite active in online investing. You want to get some advice but are concerned about the veracity of the advice you receive. What is the most likely problem with unsolicited investment advice?

A. You might not earn as much as claimed.

B. The advice might not be truly unbiased.

C. The advice might not be from a legitimate firm.

D. You might lose money.

3. Juan is a security officer for an investment firm. He is explaining various scams to the brokers. What is the term for artificially inflating a stock in order to sell it at a higher value?

A. Bait and switch

B. The Nigerian fraud

C. Pump and dump

D. The Wall Street fraud

4. What is the top rule for avoiding Internet fraud?

A. If it seems too good to be true, it probably is.

B. Never use your bank account numbers.

C. Only work with people who have verifiable email addresses.

D. Don’t invest in foreign deals.

5. Which of the following is not one of the Security and Exchange Commission’s tips for avoiding investment fraud?

A. Don’t invest online.

B. Consider the source of an offer.

C. Always be skeptical.

D. Always research an investment.

6. Aliya is active on online auctions but wants to avoid auction fraud. What are the four categories of auction fraud?

A. Failure to send, failure to disclose, sending to wrong address, failure to deliver

B. Failure to send, failure to disclose, sending something of lesser value, failure to deliver

C. Failure to disclose, sending something to wrong address, failure to send, failure to deliver

D. Failure to disclose, sending something of lesser value, failure to send, sending something of greater value

7. What is the term for a seller bidding on her own item to drive up the price?

A. Bid siphoning

B. Bid shielding

C. Shill bidding

D. Ghost bidding

8. What is the term for submitting a fake but very high bid to deter other bidders?

A. Bid siphoning

B. Bid shielding

C. Shill bidding

D. Ghost bidding

9. What is typically the goal of identity theft?

A. To make illicit purchases

B. To discredit the victim

C. To avoid criminal prosecution

D. To invade privacy

10. According to the U.S. Department of Justice, identity theft is generally motivated by what?

A. Malicious intent

B. Personal hostility toward the victim

C. Economic gain

D. Thrill seeking

11. Clarence is a police detective with a small-town police department. He is trying to consider how seriously to take reports of cyber stalking. Why is cyber stalking a serious crime?

A. It is frightening to the victim.

B. It can be a prelude to violent crime.

C. It is using interstate communication.

D. It can be a prelude to identity theft.

12. What is cyber stalking?

A. Any use of the Internet to send or post threats

B. Any use of electronic communications to stalk a person

C. The use of email to send threats

D. The use of email to stalk a person

13. What do law enforcement officials usually require of a victim in order to pursue harassment allegations?

A. A verifiable threat of death or serious injury

B. A credible threat of death or serious injury

C. A verifiable threat of harm

D. A credible threat of harm

14. If you are posting anonymously in a chat room and another anonymous poster threatens you with assault or even death, is this person’s post harassment?

A. Yes; any threat of violence is harassment.

B. Probably not because both parties are anonymous, so the threat is not credible.

C. Yes; chat room threats are no different from threats in person.

D. Probably not because making a chat room threat is not the same as making a threat in person.

15. What must exist for cyber stalking to be illegal in a state or territory?

A. Specific laws against cyber stalking in that state or territory

B. Specific laws against cyber stalking in that nation

C. Nothing; existing stalking laws can apply

D. Nothing; existing international cyber stalking laws apply

16. What is the first step in protecting yourself against identity theft?

A. Never provide personal data about yourself unless absolutely necessary.

B. Routinely check your records for signs of identity theft.

C. Never use your real name on the Internet.

D. Routinely check for spyware on your computer.

17. What can you do on your local computer to protect your privacy?

A. Install a virus scanner.

B. Install a firewall.

C. Set your browser’s security settings.

D. Set your computer’s filter settings.

18. What is a cookie?

A. A piece of data that web servers gather about you

B. A small file that contains data and is stored on your computer

C. A piece of data that your web browser gathers about you

D. A small file made that contains data and then is stored on the web server

19. Which of the following is not an efficient method of protecting yourself from auction fraud?

A. Only use auctions for inexpensive items.

B. Only use reputable auction sites.

C. Only work with well-rated sellers.

D. Only bid on items that seem realistic.

20. What is the top rule for chat room safety?

A. Make certain you have antivirus software installed.

B. Never use your real name or any real personally identifying characteristics.

C. Only use chat rooms that encrypt transmissions.

D. Use chat rooms that are sponsored by well-known websites or companies.

21. Why is it useful to have a separate credit card dedicated to online purchases?

A. If the credit card number is used illegally, you will limit your financial liability.

B. You can keep better track of your auction activities.

C. If you are defrauded, you can possibly get the credit card company to handle the problem.

D. You can easily cancel that single card if you need to do so.

22. What percentage of cyber stalking cases escalate to real-world violence?

A. Fewer than 1%

B. About 25%

C. 90% or more

D. About 19%

23. If you are a victim of cyber stalking, what should you do to assist the police?

A. Nothing; it is their job, and you should stay out of it.

B. Attempt to lure the stalker into a public place.

C. Keep electronic and hard copies of all harassing communications.

D. Try to provoke the stalker into revealing personal information about himself.

24. What is the top way to protect yourself from cyber stalking?

A. Do not use your real identity online.

B. Always use a firewall.

C. Always use a virus scanner.

D. Do not give out email addresses.

Exercises

EXERCISE 3.1: Setting Web Browser Privacy in Microsoft Edge

This process is described in detail with images in the chapter, but here you should actually walk through the process on your own:

Images Select Settings from the ellipsis (…) drop-down menu in the right-hand corner of the Microsoft Edge window and then choose Settings.

Images Scroll down and select View Advanced Settings.

Images Scroll down to the Privacy and Services section.

Images Scroll down a bit and in the Cookies drop-down section, set your browser to Don’t Block Cookies, Block All Cookies, or Block Only Third Party Cookies.

EXERCISE 3.2: Using Alternative Web Browsers

If you don’t already have it, download the Firefox browser from www.mozilla.org.

Set privacy and security settings within Firefox.

Projects

PROJECT 3.1: Finding Out About Cyber Stalking and the Law

Using the Web or other resources, find out what your state’s, country’s, or province’s laws are regarding cyber stalking.

Write a brief paper describing those laws and what they mean. You may select to do a quick summary of several laws or a more in-depth examination of one law. If you choose the former, then simply list the laws and write a brief paragraph explaining what each one covers. If you choose the latter option, then discuss the law’s authors, why it was written, and possible ramifications of the law.

PROJECT 3.2: Looking for Auction Fraud

Go to any auction site and try to identify whether there are any sellers you think might be fraudulent. Write a brief paper explaining what about a particular seller indicates that he may not be dealing honestly.

PROJECT 3.3: Examining Cyber Stalking Case Studies

Using the Web, find a case of cyber stalking that is not mentioned in this chapter. You may find some on the website www.safetyed.org/help/stalking helpful.

Write a brief paper discussing this case, paying particular attention to steps you think might have helped avoid or ameliorate the situation.

Case Study

Consider this case of an intrepid identity thief. The perpetrator, Jane, encounters the victim, John, online in a chat room. John is using his real first name but only his last initial. However, over a series of online conversations between Jane and John, he does reveal personal details about his life (marital status, children, occupation, region he lives in, and so forth). Eventually, Jane offers John some piece of information, such as perhaps an investment tip, as a trick to get John’s email address from him. Once she gets his email address, an email exchange begins outside of the chat room, wherein Jane purports to give John her real name, thus encouraging John to do the same. Of course, the perpetrator’s name is fictitious, such as “Mary.” But Jane now has John’s real name, city, marital status, occupation, and so on.

Jane can try a number of options, but in this case she begins by using the phone book or the Web to get John’s home address and phone number. She can then use this information to get John’s Social Security number in a variety of ways. The most straightforward would be to go through John’s trash while he is at work. However, if John works in a large company, Jane can just call (or enlist someone to call), claiming to be John’s wife or another close relative, wanting to verify personnel data. If Jane is clever enough, she may come away with John’s Social Security number. Then it is a trivial matter (as we will see in Chapter 13) to get John’s credit report and to get credit cards in his name.

From this scenario, consider the following questions:

What reasonable steps could John have taken to protect his identity in the chat room?

What steps should any employer take to prevent being unwittingly complicit in identity theft?

Chapter 4

Denial of Service Attacks

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand how denial of service attacks are accomplished

Images Know how certain denial of service attacks work, such as SYN flood, Smurf, and distributed denial of service attacks

Images Take specific measures to protect against denial of service attacks

Images Know how to defend against specific denial of service attacks

Introduction

By now you are aware, in a general way, of the dangers of the Internet, and you have explored a few basic rules for protection on the Internet. In Chapter 3, “Cyber Stalking, Fraud, and Abuse,” you were introduced to some fraud, stalking, and related crimes. It is now time to become more specific about how attacks on systems are conducted. In this chapter, we will examine one category of attack that might be used to cause harm to a target computer system. This chapter will describe for you, in depth, the workings of the denial of service (DoS) attack. This threat is one of the most common attacks on the Internet, so it is prudent for you to understand how it works and how to defend yourself against it. Further, in the exercises at the end of the book, you will practice stopping a DoS attack. In information security, the old adage that “knowledge is power” is not only good advice but also an axiom upon which to build your entire security outlook.

DoS Attacks

DoS attacks are actually much simpler than many other attacks, and thus they are quite prevalent. This type of attack does not even attempt to intrude on your system or to obtain sensitive information; it simply aims to prevent legitimate users from accessing the system. This type of attack is fairly easy to execute and requires a minimum of technical skill. It is based on the fact that any device has operational limits. For example, a truck can only carry a finite load or travel a finite distance. Computers, like other machines, have limits. Any computer system, web server, or network can only handle a finite load. A workload for a computer system may be defined by the number of simultaneous users, the size of files, the speed of data transmission, or the amount of data stored. If you exceed any of those limits, the excess load will stop the system from responding. For example, if you can flood a web server with more requests than it can process, it will be overloaded and will no longer be able to respond to further requests. Every technology has limits; if you can exceed those limits, then you can take the system offline. This reality underlies the DoS attack: Simply overload the system with requests, and it will no longer be able to respond to legitimate users attempting to access the web server.

Illustrating an Attack

One simple way to illustrate a DoS attack, especially in a classroom setting, involves the use of the ping command discussed in Chapter 2, “Networks and the Internet”:

Start a web server service running on one machine. (You can use Apache, IIS, or any web server.)

Ask several people to open their browsers and key the IP address of that machine into the address bar. They should then be viewing the default website for that web server.

Now you can do a rather primitive DoS attack on the system. Recall from Chapter 2 that typing in ping /? will show you all the options for the ping command. The -l option changes the size of the packet you can send. Remember that a TCP packet can be only of a finite size. Thus, you are going to set these packets to be almost as large as you can send. The -w option determines how many milliseconds the ping utility will wait for a response from the target. You are going to use -0 so that the ping utility does not wait at all. Then the -t instructs the ping utility to keep sending packets until explicitly told to stop.

Open the command prompt in Windows 7/8/8.1/10/11 (or the shell in UNIX/Linux).

Type in ping <address of target machine > -l 65000 -w 0 -t. You will then see something very much like what is shown in Figure 4.1. Note that, in the figure, I am pinging the loopback address for my own machine. You will want to substitute the address of the machine on which you are running the web server.

Figure 4.1 ping from the command prompt.

What is happening at this point is that this single machine is continually pinging away at the target machine. Of course, just one machine in your classroom or lab that is simply pinging on your web server is not going to adversely affect the web server. However, you can now, one by one, get other machines in the classroom pinging the server in the same way. After adding each batch of three or four machines to the attack, try to go to the web server’s default web page. After a certain threshold (that is, a certain number of machines pinging the server), the web server will stop responding to requests, and you will no longer be able to see the web page.

How many machines it takes to deny service depends on the web server you are using. In order to see this denial happen with as few machines involved as possible, you could use a very low-capacity PC as your web server (that is, the least RAM and CPU possible). For example, running an Apache web server on a simple laptop running Windows 7 Home Edition, it can take about 15 machines each running about 10 different command windows simultaneously pinging to cause a web server to stop responding to legitimate requests. This strategy is, of course, counter to what you would normally select for a web server; no real web server would be running on a simple laptop with Windows 7 Home Edition (or even Windows 10). Likewise, actual DoS attacks use much more sophisticated methods. This simple exercise, however, demonstrates the basic principle behind the DoS attack: Simply flood the target machine with so many packets that it can no longer respond to legitimate requests. It is important to be aware that this is just an illustration. With modern servers, and many servers actually being hosted in clusters or server farms, this exact illustration would not work against a modern target.

Generally, the methods used for DoS attacks are significantly more sophisticated than the example provided here. For instance, a hacker might develop a small virus whose sole purpose is to infect as many computers as possible and then get each of the infected computers to initiate a DoS attack on the target. Once the virus has spread, the various machines that are infected with that virus begin their flood of the target system. This sort of DoS attack is easy to do, and it can be hard to stop. A DoS attack that is launched from several different machines is called a distributed denial of service (DDoS) attack.

Regardless of the methods or the tools (many of which we will describe in this chapter), DoS and DDoS attacks are becoming even more prevalent. According to Calyptix Security, the first quarter of 2018 set records for DoS and DDoS attacks.¹ One of the most massive DDoS attacks in history hit the GitHub site on February 28, 2018, peaking at 1.3Tbps. That record was broken just 5 days later.

1. https://www.calyptix.com/top-threats/ddos-attacks-2018-new-records-and-trends/

There are other disturbing trends in DoS attacks. According to one report, in January of 2022 over 17% of victims of DoS attacks were first targeted by a threat demanding ransom.² Another 2022 report details an increase in application layer DDoS attacks. These are attacks on the application layer of the OSI model.³

2. https://blog.cloudflare.com/ddos-attack-trends-for-2022-q1/

3. https://www.f5.com/labs/articles/threat-intelligence/2022-application-protection-report-ddos-attack-trends

Distributed Reflection Denial of Service Attacks

As previously stated, DDoS attacks are becoming more common. Most such attacks rely on getting various machines (servers or workstations) to attack the target. A distributed reflection denial of service attack is a special type of DoS attack. As with all such attacks, it is accomplished by the hacker getting a number of machines to attack the selected target. However, this attack works a bit differently than other DoS attacks. Rather than getting computers to attack the target, this method tricks Internet routers into attacking a target.

Many of the routers on the Internet backbone communicate on port 179. A distributed reflection DoS attack exploits that communication line and gets routers to attack a target system. What makes this attack particularly wicked is that it does not require the routers in question to be compromised in any way. The attacker does not need to get any sort of software on the router to get it to participate in the attack. Instead, the hacker sends a stream of packets to the various routers requesting a connection. The packets have been altered so that they appear to come from the target system’s IP address. The routers respond by initiating connections with the target system. A flood of connections from multiple routers all hit the same target system, rendering the target system unreachable.

Common Tools Used for DoS Attacks

As with any of the security issues discussed in this book, you will find that hackers have at their disposal a vast array of tools. The DoS arena is no different. While it is certainly well beyond the scope of this book to begin to categorize or discuss all of these tools, a brief introduction to just a few of them will prove useful.

Low Orbit Ion Cannon

Low Orbit Ion Cannon (LOIC) is one of the most widely known DoS tools available. It has a very easy-to-use graphical user interface, shown in Figure 4.2.

Figure 4.2 LOIC.

This tool is very easy to use. As you can see in Figure 4.2, it simply requires the user to put in the target URL or IP address and then begin the attack. Fortunately, this tool does nothing to hide the attacker’s address and thus makes it relatively easy to trace an attack back to its source. It is an older tool but still widely used today. There is a tool similar to this named High Orbit Ion Cannon (HOIC).

XOIC

XOIC is similar to LOIC. It has three modes, as shown in Figure 4.3: You can send a message, execute a brief test, or start a DoS attack.

Figure 4.3 XOIC.

Like LOIC, XOIC is very easy to use. It is just a point-and-click graphical user interface. Even attackers with minimal skill can use it to launch DoS attacks.

TFN and TFN2K

Tribal Flood Network (TFN) and TFN2K are two of the oldest DoS tools and are not widely used today. They are included here for historical purposes. TFN2K is a newer version of TFN that supports both Windows Server and UNIX platforms (and can easily be ported to additional platforms). It has some features that make detection more difficult than with its predecessor, including sending decoy information to avoid being traced. Experts at using TFN2K can use the resources of a number of agents to coordinate an attack against one or more targets. In addition, TFN and TFN2K can perform various attacks, such as UDP flood attacks, ICMP flood attacks, and TCP SYN flood attacks (all discussed later in this chapter).

TFN2K works on two fronts. First, there is a command-driven client on the master system. Second, there is a daemon process operating on an agent system. The attack works like this:

The master instructs its agents to attack a list of designated targets.

The agents respond by flooding the targets with a barrage of packets.

Note

Use of the terms master and slave is ONLY in association with the official terminology used in industry specifications and standards and in no way diminishes Pearson’s commitment to promoting diversity, equity, and inclusion and challenging, countering, and/or combating bias and stereotyping in the global population of the learners we serve.

With this tool, multiple agents, coordinated by the master, can work together during the attack to disrupt access to the target. In addition, a number of “safety” features for the attacker significantly complicate development of effective and efficient countermeasures for TFN2K:

Images Master-to-agent communications are encrypted and may be mixed with any number of decoy packets.

Images Both master-to-agent communications and the attacks themselves can be sent via randomized TCP, UDP, and ICMP packets.

Images The master can falsify (spoof) its IP address.

Stacheldraht

Stacheldraht is not as widely known as the previously mentioned DoS tools. Stacheldraht, which is German for “barbed wire,” is a DDoS attack tool that combines features of the Trinoo DDoS tool (another common tool) with the source code from the TFN DDoS attack tool. Like TFN2K, it adds encryption of communication between the attacker and the Stacheldraht masters. It also adds an automatic updating of the agents.

Stacheldraht can perform a variety of attacks, including UDP flood, ICMP flood, TCP SYN flood, and Smurf attacks. It also detects and automatically enables source address forgery.

DoS Weaknesses

The weakness in any DoS attack, from the attacker’s point of view, is that the flood of packets must be sustained. As soon as the packets stop being sent, the target system is back up. A DoS/DDoS attack, however, is very often used in conjunction with another form of attack, such as disabling one side of a connection in TCP hijacking or preventing authentication or logging between servers.

If the hacker is using a distributed attack, as soon as the administrators or owners of the infected machine realize their machine is infected, they will take steps to remove the virus and thus stop the attack. If a hacker attempts to launch an attack from her own machine, she must be aware that each packet has the potential to be traced back to its source. This means that a single hacker conducting a DoS attack will almost certainly be caught by the authorities. For this reason, the DDoS attack is quickly becoming the most common type of DoS attack. The specifics of DDoS attacks will be discussed later in this chapter.

Specific DoS Attacks

The basic concept of a DoS attack is not complicated. The real problem for an attacker is performing an attack without being caught. The next few sections of this chapter will examine some specific types of DoS attacks and look at specific case studies. This information should help you gain a deeper understanding of this particular Internet threat.

TCP SYN Flood Attacks

This attack is no longer effective against most targets, but it is a classic in the annals of cyber threats and bears a brief discussion. This particular attack depends on the hacker’s knowledge of how connections to a server are made. When a session is initiated between the client and server in a network using TCP, a packet is sent to the server with a 1-bit flag called a SYN (or synchronize) flag set. This packet asks the target server to please synchronize communications. The server then allocates appropriate resources and sends to the client a packet with both the SYN (synchronize) and the ACK (acknowledge) flags set. The client machine is then supposed to respond with an ACK flag set. This process, called the three-way handshake, is summarized as follows:

The client sends a packet with the SYN flag set.

The server allocates resources for the client and then responds with the SYN and ACK flags set.

The client responds with the ACK flag set.

There have been a number of well-known SYN flood attacks on web servers. The reason for the popularity of this attack type is that any machine that engages in TCP communication is vulnerable to it—and all machines connected to the Internet engage in TCP communications. Such communication is obviously the entire reason for web servers. The easiest way to block DoS attacks is via firewall rules. (We will discuss firewalls in detail in Chapter 9, “Computer Security Technology.”) A properly configured firewall can prevent a SYN flood attack. There are, however, several methods and techniques you can implement on individual servers to protect against these attacks. The basic defensive techniques are as follows:

Images Micro blocks

Images SYN cookies

Images RST cookies

Images Upstream filtering

Images SPI firewalls

Some of these methods require more technical sophistication than others. These methods will be discussed in general here. When you are entrusted with defending a system against these forms of attacks, you can select the methods most appropriate for your network environment and your level of expertise and examine the system further at that time. The specifics of how to implement any of these methods will depend on the operating system that your web server is using. You will need to consult your operating system’s documentation, or appropriate websites, in order to find explicit instruction on how to implement methods.

Micro Blocks

A micro block works by simply allocating a micro-record instead of allocating a complete connection object (an entire buffer segment) to the SYN object. In this way, an incoming SYN object can allocate as little as 16 bytes of space, making it significantly more difficult to flood a system. This method is a bit more obscure and not as widely used today as it once was. It also does not actually prevent a DoS attack; it merely mitigates the effects.

Note

Many network administrators depend on their firewall to block DoS attacks and don’t take any remediation steps on individual servers. I suggest that you consider combining these two approaches. Yes, you should have a well-configured firewall to block many DoS attacks, but you should also consider taking mitigating steps on individual servers.

SYN Cookies

As the name SYN cookies suggests, this method uses cookies, not unlike the standard cookies used on many websites. With this method, the system does not immediately create a buffer space in memory for the handshake process. Rather, it first sends a SYN+ACK (the acknowledgment signal that begins the handshaking process). The SYN+ACK contains a carefully constructed cookie that is generated as a hash containing the IP address, port number, and other information from the client machine requesting the connection. When the client responds with a normal ACK (acknowledgment), the information from that cookie will be included, and the server then verifies it. Thus, the system does not fully allocate any memory until the third stage of the handshake process. This enables the system to continue to operate normally; typically, the only effect seen is the disabling of large windows. However, the cryptographic hashing used in SYN cookies is fairly resource intensive, so system administrators who expect a large number of incoming connections may choose not to use this defensive technique.

Fyi: Hashing

A hash value is a number generated from a string of text. The hash is significantly smaller than the text itself and is generated by a formula in such a way that it is extremely unlikely that some other text will produce the same hash value. Hashing plays a role in security when it is used to ensure that transmitted messages have not been tampered with. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they are the same, there is a very high probability that the message was transmitted intact. We will discuss hashing in more detail in Chapter 8, “Encryption.”

RST Cookies

Another cookie method that is easier to implement than SYN cookies is the RST cookie. In this method, the server sends an incorrect SYN+ACK back to the client. The client then generates an RST packet, telling the server that something is wrong. Because the client sends back a packet notifying the server of the error, the server now knows the client request is legitimate and can now accept incoming connections from that client in the normal fashion. This method has the disadvantage of potentially causing problems with older Windows machines and with machines that are communicating from behind firewalls.

Upstream Filtering

ISPs often use a process called upstream filtering that essentially involves examining traffic to determine if it is part of a DoS attack and then blocking suspected traffic. This can also be done by using a “scrubbing” center before allowing traffic to the target.

SPI Firewalls

Today, most firewalls use stateful packet inspection. These types of firewalls apply rules to each packet, and they also maintain the state of communication between the client and the server. They therefore realize that multiple SYN packets are coming from the same IP address, and they block them. This is one major reason SYN floods are not seen much today. In addition, next-generation firewalls (NGFWs) combine traditional firewall and other functions, such as those of an application firewall or an intrusion detection system/prevention system (IDS/IPS).

Smurf IP Attacks

The Smurf attack is a very popular version of the DoS attack. An ICMP (Internet Control Message Protocol) packet is sent out to the broadcast address of the network. Since it is broadcast, it responds by echoing the packet out to the network hosts, which then send it to the spoofed source address. Also, the spoofed source address can be anywhere on the Internet, not just on the local subnet. If the hacker can continually send such packets, she will cause the network itself to perform a DoS attack on one or more of its member servers. This attack is clever and rather simple. The only problem for the hacker is getting the packets started on the target network. This task can be accomplished via some software, such as a virus or Trojan horse, that will begin sending the packets.

In a Smurf attack, there are three people/systems involved: the attacker, the victim, and the intermediary (who can also be a victim). The attacker first sends an ICMP echo request packet to the intermediary’s IP broadcast addresses. Since this is sent to the IP broadcast address, many of the machines on the intermediary’s network will receive this request packet and will send back an ICMP echo reply packet. If all the machines on a network are responding to this request, the network becomes congested, and there may be outages.

The attacker impacts the third party—the intended victim—by creating forged packets that contain the spoofed source address of the victim. Therefore, when all the machines on the intermediary’s network start replying to the echo request, those replies will flood the victim’s network. Thus, another network becomes congested and could become unusable. Figure 4.4 illustrates this attack.

The Smurf attack is an example of the creativity that some malicious parties can employ. It is sometimes viewed as the digital equivalent of the biological process in an auto-immune disorder. With such a disorder, the immune system attacks the patient’s own body. In a Smurf attack, the network performs a DoS attack on one of its own systems. This method’s cleverness illustrates why it is important to attempt to work creatively and in a forward-thinking manner if you are responsible for system security in a network. The perpetrators of computer attacks are inventive and always coming up with new techniques. If your defense is less creative and clever than the attackers’ offense, then it is simply a matter of time before your system is compromised.

Figure 4.4 Smurf attack.

There are several ways to protect your system against this problem. One is to guard against Trojan horses. More will be said about the Trojan horse attacks in later chapters; for now, you just need to know that having policies prohibiting employees from downloading applications will help. Also, having adequate virus scanners can go a long way in protecting your system from a Trojan horse and, thus, a Smurf attack. It is also imperative that you use a proxy server, as discussed in Chapter 2. If the internal IP addresses of your network are not known, then it is more difficult to target one in a Smurf attack. And, of course, the most obvious mitigation step you can take is to block all inbound broadcast packets at the firewall. Probably the best way to protect your system is to combine these defenses and also prohibit directed broadcasts and patch the hosts to refuse to reply to any directed broadcasts.

There is a variation of a Smurf attack called a Fraggle. A Fraggle operates very much like a Smurf attack except that it specifically uses ports 7 (echo) and 19 (chargen) to a broadcast address and spoofs the intended victim’s source IP address.

UDP Flood Attacks

UDP, as you will recall from Chapter 2, is a connectionless protocol that does not require a connection setup procedure prior to data transfer. In a UDP flood attack, the attacker sends a UDP packet to a random port on a target system. When the target system receives a UDP packet, it automatically determines what application is waiting on the destination port. In this case, since there is no application waiting on the port, the target system will generate an ICMP “destination unreachable” packet and attempt to send it back to the forged source address. If enough UDP packets are delivered to ports on the target, the system will become overloaded trying to determine awaiting applications (which do not exist) and then generating and sending back packets.

ICMP Flood Attacks

There are two basic types of ICMP flood attacks: floods and nukes. An ICMP flood is usually accomplished by broadcasting a large number of either pings or UDP packets. As with other flood attacks, the idea is to send so much data to the target system that it slows down. If it can be forced to slow down enough, the target will time out (that is, not send replies fast enough) and be disconnected from the Internet. ICMP nukes exploit known bugs in specific operating systems. The attacker sends a packet of information that he knows the operating system on the target system cannot handle. In many cases, this will cause the target system to lock up completely.

This type of attack is far less effective against modern computers than it was against older machines. Even a low-end desktop PC now will have 4GB (or more) of RAM and a dual-core processor. That makes it difficult to generate enough pings to knock the machine offline. However, at one time this was a very common form of DoS attack.

The Ping of Death

Recall from Chapter 2 that TCP packets are of limited size. In some cases, simply sending a packet that is too large can shut down a target machine. This action is referred to as the ping of death (PoD). It works simply by overloading the target system. The hacker sends a single ping, but he does so with a very large packet and thus can shut down some machines.

This attack is quite similar to the classroom example discussed earlier in this chapter. The aim in both cases is to overload the target system and cause it to quit responding. PoD works to compromise systems that cannot deal with extremely large packet sizes. If such an attack is successful, the server will actually shut down completely. It can, of course, be rebooted.

The only real safeguard against PoD is to ensure that all operating systems and software are routinely patched. This attack relies on vulnerabilities in the way a particular operating system (or application) handles abnormally large TCP packets. When such vulnerabilities are discovered, it is customary for the vendor to release a patch. The possibility of PoD is one reason, among many, you must keep patches updated on all of your systems.

Most denial of service attacks are properly mitigated with an appropriate firewall combined with an IDS/IPS or with a next-generation firewall. Chapter 9 discusses security devices and software in more detail.

Teardrop Attacks

In a teardrop attack, the attacker sends a fragmented message. The two fragments overlap in a way that makes it impossible to reassemble them properly without destroying the individual packet headers. Therefore, when the victim attempts to reconstruct the message, the message is destroyed. This causes the target system to halt or crash. A number of variations on the basic teardrop attack are available, such as TearDrop2, Boink, targa, Nestea Boink, NewTear, and SYNdrop.

DHCP Starvation

If enough requests flood a network, an attacker can completely exhaust the address space allocated by the DHCP servers for an indefinite period of time. This DoS attack is called DHCP starvation. An attacker can use a tool such as The Gobbler to easily commit this type of attack.

HTTP POST DoS Attacks

An HTTP POST DoS attack involves sending a legitimate HTTP POST message. Part of the POST message is the content length, which indicates the size of the message to follow. In this attack, the attacker sends the actual message body at an extremely slow rate. The web server is hung while waiting for that message to complete. For more robust servers, the attacker needs to send multiple HTTP POST messages simultaneously.

PDoS Attacks

A permanent denial of service (PDoS) attack damages the system so badly that the victim machine needs an operating system reinstall or even new hardware. This type of attack, sometimes called phlashing, usually involves a DoS attack on the device’s firmware.

Registration DoS Attacks

An attacker can create a program that submits registration forms repeatedly, adding a large number of spurious users to an application. This is one reason many registration websites use CAPTCHA.

Login DoS Attacks

An attacker may overload the login process by continually sending login requests that require the presentation tier to access the authentication mechanism, rendering it unavailable or unreasonably slow to respond. Many websites use CAPTCHA to prevent automated login attempts.

Land Attacks

A land attack is probably the simplest attack in concept. The attacker sends a forged packet with the same source IP address and destination IP address (the target’s IP address). The idea is to drive the target system “crazy” by having it attempt to send messages to and from itself. The victim system will often be confused and will crash or reboot. More modern computers are not susceptible to this attack, but it is presented here for historical purposes.

DDoS Attacks

Perhaps the most common form of DoS attack today is the DDoS attack. This is accomplished by getting various machines to attack the target. A typical way this is done is by sending out a Trojan horse that will cause infected computers to attack a specified target at a particular date and time. This is a very effective way to execute a DDoS attack on any target. In this form of attack, the attacker does not have direct control of the various machines involved. These machines are simply infected by some malware that causes them to participate in the attack on a particular date and time.

Another method is to use a botnet to orchestrate the attack. Botnets are networks of computers that have been compromised by the attacker, giving said attacker control of the infected system. This is often accomplished via delivery of a Trojan horse. However, unlike with the form of DDoS attack just mentioned, the attacker has direct control of the attacking machines in the botnet.

Yo-Yo Attack

A yo-yo attack is a type of DoS attack that targets cloud-hosted applications that use autoscaling. The attacker essentially floods the target, causing the cloud hosting service to scale up to handle the increased traffic. The attacker then stops the attack, waits until the cloud host scales back, and then resumes the attack. Cloud services typically charge for scaling up to handle more bandwidth, so a yo-yo attack increases costs for the target.

Login Attacks

An attacker may enumerate usernames through another vulnerability in an application and then attempt to authenticate the site using valid usernames and incorrect passwords, which will lock out the accounts after a specified number of failed attempts. At that point, legitimate users will not be able to use the site.

Another login attack involves the attacker overloading the login process by continually sending login requests that require the presentation tier to access the authentication mechanism, rendering it unavailable or unreasonably slow to respond.

Many websites use CAPTCHA in order to thwart DoS attempts. If each login attempt requires the user to answer the CAPTCHA, automated tools cannot perform DoS attacks.

CLDAP Reflection

Connectionless Lightweight Directory Access Protocol (CLDAP) is an industry standard codified in RFC 3352.⁴ This protocol uses UDP rather than TCP and assigns IP addresses to new hosts connecting to the network. In a CLDAP reflection attack, attackers essentially overwhelm the network with a flood of CLDAP requests.

4. https://datatracker.ietf.org/doc/html/rfc3352

Degradation of Service Attacks

While the acronym is still DoS, a degradation of service attack is a bit different from a denial of service attack. The attacker targets websites with short-lived bursts of traffic. This causes the target site to respond more slowly rather than crash. This is often done on an ongoing basis to cause continual degradation of service for the target.

Challenge Collapsar Attack

In a challenge collapsar (CC) attack, the attacker sends frequent HTTP requests to the target web server. The requests include uniform resource indicators that require the target site to use time-consuming database operations. The goal is to exhaust the resources of the targeted website.

EDoS

A 2022 report is predicting that a new attack type called an economic denial of sustainability (EDoS) attack is going to become a more prominent issue in the near future.⁵ The idea of this type of attack is to disrupt or discontinue the availability of cloud resources. Such an attack may involve bots that send fake requests. These attacks are often used against infrastructure as a service (IaaS) solutions.

5. https://www.tripwire.com/state-of-security/security-data-protection/cloud/edos-the-next-big-threat-to-your-cloud/

Real-World Examples of DoS Attacks

A good deal of time has been spent discussing the basics of how various DoS attacks are conducted. By now, you should have a firm grasp of what a DoS attack is and have a basic understanding of how it works. It is now time to begin discussing specific, real-world examples of such attacks. This section will take the theoretical knowledge you have gained and give you real-world examples of its application.

Google Attack

In October 2020, a record-breaking UDP amplification attack against Google occurred. This attack, which was traced back to three Chinese Internet service providers, used several networks to spoof 167 million packets per second (mps).

AWS Attack

Also in 2020, there was a massive CLDAP reflection attack against Amazon Web Services. The attack, which used a global Mirai botnet, sent 17.2 million requests per second.

Boston Globe Attack

On November 8, 2017, the Boston Globe was hit with a large-scale DDoS attack against bostonglobe.com and other websites owned by the company. The attack also interrupted the company’s telephones. The attack was only stopped by the company’s Internet service provider implementing anti-DDoS measures, such as throttling bandwidth.

Memcache Attacks

In February 2017 a new DDoS attack vector emerged. Attackers used memcache, a database caching system, to amplify traffic volume. A request could be amplified by a factor of several thousand by using this method. The aforementioned GitHub attack involved memcaching.

DDoS Blackmail

In November 2015, the Australian company FastMail was the victim of a DDoS attack. First the system was attacked and knocked offline. After the second attack, the victim received a ransom demand. The attackers demanded 20 bitcoins to call off the attack. A similar attack had been previously launched against Protonmail, also demanding ransom to stop the attacks.

Mirai

Mirai was malware that turned Linux-based machines into a botnet to be used in DDoS attacks. This was first seen in August 2016. This malware targets Internet of Things (IoT) devices as the basis for DDoS attacks.

How to Defend Against DoS Attacks

There is no guaranteed way to prevent all DoS attacks, just as there is no sure way to prevent a hacking attack. However, there are steps you can take to minimize the danger. Some methodologies, such as SYN cookies and RST cookies, have already been mentioned. In this section, a few of the steps you can take to make your system less susceptible to a DoS attack will be examined.

One of the first things to consider is how these attacks are perpetrated. They may be executed via ICMP packets that are used to send error messages on the Internet or that are sent using the ping and traceroute utilities. If you have a firewall (and you absolutely should have one), then simply configuring it to refuse ICMP packets from outside your network will be a major step in protecting your network from DoS attacks. Since DoS/DDoS attacks can be executed via a wide variety of protocols, you can also configure your firewall to disallow any incoming traffic at all, regardless of what protocol or port it occurs on. This step may seem radical, but it is certainly a secure one.

In Practice

Blocking ICMP Packets

There are very few legitimate reasons (and, some would argue, no good reasons) for an ICMP packet from outside your network to enter your network. Thus, blocking such packets is very often one part of a strategy to defend against DoS attacks. Incidentally, blocking these packets will also make it more difficult for an attacker to scan your network (as we will see in Chapter 12, “Cyber Terrorism and Information Warfare”).

It is also possible to detect some threats from certain DoS tools, such as TFN2K, by using information tools like netstat. Many of these tools can be configured to look for the SYN_RECEIVED state, which could indicate a SYN flood attack.

If your network is large enough to have internal routers, then you can configure those routers to disallow any traffic that does not originate with your network. In that way, should packets make it past your firewall, they will not be propagated throughout the network. You should also consider disabling directed IP broadcasts on all routers. This strategy will prevent a router from sending broadcast packets to all machines on the network, thus stopping many DoS attacks. In addition, you can install a filter on a router to verify that external packets actually have external IP addresses and that internal IP addresses have internal IP addresses.

Because many distributed DoS attacks depend on “unwitting” computers being used as launch points, one way to reduce such attacks is to protect your computer against virus attacks and Trojan horses. This problem will be discussed in more detail in a later chapter, but for now, it is important that you remember three things:

Images Always use virus-scanning software and keep it updated.

Images Always keep operating system and software patches updated.

Images Have an organizational policy stating that employees cannot download anything onto their machines unless the download has been cleared by the IT staff.

Blackholing and sinkholing are techniques that are often used to mitigate DoS and DDoS attacks. If traffic is determined to be a DoS attack, that traffic is sent to a black hole—that is, a nonexistent server/interface. Internet service providers also use this tactic. Sinkholes are IP addresses that are used to analyze traffic and reject bad packets. Traffic is sent to a sinkhole so that it can be analyzed.

In addition, intrusion prevention systems (IPSs) are commonly used to examine traffic and block denial of service attacks.

As previously stated, none of these steps will make your network totally secure from either being the victim of a DoS attack or being the launch point for one, but they will help reduce the chances of either occurring. A combination of blackholing and sinkholing at the ISP with IPSs on the network can provide reasonable protection. A good resource for this topic is the SANS Institute website, at www.sans.org/dosstep/. This site has some good tips on how to prevent DoS attacks.

Summary

DoS attacks are among the most common attacks on the Internet. They are easy to perform, do not require a great deal of sophistication on the part of the perpetrator, and can have devastating effects on the target system. Only virus attacks are more common. (And, in some cases, a virus can be the source of a DoS attack.) In the exercises, you will practice stopping a DoS attack.

Test Your Skills

Multiple Choice Questions

1. When considering the various attacks that can be executed on your system, it is important to understand which attacks are most common. Of the following, which is one of the most common and simplest attacks on a system?

A. Denial of service attack

B. Buffer overflow

C. Session hacking

D. Password cracking

2. All DoS attacks are predicated on overwhelming a system’s workload capacity. Therefore, measuring the workload of a system is critical. Which of the following is not a valid way to define a computer’s workload?

A. Number of simultaneous users

B. Storage capacity

C. Maximum voltage

D. Speed of network connection

3. What do you call a DoS attack launched from several machines simultaneously?

A. Wide-area attack

B. Smurf attack

C. SYN flood

D. DDoS attack

4. It is important to understand the different types of DoS attacks and the symptoms of those attacks. Leaving a connection half open is a symptom of which type of attack?

A. Smurf attack

B. Partial attack

C. SYN flood attack

D. DDoS attack

5. While there are a wide range of different ways to execute a DoS attack, they all are predicated on the same idea. What is the basic concept behind a DoS attack?

A. Computers don’t handle TCP packets well.

B. Computers can handle only a finite load.

C. Computers cannot handle large volumes of TCP traffic.

D. Computers cannot handle large loads.

6. What is the most significant weakness in a DoS attack from the attacker’s viewpoint?

A. The attack is often unsuccessful.

B. The attack is difficult to execute.

C. The attack is easy to stop.

D. The attack must be sustained.

7. What is the most common class of DoS attacks?

A. Distributed denial of service

B. Smurf attacks

C. SYN floods

D. Ping of death

8. A range of countermeasures can help defend against DoS attacks. What are three methods for protecting against SYN flood attacks?

A. SYN cookies, RST cookies, and stack tweaking

B. SYN cookies, DoS cookies, and stack tweaking

C. DoS cookies, RST cookies, and stack deletion

D. DoS cookies, SYN cookies, and stack deletion

9. Juan is explaining various DoS attacks to security operators at his company. Which attack mentioned in this chapter causes a network to perform a DoS attack on one of its own servers?

A. SYN flood

B. Ping of death

C. Smurf attack

D. DDoS

10. What is the name for a defense that depends on a hash being sent back to the requesting client?

A. Stack tweaking

B. RST cookies

C. SYN cookies

D. Hash tweaking

11. What type of defense depends on sending the client an incorrect SYN/ACK?

A. Stack tweaking

B. RST cookies

C. SYN cookies

D. Hash tweaking

12. You are attempting to explain various DoS attacks to a new security technician. You want to make sure she can differentiate between these different attacks and notice the signs of a specific attack. What type of defense depends on changing the server so that unfinished handshaking times out sooner?

A. Stack tweaking

B. RST cookies

C. SYN cookies

D. Hash tweaking

13. What type of attack is dependent on sending packets that are too large for the server to handle?

A. Ping of death

B. Smurf attack

C. Slammer attack

D. DDoS

14. You want to make sure your team can identify the various DoS attack vectors. What type of attack uses the victim’s own network routers to perform a DoS attack on the target?

A. Ping of death

B. Smurf attack

C. Slammer attack

D. DDoS

15. If you are a website developer and concerned about DoS attacks, what is one mitigation technique you can implement in the website itself?

A. Bandwidth throttling

B. Web application firewall

C. Encryption with HTTPS

D. CAPTCHA

16. How can securing internal routers help protect against DoS attacks?

A. Attacks cannot occur if the internal router is secured.

B. Because attacks originate outside the network, securing internal routers cannot help protect against DoS attacks.

C. Securing the router will only stop router-based DoS attacks.

D. It will prevent an attack from propagating across network segments.

17. What can you do to your internal network routers to help defend against DoS attacks?

A. Disallow all traffic that is not encrypted

B. Disallow all traffic that comes from outside the network

C. Disallow all traffic that comes from inside the network

D. Disallow all traffic that comes from untrusted sources

18. Dorothy is a network administrator. Her system has been experiencing an attack that is using bots to send fake requests to the cloud resources her company uses. This is causing disruption of the availability of these resources. How is this attack best described?

A. PDoS

B. DDoS

C. EDoS

D. DoS

19. No attack mitigation strategy is perfect, and you need to allow at least some traffic into and out of your network, or else your network is of no use. What can you do with your firewall to defend against at least some DoS attacks?

A. Block all incoming traffic

B. Block all incoming TCP packets

C. Block all incoming traffic on port 80

D. Block all incoming ICMP packets

20. You are trying to identify all potential DoS attack vectors. In doing so, you hope to provide mitigation for each of these attack vectors. Why will protecting against Trojan horse attacks reduce DoS attacks?

A. Many denial of service attacks are conducted by using a Trojan horse to get an unsuspecting machine to execute the DoS attack.

B. If you can stop a Trojan horse attack, you will also stop DoS attacks.

C. A Trojan horse will often open ports and thus allow DoS attacks.

D. A Trojan horse has much the same effect as a DoS attack.

Exercises

EXERCISE 4.1: Executing a DoS Attack

Note that this exercise is best done in a laboratory setting where there are several machines available for use.

Set up one machine (preferably a machine with very limited capacity) to run a small web server. (You can download Apache for free for either Windows or Linux from www.apache.org.)

Use the ping utility with various other computers to attempt to perform a simple DoS attack on that web server. This attempt is accomplished by getting other machines to begin a continuous ping of that target machine, using the command ping -l 65000 -w0 -t <target address>.

You should add only one to three lab machines to the “attack” at a time. (Start with one, add on a few more, and then add a few more.)

As you add more machines, time how long it takes for another machine to bring up the home page of the target server. Also note the threshold (that is, when that server quits responding completely).

EXERCISE 4.2: Stopping SYN Flood Attacks

Note that this exercise is advanced. Some students may wish to work in groups.

Search the Web or your operating system’s documentation for instructions on implementing either the RST cookie or the SYN cookie.

Follow those implementation instructions on either your own machine or on a machine designated by your instructor. The following websites might be of help to you in this matter:

Images Linux: https://www.rootinstall.com/tutorial/how-to-prevent-syn-flood-attacks-in-linux/

Images Windows: https://learn.microsoft.com/en-us/answers/questions/144446/synattackprotect.xhtml

Images Both Linux and Windows: https://purplesec.us/prevent-syn-flood-attack/

EXERCISE 4.3: Using Firewall Settings

This exercise is only for students with access to a lab firewall.

Use your firewall’s documentation to see how to block ICMP packets.

Set your firewall to block those packets.

EXERCISE 4.4: Using Router Settings

This exercise is only for students with access to a lab router.

Use your router’s documentation to see how to block all traffic not originating on your own network.

Set your router to block that traffic.

Projects

PROJECT 4.1: Employing Alternative Defenses

Using the Web or another research tool, search for alternative means of defending against either general DoS attacks or a specific type of DoS attack. This can be any defense other than the ones already mentioned in this chapter.

Write a brief paper concerning this defense technique.

PROJECT 4.2: Defending Against Specific Denial of Service Attacks

Using the Web or other tools, find a DoS attack that has occurred in the past 6 months. You might find some resources at www.f-secure.com.

Note how that attack was conducted.

Write a brief explanation of how you might have defended against that specific attack.

PROJECT 4.3: Hardening the TCP Stack Against DoS

Note that this project requires access to a lab machine. It is also a long project, requiring some research time on the part of the students.

Using manuals, vendor documentation, and other resources, find one method for altering TCP communications to help prevent DoS attacks.

Using this information, implement one of these methods on your lab computer.

Case Study

Runa Singh is the network administrator in charge of network security for a medium-sized company. The firm already has a firewall, its network is divided into multiple segments separated by routers, and it has updated virus scanners on all machines. Runa wants to take extra precautions to prevent DoS attacks. She takes the following actions:

Images She adjusts her firewall so that no incoming ICMP packets are allowed.

Images She changes the web server so that it uses SYN cookies.

Now consider the following questions:

Are there problems with any of her precautions? If so, what are the problems?

What additional steps would you recommend to Runa?

Chapter 5

Malware

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand viruses (worms) and how they propagate, including famous viruses like WannaCry, Pegasus, and Titanium

Images Have a working knowledge of several specific virus outbreaks

Images Understand the dynamics of virus scanners

Images Understand what a Trojan horse is and how it operates

Images Have a working knowledge of several specific Trojan horse attacks

Images Understand ransomware and the latest trends in ransomware

Images Grasp the concept of the buffer-overflow attack

Images Have a better understanding of spyware and how it enters a system

Images Defend against various attacks using sound practices, antivirus software, and antispyware software

Introduction

In Chapter 4, “Denial of Service Attacks,” we examined the denial of service (DoS) attack, which is a very common attack and one that can easily be perpetrated. In this chapter, we will continue our examination of security threats by looking at several other types of attacks. First, you will learn about virus outbreaks. Our discussion will focus on information about how and why virus attacks work, including their deployment through Trojan horses. This chapter is not a “how to create your own virus” tutorial but rather an introduction to the concepts underlying these attacks as well as an examination of some specific case studies.

This chapter will also explore viruses, worms, buffer-overflow attacks, spyware, and several other forms of malware. Each of these brings a unique approach to an attack, and each needs to be considered when defending a system. Your ability to defend against such attacks will be enhanced by expanding your knowledge of how they work. In the exercises at the end of the chapter, you will have the opportunity to research preventive methods for viruses and to try out antivirus methods from McAfee, Norton, AVG, Bitdefender, Kaspersky, Malwarebytes, and other antivirus vendors.

Before proceeding, there are two important facts to keep in mind. The first is that the categories described in this chapter are not always clear in real-world malware. For example, a single piece of malware might combine virus functionality and spyware capabilities and might also be used to launch a DoS attack. It is still important to learn and understand the categories of malware, but you also need to be aware that many real-world malware examples overlap several categories. The second fact to keep in mind is that the world of malware is very dynamic. Things are changing fast. We will look at specific examples that are worthy of study due to their prominence in the history of malware, but it is a good idea to always stay current and constantly review the most recent malware outbreaks.

Viruses

By definition, a computer virus is a program that self-replicates. Some sources define a virus as a file that must attach to another file, such as an executable, in order to run. However, that is not accurate. Generally, a virus will also have some other unpleasant function, but the self-replication and rapid spread are the hallmarks of a virus. Often this growth, in and of itself, can be a problem for an infected network. Any rapidly spreading virus can reduce the functionality and responsiveness of a network. Simply exceeding the traffic load that a network was designed to carry may render a network temporarily nonfunctional. The infamous ILOVEYOU virus actually had no negative payload, but the sheer volume of emails it generated bogged down many networks.

How a Virus Spreads

A virus usually spreads primarily in one of just a few ways. The first is to simply email itself out to everyone in your email address book. Another method is to scan your computer for connections to a network and then copy itself to other machines on the network to which your computer has access. Viruses can also reside on portable media such as USB devices or optical media. It is also possible to mask a virus with a legitimate file; in this case, it is called a Trojan horse. Sometimes a website is infected with a virus, and when someone visits the website, that person’s computer becomes infected.

The email method is one of the most common methods for virus propagation, and Microsoft Outlook may be the one email program most often hit with such virus attacks. The reason is not so much a security flaw in Outlook as it is the ease of working with Outlook. All Microsoft Office products are made so that a legitimate programmer who is writing software for a business can access many of the application’s internal objects and thereby easily create applications that integrate with the applications within the Microsoft Office suite. For example, a programmer could write an application that would access a Word document, import an Excel spreadsheet, and then use Outlook to automatically email the resulting document to interested parties. Microsoft has done a good job of making this process very easy, and it usually takes a minimum amount of programming to accomplish these tasks. Using Outlook, it takes less than five lines of code to reference Outlook and send out an email. This means a program can cause Outlook itself to send emails, unbeknownst to the user. There are numerous code examples on the Internet that show exactly how to do this, free for the taking. For this reason, it does not take a very skilled programmer to be able to access your Outlook address book and automatically send emails. Essentially, the ease of programming Outlook is why there are so many virus attacks that target Outlook.

While the overwhelming majority of virus attacks spread by exploiting the victim’s existing email software, some virus outbreaks have used other methods for propagation, such as their own internal email engine. Another virus propagation method is for a virus to simply copy itself across a network. Virus outbreaks that spread via multiple routes are becoming more common.

The method of delivering a payload can be rather simplistic and may rely more on end-user negligence than on the skill of the virus writer. Enticing users to go to websites or open files they should not visit or open is a common method for delivering a virus and one that requires no programming skill at all. Regardless of the way a virus arrives at your doorstep, once it is on your system, it will attempt to spread and, in many cases, will also attempt to cause some harm to your system. Once a virus is on your system, it can do anything that any legitimate program can do—so it could potentially delete files, change system settings, or cause other harm.

Types of Viruses

There are many different types of viruses. In this section we will briefly look at some of the major virus types. Viruses can be classified by either their method for propagation or their activities on the target computers.

Images Macro: Macro viruses infect the macros in office documents. Many office products, including Microsoft Office, allow users to write mini-programs called macros. These macros can also be written as a virus. A macro virus is written into a macro in some business application. For example, Microsoft Office allows users to write macros to automate some tasks. Microsoft Outlook is designed so that a programmer can write scripts using a subset of the Visual Basic programming language, called Visual Basic for Applications (VBA). This scripting language is, in fact, built into all Microsoft Office products. Programmers can also use the closely related VBScript language. Both languages are quite easy to learn. If such a script is attached to an email and the recipient is using Outlook, then the script can execute. That execution can do any number of things, including scan the address book, look for addresses, send out email, delete email, and more.

Images Boot sector: As the name suggests, this type of virus infects the boot sector of a drive. Such viruses can be difficult for antivirus software to find because most antivirus software runs within the operating system, not in the boot sector.

Images Multi-partite: Multi-partite viruses attack the computer in multiple ways, for example, infecting the boot sector of the hard disk and one or more files.

Images Memory resident: A memory-resident virus installs itself and then remains in RAM from the time the computer is booted up to when it is shut down.

Images Armored: An armored virus uses techniques that make it hard to analyze. Code confusion is one such method. The code is written such that if the virus is disassembled, the code won’t be easily followed. Compressed code is another method for armoring a virus.

Images Sparse infector: A sparse infector virus attempts to elude detection by performing its malicious activities only sporadically. With a sparse infector virus, the user will see symptoms for a short period, then no symptoms for a time. In some cases the sparse infector targets a specific program but the virus executes only every 10th time or 20th time that target program executes. Or a sparse infector may have a burst of activity and then lie dormant for a period of time. There are a number of variations on the theme, but the basic principle is the same: to reduce the frequency of attack and thus reduce the chances for detection.

Images Polymorphic: A polymorphic virus literally changes its form from time to time to avoid detection by antivirus software.

Images Metamorphic: A metamorphic virus is a special case of the polymorphic virus that completely rewrites itself periodically. Such viruses are very rare.

Images Memory resident: A memory-resident virus loads into memory. If this virus was launched by a host application, then even after the host application has unloaded and stopped executing, the memory-resident virus will stay active in memory.

These major categories define the general behavior of viruses. Certainly there are other categories, but they are contained within the major categories in this list. For example, the cavity virus, also called the space filler virus, looks for cavities in existing files to insert virus code into. A virus in any of the previously listed categories could install itself as a cavity virus. On the other hand, an overwrite virus completely overwrites an existing file (often a system file).

Virus Examples

The threat from virus attacks cannot be overstated. While many web pages give information on viruses, in my opinion, there are only a handful of web pages that consistently give the latest, most reliable, most detailed information on virus outbreaks. Any security professional will want to consult these sites on a regular basis. You can read more about viruses, past and current, at the following websites:

Images https://www.csoonline.com/article/3295877/what-is-malware-viruses-worms-trojans-and-beyond.xhtml

Images https://us.norton.com/internetsecurity-malware-virus-faq.xhtml

Images https://www.us-cert.gov/publications/virus-basics

Images https://www.cm-alliance.com/cybersecurity-blog/5-major-ransomware-attacks-of-2022

Images https://www.makeuseof.com/most-notorious-malware-attacks-ever/

The following sections will look at a number of real-world virus outbreaks. We will examine very recent viruses as well as some examples from 10 or more years in the past. This should give you a fairly complete overview of how viruses behave in the real world.

Black Basta

Black Basta is ransomware that was first discovered in April 2022. One of the nuances that make this ransomware notable is that there are variants for Linux as well as Windows. When on a Windows domain controller, Black Basta will create a group policy to disable Windows Defender and other antivirus solutions. This is a particularly pernicious aspect of the virus. Another harmful aspect of this malware is that it steals data and then encrypts the computer files and demands ransom. The perpetrators will begin leaking stolen data if the ransom is not paid.

Titanium

In November 2019, Kaspersky Labs reported Titanium, a backdoor malware advanced persistent threat (APT). APTs are simply advanced attacks that work over a prolonged period of time. Titanium installs in multiple stages. Much of it is hidden in a carrier image file, usually a PNG file. Once on a computer, it will steal files on the computer, thus making it spyware. (As you will see in this chapter, it is common for malware to fit into more than one category.) It will also alter configuration settings on the infected computer as well as receive commands from a remote server.

WannaCry

In March 2017, WannaCry hit the world in a storm of activity, and this virus will be studied for many years to come. There are several reasons for this. The first reason this virus is noteworthy is that there was a patch for the vulnerability it exploited, and that patch had been available for weeks. This illustrates why patch management is such an important part of cybersecurity.

The WannaCry virus had an odd feature: It had a built-in kill switch. If a particular URL was registered, that would kill WannaCry. A man named Marcus Hutchins accidentally discovered the kill switch and stopped WannaCry. Hutchins was initially hailed as a hero, but he was later arrested by the FBI (not in connection with WannaCry) for developing and selling banking Trojan malware.

Petya

Petya was first discovered in 2016 and continued to spread all the way into 2018. It targeted Windows machines, infecting the boot sector and encrypting the hard drive’s file system. It then demanded payment in bitcoin. This is an excellent example of a virus combining multiple features. The virus’s name comes from the 1995 James Bond movie Golden Eye, in which Petya is one of the Soviet weapons satellites.

Shamoon

The Shamoon virus was first discovered in 2012, and a variant resurged in 2017. Shamoon acts as spyware but deletes files after it has uploaded them to the attacker. The virus attacked Saudi Aramco workstations, and a group named Cutting Sword of Justice claimed responsibility for the attack.

Rombertik

Rombertik wreaked havoc in 2015. This malware uses a browser to read user credentials for websites. It is most often sent as an attachment to an email. Perhaps even worse, in some situations Rombertik will either overwrite the master boot record on the hard drive, making the machine unbootable, or begin encrypting files in the user’s home directory.

Gameover ZeuS

Gameover ZeuS is a virus that creates a peer-to-peer botnet. Essentially, it establishes encrypted communication between infected computers and the command and control computer, allowing the attacker to control the various infected computers. (A command and control computer is the computer used in a botnet to control the other computers. These are the central nodes from which a botnet will be managed.) In 2014 the U.S. Department of Justice was able to temporarily shut down communication with the command and control computers; then in 2015 the FBI announced a reward of $3 million for information leading to the capture of Evgeniy Bogachev for his alleged involvement with Gameover ZeuS.

CryptoLocker and CryptoWall

One of the most widely known examples of ransomware is the infamous CryptoLocker, first discovered in 2013. CryptoLocker utilized asymmetric encryption to lock the user’s files. Several varieties of CryptoLocker have been detected.

CryptoWall is a variant of CryptoLocker first found in August 2014. It looked and behaved much like CryptoLocker. In addition to encrypting sensitive files, however, it would communicate with a command and control server and even take a screenshot of the infected machine. By March 2015 a variation of CryptoWall had been discovered bundled with the spyware TSPY_FAREIT.YOI; this variant actually steals credentials from the infected system in addition to holding files for ransom.

IoT Malware

With the burgeoning use of IoT devices, it should come as no surprise that these devices are increasingly being targeted by malware. Perhaps the most widely known IoT malware was Marai. Throughout 2016, Marai infected IoT devices running Linux, turning them into bots that could be remotely controlled. These devices were then used to perform distributed denial of service attacks.

While noteworthy, Mirai was not the first malware to target IoT devices. From 2014 to 2016 BASHLITE plagued IoT devices. This malware, which was written in C, could be compiled to a range of architectures and operating systems. It was used primarily to launch denial of service attacks.

Atlanta’s Ransomware Attack

The city of Atlanta, Georgia, was hit with ransomware in March 2018. Many of the city’s systems were impacted, including utilities, courts, and other essential systems. Two Iranian hackers, Faramarz Savandi and Mohammed Mansouri, were indicted for the attack. This attack is noteworthy for several reasons. The first is that it used the SamSam ransomware, which gets access to systems not through phishing but rather via brute-force password guessing. The second issue is that Atlanta had previously been criticized for failing to spend adequately on security. An audit just 2 months before the attack had found 1500 to 2000 vulnerabilities.

Mindware

In 2022, Mindware become a substantial threat. Attacks with this ransomware began to be noted in March and April 2022. Among other targets, Mindware was used against nonprofit mental health providers. In addition to being ransomware, this malware steals data. Data from victims in the financial and manufacturing industries that was stolen by Mindware has been posted to the Internet. Each Mindware payload is configured for a particular target. This is rather unusual in the ransomware arena. Once the target is infected, the payload drops a hard-coded ransomware note demanding payment and discouraging attempts to circumvent the ransomware.

Thanatos

The Thanatos ransomware was first seen in 2018. It first encrypts files and then places a readme.txt file on the desktop. This file has a brief message instructing the victim to pay (in bitcoin) to have their files released. The keys are actually hidden on a remote server controlled by the criminals executing the attack. Unlike with previous ransomware attacks, the attackers behind Thanatos often did not decrypt the files even if ransom was paid.

Clop

Clop (sometimes spelled Cl0p with a zero rather than an o) was first seen in 2019 as a variant of the CryptoMix ransomware family that first began to be seen in 2016. Clop began to show up widely in 2021. In addition to encrypting files, Clop also blocks about 600 Windows processes. An estimated $500 million had been paid out in ransom due to Clop as of November 2021. New variations of Clop are attacking entire networks. An interesting aspect of Clop is that it operates as ransomware as a service. Maastricht University in the Netherlands was hit with Clop.

FakeAV

While the FakeAV virus has been around for several years, it is well worth studying. This virus, which first appeared in July 2012, affected Windows systems ranging from Windows 95 to Windows 10 and Windows Server 2016. It was a fake antivirus (thus the name FakeAV) that would pop up fake virus warnings. This was not the first such fake antivirus malware, but it is a successful example of the type.

MacDefender

The MacDefender virus is very interesting for multiple reasons. First, it specifically targets Mac computers. Most experts for a long time agreed that Apple products remained relatively virus free simply because their products did not have enough market share to attract the attention of virus writers. Many suspected that if Apple garnered a greater market share, it would also begin to experience more virus attacks, and this has proven to be true.

The MacDefender virus was first seen in the early months of 2011, and variations are still seen today. It is embedded in some web pages, and when a user visits those web pages, she is given a fake virus scan that tells her she has a virus, and it needs to be fixed. The “fix” is actually downloading a virus. The point of the virus is to get end users to purchase the MacDefender “antivirus” product. This is the second reason this case is noteworthy. Fake antivirus attacks, also known as scareware, have become increasingly common.

Kedi RAT

In September 2017 the Kedi RAT (Remote Access Trojan) virus was spreading through phishing emails. Once on an infected system, it would steal data, and then it would exfiltrate that data by emailing it via a Gmail account. It specifically attempted to identify personal and/or financial data on the infected system to sell.

The Sobig Virus

Sobig, which was first found in 2003, is not a recent virus, but it is an excellent virus to study because it received a lot of media attention and caused a lot of harm when it hit. This virus used a multimodal approach to spreading—that is, it used more than one mechanism to spread and infect new machines. It would copy itself to any shared drives on your network and would email itself out to everyone in your address book. Sobig was therefore particularly virulent, which is also why it is important to study.

Fyi: Virulent Virus

The term virulent means essentially the same thing in reference to a computer virus as it does in relationship to a biological virus: It is a measure of how rapidly the infection spreads and how easily it infects new targets.

If one person on a network was unfortunate enough to open an email containing the Sobig virus, not only would his machine be infected, but so would every shared drive on that network to which that person had access. However, Sobig, like most other email-distributed virus attacks, had telltale signs in the email subject or title that could be used to identify the email as one infected by a virus. The email would have some enticing title such as “here is the sample” or “the document” to encourage you to be curious enough to open the attached file. The virus would then copy itself into the Windows System directory.

This particular virus spread so far and infected so many networks that the multiple copying of the virus alone was enough to bring some networks to a standstill. This virus did not destroy files or damage the system, but it generated a great deal of traffic that bogged down the networks it infected. The virus itself was of moderate sophistication. Once it was out, however, many variants began to spring up, further complicating the situation. One of the effects of some variants of Sobig was to download a file from the Internet that would then cause printing problems. Some network printers would just start printing junk. The Sobig.E variant would even write to the Windows Registry, causing itself to be in the computer startup. These complex characteristics indicate that the creator knew how to access the Windows Registry, access shared drives, alter the Windows startup, and access Outlook.

This brings up the issue of virus variants and how they occur. In the case of a biological virus, mutations in the genetic code cause new virus strains to appear, and the pressures of natural selection allow some of these strains to evolve into entirely new species of viruses. Obviously, the biological method is not what occurs with a computer virus. With a computer virus, some intrepid programmer with malicious intent gets a copy of a virus (perhaps her own machine becomes infected) and then reverse-engineers it. Since many virus attacks are in the form of a script attached to an email, unlike with traditionally compiled programs, the source code of these attacks is readily readable and alterable. The programmer in question then simply takes the original virus code, introduces some change, and rereleases the variant. Frequently, the people who are caught for virus creation are actually the developers of the variants who lacked the skill of the original virus writer and therefore were easily caught.

Shlayer

The Shlayer virus, which was first discovered in 2018, exploited a vulnerability that was not patched until April 2021. In fact, the largest number of infections occurred in the weeks leading up to the release of the patch. This virus targets macOS and specifically operates as a first-stage downloader that installs a variety of other malicious programs.

The Mimail Virus

Mimail is another older virus that is still worth studying. The Mimail virus did not receive as much media attention as Sobig, but it had some intriguing characteristics. This virus collected email addresses not only from your address book but also from other documents on your machine. Thus, if you had a Word document on your hard drive and an email address was in that document, Mimail would find it. This strategy meant that Mimail would spread further than many other viruses. Mimail had its own built-in email engine, so it did not have to “piggyback” off your email client. It could spread regardless of what email software you used.

These two differences from most viruses make Mimail interesting to people who study computer viruses. There are a variety of techniques that allow you to programmatically open and process files on your computer; however, most virus attacks do not employ them. The scanning of the document for email addresses indicates a certain level of skill and creativity on the part of the virus writer. In this author’s opinion, Mimail was not the work of an amateur but rather a person with professional-level programming skill.

A Nonvirus Virus

Another type of virus has been seen for several years now, and that is the “nonvirus virus” or, put simply, a hoax. Rather than actually writing a virus, a hacker sends an email to every address he has. The email claims to be from some well-known antivirus center and warns of a new virus that is circulating. The email instructs people to delete some file from their computer to get rid of the virus. The file, however, is not really a virus but part of a computer’s system. The jdbgmgr.exe virus hoax used this scheme. It encouraged the reader to delete a file that was actually needed by the system. Surprisingly, a number of people followed this advice and not only deleted the file but promptly emailed their friends and colleagues to warn them to delete the file from their machines.

Fyi: The Morris Internet Worm

The Morris worm was one of the first computer worms ever to be distributed over the Internet—and it was certainly the first to gain any significant media attention.

Robert Tappan Morris, Jr., then a student at Cornell University, wrote this worm and launched it from an MIT system on November 2, 1988. Morris did not actually intend to cause damage with the worm. Instead, he wanted the worm to reveal bugs in the programs it exploited in order to spread. However, bugs in the code allowed an individual computer to be infected multiple times, and the worm became a menace. Each additional “infection” spawned a new process on the infected computer. At a certain point, the large number of processes running on an infected machine slowed down the computer to the point of being unusable. At least 6000 UNIX machines were infected with this worm.

Morris was convicted of violating the 1986 Computer Fraud and Abuse Act and was sentenced to a $10,000 fine, 3 years’ probation, and 400 hours of community service. But perhaps the greatest impact of this worm was that it led to the creation of the Computer Emergency Response Team (CERT). CERT (www.cert.org) is an organization hosted at Carnegie Mellon University that is a repository for security bulletins, information, and guidelines. CERT is a source that any security professional should be familiar with.

Flame

No modern discussion of viruses would be complete without a discussion of Flame. While this is a few years back, it is still so important for the understanding of viruses. This virus, which first appeared in 2012, targeted Windows operating systems. The first item that makes this virus notable is that it was specifically designed by the U.S. government for espionage. It was discovered in May 2012 at several locations, including Iranian government sites. Flame is spyware that can monitor network traffic and take screenshots of the infected system.

The Earliest Viruses

It is instructive to consider the very first viruses ever found. In 1971, Bob Thomas created what is widely believed to be the first computer virus, named Creeper. It spread through the ARPANET (the precursor to the Internet) and displayed a message “I’m the creeper, catch me if you can!” Another program, named Reaper, was created to delete Creeper.

Wabbit, which was found in 1974, made multiple copies of itself, thus adversely affecting the performance of the infected computer.

Apple Viruses 1, 2, and 3 are some of the first viruses “in the wild,” or in the public domain. These viruses, which were found on the Apple II operating system in 1981, spread through Texas A&M via pirated computer games.

The Impact of Viruses

In early 2018, Taiwan Semiconductor Manufacturing Company, one of the largest chipmakers and a supplier for Apple, said it had been hit by a computer virus that had affected computer systems and fabrication tools. Estimates placed the damages over $170 million. The specific virus was not described in the news reports, but a single company being hit with a single virus causing so much havoc illustrates the dangers of computer viruses.

Machine Learning and Malware

Any new technology will eventually be coopted by unscrupulous individuals and groups. Machine learning is no exception. A 2021 paper on machine learning cyber attacks stated:¹

1. https://arxiv.org/abs/2102.07969

Stealing attack against controlled information, along with the increasing number of information leakage incidents, has become an emerging cyber security threat in recent years. Due to the booming development and deployment of advanced analytics solutions, novel stealing attacks utilize machine learning (ML) algorithms to achieve high success rate and cause a lot of damage. Detecting and defending against such attacks is challenging and urgent so that governments, organizations, and individuals should attach great importance to the ML-based stealing attacks. This survey presents the recent advances in this new type of attack and corresponding countermeasures. The ML-based stealing attack is reviewed in perspectives of three categories of targeted controlled information, including controlled user activities, controlled ML model-related information, and controlled authentication information. Recent publications are summarized to generalize an overarching attack methodology and to derive the limitations and future directions of ML-based stealing attacks. Furthermore, countermeasures are proposed towards developing effective protections from three aspects—detection, disruption, and isolation.

In December 2020, Panda Security published an online article² warning that the future of cyberthreats is likely to include malware that learns. The article predicted the use of self-learning malware in the coming years, and guessed that a major attack with machine learning malware could be seen as early as 2024. A 2019 article published in ZDNet, “Adversarial AI: Cybersecurity Battles Are Coming,”³ describes the expected use of AI and ML in offensive operations, with the possibility of attacks completely executed by AI.

2. https://www.pandasecurity.com/en/mediacenter/security/cyberthreats-learning-malware/

3. https://www.zdnet.com/article/adversarial-ai-cybersecurity-battles-are-coming/

Rules for Avoiding Viruses

You should notice a common theme among virus attacks (except for hoaxes): They want you to open some type of attachment. The most common way for a virus to spread is as an email attachment. Knowing this, you can follow a few simple rules to drastically reduce the odds of becoming infected with a virus:

Images Use a virus scanner. McAfee and Norton (explored in the exercises at the end of this chapter) are the two most widely accepted and used virus scanners. However, Kaspersky and AVG are also good, reputable choices. Each costs about $30 per year to keep your virus scanner updated. Do it. Each antivirus product has proponents and detractors, and I won’t delve into the opinions on which is better. For most users, any of the four major antivirus programs would be effective. I rotate which one I use periodically just so I can stay familiar with all of them.

Images If you are not sure about an attachment, do not open it.

Images You might even exchange a code word with friends and colleagues. Tell them that if they wish to send you an attachment, they should put the code word in the title of the message. If you don’t see the code word, you will not open any attachment.

Images Do not believe “security alerts” that are sent to you. Microsoft does not send out alerts in this manner. Check the Microsoft website regularly, as well as the website of one of the antivirus products previously mentioned.

These rules will not make your system 100% virus proof, but they will go a long way toward protecting your system.

Trojan Horses

Recall from earlier chapters that Trojan horse is a term for a program that looks benign but actually has a malicious purpose. We have already seen examples of viruses that are delivered via Trojan horse. You might receive or download a program that appears to be a harmless business utility or game. More likely, the Trojan horse is just a script attached to a benign-looking email. When you run the program or open the attachment, it does something other than or in addition to what you thought it would. It might do any of the following:

Images Download harmful software from a website.

Images Install a key logger or other spyware on your machine.

Images Delete files.

Images Open a backdoor for a hacker to use.

Combination virus/Trojan horse attacks are common. In those scenarios, the Trojan horse spreads like a virus. For example, the MyDoom virus opened a port on a machine that a later virus, doomjuice, would exploit, thus making MyDoom a combination of a virus and a Trojan horse.

A Trojan horse can also be crafted especially for an individual. If a hacker wished to spy on a certain individual, such as the company accountant, he could craft a program specifically to attract that person’s attention. For example, if he knew the accountant was an avid golfer, he could write a program that computed the person’s handicap and listed the best golf courses. He would post that program on a free web server. He would then email a number of people, including the accountant, telling them about the free software. The software, once installed, could check the name of the currently logged-on person. If the logged-on name matched the accountant’s name, the software could then go out, unbeknownst to the user, and download a key logger or other monitoring application. If the software did not damage files or replicate itself, then it would probably go undetected for quite a long time. There have been a number of Trojan horses through the years. One of the earliest and most widely known was Back Orifice.

Fyi: Virus or Worm?

As noted in Chapter 4, there is disagreement among the experts about the distinction between a virus and a worm. Some experts would call MyDoom (as well as Sasser, which will be discussed later) a worm because it spread without human intervention. However, I would define a virus as any file that can self-replicate and a worm as any program that can propagate without human interference. This is also the most common definition you will find among security experts.

Such a program could be within the skillset of virtually any moderately competent programmer. This is one reason that many organizations have rules against downloading any software onto company machines. I am unaware of any actual incident of a Trojan horse being custom tailored in this fashion. However, it is important to remember that those creating virus attacks tend to be innovative people.

It is also important to note that creating a Trojan horse does not require programming skill. There are free tools on the Internet, such as EliteWrapper, that allow someone to combine two programs—one hidden and one not. So one could easily take a virus and combine it with, for example, a poker game. The end user would see only the poker game, but when it was run, it would launch the virus.

Another scenario to consider is one that would be quite devastating. Without divulging programming details, the basic premise will be outlined here to illustrate the grave dangers of Trojan horses. Imagine a small application that displays a series of patriotic images that praise veterans. This application would probably be popular with many people in the United States, particularly people in the military, intelligence community, or defense-related industries. Now assume that this application simply sits dormant on the machine for a period of time. It need not replicate like a virus because the computer user will probably send it to many of his associates. On a certain date and time, the software connects to any drive it can, including network drives, and begins deleting all files. If such a Trojan horse were released “in the wild,” within 30 days it would probably be shipped to thousands, perhaps millions, of people. Those thousands or millions of computers would then begin deleting files and folders. Imagine the devastation.

This scenario is mentioned precisely to frighten you a little. Computer users, including professionals who should know better, routinely download all sorts of things from the Internet, such as amusing videos and cute games. Every time an employee downloads something of this nature, there is a chance of downloading a Trojan horse. One need not be a statistician to realize that if employees continue that practice long enough, they will eventually download a Trojan horse onto a company machine. If they do, hopefully the virus will not be as vicious as the theoretical one just outlined here.

Because Trojan horses are usually installed by users themselves, the security countermeasure for this attack is to prevent downloads and installations by end users. From a law enforcement perspective, the investigation of a crime involving a Trojan horse would involve a forensic scan of the computer hard drive, looking for the Trojan horse itself.

There are a number of tools, some free for download, that will help a person create a Trojan horse. One that I use in my penetration testing classes is eLiTeWrap. It is easy to use. Essentially, it can bind any two programs together. Using a tool such as this one, anyone can bind a virus or spyware to an innocuous program such as a shareware poker game. This would lead to a large number of people downloading what they believe is a free game and unknowingly installing malware on their own system.

The eLiTeWrap tool is a command line tool, but it is very easy to use. Just follow these steps:

Enter the file you want to run that is visible.

Enter the operation:

Images 1—Pack only

Images 2—Pack and execute, visible, asynchronously

Images 3—Pack and execute, hidden, asynchronously

Images 4—Pack and execute, visible, synchronously

Images 5—Pack and execute, hidden, synchronously

Images 6—Execute only, visible, asynchronously

Images 7—Execute only, hidden, asynchronously

Images 8—Execute only, visible, synchronously

Images 9—Execute only, hidden, synchronously

Enter the command line.

Enter the second file (the item you are surreptitiously installing).

Enter the operation.

When done with files, press Enter.

In Figure 5.1 you can see a demonstration that is appropriate for a classroom laboratory. In this example, two innocuous programs are combined into one Trojan horse. The programs chosen are simple Windows utilities that won’t harm the computer. However, this example illustrates how easy it would be to combine legitimate programs with malware for delivery to a target computer.

Figure 5.1 eLiTeWrap.

This illustration is meant to show how easy it is to create a Trojan horse, not to encourage you to do so. It is important to understand just how easy this process is so you can understand the prevalence of malware. Any attachment or download should be treated with significant suspicion.

The Buffer-Overflow Attack

You have become knowledgeable about a number of ways to attack a target system: denial of service, virus, and Trojan horse. While these attacks are probably the most common, they are not the only methods. Another method of attacking a system is called a buffer-overflow (or buffer-overrun) attack. A buffer-overflow attack happens when someone tries to put more data in a buffer than the buffer was designed to hold. Any program that communicates with the Internet or a private network must take in some data. This data is stored, at least temporarily, in a space in memory called a buffer. If the programmer who wrote the application was careful, then when you try to place too much information into a buffer, that information is simply truncated or outright rejected. Given the number of applications that might be running on a target system and the number of buffers in each application, the chances of having at least one buffer that was not written properly are significant enough to cause any prudent person some concern.

Someone who is moderately skilled in programming can write a program that purposefully writes more into the buffer than it can hold. For example, if the buffer can hold 1024 bytes of data and you try to fill it with 2048 bytes, the computer simply loads the extra 1024 bytes into memory. If that extra data is actually a malicious program, then it has just been loaded into memory and is thus now running on the target system. Or, perhaps the perpetrator simply wants to flood the target machine’s memory, thus overwriting other items that are currently in memory and causing them to crash. Either way, the buffer overflow is a very serious attack.

Fortunately, buffer-overflow attacks are a bit harder to execute than DoS attacks or simple Microsoft Outlook script viruses. To create a buffer-overflow attack, you must have a good working knowledge of some programming language (C or C++ is often chosen) and understand the target operating system/application well enough to know whether it has a buffer-overflow weakness and how that weakness might be exploited.

It must be noted that modern operating systems and web servers are not generally susceptible to common buffer-overflow attacks. Windows 95 was quite susceptible, but it has been many years since a Windows operating system was susceptible. Certainly Windows 7, 8, 10, or 11 cannot be compromised with this type of attack. However, the same cannot necessarily be said for all the custom applications developed to run on various systems. It is always possible that an Internet-enabled application, including but not limited to web applications, might be susceptible to this kind of attack.

Essentially, this vulnerability exists only if programmers fail to program correctly. If all programs truncate extra data, then a buffer overflow cannot be executed on a system. However, if a program does not check the boundaries of variables and arrays and allows excess data to be loaded, then that system is vulnerable to a buffer overflow.

The Sasser Virus/Buffer Overflow

Sasser is an older form of malware but one that demonstrates the use of a buffer-overflow attack. Sasser involves a combination of a virus (or worm) that spreads by exploiting a buffer overrun.

The Sasser virus spreads by exploiting a known flaw in a Windows system program. Sasser copies itself to the Windows directory as avserve.exe and creates a Registry key to load itself at startup. Therefore, once your machine is infected, you will start the virus every time you start the machine. This virus scans random IP addresses, listening on successive TCP ports starting at 1068 for exploitable systems—that is, systems that have not been patched to fix this flaw. When one is found, the worm exploits the vulnerable system by overflowing a buffer in LSASS.EXE, which is a file that is part of the Windows operating system. That executable is a built-in system file and is part of Windows. Sasser also acts as an FTP server on TCP port 5554, and it creates a remote shell on TCP port 9996. Next, Sasser creates an FTP script named cmd.ftp on the remote host and executes it. This FTP script instructs the target victim to download and execute the worm from the infected host. The infected host accepts this FTP traffic on TCP port 5554. The computer also creates a file named win.log on the C: drive. This file contains the IP address of the localhost. Copies of the virus are created in the Windows System directory as #_up.exe. Examples are shown here:

Images c:\WINDOWS\system32\12553_up.exe

Images c:\WINDOWS\system32\17923_up.exe

Images c:\WINDOWS\system32\29679_up.exe

A side effect of this virus is that it causes your machine to reboot. A machine that is repeatedly rebooting without any other known cause may well be infected with the Sasser virus.

This is another case in which the infection can easily be prevented by several means. First, if you update your systems on a regular basis, those systems should not be vulnerable to this flaw. Second, if you ensure that your network’s routers or firewall block traffic on the ports involved (9996 and 5554), you will prevent most of Sasser’s damage. Your firewall should only allow traffic on specified ports; all other ports should be shut down. In short, if you as the network administrator are aware of security issues and are taking prudent steps to protect the network, your network will be safe. Many networks have been affected by this virus, however, indicating that not enough administrators are properly trained in computer security.

Spyware

In Chapter 1, “Introduction to Computer Security,” spyware was mentioned as one of the threats to computer security. Using spyware, however, requires a great deal more technical knowledge on the part of the perpetrator than do some other forms of malware. The perpetrator must be able to develop spyware for the particular situation or customize existing spyware for his needs. He must then be able to get the spyware on the target machine.

Spyware can be as simple as a cookie used by a website to record a few brief facts about your visit to that website, or it could be of a more insidious type, such as a key logger. Recall from Chapter 1 that a key logger is a program that records every keystroke you make on your keyboard; this spyware then logs your keystrokes to the spy’s file. The most common use of a key logger is to capture usernames and passwords. However, this method can capture every username and password you enter and every document you type, as well as anything else you might type. This data can be stored in a small file hidden on your machine for later extraction or sent out in TCP packets to some predetermined address. In some cases, the software is even set to wait until after hours to upload this data to some server or to use your own email software to send the data to an anonymous email address. There are also some key loggers that take periodic screenshots from your machine, revealing anything that is open on your computer. Whatever the specific mode of operation, spyware is software that literally spies on your activities on a particular computer.

Legal Uses of Spyware

There are some perfectly legal uses for spyware. Some employers have embraced spyware as a means of monitoring employee use of company technology. Many companies have elected to monitor phone, email, or web traffic within the organization. Keep in mind that the computer, network, and phone systems are the property of the company or organization, not of the employee. These technologies are typically supposed to be used only for work purposes; therefore, company monitoring might not constitute an invasion of privacy. While courts have upheld this monitoring as a company’s right, it is critical to consult an attorney before initiating this level of employee monitoring as well as to consider the potential negative impact on employee morale.

Parents can also elect to use this type of software on their home computer to monitor the activities of their children on the Internet. The goal is usually a laudable application—protecting their children from online predators. Yet, as with employees in a company, the practice may illicit a strong negative reaction from the parties being spied upon (namely, their children). Parents have to weigh the risk to their children versus what might be viewed as a breach of trust.

How Is Spyware Delivered to a Target System?

Clearly, spyware programs can track all activity on a computer, and that information can be retrieved by another party via a number of different methods. The real question is this: How does spyware get onto a computer system in the first place? The most common method is through a Trojan horse. It is also possible that when you visit a certain website, spyware may download in the background while you are simply perusing the website. Of course, if an employer (or parent) is installing the spyware, it can then be installed openly in the same way that an organization would install any other application.

Pegasus

The Pegasus spyware was seen first in 2016, and then variations of it were found in 2022. This spyware affects mobile phones, and there are versions for both iPhone and Android. Given our growing dependence on our mobile devices, mobile malware is at least as important as traditional computer malware. The 2022 version of Pegasus is able to track calls and locations, collect passwords, and read text messages. What makes Pegasus especially intriguing is that it was originally developed for the Israeli government.

Obtaining Spyware Software

Given the many other utilities and tools that have been mentioned as being available from the Internet, you probably will not be surprised to learn that you can obtain many spyware products for free or at very low cost on the Internet. You can check the Counterexploitation website (www.cexx.org), shown in Figure 5.2, for a lengthy list of known spyware products circulating on the Internet and for information about methods you can use to remove them. The SpywareGuide website (www.spywareguide.com) lists spyware that you can get right off the Internet should you feel some compelling reason to spy on someone’s computer activities. Figure 5.3 shows the categories of malware that are available from this site. Several key logger applications are listed on this site, as shown in Figure 5.4. These applications include well-known key loggers such as Absolute Keylogger, Tiny Keylogger, and TypO. Most can be downloaded for free or for a nominal charge.

Figure 5.2 Counterexploitation website.

Figure 5.3 Malware categories at the SpywareGuide website.

Figure 5.4 List of key loggers available through the SpywareGuide website.

Some well-known Trojan horses are also listed at this site (as shown in Figure 5.5), such as the 2nd Thought application, which downloads to a person’s PC and then blasts it with advertisements. This particular piece of spyware is one that downloads to your PC when you visit certain websites. It is benign in that it causes no direct harm to your system or files; it also does not gather sensitive information from your PC. However, it is incredibly annoying as it inundates your machine with unwanted ads. This sort of software is often referred to as adware. Frequently, these ads cannot be stopped by normal protective pop-up blockers because the pop-up windows are not generated by a website that you visit but rather by rogue software running on your machine. Pop-up blockers only work to stop sites you visit from opening new windows. Websites use well-known scripting techniques to cause your browser to open a window, and pop-up blockers recognize these techniques and prevent the ad windows from opening. However, adware that launches a new browser instance bypasses the pop-up blocker’s function.

Figure 5.5 Trojan horses available at the SpywareGuide website.

Other Forms of Malware

This chapter and preceding chapters have discussed the most prominent forms of malware. There are, however, many other forms of attack. It is beyond the scope of this book to explore all of them, but you should be aware of the existence of some of the other forms of malware. Simply being aware can go a long way toward enabling you to defend your system efficiently. This section will touch upon just a few other forms of malware. You should reference the websites discussed in the end-of-chapter exercises and projects often so that you can stay up-to-date with all current forms of attack and defenses.

Rootkits

A rootkit is a collection of tools that a hacker uses to mask her intrusion and obtain administrator-level access to a computer or computer network. The intruder installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. The rootkit then collects user IDs and passwords to other machines on the network, thus giving the hacker root or privileged access.

A rootkit may consist of utilities that also do the following:

Images Monitor traffic and keystrokes

Images Create a backdoor into the system for the hacker’s use

Images Alter log files

Images Attack other machines on the network

Images Alter existing system tools to circumvent detection

The presence of a rootkit on a network was first documented in the early 1990s. At that time, the Sun and Linux operating systems were the primary targets for hackers looking to install rootkits. Today, rootkits are available for a number of operating systems and are increasingly difficult to detect on any network.

Malicious Web-Based Code

Malicious web-based code, also known as web-based mobile code, simply refers to code that is portable to all operating systems or platforms, such as HTTP, Java, and so on. The “malicious” part implies that it is a virus, worm, Trojan horse, or some other form of malware. Simply put, the malicious code does not care what the operating system may be or what browser is in use. It infects them all blindly.

Where does this code come from, and how it is spread? The first generation of the Internet was mostly indexed text files. However, as the Internet has grown into a graphical, multimedia user experience, programmers have created scripting languages and new application technologies to enable a more interactive experience. Programs written with scripting languages run the gamut from useful to poorly crafted to outright dangerous.

Technologies such as Java and ActiveX enable buggy or untrustworthy programs to move to and execute on user workstations. (Other technologies that can enable malicious code are executables, JavaScript, VBScript, and plug-ins.) The Web increases the mobility of code without differentiating between program quality, integrity, and reliability. Using available tools, it is quite simple to drag and drop code into documents that are subsequently placed on web servers and made available to employees throughout the organization or individuals across the Internet. If this code is maliciously programmed or just improperly tested, it can cause serious damage.

Not surprisingly, hackers have used these very useful tools to steal, alter, and erase data files as well as gain unauthorized access to corporate networks. A malicious code attack can penetrate corporate networks and systems from a variety of access points, including websites, HTML content in email messages, or corporate intranets.

Today, with billions of Internet users, new malicious code attacks can spread through corporations almost instantly. The majority of damage caused by malicious code happens in the first hours after a first-strike attack occurs—before there is time for countermeasures. The costs of network downtime or theft of IP make malicious code a top priority.

Logic Bombs

A logic bomb is a type of malware that executes its malicious purpose when a specific criterion is met. The most common factor is date/time. For example, a logic bomb might delete files on a certain date/time. For example, in June 2006, Roger Duronio, a system administrator for UBS, was charged with using a logic bomb to damage the company’s computer network. His plan was to drive the company stock down due to damage from the logic bomb, so he was charged with securities fraud. Duronio was later convicted and sentenced to 8 years and 1 month in prison and ordered to pay $3.1 million in restitution to UBS. As this case illustrates, this problem is not new.

In 2017 Mittesh Das of Atlanta, Georgia, was found guilty of transmitting malicious code with the intent of causing damage to a U.S. Army computer. Das created a logic bomb that would delete files in U.S. Army Reserve payroll systems after his company lost the contract. The incident actually occurred in 2014. He was sentenced to 2 years in prison followed by 3 years of probation.

Nimesh Patel is alleged to have created a logic bomb to attack his former employer’s servers in 2016. He is alleged to have logged on to the network after his employment ended and uploaded malware. The software was designed to delete financial data from the Oracle database.

Another example occurred at the mortgage company Fannie Mae. On October 29, 2008, a logic bomb was discovered in the company’s systems. While this is an older example, it is an important one in the history of logic bombs. This logic bomb had been planted by a former contractor, Rajendrasinh Makwana, who had been terminated. The bomb was set to activate on January 31, 2009, and completely wipe all of the company’s servers. Makwana was indicted in a Maryland court on January 27, 2009, for unauthorized computer access. On December 17, 2010, he was convicted and sentenced to 41 months in prison, followed by 3 years of probation. Makwana planted the logic bomb between the time he was terminated and the time the network administrators cancelled his network access. This illustrates the importance of ensuring that the accounts of former employees are deactivated immediately when their employment is terminated—whether it is an involuntary termination, a retirement, or a voluntary quit.

Spam

Spam, which most people are familiar with, is unwanted and unsolicited email that is sent out to multiple parties. Often it is used for marketing purposes, but it can be used for much more malicious goals. For example, spam is a common vehicle for spreading viruses and worms. Spam is also used to send emails enticing recipients to visit phishing websites in order to steal their identities. At best, spam is an annoyance, and at worst, it is a vehicle for spyware, viruses, worms, and phishing attacks.

Advanced Persistent Threats

Advanced persistent threat (APT) is a relatively new term for a continuous process of attacking. It can involve hacking, social engineering, malware, or combinations of attacks. Such an attack is relatively sophisticated, thus the term advanced, and it is ongoing, thus the term persistent.

The security firm Mandiant tracked several APTs over a period of 7 years, all originating in China—specifically, Shanghai and the Pudong region. These APTs were simply named APT1, APT2, and so on.

The attacks were linked to the UNIT 61398 of China’s military. The Chinese government regards this unit’s activities as classified, but it appears that offensive cyber warfare is one of its tasks. Just one of the APTs from this group compromised 141 companies in 20 different industries. APT1 was able to maintain access to victim networks for an average of 365 days, and in one case for 1764 days. APT1 is responsible for stealing 6.5TB of information from a single organization over a 10-month time frame. We will discuss the Chinese attack in more detail in Chapter 12, “Cyber Terrorism and Information Warfare.”

Deep Fakes

Deep fakes are not exactly malware, but they do fit well into a discussion of malware. Deep fakes are videos that look so real that they can be mistaken for being real. While a deep fake won’t harm your computer or ransom your files, it can certainly cause substantial disruption.

More disconcerting is the growing use of machine learning in deep fakes. A May 2022 Security Week article discusses deep fakes as a growing threat:⁴

4. https://www.securityweek.com/deepfakes-are-growing-threat-cybersecurity-and-society-europol

Two current developments have improved and increased the quality and threat from deepfakes. The first is the adaptation and use of generative adversarial networks (GANs). A GAN operates with two models: generative and discriminating. The discriminating model repeatedly tests the generative model against the original dataset. “With the results from these tests,” writes Europol (Law enforcement and the challenge of deepfakes—PDF), “the models continuously improve until the generated content is just as likely to come from the generative model as the training data.” The result is a false image that cannot be detected by the human eye but is under the control of an attacker.

The second threat comes from 5G bandwidth and the compute power of the cloud, allowing video streams to be manipulated in real time. “Deepfake technologies can therefore be applied in videoconferencing settings, live-streaming video services and television,” writes Europol.

Detecting and Eliminating Viruses and Spyware

Once you understand the nature of malware and just how devastating it can be, the next logical step is to detect and remove malware.

Antivirus Software

In this chapter and throughout the rest of this book, we have discussed the need for running virus-scanning software. This section provides some details on how virus scanners work and information on the major virus-scanning software packages. This information should help you better understand how a virus scanner might protect your system and help you make intelligent decisions regarding the purchase and deployment of an antivirus solution.

A virus scanner can work in one of two ways. The first is to look for a signature (or pattern) that matches a known virus. It is therefore important to keep your virus software updated so that you have the most recent list of signatures with which to work.

The other way in which a virus scanner might check a given PC is to look at the behavior of an executable. If a program behaves in a way consistent with virus activity, the virus scanner may flag it as a virus. Such activity could include the following:

Images Attempting to copy itself

Images Attempting to access the address book of the system’s email program

Images Attempting to change Registry settings in Windows

Figure 5.6 shows the Norton Security antivirus software in action. You can see that the virus definitions are up-to-date, virus scanning is enabled, auto-protection is enabled, and Internet worm protection is enabled as well. The other popular virus scanners have many of the same features.

Figure 5.6 Norton Security interface.

Most antivirus software today offers additional features, such as the ability to warn the user of known phishing websites, detect spyware as well as viruses, and even detect likely phishing attempts. Any modern antivirus product should be a comprehensive package, protecting against a variety of attacks, rather than just stopping viruses.

As mentioned earlier, there are many antivirus vendors. McAfee, Bitdefender, Kaspersky, AVG, and Malwarebytes are some of the most widely known.

McAfee offers solutions for the home user and large organizations. All of McAfee’s products have some common features, including email scanning and file scanning. They also scan instant messaging traffic. Figure 5.7 displays a screenshot of McAfee.

Figure 5.7 McAfee antivirus interface.

Avast (see Figure 5.8) is another widely used antivirus product. This product is offered for free for home, noncommercial uses. You can download the product from the vendor’s website: www.avast.com. You can also find professional versions, versions for UNIX or Linux, and versions specifically for servers. In addition, Avast is available in multiple languages, including English, Dutch, Finnish, French, German, Spanish, Italian, and Hungarian.

Figure 5.8 Avast antivirus interface.

AVG antivirus (see Figure 5.9), which has become quite popular, is available in a free version as well as in a commercial version.

Figure 5.9 AVG AntiVirus interface.

Malwarebytes is another widely used antivirus product. This product, available from https://www.malwarebytes.com, is available as both free and paid premium versions. Figure 5.10 shows the Malwarebytes interface.

Figure 5.10 Malwarebytes antivirus interface.

Windows Defender was first released as part of Windows Vista and Windows 7. It has grown and increased its features with each version of Windows. It is a free part of the Windows operating system. Figure 5.11 shows the main screen of Windows Defender for Windows 10.

Figure 5.11 Windows Defender main screen.

Anti-Malware and Machine Learning

Just as machine learning is becoming a part of malware, it is also a part of defending against malware. The following quote could help explain the current situation:

One of the new developments in static malware detection has been the use of deep learning for end-to-end machine learning for malware detection. In this setting, we completely skip all feature engineering; we need not have any knowledge of the PE header or other features that may be indicative of PE malware. We simply feed a stream of raw bytes into our neural network and train.⁵

5. Machine Learning for Cybersecurity Cookbook: Over 80 Recipes on How to Implement Machine Learning Algorithms for Building Security Systems Using Python

Several products currently tout machine learning as part of their antivirus approach. Among those products are:

Images Cylance Smart Antivirus

Images Deep Instinct D-Client

Images Avast Antivirus

Remediation Steps

Obviously, a crucial step in mitigating the risk from malware is running up-to-date antivirus software. I don’t endorse any particular antivirus program. McAfee, Norton, AVG, Kaspersky, and Malwarebytes are all reputable products. I do, however, recommend that if you are using both host-based antivirus and network antivirus, you should use products from two different vendors. This way, what one misses, the other is likely to catch.

In addition to running anti-malware software, there are specific steps security professionals can take to mitigate the risk from malware. Note that the goal is to mitigate the threat of malware. It is impossible to completely eliminate such threats, but you can reduce both the frequency of attacks and the severity of damage.

It is important to educate end users. End users must be made aware of the prevalence of malware. The goal is for all users on your network to be suspicious of attachments and of downloads. Certainly, there are business needs that require the use of attached documents. But you can educate users on considering a few simple questions before opening any attachment:

Images Was this attachment expected? Attachments from people you do not know or from whom you did not expect any attachment must always be treated as potential malware.

Images Is the email specific, such as “These are the third-quarter sales reports we discussed in our meeting yesterday”? Such specifics tend to indicate real email with real documents attached. But generic-sounding emails such as “Here is your document” or emails that try to convince the user that he must urgently open the attachment should be suspected of being malware.

Images Do you have significant doubts about the authenticity of an email attachment? When in doubt, ask technical support.

Taking these simple measures would eliminate many malware outbreaks.

You can take a more complicated route to render your computers virtually immune to malware: First, set up a virtual machine on your computer. There are a variety of virtual machine applications, such as VMware and Oracle Box (which is free). Then install into that virtual machine (VM) some operating system other than what the host computer runs. So if your host is a Windows 10 machine, then the VM could run Linux. If your host is a Mac, the VM could run Windows. Now if you surf the Internet inside the VM, it is almost impossible for you to get a virus on the host machine. To date, no virus has jumped the VM/host barrier, and no virus infects multiple operating systems. It should be noted that Java viruses and certain web page malware can infect browsers on different systems. However, as a general rule, a virus written for Windows won’t affect a Mac computer and vice versa.

Summary

Clearly, there are a number of ways to attack a target system: by using DoS attacks, viruses/worms, Trojan horses, buffer-overflow attacks, and spyware. Each type of attack comes in many distinct variations. There are so many ways for a hacker to attack a system that securing your system can be a rather complex task. However, it should be obvious by this point that securing your system is absolutely critical. In the upcoming exercises, you will try out antivirus programs by Norton and McAfee.

Another theme that is driven home throughout this chapter is that many, if not most, attacks are preventable. The exercises ahead will give you practice in figuring out how to prevent the Sasser and Sobig viruses. In most cases, prompt and regular patching of the system, use of antivirus tools, and blocking of unneeded ports would prevent such attacks. The fact that so many systems do get infected is an indication of the very real problem of network professionals not being skilled in computer security.

Test Your Skills

Multiple Choice Questions

1. John is a network security administrator for a midsized college. He is trying to explain to a new hire what a virus is. Which of the following is the best definition of virus?

A. A program that causes harm on your computer

B. A program used in a DoS attack

C. A program that slows down networks

D. A program that self-replicates

2. Isabelle is responsible for cybersecurity at her company. She is concerned that a virus would cause damage to the IT systems. What is the most common damage caused by virus attacks?

A. Slowing down networks by the virus traffic

B. Deleting files

C. Changing the Windows Registry

D. Corrupting the operating system

3. You are trying to form policies for your organization to mitigate the threat of viruses. You want to ensure that you address the most common way for a virus to spread. What is the most common way for a virus to spread?

A. By copying to shared folders

B. By email attachment

C. By FTP

D. By download from a website

4. Which of the following is the primary reason that Microsoft Outlook is so often a target for virus attacks?

A. Many hackers dislike Microsoft.

B. Outlook copies virus files faster.

C. It is easy to write programs that access Outlook’s inner mechanisms.

D. Outlook is more commonly used than other email systems.

5. Juan is a network administrator for a small graphic design company. In April 2021 his company was hit by a virus that specifically targeted macOS and was a first-stage downloader for other malware components. What attack was this?

A. Schlayer

B. Pegasus

C. Mirai

D. Sasser

6. What factor about the WannaCry virus is especially interesting to security practitioners?

A. It could have been prevented with good patch management.

B. It deleted critical system files.

C. It was difficult to protect against.

D. It was very sophisticated and likely an example of nation-state weaponized malware.

7. What is the name of the very first virus ever detected?

A. Creeper

B. Wabbit

C. Mimail

D. Unnamed

8. Elizabeth has found malware on a system in her company. The malware blocks about 600 Windows processes, and demands ransom. What has Elizabeth found?

A. Thanatos

B. Clop

C. Kedi RAT

D. Schlayer

9. Mohaned has found malware on his network. This malware encrypts files demanding ransom and also blocks approximately 600 Windows processes. What malware has Mohaned found?

A. Schlayer

B. Thanatos

C. Cl0p

D. Pegasus

10. Which of the following is a method that any person can use to protect against virus attacks?

A. Set up a firewall.

B. Use encrypted transmissions.

C. Use secure email software.

D. Never open unknown email attachments.

11. You are trying to develop methods to mitigate the threat of viruses in your company. Which of the following is the safest way to send and receive attachments?

A. Use a code word indicating that an attachment is legitimate.

B. Send only spreadsheet attachments.

C. Use encryption.

D. Use virus scanners before opening attachments.

12. Shelly is trying to teach new employees how to handle emailed security alerts. Which of the following is true regarding emailed security alerts?

A. You must follow them.

B. Most companies do not send alerts via email.

C. You can trust attachments on security alerts.

D. Most companies send alerts via email.

13. Which of the following is something a Trojan horse might do?

A. Open a backdoor for malicious software.

B. Change your memory configuration.

C. Change ports on your computer.

D. Alter your IP address.

14. Jared is explaining various attacks to students in an introduction to cybersecurity class. He wants to make certain they fully understand the different attacks. What does a buffer-overflow attack do?

A. It overflows a port with too many packets.

B. It puts more email in an email system than it can hold.

C. It overflows the system.

D. It puts more data in a buffer than it can hold.

15. What virus exploited buffer overflows?

A. Sobig virus

B. Mimail virus

C. Sasser virus

D. Schlayer virus

16. What can you do with a firewall to help protect against virus attacks?

A. There is nothing you can do on a firewall to stop virus attacks.

B. Shut down all unneeded ports.

C. Close all incoming ports.

D. None of the above are correct.

17. Malek is explaining various malware types to new technical support personnel. He is explaining to them the various types of malware so that they can recognized them. What type of malware is a key logger?

A. Virus

B. Buffer overflow

C. Trojan horse

D. Spyware

18. Which of the following is a step that all computer users should take to protect against virus attacks?

A. Purchase and configure a firewall.

B. Shut down all incoming ports.

C. Use nonstandard email clients.

D. Install and use antivirus software.

19. What is the primary way a virus scanner works?

A. By comparing files against a list of known virus profiles

B. By blocking files that copy themselves

C. By blocking all unknown files

D. By looking at files for virus-like behavior

20. In addition to the primary way a virus scanner works, what other way can a virus scanner work?

A. By comparing files against a list of known virus profiles

B. By blocking files that copy themselves

C. By blocking all unknown files

D. By looking at files for virus-like behavior

Exercises

EXERCISE 5.1: Using Norton Antivirus

Go to the Norton website (https://support.norton.com/sp/en/us/norton-download-install/current/info) and download the trial version of its software.

Install and run the software.

Carefully study the application, noting features that you like and dislike.

EXERCISE 5.2: Using McAfee Antivirus

Go to the McAfee antivirus website (https://www.mcafee.com/en-us/antivirus.xhtml) and download the trial version of its software.

Install and run the software.

Carefully study the application, noting features you like and dislike.

EXERCISE 5.3: Preventing Sasser

Using resources on the Web or in journals, carefully research the Sasser virus. You may find www.f-secure.com and the Symantec Security Center at https://www.symantec.com/security-center helpful in this exercise.

Write a brief essay about how Sasser spread, what damage it caused, and what steps could be taken to prevent it.

EXERCISE 5.4: Preventing Sobig

Using resources on the Web or in journals, carefully research the Sobig virus. You may find www.f-secure.com and the Symantec Security Center at https://www.symantec.com/security-center helpful in this exercise.

Write a brief essay about how Sobig spread, what damage it caused, and what steps could be taken to prevent it.

EXERCISE 5.5: Learning About Current Virus Attacks

Using resources on the Web or in journals, find a virus that has been spreading in the past 90 days. You may find www.f-secure.com and the Symantec Security Center at https://www.symantec.com/security-center helpful in this exercise.

Write a brief essay about how the virus spread, what damage it caused, and what steps could be taken to prevent it.

Projects

PROJECT 5.1: Antivirus Policies

This activity can also work as a group project.

Considering what you have learned in this chapter and in previous chapters, as well as using outside resources, write an antivirus policy for a small business or school. Your policy should include technical recommendations as well as procedural guidelines. You may choose to consult existing antivirus policy guidelines that you find on the Web to get some ideas. However, you should not simply copy these antivirus policies. Rather, you should come up with your own.

PROJECT 5.2: The Worst Virus Attacks

Using resources on the Web, in books, or in journals, find a virus outbreak that you consider to have been the worst in history. Write a brief paper describing this attack and explain why you think it is the worst. Was it widely spread? How quickly did it spread? What damage did it do?

PROJECT 5.3: Why Write a Virus?

A number of hypotheses have been formed regarding why people write viruses. These hypotheses range from the frankly conspiratorial to the academically psychological. Taking whatever position you feel is most likely, write a paper explaining why you think people take the time and effort to write a virus.

Case Study

Chiao Chien manages IT security for a school. Given the wide range of people who use the school’s computers, it is difficult for Chien to prevent virus attacks. Chien has a reasonably good budget and has installed antivirus software on every machine. He also has a firewall that has all unneeded ports blocked, and a school policy prohibits the download of any software from the Web. Consider the following questions:

How secure do you think Chien’s network is from virus attacks?

What areas has Chien not secured?

What recommendations would you make to Chien?

Chapter 6

Techniques Used by Hackers

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand the basic methodology used by hackers

Images Be familiar with some of the basic hacking tools

Images Understand the hacking mentality

Images Be able to explain specific attack methods

Introduction

The first five chapters introduced you to general security concepts. Now it is time to explore the techniques that are used to attack your network. If you do not know what the adversary knows, it is very difficult to truly secure your network. Before going any further, it is important to realize that many hackers are not criminals. A hacker is a person who wants to understand a system, often by probing its weaknesses. There are even hackers who work for organizations, testing the organizations’ system security. This is called penetration testing and also sometimes white hat hacking. There are several certifications for penetration testing:

Images Offensive Security: https://www.offensive-security.com/information-security-certifications/

Images SANS Institute: https://www.sans.org/cyber-security-courses/enterprise-penetration-testing/

Images EC-Council’s Certified Ethical Hacker: www.eccouncil.org

There is also a magazine for white hat hackers called 2600 (www.2600.com). Many computer security professionals attempt to learn hacking techniques either to enhance their security capabilities or to simply satisfy their curiosity. The techniques themselves are not criminal. However, there are people who use hacking techniques to breach systems to steal data, damage systems, or commit other cybercrimes. These people are usually referred to as black hat hackers or crackers.

The techniques presented in this chapter are presented not only to give you an understanding of how black hat hackers work but to show how you can perform penetration testing on your own network. By attempting some of these techniques on your network, you can assess your vulnerability. (It should be pointed out that you should only do this when you are very comfortable with the techniques in this chapter—and only with permission from senior management.)

Basic Terminology

Before we can delve into the world of hacking, we need to discuss the basic terminology used in this community. As you already know, the term white hat hacker is used to describe a person who uses hacking techniques for legal/ethical purposes. And the terms black hat hacker and cracker are used to describe a person who uses hacking techniques for illegal purposes.

There are a few other terms you should be familiar with. A gray hat hacker is one who was previously a black hat hacker and turned into a white hat hacker (basically, a former criminal now turned ethical). With the proliferation of tools on the Internet, there are also a lot of people who download tools (some of which we will examine in this chapter) and perform cyber attacks without really understanding what they are doing. These people are termed script kiddies (also sometimes spelled kiddys). Another important term, phreaking, refers to hacking into phones (which predates hacking into computer systems).

Often penetration testing is conducted to emulate a specific adversary or type of adversary. This is done by a red team. For example, if an organization is concerned primarily about nation-state attacks, then a red team can conduct a penetration test utilizing the same techniques that are commonly used in nation-state attacks. In contrast to the red team is the blue team, which is the defensive team attempting to stop the red team’s attack.

The Reconnaissance Phase

Any intelligent/experienced hacker is going to attempt to find out information about a target before actually attempting an attack. Just as a bank robber would want to know about a bank’s alarm systems, number of guards, police response time, and so on, a black hat hacker would want to know about your system’s security. What may surprise you is how much information can be found easily on the Internet without even attaching to the target system.

Passive Scanning Techniques

One of the easiest things a hacker can do is check the target organization’s websites. Businesses commonly post information that can be very useful to an attacker. For example, let’s assume that company XYZ lists John Doe as its IT manager. An enterprising hacker can scan bulletin boards and discussion groups for references to John Doe at XYZ. That attacker might find information useful in spear phishing attacks (that is, phishing targeted at a specific individual or group of individuals), or the attacker might find information useful in social engineering. For example, a number of former employees might have complained online that John Doe is demanding and quick to fire people. An enterprising hacker could call someone at XYZ claiming to be working for John Doe. The hacker might claim that he is trying to log on remotely to that person’s computer to update her system. After a few moments, the hacker tells the person he forgot the password John Doe gave him and is very concerned he will get fired if he doesn’t complete this assignment; then he asks that person for his password. The information the attacker gleaned from the Web gave him enough information to make this social engineering attack plausible.

It is also possible for an attacker to scan bulletin boards, chat rooms, discussion groups, and other places, looking for questions from IT staff at the target organization. For example, if an administrator posts in a discussion group asking about a particular server problem, this can give the attacker valuable information about that target network.

Another way attackers can use the Web to find out information about a target is through job ads. For example, if a company routinely advertises for ASP.NET developers and never for PHP or Perl, then it is likely that the company’s web applications are developed with ASP.NET running on a Windows web server (Internet Information Services). This can allow the attacker to focus only on a small group of possible attacks—those against ASP.NET/Windows.

Information can also be garnered from job ads. For example, if a small company with fewer than 200 employees has an advertisement for a network administrator twice a year, it is likely that the company has recently lost its old administrator because a small company would not need multiple administrators. If the current administrator is new, it means she is probably not as familiar with her own systems as the old admin. Also, if this trend of advertising for new administrators extends over a couple of years, the hacker can guess that the company has high turnover, and there is some problem the attacker may be able to exploit.

There are also specific websites that provide information an attacker may find useful. For example, netcraft.com, shown in Figure 6.1, provides information about websites. For example, you can find out what kind of server a site is running, and in some cases how long it has been since the server was last rebooted.

Figure 6.1 www.netcraft.com.

Another site that can be useful for attackers is https://archive.org. This site, shown in Figure 6.2, archives older versions of websites. The server scours the Web, archiving sites. The frequency with which a site is archived depends on its popularity.

Figure 6.2 www.archive.org.

Active Scanning Techniques

The previously mentioned techniques are all considered passive, as they do not require the attacker to connect to the target system. Since the attacker is not actually connecting to the target system, it is impossible for an intrusion detection system (IDS) to detect the scan. Active scans are far more reliable but may be detected by the target system. There are a few types of active scans.

Port Scanning

Port scanning is the process of attempting to contact each network port on the target system and see which ones are open. There are 1024 well-known ports that are usually associated with specific services. For example, port 161 is associated with Simple Network Management Protocol (SNMP). If an attacker detects port 161 open on the target system, he might decide to try SNMP-related attacks. Even more information can be derived from a port scan. For example, ports 137, 138, and 139 are all associated with NetBIOS, a very old Windows method of network communication that is not used in Windows anymore. However, NetBIOS is often used for systems where Windows machines need to communicate with Linux machines, so discovering those ports open reveals something about the target network.

A simple Google search for port scanner will reveal a host of well-known, widely used, and often free port scanners. However, the most popular port scanner in the hacking and security community is the free tool Nmap (https://nmap.org). There is a Windows version of it, called Zenmap, as shown in Figure 6.3.

Figure 6.3 Zenmap GUI.

Nmap allows you to customize a scan to make it more or less stealthy and to target certain systems. The most common types of scans are listed here:

Images Ping scan: This scan simply sends a ping to the target port. Many network administrators block incoming ICMP packets for the purpose of stopping ping scans.

Images Connect scan: This is the most reliable scan but also the type most likely to be detected. With this type of scan, a complete connection is made with the target system.

Images SYN scan: This scan is very stealthy. Most systems accept SYN (synchronize) requests. This scan is similar to the SYN flood DoS attack described in Chapter 4, “Denial of Service Attacks.” In this type of scan, you send a SYN packet but never respond when the system sends a SYN/ACK. However, unlike with a DoS SYN flood, you send only one packet per port. This is also called a half-open scan.

Images FIN scan: This scan has the FIN (connection finished) flag set. This is not an unusual packet for systems to receive, so it is considered stealthy.

Each of these scans provokes a different response on the target machine and thus provides different information to the port scanner:

Images With a FIN scan or an XMAS scan, if the target port is closed, the system sends back an RST (reset) flag packet. If it is open, there is no response.

Images With a SYN scan, if the port is closed, the response is an RST; if it is open, the response is a SYN/ACK.

Images ACK scans and NULL scans work only on UNIX systems.

Nmap also lets you set a number of flags (either with the command line version of Nmap or the Windows version) to customize the scan. The allowed flags are listed here:

-O Detects the operating system

-sP Ping scan

-sT TCP connect scan

-sS SYN scan

-sF FIN scan

-sX Xmas tree scan

-sN NULL scan

-sU UDP scan

-sO Protocol scan

-sA ACK scan

-sW Windows scan

-sR RPC scan

-sL List/DNS scan

-sI Idle scan

-Po Don’t ping

-PT TCP ping

-PS SYN ping

-PI ICMP ping

-PB TCP and ICMP ping

-PM ICMP netmask

-oN Normal output

-oX XML output

-oG Greppable output

-oA All output

-T Timing

-T0 Paranoid

-T1 Sneaking

-T2 Polite

-T3 Normal

-T4 Aggressive

-T5 Insane

As you can see, there are a number of options available to an attacker using Nmap. One can spend a lot of time just learning Nmap.

Note

There are, of course, a number of other port scanning tools. We have focused on Nmap because it is free and widely used. It also figures prominently on the EC-Council Certified Ethical Hacker certification, GPEN (from SANS), and the Professional Penetration Tester certification.

The Nmap settings are, for the most part, self-explanatory. Perhaps the timing warrants a bit more discussion, however. Timing involves how quickly to send scanning packets. Essentially, the faster you send packets, the more likely the scan is to be detected.

Here is the most basic Nmap scan:

nmap 192.168.1.1

Here is a scan of a range of IP addresses:

nmap 192.168.1.1-20

The following command scans to detect operating system, use TCP scan, and use sneaky speed:

nmap -O -PT -T1 192.168.1.1

Other Scans

There are a wide range of scans an attacker can use to probe your network. It is often a good idea to look at logs for any evidence that such scans are being conducted against your network. Even if an attacker is not successful in breaching your system, the fact that he or she has attempted to do so makes it likely the attacker will try again.

These are a few of the scans an attacker may use to probe your network:

Images FIN probe: A FIN packet is sent to an open port, and the response is recorded. Although the standard for the FIN flag (RFC 793) states that the required behavior is not to respond, many operating systems such as Windows will respond with an RST.

Images FTP bounce scan: This scan bounces scan packets off an FTP server, which makes the scan harder to trace.

Images SNMP scan: Simple Network Management Protocol (SNMP) is a popular protocol for remote monitoring and management on a network. It’s used to report the status of services and devices. It works through a system of agents and nodes. SNMP is designed so that requests are sent to agents, and the agents send back replies. The requests and replies refer to configuration variables that are accessible by agent software. Traps are used to signify an event that might be of interest. This can be anything from a simple reboot to some system failure. SNMP makes use of the Management Information Base (MIB), which is the database of configuration variables that resides on the networking device. SNMP uses UDP port 161.

Vulnerability Assessment

Vulnerability assessment involves checking a system to see if it is vulnerable to specific attacks. Although hackers can use vulnerability assessment tools to assess your system, these tools are designed to allow you to assess your system. These tools are not particularly stealthy and thus will probably be detected by an intrusion detection system. In fact, network administrators commonly use vulnerability assessment tools to test their own networks. These tools will be covered in Chapter 11, “Network Scanning and Vulnerability Scanning.”

Enumeration

Another technique that is commonly used before an actual attack is enumeration. Enumeration is simply the process of finding out what is on the target system. If the target is an entire network, the attacker wants to find out what servers, computers, and printers are on that network. If the target is a specific computer, the attacker wants to find out what users and shared folders exist on that system.

A simple Google search will help you find a number of enumeration tools. One of the easiest to use is Cain and Abel, shown in Figure 6.4.

Figure 6.4 Cain and Abel.

Although we are focusing on enumeration here, Cain and Abel can do a lot more than just enumeration. To use Cain and Able for enumeration, simply click on the Network tab, and you will find all the machines connected to the network you are on. (You obviously need some level of access before you can enumerate the target network.)

The following are a few other enumeration tools that are popular with hackers and can easily be found on the Internet:

Images Sid2User

Images Cheops (Linux only)

Images UserInfo

Images UserDump

Images DumpSec

Images Netcat

Images NBTDump

This is not an exhaustive list, but it includes some of the most widely used enumeration tools.

To defend against scanning, you should use the following techniques:

Images Be careful how much information you put on the Internet about your organization and its network.

Images Create a company policy mandating that technical personnel who use bulletin boards, chat rooms, and so on for technical data not use their real names or reveal the company’s name.

Images Use an IDS that detects many scans.

Images Block incoming Internet Control Message Protocol (ICMP) packets.

These techniques won’t make scanning and reconnaissance on your system impossible, but they will significantly reduce the amount of information an attacker can gather.

Shodan

Shodan (see Figure 6.5) is a tool used by attackers and penetration testers alike. The website https://www.shodan.io is essentially a search engine for vulnerabilities. You need to sign up for a free account to use it, but then it can be invaluable to a pen tester trying to identify vulnerabilities. Of course, the site can also be invaluable to attackers.

Figure 6.5 Shodan.

There are many options you can use in searching with Shodan.io; some are given here:

Images Search for default passwords, using search terms such as the following:

Images default password country:US

Images default password hostname:chuckeasttom.com

Images default password city:Chicago

Images Find Apache servers:

Images apache city: “San Francisco”

Images Find webcams:

Images webcamxp city:Chicago

Images OLD IIS

Images “iis/5.0”

In addition to these search terms, you can use filters, including these:

Images city: Find devices in a specific city.

Images country: Find devices in a specific country.

Images geo: Pass coordinates (that is, latitude and longitude).

Images hostname: Find values that match a specific hostname.

Images net: Search based on an IP or /x CIDR address.

Images os: Search based on operating system.

Images port: Find particular ports that are open.

Images before/after: Find results within a time frame.

For example, Figure 6.6 shows the results of a search for default passwords city:dallas.

Figure 6.6 Shodan search results.

When you are performing a penetration test, it is a good idea to search the company domain for anything you can find via Shodan. You can restrict your search to the hostname or domain name of the client who has hired you to conduct a penetration test. You can use Shodan to seek out default passwords, old web servers, unsecured web cameras, and other vulnerabilities in the target network. Again, you can be sure that would-be attackers will also use this tool.

Actual Attacks

Now that we have discussed how attackers scan a target system, let’s look at a few attacks that are commonly used. Obviously this isn’t an exhaustive list, but it provides some insight into the attack methodologies used. In Chapter 4 we discussed denial of service (DoS) attacks and some tools used to perpetrate these attacks. In this section we will look at other sorts of attacks and the techniques and tools used to make them happen.

SQL Script Injection

SQL script injection might be the most popular type of attack on websites. In recent years, more websites have taken steps to mitigate the dangers of these attacks, but unfortunately, many websites are still susceptible. An SQL script injection attack involves passing Structured Query Language (SQL) commands to a web application and getting the website to execute them.

Before we can discuss SQL injection further, we must talk about SQL and relational databases. Relational databases are based on relations between various tables. The structure includes tables, primary and foreign keys, and relations:

Images Each row represents a single entity.

Images Each column represents a single attribute.

Images Each record is identified by a unique number called a primary key.

Images Tables are related by foreign keys. A foreign key is a primary key in another table.

You can see an example of these relations in Figure 6.7.

Figure 6.7 Database relations.

All relational databases use SQL, which includes commands such as SELECT, UPDATE, DELETE, INSERT, and WHERE. At least the basic queries are very easy to understand and interpret.

Most basic SQL injection works like this: Many websites/applications have a page where a user enters a username and password. That username and password will have to be checked against some database to see if they are valid. Regardless of the type of database (Oracle, SQL Server, MySQL), all databases speak SQL. SQL looks and functions a great deal like English. For example, to check a username and password, you might want to query the database to see if there is any entry in the users table that matches the username and password that was entered. If there is such an entry, you have a match. The SQL statement to ask this might look something like this:

Click here to view code image

'SELECT * FROM tblUsers WHERE USERNAME = 'jdoe' AND PASSWORD = 'letmein'

The problem with this query is that, although it is valid SQL, it hard codes the username and password. For a real website, you would have to take whatever the user entered into the username field and password field and check that. This can be easily done (regardless of what programming or scripting language the website is programmed in). It would look something like this:

Click here to view code image

'SELECT * FROM tblUsers WHERE USERNAME = '" + txtUsername.Text +' AND PASSWORD = '" +
txtPassword.Text +"'".

If you enter username jdoe and password letmein, this code produces the following SQL command:

Click here to view code image

SELECT * FROM tblUsers WHERE USERNAME = 'jdoe' AND PASSWORD = 'letmein'

Now if there is a username jdoe in tblUsers, and the password for it is letmein, then this user will be logged on. If not, then an error will occur.

SQL injection works by putting some SQL into the username and password block that is always true. For example, suppose you enter 'OR X=X' into the username and password boxes. This will cause the program to create this query:

Click here to view code image

SELECT * FROM tblUsers WHERE USERNAME = ''OR X=X' AND PASSWORD = ''OR X=X'

Notice that you start with a single quotation mark (') before the OR X=X. This closes the open quote the attacker knows must be in the code. And if you see '', that essentially is a blank or null, and it tells the database to log you in if the username is blank, or if X=X, and if the password is blank, or if X=X. If you think about this for a second, you will see that X always equals X, so this will always be true.

There is no significance to 'OR X=X'; it is simply a statement that will always be true. Attackers try other similar statements, such as the following:

' or 'a' ='a
' or '1' ='1
' or (1=1)

The example given here is the most basic version of SQL injection, but it is the most common. You can do far more with SQL injection. The attacker is limited only by her knowledge of SQL and the target database system.

The defense against this type of attack is to filter all user input before processing it. This process, often referred to as input validation, prevents an attacker from entering SQL commands rather than a username and password. Unfortunately, many sites do not filter user input and are still vulnerable to SQL injection attacks.

Remember that earlier in the text when we first, briefly, mentioned SQL injection, it was suggested that filtering input could prevent such an attack. For example, a programmer creating a website should write the code to first check for any common SQL injection symbols such as the single quote ('), percent sign (%), equal sign (=), or ampersand (&), and if those are found, stop processing and log an error. This would prevent many SQL injection attacks. There are methods to circumvent these security measures, but implementing them would, nonetheless, stop many SQL injection attacks.

Cross-Site Scripting

With cross-site scripting, an attacker injects client-side scripts into web pages viewed by other users. The key is that the attacker enters scripts into an area that other users interact with. When users go to that part of the site, the attacker’s script, rather than the intended website functionality, is executed. For example, say that a shopping site allows users to review products. Rather than typing in a review, an attacker might type in JavaScript that redirects the user to a phishing website. When another user views that “review,” the script executes and takes the user to the new site. Again, such attacks can be prevented by simply filtering all user input. As of this writing, all the major online shopping portals, such as Amazon.com, do filter input and are not susceptible to this attack. However, many smaller sites are still susceptible to cross-site scripting.

Cross-site scripting and SQL injection both illustrate why it is critical that all IT personnel, not just security administrators, be familiar with security. If more web developers were more familiar with security, these two attacks would not be widespread.

Cross-Site Request Forgery

Cross-site request forgery could be viewed as the other side of cross-site scripting. Whereas cross-site scripting attacks the user, based on the user’s trust of a website, cross-site request forgery attacks the website, based on the site’s trust of a user. The trusted user, who is authenticated to the website, is tricked into sending requests to the website. These requests can then be used to attack the website.

Directory Traversal

Directory traversal allows attackers to access restricted directories—including those containing application source code, configuration files, and critical system files—and execute commands outside the web server’s root directory.

Attackers can manipulate variables that reference files with “dot-dot-slash” (../) sequences and variations, as in these examples:

Click here to view code image

http://www.example.com/process.aspx=../../../../some dir/some file
http://www.example.com/../../../../some dir/some file

Cookie Poisoning

Many web applications use cookies in order to save information (user ID, timestamp, and so on) on the client’s machine. For example, when a user logs in to a site, a login web script may validate his username and password and set a cookie with his numerical identifier.

When the user checks his preferences later, another web script (say, preferences.asp) retrieves the cookie and displays the user information records of the corresponding user. Because cookies are not always encrypted, they can be modified; an attack that includes this type of modification is called cookie poisoning. In fact, JavaScript can modify, write, or read a cookie. So this type of attack can be combined with cross-site scripting.

URL Hijacking

URL hijacking, also called typosquatting, involves a fake URL that is very close to a real one. For example, my website is www.Chuckeasttom.com. Someone might set up the site www.Chuckeastom.com, with only one t in the last name.

Command Injection

A command injection attack is designed to inject and execute commands specified by the attacker in a vulnerable application. Command injection attacks occur because of lack of correct input data validation, which also can be manipulated by the attacker (in forms, cookies, HTTP headers, and so on). As an example, with Linux, you can execute two commands by typing one after another, like this:

#cmd1 && cmd2

Therefore, a vulnerable application could execute the following:

Click here to view code image

www.google.com && cat /etc/passwd

Sometimes command injection is referred to as shell injection.

Wireless Attacks

A number of wireless attacks are commonly used. For example, with an evil twin attack, a rogue wireless access point (WAP) is set up that has the same SSID as one of your legitimate access points. That rogue WAP might be used to initiate a denial of service attack on your legitimate access point, making it unable to respond to users, so they are redirected to the evil twin.

Another wireless attack is the WPS attack. Wi-Fi Protected Setup (WPS) requires a PIN to connect to the WAP. The WPS attack attempts to intercept that PIN in transmission, connect to the WAP, and then steal the WPA2 password.

A deauthentication attack can cause legitimate wireless clients to deauthenticate from legitimate wireless APs or wireless routers to either perform a denial of service condition or to make those clients connect to an evil twin.

Cell Phone Attacks

There are many ways to attack cell phones. The most common attacks are briefly described here:

Images Bluesnarfing: Unauthorized access of information from a Bluetooth device.

Images Blue jacking: The process of using another Bluetooth device that is within range (depending on the version of Bluetooth it could be 10 to 240 meters) to send unsolicited messages to the target.

Images Bluebugging: Unauthorized access and use of using all phone features.

Images Pod slurping: Use of a device such as an iPod to illicitly steal confidential data by directly plugging it into a computer where the data is held.

Password Cracking

Doing password cracking is easiest when one can actually get physical access to a machine—and this is not as difficult as it sounds. Many organizations (such as universities) have kiosk machines where someone can use the system with minimal/guest privileges. A skilled hacker can use this access to gain further access.

Password Cracking Methods

There are several different approaches to password cracking. The more common approaches are listed here:

Images Dictionary attacks: A text file full of dictionary words is loaded into a password program and then run against user accounts located by the application. If simple passwords have been used, this might be enough to crack the code. Dictionary attacks can be performed offline with tools like LCP and Hashcat and online with tools like Brutus and THC-Hydra.

Images Hybrid attacks: This type of attack is similar to a dictionary attack except that it adds numbers or symbols to the dictionary words. Many people change their passwords by simply adding a number to the end of their current password. The pattern usually takes this form: First month’s password is Mike, second month’s password is Mike2, third month’s password is Mike3, and so on.

Images Rainbow table: Passwords are often stored as a hash. A hash cannot be “unhashed”; however, one can make tables of widely used passwords and hash those. Then if one can get access to the hash of a password, one can search the rainbow table for a match.

Images Brute-force attacks: This is the most comprehensive form of attack and the most potentially time-consuming. Brute-force attacks can take weeks, depending on the length and complexity of the password.

ophcrack

A very popular tool for cracking Windows passwords is ophcrack. ophcrack can be downloaded from http://ophcrack.sourceforge.net. It is based on an understanding of how Windows passwords work. Windows passwords are stored as hashes in a SAM file in one of the system directories, usually C:\WINDOWS\system32\config\. SAM is an acronym for Security Accounts Manager. The passwords are stored as a hash. (Hashes will be discussed in detail in Chapter 8, “Encryption.”) Windows hashes the password you type in and compares it to the hash found in the SAM file. If there is a match, then you are logged in. To prevent someone from copying the SAM file and taking it off to try to brute-force it, as soon as Windows begins the boot process, the operating system locks the SAM file. ophcrack boots to Linux and then gets the SAM file and looks up the hashed passwords in a large table of hashed values it has, searching for a match. If it finds one, then the matching text in that table of hashed values is the password. You can see ophcrack in Figure 6.8.

Figure 6.8 ophcrack.

This tool is remarkably easy to use. Just put the ophcrack CD into the machine and reboot. During the boot process, you can press F12 for a boot menu and tell the system to boot from CD. You will then start ophcrack. It should be noted that longer passwords (as of this writing, longer than 10 characters) are usually not crackable by ophcrack.

If ophcrack is successful (though it isn’t always), what can the attacker now do? At best she simply got the local machine admin account and not a domain account. Well, this can be used to then gain domain access. One such method of obtaining domain access will be explored later in this chapter in the “Net User Script” section.

Other Password Cracking Tools

As you probably can guess, there are many password cracking tools one can get from the Internet. A few common tools are listed here:

Images Brutus: Brutus can perform remote dictionary or brute-force attacks against Telnet, FTP, SMTP, and web servers.

Images John the Ripper: This tool has been around for many years. It is an effective password cracking tool.

Images WebCracker: This simple tool takes text lists of usernames and passwords and uses them as dictionaries to implement basic authentication password guessing.

Images THC-Hydra: This very useful web password-cracking tool attacks many common authentication schemes.

Images Crack Station: The website for this tool, https://crackstation.net, attempts to match a hashed password with a known password in a rainbow table.

Malware Creation

In this section we will briefly discuss how easy it is to create malware. In Chapter 5, “Malware,” you saw the tool eLiTeWrap. In this section you will see the methods used to actually create viruses. This is not in any way an encouragement for you to create such viruses. It is meant to educate you on why such malware is so common.

For many years, one needed significant programming skills in order to create a virus. However, in recent years there have been a number of tools developed to create viruses. These tools allow the end user to click a few buttons and create a virus. This is one reason viruses are becoming so prevalent. One such tool is TeraBIT Virus Maker, shown in Figure 6.9.

Figure 6.9 TeraBIT Virus Maker.

Tools like this make it very easy for even a novice to create a virus. When tools that automate some specific computer attack become prevalent, then one can expect a great many more such attacks.

You can easily see from the options that TeraBIT Virus Maker can create some rather damaging malware. It is important to realize that this is only one option that a malware creator has. There are a number of tools on the Internet that help create viruses. There are even ransomware development kits. A few common utilities for making malware are as follows:

Images Sam’s Virus Generator

Images Internet Worm Maker Thing

Images JPS Virus Maker

Images Deadlines Virus Maker

Images Sonic Bat Virus Creator

In addition to these tools, there are websites that contain catalogs of malware code. Anyone with only moderate programming skills can download the code for a virus and modify that malware for his specific needs. You can think of this as a sort of cyber weapons proliferation.

This proliferation of cyber weapons is the primary reason for this section in this chapter. It is critical that security professionals (and aspiring security professionals) be aware of just how easy it is to create a virus. We should reasonably expect to see more viruses as time goes on. Of course, there are still custom written viruses, and these are in fact the most effective form of malware. But the proliferation of tools and source code means that even those with only minimal technical skills can create viruses.

Windows Hacking Techniques

Given the ubiquitous nature of Microsoft Windows, it should be no surprise that there are a wide range of attacks specifically aimed at that operating system. In this section, we will briefly look at some of them.

Pass the Hash

We will examine cryptographic hashes at some length in Chapter 8. For now, you can just accept that many systems store passwords as cryptographic hashes. This is done because it is impossible to “unhash” something.

A pass the hash attack essentially realizes that the hash cannot be reversed; rather than trying to find out what the password is, the attacker just sends over the hash. If the attacker can obtain valid username and user password hash values, then the hacker can use that hash without ever knowing the actual password.

Windows applications ask users to type in their passwords; then the application in turn hashes them. Often the hashing can be done with an API like LsaLogonUser, converting the password to either an LM hash or an NT hash. Pass the hash skips around the application and just sends the hash.

Net User Script

A net user script exploit first requires access to the target machine with at least guest-level privileges. It is based on the fact that many organizations put the technical support personnel in the domain admin’s group.

The attacker writes the following two-line script (where the word localaccountname is replaced with an actual local account name):

Click here to view code image

net user /domain /add localaccountname password
net group /domain "Domain Admins" /add Domain

The attacker saves this script in the All Users startup folder. The next time someone with domain admin privileges logs on to the machine, it will execute, and localaccountname will now be a domain admin. The only problem is that it may be quite some time before someone with such privileges logs onto that machine. To speed up the process, the attacker will cause a problem with the system that would necessitate technical support fixing it, such as disabling the network card. The next user to log in will not be able to access the network or Internet and will call technical support. There is a reasonably good chance that the person in technical support is a member of the domain administrators group. When that person logs on to the computer to fix the problem, unbeknownst to her, the script will execute.

This particular exploit illustrates two different security issues. The first is the concept of least privileges, which means allowing each user only the minimum privileges to do his job. (This concept was discussed briefly in Chapter 1, “Introduction to Computer Security.”) Technical support personnel should not be in the domain admin group, and if they are not, a net user script attack will not succeed. The second issue is that access to any of your machines should be controlled. This exploit only requires that the attacker have guest-level access and then only for a few minutes. From that minimum access, a skilled attacker can move forward and acquire domain admin privileges.

Login as System

A login as system attack requires physical access to one machine on your network. It does not require domain or even computer login credentials. To understand this attack, think about the last time you logged into any Windows computer, even a Windows server. Next to the login text boxes (Username and Password), there is an accessibility button that allows you to launch various tools to aid those users with disabilities. For example, you can launch the magnifier glass in order to magnify text.

In this attack, the perpetrator will boot the system to any Linux live CD. Then, using the FDISK utility, the attacker will locate the Windows partition. By navigating to the Windows\System32 directory, the attacker can first make a backup of magnify.exe, perhaps naming the backup magnify.bak. Then she can rename command.exe (the command prompt) magnify.exe.

Now the attacker reboots to Windows. When the login screen appears, the perpetrator clicks Accessibility and then Magnify. Since command.exe was renamed magnify.exe, the attacker is actually launching the command prompt. No user has logged in yet, so the command prompt will have system privileges. At this point, the attacker is only limited by her knowledge of commands executed from the command prompt.

This particular attack illustrates the need for physical security. If an attacker can get even 10 minutes alone with your Windows computer, she will likely find a way to breach the network.

Penetration Testing

As mentioned at the beginning of this chapter, the techniques described in this chapter can be used in penetration testing. However, a penetration test is not simply a random application of a variety of hacking techniques. Usually a penetration test is done along with or subsequent to a vulnerability assessment. (We will discuss vulnerability assessments in detail in Chapter 11.)

A penetration test involves methodical probing of a target network in order to identify weaknesses in the network. The theory behind penetration testing is that the only way to objectively determine the security level of a given network is to have a competent penetration tester attempt to breach security. As described in this section, there are a variety of standards that one can use to guide a penetration test.

NIST 800-115

NIST 800-115 is the National Institute of Standards and Technology guideline for security assessments for Federal Information Systems. Assessments include penetration tests. NIST 800-115 describes security assessments as having four phases:

Images Planning: During this phase, the tester needs to set specific testing goals. Often these will be related to previous risk assessment evaluations of the target network.

Images Discovery: This phase involves using a variety of tools—including port scanners, vulnerability scanners, and manual techniques—to identify or discover any issues with the target network.

Images Attack: Now the attacker can attempt to compromise the target network by exploiting the vulnerabilities found during the discovery phase. It is in this phase that the penetration tester applies the hacking techniques we have discussed in this chapter.

Images Reporting: The final step is to prepare a detailed report and to deliver it to the person who hired the penetration tester. The report should provide details on what vulnerabilities were exploited, how they were exploited, and what remediation steps are recommended.

Even though this approach has only four phases, these are rather broad phases that include many substeps. It is not necessary for our purposes to delve into all the details of NIST 800-115. However, these broad steps provide a framework for penetration testing. Notice that there are two steps prior to the attack phase. Planning and discovery are critical, and you will see similar items in other penetration testing standards.

The NSA Information Assessment Methodology

The National Security Agency (NSA) has primary responsibility for information security throughout the U.S. federal government. The NSA has formulated a methodology to be applied to any information systems assessment that includes security audits, vulnerability tests, and penetration tests. That methodology is briefly described here:

Images Pre-assessment

Images Determine and manage the customer’s expectations.

Images Gain an understanding of the organization’s information criticality.

Images Determine the customer’s goals and objectives.

Images Determine the system boundaries.

Images Coordinate with the customer.

Images Request documentation.

Images Onsite assessment

Images Conduct an opening meeting.

Images Gather and validate system information (via interview, system demonstration, and document review).

Images Analyze assessment information.

Images Develop initial recommendations.

Images Present an out-brief.

Images Post-assessment

Images Give an additional review of documentation.

Images Get help understanding what you learned.

Images Report coordination (and writing)

This particular summary of steps is interesting. Managing customer expectations is a critical step. It is important that the customer know what a penetration test can and cannot do. The pre-assessment phase is all about deciding what will be done and what is expected.

The onsite assessment includes the process of examining the system and involves an out-briefing to let the customer know the essence of what you found. Then it culminates with a report that is written and delivered in the third phase. It is also interesting to notice that in the final phase there is a substep involving getting additional expertise. If your penetration test or security audit found items that are outside your expertise, then it is wise to consult with an expert in that area.

PCI Penetration Testing Standard

The Payment Card Industry Data Security Standard (PCI DSS) is a set of standards used by companies that process credit cards. We will look at PCI standards in general in Chapter 10, “Security Policies.” In this section we will briefly examine the penetration testing portion of those standards. PCI DSS Requirement 11.3.4 mandates penetration testing to validate that segmentation controls and methods are operational and effective and to ensure that they isolate all out-of-scope systems from systems in the cardholder data environment.

PCI standards recommend testing a separate environment, not the live production environment, during normal business hours.

It is recommended that pen testing include social engineering tests.

Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any significant change—for example, infrastructure or application upgrade or modification—or new system component installations. As with the previous models we examined, PCI DSS has some specific steps:

Images Pre-engagement: Defining scope, documents, rules of engagement, success criteria, and review of past issues

Images The actual penetration test: Applying hacking techniques

Images Post-engagement: Reporting and recommending remediation steps

It is not critical that you memorize these standards. The point is to understand that hacking techniques are utilized in penetration testing but that penetration testing is more than just random attempts to hack the target network. It is a methodical approach to verifying the security of a target network that happens to include real hacking techniques.

This book is meant to introduce computer security and does not go into detail on penetration testing. For more details, you may want to consider Penetration Testing Fundamentals: A Hands-On Guide to Reliable Security Audits, also from Pearson.

The Dark Web

The Dark Web is an area of the Internet that is accessible only via onion routing. Onion routing essentially routes packets all around the world, bouncing through proxy servers. Each packet is encrypted with multiple layers of encryption, and each proxy can only decrypt one layer, and send the packet to the next proxy. If someone intercepts a packet in transit between two proxies, you can only determine the previous proxy and the next proxy. You cannot determine the actual origin or destination. This is shown in Figure 6.10.

Figure 6.10 TOR.

This leads to a situation in which a user’s location is not easily determined. For example, I used the TOR browser to visit Yahoo.com while sitting in my study in Plano, Texas. In Figure 6.11 you can see the results. As you can see, Yahoo thought I was coming from Sweden and presented its page in Swedish.

Figure 6.11 Yahoo through TOR.

The anonymity provided by TOR is not inherently wrong or unethical. Many people simply do not wish to be monitored when surfing the Web. However, this level of anonymity does lend itself to criminal activity, and markets on the Dark Web traffic in a range of illegal products and services.

In the past several years, many Dark Web criminal markets—for example, Silk Road, Silk Road 2, HANSA, and Alpha Bay—have been taken down by law enforcement. But others have popped up. Within minutes of searching the Dark Web, you can readily find drugs, guns, child pornography, and many other illegal products and services. You can find Jihad training sites, instructions on how to make explosives, hacking services, places to buy and sell malware, and even sites devoted to extreme sexual deviation. As one example of a Dark Web market, Figure 6.12 shows The People’s Drug Store (http://newpdsuslmzqazvr.onion).

Figure 6.12 The People’s Drug Store.

Surfing the Dark Web can be a bit dangerous. Many sites are replete with malware. Therefore, you must establish a specific environment for Dark Web activities—a virtual machine that is completely isolated from the host operating system (which means no sharing of the Clipboard or folders). The virtual machine should preferably run a different operating system than the host, making crossing the VM/host barrier even more difficult. Finally, that VM should be used only for the Dark Web activities and for no other purpose. Many Dark Web investigators like to use The Amnesiac Incognito Live System (TAILS) for Dark Web surfing. It is a free download from https://tails.boum.org.

You should note that TOR has been updated to use Onion v3. Many sites are moving their addresses to Onion v3. As pf October 15, 2021, all Onion v2 sites are disabled in the TOR browser. If you have links from before 2022, they may no longer work.

Some people speculate that the stories about illicit materials on the Dark Web are simply hype. The following are just a few stories related to the Dark Web from news sources:

Images U.S., German Authorities Shut Down Hydra, Largest Darknet Marketplace (April 2022): https://www.secureworld.io/industry-news/usa-germany-shut-down-hydra

Images Man Gets 10½ Years in Federal Prison for Downloading Child Porn from “Dark Web” (May 2022): https://www.thesunchronicle.com/news/local_news/seekonk-man-get-10-1-2-years-in-federal-prison-for-downloading-child-porn-from/article_a301355a-5a97-5af9-852c-ad85bb7d500a.xhtml

Images Tampa Woman Gets 6 Years in Prison for Trying to Hire Hitman on Dark Web (April 2022): https://www.tampabay.com/news/tampa/2022/04/20/tampa-woman-gets-6-years-in-prison-for-dark-web-murder-for-hire/

Images Man Who Obtained Infant Pornography on Dark Web Sentenced to Federal Prison (May 2022): https://www.justice.gov/usao-ndia/pr/man-who-obtained-infant-pornography-dark-web-sentenced-federal-prison

For those readers who would like more technical information on the Dark Web, the most important thing to understand is the nodes. The various nodes are described here:

Images Entry node: This is the first node, where the traffic enters the TOR network. Any relay node can act as an entry node. There is no difference in the function of the entry and relay nodes; however, there is a difference from the user’s point of view. The entry node is the node that has the real identity of the user. This is the extent of the knowledge the entry node has. The entry node only knows the identity of the user and the next node information. It doesn’t know about the destination because of Perfect Forward Secrecy.

Images Relay node: Relay nodes accept the TOR connections, unwrap the additional layer of the Perfect Forward Secrecy, and relay the connection to the next node in the forward path chain. Default configurations have set only one node in the middle of the TOR circuit, but you can increase the number if you like. Be aware that as you increase the number of middle nodes, the delay in the connection increases.

Images Exit node: The exit node is the node that communicates to the destination. Again, this node is no different from the other two nodes, but as it communicates to the destination server and forwards the traffic out of the TOR network, it serves as the source for the destination server. Because of this, exit nodes are always being accused of their activities in the TOR network. Exit nodes are always targeted by investigators. Owners of exit nodes have to repeatedly give explanations to justify their servers.

Images Advertised relay nodes: These nodes are called advertised nodes because they are listed in the directory servers. These are the real nodes that help to anonymize the TOR network by maintaining Perfect Forward Secrecy. Anyone can see the identity of these nodes by querying them as they would a TOR browser.

Images Bridge nodes: Bridge nodes are like any other nodes except that they are not advertised, which means bridge nodes are not listed in the directory servers. What is the purpose of bridge nodes if they are not listed in the directory servers? The main reason to have these nodes is to hide the TOR traffic from government agencies and Internet firewalls. As you may know, TOR nodes are often accused by security agencies because of their activities on the TOR network. In addition, these are easy to block as the identities of the TOR nodes are publicly available on the directory servers. Bridge nodes are used to bypass the blocks. If a bridge node is serving as an entry node, it is hard to find and block the traffic on the firewalls as they are not listed in the TOR directory servers. The main challenge of using a bridge node as an entry node, however, is that someone has to learn about the active bridge server, and it has to be configured manually on the TOR browser.

You can find lists of exit nodes on many websites. The following are just a few:

Images https://www.dan.me.uk/tornodes

Images https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1

Images https://www.dan.me.uk/tornodes (This site has additional data.)

Images https://www.bigdatacloud.com/insights/tor-exit-nodes (This site also has geolocation of exit nodes.)

Summary

In this chapter we have examined just a few techniques hackers utilize and illustrated the need for a variety of security measures. The scanning techniques illustrate the need for blocking certain traffic at the firewall and for running an IDS. The SQL injection attack demonstrates why security must be part of application development. And the ophcrack tool illustrates why physical security is important and why the principle of least privileges is important. Putting tech support staff into the domain admins group violates the concept of least privileges and makes the privilege escalation script possible. If you wish to delve deeper into hacking and penetration testing, you may wish to read Penetration Testing Fundamentals: A Hands-On Guide to Reliable Security Audits, also from Pearson and from the same author as this current book.

Test Your Skills

Multiple Choice Questions

1. Elizabeth is describing web-based attacks to a group of students in a computer security course. What does an SQL injection attack require?

A. Having database admin privileges

B. Creating an SQL statement that is always true

C. Creating an SQL statement that will force access

D. Understanding web programming

2. Juan is using a rainbow table to circumvent passwords on a Windows computer. What is the best description of a rainbow table?

A. A table of precomputed hashes

B. A brute-force password attack

C. A dictionary attack on passwords

D. A multi pronged attempt to crack passwords

3. You are responsible for security on an e-commerce system. You want to mitigate as many attacks as you can. How can you prevent cross-site scripting?

A. Filter user input.

B. Use an IDS.

C. Use a firewall.

D. It cannot be prevented.

4. What is an advantage of using Shodan.io?

A. It is free.

B. It can check for a wide range of vulnerabilities.

C. It is designed for Windows systems.

D. It includes an IDS.

5. Perez is exploring different password cracking tools. A friend has told him about ophcrack. ophcrack depends on the attacker doing what?

A. Getting physical access to the machine

B. Getting domain admin privileges

C. Using social engineering

D. Using a scanning tool

6. If you wish to view items that have been removed from a website, what is the best way to do so?

A. Use Nessus.

B. Use Nmap.

C. Use www.netcraft.com.

D. Use www.archive.org.

7. Malek needs a port scanner so he can scan open ports on his own network. Which of the following is a popular port scanner?

A. Nessus

B. ophcrack

C. MBSA

D. Nmap

8. Jane wants to mitigate as many attacks as she can. A colleague suggested that she block ICMP packets. Blocking incoming ICMP packets will prevent what type of scan?

A. SYN

B. Ping

C. FIN

D. Stealth

9. It is important that you understand cybersecurity terminology, including terms for different actors in cybersecurity. What is the correct term for a person who uses hacking techniques for illegal activities?

A. A hacker

B. A gray hat hacker

C. A phreaker

D. A cracker

10. What is the term for a person who hacks into phone systems?

A. A hacker

B. A gray hat hacker

C. A phreaker

D. A cracker

11. Penelope is teaching an introductory cybersecurity course and is trying to explain the terminology to students. What is the term for a person who uses tools to hack without understanding the underlying technology?

A. A script kiddy

B. A gray hat hacker

C. A novice

D. A white hat hacker

12. What is the name for the process of trying to list all the servers on a network?

A. Port scanning

B. Enumeration

C. Vulnerability scanning

D. Scouting

13. Terrance is performing a scan. What response will a Windows machine give to a FIN scan?

A. ACK

B. None

C. SYN

D. RST

14. Jaron is trying to do a port scan of his own company. He wants to test to see if the company’s security systems will be able to detect his scan. Which of the following is considered the stealthiest port scan?

A. SYN

B. Connect

C. Ping

D. Nmap

15. What is the stealthiest way to find out what type of server a website is running?

A. Use Nmap.

B. Use Cain and Abel.

C. Use www.netcraft.com.

D. Use www.archive.org.

Exercises

EXERCISE 6.1: Using www.archive.org

This exercise gives you practice using www.archive.org. Go to www.archive.org and pull up at least two previous versions of your college’s/university’s website. What information can you find that is no longer on the website?

EXERCISE 6.2: Using Nmap

This exercise introduces you to the Nmap tool. You should download and install Nmap. Then run at least three different scans on either your own computer or a designated lab computer. (While it is not illegal to scan a computer, doing so may violate security policies for some colleges and universities. Make certain you scan only a designated lab computer.)

EXERCISE 6.3: Using ophcrack

Download ophcrack to a CD. Then reboot your own machine to the ophcrack CD and attempt to crack your own local passwords. (It is critical that you do this only on your own machine or a designated lab machine. Doing this on other machines would probably violate security policies at your college/university/company.)

EXERCISE 6.4: Using Netcraft.com

Visit www.netcraft.com and do a search on at least three different websites of your choosing. Note what information you are able to gather about each website.

Projects

PROJECT 6.1: Passive Reconnaissance

Select a local organization and conduct passive reconnaissance on it. This should include searching job boards, the organization’s own website, user groups/bulletin boards, social networking sites, www.archive.org, and more. Gather as much information about the target network as you can.

PROJECT 6.2: Port Scanners

Use your favorite search engine to locate at least two other port scanners besides Nmap. Download and install them and then try them on your own machine or a designated lab computer. Compare and contrast these tools to Nmap. Are they easier to use? More informative?

Case Study

Jane is a hacker intent on breaking into XYZ Corporation. She uses a variety of passive reconnaissance techniques and gathers extensive information about the company. Jane finds out from network administrator questions/comments in user groups the model of routers being used in the company. She finds a complete list of the IT staff and their phone numbers from a personnel directory on the company website. She also finds out what services are running by using a port scan.

Based on this scenario, consider the following questions:

What reasonable steps could the company have taken to prevent Jane from finding out router models and other company hardware?

What steps should the company take to prevent or at least reduce the efficacy of port scans?

Chapter 7

Industrial Espionage in Cyberspace

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand what is meant by industrial espionage

Images Explain the dangers of industrial espionage

Images Understand the low-technology methods used to attempt industrial espionage

Images Be aware of how spyware is used in espionage

Images Know how to protect a system from espionage

Introduction

Espionage is not just for nation-states. Corporations have valuable intellectual property. Whether it is trade secrets, marketing data, or pending financial moves, this data can be quite valuable—and this brings us to the topic of industrial espionage. When you hear the word espionage, perhaps you may conjure up a number of exciting and glamorous images. Perhaps you have visions of a well-dressed man who drinks martinis, shaken but not stirred, traveling to glamorous locations with equally glamorous travel companions. Or perhaps you envision some exciting covert operation with highspeed car chases and guns blazing in faraway exotic lands. Espionage is often much less exciting than those popular media portrayals. The ultimate goal of espionage is to obtain information that would not otherwise be available. Generally, espionage is best done with as little fanfare as possible. Information is the goal, and blazing gun battles and glamorous locations are unlikely and would result in unwanted attention. If possible, it is best to obtain information without the target organization realizing that its information has been compromised.

Some people assume that such spying is only engaged in by governments, intelligence agencies (such as the CIA, NSA, MI6, FSB, and so on), and nefarious international organizations, such as Al-Qaida or ISIS. While those entities absolutely engage in espionage, they are certainly not the only organizations that do so. The aforementioned organizations desire to acquire information for political and military goals. As previously discussed, corporations can have valuable information. With billions of dollars at stake, a private company can become engaged in industrial espionage as either a target or a perpetrator. What company would not like to know exactly what its competitor is doing? In fact, corporate or economic espionage is on the rise.

The boundary between industrial espionage and the activities of intelligence agencies is becoming blurred. There have been numerous cases of industrial espionage against Western nations that at least appear to have been supported by foreign intelligence services. Tech companies have often been the targets of such attacks. In fact, there have been multiple warnings of nation-state actors targeting companies. In May 2022, the New York Law Journal published an article about nation-state actors using cyber attacks to go after sensitive information of corporations.¹

1. https://www.law.com/newyorklawjournal/2022/05/06/%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%AD%C2%ADnation-state-sponsored-attacks-not-your-grandfathers-cyber-attacks/?slreturn=20220626171326

While most experts believe that corporate espionage is a substantial problem, it can be difficult to assess how big the problem is. Companies that perpetrate corporate espionage do not share the fact that they do it—for obvious reasons. Companies that are victims of such espionage often do not wish to reveal that fact either. Revealing that their security was compromised could have a negative impact on their stock value. It is also possible, in certain cases, that such a breach of security might open a company to liability claims from customers whose data may have been compromised. And in some cases, the victim might not be aware of the breach. For these reasons, companies often are hesitant to disclose any industrial espionage activities. Because you will want to protect yourself and your company, it is important that you learn about espionage methods and protections. In the exercises at the end of this chapter, you will work with some of the tools you have learned about so far in this book—antispyware, key loggers, and screen-capture software—so that you can learn how they work and, hence, become cognizant of the risks they pose.

In May 2022, Xiaorong You of Lansing, Michigan, was convicted of conspiring to commit trade secret theft, economic espionage, wire fraud, and other charges. In this case, the secrets at issue involved formulations for coatings inside beverage cans. You was accused of stealing the secrets for use in setting up a new company in China.² In 2019, Forbes ran an article on spying incidents at Apple Inc.³ In the cases examined in this article, the line between corporate espionage and state-sponsored spying was blurry. In one of the cases, Apple employee Jizhong Chen was accused of stealing trade secrets related to self-driving cars and providing them to the Chinese government. The same article estimated the cost of corporate espionage at $1.1 trillion per year.

2. https://www.justice.gov/opa/pr/chemist-sentenced-stealing-trade-secrets-economic-espionage-and-wire-fraud

3. https://www.forbes.com/sites/betsyatkins/2019/02/12/learning-from-apples-spying-incidents-how-to-protect-your-company-from-corporate-espionage/#54d18f7d6fb4

This is a global problem. In 2021 a Swedish court convicted Kristian Dimitrievski of stealing confidential information from truck and bus manufacturer Scania and selling that information to a Russian diplomat.⁴

4. https://apnews.com/article/europe-business-russia-espionage-stockholm-9cbf938ce9dca9a7cffb8c30be29f857

What Is Industrial Espionage?

Industrial espionage is the use of spying techniques to find out key information that is of economic value. Such data might include details on a competitor’s new project, a list of a competitor’s clients, research data, or any information that might give the spying organization an economic advantage. While the rationale for corporate espionage is different from the rationale for military espionage, corporate espionage often involves the same techniques employed by intelligence agencies, such as monitoring, photocopying files, or compromising a member of the target organization. Not only does economic espionage use the same techniques as intelligence agencies, but it often also uses the same people. There have been a number of incidents in which former intelligence agents have been found working in corporate espionage. When such individuals bring their skills and training to the world of corporate espionage, the situation becomes especially difficult for computer security experts.

In Practice

Leaving with Sensitive Data

While various computer experts and government agencies attempt to estimate the impact and spread of corporate espionage, its very nature makes accurate estimates impossible. Not only do the perpetrators not wish to disclose their crimes but often the victims will not disclose the events either. However, anecdotal evidence would suggest that the most common form of espionage is simply an employee quitting, taking a job with another firm, and leaving the first firm with sensitive data. In many cases, these employees choose data that is readily available within the company and, as such, the confidentiality of this data is considered a “gray area.” For example, a salesperson might leave with a printout of contacts and customers so that he can solicit them on behalf of the next employer.

It is critical that you have a very well-worded nondisclosure and noncompete agreement with all employees. It is best to solicit the services of an employment attorney to draw up this agreement. Additionally, you might consider limiting an employee’s access to data prior to terminating his employment. You should also conduct exit interviews and consider confiscating items such as company phone books, which may at first seem insignificant but could contain data that would be useful to another company. Also, thumb drives, smart phones, and other technologies provide a method for taking data out of a company, so some companies restrict the use of these devices.

Information as an Asset

Many people are used to viewing tangible objects as assets but have difficulty appreciating that information can be an asset. Companies spend billions of dollars every year on research and development. The discovered information is worth at least the amount of resources taken to derive the information plus the economic gain produced by the information. For example, if a company spends $200,000 researching a process that will in turn generate $1 million in revenue, then that data is worth at least $1.2 million. You can think of this economic gain as a simple equation:

VI (Value of Information) = C (Cost to Produce) + VG (Value Gained)

While some people are not yet fully cognizant of the concept, data does indeed represent a valuable asset. When we speak of the “information age” or our “information-based economy,” it is important to realize that these terms are not just buzzwords. Information is a real commodity. It is as much an economic asset as any other item in a company’s possession. In fact, it is most often the case that the data residing on a company’s computer is worth far more than the hardware and software of the computer system itself. It is certainly the case that the data is much more difficult to replace than the computer hardware and software.

To truly appreciate the concept of information as a commodity, consider the process of earning a college degree. You spend 4 years sitting in various classrooms. You pay a significant amount of money for the privilege of sitting in those rooms, and listening to others speak at length on various topics. At the end of the 4 years, the only tangible product you receive is a single piece of paper. Surely you can get a piece of paper for far less cost and with much less effort. What you actually paid for was the information you received. The same is true of the value of many professions. Doctors, attorneys, engineers, consultants, managers, and so forth all are consulted for their expert information. Information itself is the valuable commodity.

The data stored in computer systems has a high value for two reasons. First, a great deal of time and effort go into creating and analyzing the data. If you spend 6 months with a team of five people gathering and analyzing information, then that information is worth at least an amount equal to the salaries and benefits of those people for that length of time. Second, data often has intrinsic value, apart from the time and effort spent acquiring those facts. If the facts are about a proprietary process, invention, or algorithm, the value is obvious. However, any data that might provide a competitive edge is inherently valuable. For example, insurance companies frequently employ teams of statisticians and actuaries who use the latest technology to try to predict the risks associated with any given group of potential insureds. The resulting statistical information might be quite valuable to a competing insurance company. Even a customer contact list has a certain inherent value.

Thus, as you work in the computer security field, always keep in mind that any data that might have economic value is an asset to your organization and that such data provides an attractive target for any competitors who may not have ethical inhibitions against using espionage. If your company management thinks that this threat is not real, then they are very much mistaken. Any company is a potential victim of corporate espionage. You should take steps to protect your valuable information—and the first critical step in this process is asset identification.

Asset identification is the process of listing the assets that you believe support your organization. This list should include things that impact direct day-to-day operations as well as those that are tied to your company’s services or products. The CERT website offers a very useful worksheet that you can use to itemize the assets in your organization.⁵ This workbook includes a number of other useful worksheets for assuring information security within your organization. As the table of contents in Figure 7.1 shows, this workbook is also a tutorial that steps you through the various considerations in information security.

5. https://www.us-cert.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf

Figure 7.1 Table of contents from the CERT Supplemental Resource Guide.

Table 7.1 is a variation on the worksheet provided by CERT. Armed with this table and based on your knowledge and experience with your company, you can complete an asset identification by following the steps outlined below:

Table 7.1 Asset Identification Worksheet

Information

Systems

Services and Applications

Other Assets

In the first column of the table, list the information assets. You should list the types of information used by people in your company—the information people need to do their jobs. Examples are product designs, software programs, system designs, documentation, customer orders, and personnel data.

For each entry in the first column, in the second column fill in the names of the systems on which the information resides. In each case, ask yourself which systems people need to perform their jobs.

For each entry in the first column, in the third column fill in the names of the related applications and services. In each case, determine what applications or services are needed for individuals to perform their jobs.

In the last column, list any other assets that may or may not be directly related to the other three columns. Examples are databases with customer information, systems used in production, word processors used to produce documentation, compilers used by programmers, and human resources systems.

Once you complete these steps to fill out Table 7.1, you will have a good understanding of the critical assets for your organization. With this information, you will know how best to devote your defensive efforts. Some specific protective steps will be examined later in this chapter.

Real-World Examples of Industrial Espionage

Now that you have been introduced to the concept of corporate espionage, let’s look at five actual cases. These case studies are of real-world espionage found in various news sources. This section should give you an idea of what types of espionage activities actually occur. Note that while some of these cases are a bit old, they illustrate the way industrial espionage is done. And it is frequently the case that details of an industrial espionage incident do not emerge until many years later, if at all.

Example 1: Hacker Group

Cyber attacks are being used frequently in corporate espionage. From at least November 2018 to well into 2021, the hacking group RedCurl was linked to 30 separate attacks of corporate espionage against companies in the United Kingdom, Germany, Canada, Norway, Russia, and Ukraine. This group tends to favor using its own custom-developed malware and social engineering to gain access to sensitive data.

Example 2: Company Versus Company

In November 2021 Fiat Chrysler Automobiles accused General Motors of corporate espionage. Fiat Chrysler accused GM of impersonating former employees of Fiat Chrysler in emails. GM in turn accused Fiat Chrysler of engaging in bribery and other schemes. The two companies are engaged in multiple lawsuits against each other.

Example 3: Nuclear Secrets

In 2017 Taiwanese-American engineer Allen Ho was sentenced to 2 years in prison for providing nuclear energy technology information to China’s state-owned China General Nuclear Power Company (CGNPC). According to the indictment, Ho, a naturalized American citizen, used his company Energy Technology International, which was based at his home in Wilmington, Delaware, to gather information on the production of nuclear material from American nuclear power developers, including the Tennessee Valley Authority, and pass that information to the CGNPC. Ho engaged in these activities between 1997 and 2016, through his own efforts and those of unnamed consultants he hired.

Example 4: Uber

In 2017 it became public that Uber Technologies Inc. had paid $7 million to keep secret an alleged corporate espionage program. The program allegedly included wiretapping, hacking, bribery, and the use of former intelligence officers, and the industrial espionage team at Uber was named “Threat Operations Unit.” An attorney for former Uber employee Richard Jacob revealed this information in a courtroom.

This information was disclosed in the course of a lawsuit wherein Uber competitor Waymo accused an ex-Uber employee, Anthony Levandowsky, of stealing 14,000 confidential documents and using them to support Uber’s self-driving program. While all the details of this case have not yet been confirmed, the case does illustrate just how extreme industrial espionage can become.

Example 5: Foreign Governments and Economic Espionage

The U.S. government’s National Counterintelligence and Security Center (NCSC) released a 2018 report titled “Foreign Economic Espionage in Cyberspace,”⁶ which details multiple ways in which foreign governments are conducting economic/industrial espionage against U.S.-based companies.

6. https://www.dni.gov/files/NCSC/documents/news/20180724-economic-espionage-pub.pdf

One area emphasized in the report is the infiltration of the software supply chain. Backdoors in some software allow access to corporate resources. The report also noted that some nations, such as China, have laws that require companies doing business in China to submit their technology to the Chinese government for security reviews. The report alleged that in some cases, these reviews were a pretense to provide Chinese companies with access to technology from Western companies.

As a case in point, in April 2022 Xiang Haitao was sentenced after pleading guilty to conspiring to commit economic espionage.⁷ He admitted to being part of a plot to deliver software related to soil nutrient applications to the Chinese government. Haitao had worked as a scientist for Monsanto, which developed software designed to help increase productivity for farmers. The software included a proprietary predictive algorithm to help farmers optimize crop nutrients.

7. https://www.newsweek.com/chinese-spy-economic-espionage-stealing-trade-secrets-1696201

Trends in Industrial Espionage

While the cases just discussed range over a number of years, the problem is not abating. In fact, according to a CNN report, 2015 saw a 53% increase in cases of industrial espionage. The FBI conducted a survey of 165 companies and found that half of those companies had been victims of industrial espionage of some type. A significant number of industrial espionage cases involve insider threats.

Industrial Espionage and You

The industrial espionage cases notwithstanding, most companies will deny involvement in anything that even hints at espionage. However, not all companies are quite so shy about the issue. Larry Ellison, CEO of Oracle Corporation, has openly defended his decision to hire private investigators to sift through Microsoft garbage in an attempt to garner information. Clearly, espionage is no longer a problem just for governments and defense contractors. It is a very real concern in the modern business world. A savvy computer security professional will be aware of this concern and will take the appropriate proactive steps.

How Does Espionage Occur?

There are two ways that espionage can occur. An easy, low-technology avenue would be for current or former employees to simply take the data or for someone to use social engineering methods (discussed in Chapter 3, “Cyber Stalking, Fraud, and Abuse”) to extract data from unsuspecting company employees. The second, more technology-oriented method is for individuals to use spyware, which includes the use of cookies and key loggers. There are also other technological methods we will discuss.

Low-Tech Industrial Espionage

Corporate espionage can occur without the benefit of computers or the Internet. Disgruntled former (or current) employees can copy sensitive documents, divulge corporate strategies and plans, or perhaps reveal sensitive information. In fact, whether the method used is technological or not, disgruntled employees are the single greatest security risk to any organization. A corporate spy need not hack into a system in order to obtain sensitive and confidential information if an employee is willing to simply hand over the information. Just as with military and political espionage, the employees’ motives for divulging information vary. Some engage in such acts for obvious financial gains. Others may elect to reveal company secrets merely because they are angry about some injustice (real or imagined). Whatever the motive, any organization has to be cognizant of the fact that it has any number of employees who may be unhappy with some situation and have the potential to divulge confidential information.

Certainly, one can obtain information without the benefit of modern technology; however, computer technology (and various computer-related tactics) can certainly assist in corporate espionage, even if only in a peripheral manner. Some incidents of industrial espionage are conducted with technology that requires little skill on the part of the perpetrator, as illustrated in Figures 7.2 and 7.3. This technology can include using universal serial bus (USB) flash drives, compact discs (CDs), or other portable media to take information out of the organization. Even disgruntled employees who wish to undermine the company or make a profit for themselves will find it easier to burn a wealth of data onto a CD and carry that out in their coat pocket rather than attempt to photocopy thousands of documents and smuggle them out. And the new USB flash drives, smaller than your average key chain, are a dream come true for corporate spies. These drives can plug into any USB port and store a tremendous amount of data. As of this writing, one can easily purchase small portable devices capable of holding 10TB or more of data.

Figure 7.2 Low-tech espionage is easy.

Figure 7.3 Low-tech espionage is portable.

While information can be taken from your company without overt hacking of the system, you should keep in mind that if your system is unsecured, it is entirely possible that an outside party could compromise your system and obtain that information without an employee as an accomplice. In addition to these methods, other low-tech and even virtually “no-tech” methods can be used to extract information. Social engineering, which was discussed at length in Chapter 3, is the process of talking a person into giving up information she otherwise would not divulge. This technique can be applied to industrial espionage in a number of ways.

The first and most obvious use of social engineering in industrial espionage is in direct conversation in which the perpetrator attempts to get the targeted employee to reveal sensitive data. As illustrated in Figure 7.4, employees will often inadvertently divulge information to a supplier, vendor, or salesperson without thinking the information is important or realizing that it could be given to anyone. The attacker simply needs to try to get the target to talk more than she should. In May 2022 various intelligence agencies were warning of foreign spies using social media to begin social engineering attempts.⁸ A foreign spy might set up a fake profile pretending to be a scientist in order to befriend scientists working on sensitive or classified projects. The goal is to first make contact with the target and then, over time, ingratiate oneself with the target and eventually get access to sensitive data.

8. https://buse.de/en/blog-en/labor-law/cybersecurity-geheimdienste-warnen-vor-industriespionage-ueber-social-media/

Figure 7.4 Social engineering can be used as low-tech espionage.

Another interesting way of using social engineering is via email. In very large organizations, one cannot know every employee, so a clever industrial spy could send an email message claiming to come from some other department and perhaps simply asking for sensitive data. A corporate spy might, for example, forge an email to appear to be coming from the legal office of the target company requesting an executive summary of some research project.

Computer security expert Andrew Briney says that people are the number-one issue in computer security.

Spyware Used in Industrial Espionage

Clearly, any software that can monitor activities on a computer can be used in industrial espionage. An April 2021 article describes a marketplace named Industrial Spy that is set up for the purpose of buying and selling trade secrets. Often, the attackers will first hold the data for ransom and then sell the data—sometimes even if the ransom is paid.⁹ One method to accomplish monitoring is via spyware, which we discussed in detail in Chapter 5, “Malware.” Clearly, software or hardware that logs keystrokes or takes screenshots would be advantageous to an industrial spy. An August 2021 article specifically discussed an incident wherein the Amazon CEO, Jeff Bezos, had his smart phone targeted by spyware and several megabytes of data exfiltrated over several months. The specific spyware is alleged to have been Pegasus, which was originally created by an Israeli company for government use.

9. https://www.blackfog.com/industrial-spy-selling-stolen-data-to-competitors/

The application of this type of software to espionage is obvious: A spy could get screenshots of sensitive documents, capture logon information for databases, or capture a sensitive document as it is being typed. Any of these methods would give a spy unfettered access to all data that is processed on a machine that contains spyware.

Steganography Used in Industrial Espionage

Steganography is a way of keeping messages secret. Rather than hide messages by using encryption, steganography protects communications by obscuring them. Messages are hidden within images. And in some cases other images are hidden within images. The word steganography comes from the Greek steganos, meaning “covered” or “secret,” and graphy, meaning “writing” or “drawing.” There are several technical means to accomplish this, but the most common is to conceal the data in the least significant bits of an image file. However, data can be concealed in any sort of digital file.

It should also be noted that historically there have been nontechnical means of hiding messages. A few notable examples include the following:

Images The ancient Chinese wrapped notes in wax and swallowed them for transport.

Images In ancient Greece, a messenger’s head would be shaved, a message was written on his head, and then his hair was allowed to grow back.

Images In 1518, Johannes Trithemius wrote a book on cryptography and described a technique in which a message was hidden by having each letter taken as a word from a specific column.

You might think that accomplishing steganography requires a great deal of technical knowledge; however, there are many software packages available that will perform steganography for you. Quick-Stego and Invisible Secrets are two very easy-to-use software tools that will do steganography for you. MP3Stego is a free tool that hides data inside MP4 files. These are just a few of the tools available on the Internet. The widespread availability of cheap or free tools that are easy to use makes steganography a threat to any organization.

Phone Taps and Bugs

Of course, there is always the possibility of using phone taps. A phone tap involves tying into a phone line at some point and intercepting calls. This is often done at some utility location inside the building one wishes to tap. Obviously, this sort of attack requires the attacker to enter on or near the premises, compromise phone equipment, and have the skill to tap into the phone line.

Spy for Hire

A 2021 article discussed mercenary spy firms, which are private surveillance companies.¹⁰ Many of these companies claim to engage only in legitimate work; however, many have been accused of illegal activities. The company Black Cube, for example, deployed spies on behalf of Harvey Weinstein. Similar information was published in a 2021 Tech Republic article,¹¹ which discusses a report that identified six companies: Cobwebs Technologies, Cognyte, Black Cube, Bluehawk CI, BellTroX, and Cytrox, as well as an unnamed group in China.¹²

10. https://www.reuters.com/technology/facebook-exposes-mercenary-spy-firms-that-targeted-48000-people-2021-12-16/

11. https://www.techrepublic.com/article/surveillance-for-hire-are-you-a-target-of-the-booming-spy-business/

12. https://about.fb.com/wp-content/uploads/2021/12/Threat-Report-on-the-Surveillance-for-Hire-Industry.pdf

Industrial espionage can involve a disgruntled insider or spyware; however, it can also involve “spies for hire” (that is, mercenary spies). These individuals are usually experienced investigators, and sometimes they’re even former employees of intelligence agencies. This means that one should not be surprised to see the same techniques and tools that nation-states use now used in industrial espionage.

A 2022 article in the New York Post describes specifically how one former corporate spy gathered data.¹³ His techniques relied primarily on social engineering, and his tools were nothing more than a phone and his laptop. Robert Kerbeck, the spy in question, claims to have been earning up to $2 million per year doing corporate espionage.

13. https://nypost.com/2022/03/09/ex-corporate-spy-robert-kerbeck-on-how-he-got-companies-info/

Protecting Against Industrial Espionage

By now, you are aware that there are many ways that your organization’s valuable information assets can be compromised. What steps can you take to alleviate the danger? Note that I said alleviate the danger. There is nothing you can do to make any system, any information, or any person totally secure. Totally unbreakable security is simply unattainable. The best you can do is work to achieve a level of security that makes the effort required to get information more costly than the value of the information.

One obvious protection is to employ antispyware software. As mentioned earlier in this book, many antivirus programs also have antispyware capabilities. This software, coupled with other security measures, such as firewalls and intrusion detection software (examined in Chapter 9, “Computer Security Technology”), should drastically reduce the chance that an outside party will compromise your organization’s data. Furthermore, implementing organizational policies (also discussed in Chapter 9) that help guide employees on safely using computer and Internet resources will make your system relatively secure. If you add to your protection arsenal the strategy of encrypting all transmissions, your system will be as secure as you can reasonably make it. (Chapter 8, “Encryption,” is devoted to encryption.) However, all of these techniques—firewalls, company policies, antispyware, encryption, and so forth—will only help in cases in which the employee is not the spy. What do you do to ameliorate the danger of employees intentionally stealing or compromising information? Actually, there are several courses of action any organization can take to reduce risks due to internal espionage. Here are 12 measures you can use:

Images Always use all reasonable network security: firewalls, intrusion detection software, antispyware, patches and updates for the operating system, and proper usage policies.

Images Give the personnel of the company access to only the data that they absolutely need to perform their jobs. This concept is referred to as least privileges. The employees are given the minimum privileges necessary to perform their job tasks. Use a need-to-know approach. One does not want to stifle discussion or exchange of ideas, but sensitive data must be treated with great care.

Images If possible, set up a system for those employees with access to the most sensitive data in which there is a rotation or a separation of duties. Ensure that no one employee has access and control over all critical data at one time.

Images Limit the number of portable storage media in the organization (such as CD burners and flash drives) and control access to these media. Log every use of such media and what was stored. Some organizations have even prohibited cell phones because most phones allow the user to photograph items and send the pictures electronically.

Images Do not allow employees to take documents/media home. Bringing materials home may indicate a very dedicated employee working on her own time or a corporate spy copying important documents and information.

Images Shred documents and melt old disks/tape backups/CDs. A resourceful spy can often find a great deal of information in the garbage. If any storage media is disposed of, it should be completely wiped. Degaussing is a good technique for hard drives and USB drives.

Images Do employee background checks. You must be able to trust your employees, and you can only do this with a thorough background check. Do not rely on “gut feelings.” Give particular attention to information technology (IT) personnel who will, by the nature of their jobs, have access to a wide variety of data. This scrutiny is most important with positions such as database administrators, network administrators, and network security specialists.

Images When any employee leaves the company, scan the employee’s PC carefully. Look for signs that inappropriate data was kept on that machine. If you have any reason to suspect inappropriate usage, then store the machine for evidence in subsequent legal proceedings.

Images Keep all tape backups, sensitive documents, and other media under lock and key and allow limited access to them.

Images If portable computers are used, then encrypt the hard drives. Encryption prevents a thief from extracting usable data from a stolen laptop. A number of products on the market can accomplish this encryption, including the following:

Images VeraCrypt (see Figure 7.5) is one example of a free tool for encrypting drives, folders, or partitions. The tool is remarkably easy to use and can be found at https://www.veracrypt.fr.

There are several other similar tools, most of which are low cost or free.

Figure 7.5 VeraCrypt.

Images Microsoft Windows includes two types of encryption. Windows 7 Enterprise or Ultimate editions included BitLocker for encrypting entire hard drives. BitLocker is also available on later versions of Windows (8, 8.1, 10, 11). And all versions of Windows since Windows 2000 have included Encrypted File System for encrypting specific files or folders (see Figure 7.6).

Images DiskCryptor is an open-source drive encryption application. It supports algorithms such as AES and Serpent (which you will learn more about in Chapter 8). DiskCryptor can encrypt external devices such as USB and DVD devices. It is available from https://diskcryptor.org.

This list is not exhaustive; therefore, it is highly recommended that you carefully review a variety of encryption products before making a selection.

Images Have all employees with access to any sensitive information sign nondisclosure agreements. Such agreements give an employer recourse in the event that an ex-employee divulges sensitive data. It is amazing how many employers do not bother with this rather simple protection. Use of nondisclosure agreements is the primary means of protecting trade secrets.

Images Conduct security awareness sessions. Clearly, employee education is one of the most important things you can do. An organization should have some method for routinely advising employees about security issues. An excellent way to do that is to have an intranet site with bulletins posted to it. It is also a good idea to hold periodic training sessions for employees. These need not be lengthy or in depth. Most nontechnical employees only need an introduction to security concepts.

Figure 7.6 Windows EFS.

Unfortunately, taking these simple measures will not make you totally immune to corporate espionage. However, using these strategies will make any such attempts much more difficult for any perpetrator; thus, you will improve your organization’s data security.

Trade Secrets

Trade secrets were briefly mentioned previously in this chapter; however, this topic deserves a bit more detailed discussion. This author has been involved as an expert witness in multiple trade secrets misappropriation cases. One of the defenses that is used against allegations of trade secret misappropriation is that the trade secret was not identified. At a minimum, you should mark documents confidential; you should preferably mark trade secrets as such. It is possible a court will still uphold that something without such markings is a trade secret, particularly if the information is something a reasonable person should know is a trade secret. Appropriately marking information, however, removes any ambiguity.

The second defense against allegations of trade secret misappropriation is often that the data was not secured properly. Essentially, the concept is that if one truly views something as a trade secret, then it will be guarded more closely than other data.

The journal CSO recommended several possible choices for protecting trade secrets:¹⁴

14. https://www.csoonline.com/article/3268810/protecting-trade-secrets-technology-solutions-you-can-use.xhtml

Once data has been classified and labelled, there are a wide range of possible protection choices, depending on your use cases. These could include ERMS (Enterprise Rights Management System) persistent encryption, file encryption, document passwords, etc.

Document passwords are one of the options that CSO lists for protecting trade secrets. It should also be noted that CSO does not suggest an organization must implement all of the choices but rather select from the choices those that are a good fit for the organization. Document passwords are well suited for protecting confidential data in a document.

The U.S. Small Business Administration recommends even less substantial security measures, such as simply locking trade secrets in a cabinet (if it is a paper copy) or limiting access to files on a computer:¹⁵

15. https://sba.thehartford.com/business-management/business-questions/keep-trade-secrets-safe/

2. Keep Trade Secrets Confidential

Identification is only step one; reasonable efforts for protection are step two. You don’t have to keep your secrets in Fort Knox to protect them; marking them “confidential” and keeping them out of the public eye is sufficient because it is reasonable under the circumstances. But merely stamping “confidential” on a piece of paper won’t protect a trade secret if you don’t treat the paper like a secret worth keeping.

Images For trade secrets on paper: keep them stored in a locked file cabinet

Images For trade secrets on computer: limit access to the electronic files

Limiting access to files on a computer is accomplished via passwords for the computer. It is further enhanced if one also has the document password protected. It can be further enhanced with file or drive encryption, but this is not required.

A symposium by attorneys on protecting trade secrets made the following comments on security of trade secrets:¹⁶

16. https://www.foley.com/files/uploads/AIPLA%20Article%20on%20DTSA%20and%20Reasonable%20Efforts%20to%20Protect%20Trade%20Secrets%2048.pdf

Reasonable Efforts to Protect Trade Secrets

To be protectable as a trade secret, a plaintiff must prove that the trade secret is information that derives economic value (actual or potential) because it is not generally known and that such information is the subject of reasonable efforts to maintain its secrecy. Often the toughest aspect of a plaintiff’s trade secret action is proving that the trade secret was the subject of “reasonable efforts” to maintain its secrecy. The secrecy requirement has been shown or fulfilled in many ways, including by:

Images Restricting access to the information (e.g., locking it away in a secure place such as a vault or via computer or network security);

Images Limiting the number of people who know the information;

Images Having the people who know, or who come into contact with the trade secret, directly or indirectly, agree in writing not to disclose the information (e.g., sign non-disclosure agreements (in the case of third parties) or confidentiality or employment agreements (in the case of employees and consultants/contractors)); and/or

Images Marking any written material pertaining to the trade secret as confidential and proprietary and following up (as practical) in writing if verbal disclosure.

The Contracting Excellence Journal has the following to say about protecting trade secrets:¹⁷

17. https://journal.iaccm.com/contracting-excellence-journal/protect-your-trade-secrets-using-cybersecurity

1. Identity and access management

Courts so far have looked at some very basic forms of identity and access protection in trade secrets cases including password protection, “need to know” access and secure server storage.

2. Data security measures

Particular cybersecurity protections that deal with how confidential data may or may not be stored or transferred have been cited in a few cases as important “reasonable efforts” in protecting trade secrets, for example, USB use restrictions and electronic and physical distribution controls.

3. Perimeter and network defenses

Attempts to access a company’s trade secrets by competitors, “hacktivists,” malicious ex-employees, and even nation-states, can take the form of hacking of the company’s external networks or internal equipment. Evidence of “reasonable steps” taken to prevent this kind of trade-secret theft include firewalls, data encryption and online use restrictions.

4. Communication

Companies’ communications with training of their employees in cybersecurity and other aspects of trade-secret protection are vital best practices. A few courts have recognized certain types of electronic communications to employees as helpful “reasonable efforts,” for example, pop-up warning indicating potential risks.

5. Monitoring

Cybersecurity is obviously not just a one-time exercise in putting particular protections in place for all time, but an effort that needs to be monitored, measured and improved over time. Courts have started to recognize some elements of ongoing cybersecurity monitoring as relevant for protecting trade secrets, for example, email monitoring.

This article outlines cybersecurity measures that are reasonable for protecting trade secrets. Use of firewalls, some level of data encryption, some level of access control, and restricting access are the essentials of their recommendations.

The Industrial Espionage Act

The Industrial Espionage Act of 1996 was the first U.S. law to criminalize theft of commercial trade secrets. This law provides for significant penalties for violators. The following wording is quoted from the law:¹⁸

18. https://irp.fas.org/congress/1996_rpt/s104359.htm

(a) Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will injure any owner of that trade secret, knowingly—

(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information;

(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such information;

(3) receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;

(4) attempts to commit any offense described in paragraphs (1) through (3); or

(5) conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy, shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both.

Spear Phishing

Phishing, as you know, is the process of attempting to get personal information from a target in order to steal the target’s identity or compromise the target’s system. A common technique is to send out a mass email that is designed to entice recipients to click on a link that purports to be some financial institution’s website but is actually a phishing website.

Spear phishing uses the same technology as phishing but in a targeted manner. For example, if an attacker wanted to get into the servers at a defense contractor, he might craft email and phishing websites specifically to target software and network engineers at that company. The emails might be made to appeal to that specific subgroup of people. Or the attacker might even take the time to learn personal details of a few of these individuals and target them specifically. This technique has been used against executives at various companies. In 2010 and 2011, this problem began to grow significantly.

Whaling is a form of phishing in which an attacker attempts to compromise information regarding a specific highly valuable employee. It involves the same techniques as phishing but is highly customized to increase the chances that the single individual target will be fooled and actually respond to the phishing attempt.

Summary

A number of conclusions can be drawn from this chapter’s examination of industrial espionage. The first conclusion: It does indeed occur. The case studies clearly demonstrate that industrial espionage is not some exotic fantasy dreamed up by paranoid security experts. It is an unfortunate, but quite real, aspect of modern business. If your firm’s management chooses to ignore these dangers, then they do so at their own peril.

The second thing that can be concluded from this brief study of industrial espionage is that there are a variety of methods by which espionage can take place. An employee revealing confidential information is perhaps the most common. However, compromising information systems is another increasingly popular means of obtaining confidential and potentially valuable data. You will want to know the best way to protect your company and yourself. In the upcoming exercises, you will run screen-capture software, key loggers, and antispyware so you can learn more about espionage tactics and how to deal with them.

Test Your Skills

Multiple Choice Questions

1. Terrance is trying to explain industrial espionage to a group of new security techs. What is the ultimate goal of espionage?

A. To subvert a rival government

B. To obtain information that has value

C. To subvert a rival business

D. To obtain information not otherwise available

2. In order to truly understand industrial espionage, you need to understand the mindset of the spy. What is the best outcome for a spy attempting an espionage activity?

A. To obtain information without the target even realizing he did so

B. To obtain information with or without the target realizing he did so

C. To obtain information and discredit the target

D. To obtain information and cause harm to the target

3. What is the usual motivating factor for corporate/industrial espionage?

A. Ideological

B. Political

C. Economic

D. Revenge

4. Which of the following types of information would be a likely target for industrial espionage?

A. A new algorithm that the company’s IT department has generated

B. A new marketing plan that the company has formulated

C. A list of all the company’s customers

D. All of these answers are correct

5. Accurate statistics on corporate espionage are difficult to obtain. One reason is that the victims don’t always report the crime, as they often don’t want the incidents to become public. Which of the following is a likely reason that an organization might be reluctant to admit it has been a victim of corporate espionage?

A. It would embarrass the IT department.

B. It would embarrass the CEO.

C. It might cause stock value to decline.

D. It might lead to involvement in a criminal prosecution.

6. What is the difference between corporate and industrial espionage?

A. None; they are interchangeable terms.

B. Industrial espionage only refers to heavy industry, such as factories.

C. Corporate espionage only refers to executive activities.

D. Corporate espionage only refers to publicly traded companies.

7. Information is a valuable asset. It can be useful to calculate that value in order to determine how much effort should be put into protecting it. What formula can you use to calculate the value of information?

A. Resources needed to produce the information plus resources gained from the information

B. Resources needed to produce the information multiplied by resources gained from the information

C. Time taken to derive the information plus money needed to derive the information

D. Time taken to derive the information multiplied by money needed to derive the information

8. If a company purchases a high-end UNIX server to use for its research and development department, what is probably the most valuable part of the system?

A. The high-end UNIX server

B. The information on the server

C. The devices used to protect the server

D. The room to store the server

9. Information is an asset to your company if it

A. cost any sum of money to produce.

B. cost a significant sum of money to produce.

C. might have economic value.

D. might cost significant money to reproduce.

10. What is the greatest security risk to any company?

A. Disgruntled employees

B. Hackers

C. Industrial spies

D. Faulty network security

11. Which of the following is the best definition for spyware?

A. Software that assists in corporate espionage

B. Software that monitors activity on a computer

C. Software that logs computer keystrokes

D. Software that steals data

12. What is the highest level of security you can expect to obtain?

A. A level of security that makes the effort required to get information more costly than the value of the information

B. A level of security comparable with government security agencies, such as the Central Intelligence Agency

C. A level of security that has a 92.5% success rate in stopping intrusion

D. A level of security that has a 98.5% success rate in stopping intrusion

13. In the context of preventing industrial espionage, why might you wish to limit the number of company CD burners and control access to them in your organization?

A. An employee could use such media to take sensitive data.

B. An employee could use such media to copy software from the company.

C. CDs could be a vehicle for spyware to get on your system.

D. CDs could be a vehicle for a virus to get on your system.

14. Why would you want to scan an employee’s computer when he leaves the organization?

A. To check the workflow prior to his leaving

B. To check for signs of corporate espionage

C. To check for illegal software

D. To check for pornography

15. What is the reason for encrypting hard drives on laptop computers?

A. To prevent a hacker from reading the data while you are online

B. To ensure that data transmissions are secure

C. To ensure that another user on that machine will not see sensitive data

D. To prevent a thief from getting data off of a stolen laptop

Exercises

EXERCISE 7.1: Learning About Industrial Espionage

Using the Web, library, journals, or other resources, look up a case of industrial or corporate espionage that was not already mentioned in this chapter.

Write a brief essay describing the facts in the case. The parties in the case and the criminal proceeding are of interest, but most of your discussion should focus on the technical aspects of the case. Be sure to explain how the espionage was conducted.

EXERCISE 7.2: Using Antispyware

Note that this exercise may be repeated with different antispyware products. It is a good idea for any person interested in computer security to be familiar with multiple antispyware products.

Go to the website of one of the antispyware utilities. (See Chapter 5 if you need more direction.)

Find instructions on the vendor’s website.

Download the trial version of that software.

Install the software on your machine.

After installation, run the utility. What did it find? Record your results.

Let the utility remove or quarantine anything it found.

EXERCISE 7.3: Learning About Key Loggers

Note that this exercise may only be completed on machines where you have explicit permission to do so (not on public computers).

Using any website, find and download a key logger. The following websites might help you locate a key logger: www.kmint21.com/familykeylogger/ and www.blazingtools.com/bpk.xhtml.

Install the key logger on your PC.

Examine how the key logger behaves on your machine. Do you notice anything that might indicate the presence of illicit software?

Run the antispyware software you downloaded in Exercise 7.2. Does the antispyware software detect the key logger?

EXERCISE 7.4: Screen-Capture Spyware

Using the Web, find and download a screen-capturing spyware application. The following website might be helpful to you in selecting an appropriate product: http://en.softonic.com/s/screen-capture-spy-software. Warning: Since you are downloading spyware, it is likely that your system’s antivirus/antispyware will give you a warning.

Install and configure the application on your computer.

Run the application and note what it finds.

Run the antispyware from Exercise 7.2 and see whether it detects your spyware program.

EXERCISE 7.5: Learning About Hardware-Based Key Loggers

In this chapter, as well as in Chapter 5, we discussed software-based key loggers. However, there are also hardware-based key loggers.

Use the Internet to learn more about hardware-based key loggers. (You may wish to search for “KEYKatcher” as a starting point.)

Write an essay outlining the way in which these key loggers work and how they could be implemented for either security or industrial espionage.

Projects

PROJECT 7.1: Preventing Corporate Espionage

Using one of the websites listed in this book (you can also choose from the preferred resources in Chapter 1) or other resources, find a set of guidelines on general computer security. Write a brief essay comparing and contrasting those guidelines against the ones given in this chapter. Keep in mind that the guidelines in this chapter relate specifically to corporate espionage and not to general computer security.

PROJECT 7.2: Handling Employees

Write a brief essay describing steps regarding the handling of employees. Include all steps that you believe an organization should take to prevent corporate espionage. It is important that you support your opinions with sources and reasons.

If possible, visit a company and talk with someone in either the IT department or personnel department to learn how that company handles issues such as employee termination, rotation of duties, control of access to data, and so forth. Compare and contrast the measures you wrote about in your essay to those used by the company you visited.

PROJECT 7.3: Asset Identification in Your Organization

Using Table 7.1 or a similar asset identification table of your own design, identify the most valuable data in your organization (school or business) and what parties would most likely wish to access that data. Then write a brief guideline on how you might go about securing that data. In this project, you should tailor your security recommendations to the specific type of data you are trying to protect and against the most likely perpetrators of industrial espionage.

Case Study

David Doe is a network administrator for the ABC Company. David is passed over for promotion three times. He is quite vocal in his dissatisfaction with this situation. In fact, he begins to express negative opinions about the organization in general. Eventually, David quits and begins his own consulting business. Six months after David’s departure, it is discovered that a good deal of the ABC Company’s research has suddenly been duplicated by a competitor. Executives at ABC suspect that David Doe has done some consulting work for this competitor and may have passed on sensitive data. However, in the time since David left, his computer has been formatted and reassigned to another person. ABC has no evidence that David Doe did anything wrong. Consider the following questions:

What steps might have been taken to detect David’s alleged industrial espionage?

What steps might have been taken to prevent his perpetrating such an offense?

Chapter 8

Encryption

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Explain the basics of encryption

Images Discuss modern cryptography methods

Images Select appropriate cryptography for your organization

Introduction

There are many aspects of computer and information security. Encryption, the process of scrambling a message or other information so that it cannot be easily read by someone intercepting the message, is one of the most critical parts to the security puzzle. If you have the best firewall, very tight security policies, hardened operating systems, virus scanners, intrusion detection software, antispyware, and every other computer security angle covered but send your data in raw plain text, then you simply are not secure.

If there is one area where cybersecurity professionals consistently have a weak understanding, it is cryptography. Most cybersecurity professionals know only what is on specific certification exams, such as the CISSP and CompTIA Security+ exams. That knowledge can be insufficient for you to make important security decisions, however. No, you need not go back to university and obtain a mathematics degree and specialize in cryptography, but you must have sufficient information to be able to ask good questions.

In this chapter, you will obtain what can be termed a “manager’s understanding” of cryptography—the art of writing in or deciphering secret code. It is important to understand that this chapter will not make you a cryptographer. In fact, reading several volumes on encryption would not accomplish that lofty goal. Rather, this chapter is designed to give you a basic overview of what encryption is, some idea of how it works, and enough information so that you can make intelligent decisions about what sorts of encryption to incorporate in your organization. You will learn the basic history of encryption and the fundamental concepts, and after you have completed the exercises at the end of the chapter, you’ll have enough knowledge to at least be able to ask the right questions. Now, this does not mean we won’t cover some technical details. We will. But the goal of this chapter is to give you a broad understanding of the relevant concepts.

It is also important to understand that some concepts in cryptography can be difficult. While the general ideas are readily understandable by most readers, you may have difficulty with some concepts. That is normal and should not be a concern. You may have to read some parts of the chapter a few times to fully get some concepts.

We will go into the actual process of some of the cryptography algorithms presented. For example, we will show you the process of DES and RSA. It is beyond the scope of this book to go in depth into every cryptographic algorithm available, but it is useful for you to see a few of them described in detail.

It is not critical for a security practitioner or an aspiring security practitioner to have in-depth knowledge of cryptographic algorithms. In this chapter, some of the concepts we cover, particularly in regard to asymmetric cryptography, may be difficult to grasp. It is acceptable if you don’t get 100% of those concepts, particularly the math-related concepts, on your first reading of the material. Some topics in this chapter are likely to require a bit more study and effort than other material in this book. In Chapter 9, “Computer Security Technology,” you will see some applications of cryptography, such as SSL/TLS, digital certificates, and virtual private networks.

Cryptography Basics

The aim of cryptography is not to hide the existence of a message but rather to hide its meaning—in a process known as encryption. To make a message unintelligible, it is scrambled according to a particular algorithm, which is agreed upon beforehand between the sender and the intended recipient. Thus, the recipient can reverse the scrambling protocol and make the message comprehensible. This reversal of the scrambling is referred to as decryption. The advantage of using encryption/decryption is that, for someone who doesn’t know the scrambling protocol, the message is difficult to re-create.

There are two basic types of cryptography in use today: symmetric and asymmetric. Symmetric means the same key is used to encrypt the message and to decrypt the message. With asymmetric cryptography, a different key is used to encrypt the message than is used to decrypt the message. That may sound a bit odd, and you may be wondering how that is possible. Later in this chapter, we will explore exactly how it works. For now the important point is to understand the basic concept of symmetric and asymmetric cryptography.

History of Encryption

The idea of encryption is probably as old as written communication. The basic concept is actually fairly simple: Messages must be changed in such a way that they cannot be easily read by an enemy but so they can be easily decoded by the intended recipient. In this section, we will examine a few historical methods of encryption. It should be noted that these are very old methods, and they cannot be used for secure communication today. The methods discussed in this section would be easily cracked, even by an amateur. However, examining them is wonderful for conveying the concepts of cryptography without having to incorporate a great deal of math, which is required of the more complex encryption methods.

Fyi: Cryptographers

Encryption is a very broad and complex subject area. Even amateur cryptographers typically have some mathematical training and have studied cryptographic methods for several years.

If you are interested in learning more about the history of cryptography than what we touch upon here, you may wish to read one of the many books written on the subject. A brief history of cryptography is provided in Table 8.1.

Table 8.1 History of Cryptography

Year

Cryptography

500 to 600 BCE

Atbash

< 10 BCE

Polybius square

45 BCE to 45 CE

Caesar cipher

50 to 120 CE

Scytale

1553 CE

Vigenère Cipher

1910 to 1940

Enigma

1976

DES and Diffie-Hellman

1977

RSA

1985

Elliptic curve cryptography

1993

Blowfish cipher

1998

Rijndael published

2001

Rijndael selected as AES

If you are interested in learning more about the history of cryptography than what we touch upon here, you may wish to read one of the many books written on the subject. In addition you may wish to consult the following websites:

Images The Stanford University History of Cryptography website: http://cs.stanford.edu/people/eroberts/courses/soco/projects/public-key-cryptography/history.xhtml

Images Cryptography.org: http://cryptography.org

Images SANS History of Cryptography: https://www.sans.org/white-papers/730/

Understanding the simple methods described here and other methods listed on the aforementioned websites should give you a sense of how cryptography works as well as what is involved in encrypting a message. Regardless of whether you go on to study modern, sophisticated encryption methods, it is important for you to have some basic idea of how encryption works at a conceptual level. Having a basic grasp of how encryption works, in principle, will help you better understand the concepts of any encryption method you encounter in the real world. Khan Academy has an online cryptography course that is good for beginners.

The Caesar Cipher

One of the oldest encryption methods is the Caesar cipher. This method is purported to have been used by the ancient Roman Caesars—thus, the name. It is actually quite simple to do. You choose some number by which to shift each letter of a text. For example, if the text is:

A cat

and you choose to shift by two letters, then the message becomes:

C ecv

Or, if you choose to shift by three letters, it becomes:

D fdw

Julius Caesar was reputed to have used a shift of three to the right. However, you can choose any shifting pattern you wish. You can shift either to the right or to the left by any number of spaces you like. Because this is a very simple method to understand, it makes a good place to start our study of encryption. It is, however, extremely easy to crack. You see, any language has a certain letter and word frequency, meaning that some letters are used more frequently than others. In the English language, the most common single-letter word is A. The most common three-letter word is the. Those two rules alone could help you decrypt a Caesar cipher. For example, if you saw a string of seemingly nonsense letters and noticed that a three-letter word was frequently repeated in the message, you might easily surmise that this word was the—and the odds are highly in favor of this being correct. Furthermore, if you frequently noticed a single-letter word in the text, it is most likely the letter A. You now have found the substitution scheme for A, T, H, and E. You can now either translate all of those letters in the message and attempt to surmise the rest or simply analyze the substitute letters used for A, T, H, and E and derive the substitution cipher that was used for this message. Decrypting a message of this type does not even require a computer. It can be done in less than 10 minutes using pen and paper by someone with no background in cryptography. There are other rules that will help make cracking this code even easier. For example, in the English language, the two most common two-letter combinations are ee and oo. That gives you even more to work on.

Another reason this algorithm can be easily cracked is an issue known as key space—the number of possible keys that can be used. In this case, when applied to the English alphabet, there are only 26 possible keys since there are only 26 letters in the English alphabet. This means you could simply try each possible key (+1, +2, +3, … +26) until one works. Trying all possible keys is referred to as a brute-force attack.

The substitution scheme you choose (for example, +2, +1) is referred to as a substitution alphabet (for example, B substitutes for A, U substitutes for T). Thus, the Caesar cipher is also referred to as a monoalphabet substitution method, meaning that it uses a single substitution for the encryption. There are other monoalphabet algorithms, but the Caesar cipher is the most widely known.

Atbash

In ancient times, Hebrew scribes used the Atbash substitution cipher to encrypt religious works such as the book of Jeremiah. Applying this cipher is fairly simple: Just reverse the order of the letters of the alphabet. This is, by modern standards, a very primitive and easy-to-break cipher.

The Atbash cipher is a Hebrew code that substitutes the first letter of the alphabet for the last and the second letter for the second to the last, and so on. It simply reverses the alphabet. For example, in English, A becomes Z, B becomes Y, C becomes X, and so on. Of course, the Hebrews used a different alphabet, with aleph being the first letter and tav being the last letter. However, I will use English examples to demonstrate this:

Attack at dawn

becomes:

Zggzxp zg wzdm

As you can see, the A is the first letter in the alphabet and is switched with Z, the last letter in the alphabet. Then the T is the 19th letter (and the 7th from the end) and gets swapped with G, the 7th letter from the beginning. This process is continued until the entire message is enciphered.

To decrypt the message, you simply reverse the process, and Z becomes A, B becomes Y, and so on. This is obviously a rather simple cipher and not used in modern times. However, it illustrates the basic concept of cryptography: to perform some permutation on the plain text to render it difficult to read by those who don’t have the key to unscramble the cipher text. The Atbash cipher, like the Caesar cipher, is a single substitution cipher, so each letter in the plain text has a direct, one-to-one relationship with each letter in the cipher text. This means that the same letter and word frequency issues that can be used to crack the Caesar cipher can be used to crack the Atbash cipher.

Multi-Alphabet Substitution

Eventually, a slight improvement on the Caesar cipher, called multi-alphabet substitution, was developed. In this scheme, you select multiple numbers by which to shift letters (that is, multiple substitution alphabets). For example, if you select three substitution alphabets (12, 22, 13), then:

A CAT

becomes:

C ADV

Notice that the fourth letter starts over with another +2, and you can see that the first A was transformed to C and the second A was transformed to D. This makes it more difficult to decipher the underlying text. While this is harder to decrypt than a Caesar cipher, it is not overly difficult. It can be done with simple pen and paper and a bit of effort. It can be cracked very quickly with a computer. In fact, no one would use such a method today to send any truly secure message, for this type of encryption is considered very weak.

At one time multi-alphabet substitution was considered quite secure. In fact, a special version of this, called a Vigenère cipher, was used in the 1800s and early 1900s. The Vigenère cipher was invented in 1553 by Giovan Battista Bellaso. It is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. Figure 8.1 shows the Vigenère cipher.

Figure 8.1 Vigenère cipher.

Match the letter of your keyword on the top with the letter of your plain text on the left to find the cipher text. For example, using the chart shown in Figure 8.1, if you are encrypting the word cat and your key is horse, then the cipher text is jok.

Rail Fence

All the ciphers we have examined so far are substitution ciphers. Another approach to classic cryptography is the transposition cipher. The rail fence cipher may be the most widely known transposition cipher. You simply take the message you wish to encrypt and alter each letter on a different row. So “attack at dawn” is written as:

A t c a d w

  t a k t a n

Next, you write down the text reading from left to right as one normally would, thus producing:

atcadwtaktan

In order to decrypt the message, the recipient must write it out on rows:

A t c a d w

  t a k t a n

Then the recipient reconstructs the original message. Most texts use two rows as examples; however, this can be done with any number of rows you wish to use.

Scytale

The Scytale cipher is the first known device used for cryptography. It is pronounced such that it rhymes with Italy (it is not pronounced sky – tail). This cipher used a cylinder with a strip of parchment wrapped around it. If the person receiving the parchment had the correct diameter cylinder, then when the parchment was wrapped around that cylinder, the message could be read. If, however, the wrong size of cylinder was used, or if you simply found the parchment and no cylinder, the message would appear to be a random string of letters. This device was first used by the Spartans and later throughout Greece.

Polybius Cipher

The Polybius cipher (also known as the Polybius square) was invented by the Greek historian Polybius (c. 200–118 BCE). Obviously, his work used the Greek alphabet, but we will use it with English here. As shown in the grid in Figure 8.2, in the Polybius cipher, each letter is represented by two numbers (Mollin, 2000). Those two numbers being the x and y coordinates of that letter on the grid. For example, A is 1 1, T is 4 4, C is 1 3, and K is 2 5. Thus, to encrypt the word attack, you would use 114444111325. You can see this in Figure 8.2.

Figure 8.2 Polybius square.

Despite the use of two numbers to represent a single letter, this is a substitution cipher and still maintains the letter and word frequencies found in the underlying language of the plain text. If you used the standard Polybius square, which is a widely known cipher, it would be easily cracked, even without any frequency analysis. If you wanted to use a different encoding for letters in the square, that would require that the sending and receiving parties share the particular Polybius square in advance, so that they could send and read messages.

It is interesting to note that the historian Polybius actually established this cipher as a means of sending codes via torches. Messengers standing on hilltops could hold up torches to represent letters, and thus send messages. Establishing a series of such messengers on hilltops, each relaying the message to the next, allowed communications over a significant distance, much faster than any messenger on foot or horseback could travel.

Enigma

It is really impossible to have a discussion about cryptography and not talk about Enigma. Contrary to popular misconceptions, the Enigma is not a single machine but rather a family of machines. The first version was invented by German engineer Arthur Scherbius near the end of World War I. It was used by several different militaries, not just the Nazi Germans.

Some military texts encrypted using a version of Enigma were broken by Polish cryptanalysts Marian Rejewski, Jerzy Rozycki, and Henryk Zygalski. The three basically reverse engineered a working Enigma machine and used that information to develop tools for breaking Enigma ciphers, including one tool named the cryptologic bomb.

The core of the Enigma machine was the rotors, or disks that were arranged in a circle with 26 letters on them. The rotors were lined up. Essentially, each rotor represented a different single substitution cipher. You can think of the Enigma as a sort of mechanical poly-alphabet cipher. The operator of the Enigma machine would be given a message in plain text and then type that message into Enigma. For each letter that was typed in, Enigma would provide a different cipher text, based on a different substitution alphabet. The recipient would type in the cipher text, and as long as both Enigma machines had the same rotor settings, the recipient’s machine would provide the correct plain text. Figure 8.3 is a picture of an Enigma machine.

Figure 8.3 An Enigma machine.

There were actually several variations of the Enigma machine. The Naval Enigma machine was eventually cracked by British cryptographers working at the now famous Bletchley Park. Alan Turing and a team of analysts were able to eventually break the Naval Enigma machine. Many historians claim that this shortened World War II by as much as 2 years. This story is the basis for the 2014 movie The Imitation Game.

Binary Operations

Most symmetric ciphers make use of a binary operation called exclusive or (XOR). Before we examine modern symmetric ciphers, we will review basic binary math. Various operations on binary numbers (numbers made of only 0s and 1s) are well known to programmers and programming students. But for those who are not familiar with them, a brief explanation follows. When working with binary numbers, there are three operations not found in normal math: AND, OR, and XOR operations. Each is illustrated next.

AND

To perform the AND operation, you compare two binary numbers one place at a time. If both numbers have a 1 in both places, then the resultant number is a 1. If not, then the resultant number is a 0, as you see here:

1 1 0 1

1 0 0 1

1 0 0 1

OR

The OR operation checks to see whether there is a 1 in either or both numbers in a given place. If so, then the resultant number is 1. If not, the resultant number is 0, as you see here:

1 1 0 1

1 0 0 1

1 1 0 1

XOR

The XOR operation impacts your study of encryption the most. It checks to see whether there is a 1 in a number in a given place but not in both numbers at that place. If it is in one number but not the other, then the resultant number is 1. If not, the resultant number is 0, as you see here:

1 1 0 1

1 0 0 1

0 1 0 0

XORing has a very interesting property in that it is reversible. If you XOR the resultant number with the second number, you get back the first number. And if you XOR the resultant number with the first number, you get the second number:

0 1 0 0

1 0 0 1

1 1 0 1

Binary encryption using the XOR operation opens the door for some rather simple encryption. Convert any message to binary numbers and then XOR that with some key, where the key is some string of digits (1s and 0s) that should be random (or at least as random as possible). Converting a message to a binary number is really a simple two-step process. First, convert a message to its ASCII code and then convert those codes to binary numbers. Each letter/number will generate an 8-bit binary number. Then you can use a random string of binary numbers of any given length as the key. Simply XOR your message with the key to get the encrypted text and then XOR it with the key again to retrieve the original message. This method is easy to use and great for computer science students; however, it does not work well for truly secure communications because the underlying letter and word frequency issues remain. These issues provide valuable clues that even an amateur cryptographer can use to decrypt the message. However, this method does provide a valuable introduction to the concept of single-key encryption, which will be discussed in more detail in the next section. While simply XORing the text is not the method typically employed, single-key encryption methods are widely used today—and binary operations are often a part of the process.

Symmetric key cryptography often uses two processes: substitution and transposition. The substitution portion is accomplished by XORing the plain text message with the key. The transposition is done by swapping blocks of the text.

Modern Cryptography Methods

Modern cryptography methods, as well as computers, make cryptography a rather advanced science. What you have seen so far regarding cryptography is simply for educational purposes. As has been noted several times, you would not have a truly secure system if you implemented any of the previously mentioned encryption schemes. You may feel that this has been overstated in this text. However, it is critical that you have an accurate view of what encryption methods do and do not work. It is now time to discuss a few methods that are actually in use today.

Before we delve too deeply into this topic, let’s start with some basic definitions you will need:

Images Key: The bits that are combined with the plain text to encrypt it. In some cases this is random numbers; in other cases it is the result of some mathematical operation.

Images Plain text: The unencrypted text.

Images Cipher text: The encrypted text.

Images Algorithm: A mathematical process for doing something.

Single-Key (Symmetric) Encryption

Basically, single-key encryption means that the same key is used to both encrypt and decrypt a message. This is also referred to as symmetric key encryption. There are two types of symmetric algorithms (or ciphers): stream and block. A block cipher divides the data into blocks (often 64-bit blocks, but newer algorithms sometimes use 128-bit blocks) and encrypts the data one block at a time. Stream ciphers encrypt the data as a stream of bits, one bit at a time.

Data Encryption Standard

Data Encryption Standard, or DES, was developed by IBM in the early 1970s and published in 1976. Yes, it is old, and it is no longer considered secure; however, it is worthy of study for two reasons. The first reason is that DES was the first modern symmetric cipher. The second reason is that the general structure, often called a Feistel function or Feistel cipher, is still used in many modern algorithms. DES is a block cipher, which divides the plain text into 64-bit blocks and encrypts each block. The basic concept is as follows:

Fyi: Block Ciphers and Stream Ciphers

When applying a key to plain text to encrypt it and produce the cipher text, you must also choose how to apply the key and the algorithm. In a block cipher, the key is applied to blocks (often 64 bits in size) at a time. This differs from a stream cipher that encrypts 1 bit at a time.

Data is divided into 64-bit blocks.

Each of those blocks is divided into two 32-bit halves.

One half is manipulated with substitution and XOR operations via a round function.

The two 32-bit halves are swapped.

This is repeated 16 times (16 rounds).

At the time DES was released, it was a marvelous invention. Even today the algorithm is still sound. However, the small key size, 56 bits, is not good enough to defend against brute-force attacks with modern computers. Many cryptography textbooks and university courses use DES as the basic template for studying all block ciphers. We will do the same and give this algorithm more attention than most of the others in this chapter.

For those new to security and cryptography, the brief facts listed earlier are enough. However, for those who want to delve a bit deeper, let’s examine the details of the DES algorithm. DES uses a 56-bit cipher key applied to a 64-bit block. There is actually a 64-bit key, but 1 bit of every byte is used for error correction, leaving just 56 bits for actual key operations.

DES is a Feistel cipher with 16 rounds and a 48-bit round key for each round. They are called Feistel ciphers (also Feistel functions) after Horst Feistel, the inventor of the concept, and the primary inventor of DES. All Feistel ciphers work in the same way: They divide the block into two halves, apply a round function to one of those halves, and then swap the halves. This is done each round. The primary difference between different Feistel ciphers is what exactly occurs within the round function.

The first issue to address is the key schedule. A key schedule, which all block ciphers use, is a simple algorithm that will take the initial key the two parties derived and generate from that a slightly different key each round. DES does this by taking the original 56-bit key and slightly permuting it each round so that each round is applying a slightly different key but one that is based on the original cipher key. To generate the round keys, the 56-bit key is split into two 28-bit halves, and those halves are circularly shifted after each round by 1 or 2 bits to provide a different subkey each round. During the round key generation portion of the algorithm (recall that this is referred to as the key schedule) each round, the two halves of the original cipher key (the 56 bits of key that the two endpoints of encryption must exchange) are shifted a specific amount. The end result is that for each of the 16 rounds of DES, the key is actually a little different from the key used in the previous round. All modern symmetric ciphers do something like this to improve the security of the cipher.

Once the round key has been generated for the current round, the next step is to address the half of the original block that is going to be input into the round function. Recall that the two halves are each 32 bits. The round key is 48 bits. This means that the round key does not match the size of the half block it is going to be applied to. You cannot really XOR a 48-bit round key with a 32-bit half block unless you simply ignore 16 bits of the round key. If you did so, you would basically be making the round key shorter and thus less secure, so this is not a good option. The 32-bit half needs to be expanded to 48 bits before it is XORed with the round key. This is accomplished by replicating some bits so that the 32-bit half becomes 48 bits.

This expansion process is actually quite simple. The 32 bits that are to be expanded are broken into 4-bit sections. The bits on each end are duplicated. If you divide 32 by 4, the answer is 8. So there are 8 of these 4-bit groupings. If you duplicate the end bits of each grouping, that will add 16 bits to the original 32, thus providing a total of 48 bits.

It is also important to keep in mind that it was the bits on each end that were duplicated. This will be a key item later in the round function. Perhaps this example will help you understand what is occurring at this point. Let us assume 32 bits, as shown here:

11110011010111111111000101011001

Now divide this into 8 sections of 4 bits each, as shown here:

1111 0011 0101 1111 1111 0001 0101 1001

Now each of these has its end bits duplicated, as you see here:

1111 becomes 111111

0011 becomes 000111

0101 becomes 001011

1111 becomes 111111

1111 becomes 111111

0001 becomes 000011

0101 becomes 001011

1001 becomes 110011

The resulting 48-bit string is now XORed with the 48-bit round key. Now you are done with the round key. Its only purpose was to XOR with the 32-bit half. It is now discarded, and on the next round another 48-bit round key will be derived from the two 28-bit halves of the 56-bit cipher key, using the key schedule we previously described.

Now we have the 48-bit output of the XOR operation. But this still does not seem to work. Don’t we need 32 bits rather than 48? That 48 bits is now split into 8 sections of 6 bits each. Each of those 6-bit sections is going to be input into an s-box (substitution box), and only 4 bits will be output.

The 6-bit section is used as the input to an s-box, which is a table that takes input and produces an output based on that input. In other words, it is a substitution box that substitutes new values for the input. There are eight different s-boxes for DES, but below you can see one of them:

Middle 4 Bits of Input

0001

0010

0011

0100

0101

0110

0111

1000

1001

1010

1011

1100

1101

1110

1111

Outer Bits

00

0010

1100

0100

0001

0111

1010

1011

0110

1000

0101

0011

1111

1101

0000

1110

1001

01

1110

1011

0010

1100

0100

0111

1101

0001

0101

0000

1111

1010

0011

1001

1000

0110

10

0100

0010

0001

1011

1010

1101

0111

1000

1111

1001

1100

0101

0110

0011

0000

1110

11

1011

1000

1100

0111

0001

1110

0010

1101

0110

1111

0000

1001

1010

0100

0101

0011

An s-box is really just a hard-coded lookup table. The 2 bits on either end are shown in the left column, and the 4 bits in the middle are shown in the top row. They are matched, and the resulting value is the output of the s-box. For example, with the previous demonstration numbers we were using, our first block would be 111111. So you find 1xxxx1 on the left and x1111x on the top. The resulting value is 3 in decimal, or 0011 in binary.

Recall that during the expansion phase we simply duplicated the outermost bits, so when we come to the s-box phase and drop the outermost bits, no data is lost.

Since each s-box outputs 4 bits and there are 8 s-boxes, the result is 32 bits. That 32 bits is now exclusively ORed with the other half of the original block. Recall that we did nothing with that half originally. Now the two halves are swapped.

If you are new to cryptography, all of this might seem a bit confusing, even with the explanations provided. Many readers will need to reread this section a few times for it to become totally clear.

3DES

Triple DES (3DES) was created as a replacement for DES. At the time, the cryptography community was searching for a viable alternative. While that was still being worked on, 3DES was created as a stop-gap measure. It essentially applies DES three times with three different keys, thus the name 3DES.

There were variations of 3DES that used only two keys. The text was first encrypted with key A. The cipher text from that operation was then encrypted with key B. Then the cipher text from that operation was encrypted, this time reusing key A. The reason for this reuse is that creating good cryptographic keys is computationally intensive.

AES

Advanced Encryption Standard (AES) was the algorithm eventually chosen to replace DES. It is a block cipher that works on 128-bit blocks. It can have one of three key sizes: 128, 192, or 256 bits. The U.S. government selected AES to be the replacement for DES, and it is now the most widely used symmetric key algorithm.

AES, also known as Rijndael block cipher, was officially designated as a replacement for DES in 2001 after a 5-year process involving 15 competing algorithms. AES is designated as FIPS 197. Other algorithms that did not win that competition include such well-known algorithms as Twofish. The importance of AES cannot be overstated. It is widely used around the world and is perhaps the most widely used symmetric cipher. Of all the algorithms in this chapter, AES is the one you should give the most attention to.

As mentioned earlier, AES can have three different key sizes: 128, 192, and 256 bits. The three different implementations of AES are referred to as AES 128, AES 192, and AES 256. The block size can also be 128, 192, or 256 bit. It should be noted that the original Rijndael cipher allowed for variable block and key sizes in 32-bit increments. However, the U.S. government uses these three key sizes with a 128-bit block as the standard for AES.

This algorithm was developed by two Belgian cryptographers, John Daemen and Vincent Rijmen. John Daeman is a Belgian cryptographer who has worked extensively on the cryptanalysis of block ciphers, stream ciphers, and cryptographic hash functions. For those new to security, the brief description given so far is sufficient. However, we will explore the AES algorithm in more detail. Just as with the details of DES, this may be a bit confusing to some readers at first glance and may require a few rereads.

Rijndael uses a substitution-permutation matrix rather than a Feistel network. The Rijndael cipher works by first putting the 128-bit block of plain text into a 4-byte-by-4-byte matrix, termed the state, that changes as the algorithm proceeds through its steps. The first step is to convert the plain text block into binary and then put it into a matrix, as shown in Figure 8.4.

Figure 8.4 The Rijndael matrix.

Once you have the original plain text in binary, placed in the 4-byte-by-4-byte matrix, the algorithm consists of a few relatively simple processes that are used during various rounds. The processes are described here:

Images AddRoundKey: In this process, each byte of the state is exclusively ORed with the round key. Just as with DES, there is a key schedule algorithm that slightly changes the key each round.

Images SubBytes: This involves substitutions of the input bytes (which are the output from the AddRoundKey phase). This is where the contents of the matrix are put through the s-boxes. Each of the s-boxes is 8 bits.

Images ShiftRows: This is a transposition step where each row of the state is shifted cyclically a certain number of steps. In this process, the first row is left unchanged. Every byte in the second row is shifted 1 byte to the left (and the far left wraps around). Every byte of the third row is shifted 2 to the left, and every byte of the fourth row is shifted 3 to the left (again with the far left wrapping around). This is shown in Figure 8.5. Notice that in this figure that the bytes are simply labeled by their row and then a letter, such as 1a, 1b, 1c, 1d.

Figure 8.5 ShiftRows.

Images MixColumns: This is a mixing operation that operates on the columns of the state, combining the 4 bytes in each column. In the MixColumns process, each column of the state is multiplied with a fixed polynomial. Each column in the state (remember the matrix we are working with) is treated as a polynomial within the Galois field (2⁸). The result is multiplied with a fixed polynomial c(x) = 3x³ + x² + x + 2 modulo x⁴ + 1. The MixColumns process can also be viewed as a multiplication by the shown particular MDS matrix in the finite field GF(2⁸).

These processes are executed multiple times in the Rijndael cipher. For 128-bit keys, there are 10 rounds. For 192-bit keys, there are 12 rounds. For 256-bit keys, there are 14 rounds.

These last few steps may be leaving you a bit confused if you don’t have a background in number theory. You may be asking questions like “What is a Galois field?” and “What is a fixed polynomial?” A general overview of the math needed to understand this is provided in the next section.

AES Math

A group is an algebraic system consisting of a set, an identity element, one operation, and its inverse operation. Basically, groups are ways to limit math operations, such as addition, to specific sets of numbers. There are several specialized types of groups, briefly described here:

Images An abelian group, or commutative group, has an additional axiom a + b = b + a if the operation is addition or ab = ba if the operation is multiplication.

Images A cyclic group has elements that are all powers of one of its elements.

Images A ring is an algebraic system consisting of a set, an identity element, two operations, and the inverse operation of the first operation.

Images A field is an algebraic system consisting of a set, an identity element for each operation, two operations, and their respective inverse operations.

This brings us to the Galois group, or Galois field. GF(p) for any prime, p, this Galois field has p elements that are the residue classes of integers modulo p. That prime number p is the defining element for the field. Now, this is obviously a brief description and does not attempt to get into details. A thorough study of group theory would be needed to get into more detail.

Blowfish

Blowfish is a symmetric block cipher. It uses a variable-length key ranging from 32 to 448 bits. Blowfish was designed in 1993 by Bruce Schneier. It has been analyzed extensively by the cryptography community and has gained wide acceptance. It is also a noncommercial (free of charge) product, thus making it attractive to budget-conscious organizations.

This cryptography algorithm was intended as a replacement for DES. Like DES, it is a 16 round Feistel cipher working on 64-bit blocks; however, unlike DES, it can have varying key sizes ranging from 32 bits to 448 bits (Schneier, 1993). Early in the cipher, the cipher key is expanded. Key expansion converts a key of at most 448 bits into several subkey arrays totaling 4168 bytes.

RC4

All the other symmetric algorithms we have discussed have been block ciphers. RC4 is a stream cipher developed by Ron Rivest. RC is an acronym for Ron’s Cipher, or sometimes Rivest’s Cipher. There are other RC versions, such as RC5 and RC6.

Serpent

Serpent has a block size of 128 bits and can have a key size of 128, 192, or 256 bits, much like AES. The algorithm is also a substitution-permutation network (like AES). It uses 32 rounds working with a block of four 32-bit words. Each round applies one of eight 4-bit to 4-bit s-boxes 32 times in parallel. Serpent was designed so that all operations can be executed in parallel. This is one reason it was not selected as a replacement for DES. At the time it was created, many computers had difficulty with parallel processing. However, modern computers have no problem with parallel processing, so Serpent is once again an attractive choice.

Skipjack

Originally classified, the Skipjack algorithm was developed by the National Security Agency (NSA) for the clipper chip. The clipper chip was a chip with built-in encryption; however, the decryption key would be kept in a key escrow in case law enforcement needed to decrypt data without the computer owner’s cooperation. This feature made the process highly controversial. Skipjack uses an 80-bit key to encrypt or decrypt 64-bit data blocks. It is an unbalanced Feistel network with 32 rounds. Unbalanced Feistel simply means a Feistel cipher wherein the two halves of plain text for each block are not the same size. For example, a 64-bit block might be divided into a 48-bit half and a 16-bit half rather than two 32-bit halves.

Modification of Symmetric Methods

Just as important as understanding symmetric ciphers is understanding how they are implemented. There are some common modes that can affect how a symmetric cipher functions.

Electronic Codebook

The most basic encryption mode is the electronic codebook (ECB) mode. With ECB, a message is divided into blocks, and each block is encrypted separately. The problem is that if you submit the same plain text more than once, you always get the same cipher text. This gives attackers a place to begin analyzing the cipher to attempt to derive the key. Put another way, ECB is simply using the cipher exactly as it is described, without attempting to improve its security.

Cipher Block Chaining

When using cipher block chaining (CBC) mode, each block of plain text is XORed with the previous cipher text block before being encrypted. This means there is significantly more randomness in the final cipher text, making it much more secure than electronic codebook mode. It is the most common mode.

There really is no good reason to use ECB over CBC if both ends of communication can support CBC. CBC is a strong deterrent to known plain text attacks, a cryptanalysis method we will examine later in this chapter.

The only issue with CBC is the first block. There is no preceding block of cipher text to XOR the first plain text block with. It is common to add an initialization vector (IV) to the first block so that it has something to be XORed with. The initialization vector is basically a pseudo-random number, much like the cipher key. Usually an IV is only used once, and it is thus called a nonce (for “number used only once”). The CBC mode is actually fairly old. It was introduced by IBM in 1976.

PCBC

The propagating cipher-block chaining mode was designed to cause small changes in the ciphertext to propagate indefinitely when decrypting, as well as when encrypting. This method is sometimes called plaintext cipher-block chaining. The PCBC mode is a variation on the CBC mode of operation. It is important to keep in mind that the PCBC mode of encryption has not been formally published as a federal standard.

CFB

In Cipher Feedback mode the previous ciphertext block is encrypted then the ciphertext produced is XOR’d back with the plaintext to produce the current ciphertext block. Essentially it loops back on itself, increasing the randomness of the resultant ciphertext. While CFB is very similar to Cipher Block Chaining, its purpose is a bit different. The goal is to take a block cipher and turn it into a stream cipher. Output Feedback mode is another method used to transform a block cipher into a synchronous stream cipher.

Galois/Counter Mode

The Galois Counter Mode (GCM) uses counter mode with Galois authentication. Counter mode was introduced by Whitfield Diffie and Martin Hellman in 1979 and is used to turn a block cipher into a stream cipher. Counter mode is combined with Galois field multiplication used for authentication.

Public Key (Asymmetric) Encryption

Public key encryption is essentially the opposite of single-key encryption. With any public key encryption algorithm, one key (called the public key)is used to encrypt a message, and another (called the private key) is used to decrypt the message. You can freely distribute your public key so that anyone can encrypt a message to send to you, but only you have the private key and only you can decrypt the message. The actual mathematics behind the creation and application of the keys will vary between different asymmetric algorithms. We will look at the math for RSA later in this section. It should be pointed out, however, that many public key algorithms are dependent, to some extent, on large prime numbers, factoring, and number theory.

It has become standard in cryptography to use the fictitious Alice and Bob to illustrate asymmetric cryptography. If Alice wants to send Bob a message, she will use Bob’s public key to encrypt that message. It does not matter if every other person on the planet also has Bob’s public key. That key cannot decrypt the message. Only Bob’s private key can do that. This is shown in Figure 8.6.

Figure 8.6 Public key cryptography.

Public key encryption is important because there are no issues to deal with concerning distribution of the keys. With symmetric key encryption, you must get a copy of the key to every person to whom you wish to send your encrypted messages. If that key were lost or copied, someone else might be able to decrypt all of your messages. With public key encryption, you can freely distribute your public key to the entire world, yet only you can decrypt messages encrypted with that public key.

RSA

It isn’t possible to discuss cryptography without at least some discussion of RSA, which is a very widely used encryption algorithm. This public key method was developed in 1977 by three mathematicians: Ron Rivest, Adi Shamir, and Len Adleman. The name RSA is derived from the first letter of each mathematician’s last name. Let us take a look at the math involved in RSA. (It should be pointed out that knowing the math behind this, or any other algorithm, is not critical for most security professionals. But some readers will have an interest in going deeper into cryptography, and this will be a good place to start.)

There are a few basic math concepts you need to know about in order to understand RSA. Some (or even all) of this material may be a review:

Images Prime numbers: A prime number is divisible by itself and by 1. So 2, 3, 5, 7, 11, 13, 17, and 23 are all prime numbers. (Note that 1 itself is considered a special case and is not prime.)

Images Co-prime: This actually does not mean prime; it means two numbers have no common factors. So, for example, the factors of 8 (excluding the special case of 1) are 2 and 4, and the factors of 9 are 3. The numbers 8 and 9 have no common factors, so they are co-prime.

Images Euler’s Totient: Pronounced “oilers” totient, or called just the totient, this is the number of integers smaller than n that are co-prime with n. So let us consider the number 10. Since 2 is a factor of 10, it is not co-prime with 10. But 3 is co-prime with 10. The number 4 is not co-prime since both 4 and 10 have 2 as a factor. The number 5 is not since it is a factor of 10. Neither is 6 since both 6 and 10 have 2 as a cofactor. The number 7 is prime, so it is co-prime with 10. The number 8 is not because both 8 and 10 have 2 as a factor. The number 9 is co-prime with 10. So the numbers 3, 7, and 9 are co-prime with 10. We add in 1 as a special case, the Euler’s totient of 10 is 4. Now it just so happens that Leonhard Euler also proved that if the number n is a prime number, then its totient is always n – 1. So the totient of 7 is 6. The totient of 13 is 12.

Images Multiplying and co-prime: Now we can easily compute the totient of any number. And we know automatically that the totient of any prime number n is just n – 1. But what if we multiply two primes? For example, we can multiply 5 and 7 to get 35. Well, we can go through all the numbers up to 35 and tally up the numbers that are co-prime with 35. But the larger the numbers get, the more tedious this process becomes. For example, if you have a 20-digit number, manually calculating the totient is almost impossible. Fortunately, Leonhard Euler also proved that if you have a number that is the product of two primes (let’s call them p and q), such as 5 and 7, then the totient of the product of those two numbers (in this case 35) is equal to p – 1 × q – 1 (in this case 4 × 6, or 24).

Images Modulus: This is the last concept you need for RSA. There are a few approaches to explaining this concept. We will actually use two of them. First, from a programmer’s perspective, the modulus operation is to divide two numbers but only give the remainder. Programmers often use the symbol % to denote modulo operations. So 10 % 3 is 1. The remainder of 10 divided by 3 is 1. Now, this is not really a mathematical explanation of modulo operations.

Basically, modulo operations take addition and subtraction and limit them by some value. You have actually done this all your life without realizing it. Consider a clock. When you say 2 p.m., what you really mean is 14 mod 12 (or 14 divided by 12; just give me the remainder). Or if it is 2 p.m. now (14 actually) and you tell me you will call me in 36 hours, what I do is 14 + 36 mod 12, or 50 mod 12, which is 2 a.m. (a bit early for a phone call, but it illustrates our point).

Now if you understand these basic operations, then you are ready to learn RSA. If needed, reread the preceding section (perhaps even more than once) before proceeding.

To create the key, you start by generating two large random primes, p and q, of approximately equal size. You need to pick two numbers so that when multiplied together, the product will be the size you want (2048 bits, 4096 bits, and so on).

Now multiply p and q to get n. Let n = pq.

The next step is to multiply Euler’s totient for each of these primes. Basically, Euler’s totient is the total number of co-prime numbers. Two numbers are considered co-prime if they have no common factors. For example, if the original number is 7, then 5 and 7 would be co-prime. Remember that it just so happens that for prime numbers, this is always the number minus 1. For example, 7 has 6 numbers that are co-prime to it. (If you think about this a bit, you will see that 1, 2, 3, 4, 5, and 6 are all co-prime with 7.)

Let m = (p – 1)(q – 1).

Now we are going to select another number. We will call this number e. We want to pick e so that it is co-prime to m. Choose a small number e, co-prime to m.

We are almost done generating a key. Now we just find a number d that, when multiplied by e and modulo m, would yield 1. (Remember: Modulo means dividing two numbers and returning the remainder. For example, 8 modulo 3 would be 2.)

Find d, such that de % m = 1.

Now you will publish e and n as the public key. Keep d as the secret key. To encrypt, you simply take your message raised to the e power and modulo n:

= me % n

To decrypt, you take the cipher text and raise it to the d power modulo n:

P = Cd % n

The letter e is for encrypt and d is for decrypt. If all this seems a bit complex to you, you must realize that many people work in network security without being familiar with the actual algorithm for RSA (or any other cryptography for that matter). However, if you wish to go deeper into cryptography, then this is a very good start. It involves some fundamental number theory, particularly regarding prime numbers. There are other asymmetric algorithms that work in a different manner. For example, elliptic curve cryptography is one such example.

Let’s look at an example that might help you understand. Of course, RSA would be done with very large integers. To make the math easy to follow, we will use small integers in this example.

Choose two distinct prime numbers, such as p = 61 and q = 53. Compute n = pq:

n = 61 × 53 = 3233

Compute the totient of the product as ϕ (n) = (p – 1)(q – 1):

ϕ (3233) = (61 – 1)(53 – 1) = 3120

Choose any number 1 < e < 3120 that is co-prime to 3120. Choosing a prime number for e leaves us only to check that e is not a divisor of 3120. Let e = 17. Compute d, the modular multiplicative inverse of yielding d = 2753.

The public key is (n = 3233, e = 17). For a padded plain text message m, the encryption function is:

m¹⁷ (mod 3233)

The private key is:

(n = 3233, d = 2753)

For an encrypted cipher text, c, the decryption function is:

c²⁷⁵³ (mod 3233)

For those readers new to RSA or new to cryptography in general, it might be helpful to see one more example, with even smaller numbers:

Select primes: p = 17 & q = 11.

Compute n = pq =17 × 11 = 187.

Compute ϕ(n) = (p – 1)(q – 1) = 16 × 10 = 160.

Select e: gcd(e,160) = 1; choose e = 7.

Determine d: de = 1 mod 160 and d < 160. Value is d = 23 since 23 × 7 = 161 = 10 × 160 + 1.

Publish public key: (7 and 187).

Keep secret private key: 23.

Diffie-Hellman

Diffie-Hellman was the first publicly described asymmetric algorithm. This cryptographic protocol allows two parties to establish a shared key over an unsecured channel. In other words, Diffie-Hellman is often used to allow parties to exchange a symmetric key through some unsecured medium, such as the Internet. It was developed by Whitfield Diffie and Martin Hellman in 1976.

One problem with working in cryptology is that much of the work is classified. You could labor away and create something wonderful…that you cannot tell anyone about. Then to make matters worse, years later someone else might develop something similar, release it, and get all the credit. This is exactly the situation with Diffie-Hellman. It turns out that a similar method had been developed a few years earlier by Malcolm J. Williamson of the British Intelligence Service, but it was classified.

For those interested in more knowledge about the actual math used in Diffie-Hellman, it is provided here. The system has two parameters called p and g (Rescorla, 1996). Parameter p is a prime number and parameter g (usually called a generator) is an integer less than p, with the following property: For every number n between 1 and p-1 inclusive, there is a power k of g such that n = gk mod p. Let us revisit our old friends Alice and Bob to illustrate this.

Alice generates a random private value a and Bob generates a random private value b. Both a and b are drawn from the set of integers.

They derive their public values using parameters p and g and their private values. Alice’s public value is ga mod p, and Bob’s public value is gb mod p.

They exchange their public values.

Alice computes gab = (gb)a mod p, and Bob computes gba = (ga)b mod p.

Because gab = gba = k, Alice and Bob now have a shared secret key k.

This process is shown in Figure 8.7.

Figure 8.7 Diffie-Hellman.

There have been several modifications of and improvements to Diffie-Hellman. Among the most well-known are ElGamal and MQV. ElGamal is named after its inventor, Taher Elgamal. MQV was first proposed in 1995 and is named after its inventors Alfred Menezes, Minghua Qu, and Scott Vanstone. MQV is incorporated in the public key standard IEEE P1363 and NIST’s SP800-56A standard.

Elliptic Curve Cryptography

The elliptic curve algorithm was first described in 1985 by Victor Miller and Neal Koblitz. Elliptic curve cryptography (ECC) is based on the fact that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is difficult to the point of being impractical. The mathematics behind this algorithm are a bit much for an introductory book on security. However, if you are interested, you should read the great tutorial at http://arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/.

There are a number of variations, such as ECC-DH (ECC Diffie-Hellman) and ECC-DSA (ECC Digital Signature Algorithm). The real strength of ECC crypto systems is that you can get just as much security with a smaller key as with other systems, like RSA. For example, a 384-bit ECC key is as strong as 2048-bit RSA.

PGP

PGP, a public key system, stands for Pretty Good Privacy. It is a widely used system that is considered very secure by most experts. There are several software implementations available as freeware for most desktop operating systems. There are PGP plug-ins for MSN Messenger and many other popular communications software packages. A simple Yahoo! or Google search for PGP will help you find many of these software products.

Fyi: “Old” Encryption

PGP is quite old, and you might wonder whether it is therefore outdated. Cryptography is unlike other technological endeavors in this regard: Older is better. It is usually unwise to use the “latest thing” in encryption for the simple reason that it is unproven. An older encryption method, provided it has not yet been broken, is usually a strong choice because it has been subjected to years of examination by experts and to cracking attempts by both experts and less honorably motivated individuals. This is sometimes hard for computer professionals to understand since the newest technology is often preferred in the computer business.

PGP was invented by Phil Zimmermann. Before creating PGP, Zimmermann had been a software engineer for 20 years and had experience with existing forms of cryptography. A great deal of controversy surrounded the birth of PGP because it was created without an easy means for government intrusion, and its encryption was considered too strong for export. This led to Zimmermann being the target of a 3-year government investigation. However, those legal matters have since been resolved, and PGP is one of the most widely used encryption methods available.

The important things to know about PGP are that it is:

Images A public key encryption

Images Considered quite secure

Images Available free of charge

These facts make it well worth your time to investigate PGP as a possible solution for your organization’s encryption needs.

Legitimate Versus Fraudulent Encryption Methods

The encryption methods discussed earlier in this chapter are just a few of the most widely used modern encryption methods. Dozens of other methods are released to the public for free or are patented and sold for profit every year. However, it is important to realize that this particular area of the computer industry is replete with frauds and charlatans. One need only scan a search engine for encryption to find a plethora of advertisements for the latest and greatest “unbreakable” encryption. If you are not knowledgeable about encryption, how do you separate legitimate encryption methods from frauds?

There are many fraudulent cryptographic claims out there. You do not have to be a cryptography expert to be able to avoid many of those fraudulent claims. Here are some warning signs:

Images Unbreakable: Anyone with experience in cryptography knows that there is no such thing as an unbreakable code. There are codes that have not yet been broken. There are codes that are very hard to break. But when someone claims that a method is “completely unbreakable,” you should be suspicious.

Images Certified: Guess what? There is no recognized certification process for encryption methods. Therefore, any “certification” a company claims is totally worthless.

Images Inexperienced people: A company is marketing a new encryption method. What experience do the people working with it have? Does the cryptographer have a background in math, encryption, or algorithms? If not, has he submitted his method to experts in peer-reviewed journals? Or, is he at least willing to disclose how his method works so that it can be fairly judged? Recall that PGP’s inventor had decades of software engineering and encryption experience.

Auguste Kerckhoffs first articulated what has come to be called Kerckhoffs’s principle in the 1800s. He stated that the security of a cipher depends only on the secrecy of the key, not on the secrecy of the algorithm. Claude Shannon rephrased this stating that, “One ought to design systems under the assumption that the enemy will ultimately gain full familiarity with them.” This idea, referred to as Shannon’s maxim, states essentially the same idea as Kerckhoffs’s principle.

I would add to Kerckhoffs’s principle/Shannon’s maxim something I will humbly call Easttom’s corollary: “You should be very wary of any cryptographic algorithm that has not been published and thoroughly reviewed. Only after extensive peer review should you consider the use of any cryptographic algorithm.” I first proposed this corollary in my book Modern Cryptography: Applied Mathematics for Encryption and Information Security.

Digital Signatures

A digital signature is not used to ensure the confidentiality of a message but rather to guarantee who sent the message. This is referred to as nonrepudiation. Essentially, nonrepudiation means proving who the sender is. Digital signatures are actually rather simple, but they are clever. They simply reverse the asymmetric encryption process. Recall that in asymmetric encryption, the public key (which anyone can have access to) is used to encrypt a message to the recipient, and the private key (which is kept secure and private) can decrypt it. With a digital signature, the sender encrypts something with his private key. If the recipient is able to decrypt that with the sender’s public key, then it must have been sent by the person purported to have sent the message. This process is shown in Figure 8.8.

Figure 8.8 Digital signatures.

Hashing

A hash is a type of cryptographic algorithm that has some specific characteristics. First and foremost, it is one way. That means you cannot unhash something. Second, you get a fixed-length output no matter what input is given. Third, there are no collisions. A collision occurs when two different inputs to the same hashing algorithm produce the same output (called a hash or digest). Ideally we would like to have no collisions. But the reality is that with fixed-length output, collisions are possible. So the goal is to make collisions so unlikely as to be something we need not think about.

Hashes are exactly how Windows stores passwords. For example, if your password is password, then Windows will first hash it and produce something like this:

0BD181063899C9239016320B50D3E896693A96DF

Windows will then store that in the SAM (Security Accounts Manager) file in the Windows System directory. When you log on, Windows cannot unhash your password (because, remember, it is one way). So, what Windows does is take whatever password you type in, hash it, and then compare the result with what is in the SAM file. If they match (exactly), then you can log in.

Storing Windows passwords is just one application of hashing. There are others. For example, in computer forensics it is common to hash a drive before you begin forensic examination. Then later you can hash it again to see if anything was changed (accidently or intentionally). If the second hash matches the first, then nothing has been changed.

There are various hashing algorithms. The two most common of them are MD5 and SHA. (It was SHA-1, but since then later versions, like SHA-256, have become more common.)

MD5

MD5 is a 128-bit hash that is specified in RFC 1321. It was designed by Ron Rivest in 1991 to replace an earlier hash function, MD4. MD5 produces a 128-bit hash or digest. It has been found to be not as collision resistant as SHA.

SHA

Secure Hash Algorithm (SHA) is perhaps the most widely used hash algorithm today. There are now several versions of SHA. All versions of SHA are considered to be secure and collision free:

Images SHA-1: This is a 160-bit hash function that resembles the earlier MD5 algorithm. It was designed by the NSA to be part of the Digital Signature Algorithm (DSA).

Images SHA-2: This is actually two similar hash functions, with different block sizes, known as SHA-256 and SHA-512. They differ in the word size; SHA-256 uses 32-byte (256 bits) words, whereas SHA-512 uses 64-byte (512 bits) words. There are also truncated versions of each standardized, known as SHA-224 and SHA-384. These were also designed by the NSA.

Images SHA-3: This latest version of SHA was adopted in October 2012.

RIPEMD

RACE Integrity Primitives Evaluation Message Digest (RIPEMD) is a 160-bit hash algorithm developed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel. There exist 128-, 256-, and 320-bit versions of this algorithm, called RIPEMD-128, RIPEMD-256, and RIPEMD-320, respectively. All these replace the original RIPEMD, which was found to have collision issues.

MAC and HMAC

Hashes are used for several security-related functions. One of these functions is to store passwords, and we have discussed that already (and we will see more later in this chapter).

A hash of a message can be sent to see if accidental alteration occurred in transit. If a message is altered in transit, the recipient can compare the hash received against the hash the computer sent and detect the error in transmission. But what about intentional alteration of messages? What happens if someone alters the message intentionally, deletes the original hash, and recomputes a new one? Unfortunately, a simple hashing algorithm cannot account for this scenario.

Using a message authentication code (MAC) is one way to detect intentional alterations in a message. A MAC is also often called a keyed cryptographic hash function. That name should tell you how this works. One way to do it is the hashing message authentication code (HMAC). Let us assume you are using MD5 to verify message integrity. To detect an intercepting party intentionally altering a message, both the sender and the recipient must have previously exchanged a key of the appropriate size (in this case, 128 bits). The sender will hash the message and then XOR that hash with this key. The recipient will hash what she receives and XOR that computed hash with the key. Then the two hashes are exchanged. If an intercepting party were to simply recompute the hash, he would not have the key to XOR that with (and may not even be aware that it should be XORed); thus, the hash the interceptor creates won’t match the hash the recipient computes, and the interference will be detected.

There are other variations of the concept. Some use a symmetric cipher in CBC (cipher block chaining mode) and then use only the final block as the MAC. These variations are called CBC-MAC.

Rainbow Tables

Since Windows and many other systems store passwords as hashes, many people have had an interest in how to break hashes. As we’ve mentioned, since a hash is not reversible, there is no way to unhash something. In 1980, Martin Hellman described a cryptanalytic technique that reduces the time of cryptanalysis by using precalculated data stored in memory. This technique was improved by Rivest before 1982. Basically, these types of password crackers are working with precalculated hashes of all passwords available within a certain character space, be that a–z or a–zA–z or a–zA–Z0–9, and more. This is called a rainbow table. If you search a rainbow table for a given hash, whatever plain text you find must be the text that was input into the hashing algorithm to produce that specific hash.

Clearly, such a rainbow table would get very large very fast. Assume that the passwords must be limited to keyboard characters. That leaves 52 letters (26 uppercase and 26 lowercase), 10 digits, and roughly 10 symbols, or about 72 characters. As you can imagine, even a 6-character password has a very large number of possible combinations. This means there is a limit to how large a rainbow table can be, and this is why longer passwords are more secure than shorter passwords.

Since the development of rainbow tables, there have been methods designed to thwart such attacks. The most common is salting, in which random bits are added to further secure encryption or hashing. This is most often encountered with hashing to prevent rainbow table attacks.

Essentially, the salt is intermixed with the message that is to be hashed. Consider an example. Say that you have a password that is:

pass001

In binary that is:

01110000 01100001 01110011 01110011 00110000 00110000 00110001

A salt algorithm would insert bits periodically. Let’s assume for our example that we insert bits every fourth bit, giving us:

0111100001 0110100011 0111100111 0111100111 0011100001 0011100001 0011100011

If you convert that to text, you would get:

All this is transparent to the end user, who doesn’t even know that salting is happening or what it is. However, an attacker using a rainbow table to get passwords would get the wrong password.

Steganography

Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message. It is a form of security through obscurity. Often the message is hidden in some other file, such as a digital picture or an audio file, to defy detection.

The advantage of steganography over cryptography alone is that messages do not attract attention to themselves. If someone is aware that a message is even there, she won’t try to decipher it. In many cases, messages are encrypted and hidden via steganography.

The most common implementation of steganography utilizes the least significant bits in a file in order to store data. By altering the least significant bit, you can hide additional data without altering the original file in any noticeable way.

There are some basic steganography terms you should know:

Images Payload is the data to be covertly communicated. In other words, it is the message you wish to hide.

Images The carrier is the signal, stream, or data file into which the payload is hidden.

Images The channel is the medium used. This may be still photos, video, or sound files.

The most common way steganography is accomplished today is via least significant bits. Every file has a certain number of bits per unit of the file. For example, an image file in Windows is 24 bits per pixel. If you change the least significant of those bits, then the change is not noticeable with the naked eye. And you can hide information in the least significant bits of an image file. With least significant bit (lsb) replacement, certain bits in the carrier file are replaced.

Historical Steganography

In modern times, steganography involves digital manipulation of files to hide messages. However, the concept of hiding messages is not new. There have been many methods used throughout history.

Images The ancient Chinese wrapped notes in wax and swallowed them for transport. This was a crude but effective method of hiding messages.

Images In ancient Greece, a messenger’s head would be shaved, a message was written on his head, and then his hair was allowed to grow back. Obviously, this method required some time.

Images In 1518 Johannes Trithemius wrote a book on cryptography and described a technique in which a message was hidden by having each letter taken as a word from a specific column.

Images During World War II the French Resistance sent messages written on the backs of couriers using invisible ink.

Images Microdots are images/undeveloped film the size of a typewriter period that are embedded in innocuous documents. These were said to be used by spies during the Cold War.

Images Also during the Cold War, the U.S. Central Intelligence Agency used various devices to hide messages. For example, they developed a tobacco pipe that had a small space to hide microfilm but could still be smoked.

In more recent times, but before the advent of computers, other methods were used to hide messages.

Steganography Methods and Tools

There are a number of tools available for implementing steganography. Many are free or at least have free trial versions. A few of these tools are listed here:

Images QuickStego: Easy to use but very limited

Images Invisible Secrets: Much more robust, with both a free version and a commercial version available

Images MP3Stego: Specifically for hiding payload in MP3 files

Images Stealth Files 4: Works with sound files, video files, and image files

Images Snow: Hides data in whitespace

Images StegVideo: Hides data in a video sequence

Images Invisible Secrets: A very versatile steganography tool that has several options

Cryptanalysis

Cryptanalysis is a daunting task. It essentially involves searching for some means to break through encryption of some sort. And, unlike what you see in the movies, it is a very time-consuming task that frequently leads to only partial success. Cryptanalysis involves using any method to decrypt the message that is more efficient than simple brute-force attempts. (Remember that brute forcing means simply trying every possible key.)

A cryptanalysis success is not necessarily breaking the target cipher. In fact, finding any information about the target cipher or key is considered a success. There are several types of cryptographic success:

Images Total break: The attacker deduces the secret key.

Images Global deduction: The attacker discovers a functionally equivalent algorithm for encryption and decryption but without learning the key.

Images Instance (local) deduction: The attacker discovers additional plain texts (or cipher texts) not previously known.

Images Information deduction: The attacker gains some Shannon information about plain texts (or cipher texts) not previously known.

Images Distinguishing algorithm: The attacker can distinguish the cipher from a random permutation.

Entire books have been written on cryptanalysis. The purpose of this section is just to give you some basic concepts from the field so that you have a basic understanding. There are certainly other methods not discussed in this section.

Frequency Analysis

Frequency analysis is a basic tool for breaking most classical ciphers, though it is not useful against modern symmetric or asymmetric cryptography. It is based on the fact that some letters and letter combinations are more common than others. In all languages, certain letters of the alphabet appear more frequently than others. By examining those frequencies, you can derive some information about the key that was used. In English, the words the and and are the two most common three-letter words. The most common single-letter words are I and a. If you see two of the same letters together in a word, it is most likely ee or oo.

Modern Cryptanalysis Methods

Cracking modern cryptographic methods is quite daunting. The level of success depends on a combination of resources, including computational power, time, and data. If you had an infinite amount of any of these, you could crack any modern cipher. But you won’t have an infinite amount.

The following sections describe the basic approaches used to attack block ciphers. There are other methods that are beyond the scope of this book, such as differential cryptanalysis and linear cryptanalysis. For the purposes of understanding basic computer security, it is not necessary that you master these techniques.

Known Plain Text Attack

The known plain text attack method is based on having a sample of known plain texts and their resulting cipher texts and then using this information to try to ascertain something about the key used. It is easier to obtain known plain text samples than you might think. Consider email. Many people, myself included, use a standard signature block. If you have ever received an email from me, you know what my signature block is. Then if you intercept encrypted emails I send, you can compare the known signature block to the end of the encrypted email. You would then have a known plain text and the matching cipher text to work with. Success with this method requires many thousands of known plain text samples.

Chosen Plain Text Attack

The chosen plain text attack is closely related to the known plain text attack, but with the chosen plain text attack, the attacker has found a method to get the target to encrypt messages the attacker chooses. This can allow the attacker to attempt to derive the key used and thus decrypt other messages encrypted with that key. The method can be difficult but is not impossible. It requires many thousands of chosen plain text samples to be successful.

Cipher Text Only

With a cipher text only attack, the attacker only has access to a collection of cipher texts. This is much more likely than known plain text, but it is also the most difficult type of attack. A cipher text only attack is completely successful if the corresponding plain texts can be deduced or, even better, if the key can be deduced. Even the ability to obtain any information at all about the underlying plain text is considered a success.

Related-Key Attack

A related-key attack is like a chosen plain text attack except that the attacker can obtain cipher texts encrypted under two different keys. This is actually a very useful attack if you can obtain the plain text and matching cipher text.

Cryptography Used on the Internet

What sort of encryption is used on bank websites and for e-commerce? In general, symmetric algorithms are faster and require a shorter key length to be as secure as asymmetric algorithms. However, there is the problem of how to securely exchange keys. So most e-commerce solutions use an asymmetric algorithm to exchange symmetric keys and then use the symmetric keys to encrypt the actual data.

When visiting websites that have an HTTPS at the beginning rather than HTTP, the S denotes Secure. It means traffic between your browser and the web server is encrypted—usually with either SSL (Secure Sockets Layer) or TLS (Transport Layer Security). SSL, the older of the two technologies, was developed by Netscape. Both SSL and TLS are asymmetric systems.

Quantum Computing Cryptography

One of the most engaging cryptography-related topics in recent times is quantum computing. Here we explain a bit about quantum computing and then look at its impact on cryptography.

The essential issue with quantum computing is the ability to represent more than two states. Current computing technology, using classical bits, can represent only binary values. Qubits, or quantum bits, store data via the polarization of a single photon. The two basic states are horizontal polarization and vertical polarization; however, quantum mechanics allows for a superposition of the two states at the same time—which is simply not possible in a classical bit. The two states of a qubit are represented with quantum notation as |0> and |1>, representing horizontal polarization and vertical polarization. A qubit involves the superposition of these two basis states. This superposition is represented as |ψ> = α|0> + β|1>. Essentially a classical bit can represent a 1 or a 0. A qubit can represent a 1, a 0, or any quantum superposition of those two qubit states, which allows for much more powerful computing.

Contrary to what you might have heard, current quantum computing is not at a stage to be useful in practical applications. Cutting-edge quantum systems of today have only 20 to 50 qubits and can only maintain data for a very short time. This makes for great research but not practical computing applications. However, many experts believe that within 10 years we will have a working, practical quantum computer. What does that mean for cryptography? Well, in 1995 Peter Shor published Shor’s algorithm, which proved that a quantum computer would be able to factor large numbers in a much shorter time than classical computers. A quantum computer can factor an integer N in polynomial time; actual time is log N. This is substantially faster than the most efficient known classical factoring algorithm (the general number field sieve) which works in subexponential time. RSA is based on the difficulty of factoring large numbers. A quantum computer is expected to be similarly efficient at solving discrete logarithm problems. Diffie-Hellman, MQV, Elgamal, and ECC are all based on the difficulty of solving the discrete logarithm problem.

What all this means is that when quantum computers become a practical reality, current asymmetric (public key) algorithms will become obsolete. At that point, current security for e-commerce, VPNs, and many other applications will no longer be secure. The U.S. National Institute of Standards and Technology (NIST) is already working on finding a quantum-proof cryptography standard.¹ In 2022 NIST completed that study. The algorithms chosen are listed here:

1. https://www.nist.gov/news-events/news/2019/01/nist-reveals-26-algorithms-advancing-post-quantum-crypto-semifinals

Images CRYSTALS-KYBER for public-key encryption and key-establishment algorithms (For more on CRYSTALS-KYBER, see https://pq-crystals.org/kyber/.)

Images CRYSTALS-DILITHIUM for digital signatures

Images FALCON for digital signatures

Images SPHINCS+ for digital signatures

Summary

A basic element of computer security is encryption. Sending sensitive data that is not encrypted is simply foolish. This chapter provided the basic information on how cryptography works. The most important thing to remember is that, ultimately, it is not your computer or your network that can be compromised but rather your data. Encrypting data when transmitting it is an integral part of any security plan.

In the exercises at the end of this chapter, you will practice using different cipher methods and learn more about a number of encryption methods.

Test Your Skills

Multiple Choice Questions

1. It is important to understand the concepts and application of cryptography. Which of the following most accurately defines encryption?

A. Changing a message so it can only be easily read by the intended recipient

B. Using complex mathematics to conceal a message

C. Changing a message using complex mathematics

D. Applying keys to a message to conceal it

2. Which of the following is the oldest encryption method discussed in this text?

A. PGP

B. Multi-alphabet encryption

C. Caesar cipher

D. Cryptic cipher

3. Many classic ciphers are easy to understand but not secure. What is the main problem with simple substitution?

A. It does not use complex mathematics.

B. It is easily broken with modern computers.

C. It is too simple.

D. It maintains letter and word frequency.

4. Classic ciphers were improved with the addition of multiple shifts (multiple substitution alphabets). Which of the following is an encryption method that uses two or more different shifts?

A. Caesar cipher

B. Multi-alphabet encryption

C. DES

D. PGP

5. Which binary mathematical operation can be used for a simple (but unsecured) encryption method and is in fact a part of modern symmetric ciphers?

A. Bit shift

B. OR

C. XOR

D. Bit swap

6. Why is binary mathematical encryption not secure?

A. It does not change letter or word frequency.

B. It leaves the message intact.

C. It is too simple.

D. The mathematics of it is flawed.

7. Which of the following is most true regarding binary operations and encryption?

A. They are completely useless.

B. They can form a part of viable encryption methods.

C. They are only useful as a teaching method.

D. They can provide secure encryption.

8. What is PGP?

A. Pretty Good Privacy, a public key encryption method

B. Pretty Good Protection, a public key encryption method

C. Pretty Good Privacy, a symmetric key encryption method

D. Pretty Good Protection, a symmetric key encryption method

9. Which of the following methods is available as an add-in for most email clients?

A. DES

B. RSA

C. Caesar cipher

D. PGP

10. Which of the following is a symmetric key system that uses 64-bit blocks?

A. RSA

B. DES

C. PGP

D. Blowfish

11. What is the advantage of a symmetric key system using 64-bit blocks?

A. It is fast.

B. It is unbreakable.

C. It uses asymmetric keys.

D. It is complex.

12. What size key does a DES system use?

A. 64 bit

B. 128 bit

C. 56 bit

D. 256 bit

13. What type of encryption uses different keys to encrypt and decrypt the message?

A. Private key

B. Public key

C. Symmetric

D. Secure

14. Which of the following methods uses a variable-length symmetric key?

A. Blowfish

B. Caesar

C. DES

D. RSA

15. What should you be most careful of when looking for an encryption method to use?

A. Complexity of the algorithm

B. Veracity of the vendor’s claims

C. Speed of the algorithm

D. How long the algorithm has been around

16. Which of the following is most likely to be true of an encryption method that is advertised as unbreakable?

A. It is probably suitable for military use.

B. It may be too expensive for your organization.

C. It is likely to be exaggerated.

D. It is probably one you want to use.

17. Which of the following is most true regarding certified encryption methods?

A. These are the only methods you should use.

B. It depends on the level of certification.

C. It depends on the source of the certification.

D. There is no such thing as certified encryption.

18. Which of the following is most true regarding new encryption methods?

A. Never use them until they have been proven.

B. You can use them, but you must be cautious.

C. Use them only if they are certified.

D. Use them only if they are rated unbreakable.

Exercises

EXERCISE 8.1: Using the Caesar Cipher

This exercise is well suited for group or classroom exercises.

Write a sentence in normal text.

Use a Caesar cipher of your own design to encrypt it.

Pass it to another person in your group or class.

Time how long it takes that person to break the encryption.

(Optional) Compute the mean time for the class to break Caesar ciphers.

Exercise 8.2: Using Multi-Alphabet Ciphers

This exercise also works well for group settings and is best used in conjunction with Exercise 8.1.

Write a sentence in normal text.

Use a multi-alphabet cipher of your own design to encrypt it.

Pass it to another person in your group or class.

Time how long it takes that person to break the encryption.

(Optional) Compute the mean time for the class to break these and compare that to the mean time required to break the Caesar ciphers.

Exercise 8.3: Using PGP

Download a PGP attachment for your favorite email client. A web search for PGP and your email client (that is, PGP and Outlook or PGP and Eudora) should locate both modules and instructions.

Install and configure the PGP module.

Working with a classmate, send encrypted messages back and forth.

Exercise 8.4: Finding Good Encryption Solutions

Scan the Web for various commercial encryption algorithms.

Find one that you feel may be “snake oil.”

Write a brief paper explaining your opinion.

Projects

PROJECT 8.1: RSA Encryption

Using the Web or other resources, write a brief paper about RSA, its history, its methodology, and where it is used. Students with a sufficient math background may choose to delve more deeply into the RSA algorithm’s mathematical basis.

PROJECT 8.2: Programming Caesar Cipher

This project is for students with some programming background.

Write a simple program in any language you prefer (or that your instructor specifies) that can perform a Caesar cipher. In this chapter, you not only saw how this cipher works but were given some ideas on how to use ASCII codes to make this work in any standard programming language.

PROJECT 8.3: Other Encryption Methods

Write a brief essay describing any encryption method not already mentioned in this chapter. In the paper, describe the history and origin of that algorithm. You should also provide some comparisons with other well-known algorithms.

Case Study

Jane Doe is responsible for selecting an encryption method that is suitable for her company, which sells insurance. The data the company sends is sensitive but is not military or classified in nature. Jane is looking at a variety of methods. She ultimately selects a commercial implementation of RSA. Is this the best choice? Why or why not?

Chapter 9

Computer Security Technology

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Evaluate the effectiveness of a scanner based on how it works

Images Choose the best type of firewall for a given organization

Images Understand antispyware methods

Images Employ intrusion detection systems to detect problems on a system

Images Understand honey pots

Introduction

Throughout this book, various aspects of computer security have been discussed. At this point in your studies, you should have a good idea of what the real dangers are and what adequate security measures include, as well as a basic understanding of the various forms of computer attacks. However, if you are striving to secure a network, you will need more technical details on the various security devices and software you might choose to employ. This chapter reviews these items and provides enough detail to allow you to make intelligent decisions about which types of products you will use.

Most of the devices described in this chapter have been mentioned and briefly described in the preceding chapters. The intent of this chapter is to delve more deeply into details of how these devices work. This information is of particular value to those who intend to eventually enter the computer security profession. Simply having a theoretical knowledge of computer security is inadequate. You must have some practical skills. This chapter will be a good starting point for gaining those skills, and the exercises at the end of the chapter will give you a chance to practice setting up and evaluating various types of firewalls, intrusion detection systems (IDSs), and antivirus applications.

Virus Scanners

A virus scanner is essentially software that tries to prevent a virus from infecting a system. This fact is probably abundantly obvious to most readers. Knowing how a virus scanner works, however, is another matter. This topic was discussed briefly in our previous discussions on viruses but will be elaborated on in this chapter.

In general, virus scanners work in two ways. First, a virus scanner may contain a list of all known virus definitions—that is, files that list known viruses and their file sizes, properties, and behaviors. Generally, one of the services that vendors of virus scanners provide is to periodically update these files. A virus definition list is typically in a small file, often called a .dat (short for data) file. When you update your virus definitions, what actually occurs is that your current file is replaced by the more recent one available from the vendor. The antivirus program can then scan your PC, network, and incoming email for known virus files. Any file on your PC or attached to an email is compared to the virus definition file to see whether there are matches. With emails, this can be done by looking for specific subject lines and content. The virus definitions often also include details on the file, file size, and more. This provides a complete signature of the virus.

The second way a virus scanner can work is to look for virus-like behavior. Essentially, the scanner looks to see if the file in question is doing things that viruses typically do—things like manipulating the Registry or looking through your address book. Obviously, this second technique is essentially a best guess.

How Does a Virus Scanner Work?

Let’s take a more detailed look at how antivirus software works. A 2022 U.S. News & World Report article, titled “How Does a Virus Scanner Work?”, explains that a virus scanner is essentially software that searches for a signature or pattern of a known virus.¹ Keep in mind that a scanner works only if you keep it updated. And, of course, it works only with known viruses.

1. https://www.usnews.com/360-reviews/privacy/antivirus/how-does-antivirus-software-work

Recall that the second way a virus scanner works is to watch for certain types of behaviors that are typical of viruses. This might include any program that attempts to write to your hard drive’s boot sector, change system files, automate your email software, or self-multiply. Programs that attempt to modify the system Registry (for Windows systems) or alter any system settings may also indicate virus infection.

Another feature that virus scanners search for is a file that will stay in memory after it executes. This is called a terminate and stay resident (TSR) program. Some legitimate programs do this, but such activity is often a sign of a virus. Additionally, some virus scanners use more sophisticated methods, such as scanning your system files and monitoring any programs that attempt to modify those files.

Whatever the behavior, antivirus software uses specific algorithms to evaluate the likelihood that a given file is actually a virus. It should be noted that modern virus scanners scan for all forms of malware, including Trojan horses, spyware, and viruses.

There is a third method, called heuristic scanning, which basically involves examining a file and is similar to signature scanning. However, with heuristic scanning, the file need not exactly match the signature. Heuristics refers to functions that rank various alternatives using a branching step in the algorithm. So, a heuristic scan checks for the likelihood of a given file being a virus, based on file characteristics rather than behavior.

It is important to differentiate between on-demand virus scanning and ongoing scanners. An ongoing virus scanner runs in the background and is constantly checking the PC for any sign of a virus. On-demand virus scanners run only when you launch them. Many modern antivirus scanners offer both options.

Keep in mind that any antivirus program will yield some false positives and some false negatives. A false positive occurs when the virus scanner detects a given file as a virus when in fact it is not. For example, a legitimate program may edit a Registry key or interact with your email address book. A false negative occurs when a virus is falsely believed to be a legitimate program.

Due to false positives, it is recommended that you not set your antivirus to automatically delete suspected viruses. Rather, they should be quarantined and the computer user notified.

Virus-Scanning Techniques

In general, there are six ways a virus scanner might scan for virus infections. Some of these were mentioned in the previous section, but they are outlined and defined here:

Images Email and attachment scanning: Since the primary propagation method for a virus is email, email and attachment scanning is the most important function of any virus scanner. Some virus scanners actually examine your email on the email server before downloading it to your machine. Other virus scanners work by scanning your emails and attachments on your computer before passing them to your email program. In either case, email and email attachments should be scanned before a user has a chance to open them and release viruses on the system.

Images Download scanning: Any time you download anything from the Internet, either via a web link or through an FTP program, there is a chance you might download an infected file. Download scanning works much like email and attachment scanning but operates on files you select for downloading.

Images File scanning: With file scanning, files on your system are checked to see whether they match any known virus. This sort of scanning is generally done on an on-demand basis instead of an ongoing basis. It is a good idea to schedule your virus scanner to do a complete scan of the system periodically. I recommend a weekly scan, preferably at a time when no one is likely to be using the computer.

Images Heuristic scanning: Heuristic scanning, briefly mentioned in the previous section, is perhaps the most advanced form of virus scanning. Because it uses rules to determine whether a file or program is behaving like a virus, heuristic scanning is one of the best ways to find a virus that is not a known virus. A new virus will not be on a virus definition list, so you must examine its behavior to determine whether it is a virus. However, this process is not foolproof. Some actual virus infections will be missed, and some nonvirus files might be suspected of being viruses.

Images Sandbox: The sandbox approach basically involves having a separate area, isolated from the operating system, in which a download or an attachment is run. Then, if it is infected, it won’t infect the operating system.

Images Machine learning: Most antivirus vendors are now working to implement basic machine learning algorithms into their antivirus software. This allows the antivirus software to adapt to changing attacks. Machine learning is only beginning to be used and is not yet well developed. Machine learning is a growing aspect of anti-malware.

One way to accomplish sandboxing is for the operating system to set aside a protected area of memory to open the suspected file and to monitor its behavior. This is not 100% effective, but it is far safer than simply opening files on your system and hoping there is no infection.

A related concept is called a “sheep dip” machine. This is useful in corporate networks. You set up a system that is identical in configuration to your standard workstations. However, this sheep dip machine is not networked. Suspect files are opened first on the system. Then the system is monitored for a period of time for signs of infection. Once the file has cleared this check, it can then be opened on normal workstations.

A simple way to do this in a home or small office is to set up a virtual machine on your computer and to open suspected attachments or downloads in the virtual machine first. This virtual machine can have virus scanners running on it. Also, you can change the time in the virtual machine in order to detect logic bombs. Allow the suspect file to reside on the VM for a period of time before bringing it to the host computer.

Fyi: How Most Commercial Scanners Work

Most commercial virus scanners use multiple methods, including most, if not all, of the methods listed here:

Images Active code scanning: Modern websites frequently embed active codes, such as Java applets and ActiveX. These technologies can provide some stunning visual effects to any website. However, they can also be vehicles for malicious code. Scanning such objects before they are downloaded to a computer is an essential feature in any quality virus scanner.

Images False positives and false negatives: Regardless of the type of virus scanner, any antivirus software will occasionally have an error. There are two types of errors that you should be concerned with. It is possible that your antivirus software will mistake a legitimate program for a virus. For example, you might have a program that is supposed to make some adjustment to the Windows Registry or to scan your email address book. Mistaking a legitimate program for a virus is referred to as a false positive. It is also possible that your antivirus will fail to recognize a virus. This is referred to as a false negative. The best way to minimize false negatives is to keep your antivirus software updated. For false positives, it is recommended that you simply quarantine suspected viruses and not automatically delete them.

Any virus scanner that uses only one scanning modality would be virtually worthless from a practical virus defense perspective. These modalities are how a scanner works, regardless of whether it is using a heuristic scan, download scan, email scan, and so on.

Commercial Antivirus Software

Four brands of antivirus software virtually dominate the antivirus market today, and it is typical for a company that offers a commercial scanner to also offer a free version that does not provide as many features as the commercial product. For example, AVG AntiVirus, available from www.avg.com, is a commercial product, but the company also offers the AVG AntiVirus Free Edition. McAfee, Norton, and Kaspersky are three other very well-known antivirus vendors. All four products are good choices and come with a number of options, such as spam filters and personal firewalls. Any of these four products can be purchased for a home machine for about $30 to $60 (depending on the options included). This purchase price includes a 1-year subscription to update the virus files so that the antivirus software will be able to recognize all known virus attacks, including new ones. Organizational licenses are also available to cover entire networks. Malwarebytes is another popular vendor that has both free and commercial versions.

Of course, there are other antivirus solutions available. Several free virus scanners can easily be found on the Internet. McAfee, Norton, AVG, Malwarebytes, and Kaspersky are mentioned here because they are commonly used, and it is likely that you will encounter them frequently. But my mentioning these well-known products does not mean that I discourage you from using other systems. I do, however, strongly recommend that you stick with widely used, well-supported antivirus products.

Firewalls

A firewall is, in essence, a barrier between two computers or computer systems. The most common place to encounter a firewall is between a network and the outside world. However, firewalls on individual computers and between network segments are also quite common. At a minimum, a firewall will filter incoming packets based on certain parameters, such as packet size, source IP address, protocol, and destination port. Linux and Windows (beginning with Windows XP and including all subsequent Windows versions) ship with a simple firewall. For Windows, the firewall in Windows 7 was expanded to handle filtering of both inbound and outbound traffic. Windows 8 and Windows 10 have not significantly changed the firewall functionality in Windows. You should turn on and configure your individual computer firewalls in addition to perimeter firewalls.

In an organizational setting, you will want, at a minimum, a dedicated firewall between your network and the outside world. This might be a router that also has built-in firewall capabilities. (Cisco Systems is one company that is well known for selling high-quality routers and firewalls.) Or, it might be a server that is dedicated solely to running firewall software. Selecting a firewall is an important decision. If you lack the expertise to make such a decision, then you should arrange for a consultant to assist you in this respect.

Benefits and Limitations of Firewalls

A firewall, no matter what type you get (types are described in the next section), is basically a tool to block certain traffic. A set of rules determines what traffic to allow in and what traffic to block. Obviously, a firewall is a critical piece of your security strategy. I cannot even conceive of a reason to run a system without one. However, a firewall is not a panacea for security because it cannot block every attack. For example, a firewall won’t stop you from downloading a Trojan horse. It also cannot stop internal attacks. But a firewall can be an excellent way to stop a denial of service (DoS) attack or to prevent a hacker from scanning the internal details of your network.

Firewall Types and Components

There are numerous types of firewalls and variations on those types. But most firewalls can be grouped into one of the following three families of firewalls:

Images Packet inspection

Images Stateful packet inspection

Images Application

The following sections discuss each of these and assess the advantages and disadvantages of each.

Packet Filtering

Basic packet filtering is the simplest form of firewall. It involves looking at packets and checking to see if each packet meets the firewall rules. For example, it is common for a packet filtering firewall to consider three questions:

Images Is this packet using a protocol that the firewall allows?

Images Is this packet destined for a port that the firewall allows?

Images Is the packet coming from an IP address that the firewall has not blocked?

These are three very basic rules. Some packet filtering firewalls check additional rules. But what is not checked is the preceding packets from that same source. Essentially, each packet is treated as a singular event, without reference to the preceding conversation. This makes packet filtering firewalls quite susceptible to some DoS attacks, such as SYN floods.

Stateful Packet Inspection

A stateful packet inspection (SPI) firewall examines each packet and denies or permits access based not only on the examination of the current packet but also on data derived from previous packets in the conversation. The firewall is therefore aware of the context in which a specific packet was sent. This makes such a firewall far less susceptible to ping floods and SYN floods, as well as less susceptible to spoofing. For example, if a firewall detects that the current packet is an ICMP packet and a stream of several thousand packets have been continuously coming from the same source IP, the firewall will see that this is clearly a DoS attack, and it will block the packets.

A stateful packet inspection firewall can also look at the actual contents of a packet, which allows for some very advanced filtering capabilities. Most high-end firewalls use the stateful packet inspection method; when possible, this is the recommended type of firewall.

Application Gateways

An application gateway (also known as application proxy or application-level proxy) is a program that runs on a firewall. When a client program, such as a web browser, establishes a connection to a destination service, such as a web server, it connects to an application gateway, or proxy. The client then negotiates with the proxy server in order to gain access to the destination service. In effect, the proxy establishes the connection with the destination behind the firewall and acts on behalf of the client, hiding and protecting individual computers on the network behind the firewall. This process actually creates two connections. There is one connection between the client and the proxy server, and there is another connection between the proxy server and the destination.

Once a connection is established, the application gateway makes all decisions about which packets to forward. Since all communication is conducted through the proxy server, computers behind the firewall are protected.

Essentially, an application firewall is used for specific types of applications, such as database or web server applications. It is able to examine the protocol being used (such as HTTP) for any anomalous behavior and block traffic that might get past other types of firewalls. It is common to have an application firewall that also includes stateful packet inspection.

Firewall Configurations

In addition to the various types of firewalls, there are various configuration options. The type of firewall tells you how it will evaluate traffic and hence decide what to allow and what not to allow. The configuration gives you an idea of how that firewall is set up in relation to the network it is protecting. Some of the major configurations/implementations for firewalls include the following:

Images Network host-based firewall

Images Dual-homed host

Images Router-based firewall

Images Screened host

All of these configurations are discussed in the following sections.

Network Host-Based Firewalls

A network host-based firewall is a software solution installed on an existing machine with an existing operating system. The most significant concern in using this type of firewall is that no matter how good the firewall solution is, it is contingent upon the underlying operating system. In such a situation, it is absolutely critical that the machine hosting the firewall have a hardened operating system.

Dual-Homed Host

A dual-homed host is a firewall running on a server with at least two network interfaces. The server acts as a router between the network and the interfaces to which it is attached. To make this work, the automatic routing function is disabled, meaning that an IP packet from the Internet is not routed directly to the network. You can choose what packets to route and how to route them. Systems inside and outside the firewall can communicate with the dual-homed host but cannot communicate directly with each other.

Router-Based Firewall

As was previously mentioned, you can implement firewall protection on a router. In larger networks with multiple layers of protection, this is commonly the first layer of protection. Although you can implement various types of firewalls on a router, the most common type used is packet filtering. If you use a broadband connection in your home or small office, you can get a packet-filtering firewall router to replace the basic router provided to you by the broadband company. In recent years, router-based firewalls have become increasingly common and are in fact the most common type of firewall used today.

Screened Host

A screened host is really a combination of firewalls. In this configuration, you use a combination of a bastion host and a screening router. The screening router adds security by allowing you to deny or permit certain traffic from the bastion host. It is the first stop for traffic, which can continue only if the screening router lets it through.

Types of Firewalls

In addition to configuration, there are many different types of firewalls. The different types are utilized for different goals. It is important in cybersecurity to understand the various firewalls.

Application-Layer Firewalls and Circuit-Level Gateways

Both application-layer firewalls and circuit-level gateways are firewall designs that sit between a client and a web server and communicate with the server on behalf of the client. They stand in place of the other party and can be used to cache frequently accessed pages. Application-layer firewalls and circuit-level gateways increase security and prevent direct access into or out of a network. Circuit-level gateways work at the session layer of the OSI model and can monitor TCP packets. Application-layer firewalls can examine packets at the application layer. Application-layer firewalls can also filter application-specific commands and can be configured as web proxies.

Web Application Firewall

A web application firewall (WAF) is, as the name suggests, specifically for protecting websites. It protects against common web attacks such as SQL injection, cross-site scripting, parameter tampering, and the like. Cloudflare describes a WAF as follows:²

2. https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/

A WAF or web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model), and is not designed to defend against all types of attacks. This method of attack mitigation is usually part of a suite of tools which together create a holistic defense against a range of attack vectors.

NGFW

Next-generation firewall (NGFW) is a general term that refers to a stateful packet inspection firewall that includes additional features such as integrated intrusion detection systems, application gateway features, and deep packet inspection.

Blacklisting/Whitelisting

Most firewalls allow you to choose between blacklisting or whitelisting. Blacklisting is a security approach wherein users are allowed to visit any website or Internet resource except those on the prohibited list, called a blacklist. Blacklisting is very permissive as users are only prevented from visiting the sites on a specific list.

Whitelisting involves preventing users from visiting any Internet resource other than the resources that are on the approved list, called a whitelist. Whitelisting is far more restrictive than blacklisting, and hence it is more secure.

The problem with blacklisting is that it is impossible to know and list every website that users should not visit. No matter how thorough the blacklist is, it will allow traffic to some sites it should not. Whitelisting is far more secure but also less user friendly.

Commercial and Free Firewall Products

A variety of commercial firewall products are available, some of them free. If all you want is a basic packet-filtering solution, you can find such a solution from many software vendors. Major antivirus software vendors (including those mentioned previously in this chapter) often offer firewall software as a bundled option with antivirus software. Other companies, such as Zone Labs, sell firewall and IDSs. Major manufacturers of routers and hubs, such as Cisco Systems, also offer firewall products. How much security you need is difficult to determine. A bare minimum recommendation is to have a packet-filtering firewall/proxy server between your network and the Internet—but that is a bare minimum.

ZoneAlarm

Zone Labs offers the ZoneAlarm Security Suite, which provides all the tools for complete Internet security. It also offers a free personal firewall solution (see https://www.zonealarm.com/software/free-firewall/).

Windows 10 Windows Defender Firewall

Windows 10 ships with a fully functioning firewall, called Windows Defender Firewall. (In fact, Windows has shipped with a firewall for many years.) Windows Defender Firewall can block inbound and outbound packets. To access it, click the Start button and type Firewall. Figure 9.1 shows Windows Defender Firewall.

Figure 9.1 Windows 10 Windows Defender Firewall.

Note that Windows Defender Firewall looks very similar to the firewall in Windows 11, Windows Server 2012, 2016, and Server 2019, but it is different from the firewall in Windows 7.

Beginning with Windows Server 2008 and for all versions after that, Windows includes stateful packet inspection firewalls. With Windows Defender Firewall for Windows 10, you can set different rules for outbound and inbound traffic. For example, your standard workstation will probably allow outbound HTTP traffic on port 80, but you might not want to allow inbound traffic (unless you are running a web server on that workstation).

You can also set up rules for a port, a program, a custom rule, or one of the many predefined rules that Microsoft allows you to select. You can also choose not only to allow or block a connection but to allow it only if it is secured by IPsec. This means you have three options for any connection.

Rules can allow or block given applications or ports. You can also have different rules for inbound and outbound traffic. The rules allow you to decide whether a particular type of communication is blocked or allowed. You can have different settings for inbound and outbound traffic. You can set rules for individual ports (all 65,554 available network ports) and for applications. The rules in the Windows 10 firewall give you a lot of flexibility.

Most importantly, you can apply rules differently depending on where traffic comes from. You can set up rules for three areas or profiles:

Images Domain: For computers authenticated on your domain.

Images Public: For computers from outside your network. You would treat outside traffic more carefully than traffic coming from another machine in your domain.

Images Private: Private refers to traffic from your own computer.

Firewall Logs

Firewalls are excellent tools for attempting to ascertain what has happened after an incident has occurred. Almost all firewalls, regardless of type or implementation, log activity. Firewall logs can provide valuable information that can assist in determining the source of an attack, methods used to attack, and other data that might help either locate the perpetrator of an attack or at least prevent a future attack using the same techniques. Any security-conscious network administrator should make it a routine habit to check the firewall logs.

Antispyware

Antispyware, as discussed earlier in this book, scans a computer to see whether there is spyware running on the machine. This is an important element of computer security software that was at one time largely ignored. Even today, not enough people take spyware seriously or guard against it. Most antispyware works by checking the system for known spyware files. Each application must simply be checked against a list of known spyware. This means that you must maintain some sort of subscription service so that you can obtain routine updates to your spyware definition list. Most antivirus solutions now also check for spyware.

In today’s Internet climate, running antispyware is as essential as running antivirus software. Failing to do so can lead to serious consequences. Personal data, and perhaps sensitive business data, could easily be leaking out of your organization without your knowledge. And, as was pointed out earlier in this book, it is entirely possible for spyware to be the vehicle for purposeful industrial espionage.

Barring the use of antispyware, or even in conjunction with such software, you can protect yourself via your browser’s security settings, as discussed in a previous chapter. Additionally, several times throughout this book, you have been warned to be cautious about attachments and Internet downloads. You would also be well advised to avoid downloading various Internet “enhancements,” such as skins and toolbars. If you are in an organization, prohibiting such downloads should be a matter of company policy. Unfortunately, many websites today require some sort of add-in such as Flash in order to function properly. The best advice for this situation is to only allow add-ins on trusted, well-known sites.

IDSs

Intrusion detection systems (IDSs) have become much more widely used in the past few years. Essentially, an IDS inspects all inbound and outbound port activity on a machine/firewall/system, looking for patterns that might indicate break-in attempts. For example, if an IDS finds that a series of ICMP packets were sent to each port in sequence, this probably indicates that the system is being scanned by network-scanning software, such as Cerberus. This type of scan is often a prelude to an attempt to breach system security, and it can be very important to know that someone is performing preparatory steps to infiltrate your system.

Entire volumes have been written on how IDSs work. This chapter cannot hope to cover that much information. However, it is important that you have a basic idea of how these systems work.

The sections that follow first examine the broad categories in which IDSs tend to be viewed and then look at some specific approaches to IDSs. While this information is not all inclusive, the following sections do address the most common terminology used.

IDS Categorization

There are a number of ways in which IDSs can be categorized. The most common IDS categorizations are as follows:

Images Passive IDSs

Images Active IDSs

Passive IDSs

A passive IDS just monitors suspicious activity and logs it. In some cases, an IDS may notify the administrator of the activity in question. This is the most basic type of IDS. Any modern system should have, at a minimum, a passive IDS along with the firewall, antivirus, and other basic security measures.

Active IDSs

An active IDS, also called an intrusion prevention system (IPS), takes the added step of shutting down the suspect communication. Whether one uses an IDS or IPS is a decision that must be made after a thorough risk analysis.

Just as with antivirus software, it is possible for an IDS to have a false positive. It might suspect that something is an attack when in fact it is legitimate traffic. Imagine that an active IDS is looking at threshold monitoring to determine if an attack is occurring. A particular user normally works between the hours of 8 a.m. and 5 p.m. and uses a relatively small amount of bandwidth. If the IDS detects the user at 10 p.m. using 10 times his normal bandwidth, it might perceive that this is an attack and shut down the offending traffic. However, it may be found later that this was a legitimate user working late on a critical project that was due to a client the next day, and the IPS prevented that from happening. This is a false positive.

This is an excellent place to consider risk analysis. You have to weigh the hazards of false positives against the risk of allowing an attack to proceed undetected before deciding whether a passive IDS or an IPS is appropriate for your organization. It is often the case that different network segments will have different risk profiles. You may find that a passive IDS is appropriate for most of your network but that an IPS is needed for the most sensitive network segments.

Identifying an Intrusion

There are really two ways of identifying an intrusion. The first method is signature based. IDS signatures are similar to the signatures used by antivirus. However, IDS signatures cover issues beyond malware. For example, certain DoS attacks have specific signatures that can be recognized.

The second method is statistical anomaly. Essentially, any activity that seems outside normal parameters and far enough outside the given parameters to be a likely attack is identified as a probable attack. Any number of activities can trigger this type of alert, such as a sudden increase in bandwidth utilization or user accounts accessing resources they have never accessed before.

Most IDSs use both forms of attack identification. The two real issues for selecting an IDS are its ease of use and its signature database. There are certainly other considerations, such as price, but ease of use and its signature database are the most important in deciding on an IDS.

IDS Elements

Whether it is an active IDS or a passive IDS, and regardless of whether it is commercial or open source, certain elements/terms are common to all IDSs:

Images A sensor is the IDS component that collects data and passes it to the analyzer for analysis.

Images The analyzer is the component or process that analyzes the data collected by the sensor.

Images The manager is the IDS interface used for management. It is a software component of the IDS.

Images The operator is the person primarily responsible for the IDS.

Images Notification is the process or method by which the IDS manager makes the operator aware of an alert.

Images An activity is an element of a data source that is of interest to the operator. It may or may not be a possible attack.

Images An event is any activity that is deemed to be suspicious and a possible attack.

Images An alert is a message from the analyzer indicating that an event has occurred.

Images The data source is raw information that the IDS is analyzing to determine if there has been an event.

All these elements are part of an IDS, and they function together to capture traffic, analyze that traffic, and report anomalous activity to the operator of the IDS. An IPS has additional elements that enable it to shut down offending traffic.

Snort

A number of vendors supply IDSs, and each has unique strengths and weaknesses. Which system is best for your environment depends on many factors, including the network environment, security level required, budget constraints, and skill level of the person who will be working directly with the IDS. One popular open-source IDS is Snort, which can be downloaded for free from www.snort.org.

We will examine Snort briefly in this section. While it is not the only IDS available, it is free, and that makes it an attractive option for many people. We will walk through the basic configuration of Snort for Windows.

First, you must visit www.snort.org and register (for free). Then download the Snort installation program and the latest rules. Make certain you download the installer that has an .exe extension. The .rpm extensions are for Linux. Also, I have found that certain versions of Microsoft Internet Explorer do not work well with the Snort website, so it is recommended that you use an alternative browser such as Mozilla Firefox.

Once you have downloaded both the rules and the installation program, start the installation. Most of it is quite simple. There is a screen that asks you if you wish to support database connectivity. For most live situations, you would want to dump your Snort records to some database. However, for demonstration purposes, choose I Do Not Plan to Log to a Database. Figure 9.2 shows the installation options.

Figure 9.2 Snort installation options.

Other than this, simply use all default settings. At the end, the installation program will also attempt to install WinPCAP. If for some reason this fails, you will need to download and install it separately. WinPCAP is an open-source tool for capturing packets, and all IDSs depend on packet capturing.

After you copy the rules you downloaded from wherever you saved them to C:\snort\rules, you need to copy the configuration file from C:\snort\rules\etc\snort.conf to C:\snort\etc. Open that configuration file using WordPad, not Notepad. (Notepad does not support word wrap, and it will be difficult to read the configuration file in Notepad.)

You need to change the HOME_NET any to your machine’s IP address, as shown in Figure 9.3. In a live situation, you would also set the other IP addresses (for the web server, SQL server, DNS server, and so on).

Figure 9.3 HOME_NET address.

Now you need to find and change the rule paths, which are Linux-style paths, as shown in Figure 9.4.

Figure 9.4 Linux-style paths.

You need to change them to Windows-style paths, as shown in Figure 9.5.

Figure 9.5 Windows-style paths.

You now need to find and change the library paths. This is a bit difficult because the names of the paths and the files are a bit different in Windows. The Linux-style library paths will look like the ones shown in Figure 9.6.

Figure 9.6 Linux-style library paths.

You can find your Windows pathnames and filenames by looking in the folder shown in Figure 9.7.

Figure 9.7 Windows-style library paths.

Note

If you find that you do not have a particular file or path in your system, just make sure it is commented out in the configuration file.

You must find the reference data and change it from Linux-style paths to Windows-style paths, as shown in Figure 9.8.

Figure 9.8 Reference paths.

You are almost done. Now search for this:

#output log_tcp dump

and after it, add this line:

output alert_fast: alert.ids

Note

The pound sign (#) indicates a comment.

Now you need to use the command line to start Snort. Simply navigate to C:\snort\bin. There are several different ways to start Snort. Many of the common ones are listed in Table 9.1. I recommend that you try the simplest one first.

Table 9.1 Snort Commands

Command

Purpose

snort -v

Start Snort as just a packet sniffer.

snort -vd

Start Snort as a packet sniffer but have it sniff packet data rather than just the headers.

snort -dev -l ./log

Start Snort in logging mode so it logs packets.

snort -dev -l ./log -h
192.168.1.1/24 -c snort.conf (replacing 192.168.1.1/24 with your IP address)

Start Snort in IDS mode.

Snort is free and open source, but many people have a great deal of difficulty working with it at first. The slightest error in your configuration file or the command line startup will cause it to not run correctly. The purpose of this section is just to introduce you to Snort. For more information on Snort, see the following sites:

Images Snort Manual: http://manual-snort-org.s3-website-us-east-1.amazonaws.com/

Images Writing Snort Rules: http://paginas.fe.up.pt/~mgi98020/pgr/writing_snort_rules.htm+

Snort rules, which can be downloaded from https://www.snort.org/downloads#rules, consist of two parts:

Images Rule header: This is where the rule’s actions are identified.

Images Rule options: This is where the rule’s alert messages are identified.

Here is a sample rule:

Click here to view code image

Alert tcp any any -> any 80 (content: "attackdetected"; msg: "Looks like an attack";)

The text up to the first parenthesis is the rule header. This first part is known as the rule action; in the example just provided, Alert is the action. Rule actions can include the following:

Images Alert

Images Log

Images Pass

Images Activate

Images Dynamic

The next item in a rule is the protocol. In the example above, TCP is the protocol. After the protocol are the source address and mask. Although the example uses any, a rule can use a specific network, such as 192.168.1.0/16. This is followed by the target IP address and mask, which again can be specific or listed as any. The final entry of the rule header is the port; in this example, the port is 80.

You may wish to consider the Security Onion Linux distribution, which can be downloaded from https://securityonion.net. Security Onion is an open-source Linux distribution that includes intrusion detection and log management tools like Snort, Suricata, Bro, Wazuh, Sguil, Squert, CyberChef, Zeek, Elasticsearch, Logstash, and Kibana.

Honey Pots

A honey pot is an interesting technology. Essentially, it assumes that an attacker is able to breach your network security, and it would be best to distract that attacker away from your valuable data. Therefore, a honey pot involves creating a server that has fake data—perhaps an SQL server or Oracle server loaded with fake data, and just a little less secure than your real servers. Then, since none of your actual users ever access this server, monitoring software is installed to alert you when someone does access this server.

A honey pot achieves two goals. First, it takes the attacker’s attention away from the data you wish to protect. Second, it provides what appears to be interesting and valuable data, thus leading the attacker to stay connected to the fake server, giving you time to try to track the attacker. Commercial solutions, such as Specter (www.specter.com), are available. These solutions are usually quite easy to set up and include monitoring/tracking software. You may also find it useful to check out www.honeypots.org for more information on honey pots in general and on specific implementations.

Honey pots can be both low and high interaction. Low-interaction honey pots work by emulating services and programs that would be found on an individual’s system. If the attacker does something that the emulation does not expect, the honey pot generates an error.

High-interaction systems perfectly emulate a system or network of computers. The idea is to have a controlled area in which the attackers can interact with what appear to be real applications and programs. High-interaction honey pots rely on the border devices controlling traffic so that attackers can get in, but they tightly control outbound activity.

Database Activity Monitoring

Database activity monitoring (DAM) involves monitoring and analyzing database activity that operates independently of the database management system (DBMS). It is separate from the DBMS auditing, logging, and monitoring. Database activity monitoring and prevention (DAMP) is an extension to DAM that goes beyond monitoring and alerting to also blocking unauthorized activities.

Gartner provides a very good description of DAM:³

3. https://www.gartner.com/en/information-technology/glossary/database-activity-monitoring-dam

Database activity monitoring (DAM) refers to a suite of tools that can be used to support the ability to identify and report on fraudulent, illegal or other undesirable behavior, with minimal impact on user operations and productivity. The tools, which have evolved from basic analysis of user activity in and around relational database management systems (RDBMSs) to encompass a more comprehensive set of capabilities, such as discovery and classification, vulnerability management, application-level analysis, intrusion prevention, support for unstructured data security, identity and access management integration, and risk management support.

Database activity monitoring is usually done using one of two methods. The first is memory based. In a memory-based scenario, the DAM essentially attaches a lightweight sensor to the database and continually polls the system to collect what SQL statements are being executed. The second method is to analyze the database transaction logs. In both cases, what is occurring is the system is examining what SQL statements are executed on the target system.

SIEM

A security information and event management (SIEM) system helps coordinate security activity on a network. The idea of a SIEM system is to aggregate logs from all of your security systems (firewalls, IDSs, IPSs, and so on) and then monitor and scan those logs. Most security personnel can attest to the difficulty of analyzing logs. Logs become large and difficult to review. Having a system that reviews all of your logs and alerts you when something requires your direct attention can make security management much more streamlined.

A 2022 article in CSO magazine provides the following definition:⁴

4. https://www.csoonline.com/article/2124604/what-is-siem-security-information-and-event-management-explained.xhtml

Security information and event management (SIEM) tools collect and aggregate log and event data to help identify and track breaches. They are powerful systems that give enterprise security professionals both insight into what’s happening in their IT environment right now and a track record of relevant events that have happened in the past.

Other Preemptive Techniques

Besides IDSs, antivirus software, firewalls, and honey pots, there are a variety of preemptive techniques an administrator can use to attempt to reduce the chances of a successful attack being executed against a network.

Intrusion Deflection

Intrusion deflection is becoming increasingly popular among security-conscious administrators. The essence of it is quite simple: An attempt is made to attract the intruder to a subsystem set up for the purpose of observing intruders. This is done by tricking the intruder into believing that he has succeeded in accessing system resources when, in fact, he has been directed to a specially designed environment. Being able to observe the intruder while he practices his art will yield valuable clues and can lead to his arrest.

Intrusion deflection is often done by using a honey pot. Essentially, you set up a fake system, possibly a server that appears to be an entire subnet. You make that system look very attractive by perhaps making it appear to contain sensitive data, such as personnel files, or valuable data, such as account numbers or research. The actual data stored in this system is fake. The real purpose of the system is to carefully monitor the activities of any person who accesses the system. Since no legitimate user ever accesses this system, it is a given that anyone accessing it is an intruder.

Intrusion Deterrence

Intrusion deterrence involves simply trying to make a system seem like a less palatable target. In short, an attempt is made to make any potential reward from a successful intrusion attempt appear more difficult than it is worth. This approach includes tactics such as attempting to reduce the apparent value of the system’s worth through camouflage, which essentially means working to hide the most valuable aspects of the system. Another tactic in this methodology involves raising the perceived risk of a potential intruder being caught. This can be done in a variety of ways, including conspicuously displaying warnings and warning of active monitoring. The perception of the security of a system can be drastically improved, even when the actual system security has not been improved.

Authentication

When a user logs on to a system, the system needs to authenticate her (and sometimes the user needs to authenticate the system). There are many authentication protocols. A few of the most common ones are briefly described here:

Images PAP: Password Authentication Protocol is the simplest form of authentication and the least secure. Usernames and passwords are sent unencrypted, in plain text. This is obviously a very old method that is not used anymore. However, in the early days of computing, there were no widely available packet sniffers, and security was far less of a concern.

Images SPAP: Shiva Password Authentication Protocol is an extension to PAP that encrypts the username and password that are sent over the Internet.

Images CHAP: Challenge Handshake Authentication Protocol calculates a hash after the user has logged in. Then it shares that hash with the client system. Periodically the server will ask the client to provide that hash. (This is the challenge part.) If the client cannot provide it, then it is clear that the communications have been compromised. MS-CHAP is a Microsoft-specific extension to CHAP. These are the basic steps:

After the handshake phase is complete, the authenticator (often the server) sends a “challenge” message to the peer.

The peer responds with a value calculated using a “one-way hash” function.

The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged; otherwise, the connection should be terminated.

At random intervals, the authenticator sends a new challenge to the peer and repeats steps 1 to 3.

The goal of CHAP is to not only authenticate but to periodically reauthenticate, thus preventing session hijacking attacks.

Images EAP: Extensible Authentication Protocol is a framework frequently used in wireless networks and point-to-point connections. It was originally defined in RFC 3748 but has been updated since then. It handles the transport of keys and related parameters. There are several versions of EAP, and it has many variations, including these:

Images LEAP: Lightweight Extensible Authentication Protocol was developed by Cisco and has been used extensively in wireless communications. LEAP is supported by many Microsoft operating systems, including Windows 7 and later versions. LEAP uses a modified version of MS-CHAP.

Images EAP-TLS: Extensible Authentication Protocol–Transport Layer Security uses TLS to secure the authentication process. Most implementations of EAP-TLS utilize X.509 digital certificates to authenticate the users.

Images PEAP: Protected Extensible Authentication Protocol encrypts the authentication process with an authenticated TLS tunnel. PEAP was developed by a consortium including Cisco, Microsoft, and RSA Security. It was first included in Microsoft Windows XP.

Images Kerberos: Kerberos is used widely, particularly with Microsoft operating systems. It was invented at MIT and derives its name from the mythical three-headed dog that was reputed to guard the gates of Hades. The system is a bit complex, but the basic process is as follows: When a user logs in, the authentication server verifies the user’s identity and then contacts the ticket-granting server. (These servers are often on the same machine.) The ticket-granting server sends an encrypted ticket to the user’s machine. That ticket identifies the user as being logged in. Later, when the user needs to access some resource on the network, the user’s machine uses that ticket-granting ticket to get access to the target machine. There is a great deal of verification for the tickets, and these tickets expire in a relatively short time.

More on Kerberos

Because Kerberos is so widely used, it bears a bit closer look than the other authentication methods. In this section we will look a bit more in depth at Kerberos. If this is your first exposure to Kerberos, you may need to read this section more than once to really digest it. While there are variations, the basic process is shown in Figure 9.9. (Note that Figure 9.9 is a very simplified overview of Kerberos and omits some steps that are discussed later in this section.)

Figure 9.9 Kerberos.

The elements of Kerberos follow:

Images Principal: A server or client that Kerberos can assign tickets to.

Images Authentication server (AS): A server that authorizes the principal and connects it to the ticket-granting server.

Images Ticket-granting server (TGS): A server that provides tickets.

Images Key distribution center (KDC): A server that provides the initial ticket and handles TGS requests. Often it runs both the AS and TGS. It must be noted that Kerberos is one of the most widely used authentication protocols. Europe often uses an alternative, SESAME (Secure European System for Applications in a Multivendor Environment).

The Kerberos process consists of messages, denoted by letters, being sent between the client and the KDC. First, the AS generates a secret key by creating a hash of the user password and then sends two messages to the client:

Images Message A: This is the client/TGS session key, encrypted with the secret key of the client.

Images Message B: The TGT includes the client ID, client network address, and validity period.

The messages are encrypted using the key the AS generated. Then the user attempts to decrypt Message A with a secret key generated by the client hashing the user’s entered password. If that entered password does not match the password the AS found in the database, then the hashes don’t match, and the decryption won’t work. If it does work, then Message A contains the client/TGS session key that can be used for communications with the TGS. Message B is encrypted with the TGS secret key and cannot be decrypted by the client. (Notice that the password is never actually sent across the network.)

When requesting services, the client sends the following messages to the TGS:

Images Message C: This message is composed of the TGT from Message B and the ID of the requested service.

Images Message D: This message is an authenticator (which is composed of the client ID and the timestamp), encrypted using the client/TGS session key.

Upon receiving Messages C and D, the TGS retrieves Message B out of Message C. It decrypts Message B by using the TGS secret key. This gives it the client/TGS session key. Using this key, the TGS decrypts Message D (the authenticator) and sends the following two messages to the client:

Images Message E: This is the client-to-server ticket (which includes the client ID, client network address, validity period, and client/server session key) encrypted using the service’s secret key.

Images Message F: This is the client/server session key encrypted with the client/TGS session key.

Upon receiving Messages E and F from the TGS, the client has enough information to authenticate itself to the service server (SS). The client connects to the SS and sends the following Message E (the client-to-server ticket, encrypted using the service’s secret key) along with this new message:

Images Message G: This is the new authenticator, which includes the client ID and a timestamp and is encrypted using the client/server session key.

The SS decrypts Message E using its own secret key to retrieve the client/server session key. Using the sessions key, SS decrypts Message G and sends the following message to the client to confirm its true identity and willingness to serve the client:

Images Message H: This is the timestamp in the client’s authenticator.

The client decrypts the confirmation (Message H) by using the client/server session key and checks whether the timestamp is correct. If it is, the client can trust the server and can start issuing service requests to the server. The server then provides the requested services to the client.

Yes, this process is quite convoluted—intentionally so. However, you have probably used this authentication method many times, even if you weren’t aware of it. It is very common.

Digital Certificates

It seems very likely that you have heard the term digital certificate previously. The first thing you may wonder is what does a digital certificate do? Recall our discussions of asymmetric cryptography in Chapter 8, “Encryption.” We mentioned that the public key can be disseminated widely since it can only be used to encrypt messages to us. Well, how does one provide people with a public key? The most common method is via a digital certificate. The digital certificate contains the user’s public key, along with other information. However, a digital certificate can provide much more. It can provide a means for authenticating that the holder of the certificate is who she claims to be.

X.509 is an international standard for the format and information contained in a digital certificate. X.509 is the most common type of digital certificate in the world. It is a digital document that contains a public key signed by the trusted third party that is known as a certificate authority, or CA.

The following are the basic items in an X.509 certificate, though there can be other optional information:

Images Version: This is the version of X.509 that this certificate complies with.

Images Certificate holder’s public key: This is the primary way of getting someone’s public key from his X.509 certificate.

Images Serial number: This is a unique identifier for this certificate.

Images Certificate holder’s distinguished name: This is often a domain name or an email address associated with a certificate.

Images Certificate’s validity period: One year is the most common validity period.

Images Unique name of certificate issuer: This is the certificate authority that issued this certificate.

Images Digital signature of issuer: This field and the next are used to verify the certificate.

Images Signature algorithm identifier: This identifies the digital signature algorithm used.

Let us see how this works in a common scenario. Say that you visit your bank’s website. In order to get the bank’s public key, your browser will download that bank’s digital certificate. But there is a problem. Could someone have set up a fake site, claiming to be your bank? Could that person have also generated a fake certificate, claiming to be the bank? Yes, it’s possible. This is one place digital certificates help us out. Your browser will look at the certificate issuer listed on the certificate and first ask if that is a CA that your browser trusts. If it is, then your browser communicates with that CA to get that CA’s public key. (Recall from Chapter 8 that a digital signature is created with a private key and verified with the public key.) The browser uses that CA public key to verify the CA signature on the certificate. If this is a fake certificate, the digital signature won’t be recognized. This means a certificate not only provides you with the certificate holder’s public key but also gives you a method of verifying that entity with a trusted third party.

It should be noted that unlike X.509 certificates, PGP (Pretty Good Privacy) certificates are not issued by a CA and don’t have a mechanism for third-party verification. They are usually used only for email communication. This is because it is assumed that you know who you are emailing, so verifying that identity is not required.

There are some other terms and concepts related to digital certificates that you need to be familiar with. Let us begin with a CA, the entity that issues you a digital certificate. Comodo, Symantec, DigiCert, GoDaddy, Verisign, and Thawte are all well-known certificate authorities. When you purchase a certificate from one of these vendors, it first verifies who you are. (This can be as simple as matching your credit card number with the domain you are buying the certificate for, or it can be far more involved.)

Since verifying a certificate user can be time-consuming, many CAs offload that process to a registration authority (RA), which notifies the CA about whether to issue the certificate.

A CRL (certificate revocation list) is a list of certificates issued by a CA that are no longer valid. CRLs are distributed in two main ways: In the push model, the CA automatically sends the CRL out at regular intervals. In the pull model, the CRL is downloaded from the CA by those who want to see it to verify a certificate. The problem is that a CRL does not involve real-time checking. Thus, the newer answer is Online Certificate Status Checking Protocol (OCSP), which checks in real time whether the certificate is still valid.

SSL/TLS

What sort of encryption is used on bank websites and for e-commerce? In general, symmetric algorithms are faster and require a shorter key length to be as secure as asymmetric algorithms. However, there is the problem of how to securely exchange keys. Most e-commerce solutions use an asymmetric algorithm to exchange symmetric keys and then use the symmetric keys to encrypt the data.

When visiting websites that have an https at the beginning, rather than http, the s denotes secure. It means traffic between your browser and the web server is encrypted—usually with either SSL (Secure Sockets Layer) or TLS (Transport Layer Security). SSL and TLS are both asymmetric systems.

SSL, the older of the two technologies, is used to allow for transport-layer security via public key encryption. SSL was developed by Netscape for transmitting private documents via the Internet. By convention, URLs that require an SSL connection start with https instead of http. There have been several versions:

Images Unreleased v1 (Netscape)

Images Version 2, released in 1995 (and had many flaws)

Images Version 3, released in 1996 (RFC 6101)

Images Standard TLS1.0 (RFC 2246), released in 1999

Images TLS 1.1, defined in RFC 4346 in 2006

Images TLS 1.2, defined in RFC 5246 in 2008 (and based on the earlier TLS 1.1 specification)

Images TLS 1.3, defined in RFC 8446 in 2018

Figure 9.10 shows the basic process of establishing an SSL/TLS connection.

Figure 9.10 SSL/TLS.

Note that step 3 does not actually involve communication with the CA. It is common for computers to have a certificate store that contains digital certificates for known and trusted CAs. Thus, the client machine need only check its own certificate store for the CA certificate.

The process of establishing an SSL/TLS connection involves several complex steps, as defined here:

The client sends the server information regarding the client’s cryptographic capabilities, including what algorithms it is capable of, what hashing algorithms it can use for message integrity, and related information.

The server responds by selecting the best encryption and hashing that both the client and server are capable of and sends this information to the client. The server also sends its own certificate, and if the client is requesting a server resource that requires client authentication, the server requests the client’s certificate.

The client uses the information sent by the server to authenticate the server. This means authenticating the digital certificate with the appropriate CA. If this fails, the browser warns the user that the certificate cannot be verified. If the server can be successfully authenticated, the client proceeds to the next step. (However, modern computers ship with the certificates for the major CAs. These are usually in a certificate store on the computer. Thus to validate a certificate from a given CA, the client computer only has to get that CA’s digital certificate from its own store.)

Using all data generated in the handshake thus far, the client creates the pre-master secret for the session, encrypts it with the server’s public key that it received from the server’s X.509 certificate, and then sends the encrypted pre-master secret to the server.

If the server has requested client authentication, then the server will also authenticate the client’s X.509 certificate. This does not happen in most e-commerce and banking websites.

Both the client and the server use the master secret to generate the session keys. These are symmetric keys (such as AES) that will be used throughout the session to encrypt information between the client and the server.

The client sends a message to the server, informing it that future messages from the client will be encrypted with the session key.

The server sends a message to the client, informing it that future messages from the server will be encrypted with the session key.

Note

Use of the terms master and slave is ONLY in association with the official terminology used in industry specifications and standards and in no way diminishes Pearson’s commitment to promoting diversity, equity, and inclusion and challenging, countering, and/or combating bias and stereotyping in the global population of the learners we serve.

This process not only allows for secure exchange of a symmetric key but enables verification of the server and (optionally) verification of the client. This is how secure web traffic is accomplished.

Virtual Private Networks

A VPN (or virtual private network) essentially provides a way to use the Internet to create a virtual connection between a remote user or site and a central location. The packets sent back and forth over this connection are encrypted, thus making it private. The VPN must emulate a direct network connection.

Three different protocols are used to create VPNs:

Images Point-to-Point Tunneling Protocol (PPTP)

Images Layer 2 Tunneling Protocol (L2TP)

Images Internet Protocol Security (IPsec)

These protocols are discussed in more depth in the following sections.

Point-to-Point Tunneling Protocol

Point-to-Point Tunneling Protocol (PPTP) is the oldest of the three protocols used in VPNs. It was originally designed as a secure extension to Point-to-Point Protocol (PPP). PPTP was originally proposed as a standard in 1996 by the PPTP Forum—a group of companies that included Ascend Communications, ECI Telematics, Microsoft, 3Com, and U.S. Robotics. It adds the features of encrypting packets and authenticating users to the older PPP protocol. PPTP works at the data link layer of the OSI model (discussed in Chapter 2, “Networks and the Internet”).

PPTP offers two different protocols for authenticating the user: Extensible Authentication Protocol (EAP) and Challenge Handshake Authentication Protocol (CHAP). EAP was actually designed specifically for PPTP and is not proprietary. CHAP is a three-way process whereby the client sends a code to the server, the server authenticates it, and then the server responds to the client. CHAP also periodically reauthenticates a remote client, even after the connection is established.

PPTP uses Microsoft Point-to-Point Encryption (MPPE) to encrypt packets. MPPE is actually a version of DES. DES is still useful for many situations; however, newer versions of DES, such as DES 3, are preferred.

Layer 2 Tunneling Protocol

Layer 2 Tunneling Protocol (L2TP) was explicitly designed as an enhancement to PPTP. Like PPTP, it works at the data link layer of the OSI model. It has several improvements over PPTP. First, it offers more and varied methods for authentication: PPTP offers two methods (CHAP and EAP), whereas L2TP offers five (CHAP, EAP, PAP, SPAP, and MS-CHAP).

Besides making more authentication protocols available for use, L2TP offers other enhancements. PPTP will only work over standard IP networks, whereas L2TP will work over X.25 networks (a common protocol in phone systems) and ATM (Asynchronous Transfer Mode, a high-speed networking technology) system. L2TP also uses IPsec for encryption.

IPsec

Internet Protocol Security (IPsec) is the newest of the three VPN protocols. One of the differences between IPsec and the other two methods is that it encrypts not only the packet data (recall the discussion of packets in Chapter 2) but also the header information. It also has protection against unauthorized retransmission of packets. This is important because one trick that a hacker can use is to simply grab the first packet from a transmission and use it to get his own transmissions to go through. Essentially, the first packet (or packets) has to contain the login data. If you simply re-send that packet (even if you cannot crack its encryption), you will be sending a valid logon and password that can then be followed with additional packets. Preventing unauthorized retransmission of packets prevents this from happening.

IPsec operates in one of two modes: Transport mode, in which only the payload is encrypted, and Tunnel mode, in which both data and IP headers are encrypted. Following are some basic IPsec terms:

Images Authentication headers (AHs) provide connectionless integrity and data origin authentication for IP packets.

Images Encapsulating Security Payload (ESP) provides origin authenticity, integrity, and confidentiality protection of packets. It offers encryption-only and authentication-only configurations.

Images Security associations (SAs) provide the parameters necessary for AH or ESP operations. SAs are established using Internet Security Association and Key Management Protocol (ISAKMP).

Images Internet Security Association and Key Management Protocol (ISAKMP) provides a framework for authentication and key exchange.

Images Internet Key Exchange (IKE and IKEv2) is used to set up a SA by handling negotiation of protocols and algorithms and to generate the encryption and authentication keys to be used.

Essentially during the initial establishment of an IPsec tunnel, SAs are formed. These SAs have information such as what encryption algorithm and what hashing algorithms will be used in the IPsec tunnel. (Recall that we discussed encryption in some depth in Chapter 8.) IKE is primarily concerned with establishing these SAs. ISAKMP allows the two ends of the IPsec tunnel to authenticate to each other and to exchange keys.

Wi-Fi Security

Wireless networks are commonly used today, and it is important to consider wireless network security. There are three Wi-Fi security protocols, ranging from the oldest and least secure (WEP) to the most recent and most secure (WPA3). They are each briefly described here.

Wired Equivalent Privacy

Wired Equivalent Privacy (WEP) uses the stream cipher RC4 to secure data and a CRC-32 checksum for error checking. Standard WEP uses a 40-bit key (known as WEP-40) with a 24-bit initialization vector (IV) to effectively form 64-bit encryption. 128-bit WEP uses a 104-bit key with a 24-bit IV.

Because RC4 is a stream cipher, the same traffic key must never be used twice. The problem with WEP is that the committee that created it was composed of very good computer professionals who thought they knew enough about cryptography but did not. They reused the IV, which defeats the entire purpose of an IV and leaves the protocol open to attacks. A simple search of YouTube for “how to crack WEP” will yield a deluge of videos on techniques for cracking WEP.

Wi-Fi Protected Access

Wi-Fi Protected Access (WPA) was definitely an improvement over WEP. First, WPA uses AES, which is a very good encryption algorithm. In addition, WPA uses Temporal Key Integrity Protocol (TKIP), which dynamically generates a new key for each packet. So even if you crack a WPA key, there will be a different key for the next packet.

WPA2

WPA2 is the most widely used Wi-Fi security today, and if it is at all possible, this is what you should be using. WPA2, which is based on the IEEE 802.11i standard, provides Advanced Encryption Standard (AES) using the Counter Mode-Cipher Block Chaining (CBC)-Message Authentication Code (MAC) Protocol (CCMP), which provides data confidentiality, data origin authentication, and data integrity for wireless frames. (Some of these terms you should recall from Chapter 8.) CBC prevents known plain text attacks.

The MAC preserves message integrity and ensures that packets are not altered in transit, either accidentally or intentionally. This means that WPA2 uses very strong encryption along with message integrity.

WPA3

WPA3, which was released in 2018, has many interesting features. Among its more interesting new properties is that all traffic to and from the wireless access point (WAP) is encrypted. WPA3 also requires attackers to interact with your Wi-Fi for every password guess they attempt, which makes brute-force attacks less likely to be successful.

Summary

It is absolutely critical that every network have a firewall and proxy server between the network and the outside world. It is critical that all machines in a network (servers and workstations alike) have updated virus protection. It is also a good idea to consider implementing an IDS and antispyware. In the upcoming exercises, you will have an opportunity to practice setting up various types of firewalls and IDSs.

Test Your Skills

Multiple Choice Questions

1. Which of the following is the most common way for a virus scanner to recognize a virus?

A. To compare a file to known virus attributes

B. To use complex rules to look for virus-like behavior

C. To look for only TSR programs

D. To look for TSR programs or programs that alter the Registry

2. What is one way of checking emails for virus infections?

A. Block all emails with attachments.

B. Block all active attachments (for example, ActiveX, scripting).

C. Look for subject lines that are from known virus attacks.

D. Look for emails from known virus sources.

3. What are TSR programs?

A. Terminal signal registry programs, which alter the system Registry

B. Terminate and system remove programs, which erase themselves when complete

C. Terminate and scan remote programs, which scan remote systems prior to terminating

D. Terminate and stay resident programs, which stay in memory after you shut them down

4. What is the name for scanning that depends on complex rules to define what is and is not a virus?

A. Rules-based scanning (RBS)

B. Heuristic scanning

C. TSR scanning

D. Logic-based scanning (LBS)

5. Which of the following is not one of the basic types of firewalls?

A. Screening firewall

B. Application gateway

C. Heuristic firewall

D. Circuit-level gateway

6. Which of the following is the most basic type of firewall?

A. Screening firewall

B. Application gateway

C. Heuristic firewall

D. Circuit-level gateway

7. George is responsible for security on a midsized network. He has more than two dozen systems that generate logs. What technology would be most helpful for him in analyzing these logs?

A. SIEM

B. IDS/IPS

C. NGFW

D. PKI

8. What does SPI stand for?

A. Stateful packet inspection

B. System packet inspection

C. Stateful packet interception

D. System packet interception

9. What is the term for a firewall that is software installed on an existing server?

A. Network host-based firewall

B. Dual-homed firewall

C. Router-based firewall

D. Screened host

10. What is a major weakness with a network host-based firewall?

A. Its security depends on the underlying operating system.

B. It is difficult to configure.

C. It can be easily hacked.

D. It is very expensive.

11. What is the term for blocking an IP address that has been the source of suspicious activity?

A. Preemptive blocking

B. Intrusion deflection

C. Proactive deflection

D. Intrusion blocking

12. What is the term for a fake system designed to lure intruders?

A. Honey pot

B. Faux system

C. Deflection system

D. Entrapment

13. Which of the following is the correct term for making a system less attractive to intruders?

A. Intrusion deterrence

B. Intrusion deflection

C. Intrusion camouflage

D. Intrusion avoidance

14. What method do most IDS software implementations use?

A. Anomaly detection

B. Preemptive blocking

C. Intrusion deterrence

D. Infiltration

15. How do most antispyware packages work?

A. By using heuristic methods

B. By looking for known spyware

C. The same way antivirus scanners work

D. By seeking out TSR cookies

Exercises

EXERCISE 9.1: Setting Up a Firewall

Microsoft Windows (in every version since XP, including Windows 11) and Linux both offer built-in packet-filtering firewalls of some sort. Ideally, if you have access to both operating systems, the best exercise is to experiment with setting up firewalls for both.

Using the documentation for whichever operating system you have, decide what packets you wish to block.

Set your firewall to filter those packets.

EXERCISE 9.2: Router-Based Firewalls

This exercise is for students with access to a lab router-based firewall.

Consult your router documentation for instructions on how to configure the firewall.

Configure your router-based firewall to block the same items you chose to block in Exercise 9.1.

EXERCISE 9.3: Evaluating Firewalls

Write a brief essay explaining whether you think the router-based solution or the built-in operating system solution is best. Explain your reasons.

EXERCISE 9.4: Active Code

Using the Web or other resources, find out why blocking active code (for example, ActiveX scripts) might or might not be a good idea in some situations. Write a brief essay explaining your position.

EXERCISE 9.5: Hardware Used by a Company

Visit the IT department of a company and ascertain what hardware it uses in its computer system’s defense. Does the company use a hardware firewall in addition to a software firewall? What form of intrusion detection software does it use? Does it use antivirus and antispyware software on the workstations within the company? Write a brief report summarizing your findings.

Projects

PROJECT 9.1: How Does the Microsoft Firewall Work?

Using Microsoft documentation, the Web, and other resources, find out what methodologies the Microsoft Windows (whichever version you are using) firewall uses. Write a brief essay explaining the strengths and weaknesses of that approach. Also discuss situations in which you feel that approach is adequate and those in which it might be inadequate.

PROJECT 9.2: How Does Antivirus Software Work?

Using documentation from the vendor, the Web, or other resources, find out what methodology Norton antivirus software uses, as well as the methods that McAfee uses. Armed with this information, write a brief essay comparing and contrasting any differences. Also discuss situations in which one might be recommended over the other.

PROJECT 9.3: Using Snort

This is a longer project and appropriate for groups.

Go to the Snort.org website (www.snort.org) and download Snort. Using the vendor documentation or other resources, configure Snort. Then use port scanners on the machine that has Snort configured and note whether Snort detects the scan.

Case Study

Jane Smith is responsible for security at the ABC Company. She has a moderate budget with which to purchase security solutions. To date, she has installed a router-based firewall between the network and the outside world. She also has a commercial virus scanner on every machine on the network. Consider the following questions:

What other actions might you recommend to her?

Would you recommend a different firewall? Why or why not?

Chapter 10

Security Policies

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Recognize the importance of security policies

Images Understand the various policies and the rationale for them

Images Know what elements go into good policies

Images Create policies for network administration

Images Evaluate and improve existing policies

Introduction

So far in this book we have explored various threats to networks. And in Chapter 9, “Computer Security Technology,” we examined a variety of technical defenses against such attacks. However, the fact is that technology by itself cannot solve all network security problems. There are some issues that technology cannot stop. Examples include the following:

Images Antivirus software won’t prevent a user from manually opening an attachment and releasing a virus.

Images A technologically secured network is still very vulnerable if former employees (perhaps those who are unhappy with the company) still have working passwords or if passwords are simply put on sticky notes on computer monitors.

Images A server is not secure if it is in a room that nearly everyone in the company has access to.

Images A network is not secure if end users are vulnerable to social engineering.

Another reason that technology alone is not the answer is that technology must be appropriately applied. Policies are used to guide you in how to implement and manage security, including security technology. In this chapter, we will examine computer security policies, including the elements that go into creating good security policies as well as examples of how to establish a network security policy.

What Is a Policy?

A security policy is a document that defines how an organization will deal with some aspect of security. There can be policies regarding end-user behavior, IT response to incidents, or specific issues and incidents.

Security policies can also be created to deal with regulatory requirements. These types of policies direct members of the organization as to how to comply with certain regulations. A good example would be a policy informing healthcare workers how to comply with HIPAA when using electronic medical records software.

Policies can also be simply advisory, suggesting to employees how they should handle certain items but not requiring compliance. For example, a policy might advise users that emailing from a smart phone using a Wi-Fi hotspot can be unsecure but not forbid it.

Important Standards

There are a number of industry standards that you should refer to when creating security policies. Before we delve into various specifics on policy development and enforcement, on policy development and enforcement, it is important to review relevant standards.

ISO 17999

ISO 17799 is a standard on how to develop policies. Policies are often not viewed as exciting security topics; however, the core of your security posture is your policies. Thus, it is critical to develop policies appropriately.

ISO/IEC 17799:2005 describes best practices related to control objectives and controls in the following areas of information security management:

Images Security policy

Images Organization of information security

Images Asset management

Images Human resources security

Images Physical and environmental security

Images Communications and operations management

Images Access control

Images Information systems acquisition, development, and maintenance

Images Information security incident management

Images Business continuity management

Images Compliance

It is a good idea to develop familiarity with this standard and at least consider its recommendations when developing policies.

Let’s briefly review some of these standards.

NIST SP 800-53

The National Institute of Standards and Technology (NIST) in the United States publishes a number of standards relevant to cybersecurity. NIST SP 800-53 (where SP stands for special publication, though it is often omitted) identifies 18 families of security controls (listed in Table 10.1). NIST 800-53 is a good reference when analyzing your system security policies.

Table 10.1 NIST 800-53 Security Control Families

ID

Family

ID

Family

AC

Access Control

MP

Media Protection

AT

Awareness and Training

PE

Physical and Environmental Protection

AU

Audit and Accountability

PL

Planning

CA

Security Assessment and Authorization

PS

Personnel Security

CM

Configuration Management

RA

Risk Assessment

CP

Contingency Planning

SA

System and Services Acquisition

IA

Identification and Authentication

SC

System and Communications Protection

IR

Incident Response

SI

System and Information Integrity

MA

Maintenance

PM

Program Management

ISO 27001

ISO/IEC 27001 requires that management:

Images Systematically examine the organization’s information security risks, taking account of the threats, vulnerabilities, and impacts.

Images Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable.

Images Adopt an overarching management process to ensure that the information security controls continue to meet the organization’s information security needs on an ongoing basis.

(Note that ISO 27001 is designed to cover much more than just IT.)

ISO 27002

ISO 27002 recommends best practices for initiating, implementing, and maintaining information security management systems (ISMS). This standard starts with several introductory chapters that provide guidance about terminology and the scope of the standard. The chapters starting with Chapter 5 cover important ISMS topics:

Images Chapter 5: Information Security Policies

Images Chapter 6: Organization of Information Security

Images Chapter 7: Human Resource Security

Images Chapter 8: Asset Management

Images Chapter 9: Access Control

Images Chapter 10: Cryptography

Images Chapter 11: Physical and Environmental Security

Images Chapter 12: Operation Security: Procedures and Responsibilities

Images Chapter 13: Communication Security

Images Chapter 14: System Acquisition, Development, and Maintenance

Images Chapter 15: Supplier Relationships

Images Chapter 16: Information Security Incident Management

Images Chapter 17: Information Security Aspects of Business Continuity Management

ISO 17799

Perhaps the standard most obviously connected to policy development is ISO 17779 (titled “How to Develop Security Policies”). This standard establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization.

ISO/IEC 17799:2005 describes best practices and control objectives in the following areas of information security management:

Images Security policy

Images Organization of information security

Images Asset management

Images Human resources security

Images Physical and environmental security

Images Communications and operations management

Images Access control

Images Information systems acquisition, development, and maintenance

Images Information security incident management

Images Business continuity management

Images Compliance

Defining User Policies

When discussing user policies, there is one rule you must keep in mind: You should have a policy for every foreseeable situation. Failure to have policies that address a given problem usually result in that problem being exacerbated. Something may seem like common sense to you but may not be to someone with no training or experience in computer networks or network security.

The misuse of systems is a major problem for many organizations. A large part of the problem comes from the difficulty in defining exactly what is misuse. Some things might be obvious misuse, such as using company time and computers to search for another job or to view illicit websites. However, other areas are not so clear, such as an employee using her lunchtime to look up information about a car she is thinking of buying. Generally, good user policies outline specifically how people are to use the system and how they should not. For a policy to be effective, it needs to be very clear and quite specific. Vague statements such as “computers and Internet access are only for business use” are simply inadequate. I would recommend something more clear and perhaps more enforceable, such as “Computers and Internet access are only for business purposes during business hours. However, employees may use the computer/Internet access for personal use during nonwork time such as breaks, lunch, and before work. However, such use must be in compliance with Internet usage policies.” This wording is clear, direct, and enforceable.

Other areas for potential misuse are also covered by user policies, including sharing passwords, copying data, leaving accounts logged on while employees go to lunch, and so on. All of these issues ultimately have a significant impact on your network’s security and must be clearly spelled out in your user policies. We will now examine several areas that effective user policies must cover:

Images Passwords

Images Internet use

Images Email usage

Images Installing/uninstalling software

Images Instant messaging

Images Desktop configuration

Images Bring your own device (BYOD)

Passwords

Keeping passwords secure is critical. Chapter 8, “Encryption,” discusses appropriate passwords as part of operating system hardening. Most sources indicate that a good password is at least eight characters long, uses numbers and special characters, and has no obvious relevance to the end user. For example, a Dallas Cowboys fan would be ill advised to use a password like cowboys or godallas but might be well advised to use a password such as %trEe987 or 123DoG$$ since those don’t reflect the person’s personal interests and therefore would not be easily guessed. Issues such as minimum password length, password history, and password complexity come under administrative policies, not user policies. User policies dictate how the end user should behave. For reliable security, I recommend using a passphrase that has been altered to include numbers and special characters. This can be something easy to remember but altered so that it will not be vulnerable to guessing or brute-force attacks. An example would be altering the phrase “I like double cheeseburgers” to be something like IliK3double3ch33$eburg3r$. Notice that the Es were changed to 3s, the Ss were changed to $s, and two random letters were capitalized. You now have a 25-character password that is also complex. It is easy to remember and very difficult to break.

However, no password is secure, no matter how long or how complex, if it is listed on a sticky note stuck to the user’s computer monitor. This may seem obvious, but it is not at all uncommon to go into an office and find a password either on the monitor or in the top drawer of the desk. Every janitor or anyone who simply passes by the office can get that password.

It is also not uncommon to find employees sharing passwords. For example, Bob is going to be out of town next week, so he gives Juan his password so that Juan can get into his system, check email, and more. The problem is that now two people have that password. And what happens if during the week Bob is gone, Juan gets ill and decides he will share the password with Shelly so that she can keep checking that system while Juan is out sick? It does not take long for a password to get to so many people that it is no longer useful at all from a security perspective.

Administrative policies need to address issues like minimum length of passwords, password age, and password history. System administrators can force these requirements. However, none of that will be particularly helpful if users don’t manage their passwords in a secure fashion.

All of this means you need explicit policies regarding how users secure their passwords. Those policies should specify the following:

Images Passwords are never to be kept written down in an accessible place. The preference is that they not be written down at all, but if they are, they should be in a secure area such as a lock box at your home (not in the office right next to your computer).

Images Passwords must never be shared with another person for any reason.

Images If an employee believes his password has been compromised, he should immediately contact the IT department so his password can be changed and so that logon attempts with the old password can be monitored and traced.

Internet Use

Most organizations provide their users with some sort of Internet access. There are several reasons for this. The most obvious reason is email. However, that is hardly the only reason to have Internet access in a business or academic setting. There is also the Web, and even chat rooms. (Believe it or not, chat rooms are being used for business communications.) The Internet can be used for legitimate purposes within any organization, but it can also bring about serious security problems. Appropriate policies must be in place to govern the use of Internet technologies.

The World Wide Web is a wonderful resource for a tremendous wealth of data. Throughout this book, we have frequently referenced websites where one can find valuable security data and useful utilities. The Internet is also replete with useful tutorials on various technologies. However, even non-technology-related business interests can be served via the Web. Here are a few examples of legitimate business uses of the Web:

Images Sales staff checking competitors’ websites to see what products or services they offer, in what areas, and to perhaps even get prices

Images Creditors checking the business’s AM Best or Standard & Poor’s rating to see how their business financial rating is doing

Images Business travelers checking weather conditions and getting prices for travel

Images Online training with webinars

Images Web meetings

Images Online bill payment or in some cases even filing of regulatory and government documents

Of course, there are other web activities that are clearly not appropriate on a company’s network:

Images Using the Web to search for a new job

Images Any pornographic use

Images Any use that violates local, state, or federal laws

Images Use of the Web to conduct your own business (if you have another enterprise you are involved in other than the company’s business)

In addition, there are gray areas. Some activities might be acceptable to some organizations but not to others. Such activities might include:

Images Online shopping during the employee’s lunch or break time

Images Reading news articles online during lunch or break time

Images Viewing humorous websites

What one person might view as absurdly obvious might not be to another. It is critical that an organization have very clear policies detailing specifically what is and what is not acceptable use of the Web at work. It is also important to give clear examples of what is acceptable use and what is not. You should also remember that most proxy servers and many firewalls can block certain websites. This will help prevent employees from misusing the company’s web connection.

Email Usage

Most business and even academic activity now occurs via email. As we have discussed in several previous chapters, email also happens to be the primary vehicle for virus distribution. This means that email security is a significant issue for any network administrator.

Clearly, you cannot simply ban all email attachments. However, you can establish some guidelines for how to handle email attachments. Users should open an attachment only if it meets the following criteria:

Images It was expected. (Someone requested documents from a colleague or client.)

Images If it was not expected, it came from a known source. If so, first send that person an email (or phone her) and ask if she sent the attachment. If so, open it.

Images It appears to be a legitimate business document (a spreadsheet, a document, a presentation, and so on).

It should be noted that some people might find such criteria unrealistic. There is no question they are inconvenient. However, with the prevalence of viruses, which are often attached to email, these measures are prudent. Many people choose not to go to this level to try to avoid viruses, and that may be your choice as well. Just bear in mind that millions of computers are infected with some sort of virus every single year.

No one should ever open an attachment that meets any of the following criteria:

Images It comes from an unknown source.

Images It is some active code or executable.

Images It is an animation/movie.

Images The email itself does not appear to be legitimate. (It seems to entice you to open the attachment rather than simply being a legitimate business communication that happens to have an attachment.)

If the end user has any doubt whatsoever, then she should not open the email. Rather, she should contact someone in the IT department who has been designated to handle security. That person can then either compare the email subject line to known viruses or can simply come check out the email personally. Then, if it appears legitimate, the user can open the attachment.

Fyi: About Attachments

I frequently follow the “better safe than sorry” axiom on opening attachments. When forwarded some joke, image, and so on circulating the Internet, I simply delete it. That may mean that I will miss many humorous images and stories, but it also means I will miss many viruses. You would do well to consider emulating this practice.

Installing/Uninstalling Software

When it comes to installing and uninstalling software, there is an absolute answer: End users should not be allowed to install anything on their machines. This includes wallpaper, screensavers, utilities—anything. The best approach is to limit end users’ login privileges so that they cannot install anything. However, this should be coupled with a strong policy statement prohibiting the installation of anything on their PC. If they wish to install something, it should first be scanned by the IT department and approved. This process might be cumbersome, but it is necessary. Some organizations go so far as to remove or at least disable media drives (CD, USB, and so on) from end-user PCs, so installations can occur only from files that the IT department has put on some network drive. This is usually a more extreme measure than most organizations require, but it is an option you should be aware of. In fact, Windows allows the administrator to disable allowing new USB devices. So the admin can install some USB devices that are approved for corporate use and then disallow any additional devices being added.

Instant Messaging

Instant messaging is widely used and abused by employees in organizations. In some cases, instant messaging can be used for legitimate business purposes. However, it does pose a significant security risk. Some viruses specifically propagate via instant messaging. In one incident, the virus would copy everyone on the user’s buddy list with the contents of all conversations. Thus, if you were subject to the virus, a conversation you thought was private ended up being broadcast to everyone you had ever messaged with.

Instant messaging is also a threat from a purely information security perspective. Nothing stops an end user from instant messaging trade secrets or confidential information without the traceability of email going through the corporate email server. It is recommended that instant messaging simply be banned from all computers within an organization. If you find you absolutely must have it, then you must establish very strict guidelines for its use, including the following:

Images Instant messaging can only be used for business communications, not personal conversations. Now, this might be a bit difficult to enforce. Rules like this often are. More common rules, such as prohibiting personal web browsing, are also quite difficult to enforce. However, it is still a good idea to have such rules in place. Then if you find a person violating them, you can refer to the company policy that prohibits such actions. However, you should be aware that in all likelihood, you won’t catch most violations of this rule.

Images No confidential or private business information should be sent via instant messaging, text messaging, or any sort of messaging app. The exceptions being if it is absolutely vital to send such information and the app has robust security including encryption. The Signal app is one example of a secure communications app.

Desktop Configuration

Many users like to reconfigure their desktops, changing the background, screensaver, font size, and resolution. Theoretically speaking, this is not a security hazard. Simply changing your computer’s background image cannot compromise the computer’s security. However, there are other issues involved.

The first issue is where a background image comes from. Frequently, end users download images from the Internet. This means there is a chance of getting a virus or Trojan horse, particularly one using a hidden extension. (For example, a file that appears to be mypic.jpg may really be mypic.jpg.exe.) There are also human resources/harassment issues involved if an employee uses a backdrop or screensaver that is offensive to other employees. Some organizations simply decide to prohibit any changes to the system configuration for this reason.

The second problem is technical. In order to give users access to change screensavers, background images, and resolution, you must give them rights that also allow them to change other system settings you might not want changed. The graphical display options are not separated from all other configuration options. This means that allowing users to change their screensaver might open the door for them to alter other settings (such as the network card configuration or the Windows Firewall) that would compromise security.

Bring Your Own Device

Bring your own device (BYOD) has become a significant issue for most organizations. Most, if not all, of your employees will have their own smart phones, tablets, smart watches, and activity monitors that they will carry with them into the workplace. Having these devices connected to your wireless network introduces a host of new security concerns. You have no idea what networks each device previously connected to, what software was installed on them, or what data might be exfiltrated by these personal devices.

In highly secure environments, it may be necessary to forbid personally owned devices. However, in many organizations, such a policy is impractical. A workaround for that is to have a Wi-Fi network that is dedicated to BYOD and is not connected to the company’s main network. Another approach, albeit more technologically complex, is to detect the device on connection, and if it is not a company-issued device, significantly limit its access.

Whatever approach you take, you must have some policy regarding personal devices as they are ubiquitous. Just a few years ago, smart phones were common but smart watches were not. It is difficult to predict what new smart devices might loom on the horizon.

There are a variety of approaches to handling user devices on an organization’s network, some of which have their own acronyms:

Images CYOD (choose your own device): The company lists acceptable devices (that is, those that meet company security requirements) and allows each employee to choose his or her own device.

Images COPE (company owned/personally enabled or company-owned and provided equipment): The company owns and provides the equipment. This clearly offers more security than BYOD or CYOD but also comes at the highest cost.

Images COBO (company owned/business only): This model provides the most security. The company owns and operates the equipment, and corporate IT services control the device and options for the device.

Final Thoughts on User Policies

This section has provided an overview of appropriate and effective user policies. It is critical that every organization implement solid user policies. However, these policies will not be effective unless you have clearly defined consequences for violating them. Many organizations find it helpful to spell out specific consequences that escalate with each incident, such as the following:

Images The first incident of violating any of these policies will result in a verbal warning.

Images A second incident will result in a written warning.

Images The third incident will result in suspension or termination. (In the case of academic settings, this would be suspension or expulsion.)

You must clearly list the consequences, and all users should sign a copy of the user policies upon being hired to prevent employees from claiming that they are not aware of the policies.

Caution

Termination or Expulsion

Any policy that can lead to expulsion from a school or termination from a job (or even a demotion) should first be cleared by your legal advisor. There can be significant legal ramifications for wrongful termination or expulsion. I am not an attorney or an expert in legal matters and cannot provide you with legal advice. It is imperative that you consult an attorney about these matters.

It is also important to realize that there is another cost to misuse of corporate Internet access: lost productivity. How much time does the average employee spend reading personal email, doing nonbusiness web activities, or social media? It is hard to say. However, for an informal view, go to www.yahoo.com on any given business day, during business hours, and click on one of the news stories. At the bottom of the story you will see a message board for this story. It lists date and time of posts. See how many posts are made during business hours. It is unlikely that all of those people are out of work, retired, or at home sick. You will find something similar on any social media platform.

Let me be completely clear: The Internet is the single greatest communication tool in human history. And it can have a tremendous positive effect on any business. I conduct almost all of my business activities through the Web. However, many employees abuse their Internet privileges, and using the Web does decrease productivity for those who cannot be self-disciplined. Here are just a few studies supporting this assertion:

Images A 2022 article reporting on multiple studies claimed that 89% of workers admit to wasting time every day.¹ It is often the case that widespread Internet access actually inhibits productivity rather than enhancing it.

1. https://www.zippia.com/advice/wasting-time-at-work-statistics/

Images Ohio State University researchers found regular Facebook users had a lower GPA than nonusers.²

2. http://content.time.com/time/business/article/0,8599,1891111,00.xhtml

Images Multiple studies have shown that Facebook at work has a negative impact on productivity. Most of these studies are a few years old because it has become well established that social media at work hurts productivity.³,⁴,⁵

3. http://www.cnbc.com/2016/02/04/facebook-turns-12--trillions-in-time-wasted.xhtml

4. http://www.riskmanagementmonitor.com/the-risks-of-social-media-decreased-worker-productivity/

5. http://www.shellypalmer.com/2011/05/social-media-use-drastically-reduces-work-productivity/

Defining System Administration Policies

In addition to determining policies for users, you must have some clearly defined policies for system administrators. There must be procedures for adding users, removing users, dealing with security issues, changing any system, and so on. There must also be standards for handling any deviation from the standard procedures.

New Employees

When a new employee is hired, the system administration policy must define specific steps to safeguard company security. New employees must be given access to the resources and applications their job function requires. The granting of that access must be documented (possibly in a log). It is also critical that the new employee receive a copy of the company’s computer security and acceptable use policies and sign a document acknowledging receipt of such.

Before a new employee starts to work, the IT department (specifically network administration) should receive a written request from the business unit for which the person will be working. That request should specify exactly what resources this user will need and when she will start, and it should have the signature of someone in the business unit with authority to approve such a request. Then the person who is managing network administration or network security should approve and sign the request. After you have implemented the new user on the system with the appropriate rights, you can file a copy of the request.

Departing Employees

When an employee leaves, it is critical to make sure all of his logins are terminated and all access to all systems is discontinued immediately. Unfortunately, this is an area of security that too many organizations do not give enough attention to. You cannot be certain which employees will bear the company ill will and which won’t upon leaving the company. It is imperative to have all of a former employee’s access shut down on his last day of work. This includes physical access to the building. If a former employee has keys and is disgruntled, nothing can stop him from returning to steal or vandalize computer equipment. When an employee leaves the company, you need to ensure that on his last day, the following actions take place:

Images All logon accounts to any server, VPN, network, or other resource are disabled.

Images All keys to the facility are returned.

Images All accounts for email, Internet access, wireless Internet, cell phones, and so on are shut off.

Images Any accounts for mainframe resources are canceled.

Images The employee’s workstation hard drive is searched.

The last item might seem odd. But if an employee was gathering data to take with him (such as proprietary company data) or conducting any other improper activities, you need to find out right away. If you do see any evidence of such activity, you need to secure that workstation and keep it for evidence in any civil or criminal proceedings.

All of this might seem a bit extreme to some readers. It is true that with the vast majority of exiting employees, you will have no issues to be concerned about. However, if you do not make it a habit of securing employees’ access when they depart, you will eventually face an unfortunate situation that could have been easily avoided.

Change Requests

The nature of information technology is change. Not only do end users come and go but requirements change frequently. Business units request access to different resources, server administrators upgrade software and hardware, application developers install new software, and web developers change the website. Change is occurring all the time. Therefore, it is important to have a change control process. This process not only makes the change run smoothly, but it also allows the IT security personnel to examine the change for any potential security problems before it is implemented. A change control request should go through the following steps:

An appropriate manager within the business unit signs the request, signifying approval of the request. In other words, there is no point in pursuing the change request process if the immediate supervisor of the requestor has not approved the request.

The appropriate IT unit (database administration, network admin, email admin, cloud administration) verifies that the request is one it can fulfill technologically, fits within budget constraints, and does not violate IT policies.

The IT security unit verifies that this change will not cause security problems. This is becoming more and more critical in modern times.

The appropriate IT unit formulates a plan to implement the change and a plan to roll back the change in the event of some failure. That latter part is very critical and is often overlooked. There must be some mechanism to roll back the change should it cause any problems.

The date and time for the change is scheduled, and all relevant parties are notified.

Your change control process might not be identical to this one; in fact, it might be much more specific. However, the key to remember is that in order for your network to be secure, you simply cannot have changes happening without some process for examining the impact of those changes prior to implementing them.

Change management activities are frequently managed through a change control board (CCB) process, sometimes also called a change approval board (CAB) process. The change process was detailed previously in this section, but the basic process can be summarized as follows:

Initiate the process with an RFC (request for comments or request for change) document.

Send the RFC for approval.

Set the priority of the process.

Assign the process to whomever makes the change.

Document decisions.

Have the CAB evaluate changes.

Schedule the RFC.

Have the change owner and requester verify successful implementation of the change.

Review the RFC.

This process can involve formal meetings of the CAB and extensive documentation, or it can be informal and conducted via emails with the appropriate parties.

In Practice

Extremes of Change Control

Anyone who has even a few years of experience in the IT profession can tell you that when it comes to change control, there are all sorts of different approaches. The real problem is IT groups that implement unreasonable extremes. I have seen both. Without using the real names of the companies involved, let’s examine a real case of each extreme.

Software consultant Company X was a small company that did custom financial applications for various companies. It had a staff of fewer than 20 developers who frequently traveled to client locations around the country. It literally had:

Images No documentation for any of its applications—not even a few notes.

Images No change control process. When someone did not like a setting on a server or some part of the network configuration, he simply changed it.

Images No process for handling former employee access. In one case, a person had been gone for 6 months and still had a valid logon account.

Now, clearly this is alarming from several perspectives, not just from a security viewpoint. However, that is one extreme—one that makes for a chaotic environment that is very unsecure. Security-minded network administrators tend to move toward the opposite extreme, one that can have a negative impact on productivity.

Company B had more than 2000 employees, with an IT staff of about 100 people. In this company, the bureaucracy had overwhelmed the IT department to the point that their productivity was severely impacted. In one case, a person was a web server administrator, and the decision had been made that he also needed database administration rights on a single database server. The process, however, took 3 months with one face-to-face meeting between his manager and the CIO, as well as two phone conferences and a dozen emails between his manager and the manager of the database group.

The company’s convoluted change control process had a severely negative impact on productivity. Some employees informally estimated that even the low-level IT supervisors spent 40% of their time in meetings/conferences, reporting on meetings/conferences, or preparing for meetings/conferences. And the further one went up the IT ladder, the more one’s time became consumed in bureaucratic activities.

Both of these examples are meant to illustrate two extremes in change control management that you should try to avoid. Your goal in implementing change control management is simply to have an orderly and safe way of managing change, not to be an impediment to productivity.

Security Breaches

Unfortunately, the reality is that your network will probably, at some point, experience a security breach of some kind. You may be the target of a denial of service (DoS) attack, your system might be infected with a virus, or perhaps a hacker will gain entrance and destroy or copy sensitive data. You must have some sort of plan for how to respond should any such event occur. This book cannot tell you specifically how to deal with each and every event that might occur; however, we can discuss some general guidelines for what to do in certain general situations. We will look at each of the main types of security breaches and what actions you should take for each.

Virus Infection

When a virus strikes your system, immediately quarantine the infected machine or machines. This means literally unplugging the machines from the network. If it is a subnet, then unplug its switch or disconnect wireless access. Isolate the infected machines (unless your entire network is infected, in which case simply shut down your router/ISP connection to close you off from the outside world and prevent spread beyond your network). After implementing the quarantine, you can safely take the following steps:

Scan and clean each and every infected machine. Since the machines are now off the network, this will be a manual scan.

Log the incident, the hours/resources taken to clean the systems, and the systems that were affected.

When you are certain the systems are clean, bring them online in stages (a few at a time). With each stage, check all machines to see that they are patched, updated, and have properly configured/running antivirus.

Notify the appropriate organization leaders of the event and the actions you have taken.

After you have dealt with the virus and notified the appropriate people, have a meeting with appropriate IT staff to discuss what can be learned from this breach and how you might prevent it from occurring again in the future.

DoS Attacks

If you have taken the steps outlined earlier in this book (such as properly configuring your router and your firewall to reduce the impact of any attempted DoS attack), then you will already be alleviating some of the damage from DoS attacks. In addition, consider taking the following measures:

Images Use your firewall logs or IDS to find out which IP address (or addresses) originated the attacks. Note the IP address(es) and then (if your firewall supports this feature—and most do) deny the IP address(es) access to your network.

Images Use online resources (interNIC.net and so on) to find out who the address belongs to.

Images Contact that organization and inform it of what is occurring.

Images Log all of these activities and inform the appropriate organizational leaders.

Images After you have dealt with the DoS attack and notified the appropriate people, have a meeting with appropriate IT staff to discuss what can be learned from this attack and how you might prevent it from occurring in the future.

Intrusion by a Hacker

What do you do if a malicious hacker has intruded into your network? In other words, what are the basics of incident response? Consider taking the following measures in the event of intrusion by a hacker:

Images Immediately copy the logs of all affected systems (firewall, targeted servers, and so on) for use as evidence.

Images Immediately scan all systems for Trojan horses, changes to firewall settings, changes to port filtering, new services running, and so on. In essence, you need to perform an emergency audit to see what damage has been done.

Images Document everything. Of all of your documentation, this must be the most thorough. You must specify which IT personnel took what actions at what times. Some of this data may be part of later court proceedings, so absolute accuracy is necessary. It is probably a good idea to log all activities taken during this time and to have at least two people verify and sign the log.

Images Change all affected passwords. Repair any damage done.

Images Inform the appropriate business leaders of what has happened.

Images After you have dealt with the breach and notified the appropriate people, you should have a meeting with appropriate IT staff to discuss what can be learned from this breach and how you might prevent another one from occurring in the future.

These are just general guidelines, and some organizations may want to take much more specific actions in the event of some security breach. You should also bear in mind that throughout this book when we have discussed various sorts of threats to network security, we have mentioned particular steps and policies that should be taken. The policies in this chapter are meant to be in addition to any already outlined in this book. It is an unfortunate fact that some organizations have no plan for what to do in case of an emergency. It is important that you do have at least some generalized procedures you can implement.

Defining Access Control

An important area of security policies that usually generates some controversy in any organization is access control. There is always a conflict between users’ desire for unfettered access to any data or resources on the network and the security administrator’s desire to protect that data and resources. This means that extremes in policies are not practical. You cannot simply lock down every resource as completely as possible since doing so would impede users’ access to those resources. Conversely, you cannot simply allow anyone and everyone complete access to everything. The core of access control is the concept of least privileges, introduced in Chapter 1, “Introduction to Computer Security.” According to this concept, each person is given the minimum privileges necessary to do her job—no more and no less.

The idea of least privileges is simple: Each user, including IT personnel, gets the least access he can have and still effectively do his job. Rather than ask the question, “Why not give this person access to X?” you should ask, “Why give this person access to X?” And if you don’t have a very good reason, then don’t. This is one of the fundamentals of computer security. The more people who have access to any resource, the more likely some breach of security is to occur.

Along with, and related to, least privileges is the concept of implicit deny. Implicit deny means that all users are implicitly denied access to network resources until an administrator explicitly grants them.

Separation of duties, job rotation, and mandatory vacations are also important and related concepts. Separation of duties means that no one person can perform critical tasks; at least two individuals are needed. This prevents one person from accidently (or intentionally) causing some security breach via inappropriate use of critical functions. Both job rotation and mandatory vacations are used to make sure that, periodically, the person performing a given job changes. This makes it more difficult for one person to exploit her position to breach security.

Obviously, trade-offs must be made between access and security. Examples abound. One common example involves sales contact information. Clearly, a company’s marketing department needs access to this data. However, what happens if your competitors get all of your company’s contact information? That could allow them to begin targeting your current client list. This requires a trade-off between security and access. In this case, you would probably give salespeople access only to the contacts that are within their territory. No one other than the sales manager should have complete access to all the marketing data.

Development Policies

Many IT departments include programmers and web developers. Unfortunately, many security policies do not address secure programming. No matter how good your firewalls, proxy server, virus scanning, and policies are, if your developers create code that is flawed, you will have security breaches. Clearly, the topic of secure programming could fill its own separate volume. Nonetheless, we can consider a brief checklist for defining secure development policies. If your company currently has no secure programming initiatives, using this checklist is certainly better than developing in a vacuum. It can also serve as a starting point to get you thinking and talking about secure programming:

Images All code, especially code written by outside parties (contractors, consultants, and so on) must be checked for backdoors/Trojan horses.

Images All buffers must have error handling that prevents buffer overruns.

Images All communication (such as using TCP sockets to send messages) must adhere to your organization’s secure communications guidelines.

Images Any code that opens any port or performs any sort of communication needs to be thoroughly documented, and the IT security unit must be apprised of the code, what it will do, and how it will be used.

Images All input should be filtered for items that might facilitate an attack, such as an SQL injection attack.

Images Every vendor should supply you with a signed document verifying that there are no security flaws in its code.

Following these guidelines will not guarantee that flawed code will not be introduced into your system, but it will certainly lower the odds significantly. And the unfortunate fact is that these simple steps alone are more than most organizations are taking. A very good place to look at security policies is the SANS Institute (www.sans.org/security-resources/policies/).

Standards, Guidelines, and Procedures

Related to policies are standards, guidelines, and procedures. All of these documents are related to security policies and in fact support those policies. A standard is a general statement of the desired level of operation. For example, requiring 99.5% network uptime would be a standard. A guideline is a general suggestion about how to achieve some standard. Guidelines are broad and are sometimes optional (not mandatory). Procedures are specific instructions on how to handle specific issues.

Data Classification

It is critical to classify information within an organization. This process is common in Department of Defense (DoD)–related agencies and organizations. It is less common in the civilian sector. Classifying information provides employees with guidance on how to handle data. Classification can be as simple as using two categories:

Images Public information is information that can be disseminated publicly to anyone. There are no restrictions on who can view the data.

Images Private information is intended only for use internally in the organization. This type of information can potentially embarrass the company, disclose trade secrets, reveal corporate strategy, expose private personal data of employees or customers, or otherwise reveal information that your organization does not want revealed.

This two-tier approach to data classification is rather elementary. Most organizations will have multiple tiers. Each tier is defined by the damage that information disclosure could cause. We will take a look at U.S. DoD clearance levels. These provide some insight into varying security classifications. Even if you work in an entirely civilian environment, reviewing the DoD approach can give you some suggestions on how to classify your data and how to properly evaluate which personnel should have access.

DoD Clearances

The terms secret and top secret have specific meanings. The United States has a specific hierarchy of classification. The lowest is confidential. This is information that, if disclosed, might damage national security. Secret information is data that, if disclosed, might cause serious damage to national security. Top secret information is data that, if disclosed, could be expected to cause exceptionally grave damage to national security. There is another designation: top secret SCI (sensitive compartmented information).

Each of these clearances requires a different level of investigation. A secret clearance requires a complete background check including criminal, work history (for the past 7 years), credit check, and checks with various national agencies (Department of Homeland Security, Immigration, State Department, and so on). This type of background check is referred to as an NACLC, or National Agency Check with Law and Credit. The secret clearance may or may not include a polygraph.

The top secret clearance is more rigorous, as you might imagine. It involves a Single Scope Background Investigation (SSBI)—a complete NACLC for the subject and spouse that goes back at least 10 years. It also involves a subject interview conducted by a trained investigator. Direct verification of employment, education, birth, and citizenship are also required. At least four references are necessary, and at least two of those will be interviewed by investigators. A polygraph is also used. The SSBI is repeated every 5 years.

An SCI is assigned only after a complete SSBI has been completed. An SCI may have its own process for evaluating access; therefore, a standard description of what is involved is not available.

Disaster Recovery

Before we can discuss disaster recovery, we have to define what a disaster is. A disaster is any event that significantly disrupts an organization’s operations. A hard drive crash on a critical server is a disaster. Other examples include fire, earthquake, the telecom provider being down, a labor strike affecting shipping to and from your business, and a hacker deleting critical files. Any event that can significantly disrupt an organization’s operations is a disaster.

Disaster Recovery Plan

A disaster recovery plan (DRP) is a plan you have in place to return business to normal operations after a disaster occurs. A DRP must include a number of items. It must address personnel issues, including being able to find temporary personnel, if needed, and being able to contact the personnel you have employed. It also includes having specific people assigned to specific tasks. Your DRP needs to address who in your organization is tasked with the following:

Images Locating alternative facilities

Images Getting equipment to those facilities

Images Installing and configuring software

Images Setting up the network at the new facility

Images Contacting staff, vendors, and customers

These are just a few areas that a disaster recovery plan must address.

Business Continuity Plan

A business continuity plan (BCP) is similar to a DRP but with a different focus. A DRP is designed to get the organization back to full functionality as quickly as possible. A BCP is designed to get minimal business functions back up and running at least at some level so you can conduct some type of business. An example would be a retail store whose credit card processing system is down. Disaster recovery is concerned with getting the system back up and running, and business continuity is concerned with simply getting a temporary solution, such as processing credit cards manually.

To successfully formulate a BCP, you must consider those systems that are most critical for your business and have an alternative plan in case those systems are down. The alternative plan need not be perfect, just functional.

Impact Analysis

Before you can create a realistic DRP or BCP, you have to do an impact analysis of what damage to your organization a given disaster might cause. This is called a business impact analysis or business impact assessment (BIA). Consider a web server crash. If your organization is an e-commerce business, then a web server crash is a very serious disaster. However, if your business is an accounting firm and the website is just a way for new customers to find you, then a web server crash is less critical; you can still do business and earn revenue while the web server is down. You should make a spreadsheet of various likely or plausible disasters and do a basic BIA for each.

One item to consider for a BIA is the maximum tolerable downtime (MTD). How long can a given system be down before the effect is catastrophic and the business is unlikely to recover? Another item to consider is the mean time to repair (MTTR). How long is it likely to take to repair a given system if it is down? These factors help you determine the business impact of a given disaster.

Disaster Recovery and Business Continuity Standards

Several standards might be useful to you in forming a BCP and a DRP. Familiarizing yourself with existing standards can aid you in forming your own DRP and BCP:

Images ISO 27035: This standard is about incident response. It requires a structure, planned approach to detecting and reporting incidents, as well as responding.

Images NIST 800-61: This standard is concerned with establishing incidence response policies. It provides guidance on incidence response teams, response procedures, and related items.

Both of these are good, general disaster recovery standards. Either can provide a basis for your own disaster recovery planning.

Fault Tolerance

The fact is that at some point, all equipment fails. So fault tolerance is important. At the most basic level, fault tolerance for a server means a backup. If the server fails, did you back up the data so you can restore it? While database administrators may use a number of different types of data backups, from a security point of view, there are three primary backup types to be concerned with:

Images Full: All changes

Images Differential: All changes since last full backup

Images Incremental: All changes since last backup of any type

Consider a scenario in which you do a full backup at 2 a.m. each morning. But you are concerned about the possibility of a server crash before the next full backup, so you want to do a backup every 2 hours. Well, the type of backup you choose will determine the efficiency of doing those frequent backups and the time needed to restore. So let’s consider each scenario and what would happen if the system crashed at 10:05 a.m.:

Images Full: Say that you do full backups at 4 a.m., 6 a.m., … 10 a.m., and then the system crashes. Well, to restore, you just have to restore the last full backup, which was done at 10 a.m. This makes restoration much simpler. However, running a full backup every 2 hours is very time-consuming and resource intensive, and it will have a significant negative impact on your server’s performance.

Images Differential: Say that you do differential backups at 4 a.m., 6 a.m., … 10 a.m., and then the system crashes. To restore, you will need to restore the last full backup, which was done at 2 a.m., and the most recent differential backup, which was done at 10 a.m. This is just a little more complicated than the full backup strategy. However, those differential backups are going to get larger each time you do them, and thus they will be more time-consuming and resource intensive. While they won’t have the impact of the full backups, they will still slow down your network.

Images Incremental: Say that you do incremental backups at 4 a.m., 6 a.m., … 10 a.m., and then the system crashes. To restore, you need to restore the last full backup, which was done at 2 a.m., and then each incremental backup done since then, and they must be restored in order. This type of restoration is much more complex, but each incremental backup is small and does not take much time or consume many resources.

There is no “best” backup strategy. Which one you select will depend on your organization’s needs. Whatever backup strategy you choose, you must periodically test it. The only effective way to test your backup strategy is to actually restore the backup data to a test machine.

The other fundamental aspect of fault tolerance is RAID, or redundant array of independent disks. RAID allows your servers to have more than one hard drive, so that if the main hard drive fails, the system keeps functioning. The primary RAID levels are described here:

Images RAID 0 (striped disks): RAID 0 distributes data across multiple disks in a way that gives improved speed at any given instant. There is no fault tolerance.

Images RAID 1 (mirroring): RAID 1 mirrors the contents of the disks, making a form of 1:1 ratio real-time backup.

Images RAID 3 or 4 (striped disks with dedicated parity): RAID 3 or 4 combines three or more disks in a way that protects data against loss of any one disk. Fault tolerance is achieved by adding an extra disk to the array and dedicating it to storing parity information. The storage capacity of the array is reduced by one disk.

Images RAID 5 (striped disks with distributed parity): RAID 5 combines three or more disks in a way that protects data against the loss of any one disk. It is similar to RAID 3, but the parity is not stored on one dedicated drive; instead, parity information is interspersed across the drive array. The storage capacity of the array is a function of the number of drives minus the space needed to store parity.

Images RAID 6 (striped disks with dual parity): RAID 6 combines four or more disks in a way that protects data against loss of any two disks.

Images RAID 1+0 (or 10): RAID 1+0 is a mirrored data set (RAID 1) that is then striped (RAID 0), hence the “1+0” name. A RAID 1+0 array requires a minimum of four drives: two mirrored drives to hold half of the striped data, plus another two mirrored for the other half of the data.

A server without at least RAID 1 is gross negligence on the part of the network administrator. RAID 5 is actually very popular with servers.

While RAID and backup strategies are the fundamental issues of fault tolerance, any backup system provides additional fault tolerance. This can include uninterruptable power supplies, backup generators, and redundant Internet connections.

Zero Trust

CrowdStrike defines Zero Trust as follows:⁶

6. https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/

Zero Trust is a security framework requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data. Zero Trust assumes that there is no traditional network edge; networks can be local, in the cloud, or a combination or hybrid with resources anywhere as well as workers in any location.

This is a good definition. Zero Trust is about having no special, or trusted, systems. Every computer is treated as if it is an unknown system connecting from the Internet. Computers on your own network are not inherently trusted just because they are on your network.

Oracle describes Zero Trust as follows:⁷

7. https://www.oracle.com/security/what-is-zero-trust

All data sources and computing services are considered resources.

All communication is secure regardless of network location; network location does not imply trust.

Access to individual enterprise resources is granted on a per-connection basis; trust in the requester is evaluated before the access is granted.

Access to resources is determined by policy, including the observable state of user identity and the requesting system, and may include other behavioral attributes.

The enterprise ensures all owned and associated systems are in the most secure state possible and monitors systems to ensure that they remain in the most secure state possible.

User authentication is dynamic and strictly enforced before access is allowed; this is a constant cycle of access, scanning and assessing threats, adapting, and continually authenticating.

There are standards governing Zero Trust, including NIST SP 800-207, “Zero Trust Architecture,” and NIST SP 800-205, “Network Requirements for Zero Trust.” Familiarizing yourself with such standards will make it easier to implement Zero Trust.

Important Laws

There are a number of computer laws in various countries, states, and provinces. It is important to be familiar with the laws that are relevant to your jurisdiction. However, there are a few laws that are most critical in the United States. We will discuss each of them here.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal regulation that mandates national standards and procedures for the storage, use, and transmission of personal medical information. Passed into law in 1996, HIPAA has caused a great deal of change in healthcare record keeping.

HIPAA covers three areas—confidentiality, privacy, and security of patient records—and was implemented in phases to ease the transition. Confidentiality and privacy of patient records had to be implemented by a set date, followed by security of patient records. Standards for transaction codes in medical record transmissions had to be completed by a given date as well.

The penalties for HIPAA violations are very stiff: They can be as high as $250,000, depending on the circumstances. A medical practice is required to appoint a security officer. All related parties, such as billing agencies and medical records storage facilities, are required to comply with these regulations.

Sarbanes-Oxley

The Sarbanes-Oxley Act is legislation that came into force in 2002, introducing major changes to the regulation of financial practice and corporate governance. Named after Senator Paul Sarbanes and Representative Michael Oxley, this law is designed to make publicly traded corporations more accountable.

The legislation focuses primarily on financial issues, but it also affects IT departments that are responsible for storing a corporations’ electronic records. The Sarbanes-Oxley Act states that all business records, including electronic records and electronic messages, must be saved for “not less than five years.” The consequences for noncompliance are fines, imprisonment, or both.

Payment Card Industry Data Security Standards

While not a law, the Payment Card Industry Data Security Standards (PCI DSS) is certainly something any IT security professional who works for a company that handles credit cards and debit cards should be familiar with. PCI DSS is a proprietary information security standard for organizations that handle branded credit cards from major companies, including Visa, MasterCard, American Express, and Discover.

Summary

In this chapter, you learned that technology is not enough to ensure a secure network. You must have clear and specific policies detailing procedures on your network. Those policies must cover employee computer resource use, new employees, outgoing employees, access rights, how to respond to an emergency, and even the security of code in applications and websites.

User policies must cover all aspects of how the user is expected to use company technology. In some cases, such as with instant messaging and Web use, policies may be difficult to enforce, but they must still be in place. If your user policies fail to cover a particular area of technology use, then you will have difficulty taking any action against an employee who performs that particular misuse.

You also learned that it is not just the end user who will need policies. The IT staff needs clearly delineated policies covering how to handle various situations. Of particular concern are policies dictating how to handle new users or exiting users. You also need a carefully considered change management policy.

Test Your Skills

Multiple Choice Questions

1. Which of the following does not demonstrate the need for policies?

A. Antivirus software cannot prevent a user from downloading infected files.

B. The most secure password is not at all secure if it’s posted on a sticky note by the computer.

C. End users are generally not particularly bright and must be told everything.

D. Technological security measures are dependent upon the employees’ implementation.

2. Grace is a network administrator who is trying to implement a Zero Trust architecture. Which of the following standards would be most helpful for Grace?

A. NIST 800-171

B. NIST 800-61

C. NIST 800-207

D. NIST 800-53

3. Which of the following is not an example of a user password policy?

A. Users may not keep copies of passwords in their office.

B. Passwords must be eight characters long.

C. A user may only share passwords with his or her assistant.

D. Passwords may not be shared with any employee.

4. What should an employee do if she believes her password has been revealed to another party?

A. If it is a trusted employee or friend, just ignore it.

B. Change the password immediately.

C. Notify the IT department.

D. Ignore it.

5. What standard is the most appropriate when considering security controls?

A. ISO 27002

B. NIST 800-61

C. NIST 800-205

D. NIST 800-207

6. Which of the following is the best reason users should be prohibited from installing software?

A. They may not install it correctly, which could cause security problems for the workstation.

B. They may install software that circumvents security.

C. Software installation is often complex and should be done by professionals.

D. If a user’s account does not have installation privileges, then it is likely that a Trojan horse will not be inadvertently installed under their account.

7. Which of the following is not a significant security risk posed by instant messaging?

A. Employees may send harassing messages.

B. Employees might send out confidential information.

C. A virus or worm might infect the workstation via instant messaging.

D. An instant messaging program could actually be a Trojan horse.

8. What must all user policies have in order to be effective?

A. They must be reviewed by an attorney.

B. They must state consequences.

C. They must be notarized.

D. They must be properly filed and maintained.

9. Which of the following is the appropriate sequence of events for a new employee?

A. IT is notified of the new employee and the requested resources > employee is granted access to those resources > employee is briefed on security/acceptable use > employee signs acknowledging receipt of a copy of security rules.

B. IT is notified of the new employee and the requested rights > employee is given access to those resources > employee signs acknowledging a receipt of a copy of security rules.

C. IT is notified of the new employee and assigns default rights > employee is briefed on security/acceptable use > employee signs acknowledging receipt of a copy of security rules.

D. IT is notified of the new employee and assigns default rights > employee signs acknowledging receipt of company security rules.

10. Which of the following is the appropriate sequence of events for a departing employee?

A. IT is notified of the departure > all logon accounts are shut down > all access (physical and electronic) is disabled.

B. IT is notified of the departure > all logon accounts are shut down > all access (physical and electronic) is disabled > the employee’s workstation is searched/scanned.

C. IT is notified of the departure > all physical access is shut down > all electronic access is shut down.

D. IT is notified of the departure > all electronic access is shut down > all physical access is shut down.

11. Which of the following is the appropriate sequence for a change request?

A. Business unit manager requests change > IT unit verifies request > request is implemented.

B. Business unit manager requests change > IT unit verifies request > security unit verifies request > request is scheduled with rollback plan > request is implemented.

C. Business unit manager requests change > IT unit verifies request > request is scheduled with rollback plan > request is implemented.

D. Business unit manager requests change > IT unit verifies request > security unit verifies request > request is implemented.

12. What is the first step when discovering a machine(s) has been infected with a virus?

A. Log the incident.

B. Scan and clean the infected machine(s).

C. Notify appropriate management.

D. Quarantine the infected machine(s).

13. What is the rule in access control?

A. Grant the most access you can securely give.

B. Grant the least access job requirements allow.

C. Grant standard access for all users.

D. Strictly limited access for most users.

14. After dealing, on a technical level, with any security breach, what is the last thing to be done for a security breach?

A. Quarantine infected machines.

B. Study the breach to learn how to prevent recurrence.

C. Notify management.

D. Log the incident.

15. Which of the following is a list of items that should be implemented in all secure code?

A. All code checked for backdoors or Trojans, all buffers have error handling to prevent buffer overruns, all communication activity thoroughly documented

B. All code checked for backdoors or Trojans, all buffers have error handling to prevent buffer overruns, all communication adheres to organizational guidelines, all communication activity thoroughly documented

C. All code checked for backdoors or Trojans, all buffers have error handling to prevent buffer overruns, all communication adheres to organizational guidelines

D. All code checked for backdoors or Trojans, all communication adheres to organizational guidelines, all communication activity thoroughly documented

Exercises

Each of these exercises is intended to give you experience writing limited portions of a policy. Together, the exercises create a complete policy for a college campus computer network.

EXERCISE 10.1: User Policies

Using the guidelines provided in this chapter (and other resources, as needed), create a document that defines user policies. The policies should clearly define acceptable and unacceptable use for all personnel. You may require some separate policies for administration, faculty, and students.

EXERCISE 10.2: New Student Policy

Using the guidelines provided in this chapter (and other resources, as needed), create a step-by-step IT security policy for implementing a new user account for a student.The policy should define what resources the student has access to, what she does not have access to, and for how long access is granted.

EXERCISE 10.3: Leaving Student Policy

Using the guidelines provided in this chapter (and other resources, as needed), create a step-by-step IT security policy for handling user accounts/rights for a student who is leaving prematurely (drops, is expelled, and so on).

You will need to consider specialized student scenarios, such as a student who works as an assistant to a faculty member or as a lab assistant in a computer lab and may have access to resources most students do not have access to.

EXERCISE 10.4: New Faculty/Staff Policy

Using the guidelines provided in this chapter (and other resources, as needed), create a step-by-step IT security policy for implementing a new user account for a faculty or staff member.

The policy should define what resources the faculty or staff member has access to, what she does not have access to, and any restrictions. (Hint: Unlike with student policies, you don’t need to define an amount of time since it should be indefinite.)

EXERCISE 10.5: Leaving Faculty/Staff Policy

Write a policy for how to handle a faculty departure (quit, fired, retired, and so on). Use the guidelines in this chapter and any other resources you like to get started.

Make certain you consider not only shutting down access but also the possibility of proprietary research material existing on the faculty/staff member’s workstation.

EXERCISE 10.6: Student Lab Use Policy

Considering the material in this chapter, create a set of policies for acceptable use of computer lab computers.

Make sure to specify web use, email use, and any other acceptable uses.

Carefully spell out unacceptable usage. (For example, is game playing acceptable?)

Projects

PROJECT 10.1: Examining Policies

Examine the following web resources that discuss security policies:

Images EarthLink acceptable use policy: www.earthlink.net/about/policies/use/

Images SANS Institute policies: www.sans.org/resources/policies/

Images Key Elements of an Information Security Policy: Information Security Policy World

Summarize the main theme of these policy recommendations. Pay particular attention to any area where these recommendations differ from or exceed the recommendations of this chapter.

Choose which policy recommendation you believe is the most secure and state the reasons for your choice.

PROJECT 10.2: Real-World Security Policies

Ask a local business or your college to let you see its security policies. Study the policies carefully.

Summarize the main theme of these policy recommendations. Pay particular attention to any area where these recommendations differ from or exceed the recommendations of this chapter.

Choose which policy recommendation you believe is the most secure and state the reasons for your choice.

PROJECT 10.3: Creating Security Policies

Note: This project works well as a group project.

At this point in the book, you have studied security, including policies. In this chapter and the preceding exercises and projects, you have examined several policies from various web resources and the policies of some actual organizations.

Expand the brief policies you created for the exercises in this to create an entire working security policy for your college. You will need to add administrative policies, development policies, and more.

Case Study

Hector is a security administrator for a defense contractor. This business frequently works with highly sensitive classified material. Hector has developed a policy for departing employees. This policy handles everything mentioned in this chapter:

Images All logon accounts to any server, VPN, network, or other resource are disabled.

Images All keys to the facility are returned.

Images All accounts for email, Internet access, wireless Internet, cell phones, and so on are shut off.

Images Any accounts for mainframe resources are canceled.

Images The employee’s workstation hard drive is searched.

Given the highly sensitive nature of the work at this company, what other actions might you add to this policy?

Chapter 11

Network Scanning and Vulnerability Scanning

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand how to verify the security of a system

Images Probe a system for vulnerabilities

Images Use vulnerability scanning tools

Images Evaluate potential security consultants

Introduction

At this point, it should be clear that it is necessary to periodically assess any system for vulnerabilities. There are a variety of methods for assessment, including vulnerability scanning, penetration testing, and auditing. The first part of this chapter discusses the essential steps that you should follow in assessing a system for vulnerabilities. The purpose of this chapter is to get someone who is new to computer security to begin thinking about these issues. This chapter is not meant to provide a comprehensive treatment of the subject or be a substitute for getting an expert consultant. In fact, most security topics, such as disaster recovery, cryptography, and policies, have had entire volumes written on them. This chapter should give you a basic blueprint you can follow. Specific details will depend on your particular environment, budget, skills, and security needs. The second part of this chapter discusses various tools you can use to scan your network for vulnerabilities.

In this book, you have thus far examined a number of threats to individual computers and networks. You have also learned about specific defenses against each of these dangers. However, you have not yet looked at a comprehensive approach to security. In the second part of this chapter, you will learn about many of the security procedures that can be implemented to provide an environment with more secure computing. Note that this chapter is about overall procedures that you need to perform in securing a system rather than specific step-by-step techniques.

Basics of Assessing a System

Knowing where to begin with system security can be daunting for those new to security. To keep it simple and easy to remember, the stages of assessing a system’s security can be categorized into the six Ps:

Images Patch

Images Ports

Images Protect

Images Policies

Images Probe

Images Physical

Patch

The first rule of computer security is to check patches. This is true for networks, home computers, laptops, tablets, smart phones,…literally any computer. The operating system, database management systems, development tools, Internet browsers, and so forth all need to be checked for patches. In a Microsoft environment, this should be easy, as the Microsoft website has a utility that will scan your system for any required patches to the browser, operating system, or Office products. It is a very basic tenet of security to ensure that all patches are up to date. This should be one of the first tasks when assessing a system.

It is also important to consider the types of patches. The most important patches are labeled important or critical. (Microsoft labels them critical, but other vendors may use another designation.) These patches must be applied; without them, your system simply is not secure. Recommended patches should be applied unless you have some compelling reason not to. Finally, optional patches usually enhance or correct some minor functionality in the system but are not necessary for security. Your system will not be vulnerable without them.

While home users might benefit from automatic patching, automatic patching is not appropriate for network administrators. It is always possible that a patch might interfere with some custom software or some system configuration. Therefore, patches need to be deployed first to a test system to ensure that they do not disrupt any other software or configurations. Once the testing is complete, you can push a patch out to the production network. Even then, patches should be rolled out in stages, in case something goes wrong. This does not mean that patches are not applied in a timely manner. If there is a critical patch, it must be tested promptly so that it can be rolled out to the production network.

Fyi: Patching and Applications

Whenever there is a patch to an operating system or application, there is documentation (sometimes in a Read Me file, sometimes at the download site) that indicates what the patch is fixing and that lists any known adverse interactions with other applications. You should always read this documentation before installing a patch. In most cases, the problems are minimal and often involve obscure situations. But it is always good to ensure that a service or an application upon which you are dependent will not be adversely impacted.

Fyi: Ports on Routers

One security flaw seen in many organizations that are otherwise security conscious is a failure to close ports on routers. This is particularly a problem for large organizations with wide area networks (WANs) spread over multiple locations. The routers between locations should be filtered but too often are not.

Once you have ensured that all patches are up to date, the next step is to set up a system to ensure that they are kept up to date. One simple method is to initiate a periodic patch review during which, at a scheduled time, all machines are checked for patches. There are also automated solutions that can patch all systems in an organization. It is imperative that all machines be patched, not just the servers.

An important issue is when to patch. For home users, it is usually recommended that automatic patching be turned on so that their systems get patched as soon as patches are available. However, this is not recommended for network administrators. It is entirely possible that a particular patch might not be compatible with some software on the network. A good example occurred in May 2022, when Microsoft’s “patch Tuesday” update caused Windows Active Directory authentication errors. Microsoft stated:¹

1. https://threatpost.com/microsofts-may-patch-tuesday-updates-cause-windows-ad-authentication-errors/179631/

After installing updates released May 10, 2022 on your domain controllers, you might see authentication failures on the server or client for services such as Network Policy Server (NPS), Routing and Remote Access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP).

It is recommended that you install patches on a test machine that has an identical configuration to your network’s workstations. Then after the patch has been tested, it can be pushed out to the network.

Ports

As you learned in Chapter 2, “Networks and the Internet,” all communication takes place via some port. Any port you do not explicitly need should be shut down. Any unused services on servers and individual workstations should be shut down. Both Windows (XP, Vista, 7, 8, 10, and 11) and Linux have built-in port-filtering capability. Windows 2000 Professional was the first Windows operating system to include port-filtering capability. Windows XP expanded this to a fully functional firewall. Windows 7 added a firewall that could block outgoing as well as incoming traffic and that continues to Windows 11. Shutting down a service in Windows and port filtering are both discussed in more detail in Chapter 9, “Computer Security Technology.”

You should also shut down any unused router ports in your network. If your network is part of a larger WAN, then it is likely that you have a router connecting you to that WAN. Every open port is a possible avenue of entry for malware or an intruder. Therefore, every port you close eliminates an opportunity for such attacks to affect your system.

In Practice

Shutting Down a Service in Windows

For an individual machine that is not running firewall software, you do not directly close ports; instead, you shut down the service using a port. For example, if you do not use an FTP service but you see that the FTP port is on, chances are that you have an FTP service running on that machine. In Windows (any Windows version since Windows 7, including Windows 11) or in Windows Server (any version from 2008 on), if you have administrative privileges, you can take the following two steps to shut down an unneeded service:

Go to the Control Panel and double-click Administrative Tools. (Note that in Windows 10 you go to Control Panel, click on System and Security, and double-click Administrative Tools.)

Double-click Services. You should see a window similar to the one shown in Figure 11.1.

Figure 11.1 Windows services.

The window in Figure 11.1 shows all services installed on the machine, whether they are running or not. Notice that the window also displays information about whether a service is running, whether it starts up automatically, and so forth. In Windows, more information can be seen by selecting an individual service. When you double-click on an individual service in any version of Windows (Windows XP through Windows 11, Server 2003 through Server 2019), you see a dialog box similar to the one in Figure 11.2 that provides details about that service.

Figure 11.2 Disabled services.

In the example shown in Figure 11.1, you can see a service on a machine that does not require it. In Figure 11.2 you see how to disable that service. To illustrate the procedure, next we will walk through disabling this service. (Before you turn off any service, however, you need to check whether other services depend on the one you are about to shut off. If other services depend on the one you want to turn off and you proceed to turn it off, you will cause the other services to fail.) Follow these steps to turn off a service:

Click on the Dependencies tab. In this case, the service has no dependencies.

Click the General tab.

Change the Startup type to Disabled.

Click the Stop button in the Service status section, if necessary. Your dialog box should look similar to the one in Figure 11.2. The fax service is now shut down.

Click OK to accept the edits made and close the Properties dialog box. Close the Services dialog box and the Administrative Tools dialog box.

Shutting down unneeded ports and services is an essential and very basic part of computer security. As mentioned, every port that is open (and every service that is running) is a possible avenue for a hacker or virus to get to your machine. Therefore, keep in mind this important rule: If you don’t need it, shut it down and block it.

Of course, you should make certain you are not shutting down services you do indeed need. Some services depend on other services. Fortunately, Windows gives you information about what services depend on a given service. If you are not certain, take the time to research a service before shutting it down. You don’t want to disable software and services that you do, in fact, need.

It is often the case that one will use a system that has an identical configuration to your production workstations and that system is used as a test. Either adding patches or shutting down services should be done on a test system. Then if there are no issues, you can roll the changes out to production machines. Even after using a test system, you should roll out to production in stages rather than roll out the entire network at one time. There is always the possibility of some issue occurring.

It is a best practice to make a list of all software that you are running. Then look up the ports and protocols that you need for that software and allow only those. It is important to keep in mind that these are ports for incoming traffic. If your machine is not used as a database server, web server, or other type of server and if your machine is a stand-alone one, you can (and should) close all ports. Workstations on networks may need some ports open for network utilities. We will examine some interesting utilities later in this chapter.

Protect

The next phase of assessing a system’s security is to ensure that all reasonable protective software and devices are employed. This means, at a minimum, having a firewall between your network and the outside world (refer to Chapter 2). You should also consider using an intrusion detection system (IDS) on that firewall and any web servers. (We discussed the Snort IDS in Chapter 9.) Some security experts consider IDSs to be nonessential; you can certainly have a secure network without one. However, using an IDS is the only way to know of impending attacks; there are free, open-source IDSs available, and I highly recommend using them. A firewall and an IDS will provide basic security to your network’s perimeter, but you also need virus scanning. Each and every machine, including servers, must have a virus scanner that is updated regularly. The point has already been made that a virus infection is the greatest threat to most networks. As also previously discussed, it is probably prudent to consider installing antispyware software on all of your systems to prevent users of your network from inadvertently running spyware on the network.

In Practice

Finding a Firewall

When selecting a firewall to use, you have a number of options: You can purchase a very inexpensive router-based firewall for your high-speed Internet connection, you can get a router that is separate from your DSL or cable router, or you can get a cable or DSL router that includes a firewall. The following websites can help you find more information on these options and determine which one would best suit your needs:

Images Linksys: https://www.linksys.com/ (Note: Linksys was purchased by Cisco.)

Images Firewall Guide: www.firewallguide.com

Images CDW: https://www.cdw.com/content/cdw/en/articles/security/firewall-type-comparison.xhtml

In addition to the information on the firewall options available, you can find many free or very inexpensive firewall packages on the Internet. Following is a list of six popular firewalls available via the Internet:

Images Norton Personal Firewall: This product is inexpensive and is available for multiple operating systems. A free trial download is available from https://us.norton.com/feature/firewall.

Images McAfee Personal Firewall: This product is similar in price and basic function to Norton Personal Firewall. You can find out more about this product at http://us.mcafee.com.

Images Comodo: This product has a free version and a commercial version. See https://www.comodo.com/home/internet-security/firewall.php.

Images ZoneAlarm: This product also comes in both free and commercial versions. See https://www.zonealarm.com/pc-protection/#fw-section.

Images Bitdefender Total Security: This product includes a firewall along with other security features. See https://www.bitdefender.com/solutions/total-security.xhtml?awc=2873_1659205504_91a428fcb027d4a97b11ad7579cbaf9d.

Images AFWall+: This firewall is for Android devices such as phones and tablets. See https://play.google.com/store/apps/details?id=dev.ukanth.ufirewall&hl=en.

For medium-sized or larger networks that have more flexible budgets, you will want something more than a personal firewall. Most major network product vendors include firewalls in their products. Cisco routers and Juniper routers both include firewall capabilities. For your network’s routers and switches, you should consult the vendor documentation and ensure that you have properly configured the firewall functionality included with that device.

Finally, Linux has a built-in firewall called iptables. It is an excellent solution for any system using Linux. The first firewall widely available for Linux was called ipchains. This product worked but had limitations. It was first introduced in version 2.2 of the Linux kernel and superseded ipfwadm. The iptables service, which is now the primary firewall for Linux, was first introduced in Linux kernel 2.4. On most Linux systems, iptables is installed as /usr/sbin/iptables; however, if it was not included in the installation, you can add it later.

Policies

While policies are discussed in detail in Chapter 10, “Security Policies,” we briefly review some aspects of policies here. It is absolutely essential that any organization have clearly written policies on computer security—and that those policies be strongly enforced by management. Those policies should cover acceptable use of organizational computers, the Internet, email, and any other aspect of the system. Policies should prohibit the installation of any software on the systems. Only IT personnel should install software—and only after they have verified its safety.

Policies should also advise users against opening unknown/unexpected attachments. I recommend that people within an organization or department use a code word. If that code word does not appear in the body of an email (or in the subject line), then they do not open the attachment. Most virus attacks spread via email attachments. The subject line and body of such email messages are generated automatically by the virus itself. All of your legitimate attachments can have a code word in the subject line; it is highly unlikely that this word would be in the subject line of an email sent by a virus. This alone could prevent your users from inadvertently opening a virus.

Policies should also clearly delineate who has access to what data, how backups are performed, and what to do to recover data in the case of a disaster (commonly called a disaster recovery plan). Data access must be limited to only those personnel with an actual need to access the data. For example, not everyone in the human resources department needs access to disciplinary files on all employees. Does your organization have a plan for what to do if a fire destroys your servers and all their data? Where do you get new machines? Who gets them? Is there an offsite copy of the data backup? Such questions must be addressed in a disaster recovery plan.

There should be a policy regarding passwords: acceptable minimum length, lifetime of a password, password history, and passwords to be avoided, such as any word that has a direct connection to the user. For example, a user who is a big fan of the Dallas Cowboys should not use a password that has any relationship to that sports team. Also, passwords that relate to personal data, such as spouse’s birthday, children’s names, or pet names, are poor choices. A password policy could also include recommendations or restrictions on a password.

Fyi: Good Passwords

Many sources claim that a good password is at least 8 (preferably 15) characters long; contains letters, numbers, and characters; and combines upper- and lowercase letters. After learning about rainbow tables earlier in this book, you are probably aware that an even longer password might be needed. I usually recommend a passphrase. Start with something easy like “cheeseburgers from Burger King.” Now put it all together in one word, use some capitalization, and change some letters to numbers, and you might end up with a password like this: !l!k3ch33s3burg3rsfrombuRG 3rk1ng. You can memorize such a password with surprising ease, and it is very difficult to guess or even to crack with a rainbow table.

Additionally, a password should not be kept for long periods of time. A 90- or 180-day password replacement schedule is good for most situations. More secure environments might require 30 or even fewer days. Microsoft recommends 42 days (6 weeks). This is referred to as password age. (The frequency of required password changes, of course, must be based on the user’s access to sensitive information or data. A company financial officer might change her password weekly; a nuclear arms engineer might change his password daily; and a mail clerk might need to change her password on a much less frequent basis.) You can set many systems (including Windows) to force the user to get a new password after a certain period of time. You should also make sure the person does not merely reuse old passwords, referred to as password history and also referred to in some operating systems as uniqueness. A good rule of thumb is a history depth of five—meaning that the person cannot reuse any of her previous five passwords. Additionally, you may need to implement a minimum password age to prevent users from immediately changing their password five times to return to her current password. Generally, a minimum of 1 day is recommended.

Fyi: How Extensive Should Policies Be?

How extensive should policies be? Should they be a few brief pages or a lengthy manual? Various computer security experts have different opinions. My opinion is that the policies should be lengthy enough to cover your organizational needs but not so lengthy as to be unwieldy. In short, overly long policy manuals are likely to be left unread by employees and hence not be followed. If you absolutely must have a long policy manual, then create a few brief submanuals for specific employee groups to increase the chances of the policies being read and followed. It is probably a good idea to have new hires briefed on security policies by someone from the IT security department.

Fyi: Checklists and Policies

For your convenience and to assist in getting you started in securing your systems and establishing good policies, the SANS Institute website provides examples of checklists and policies (see www.sans.org/security-resources/policies/). Each of these is also available electronically through the companion website for this text.

Finally, policies should include specific instructions on what to do in case of an employee termination. It is imperative that all of that person’s login accounts be immediately disabled and any physical access to any part of the system be immediately discontinued. Unfortunately, many organizations fail to address this properly and end up providing opportunities for disgruntled former employees to inflict retribution on the former employer.

Probe

An important step in assessing any network is to probe the network. We will look at several probes later in this chapter. The key is to periodically probe your own network for security flaws. This should be a regularly scheduled event—perhaps once a quarter. At a minimum, a complete audit of your security should be completed once per year. That would, of course, include probing your ports. However, a true security audit would also include a review of your security policies, your patching system, any security logs you maintain, personnel files of those in secure positions, and so forth.

Physical

Finally, you cannot ignore physical security. The most robustly secure computer that is left sitting unattended in an unlocked room is not at all secure. You must have some policy or procedure governing the locking of rooms with computers as well as the handling of laptops, PDAs, and other mobile computer devices. Servers must be in a locked and secure room with as few people as is reasonably possible having access to them. Backup tapes should be stored in a fireproof safe. Documents and old backup tapes should be destroyed before disposal (for example, by melting tapes, magnetizing hard disks, destroying external storage devices, and so on).

Physical access to routers and hubs should also be tightly controlled. Having the most high-tech, professional information security on the planet but leaving your server in an unlocked room to which everyone has access is a recipe for disaster. One of the most common mistakes in the arena of physical security is co-locating a router or switch in a janitorial closet. This means that, in addition to your own security personnel and network administrators, the entire cleaning staff has access to your router or switch, and any one of them could leave the door unlocked for an extended period of time.

There are some basic rules you should follow regarding physical security:

Images Server rooms: The room where servers are kept should be the most fire-resistant room in the building. It should have a strong door with a strong lock, such as a deadbolt. Only those personnel who actually have a need to go in the room should have a key. You might also consider a server room log wherein each person logs in when she enters or exits the room. There are actually electronic locks that record who enters a room, when she enters, and when she leaves. You may also wish to consider using biometric locks on critical areas such as server rooms. Consult local security vendors in your area for more details on price and availability.

Images Workstations: Every workstation should have an engraved identifying mark. You should also routinely inventory them. It is usually physically impossible to secure them as well as you secure servers, but you can take a few steps to improve their security. Some companies choose to attach the workstations to the desks with cables. This can be effective and affordable.

Images Miscellaneous equipment: Projectors, CD burners, laptops, and so forth should be kept under lock and key. Any employee who wishes to use one should be required to sign it out, and it should be checked to see that it is in proper working condition and that all parts are present when it is returned.

Having appropriate locks on doors is important. Locks that work with a passkey or swipe card that records who opened the door and when are recommended. Such recording of physical access should be done at least for sensitive areas like server rooms. Video monitoring has become quite inexpensive, and cameras can provide high-definition and night vision, as well as backup to the cloud. Such systems are even commonly found in homes.

Securing Computer Systems

In this section, we will examine various security specifics for an individual workstation, a server, and a network. You should be aware, however, that you do not need to reinvent the wheel. A number of very reputable organizations, including the following, have put together step-by-step guides, or security templates, that you can use in your network setting:

Images National Security Agency: The NSA’s website offers a number of specific network security guides. See https://nsacyber.github.io/publications.xhtml.

Images Center for Internet Security (CIS): CIS offers a number of security guides and benchmarks at https://www.cisecurity.org.

Images SANS Institute: SANS has a number of sample policies you can download and use or modify. See www.sans.org/resources/policies/.

You can modify these resources to fit your particular organization or use them as a starting point in forming your own security strategy.

There are also templates that can be applied to many operating systems and applications (such as Microsoft Windows and Microsoft Exchange) that will implement certain security precautions. These templates can be found for many products and then simply installed on the appropriate machine. Some security professionals prefer to handle the details of security themselves, but many administrators find these templates to be useful—and they can be invaluable for the beginner.

Images Windows security templates: https://support.microsoft.com/en-us/kb/816585

Images Understanding Windows templates: http://www.windowsecurity.com/articles-tutorials/misc_network_security/Understanding-Windows-Security-Templates.xhtml

The use of these templates will at least give you a baseline of security on the applications to which they are applied.

Securing an Individual Workstation

There are a number of steps that any prudent individual can take to make his own computer secure. These steps should be taken for both home computers and workstations on a network. In the former case, securing the individual computer is the only security option available. In the latter case, securing the individual computers as well as the perimeter allows for a layered approach to security. While some network administrators simply secure the perimeter via a firewall and/or proxy server, it is generally believed that you should also secure each machine in your organization. This is particularly vital in protecting against virus attacks and some of the distributed denial of service attacks that you learned about in Chapter 4, “Denial of Service Attacks.”

Fyi: Hardening a System

The process of securing a computer system against hackers, malware, and other intruders is sometimes referred to as hardening a system. You may see the terms server hardening and router hardening commonly used.

The first step with an individual computer is to ensure that all patches are appropriately applied. Microsoft’s website has utilities that will scan your machine for needed patches for both Windows and Microsoft Office. It is critical that you do this on a regular basis—once per quarter as a minimum. You should also check your other software vendors to see whether they have some similar mechanism to update patches for their products. It is amazing how many virus outbreaks have been widespread despite patches being available to secure the flaws they exploited. Too many people simply do not ensure that patches are applied regularly. For a home computer, this is the most critical step in your security strategy and will protect you from a number of attacks designed to exploit security flaws. For a networked workstation, this is still a vital piece of the overall security strategy and cannot be ignored.

The second step in securing an individual computer is restricting the ability to install programs or alter the machine configuration. In a network environment, this would mean that most users do not have permissions to install software or change system settings. Only network administrators and designated support staff should have that ability. In a home environment, this would mean that only a responsible party or parties (such as the parents) have access rights to install software.

One of the reasons for this particular precaution is to prevent users from accidentally installing a Trojan horse or other malware on their machine. If a person is prevented from installing any software, then there is no chance of inadvertently installing improper software such as a Trojan horse, adware, or other malware. Blocking users from altering the machine’s configuration also prevents them from changing system security settings. Novice users may hear of some way to change some setting and will do so, not realizing the security risks they are exposing their system to.

A perfect example in which a novice might adversely alter security settings involves the Windows Messenger service. This is not used for chat rooms or instant messaging, as many novices incorrectly assume. It is instead used for network administrators to send a broadcast message to all people on a network. Unfortunately, some adware programs also use that service to circumvent pop-up blockers and inundate you with ads. Thus, a security-conscious person might disable that service. You would not want an inexperienced person to turn it back on by thinking it is needed for instant messaging.

It is absolutely critical in any network environment that limits be placed on what the average user can do to a machine’s configuration. Without such limits, even well-meaning employees could eventually compromise security. This particular step is often met with some resistance from the organization. If you are in charge of a system’s security, it is your job to educate the decision makers as to why this step is so critical.

The next step has been discussed previously in this book. Each and every computer must have antivirus and antispyware software. You must also set it to routinely automatically update its virus definitions. Updated, running antivirus software is an integral part of any security solution. The two-pronged approach of antispyware and antivirus software should be a major component in your individual computer security strategy. Some analysts feel that antispyware is a nice extra but not a critical component. Others contend that spyware is a rapidly growing problem and will probably eventually equal or surpass the dangers of virus attacks.

Of course, if your operating system has a built-in firewall, it is a good idea to configure it and have it turned on. Windows (10 and 11) and Linux both come with built-in firewall features. Turn them on and configure them properly. The only significant problem you may encounter in implementing this step is that most networks require a certain amount of traffic between key servers (such as the DNS server) and individual computers. When you configure your firewall, make certain you are allowing appropriate traffic through. If you are at home, you can simply block all incoming traffic. If you are on a network, you must identify what traffic you need to allow.

Passwords and physical security, as discussed earlier in this chapter, are a critical part of computer security. You must ensure that all users utilize passwords that are at least eight characters long and consist of a combination of letters, numbers, and characters. In general, make sure that your password policy is complete and that all employees follow it. This will ensure that your physical security system is sound.

Following these guidelines will not make your computer totally impervious to danger, but these guidelines will make your workstation as secure as it reasonably can be. Remember that, even in a network environment, it is critical to also secure each computer as well as the perimeter.

Securing a Server

The core of any network is its servers—database servers, web servers, DNS servers, file and print servers, and so on. These computers provide the resources for the rest of the network. Generally, your most critical data will be stored on these machines. This means that these computers are an especially attractive target for intruders, and securing them is of paramount importance.

Essentially, to secure a server, you should apply the same steps that you would apply to any workstation and then add additional steps. There will not be a user on that machine routinely typing documents or using spreadsheets, so extra-tight restrictions are unlikely to cause the same difficulties for end users that they might on a workstation.

To begin with, you must follow the same steps you would for a workstation. Each and every server should have its software routinely patched. It should also have virus-scanning software and perhaps antispyware as well. It is critical that access to these machines, both via logging on and physical access, be limited to only those people with a clear need. There are, however, additional steps you should take with a server that you might not take with a standard workstation.

Most operating systems for servers (for example, Windows 2019 Server, Linux) have the ability to log a variety of activities. These activities would include failed logon attempts, software installation, and other activities. You should make sure that logging is turned on and that all actions that might pose a security risk are logged. You then must make certain that those logs are checked on a periodic basis.

Remember that the data on a server is more valuable than the actual machine. For this reason, data must be backed up on a regular basis. A daily backup is usually preferred but, in some cases, a weekly backup might be adequate. The backup tapes should be kept in a secure offsite location (such as a bank safety deposit box) or in a fireproof safe. It is critical that you limit access to those backup tapes just as you would limit access to the servers themselves.

With any computer, you should shut down any service you do not need. However, with a server, you may wish to take the extra step of uninstalling any software or operating system components you do not need, meaning that anything not required for the server to function should be removed. But think carefully about this before proceeding. Clearly, games and office suites are not needed for a server. However, a browser might be necessary to update patches.

There is another step that should be taken with servers that is not necessary with workstations. Most server operating systems have built-in accounts. For example, Windows has built-in administrator, guest, and power user accounts. Any hacker who wants to try to guess passwords will begin by trying to guess the passwords that go with these standard users. In fact, there are utilities on the Web that will do this automatically for the would-be intruder. First, you should create your own accounts with names that do not reflect their level of permission. For example, disable the administrator account and create an account called basic_user. Set up basic_user as the administrator account, with appropriate permissions. (Of course, only give that username and password to those people you want to have administrator privileges.) If you do this, a hacker would not immediately guess that this account is the one that he wants to crack. Remember, hackers ultimately want administrative privileges on a target system; concealing which accounts have those privileges is a vital step in preventing the hacker from breaching your security.

Fyi: Handling Old Backup Media

Unfortunately, many network administrators simply throw old backup media in the trash. Persons with malicious intent who retrieve this discarded media could restore it to their own machine. This could give them access to your older data without breaking in to your system or could give them very valuable clues as to your current security practices, depending on what is found on that media. Old media (tapes, DVDs, hard disks) should be thoroughly destroyed. For a DVD, this means physically breaking it. For a tape, this means partially or completely melting it. Hard disks should be magnetized with a powerful magnet.

There are a variety of Registry settings in any version of Windows that can be altered to increase your security. If you use a scanning tool, such as Cerberus, it returns a report stating the weaknesses in your Registry settings. What items in the Registry settings might cause security problems? A few items that are commonly examined include the following:

Images Logon: If your Registry is set so that the logon screen shows the last user’s name, you have done half of the hacker’s work for her. Since she now has a username, she only needs to guess the password.

Images Default shares: Certain drives/folders are shared by default. Leaving them shared like this presents a security hazard.

These are just a few of the potential problems in the Windows Registry. A tool such as Cerberus will not only tell you what the problems are but will make recommendations for corrections. To start the Registry editor, go to Start, select Run, and then enter regedit. You can then edit the Registry.

Securing a Network

Obviously, the first step in securing a network is to secure all computers that take part in that network, including all workstations and servers. However, this is just one part of network security. By now it should be clear that using a firewall and proxy server are also critical elements in network security. Chapter 12, “Cyber Terrorism and Information Warfare,” provides more details on these devices. For now, it is important to realize that you need to have them. Most experts also recommend using an IDS. There are a number of such systems available—and some are even free. These systems can detect things, such as port scanning, which might indicate that a person is preparing to attempt a breach of your security perimeter.

If your network is at all large, then you might consider partitioning it into smaller segments with a firewall-enabled router between segments. Of course, “large” is a vague term, and you will have to decide if your network is large enough to require partitioning. In this way, if one segment is compromised, the entire network will not be compromised. In this system, you might consider putting your most important servers (database, file) on a secure segment.

Because web servers must be exposed to the outside world and are the most common point of attack, it then makes sense to separate them from the rest of the network. Many network administrators will put a second firewall between the web server and the rest of the network. This means that if a hacker exploits a flaw in your web server and gains access to it, then he will not have access to your entire network. This brings up the issue of what should be on your web server. The answer is: only what you need to post web pages. No data, documents, or other information should be stored on that server, and certainly no extraneous software. The operating system and web server software are all that are required. You may add a few other items (such as an IDS) if your situation requires it. Any other software running on that server is a potential security risk.

Another concept you should consider is the DMZ (which stands for demilitarized zone). A DMZ essentially involves two firewalls: one outer and one inner. Resources that must be accessible to the outside world are between the two firewalls. The outer firewall is more permissive, and the inner firewall is highly restrictive. There are even routers that include this functionality in a single box. By plugging into certain ports, you are adding a device either behind the inner firewall or in the DMZ. This is shown in Figure 11.3.

Figure 11.3 DMZ.

You must also have policies that guide users in how to use the system, as we discussed earlier in this chapter. The most robust security in the world will not be of much use if a careless user inadvertently compromises your security. Keep in mind that you must have policies in place that guide users in what is considered appropriate use of the system and what is not.

Just as you take steps to harden your servers (such as patching the operating system and shutting down unneeded services), you should also harden your router. The specifics of what needs to be done will be contingent on your particular router manufacturer and model, but a few general rules should be followed:

Images Use good passwords: All routers are configurable. They can be programmed. Therefore, you must obey the same password policies on a router that you would use on any server, including minimum password length and complexity, age of password, and password history. If your router allows you to encrypt the password (as Cisco and other vendors do), then do it.

Images Use logging: Most routers allow for logging. You should turn this on and monitor it just as you would monitor server logs.

Images Security rules: Some basic router security rules should also be followed:

Images Do not answer to Address Resolution Protocol (ARP) requests for hosts that are not on the user local area network (LAN).

Images If no applications on your network use a given port, that port should be also shut down on the router.

Images Packets not originating from inside your LAN should not be forwarded.

These rules are simply a beginning. You will need to consult your vendor’s documentation for additional recommendations. You must absolutely pay as much attention to securing your router as you do to securing your servers. The following links might be helpful:

Images Router security: www.mavetju.org/networking/security.php

Images Cisco router hardening: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.xhtml

Scanning Your Network

The only way to be sure your network is secure is to actually check for vulnerabilities and flaws. In this section, we will look at some commonly used vulnerability scanners. These tools can be an invaluable asset for any network administrator.

NESSUS

Nessus (www.Nessus.org) is the premiere network vulnerability scanner. There was formerly a free version for personal use and a commercial version. It is now only available for a fee. This is perhaps the most widely used vulnerability scanner available today. It is not nearly as simple to use as MBSA but has many more capabilities. We will explore the basic functionality. If you have an interest in learning more about Nessus, then it is recommended that you consult the documentation available at the Nessus website.

Nessus is a well-known vulnerability scanner. It has been used for many years. Unfortunately, it is not free. The license, which costs over $3300 per year, can be obtained from https://www.tenable.com. Its price has been a barrier for many penetration testers. The primary advantage of Nessus is that the vendor is constantly updating the vulnerabilities it can scan for. Nessus also has a very easy-to-use web interface, as shown in Figure 11.4.

Figure 11.4 Nessus main screen.

If you click New Scan, you are given a number of options, as shown in Figure 11.5.

Figure 11.5 Nessus scan options.

You can select Basic Network Scan to see a number of intuitive basic settings. You have to name your scan and select a range of IP addresses, as shown in Figure 11.6.

Figure 11.6 Nessus basic network scan options.

Then you can either schedule the scan to run later or launch it right away. Nessus scans can take some time to run because they are quite thorough. The results are presented in a very organized screen, as illustrated in Figure 11.7.

Figure 11.7 Nessus results.

You can then drill down on any item of interest. If you double-click on a specific IP address, you can see details for that address, as illustrated in Figure 11.8.

Figure 11.8 Drilling down into Nessus results.

You can then double-click on any individual item for more details about the issues and how to remediate them.

OWASP Zap

The Open Web Application Security Project (OWASP) is the standard for web application vulnerability. OWASP offers a free vulnerability scanner called the Zed Attack Proxy, commonly known as OWASP ZAP. You can download it from https://www.zaproxy.org/download/. The interface, shown in Figure 11.9, is very easy to use.

Just type in the URL of the site you wish to scan and click Attack. After a few moments, the results are displayed at the bottom of the screen. You can then expand any item. If you click on a specific item, details are loaded as shown in Figure 11.10.

Figure 11.9 OWASP ZAP main screen.

Figure 11.10 OWASP ZAP results.

OWASP ZAP is a very easy-to-use tool. The basics can be mastered in a few minutes. And given that OWASP is the organization that tracks web application vulnerabilities, it is a very good source for testing the vulnerabilities of a website.

Shodan

The Shodan tool is widely used by black hat hackers and security professionals alike. The website https://www.shodan.io is essentially a search engine for vulnerabilities. You need to sign up for a free account to use it, but then it can be invaluable to a pen tester trying to identify vulnerabilities. Of course, the site can also be invaluable to attackers. You can see the website in Figure 11.11.

Figure 11.11 Shodan.io.

Shodan allows you to search using a number of options, including the following:

Images Search for default passwords, using search terms such as the following:

Images default password country:US

Images default password hostname:chuckeasttom.com

Images default password city:Chicago

Images Find Apache servers, using search terms such as the following:

Images apache city: “San Francisco”

Images Find webcams, using search terms such as the following:

Images webcamxp city:Chicago

Images OLD IIS, using search terms such as the following:

Images “iis/5.0”

With Shodan you can use a number of filters, including these:

Images city: Find devices in a specific city.

Images country: Find devices in a specific country.

Images geo: Specify coordinates (such as latitude and longitude).

Images hostname: Find values that match a specific hostname.

Images net: Search based on an IP address or an /x CIDR address.

Images os: Search based on operating system.

Images port: Find particular ports that are open.

Images before/after: Find results within a specified time frame.

For example, Figure 11.12 shows the results of a search for default password city:Miami.

Figure 11.12 Shodan search results.

When you are performing a penetration test, it is a good idea to search Shodan for your company domain to find information that can guide your penetration testing efforts. Of course, would-be attackers can also use Shodan to find the same information. You can restrict your search to the hostname or domain name of a client who has hired you to conduct a penetration test. You can use Shodan to seek out default passwords, old web servers, unsecured web cameras, and other vulnerabilities in the target network.

The search shown in Figure 11.12 was conducted using the free version of Shodan. Shodan also offers a paid version that starts at $69 and provides additional tools. There are also small business and corporate memberships available at a higher price.

Kali Linux

Kali Linux is a Linux distribution that comes packed with open-source tools for cybersecurity, digital forensics, and penetration testing. There are several scanners in Kali Linux you should be familiar with, as described in the sections that follow.

Lynsis

Lynsis is a host-based, open-source security auditing application that can evaluate the security profile and posture of Linux and other UNIX-like operating systems. This tool comes installed with the Kali Linux distribution. Figure 11.13 shows a basic scan process with Lynsis.

Figure 11.13 Lynsis scan.

Nikto

Nikto is a Kali Linux tool that scans websites for common vulnerabilities. There is no convenient graphical user interface; rather, you run Nikto from the Linux shell, and it is very simple to learn and use. You can see Nikto being used to scan my website in Figure 11.14.

Figure 11.14 Nikto scan.

The options with Nikto are easy to understand and use. For example, you can scan a group of IP addresses by just putting them all in a text file and using the command nikto -h targetIP.txt.

You can choose from several formats for output:

Images csv: Comma-separated-values format

Images htm: HTML format

Images nbe: Nessus NBE format

Images sql: Generic SQL format

Images txt: Plain text

Images xml: XML format

If not specified, the format is taken from the file extension that is passed to -output.

Sparta

Sparta is a vulnerability scanner that comes with Kali Linux and includes a number of other tools all in one package, including:

Images Mysql-default

Images Nikto

Images Snmp-enum

Images Smtp-enum-vrfy

Images Snmp-default

Images Snmp-check

Sparta also has an easy-to-use graphical user interface. Figures 11.15 through 11.17 show a basic Sparta scan.

Figure 11.15 Sparta step 1.

Figure 11.16 Sparta step 2.

Figure 11.17 Sparta step 3.

Vega

Vega, like OWASP ZAP, is a scanner for web applications. It is free and open source. Using both OWASP ZAP and Vega on your web applications will help validate your findings. You can download Vega from https://subgraph.com/vega/download/. As with OWASP ZAP, you only need to type in the URL and select the modules, and Vega does the rest, as shown in Figure 11.18.

Figure 11.18 Vega scan.

OpenVAS

OpenVAS is an open-source vulnerability scanner that was created by Greenbone Networks. The OpenVAS framework includes several services and tools that enable you to perform detailed vulnerability scanning against hosts and networks. OpenVAS can be downloaded from https://github.com/greenbone/openvas-scanner, and the documentation can be accessed at https://docs.greenbone.net/#user_documentation.

OpenVAS also includes an API that allows you to programmatically interact with its tools and automate the scanning of hosts and networks. The OpenVAS API documentation can be accessed at https://docs.greenbone.net/#api_documentation.

Running OpenVAS is very easy. The result screen will prompt you to purchase the full version by upgrading to a pro account, but you can ignore that if you wish and continue using the free version (see Figure 11.19).

Figure 11.19 OpenVAS results.

Testing and Scanning Standards

Specific standards are relevant to vulnerability scans and penetration tests. Some of the more prominent standards are briefly discussed in this section.

NIST 800-115

NIST 800-115, “Technical Guide to Information Security Testing and Assessment,” is a general guide for testing—not just penetration testing. This standard covers items one would include as part of a system audit, such as document review, log review, and similar items. However, the standard also covers items that should be included in both penetration tests and vulnerability scans. Most importantly, NIST 800-115 uses three specific phases:

Images Planning

Images Execution

Images Post-execution

This may seem like a rather simplified plan, but these phases are described in detail in the NIST 800-115 documentation. In fact, the standard recommends specific tools, many of which you have seen in this chapter already.

NSA-IAM

The National Security Agency InfoSec Assessment Methodology (NSA-IAM) is an excellent guide for penetration tests. The document describes three general phases, each subdivided into specific tasks:

Images Pre-assessment

Images Determine and manage the customer’s expectations

Images Gain an understanding of the organization’s information criticality

Images Determine customer’s goals and objectives

Images Determine the system boundaries

Images Coordinate with customer

Images Request documentation

Images On-site assessment

Images Conduct opening meeting

Images Gather and validate system information (via interview, system demonstration, and document review)

Images Analyze assessment information

Images Develop initial recommendations

Images Present out-brief

Images Post-assessment

Images Additional review of documentation

Images Additional expertise

Images Report coordination

The NSA-IAM has three levels of security testing. Assessment Level I involves reviewing policies and procedures; it is essentially an audit. Assessment Level II involves the use of tools for diagnosing and finding flaws; this is a vulnerability scan. Assessment Level III involves red team exercises; this is where the penetration testing occurs. So you can see that audits, vulnerability scans, and penetration tests are all covered in this standard.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is the standard used by Visa, MasterCard, American Express, and Discover. There are in fact a great many parts to the standard, but here we will focus on the penetration testing part. Obviously, if you have a system that deals with credit cards, this is an important standard.

The main focus of PCI DSS is the security controls and objectives that companies that process credit cards should implement. Security auditing and penetration testing are done to ensure that such controls are implemented and the objectives are met. You need a basic understanding of PCI DSS in order to truly understand a PCI DSS penetration test.

National Vulnerability Database

The National Vulnerability Database is not a standard but rather a database of known vulnerabilities. When checking your network for vulnerabilities, it should be rather clear that you need to check for known vulnerabilities. An excellent place to start is the National Vulnerability Database, which is a U.S. government repository of vulnerability data that uses the Security Content Automation Protocol (SCAP, pronounced “ess-cap”). The National Vulnerability Database is essentially a set of open standards that allows interoperability among vulnerability scanners. The SCAP protocol is used to enable automated vulnerability management. It can also be used to support policy compliance, including compliance with the Federal Information Security Modernization Act of 2002 commonly referred to as FISMA. You can view the NVD website in Figure 11.20.

Figure 11.20 National Vulnerability Database website.

Getting Professional Help

You may decide that you need outside help to set up and test your system’s security. This option is one that most security professionals would highly recommend if at all possible, particularly if you are new to security. It can be extremely helpful to get a professional consultant to assist you in setting up your initial security strategy and policies and perhaps do a periodic audit of your security. As mentioned in Chapter 1, “Introduction to Computer Security,” there are a number of people who claim to be hackers who are not. Frankly, there are also a number of self-proclaimed security experts who simply do not have the requisite skills. The question here is: How do you determine whether an individual is qualified? Following are some guidelines to consider in making this decision.

Experience is the most important factor when looking for a security professional. You want someone with a minimum of 5 years of IT experience, with 2 years related to security. Often, this will be a network administrator or programmer who has moved into security. Note that this is a minimum level of experience. More experience is always better. It is certainly possible that someone with less experience might have the requisite skill, but it is unlikely. Everyone needs a place to start, but you do not want your systems to be the place where someone is learning.

The quality of the person’s experience is as important as the length of experience. Ask details about the person’s experience. For example, exactly what role did she play in computer security? Did she simply set up policies, or did she actually do hands-on security work? What was the result? Was her system free from virus infections and hacker breaches or not? Can you contact her references? In short, simply because a person states that she was responsible for information security on her resume is not enough. You need to find out exactly what she did and what the results were.

Another important aspect of a security professional is education. Remember that computer security is a very broad subject. One needs an understanding of networks, protocols, programming, and more. It is entirely possible for a person with no formal education to have these skills, but it is less likely than if they had a formal education. Generally, these skills will most likely be found in a person with experience and a degree in a computer- or math-related field. That may sound somewhat intellectually snobbish, but it is a fact. There are many people in IT who are self-taught, such as people with history degrees who are network administrators or psychology majors who are now programmers. However, the more areas a person focuses in, the harder it is to obtain mastery. This is not to say that a person cannot be a security professional without a computer science, math, or engineering degree. The point is simply that this is one factor you should consider. If someone has an unrelated degree but meets or exceeds all other qualifications, you might still consider him. Some colleges are beginning to offer security-specific curriculum, and a few even offer security degrees. Clearly, specific training in computer security would be the most preferable security background.

Certifications have become very controversial in the IT profession. Some people swear by them. You can easily find many job advertisements that demand certain certifications, such as the CNE (Certified Novell Engineer) or MCITP (Microsoft Certified Information Technology Professional). Cisco certifications are also common (for example, Cisco Certified Network Associate through Cisco Certified Internetworking Engineer). On the other hand, you would have no problem finding some IT professionals who denigrate certifications and consider them utterly worthless. That second position stems from the fact that there are some people who hold certifications who don’t have the skills one would expect. But that is true of any credential. There are medical doctors who are incompetent. But if you need medical help, your odds are much better if you consult someone who has a medical degree. Employers often take this approach to hiring. If they only interview those with certain degrees or certifications, then they have a higher chance of interviewing qualified candidates.

A more reasonable position is somewhere between the two extremes. A certification can be a good indicator of a candidate’s knowledge of a specific product. For example, if you want someone to secure your Microsoft network, looking at people who are Microsoft certified is not a bad idea. You should balance that, however, by keeping in mind that it is entirely possible for someone with a good memory to use the various study guides available on the Internet and pass a test they don’t actually understand. That is where experience comes in. A certification coupled with appropriate experience is a good indicator of skill. Put another way, a certification in and of itself is not enough. But a combination of one or more certifications with experience and perhaps a related degree can be a strong indicator of technical skills.

In addition to the certifications for network administrators, there are a number of security-related certifications. Some have more credibility than others. The Security+ exam from CompTIA and the CIW Security Analyst are both conceptual exams. This means that they test a candidate’s knowledge of security concepts and not their ability to actually implement a security solution. By themselves, they may not indicate the skill level you need. But if, for example, you are securing a network using Novell, a candidate who is a CNE and has CIW Security Analyst or Security+ might be a good person to consider. It should be noted that CompTIA has recently added the Certified Advanced Security Practitioner (CASP), which is designed for those with 10 years of experience in security.

The most respected security certification is the CISSP (Certified Information Systems Security Professional). This test is a 6-hour exam and also requires 4 years of security-related experience if you also have a degree or 5 years of experience if you do not have a degree. CISSP holders are also required to submit a recommendation from another CISSP or an officer of their company and to take continuing education credits to maintain the certification. This is probably the most respected security-related certification. The vendor that produces CISSP (ISC2) also has advanced, post-CISSP certifications, such as the Information Systems Security Architecture Professional (ISSAP), Information Systems Security Engineering Professional (ISSEP), and Information Systems Security Management Professional (ISSMP).

The Certified Ethical Hacker certification is sponsored by the EC-Council (www.eccouncil.org). This test has also been the subject of some controversy. Keep in mind that it tests basic hacking skills, not a mastery of hacking. It is good for an introduction to hacking/penetration testing.

Offensive Security (https://www.offensive-security.com) specializes in penetration testing certifications. What makes their certification tests most interesting is that they all involve a hands-on component. You don’t simply take a test; you have to actually hack into their test systems.

CompTIA also offers several security exams, including Security+, CompTIA Advanced Security Practitioner (CASP), and Pentest+.

There are a number of general forensics certifications. EC-Council (www.eccouncil.org) has the Certified Hacking Investigator. There are also specific certifications for particular forensics tools. A good knowledge of basic forensics is useful for a security professional.

GIAC (www.giac.org) has a number of security-related certifications. All have a very solid reputation in the security industry. They are, however, more expensive than other tests, and for that reason there are fewer security professionals who have them. GIAC has security certifications (GSEC), penetration testing certifications (GPEN), and forensics certifications (GCFA and GCFE).

All certifications get some critics. The fact is that some people do attend boot camps and cram in just enough information to pass a certification. However, the same can be said of any qualification. It is certainly the case that there are medical doctors who are incompetent, but I am certain that if you are sick or injured, you seek out a medical doctor. The reason is that you are more likely to get qualified help from a doctor than if you simply select some random person. The same is true of certifications. Keep in mind that certifications reflect a minimum skill level, not mastery. I recommend having at least one general security certification (Security+, CASP, CISSP, and so on), one penetration testing certification (GPEN, CEH, Offensive Security, and so on), and one forensics certification (CCFP, GCFA, CHFI, and so on).

You should never hire a person based solely on certifications. Those certifications should simply be one element that you consider.

Finally, you should consider personal background. A security consultant or full-time employee will, by definition, have access to confidential information. Any legitimate security professional will not mind giving you any of the following:

Images References

Images Permission to check their credit history

Images Permission to check their criminal background

Anyone who seems reluctant to provide any of these items should be avoided. Therefore, an ideal security consultant might be a person with 5 or more years of experience, a degree in a computer-related discipline, a certification in your organization’s operating systems as well as one of the major security certifications, and a completely clean background, with references. As a rule, you simply cannot be too careful in hiring a security consultant.

Unless you have a highly trained security expert on staff, you should consider bringing in a security consultant to assess your system at least once. In our current legal environment, liability for security breaches is still being hotly debated. Companies are being sued for failing to practice due diligence in computer security. It is simply a wise move, both from a computer industry perspective as well as from a legal perspective, to do everything reasonable to ensure the security of your systems.

Summary

This chapter has outlined some basic items to look for in any security assessment. You should periodically assess your network/system for security vulnerabilities. A general recommendation would be a quarterly assessment for noncritical/low-security sites and perhaps as frequently as a weekly assessment for high-security sites. In any case, what are outlined in this chapter are the basics of assessing the security of a network, and they should give you a start toward securing your own network.

Safe computing is a matter of securing your computer, your network, and your servers and using common sense on the Web. It is important to rigorously apply security practices and standards to all computers, whether they are home computers or part of an organizational network.

Test Your Skills

Multiple Choice Questions

1. Which of the following is not one of the phases listed in NIST 800-115?

A. Planning

B. Execution

C. Post-assessment

D. Post-execution

2. John is now responsible for system security at a small bookkeeping firm. He wants to ensure that he implements good fundamental security. What is the most basic rule of computer security?

A. Keep systems patched.

B. Always use an IDS.

C. Install a firewall.

D. Always use antispyware.

3. You work in the network security department of a large bank. One of your jobs is to keep all systems patched. How might you ensure that system patches are kept up to date?

A. Use an automated patching system.

B. Patch any time you receive a vendor notification of a new patch.

C. Patch whenever a new threat is announced.

D. Use periodic scheduled patching.

4. Teresa is explaining basic security to a new technician. She is teaching him how to secure ports on any server or workstation. What is the rule about ports?

A. Block all incoming ports.

B. Block ICMP packets.

C. Block all unused ports.

D. Block all nonstandard ports.

5. Miguel is trying to secure a web server. He has decided to shut down any services that are not needed. His supervisor has told him to check dependencies first. Which of the following is a good reason to check dependencies before shutting down a service?

A. To determine whether you will need to shut down other services as well

B. To determine whether shutting down this service will affect other services

C. To find out what this service does

D. To find out whether this service is critical to system operations

6. If your machine is not used as a server and is not on a local network, what packet-filtering strategy should you use?

A. Block all ports except 80.

B. Do not block any ports.

C. Block all ports that you don’t need.

D. Do not block well-known ports.

7. You are trying to implement good fundamental security for a small company. Which of the following is the least essential device for protecting your network?

A. Firewall

B. Virus scanners on all machines

C. IDS system

D. Proxy server

8. Mohammed is responsible for security policies at a university. He is trying to ensure proper access policies. What is the rule of thumb on data access?

A. Data must be available to the widest range of people possible.

B. Only administrators and supervisors should access sensitive data.

C. Only those with a need for the specific data should have access.

D. All employees should have access to any data used in their department.

9. What are the main phases of the NSA-IAM process?

A. Planning, on-site assessment, post-assessment

B. Planning, execution, post-execution

C. Pre-assessment, execution, post-assessment

D. Pre-assessment, on-site assessment, post-assessment

10. What is the minimum frequency for system probing and audits?

A. Once per month

B. Once per year

C. Every other year

D. Every other month

11. An audit should check what areas?

A. Perform system patching, review policies, check personnel records of all managers, and probe for flaws

B. Only probe for flaws

C. Perform system patches, probe for flaws, check logs, and review policies

D. Check all machines for illicit software, perform complete system virus scan, and review firewall policies

12. Jerod is setting up security for a server room for a university. Which of the following is true of the room in which the server is located?

A. It should be in the most fire-resistant room in the building.

B. It should have a strong lock with a strong door.

C. It should be accessible only to those who have a need for access.

D. All of these answers are correct.

13. Elizabeth is responsible for security policies at her organization. She is trying to implement sound end-user security policies. What would be most important to block end users from doing on their own machine?

A. Running programs other than those installed by the IT staff

B. Surfing the Web and using chat rooms

C. Changing their screensaver and using chat rooms

D. Installing software or changing system settings

14. What is the preferred method for storing backups?

A. Near the server for quick restore if needed

B. Offsite in a secure location

C. In the IT manager’s office for security

D. At the home of one of the IT staff

15. Which of the following is a step you would definitely take with any server but might not be required for a workstation?

A. Uninstall all unneeded programs/software.

B. Shut down unneeded services.

C. Turn off the screensaver.

D. Block all Internet access.

16. Which of the following is a step you might take for large networks but not for smaller networks?

A. Use an IDS.

B. Segment the network with firewalls between the segments.

C. Use antivirus software on all machines on the network.

D. Do criminal background checks for network administrators.

17. Which of the following is a common way to establish security between a web server and a network?

A. Block all traffic between the web server and the network.

B. Place virus scanning between the network and the web server.

C. Put a firewall between the web server and the network.

D. Do not connect your network to the web server.

18. What is the rule on downloading from the Internet?

A. Never download anything.

B. Only download if the download is free of charge.

C. Only download from well-known, reputable sites.

D. Never download executables. Only download graphics.

19. Which of the following certifications is the most prestigious?

A. CISSP

B. PE

C. MCSA

D. Security+

20. Which of the following set of credentials would be best for a security consultant?

A. Ten years of IT experience, 1 year in security, CIW Security analyst, M.B.A.

B. Eight years of IT experience, 3 years in security, CISSP, B.S. in computer science

C. Eleven years of IT experience, 3 years in security, MCSE and CISSP, M.S. in information systems

D. Ten years of experience as a hacker and cracker, MCSE/CIW and Security+, Ph.D. in computer science

Exercises

EXERCISE 11.1: Patching Systems

Using a lab system, find and apply all operating system patches.

Check with all vendors of software installed on that machine and apply patches for those applications as well (if available).

Note the time taken to fully patch a machine. Consider how long it would take to patch a 100-machine network.

Write an essay that answers the following questions: Are there ways you could speed the process of patching a 100-machine network? How might you approach such a task?

Fyi: Helpful Resources

For Exercises 11.2, 11.3, and 11.4, you may find the following resources helpful:

Images www.cert.org

Images www.sans.org

EXERCISE 11.2: Learning About Policies

Using the resources given or other resources, find at least one sample security policy document.

Analyze that document.

Write a brief essay giving your opinion of that policy. Did it miss items? Did it include items you had not thought of?

EXERCISE 11.3: Learning About Disaster Recovery

Using the resources given or other resources, find at least one sample disaster recovery plan.

Analyze that document.

Write a brief essay giving your opinion of that disaster recovery plan. Also note any changes you would recommend to that policy.

EXERCISE 11.4: Learning About Audits

Using the resources given or other resources, find at least one sample security audit plan.

Analyze that document.

Write a brief essay giving your opinion of that plan. Do you feel the audit plan is adequate? What changes might you recommend?

EXERCISE 11.5: Securing Your Computer

Using either your home computer or a lab computer, follow the guidelines given in this chapter to secure that computer. Those steps should include the following:

Scan for all patches and install them.

Shut down all unneeded services.

Install antivirus software. (A demo version can be used for this exercise.)

Install antispyware software. (A demo version can be used for this exercise.)

Set appropriate password permissions.

EXERCISE 11.6: Secure Passwords

Using the Web or other resources, find out why longer passwords are harder to break.

Also find out what other things you should do to make a password harder to crack.

Write a brief essay describing what makes a perfect password.

EXERCISE 11.7: Securing a Server

This exercise is for those students with access to a lab server. Using the guidelines discussed in this chapter, secure a lab server. The steps taken should include the following:

Scan for all patches and install them.

Shut down all unneeded services.

Remove unneeded software.

Install antivirus software. (A demo version can be used for this exercise.)

Install antispyware software. (A demo version can be used for this exercise.)

Set appropriate password permissions.

Enable logging of any security violations. (Consult your operating system documentation for instructions.)

EXERCISE 11.8: Backups

Using the Web and other resources as a guide, develop a backup plan for a web server. The plan should cover how frequently to back up and where to store the backup media.

EXERCISE 11.9: User Accounts

This exercise is best done with a lab computer, not a machine actually in use.

Locate user accounts. (In Windows 8 or Windows 10, this is done by going to Start > Control Panel > Administrative Tools > Computer Management and looking for Groups and Users.)

Disable all default accounts (Guest, Administrator).

Projects

PROJECT 11.1: Writing and Executing an Audit Plan

With the knowledge you have gained while studying six chapters of this text and in examining security policies in the preceding exercises, it is now time to devise your own audit plan. This plan should detail all the steps in an audit.

Note: The second part of this project is contingent upon getting permission from some organization to allow you to audit its security. It is also ideal for a group project.

Taking the audit plan you wrote, audit a network. This audit can be conducted for any sort of organization, but you should make your first audit one with a small network (fewer than 100 users).

PROJECT 11.2: Forming a Disaster Recovery Plan

Using the knowledge you have gained thus far, create an IT disaster recovery plan for an organization. You may use a fictitious organization, but a real organization would be better.

PROJECT 11.3: Writing a Security Policy Document

Note: This project is designed as a group project.

It is now time to bring all you have learned thus far together. Write a complete set of security policies for an organization. Again, you may use a fictitious company, but real organizations are better. This set of policies must cover user access, password policies, frequency of audits (both internal and external), minimum security requirements, guidelines for web surfing, and so on.

PROJECT 11.4: Secure Web Servers

Using the information in this chapter as well as other resources, come up with a strategy specifically for securing a web server. This strategy should include the security of the server itself as well as securing the network from the server.

PROJECT 11.5: Adding Your Own Guidelines

Note: This project is ideal for a group project.

This chapter has outlined some general procedures for security. Write an essay detailing your own additional guidelines. These can be guidelines for individual computers, servers, networks, or any combination thereof.

Case Study

Juan Garcia is the network administrator for a small company that also maintains its own web server. He has taken the following precautions:

Images All computers are patched, have antivirus software, and have unneeded services shut down.

Images The network has a firewall with proxy server and IDS.

Images The organization has a policy requiring passwords of 10 characters in length, and they must be changed every 90 days.

Consider the following questions:

Has Juan done enough to secure the network?

What other actions would you recommend he take?

Chapter 12

Cyber Terrorism and Information Warfare

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Explain what cyber terrorism is and how it has been used in some actual cases

Images Understand the basics of information warfare

Images Have a working knowledge of some plausible cyber terrorism scenarios

Images Have an appreciation for the dangers posed by cyber terrorism

Images Explain future trends in cyber warfare

Introduction

This book has looked at various ways a person might use a computer to commit a crime. This book has also looked into specific methods to make a system more secure. One issue that has not been addressed is cyber terrorism. People in countries around the world have grown accustomed to the ever-present threat of terrorist attacks, which can come in the form of bombs, hijacking, release of a biological agent, or other means. However, in our modern world, we have to consider cyber attacks as well.

The first question might be this: What is cyber terrorism? According to the FBI, cyber terrorism is a premeditated, politically motivated attack against information, computer systems, computer programs, and data that results in violence against noncombatant targets by subnational groups or clandestine agents. Cyber terrorism is simply the use of computers and the Internet connectivity between them in order to launch a terrorist attack. In short, cyber terrorism is just like other forms of terrorism—it is only the milieu of the attack that has changed. Clearly, the loss of life due to a cyber attack would be much less than that of a bombing. In fact, it is highly likely that there would be no loss of life at all. However, significant economic damage, disruptions in communications, disruptions in supply lines, and general degradation of the national infrastructure are all quite possible via the Internet.

The real question might be: What is the difference between cyber espionage and cyber terrorism? First and foremost, the goal of espionage is simply to gather information. It is preferable to the spy if no one is even aware that anything occurred. This is true for both corporate and international espionage. Cyber terrorism, on the other hand, seeks to cause damage, and it needs to be as public as possible. The idea is to strike fear into people. While some might find the topics related, they are actually quite different.

Leading up to the 2022 Russian invasion of Ukraine, Russia made coordinated cyber strikes against Ukraine. This sort of two-pronged operation—cyber attacks coupled with kinetic warfare—is expected to be more common in coming years. First disrupting the target’s infrastructure through a cyber attack improves the chance that the kinetic attacks will succeed. This is not meant as a comment on the morality of the Russian invasion of Ukraine but rather an observation about the role cyber attacks play and will continue to play in traditional conflict scenarios.

It is a strong possibility that, in time, someone or some group will try to use computer methods to launch a military or terrorist attack against our nation. Some experts make the case that the MyDoom virus was an example of domestic economic terrorism. However, an attack such as that may be only the tip of the iceberg. Sometime in the near future, our nation may be the target of a serious cyber terrorism attack. This chapter will examine some possible cyber terrorism scenarios, with the purpose of giving you a realistic assessment of just how serious a threat this is. In the exercises at the end of the chapter, you will have the opportunity to examine current acts of cyber terrorism, as well as potential threats, and the actions you can take to help prevent them.

The first edition of this book discussed cyber terrorism as well. That was in 2004. At that time, some may have thought that the coverage of that topic was almost fiction, that there was no real threat from cyber terrorism. That has proven to not be the case. One of the first indications that cyber terrorism is a real threat was that in November 2006 the secretary of the Air Force announced the creation of the Air Force Cyber Command (AFCC), whose primary function is to monitor and defend American interests in cyberspace. The AFCC draws upon the personnel resources of the 67th Network Warfare Wing as well as other resources. It seems that the U.S. Air Force takes the threat of cyber terrorism and cyber warfare seriously, given that it has created an entire command to counter that threat.

Actual Cases of Cyber Terrorism

Because some readers may wonder whether this is just fear mongering, let’s look at some actual cases of cyber terrorism before we delve into the various aspects of it. How likely is a genuine cyber terrorist attack? Well, let’s look at some real-world cases of cyber terrorism before we delve into the various aspects of it. We will begin with older cases and work our way forward to modern cases to provide a timeline of cyber warfare, espionage, and terrorism.

CENTCOM, or Central Command, is the U.S. military command responsible for operations in the Middle East and Near East. In 2008 CENTCOM was infected with spyware. A USB drive was left in the parking lot of a DoD facility in the Middle East. A soldier picked it up and plugged it into his workstation, thus introducing the spyware to the CENTCOM network. The worm was known as Agent.btz, a variant of the SillyFDC worm. This was a significant security breach, and we will probably never know how much data was lost or how much damage was caused.

The year 2009 brought a number of Internet-based attacks, specifically against U.S. government websites, such as the websites of the Pentagon and the White House (in the United States) and various government agencies in South Korea. These attacks coincided with increased tensions with North Korea. Clearly, these where examples of cyber terrorism, albeit relatively minor.

In December 2009 a far more disturbing story came out. Hackers broke into computer systems and stole secret defense plans of the United States and South Korea. Authorities speculated that North Korea was responsible. The information stolen included a summary of plans for military operations by South Korean and U.S. troops in case of war with North Korea, and the attacks traced back to a Chinese IP address. This case is clearly an example of cyber espionage and a very serious one at that.

In December 2010 a group calling itself the Pakistan Cyber Army hacked the website of India’s top investigating agency, the Central Bureau of Investigation (CBI). This sort of cyber espionage is far more common than what is revealed to the public.

In 2015 Chinese hackers were deemed responsible for breaking into U.S. government computers and accessing the data of 4 million current and former federal employees. This was a breach of the Office of Personnel Management.

Also in 2015, half of Turkey experienced a 12-hour power outage after an attack carried out by advanced persistent threat (APT) group MuddyWater, which has ties to Iran’s Ministry of Intelligence and Security. The group used malicious PDFs and Office documents as their main attack vector.¹

1. https://www.zdnet.com/article/state-sponsored-iranian-hackers-attack-turkish-govt-organizations/

In 2017 Russian-backed hackers targeted at least 10,000 U.S. Defense Department (DoD) employees via Twitter.

In 2019 Russia accused the United States of planting malware on Russia’s power grid.² The Russian government claims that U.S. probing of the Russian power grid goes back as far as 2012. There is, however, no evidence that any of the malware had actually been used.

2. https://www.securityweek.com/us-planted-powerful-malware-russias-power-grid-report

In 2022 the United States claimed to have removed malware around the world to prevent Russian cyber attacks. The malware in question was meant to allow GRU (Russian military intelligence) to create and control botnets.³

3. https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation

These incidents show a steady progression in the use of cyber weapons by nation-states. Clearly, this issue is not hypothetical but rather actual and increasing. Later in this chapter, detailed examinations of specific incidents will be provided.

China’s Advanced Persistent Threat

An advanced persistent threat (APT), as the name suggests, is a series of advanced cyber attacks that are sustained over a period of time—hence the term persistent. The security firm Mandiant tracked several APTs over a period of 7 years,⁴ all originating in China, specifically Shanghai and the Pudong region. These APTs were simply named APT1, APT2, and so on.

4. https://www.mandiant.com/resources/apt1-exposing-one-of-chinas-cyber-espionage-unit

The attacks were linked to UNIT 61398 of China’s military. The Chinese government regards this unit’s activities as classified, but it appears that offensive cyber warfare is one of its tasks. A single one of the APTs from this group compromised 141 companies in 20 different industries. APT1 was able to maintain access to victim networks for an average of 365 days—and in one case for 1764 days. APT1 is responsible for stealing 6.5 terabytes of information from a single organization over a 10-month time frame.

India and Pakistan

India and Pakistan have had deep enmity for each other for quite some time. It should be no surprise that, in recent years, this has involved cyber operations.

One India published an article in August 2015 titled “Pakistan Wants to Launch Cyber War on India,” which stated, “The cyber wing of the Intelligence Bureau has warned that government websites could be hacked by the Pakistan Cyber Army in this ongoing proxy war against India.”⁵ As per the latest alert, Pakistan’s ISI has directed its cyber army to declare an Internet war on India.

5. https://www.oneindia.com/india/pakistan-wants-to-launch-cyber-war-on-india-1831947.xhtml

This has continued. In 2022, there was an article discussing the various ways India and Pakistan have utilized cyber attacks in their ongoing dispute over Kashmir.⁶ Both sides have employed cyber attacks against the other. Furthermore, both sides have used third parties as part of their cyber conflict.

6. https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/how-pakistan-brought-cyberwar-kashmir

Russian Hackers

According to ISight Partners, a cyber intelligence firm, in 2014 hackers from Russia were spying on computers used in NATO and the European Union.⁷ The spying was accomplished by exploiting bugs in Microsoft Windows. The hackers were also reported to have been targeting sites in Ukraine for spying.

7. https://www.nytimes.com/2014/10/15/business/international/russian-hackers-used-bug-in-microsoft-windows-for-spying-report-says.xhtml

Iran–Saudi Tension

The tension between Iran and Saudi Arabia has gone on for decades. The civil war in Yemen has been a proxy war between Iran and Saudi Arabia. Each side has accused the other of cyber attacks. In addition, there have been numerous accusations of outside influence. The Houthi have been accused of being proxies for Iran, as both the Houthi and Iran are Shia. The United States and Saudi Arabia have both accused Iran of arming the Houthi. Iran and the Houthi deny any affiliation. African nations such as Eritrea have also been accused of supporting the Houthi. The Yemeni government has actually received support from the United States and Saudi Arabia.

The Shamoon virus was first discovered in 2012, and a variant was found circulating in 2017. Shamoon acts as spyware but deletes files after it has uploaded them to the attacker. The virus attacked Saudi Aramco workstations, and a group named Cutting Sword of Justice claimed responsibility for the attack. A number of security officials within Saudi Aramco have blamed Iran for this attack. And, like Stuxnet (described shortly), this virus infected systems other than the intended target.

Weapons of Cyber Warfare

In cyber warfare and cyber terrorism, malware is still the primary weapon. Whether it is spyware, a virus, a Trojan horse, a logic bomb, or some other sort of malware, it is still the malware that is the essential vehicle for conducting a cyber conflict. In this section, we will look at some well-known malware that has been used in conflicts.

Stuxnet

Stuxnet is a classic example of weaponized malware. Stuxnet first spread via infected USB drives; however, once it was on an infected machine, it would spread over the entire network and even over the Internet. The Stuxnet virus then searched for a connection to a specific type of programmable logic controller (PLC), specifically the Siemens Step7 software. If that particular PLC was discovered, Stuxnet would load its own copy of a specific DLL for the PLC in order to monitor the PLC and then alter the PLC’s functionality.

Stuxnet was designed to target centrifuge controllers involved in Iran’s uranium enrichment. But the virus spread beyond its intended target and thus became publicly known. While many users reported no significant damage from Stuxnet, outside the Iranian reactors, it was detected on numerous machines.

Stuxnet employed a classic virus design. Stuxnet has three modules: a worm that executes routines related to the attack; a link file that executes the propagated copies of the worm; and a rootkit responsible for hiding files and processes, with the goal of making it more difficult to detect the presence of Stuxnet. It is not the purpose of this discussion to explore the intricacies of Stuxnet. Rather, Stuxnet is introduced as both an example of state-sponsored malware attacks and at least an attempt to target such attacks.

Flame

No modern discussion of cyber warfare and espionage would be complete without a discussion of Flame. This virus first appeared in 2012 and was targeting Windows operating systems. The first item that makes this virus notable is that it was specifically designed for espionage. It was first discovered in May 2012 at several locations, including Iranian government sites. Flame is spyware that can monitor network traffic and take screenshots of the infected system.

It was spyware that recorded keyboard activity and network traffic, took screenshots, and is even reported to have recorded Skype conversations. It also would turn the infected computer into a Bluetooth beacon attempting to download information from nearby Bluetooth-enabled devices.

Kaspersky Lab reported that the Flame file contained an MD5 hash that only appeared on machines in the Middle East. This indicates the possibility that the virus authors intended to target the malware attack to a specific geographical region. The Flame virus also appears to have had a kill function allowing someone controlling it to send a signal directing it to delete all traces of itself. These two items indicate an attempt to target the malware, though the outcome of that targeting seems to have been a failure, or we would not be aware of its existence.

StopGeorgia.ru Malware

A number of hacking incidents played a role in the conflict between Russia and Georgia. The StopGeorgia.ru forum was an online forum designed to facilitate attacks against key network targets within Georgia. The online forum would advertise specific targets, give tutorials (and in some cases tools) for helping even low-skilled attackers engage the targets, and even provided links to proxy servers to help facilitate the attack by hiding the attacker’s true IP address and location.

As an example of what the website StopGeorgia.ru offered, there was a tool named DoSHTTP that automated DoS attacks and a list of websites and IP addresses within Georgia that would be good targets. This encouraged anyone sympathetic to Russia’s position in this conflict, who had even minimal computer skills, to embark on cyber attacks against Georgia.

FinFisher

FinFisher spyware was designed for law enforcement agencies with a warrant, to collect evidence on suspects. However, the software was released by WikiLeaks. It is now available on the Internet for anyone who wishes to use it.

BlackEnergy

BlackEnergy theoretically manipulates water and power systems, including causing blackouts and water supply disruptions. The BlackEnergy software has been traced to the Russian group SandWorm. In January 2016, a blackout at the Kiev airport was linked to the BlackEnergy malware.

The BlackEnergy malware specifically affects power plants. The malware is a 32-bit Windows executable. BlackEnergy is versatile malware, able to initiate several different attack modalities. It can launch distributed denial of service (DDoS) attacks. It also can deliver KillDisk, a feature that renders a system unusable.

Regin

Regin—also known as QWERTY and Prax—is a malware and hacking toolkit alleged to have been created by the U.S. National Security Agency in cooperation with the British GCHQ. The malware was first published by Kaspersky Lab and Symantec in 2014. This malware, which targets specific Windows computers, is quite stealthy due to its encrypted virtual file system.

NSA ANT Catalog

NSA ANT is reported to be a catalog that NSA makes available to agencies within the U.S. government that have clearance. It is a catalog of malware, including spyware, that has been developed by the National Security Agencies Tailored Access Operations group. A number of sources purport to have lists of items in the catalog as well as screenshots from the catalog. Given the classified nature of this catalog, if it actually exists, any website claiming to have details of the catalog should be treated with some skepticism.

Economic Attacks

There are a variety of ways that a cyber attack can cause economic damage. Lost files and lost records are one way. Chapter 9, “Computer Security Technology,” discussed cyber espionage and mentioned the inherent value of data. In addition to stealing that data, it could simply be destroyed, in which case the data is gone and the resources used to accumulate and analyze the data are wasted. To use an analogy, consider that a malicious person could choose to simply destroy your car rather than steal it. In either case, you are without the car and will have to spend additional resources acquiring transportation.

In addition to simply destroying economically valuable data (remember that there is very little data that does not have some intrinsic value), there are other ways to cause economic disruption. Some of those ways include stealing credit cards, transferring money from accounts, and committing fraud. But it is a fact that anytime IT staff is involved with cleaning up a virus rather than developing applications or administering networks and databases, there is economic loss. The mere fact that companies now need to purchase antivirus software and intrusion detection software and hire computer security professionals means that computer crime has already caused economic damage to companies and governments around the world. However, the general damage caused by random virus outbreaks, lone hacking attacks, and online fraud is not the type of economic damage that is the focus of this chapter. This chapter is concerned with a concerted and deliberate attack against a particular target or targets for the exclusive purpose of causing direct damage.

A good way to get a firm grasp on the impact of this type of attack is to walk through a scenario. Group X (which could be an aggressive nation, a terrorist group, an activist group, or literally any group with the motivation to damage a particular nation) decides to make a concerted attack on our country. It finds a small group of individuals (in this case, six) who are well versed in computer security, networking, and programming. These individuals, motivated either by ideology or monetary needs, are organized to create a coordinated attack. There are many possible scenarios under which they could execute such an attack and cause significant economic harm. The example outlined next is just one of those possible attack modalities. In this case, each individual has an assignment, and all assignments are designed to be activated on the same specific date:

Images Team member one sets up several fake e-commerce sites. Each of these sites is up for only 72 hours and pretends to be a major stock brokerage site. During the brief time it is up, the site’s real purpose is only to collect credit card numbers, bank account numbers, and so forth. On the predetermined date, all of those credit card and bank numbers will be automatically, anonymously, and simultaneously posted to various bulletin boards/websites and newsgroups, making them available for any unscrupulous individual who wishes to use them.

Images Team member two creates a virus that is contained in a Trojan horse. Its function is to delete key system files on the predetermined date. In the meantime, it shows a series of business tips or motivational slogans, making it a popular download with people in business.

Images Team member three creates another virus. It is designed to create distributed denial of service (DDoS) attacks on key economic sites, such as those for stock exchanges or brokerage houses. The virus spreads harmlessly and is set to begin its DDoS attack on the predetermined date.

Images Team members four and five begin the process of footprinting major banking systems, preparing to crack them on the predetermined date. Footprinting is the process of gathering information—some from public sources, others by scanning the target system/network.

Images Team member six prepares a series of false stock tips to flood the Internet on the predetermined date.

If each of these individuals is successful in his mission, on the predetermined date several major brokerages and perhaps government economic sites are taken down, viruses flood networks, and files are deleted from the machines of thousands of businesspeople, economists, and stockbrokers. Thousands of credit cards and bank numbers are released on the Internet, guaranteeing that many will be misused. It is also highly likely that the cracking team members four and five will have some success—meaning that possibly one or more banking systems are compromised. It does not take an economist to realize that this would easily cost hundreds of millions of dollars, perhaps even billions of dollars. A concerted attack of this nature could easily cause more economic damage to our country than most traditional terrorists attacks (bombings) have ever done. This is illustrated in Figure 12.1.

Figure 12.1 A team member of Group X?

You could extrapolate on this scenario and imagine not just one group of six cyber terrorists, but five groups of six—each group with a different mission and each mission designed to be committed approximately 2 weeks apart. In this scenario, the nation’s economy would literally be under siege for 2.5 months.

This scenario is not particularly far-fetched when you consider that, in past decades, nuclear scientists were sought after by various nations and terrorist groups. More recently, experts in biological weapons have been sought by these same groups. It seems extremely likely that these groups will see the possibilities of this form of terrorism and seek out computer security/hacking experts. Given that there are thousands of people with the requisite skills, it seems likely that a motivated organization could find a few dozen people willing to commit these acts.

Military Operations Attacks

When computer security and national defense are mentioned together, the obvious thought that comes to mind is the possibility of some hacker breaking into ultra-secure systems at the U.S. Department of Defense, Central Intelligence Agency (CIA), or National Security Agency (NSA). However, such an intrusion into one of the most secure systems in the world is very unlikely—not impossible, but very unlikely. The most likely outcome of such an attack would be for the attacker to be promptly captured. Such systems are hyper-secure, and intruding upon them is not as easy as some movies might suggest. However, there are a number of scenarios in which breaking into less secure systems could jeopardize our national defense or put military plans at risk.

Consider less sensitive military systems for a moment—systems that are responsible for basic logistical operations (such as food, mail, and fuel). Someone who cracks one or more of these systems could perhaps obtain information that several C-141s (aircraft often used for troop transports and parachute operations) are being routed to a base that is within flight distance of some city—a city that has been the focal point of political tensions. This same cracker (or team of crackers) might also find that a large amount of ammunition and food supplies—enough for perhaps 5000 troops for 2 weeks—is simultaneously being routed to that base. Then, on yet another low-security system, the cracker (or team of crackers) may note that a given unit, such as two brigades of the 82nd Airborne Division, has had all military leaves canceled. It does not take a military genius to conclude that these two brigades are preparing to drop in on the target city and secure that target. Therefore, the fact that a deployment is going to occur, the size of the deployment, and the approximate time of that deployment can all be deduced without ever attempting to break into a high-security system.

Taking the previous scenario to the next level, assume the hacker gets deep into the low-security logistical systems. Then assume that he does nothing to change the routing of the members of the brigades or the transport planes—actions that might draw attention. However, he does alter the records for the shipment of supplies so that the supplies are delivered 2 days late and to the wrong base. So there would be two brigades potentially in harm’s way, without a resupply of ammunition or food en route. Of course, the situation could be rectified, but the units in question may go for some time without resupply—enough time, perhaps, to prevent them from successfully completing their mission.

These are just two scenarios in which compromising low-security/low-priority systems can lead to very significant military problems. This further illustrates the serious need for high security on all systems. Given the interconnectivity of so many components of both business and military computer systems, there are no truly “low-priority” security systems.

General Attacks

The previously outlined scenarios involve specific targets with specific strategies. However, once a specific target is attacked, defenses can be readied for it. There are many security professionals who work constantly to thwart these specific attacks. What may be more threatening is a general and unfocused attack with no specific target. Consider the various virus attacks of late 2003 and early 2004. With the exception of MyDoom, which was clearly aimed at the Santa Cruz Organization, these attacks were not aimed at a specific target. However, the sheer volume of virus attacks and network traffic did cause significant economic damage. IT personnel across the globe dropped their normal projects to clean infected systems and shore up the defenses of systems. While these attacks are several years old, they are typical and thus worthy of study.

This leads to another possible scenario in which various cyber terrorists continuously release new and varied viruses, perform denial of service attacks, and work to make the Internet in general, and e-commerce in particular, virtually unusable for a period of time. Such a scenario would actually be more difficult to combat, as there would not be a specific target to defend or a clear ideological motive to use as a clue to the identity of the perpetrators.

Supervisory Control and Data Acquisitions (SCADA)

SCADA systems are industrial systems used to operate and monitor large-scale equipment (for example, power generators, civil defense alarms, water treatment plants). These systems are very attractive targets for cyber terrorism. In 2009 60 Minutes did a report on the vulnerability of power systems. It showed that penetration testers working for the Department of Energy were able to take over a power generator and potentially overload it, causing permanent damage and taking it offline. The famous Stuxnet virus that infected Iranian nuclear facilities was exploiting a vulnerability in SCADA systems.

These systems are of particular concern because damage to them is not simply an economic attack. It is entirely possible for lives to be lost as a result of cyber attacks on SCADA systems.

The components of a SCADA system include:

Images Remote terminal units (RTUs) connected to sensors to send and receive data, often with embedded control capabilities

Images Programmable logic controllers (PLCs)

Images A telemetry system, typically used to connect PLCs and RTUs with control centers

Images A data acquisition server, which is a software service that uses industrial protocols to connect software services, via telemetry, with field devices such as RTUs and PLCs

Images A human–machine interface (HMI) to present processed data to a human operator

Images A historian, which is a software service that accumulates time-stamped data, Boolean events, and Boolean alarms in a database

Images A supervisory (computer) system

There are standards for SCADA security. Special Publication 800-82, Revision 2, “Guide to Industrial Control System (ICS) Security,” is specific to industrial control systems, including SCADA systems and PLCs (programmable logic controllers). This document begins by examining the threats to these systems in detail. It also discusses how to develop a comprehensive security plan for such a system.

Information Warfare

Information warfare certainly predates the advent of the modern computer and, in fact, may be as old as conventional warfare. In essence, information warfare is any attempt to manipulate information in pursuit of a military or political goal. When you attempt to use any process to gather information on an opponent or when you use propaganda to influence opinions in a conflict, these are both examples of information warfare. Chapter 7, “Industrial Espionage in Cyberspace,” discussed the role of the computer in corporate espionage. The same techniques can be applied to a military conflict in which the computer can be used as a tool in espionage. Although information gathering will not be reexamined in this chapter, it is only one part of information warfare. Propaganda is another aspect of information warfare. The flow of information impacts troop morale, citizens’ outlooks on a conflict, the political support for a conflict, and the involvement of peripheral nations and international organizations.

Propaganda

Computers and the Internet are very effective tools that can be used in the dissemination of propaganda. Many people now use the Internet as a secondary news source, and some even use it as their primary news source. This means that a government, terrorist group, political party, or any activist group could use what appears to be an Internet news website as a front to put its own political spin on any conflict. Such a website does not need to be directly connected to the political organization whose views are being disseminated; in fact, it is better if it is not directly connected. The Irish Republican Army (IRA), for example, has always operated with two distinct and separate divisions: one that takes paramilitary/terrorist action and another that is purely political. This allows the political/information wing, called Sinn Féin, to operate independently of any military or terrorist activities. In fact, Sinn Féin now has its own website (www.sinnfein.org), shown in Figure 12.2, where it disseminates news with its own perspective. In this situation, however, it is fairly clear to whomever is reading the information that it is biased toward the perspective of the party sponsoring the site. A better scenario (for the party concerned) occurs when there is an Internet news source that is favorably disposed to a political group’s position without having any actual connection. This makes it easier for the group to spread information without being accused of obvious bias. The political group (be it a nation, rebel group, or terrorist organization) can then “leak” stories to that news agency.

Figure 12.2 The Sinn Féin website.

Information Control

Since World War II, control of information has been an important part of political and military conflicts. Following are just a few examples:

Images Throughout the Cold War, Western democracies invested time and money in radio broadcasts into communist nations. This well-known campaign was referred to as Radio Free Europe. The goal was to create dissatisfaction among citizens of those nations, hopefully encouraging defection, dissent, and general discontent. Most historians and political analysts agree that this was a success.

Images The Vietnam War was the first modern war to which there was strong and widespread domestic opposition. Many analysts believe that opposition was due to the graphic images being brought home via television.

Images Today, the government and military of every nation are aware of how the phrases they use to describe activities can affect public perception. They do not say that innocent civilians were killed in a bombing raid. Rather, they state that there was “some collateral damage.” Governments do not speak of being the aggressor or starting a conflict. They speak of “preemptive action.” Dissenters in any nation are almost always painted as traitors or cowards.

Public perception is a very important part of any conflict. Each nation wants its own citizens to be totally in support of what it does and to maintain very high morale. High morale and strong support lead to volunteering for military service, public support for funding the conflict, and political success for the nation’s leader. At the same time, you want the enemy to have low morale—to doubt not only their ability to be successful in the conflict but also their moral position relative to the conflict. You want them to doubt their leadership and to be as opposed to the conflict as possible. The Internet provides a very inexpensive vehicle for swaying public opinion.

Web pages are just one facet of disseminating information. Having people post to various discussion groups can also be effective. One full-time propaganda agent could easily manage 25 or more distinct online personalities, each spending time in different bulletin boards and discussion groups, espousing the views that his political entity wants to espouse. These can reinforce what certain Internet news outlets are posting, or they could undermine those postings. They can also start rumors. Rumors can be very effective even when probably false. People often recall hearing something with only a vague recollection of where they heard it and whether it was supported by data.

Such an agent could have one personality that purports to be a military member (it would take very little research to make this credible) and could post information “not seen in newscasts” that would cast the conflict in either a positive or a negative light. She could then have other online personas that entered the discussion who would agree with and support the original position. This would give the initial rumor more credibility. Some people suspect this is already occurring in Usenet newsgroups and Yahoo! discussion boards. Obviously, Usenet and Yahoo! are just two examples. The Internet is replete with various blogs, community sites, boards, and more.

Fyi: Cyber Information Warfare Now

Anyone familiar with Yahoo! news boards (this is just one example; there are certainly many more) has probably noticed an odd phenomenon. At certain times, there will be a flood of posts from anonymous users, all saying essentially the same things—even using the same grammar, punctuation, and phrasing—and all in support of some ideological perspective. These flurries often happen in times when influence of public opinion is important, such as when an election is nearing. Whether or not these postings are coordinated by a well-known or official organization is debatable. However, they are an example of information warfare. One person or group of people attempts to sway opinion by flooding one particular media (Internet groups) with various items advocating one view. If they are lucky, some individuals will copy the text and email it to friends who do not participate in the newsgroups, thus crossing over to another media and spreading opinions (in some cases entirely unfounded) far and wide.

Fyi: Disinformation—A Historical Perspective

While disinformation campaigns are certainly easier to conduct since the advent of mass communication, particularly the Internet, such activities did exist prior to the Internet, or even television. For example, in the weeks leading up the famous D-Day invasion of World War II, the Allied forces used a number of disinformation techniques:

Images They created documents and communiqués listing fictitious military units that would invade from an entirely different location than the real invasion was planned.

Images They used Allied double agents to spread similar disinformation to the Germans.

Images A few small groups simulated a large-scale invasion to distract the German army.

Disinformation

Another category of information warfare that is closely related to propaganda is disinformation. It is a given that a military opponent is attempting to gather information about troop movements, military strength, supplies, and so forth. A prudent move would be to set up systems that had incorrect information and were just secure enough to be credible but not secure enough to be unbreakable. An example would be to send an encrypted coded message such that, when the message is decrypted, seems to say one thing, but to those who can complete the code it has a different message. The actual message is “padded” with “noise.” That noise is a weakly encrypted false message, whereas the real message is more strongly encrypted. In this way, if the message is decrypted, there exists a high likelihood that the fake message will be decrypted and not the real one. General Gray, USMC, put it best when he said, “Communications without intelligence is noise; intelligence without communications is irrelevant.”⁸

8. https://www.powerquotations.com/quote/communications-without-intelligence-is-noise

The goal of any military or intelligence agency is to make certain our communications are clear and that the enemy can only receive noise.

Actual Cases of Cyber Terrorism

Several cases of cyber terrorism have already been mentioned in this chapter. In this section we will briefly look at additional cases. We will examine incidents that occurred between 1996 and 2022. It should be noted that there are voices in the computer security industry that think cyber terrorism or cyber war are simply not realistic scenarios. Marcus Ranum of Information Security magazine states as much in the April 2004 issue. He and others claim that there is no danger from cyber terrorism and that, in fact, “The whole notion of cyberwarfare is a scam.”⁹ That quotation is quite old, but it illustrates that this is not a new perspective. Unfortunately, actual case studies have shown that this view is simply wrong. However, computer warfare and cyber terrorism have already been used on a small scale. It seems quite plausible that, in a matter of time, it will be seen on a much larger scale.

9. https://taosecurity.blogspot.com/2008/11/response-to-marcus-ranum-hitb-cyberwar.xhtml

Even if you believe that the scenarios outlined in the earlier sections of this chapter are merely the product of an overactive imagination, you should consider that there have already been a few actual incidents of cyber terrorism, although much less severe than the theoretical scenarios. This section examines some of these cases to show you how such attacks have been carried out in the past.

Some of the incidents listed next were reported in testimony before the Special Oversight Panel on Terrorism, Committee on Armed Services, U.S. House of Representatives. Earlier in this chapter, we listed more recent attacks, but these older attacks are important to illustrate just how long this problem has been going on. Some of these cases are quite old, but we move from historical cases to current cases.

Images In 1996, a computer hacker allegedly associated with the white supremacist movement temporarily disabled a Massachusetts ISP and damaged part of the ISP’s record-keeping system. The ISP had attempted to stop the hacker from sending out worldwide racist messages under the ISP’s name. The hacker signed off with the threat, “You have yet to see true electronic terrorism. This is a promise.”

Images In 1998 ethnic Tamil guerrillas swamped Sri Lankan embassies with 800 emails a day over a 2-week period. The messages read, “We are the Internet Black Tigers and we’re doing this to disrupt your communications.” Intelligence authorities characterized it as the first known attack by terrorists against a country’s computer systems. This is obviously a very old case, but it illustrates how long this sort of thing has been occurring.

Images During the Kosovo conflict in 1999, NATO computers were blasted with email bombs and hit with DoS attacks by hacktivists (the name applied to individuals who work for their causes using cyber terrorism) protesting the NATO bombings. In addition, according to reports, businesses, public organizations, and academic institutes received highly politicized virus-laden emails from a range of Eastern European countries. Web defacements were also common. After the Chinese embassy was accidentally bombed in Belgrade, Chinese hacktivists posted messages such as, “We won’t stop attacking until the war stops!” on U.S. government websites.

Images In August 2010 the United States publicly warned that the Chinese military was targeting American companies as well as government agencies. The United States further warned that the Chinese government was utilizing civilian experts in these attacks. In this report a Chinese computer spying network named GhostNet was revealed.

Images The Shamoon virus was first discovered in 2012, and a variant circulated in 2017. Shamoon acts as spyware but deletes files after it has uploaded them to the attacker. The virus attacked Saudi Aramco workstations, and a group named Cutting Sword of Justice claimed responsibility for the attack. A number of security officials within Saudi Aramco have blamed Iran for this attack. And, like Stuxnet, this virus infected systems other than the intended target.

Images In 2013 the New York Times reported multiple cyber attacks, all targeting financial institutions within the United States. All appear to have been instigated from Iran.

Images In December 2015 a significant portion of the Ivano-Frankivsk region in Ukraine had no power for approximately 6 hours due to the BlackEnergy malware. The attacks have been attributed to a Russian cyber espionage group named Sandworm.

Images In 2017 the United States accused Russia of hacking into U.S. systems using the antivirus product Kaspersky. Then in the fall of 2017, Israel claimed that it had hacked Russian spy agencies, and found evidence that the Russians were indeed using Kaspersky as a vehicle for cyber espionage. This is a classic case of everyone seeming to be hacking into everyone else.

Images It has been alleged that in October 2018, the United States launched an operation named Synthetic Theology to identify Russian agents who were interfering in the Macedonian and Ukrainian elections. The entire operation is said to have been a cyber operation.

Images In November 2018 German security officials announced that a Russia-linked group had targeted the email accounts of several members of the German parliament, as well as the German military and several embassies.

Images In December 2018 the United States, in coordination with Australia, Canada, the UK, and New Zealand, accused China of conducting a 12-year campaign of cyber espionage targeting the intellectual property and trade secrets of companies across 12 countries. The announcement was tied to the indictment of two Chinese hackers associated with the campaign.

Images In January 2019 hackers associated with Russian intelligence services were found to have targeted the Center for Strategic and International Studies.

Images In February 2019 European aerospace company Airbus revealed that it had been targeted by Chinese hackers who stole the personal and IT identification information of some of its European employees.

Images Beginning in March 2019, it was reported that the United States began persistent cyber operations against Russia’s power grid.

In March 2021 it was reported that Russian hackers targeted Lithuanian government officials with spyware. The group, named APT29, is alleged to have carried out a variety of attacks related to cyber espionage.

The now infamous Colonial Pipeline attack of May 2021 is an important one in the history of cyber warfare and terrorism. This pipeline controls approximately 45% of the oil that services the East Coast of the United States. The attack forced the company to turn off the pipeline and eventually to pay the $5 million ransom. This would be characterized as cyber terrorism.

In the buildup to the 2022 Russian invasion of Ukraine, there were multiple cyber attacks on Ukraine. This is an example of cyber warfare being used to augment kinetic warfare.

The good news is that most of these attacks caused little damage and were clearly the work of amateurs. However, it may only be a matter of time before more damaging attacks are perpetrated by far more skilled cyber terrorists. Yet it is clear that cyber terrorism, at least on a low-intensity scale, is already beginning. These warnings can be heeded and the issues taken seriously, or they can simply be ignored until disaster strikes. In addition, there are other items of concern, such as the recruiting of terrorists via the Internet, which we will look at later in this chapter. Here are some additional actual cases of spying.

Images In June 2000, Russian authorities arrested a man they accused of being a CIA-backed hacker. As shown in Figure 12.3, this man allegedly hacked into systems of the Russian Domestic Security Service (FSB) and gathered secrets that he then passed on to the CIA. This example illustrates the potential for a skilled hacker using knowledge to conduct espionage operations. This type of espionage is likely occurring much more often than is reported in the media, and many such incidents may never come to light.

Figure 12.3 BBC report on an arrested hacker.

Images Operation Ababil was a 2012 hacktivist-led effort that executed DoS attacks on the New York Stock Exchange and various banks. The hacktivist group Qassam Cyber Fighters claimed credit.

Images Perhaps most disconcerting was the 2015 breach of the U.S. Office of Personnel Management. It is estimated that over 21 million records were stolen, including detailed background checks of persons with security clearances.

It is also frightening to consider reports that our satellites, used for communication, weather, and military operations, could be vulnerable to hacking. Such vulnerabilities seem rather unlikely to be exploited simply because of the skill level required to execute such an attack. As previously mentioned, hacking/cracking is like any other human endeavor in that, based on the law of averages, most people are mediocre. The level of skill required to compromise security on a satellite system is far greater than that required to compromise the security of a website. Of course, that does not mean that such an attack is impossible, but simply that it is less likely.

Future Trends

By carefully analyzing what is occurring presently in cybercrime and cyber terrorism along with the recent history of that field, we can extrapolate and make reasonably accurate estimates about what trends will dominate in the near future. This section considers machine learning/artificial intelligence and then both positive and negative trends.

Machine Learning/Artificial Intelligence

With the growth of machine learning (ML) and artificial intelligence (AI), it should come as no surprise that ML/AI will also impact cyber warfare. Machine learning is already having an effect on hacking. And cyber warfare is simply the coordinated use of hacking attacks by a nation-state or an international threat actor to achieve political goals. As one example of machine learning improving hacking attacks, an article published in August 2021 demonstrated that AI wrote better, more believable phishing emails than did humans.¹⁰

10. https://www.wired.com/story/ai-phishing-emails/

A 2019 article published in ZDNet, “Adversarial AI: Cybersecurity Battles Are Coming,” outlines the coming use of AI and ML in offensive operations, with the possibility of attacks completely executed by AI.¹¹

11. https://www.zdnet.com/article/adversarial-ai-cybersecurity-battles-are-coming

Given that malware is the weapon of choice in cyber warfare and that cyber warfare is a part of nation-state national security policy, a natural next step is the application of machine learning to offensive cyber capabilities. One significant focus is on the use of machine learning in the development and deployment of weaponized malware.

Implementing machine learning directly in malware would cause the malware to consume substantial resources on the target and be more likely to be discovered. Machine learning algorithms could be offloaded to a command and control server. The various instances of a given type of malware would communicate data to the command and control center. That data would be subjected to machine learning in order to improve the efficacy of the currently deployed malware. This would function in much the same way as botnet communications with the command and control center.

In addition, machine learning algorithms could be used in the development and testing of weaponized malware. This would make the malware more efficient and more effective. Machine learning could also be used to enhance vulnerability discovery to improve the efficacy of attacks.

Positive Trends

It does seem that various governments are beginning to take notice of the problem of cyber terrorism and are taking some steps to ameliorate the dangers. For example, then Senator John Edwards (D-NC) proposed two bills in 2002 aimed at allocating $400 million for cybersecurity efforts. The first measure, called the Cyberterrorism Preparedness Act of 2002, a portion of which is shown in Figure 12.4, allocated $350 million over 5 years for improving network security, first for federal systems and then for the private sector. It also created a group assigned to gather and distribute information about the best security practices. The Cybersecurity Research and Education Act of 2002, a portion of which is shown in Figure 12.5, provided $50 million over 4 years for fellowships that were used to train IT specialists in cybersecurity. It also called for the creation of a web-based university where administrators could get updated training. The Cybersecurity Research and Education Act was passed and became Public Law 107-305. The Cyberterrorism Preparedness Act of 2002 was not passed. However, many of its goals were addressed by the PATRIOT Act.

Figure 12.4 The Cyberterrorism Preparedness Act of 2002.

Figure 12.5 The Cybersecurity Research and Education Act of 2002.

Title VIII of the U.S. PATRIOT Act specifically deals with cyber terrorism. The number of cyber attacks included in its definition of cyber terrorism is expansive, including attempts to damage or alter medical records and releasing a virus in a target system. Penalties are also clearly set out.

In 2010 the U.S. Department of Defense established the U.S. Cyber Command (USCYBERCOM). This unit, based in Ft. Meade, Maryland, is a joint task force representing components of all portions of the U.S. Armed Forces.

In 2011 the Dutch Ministry of Defense formulated and published a cyber strategy that included a joint cyber defense military unit. It also established an offensive and defensive cyber force named Defence Cyber Command (DCC).

In 2013 Germany revealed that it had a Computer Network Operations unit. Some public reports suggested that the unit was rather small, with about 60 members, but the nature of the unit makes it difficult to get accurate numbers. It was reported that the German intelligence agency (Federal Intelligence Service in English, Bundesnachrichtendienst in German, commonly known as simply BND) began in 2013 to hire a number of hackers.

More and more nations are treating cyber defense like any other area of defense and establishing the appropriate military and intelligence organizations to deal with it.

In the second edition of this book, I stated, “It is unreasonable to ask every police department to have a computer-crime specialist on staff. However, state-level investigative agencies should be able to hire such personnel.” I am thrilled to report that many positive trends in this area have exceeded my expectations. First, many law enforcement agencies, even small local agencies, do indeed now have cyber forensic detectives. There are also a number of cybercrime task forces that bring together state, local, and federal resources. For example, the U.S. Secret Service had established Electronic Crimes Task Forces around the country that bring together state, local, and federal resources to combat cybercrime and terrorism. The Department of Homeland Security has set up regional Fusion Centers to assist in coordinating the sharing of information between intelligence agencies and law enforcement agencies, at all levels.

Negative Trends

Unfortunately, as legislative bodies become aware of the problem of cyber terrorism and focus resources on the issue, the threats continue to grow. A paper commissioned by the Rand Corporation noted that even groups such as Al-Qaeda—which have not used cyber terrorism as one of their attack modalities as of this writing—have used Internet and computer technology resources to plan their various activities and coordinate training.

As early as 2000, the U.S. General Accounting Office warned of several possible cyber terrorism scenarios. As shown in Figure 12.6, these concerns focused on lethal attackers and possible attack scenarios in which the computer-controlled machinery in a chemical plant was altered in order to cause a release of toxic chemicals into the environment. This could be done in a variety of ways, including simply causing the machinery to drastically overproduce, overheat, or perhaps prematurely shut down equipment. The panel also contemplated scenarios in which water and power supplies were interrupted or compromised via computer systems. In essence, the focus was on the potential for massive casualties as a direct result of a cyber-based attack rather than the economic damage on which this chapter’s scenarios tend to focus.

Figure 12.6 Rand report on cyber terrorism.

Defense Against Cyber Terrorism

As the world becomes more dependent on computer systems, the danger of cyber terrorism will grow. Clearly, there must be a much stronger emphasis on computer security. In addition to the basic security measures already recommended in this book, these are some recommendations for preparing for and protecting systems against cyber terrorism:

Images Major academic institutions must begin dedicated research and academic programs that are devoted solely to computer security. Fortunately, since earlier editions of this book, that has changed. We now have a wide spectrum of cybersecurity related degrees.

Images Computer crime must be treated far more seriously, with stronger punishments and more active investigation of suspected crimes. This has also improved since the earlier editions of this book.

Images Rather than train law enforcement officers in basic computer crime, I have always recommended that it is more appropriate to train highly skilled computer professionals in law enforcement. To adequately combat cyber terrorism, one absolutely must first and foremost be a highly qualified computer expert.

Images An emergency reporting system may need to be implemented so that security professionals from various industries have a single source where they can report attacks on their systems and can view the issues with which other security professionals are dealing. This could enable security professionals as a group to more quickly recognize when a coordinated attack is occurring. There are currently many diverse reporting and communications platforms.

In addition, you can make some additions to and variations on your existing security measures. For example, you should have a recovery process in place so that data can be quickly recovered should someone delete important files. You should also, as recommended in Chapter 9, assess what data is of most value and focus your attention on that data. But, as this chapter points out, you must consider how data that might at first appear to be of little value may actually reveal more information about you personally or your company than is prudent.

Terrorist Recruiting and Communication

The Internet is an incredible communication tool, and it serves as a communications and recruiting tool for terrorist groups. Terrorists use Internet chat rooms for communication and planning. It is easy to set up a private chat room or bulletin board. Members of a terrorist group can then use public terminals to log in to that chat room or bulletin board and discuss plans. The terror network in the Netherlands that was responsible for the killing of filmmaker Theo van Gogh met regularly on Yahoo! to devise and discuss its plans. This is just one example of a terrorist group using the Internet to plan attacks.

The Internet’s ubiquitous nature enables terrorists who are geographically separated to communicate and coordinate. Websites allow terrorist groups to spread propaganda, raise funds, and recruit new members. And, as discussed, the Internet will even enable extremist groups to inspire lone individuals to act on their own but in the interests of the group.

It is also a fact that various terrorist groups have been using social media for recruiting purposes. Social media can be used to locate and entice those likely to be sympathetic to a terrorist organization. Then a grooming process can occur (not unlike that used by pedophiles). If needed, the terrorist group can even provide the new terrorist with training on topics like bomb making via the Internet. The advantage to the terrorist organization is that if the fledgling terrorist is caught, he has no knowledge of the terrorist organization. He has never even met any of the members, so he cannot give any information.

TOR and the Dark Web

TOR was mentioned in Chapter 6, “Techniques Used by Hackers,” and is discussed again here due to its connection to the topics of this chapter. TOR, or The Onion Router, may not seem like a military application of cryptography; however, it is appropriate to cover this topic in this chapter for two reasons:

Images The TOR project is based on an earlier Onion Routing protocol developed by the U.S. Navy specifically for military applications. So TOR is an example of military technology being adapted to civilian purposes.

Images TOR is used by privacy advocates every day. But it is also used by terrorist groups and organized criminals.

TOR consists of thousands of volunteer relays spread around the world. Each relay uses encryption to conceal the origin and even final destination of the traffic passing through it. Each relay is only able to decrypt one layer of the encryption, revealing the next stop in the path. Only the final relay is aware of the destination, and only the first relay is aware of the origin. This makes tracing network traffic practically impossible.

The basic concepts of onion routing were developed at the U.S. Naval Research Laboratory in the mid-1990s and later refined by the Defense Advanced Research Projects Agency (DARPA). The goal was to provide secure intelligence communication online.

Onion routers communicate using TLS (covered in depth in Chapter 13, “Cyber Detective”) and ephemeral keys. Ephemeral keys are so called because they are created for one specific use and then destroyed immediately after that use. Onion routers often use 128-bit AES as the symmetric key.

While the TOR network is a very effective tool for maintaining privacy, it has also become a tool for hiding criminal activity. Markets on the TOR network are used expressly to sell and distribute illegal products and services. Stolen credit card numbers and other financial data are common products on TOR markets. The images in Figures 12.7 and 12.8 give you some insight into what is on the Dark Web. These are actual screenshots. It must be noted that neither I nor the publisher endorses these sites. In fact, I work with law enforcement regularly and am opposed to what is done on these websites. However, if you are going to learn cybersecurity, you should know what is out there.

Figure 12.7 Drugs on the Dark Web.

Figure 12.8 Accounts for sale.

Are some sites on the Dark Web fake? Of course. Some are simply scamming people out of their money and not delivering the nefarious service or money. But many are real—particularly those selling stolen credit cards, drugs, and child pornography.

In 2015 the founder of Silk Road, Ross Ulbricht, the most well-known of the TOR markets, was sentenced to life in prison. Many people on various news outlets have claimed that this sentence is draconian. And one can certainly argue the merits of any sentence. But allow me to give you food for thought. Silk Road was not simply a venue for privacy or even for marijuana exchanges. It became a hub for massive drug dealing, including heroin, cocaine, and meth. It was also used to traffic in arms, stolen credit cards, child pornography, and even murder for hire. The venue Mr. Ulbricht created was a hub for thousands of very serious felonies.

Summary

It is clear that there are a variety of ways in which cyber terrorist attacks could be used against any industrialized nation. Many experts, including various government panels, senators, and terrorism experts, believe that cyber terrorism is a very real threat. It is more important than ever before to be extremely vigilant in securing your computer systems. You must also look beyond the obvious uses of data and consider how someone with an intent to harm or cause economic hardship could use seemingly unimportant information. In the exercises at the end of this chapter, you will have a chance to explore various cyber terrorism and information warfare threats.

Test Your Skills

Multiple Choice Questions

1. What is the most likely damage from an act of cyber terrorism?

A. Loss of life

B. Compromised military strategy

C. Economic loss

D. Disrupted communications

2. Which of the following is not an example of financial loss due to cyber terrorism?

A. Lost data

B. Transfer of money from accounts

C. Damage to facilities including computers

D. Computer fraud

3. Which of the following military/government systems would most likely be the target of a successful computer hack?

A. The most sensitive systems of the CIA

B. Nuclear systems at NORAD

C. Low-security logistical systems

D. Military satellite control systems

4. Which of the following might be an example of domestic cyber terrorism?

A. Sasser virus

B. Mimail virus

C. Sobig virus

D. MyDoom virus

5. What differentiates cyber terrorism from other computer crimes?

A. It is organized.

B. It is politically or ideologically motivated.

C. It is conducted by experts.

D. It is often more successful.

6. Which of the following is a political group that has already used the Internet for political intimidation?

A. Internet Black Tigers

B. Al-Qaeda

C. Mafia

D. IRA

7. What is information warfare?

A. Spreading disinformation

B. Spreading disinformation or gathering information

C. Gathering information

D. Spreading disinformation or secure communications

8. Which of the following would most likely be considered an example of information warfare?

A. Radio Free Europe during the Cold War

B. Radio political talk show

C. Normal news reports

D. Military press releases

9. Which of the following is a likely use of Internet newsgroups in information warfare?

A. To spread propaganda

B. To monitor dissident groups

C. To send encoded messages

D. To recruit supporters

10. Sending a false message with weak encryption, intending it to be intercepted and deciphered, is an example of what?

A. Poor communications

B. Need for better encryption

C. Disinformation

D. Propaganda

11. Which of the following best describes the communication goal of any intelligence agency?

A. To send clear communications to allies and noise to all other parties

B. To send clear communications to allies and noise only to the enemy

C. To send disinformation to the enemy

D. To send clear communications to allied forces

12. Which of the following conflicts had a cyber warfare component?

A. 1989 invasion of Panama

B. 1990 Kosovo crisis

C. 1990 Somalia crisis

D. Vietnam War

13. Which of the following agencies has allegedly had one of its cyber spies actually caught?

A. NSA

B. KGB

C. FBI

D. CIA

14. Which of the following is a cyber attack that would likely cause loss of life?

A. Disruption of banking system

B. Disruption of water supply systems

C. Disruption of security systems

D. Disruption of chemical plant control systems

Exercises

EXERCISE 12.1: Finding Information Warfare

Pick a current political topic.

Track that topic on multiple bulletin boards, Yahoo! newsgroups, or blogs.

Look for signs that might indicate an organized effort to sway opinion or information warfare. This might include posts allegedly made by separate individuals that have highly similar points, grammar, and syntax.

Write a brief essay discussing what you found and why you think it constitutes information warfare.

EXERCISE 12.2: Cyber Terrorism Threat Assessment

Pick some activist group (political or ideological) that you find intriguing.

Using only the Web, gather as much information about that organization as you can.

Write a brief dossier on that group, including what you think is the likelihood that such a group would engage in information warfare or cyber terrorism and why.

EXERCISE 12.3: Finding Information Policies

Using the Web or other resources, locate several examples of organizational policies regarding information dissemination.

Find points common to all such policies.

Write a brief essay explaining why these policies might be related to either propagating or preventing information warfare.

EXERCISE 12.4: How Companies Defend Against Cyber Terrorism

Interview the IT staff of a company to find out whether they take information warfare or cyber terrorism directly into account when they are securing their systems.

Find out what steps they take to protect their company’s systems from these threats.

Write a brief essay explaining what you have found out.

EXERCISE 12.5: Pulling It All Together

Pulling together what you have learned from previous chapters, what information can you apply to the protection of a system against cyber terrorism or information warfare? Write a brief outline of the steps you would take to secure a system against these threats.

Projects

PROJECT 12.1: Computer Security and Cyber Terrorism

Consider the various security measures you have examined thus far in this book. Given the threat of cyber terrorism, write an essay discussing how those methods might relate to cyber terrorism. Also discuss whether or not the threat of computer-based terrorism warrants a higher security standard than you might have otherwise used and explain why or why not.

PROJECT 12.2: The Law and Cyber Terrorism

Note: This is meant as a group project.

Using the Web or other resources, find and examine laws that you feel relate to cyber terrorism. Then write an essay describing legislation you believe needs to be written regarding cyber terrorism. Essentially, your group should act as if it were technical advisors to a congressional committee drafting new legislation.

PROJECT 12.3: Cyber Terrorism Scenario

Considering any of the theoretical cyber terrorism scenarios presented in this chapter, write a security and response plan that you feel addresses that scenario and protects against that specific threat.

Case Study

Jane Doe is the network administrator responsible for security for a small defense contractor. Her company handles some low-level classified material. She has implemented a strong security approach that includes the following:

Images A firewall has all unneeded ports closed.

Images Virus scanners are placed on all machines.

Images Routers between network segments are secured.

Images All machines have the operating systems patched monthly.

Images Passwords are long and complex, and they are required to be changed every 90 days.

What other recommendations would you make to Jane Doe? Explain the reasons for each of your recommendations.

Chapter 13

Cyber Detective

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Find contact information on the Web

Images Locate court records on the Web

Images Locate criminal records on the Web

Images Use Usenet newsgroups to gather information

Images Understand sources on the Internet

Introduction

In the preceding chapters we have examined many facets of computer security. Three of those issues led us to the content of this chapter: identity theft, hacking, and investigating potential employees for sensitive positions.

In order for a criminal to perpetrate identity theft, she has to take a small amount of information she finds on her target and use that to garner even more information. Perhaps a discarded credit card receipt or utility bill becomes the starting point from which the perpetrator finds enough information to assume the victim’s identity. This chapter will show you some techniques that use the Internet to find additional information about a person. You need to be aware of how this is done in order to be better prepared to defend against it and so that you are aware of what information about you personally is available. There is even a term for searching trash for valuable information: Dumpster diving.

Hackers—at least skilled hackers—want information about a target person, organization, and system to assist in compromising security. Whether the perpetrator is attempting to use social engineering or simply trying to guess a password, having information about the target will facilitate the task. Once you see how easy it is to gain personal information about someone, you will understand why security experts are so adamant that you must not use passwords that are in any way associated with you, your profession, your hobbies, or anything that might be traced back to you.

Finally, when you are hiring employees who might have access to sensitive data, simply calling the references they provide is not an adequate method of checking into their background. And hiring a private investigator may be impractical. The information in this chapter might be of use to you in conducting some level of investigation on your own.

This may surprise some readers, but network administrators should be investigated before hiring. Most companies perform the same cursory check of network administrators as they do of any other person. That usually consists of verifying degrees/certifications and calling references. With some companies it might include a credit check and a local criminal check. However, a network administrator should be more thoroughly investigated. The reason is quite simple: Regardless of how tight your security is, it cannot keep out the person who sets it up and maintains it. If you are considering hiring a network administrator for your company, knowing that he has been affiliated with hacking groups might be of interest to you. Or simply knowing that he has had lapses in judgment might indicate a stronger possibility that he will have similar lapses in the future. This may seem a bit paranoid, but by this point in this book, you should have developed a little healthy paranoia.

The Internet can be a valuable investigation tool. It can be used to find out about potential employees, babysitters, and more. Much of the information on the Internet is also free. Many states have court records online, and there are many other resources you can use to find information. In this chapter, we will examine some of the various resources you can use on the Internet to locate critical information.

Before beginning this discussion, a few points need to be made clear, the first being that this information is a double-edged sword. Yes, you can use it to find out if a potential business partner has previously been sued or declared bankruptcy or if your child’s little league coach has a criminal record. However, as we briefly mentioned, a less scrupulous person can also use these techniques to gather detailed information about you, either for the purpose of identity theft or perhaps stalking. Some people have suggested to me that perhaps I should not put this information (and some other items that appear in various chapters) in this book. However, my opinion is that the hackers, crackers, and perpetrators of identity theft already know about these resources. My hope is to level the playing field. I would also warn all readers that invading other people’s privacy is fraught with ethical, moral, and, in many cases, legal ramifications. It would be advisable to obtain written permission before running a background check on any person—or, better yet, play it safe and only perform searches on your own name. It must also be stressed that I am neither an attorney nor a law enforcement officer. I am simply providing you with techniques and resources. If you have questions about legality, you should refer those questions to an attorney.

General Searches

Sometimes you simply want to find an address, phone number, or email address for a person. Or perhaps that is the starting point for a more thorough investigation. There are a number of absolutely free services on the Web that will allow you to perform this sort of search. Some are better than others, and obviously the more common the name you are searching for the harder it will be to find the right one. If you do a search for John Smith in California, you might have a tough time dealing with all the results you get. No matter what search mechanism you utilize (LinkedIn, Facebook, and so on), the problem is the same.

A fairly easy-to-use service is Yahoo! People Search. When you go to www.yahoo.com, you see a number of options on the page. One option is the People Search shown in Figure 13.1. Or you can simply go directly to http://itools.com/tool/yahoo-people-search.

Figure 13.1 Yahoo! People Search.

When you select this option, you will see a screen similar to the one shown in Figure 13.2. In the first screen you enter a name, and in the second you see the results.

Figure 13.2 Search options.

To illustrate how this works, I did a search on my own name, in Texas (where I live). The data shown in Figure 13.2 is not accurate. Various entries have my age as 64 or 63 (not there yet) and 38 (I have not been 38 for a very long time). The closest is the listing that claims I live in Richardson, Texas. I don’t, but I don’t live far from there. So while information is available on the Internet, the more you know before beginning your search, the better you will be able to weed out incorrect results.

Many additional sites allow you to investigate and discover a person’s home address or telephone number. Several other good sites you should consider are listed here:

Images The Real Yellow Pages: www.yellowpages.com

Images US Search: https://www.ussearch.com/

Images Facebook: www.facebook.com

Images Whitepages: www.whitepages.com

Images LinkedIn: www.LinkedIn.com

Images Spokeo: http://www.spokeo.com

Images People Search Now: http://www.peoplesearchnow.com

Images Zabasearch: http://www.zabasearch.com

Images Peoplefinders: http://www.peoplefinders.com

Images Justia email finder: http://virtualchase.justia.com/content/finding-email-addresses

It is important to remember that the more information you can provide, and the more you narrow down your search, the greater the likelihood of finding what you are looking for. All of these websites can assist you in finding phone numbers and addresses, both current and past. For a background check on an employee, this can be useful in verifying previous addresses.

There are also sites for searching images and for doing reverse searches on images. Some of those sites are as follows:

Images Reverse Image Search: https://www.reverse-image-search.com

Images Google Images: https://www.google.com/imghp?hl=en

Images The Wolfram Language Image Identification Project: https://www.imageidentify.com

With all of these sites, you can upload any image, and the site will attempt to identify that image.

Fyi: Respecting Privacy

You might wonder why I would be willing to put my home address and phone number in a published book. To begin with, the phone number and address displayed are not accurate. They are old and no longer valid. And, in order to illustrate the process, I needed a name to use. For the liability reasons mentioned earlier, I could not have used someone else’s name. Anyone who wishes to find my current information would not have much trouble doing so. I have an uncommon last name and am a semi-public figure. However, should readers wish to contact me, they are strongly encouraged to do so via my website (www.chuckeasttom.com) and email address (chuck@chuck-easttom.com) rather than via phone. I try to answer all my email but frequently avoid my phone. And I am certainly not encouraging anyone to make a surprise visit to my home!

Email Searches

The website https://virtualchase.justia.com/content/finding-email-addresses/ links to multiple email search sites. Some of the sites linked to also get you addresses and phone numbers. One of the sites you can get to is http://www.freeality.com/finde.htm, which helps you do a lot of additional searches, as shown in Figure 13.3.

Figure 13.3 Freeality.com.

Company Searches

There are many sites that allow you to gather information on a company of interest. The SEC provides information on publicly traded companies at https://www.sec.gov/edgar/searchedgar/companysearch.xhtml, as shown in Figure 13.4.

Figure 13.4 SEC search.

The website https://opencorporates.com provides information on many companies. Company information is, to a large extent, public information. So you should not be surprised that there are numerous websites that assist you by simply aggregating this information.

The Dun & Bradstreet corporate directory, https://www.dnb.com/business-directory.xhtml, has been available online for many years. This is a very reputable source for information regarding companies.

Here are some other sites you can use to gather financial information about an organization:

Images MarketWatch: http://www.marketwatch.com

Images Experian: http://www.experian.com

Images Euromonitor: http://www.euromonitor.com

Court Records and Criminal Checks

A number of states put a variety of court records online—everything from general court documents to specific records of criminal history and lists of sex offenders. This sort of information can be critical before you hire an employee, use a babysitter, or send your child to little league. In the following sections, we discuss a variety of resources for this sort of information.

Sex Offender Registries

You should become familiar with the online sex offender registries. The FBI maintains a rather exhaustive list of individual state registries. You can access this information at https://www.fbi.gov/scams-safety/registry. Every state that has an online registry is listed on this website, as shown in Figure 13.5.

Figure 13.5 FBI state registry of sex offenders.

Obviously, some states have done a better job of making accurate information public than have others. For example, Texas has a rather comprehensive site. You can find it at https://www.dps.texas.gov/section/crime-records-service/texas-sex-offender-registration-program. This site allows you to look up an individual person. You can also use the site https://publicsite.dps.texas.gov/SexOffenderRegistry/map/load?mapReqId=1&channel=p-SexOffenderJs&address=Goldthwaite%2C+TX%2C+USA to put in an address and find out any registered sex offenders in that area. Figure 13.6 shows the search screen for the Texas site mentioned.

Figure 13.6 Texas sex offender search page.

One of the most compelling things about the Texas sex offender registry is that it lists the offense for which the person was convicted and provides a photo of the offender. This is important because the term sex offender covers a wide variety of crimes. Some of these may not, for example, impact whether you should hire this person. It is important to know what a person was convicted of before you decide he is unsuitable to be interacting with your children or working in your organization.

It should also be noted that there is an app for the iPhone/iPad called Offender Locator that uses your GPS location to list registered sex offenders nearby.

Some sex offenders have committed heinous crimes, and many parents will want to know this information about potential babysitters and coaches. This information may also be applicable to employment screenings. However, any time any information is used for employment screening, it is advisable to check the laws in your area. You may not legally be able to base employment decisions on certain information. As with all legal questions, your best course of action is to consult a reputable attorney.

Caution

Mistaken Identity

There have been cases of mistaken identity with sex offender lists. Any time you find negative information on a person you are investigating—whatever the source—you have an ethical responsibility to verify that information before you take any action on it.

Civil Court Records

There are a variety of crimes, as well as civil issues, a person might be involved in that would make her unsuitable for a particular job. If you are hiring a person to work in your human resources department and oversee equal opportunity issues, knowing if she had been involved in domestic violence, racially motivated graffiti, or other similar issues might affect your employment decision. Or, if you are considering a business partnership, it would be prudent to discover if your prospective partner has ever been sued by other business partners or has ever filed for bankruptcy. Unfortunately, in any of these cases, you cannot simply rely on the other party’s honesty. You need to check out these things for yourself.

Unfortunately, this area of legal issues has not been transferred to a web format as well as sex crimes. Some records are available online, but not all. However, many states and federal courts do offer online records. One of the best organized and most complete on this issue is the state of Oklahoma. You can find Oklahoma’s website at www.oscn.net/applications/oscn/casesearch.asp, and its home search page is shown in Figure 13.7.

Figure 13.7 Oklahoma online court records.

This site allows you to search by last name, last and first name, case number, and more. You will get a complete record of any case you find, including current disposition and any filings. This includes both civil and criminal proceedings. Oddly enough, there are at least five different websites offering information on Oklahoma court cases for a fee—when all of that information is online and free. This illustrates a key point to keep in mind. There are a number of sites/companies that offer to do searches for you, for fees ranging from $9.95 to $79.95. It is true that they can probably do it faster than you. But it is also true that you can find the same information these people do, for free. And hopefully this chapter will equip you with the information you need to do that successfully.

Other Resources

There are many other websites that can be quite helpful for your searches. There are a few that deserve particular attention. The National Center for State Courts has a website at http://www.ncsc.org that lists links to state courts all over the United States. It also lists several international courts in countries like Australia, Brazil, Canada, and the United Kingdom. This website is an excellent starting point if you are seeking court records. In addition, there is a government access site that helps you find all federal courts. That website is www.uscourts.gov/court_locator.aspx.

The following list is designed to give you a starting point for online searches across the United States. These websites should help you start your search for court records:

Images Pacer: www.pacer.psc.uscourts.gov

Images Prison searches: https://www.bop.gov/mobile/find_inmate/byname.jsp

Images Public records: http://publicrecords.searchsystems.net

Images The Bureau of Federal Prisons: www.bop.gov

As you search the Internet, you will find other sites that appeal to you. This may be due to their ease of use, content, or other factors. When you find such sites, bookmark them. In a short time, you will have an arsenal of online search engines. Also, your proficiency with using them will increase, and you will learn which ones to use for various kinds of information. This will allow you to become adept at quickly finding information that you need online.

Usenet

Many readers who are new to the Internet (in the past 10 to 15 years) may not be familiar with Usenet. Usenet is a global group of bulletin boards that exist on any subject you can imagine. Specific software packages are used to view these newsgroups, but for some time now they have been accessible via web portals. Google has an option on its main page called Groups. When you click on that option, you are taken to Google’s portal to Usenet newsgroups, as shown in Figure 13.8.

Figure 13.8 Google access to Usenet groups.

Caution

Usenet Information

Anyone can post anything on Usenet. There are no restrictions. If you find a negative comment about a person on Usenet, it is not wise to automatically assume that the comment is true. These postings can only be viewed as part of an investigation and are only credible if other facets of the investigation also support the postings you find.

As you can see, newsgroups are divided into broad categories. For example, newsgroups devoted to science topics would be found under the heading sci. This includes groups like sci.anthropology, sci.logic, sci.math.stat, and more. The heading alt is a catchall for anything and everything. This category includes things ranging from alt.hacking to alt.adoption.

You may be thinking that, while all this is fascinating, it does not have anything to do with tracking down information. But actually it does. If, for example, you were hiring a network administrator, you could see if she had posted in various network administration groups and if those postings revealed key information about her network. This tool may be the single most important investigative tool you have if you are willing to take the time to ferret out the information you need.

Google

Undoubtedly you have used Google to search for terms; however, you might not be aware of the diversity of search capabilities in Google. With advanced operators, Google can become an even more powerful search tool. Table 13.1 describes some common Google search parameters.

Table 13.1 Common Google Search Parameters

Operator

Description

filetype

Directs Google to search only within the text of a particular type of file. Example: filetype:xls

inurl

Directs Google to search only within the specified URL of a document. Example: inurl:search-text

link

Directs Google to search within hyperlinks for a specific term. Example: link:www.domain.com

intitle

Directs Google to search for a term within the title of a document. Example intitle: "Index of.etc"

site

Directs Google to search only within a given site. Example site: https://whitehouse.gov

These are just a few. A longer list can be found at https://hackr.io/blog/google-dorks-cheat-sheet.

Maltego

Maltego is an open-source intelligence and forensics application that offers extraordinary data mining and intelligence gathering capabilities. There are several versions, and you can download them from https://www.maltego.com. The community version is free.

Results are well represented in a variety of easy-to-understand views. In concert with its graphing libraries, Maltego identifies key relationships between data sets and identifies previously unknown relationships between them. Figure 13.9 shows the main screen of Maltego.

Figure 13.9 Maltego.

Maltego is primarily used for working with entities and transforms. You select some entity (for example, email address, website, person, phone number) and select a transform for that entity. Once you have selected something to graph—be it a person, an email address, a website, or another item—the relationships between that entity and other entities are shown as a graph (see Figure 13.10).

Figure 13.10 Maltego graph.

Figure 13.11 shows how you start a new graph. Simply select Share Graph to create a new graph based on the entities and transforms you select.

Figure 13.11 Starting a new Maltego graph.

Maltego is more complex than some of the other tools we have discussed in this chapter. However, there are tutorials on the Web to help you master this tool. See, for example, https://docs.maltego.com/support/home.

Summary

We have seen in this chapter that the Internet can be a valuable resource for any sort of investigation. It is often one of the tools that hackers and identity thieves use to gain information about their targets. However, it can also be a valuable tool for you in researching a prospective employee or business partner. In addition, it can be invaluable for routinely finding out what information is on the Internet about you. Seeing strange data that is not accurate can be an indication that you have already been the victim of identity theft.

Test Your Skills

Multiple Choice Questions

1. How might an identity thief use the Internet to exploit his victim?

A. He might find more information about the target and use that information to conduct his crime.

B. He could find out how much the target has in her savings account.

C. An identity thief usually does not use the Internet to accomplish his task.

D. He could use the Internet to intercept the target’s email and thus get access to the target’s personal life.

2. Which of the following is not an ideal place to seek out phone numbers and addresses?

A. Yahoo! People Find

B. People Search

C. The international phone registry

D. OSINT

3. Why do you not want too much personal data about you on the Internet?

A. It might reveal embarrassing facts about you.

B. It might be used by an identity thief to impersonate you.

C. It might be used by a potential employer to find out more about you.

D. There is no reason to worry about personal information on the Internet.

4. How could a hacker use information about you found through Internet searches?

A. It could be used to guess passwords if your passwords are linked to personal information such as your birth date, address, or phone number.

B. It could be used to guess passwords if your passwords are linked to your interests or hobbies.

C. It could be used in social engineering to ascertain more information about you or your computer system.

D. All of these answers are correct.

5. If you are hiring a new employee, which of the following should you do?

A. Verify degrees and certifications.

B. Call references.

C. Perform an Internet search to verify contact information and to check for a criminal record.

D. All of these answers are correct.

6. Which of the following would be least important to know about a potential business partner?

A. Past bankruptcies

B. A 15-year-old marijuana possession arrest

C. A lawsuit from a former business partner

D. A recent DUI

7. What information would provide the most accurate results for locating a person?

A. First name and state

B. First name, last name, and state

C. Last name and state

D. First name and last name

8. Of the websites listed in this chapter, which would be the most useful in obtaining the address and phone number of someone who does not live in the United States?

A. The FBI website

B. Yahoo!

C. Infobel

D. Google

9. Where would you go to find various state sex offender registries?

A. The FBI website

B. The national sex offender online database

C. The interstate online sex offender database

D. The special victims unit website

10. What is most important to learn about a person listed in a sex offender registry?

A. The extent of his punishment

B. How old she was when she committed her crime

C. How long he has been out of prison

D. The nature of her specific crime

11. Which web search approach is best when checking criminal backgrounds?

A. Check primarily the person’s state of residence.

B. Check primarily federal records.

C. Check the current and previous state of residence.

D. Check as many places as might have information.

12. What advantages are there to commercial web search services?

A. They can get information you cannot.

B. They can get the information faster than you can.

C. They can do a more thorough job than you can.

D. They are legally entitled to do searches; you are not.

13. Which would you use to begin a search for information on a United States court case?

A. The National Center for State Courts Website

B. Usenet

C. Yahoo! People Search

D. Google Groups

14. Which of the following is the most accurate description of Usenet?

A. A nationwide bulletin board

B. A repository of computer security information

C. A large-scale chat room

D. A global collection of bulletin boards

15. Which of the following is the most helpful data you might get from Usenet on a person you are investigating?

A. Postings by the individual you are investigating

B. Security tips to help you investigate

C. Criminal records posted

D. Negative comments made by others about your target

Exercises

For all exercises and projects in this chapter, you will concentrate your investigation on some person. It is best if you investigate yourself (which makes it easier to evaluate the accuracy of what you find) or someone in the class or the instructor who volunteers to be the target of the investigation. There are ethical issues with simply investigating random people without their knowledge or permission. It is also important to avoid embarrassing someone in the classroom. So the volunteer targets of the investigation should be certain they will not be embarrassed by whatever is found. Substitute the name of the person you are investigating for John Doe or Jane Doe in the projects and exercises.

EXERCISE 13.1: Finding Phone Numbers

Beginning with Yahoo! People Search, seek out phone numbers and addresses for John Doe.

Use at least two other sources to look up John’s phone number.

Did you get too little information or too much information? Were you able to determine the correct, current number?

EXERCISE 13.2: Criminal Records Checks

Using sources listed in this chapter or other websites, look for criminal background information about John Doe. Start with the state John currently resides in, and then check other states, particularly those that might have shown up with John’s name in Exercise 13.1.

Expand your search to check for federal crimes as well.

EXERCISE 13.3: Checking Court Cases

Search court records for any court cases for Jane Doe’s business.

Check state licensing agency websites, if applicable, for any history or complaints on Jane’s business.

EXERCISE 13.4: Finding Business Information on Usenet

Access Usenet.

Search bulletin boards and other groups that Jane Doe may have posted to in connection with her business.

Were you able to find out more about Jane’s business through her postings to a Usenet group?

EXERCISE 13.5: Blocking Information

This chapter illustrated the many ways you can access information about someone and pointed out the potential hazards of having too much personal information available on the Internet. So, what can you do to prevent unscrupulous individuals from finding out too much about you? Check the primary websites listed in this chapter (Yahoo! and Google) to see if they provide any means to block your information from being distributed. Are there any other means of blocking access to your personal information?

Projects

PROJECT 13.1: Investigating a Person

Using all of the web resources in this chapter and any others you come across, do a complete investigation of Jane Doe. Try to determine her address, phone number, occupation, age, and any criminal history. You might even check Usenet postings and find out clues as to Jane’s hobbies and personal interests. Create a brief report on Jane based on your findings.

Project 13.2: Investigating a Company

Using all of the web resources in this chapter and any others you come across, do a complete investigation of John Doe’s business. How long has he been in business? Are there any complaints about the business with any regulatory agency? Any complaints on Usenet boards? Any business relationships? Any past court proceedings? Write a report discussing your analysis of this business based on your findings.

Project 13.3: The Ethics of Investigation

Write an essay discussing the ethics of online investigations. Do you feel these investigations are an invasion of privacy? Why or why not? If you do feel they are an invasion of privacy, what do you think can be done about it? Are there problems with getting inaccurate information?

Case Study

Henry Rice, the owner and CEO of a small company, has been conducting a search for a new human resources administrator. After many rounds of interviews, he has narrowed down his search to two individuals whom he feels are the best candidates. They have very similar qualifications, and Henry’s decision may very well be based on the information he finds when he checks their references and performs a background check.

Henry has received written permission from each candidate to conduct a background check. Consider the following questions:

Where should Henry begin his search?

What sites or sorts of information would be most critical for him to check?

What type of information could weigh heavily for a person working in human resources?

Write a brief essay outlining the steps Henry should take in conducting his research.

Chapter 14

Introduction to Forensics

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand basic forensics principles

Images Make a forensic copy of a drive

Images Use basic forensics tools

Images Prepare a forensics report

Images Avoid common forensics mistakes

Introduction

In the preceding 13 chapters, you have been introduced to a variety of security topics: from concepts like the CIA triangle, to attacks such as session hijacking, to countermeasures like IDSs and honey pots. In this chapter, we are going to cover the basics of computer forensics. This is a very important topic for anyone involved in computer security or network administration. It is frequently the case that the first responder to a computer crime is the network administrator, not a law enforcement officer. And if you fail to handle the evidence properly, you may render it unusable in a court and ruin any chances of convicting the perpetrator.

Computer forensics is a comparatively new field. Widespread use of computers dates back to the 1970s and widespread computer crime to the 1990s. The field of computer forensics has evolved only in the past 20 to 30 years. The field of computer forensics, now often called cyber forensics, attempts to apply forensic science to computer devices.

CERT defines computer forensics in this manner:¹

1. https://www.cisa.gov/uscert/sites/default/files/publications/forensics.pdf

If you manage or administer information systems and networks, you should understand computer forensics. Forensics is the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts. (The word forensics means “to bring to the court.”) Forensics deals primarily with the recovery and analysis of latent evidence. Latent evidence can take many forms, from fingerprints left on a window to DNA evidence recovered from blood stains to the files on a hard drive.

The goal of cyber forensics is to examine computer devices (laptops, servers, cell phones, tablets, and so on) using scientific methods in order to extract evidence in such a way that evidence can be presented in court. Now, there are certainly times when you will use forensics in scenarios that will never go to court. But the techniques were designed to satisfy the evidentiary requirements of courts.

It is important to keep in mind that a few jurisdictions have passed laws requiring that in order to extract the evidence, the investigator must be either a law enforcement officer or a licensed private investigator. This is a controversial law, given that normally private investigator training and licensing does not include computer forensics training. You should check with specifics in your state. However, many of those states will allow you to forensically examine a computer if you have the permission of the owner or if someone who is licensed seized the evidence. So this would not prohibit you from forensically examining computers in your company. You should check the laws in your jurisdiction before proceeding with any forensic analysis.

The purpose of this chapter is to give you a general introduction to the field of forensics. Clearly, each topic discussed in this chapter could be investigated in more depth.

General Guidelines

There are some general guidelines you should always follow in any forensic examination. You want to have as little impact on the evidence as possible. That is, you want to examine it and not alter it. You want to have a clear document trail for everything that is done. And, of course, you want to secure your evidence.

Don’t Touch the Suspect Drive

The first, and perhaps most important, precaution is to touch the system as little as possible. You do not want to make changes to the system in the process of examining it. Let’s look at one possible way to make a forensically valid copy of a drive. Some of this depends on Linux commands, which you may or may not be familiar with. If you are not, I have had students with no Linux experience use these same commands and be able to accomplish the task of making a forensic copy of a drive. Later in this section I will show you how to image drives with other forensic tools, but first we will discuss how to do this without specialized tools.

You will need a bootable copy of Linux. Any Linux live CD will do. You will actually need two copies: one on the suspect machine and one on the target machine. Whichever version of Linux you use, the steps will be the same.

First, you have to completely wipe the target drive:

Click here to view code image

dd if=/dev/zero of=/dev/hdb1 bs=2048

Next, you need to set up the target forensics server to receive the copy of the suspected drive you wish to examine. The netcat command helps with this:

nc -l -p 8888 > evidence.dd

Here you are telling the machine to listen on port 8888 and put whatever it receives into evidence.dd.

On the suspect machine, you have to start sending the drive’s information to the forensics server:

Click here to view code image

dd if=/dev/hda1 | nc 192.168.0.2 8888 -w 3

Of course, this assumes that the suspect drive is hda1. If it is not, replace that part of the command with the partition you are using. This also assumes the server has IP address 192.168.0.2. If not, replace it with whatever your forensics server IP address is.

You will want to create a hash of the suspect drive so that later you can hash the drive you have been working with and compare that to the hash of the original drive and confirm that nothing has been altered. You can make a hash by using Linux shell commands:

Click here to view code image

md5sum /dev/hda1 | nc 192.168.0.2 8888 -w 3

When you are done, you have a copy of the drive. It is often a good idea to make two copies: one you will work with and another that will simply be stored. But in no case should you do your forensic analysis on the suspect drive.

Imaging a Drive with Forensic Toolkit

AccessData is the maker of the Forensic Toolkit and FTK Imager. The Forensic Toolkit is a commercial product that can be a bit expensive. FTK Imager is a free download that can be used to make images of drives and to mount images that have been made. You begin by launching FTK Imager, shown in Figure 14.1.

Figure 14.1 FTK Imager.

Next, you choose File and select Create Disk Image, as shown in Figure 14.2.

Figure 14.2 FTK Imager—Create Disk Image.

Next, you are prompted to select the type of drive you wish to image, as shown in Figure 14.3.

Figure 14.3 FTK Imager—Select Source.

Now, based on the source type you selected, you need to make another choice. For example, if you selected Logical Drive, you now need to pick which logical drive, as shown in Figure 14.4.

Figure 14.4 FTK Imager—Source Drive Selection.

Finally, select a destination for the image, as shown in Figure 14.5.

Figure 14.5 FTK Imager—Create Image.

The process for mounting an image is even easier. FTK Imager is well respected in the forensic community, easy to use, and free.

Another tool we will use in this chapter is OSForensics. The website for this tool is https://www.osforensics.com. Unlike many other forensics tools, this one has a free 30-day download, so you will be able to actually do the various activities. OSForensics also allows you to image a drive. You first select Forensic Imaging from the menu on the left, as shown in Figure 14.6.

Figure 14.6 OSForensics Imaging.

Can You Ever Conduct Forensics on a Live Machine?

We have emphasized, and rightfully so, that whenever possible you should always create an image of a drive and perform the analysis only on that image. For a long time this was considered the only way to conduct computer forensics. However, the past few years have yielded some variation on that thinking. There are times when live forensics is possible or even desirable:

Images When you find a machine running, you should conduct some analysis of running processes, memory, and so on before shutting it down.

Images It may be necessary on clouds and clusters.

Images When the machine has already been imaged, thus preserving evidence.

Images When there is not a true forensic investigation, but rather asking a single question.

Images Be careful shutting down; if the machine has drive encryption, then when you boot it back up you won’t be able to retrieve data.

It is still important to keep in mind that imaging is the preferred method. The preceding list is just a list of suggested times when it may be possible to work with the live system. When doing live forensics, your report must explain why you did it and exactly what steps you did, while making sure the steps you took had the least impact on the system possible.

Document Trail

Beyond not touching the actual drive, the next issue is documentation. If you have never worked in an investigative capacity, the level of documentation may seem onerous to you. But the rule is simple: Document everything.

When you first discover a computer crime, you must document exactly what events occurred. Who was present, and what were they doing? What devices were attached to the computer, and what connections did it have over the network/Internet? What hardware was being used, and what operating system?

Then when you begin your actual forensic investigation you must document every step. Start with documenting the process you use to make a forensic copy. Then document every tool you use, every test you perform. You must be able to show in your documentation everything that was done.

Secure the Evidence

First and foremost, the computer must be taken offline to prevent further tampering. Now, there are some limited circumstances wherein a machine would be left online to trace down an active, ongoing attack. But the general rule is to take it offline immediately.

The next step is to limit access to the machine. No one who does not absolutely need access to the evidence should have it. Hard drives should be locked in a safe or secure cabinet. Analysis should be done in a room with limited access.

Chain of Custody

You must be able to document who had access to evidence, how they interacted with it, and where the evidence was stored. There must be no period of time that you cannot account for the evidence. This is called chain of custody.

The concept of chain of custody is one of the cornerstones of forensic science, whether that is cyber forensics or some other forensic discipline. Chain of custody refers to detailed documentation showing the status of evidence at every point in time from the moment of seizure to the moment the evidence is presented in court. Any break in that chain of custody will likely render the evidence inadmissible at trial.

According to the Scientific Working Group on Digital Evidence Model Standard Operation Procedures for Computer Forensics:² “The chronological documentation of the movement, location and possession of evidence.” This means that any time evidence is transferred from one location to another or from one person to another, that transfer must be documented. The first transfer is the seizure of evidence when the evidence is transferred to the investigator. Between that point in time and any trial, there may be any number of transfers.

2. https://www.swgde.org/glossary

Remember that it is almost impossible to overdocument. Detail what you do, what tools you use, who is present, who conducts what tests, and so on. I find it helpful to take frequent screenshots during my forensic analysis and to include them in my report.

FBI Forensics Guidelines

Beyond the general guidelines we have just discussed, the FBI gives some specific guidelines. In most cases, they will overlap with what we have discussed, but it is still useful to cover the FBI recommendations.

If an incident occurs, the FBI recommends that the first responder preserve the state of the computer at the time of the incident by making a backup copy of any logs, damaged or altered files, and of course any files left by the intruder. This last part is critical. Hackers frequently use various tools and may leave traces of their presence. Furthermore, the FBI warns that if the incident is in progress, activate any auditing or recording software you might have available. Collect as much data about the incident as you can. In other words, this might be a case where you do not take the machine offline but rather analyze the attack in progress.

Another important step is to document the specific losses suffered due to the attack. Losses typically include the following:

Images Labor cost spent in response and recovery. (Multiply the number of participating staff by their hourly rates.)

Images The cost of the equipment if equipment was damaged.

Images The value of the data if any was lost or stolen. How much did it cost to obtain that data, and how much will it cost to reconstruct it?

Images Any lost revenue, including losses due to downtime, having to give customers credit due to inconvenience, or any other way in which revenue was lost.

Documenting the exact damages due to the attack is just as important as documenting the attack itself.

The FBI computer forensic guidelines stress the importance of securing evidence. The FBI also stresses that you should not limit your concept of computer evidence to PCs and laptops. Computer evidence can include the following:

Images Logs (system, router, chat room, IDS, firewall)

Images Portable storage devices (USB drives, external drives)

Images Emails

Images Devices capable of storing data, such as iPod, iPad, and tablets

Images Cell phones

The FBI guidelines also stress making a forensic copy of the suspect drive/partition to work with and creating a hash of that drive.

U.S. Secret Service Forensics Guidelines

The U.S. Secret Service is another federal agency tasked with combating cybercrime and with computer forensics. It has a website devoted to computer forensics that includes forensics courses. These courses are usually for law enforcement personnel.

The Secret Service also has released a guide for first responders to computer crime. It has listed its “golden rules” to begin the investigation:

Images Secure the scene and make it safe.

Images If you reasonably believe that the computer is involved in the crime you are investigating, take immediate steps to preserve the evidence.

Images Determine whether you have a legal basis to seize this computer (plain view, search warrant, consent, and so on).

Images Avoid accessing computer files. If the computer is off, leave it off.

Images If the computer is on, do not start searching through it. If the computer is on, go to the appropriate sections in this guide on how to properly shut down the computer and prepare it for transportation as evidence.

Images If you reasonably believe that the computer is destroying evidence, immediately shut down the computer by pulling the power cord from the back of the computer.

Images If a camera is available and the computer is on, take pictures of the computer screen. If the computer is off, take pictures of the computer, the location of the computer, and any electronic media attached.

Images Determine whether special legal considerations apply (doctor, attorney, clergy, psychiatrist, newspapers, publishers, and so on).

These are all important steps in both preserving the chain of custody and ensuring the integrity of the investigation.

EU Evidence Gathering

The Council of Europe Convention on Cybercrime, also called Budapest Convention on Cybercrime or simply Budapest Convention, refers to electronic evidence as evidence that can be collected in electronic form of a criminal offence.

The Electronic Evidence Guide is a basic guide for police officers, prosecutors, and judges.

The EU also has five principles that establish a basis for all dealings with electronic evidence:

Images Principle 1: Data integrity: You must ensure that the data is valid and has not been corrupted.

Images Principle 2: Audit trail: Similar to the concept of chain of custody, you must be able to fully account for the evidence. That includes its location as well as what was done with it.

Images Principle 3: Specialist support: As needed, utilize specialists. For example, if you are a skilled forensic examiner but have limited experience with a Macintosh computer, get a Mac specialist should you need to examine a Mac.

Images Principle 4: Appropriate training: All forensic examiners and analysts should be fully trained and always expanding their knowledge base.

Images Principle 5: Legality: Make certain all evidence is collected and handled in a manner consistent with all applicable laws.

Even if you don’t work within the European Union, these guidelines can be quite useful. Yes, they are rather broad, but they do provide guidance as to how to properly conduct a forensic examination.

Scientific Working Group on Digital Evidence

Scientific Working Group on Digital Evidence, or SWGDE (www.swgde.org), creates a number of standards for digital forensics. According to the SWGDE Model Standard Operation Procedures for Computer Forensics, there are four steps of examination:

Visual inspection: The purpose of this inspection is just to verify the type of evidence, its condition, and relevant information to conduct the examination. This is often done in the initial evidence seizure. For example, if a computer is being seized, you would want to document whether the machine is running, what its condition is, and what the general environment is like.

Forensic duplication: This is the process of duplicating the media before examination. It is always preferred to work with a forensic copy and not the original.

Media examination: This is the actual forensic testing of the application. By media, we mean hard drive, RAM, SIM card—some item that can contain digital data.

Evidence return: Exhibit(s) are returned to the appropriate location—usually some locked or secured facility.

These steps provide an overview of how a cyber forensic examination should proceed. SWGDE has a number of useful documents on its website that you should consult to delve deeper into the nuances of a proper cyber forensics examination.

Locard’s Principle of Transference

Dr. Edmond Locard was a forensic scientist who formulated what has become known as Locard’s exchange principle or Locard’s principle of transference. This principle was first applied to physical forensics, and it essentially states that you cannot interact in any environment without leaving something behind. For example, someone cannot break into a house and not leave something. That something could be a fingerprint, a hair, a footprint, and more. Now, a careful criminal will cover up some of this, such as by using gloves to keep from leaving fingerprints. But something will be left behind.

This applies to computer evidence as well and is one reason we prefer to work with a copy. In Windows, for example, any time you log in, open a file, or do anything at all, you have changed Registry settings, perhaps left temporary files, and left some other traces. For a forensic examination, this is critical. It also means the investigator has to be careful not to leave behind traces.

The Scientific Method

Forensics is a science. In addition to being familiar with tools, you need to understand the scientific method and how to apply it. To use the scientific method, you always begin with a hypothesis. Contrary to popular misconception, a hypothesis is not a guess. It is a question that is testable. If a question cannot be tested, then it has no place in science whatsoever. Once you have tested a hypothesis, you have a fact. For example, if you suspect that confidential documents were on my computer and subsequently moved to a USB device and deleted (your hypothesis), you can conduct a forensic examination of my computer (your test). If that examination finds that a USB drive was connected to the computer and an undelete program recovers the deleted documents, you now have a fact.

The next step is to build a theory of the crime, based on multiple facts. The fact that confidential documents were on my computer, while very interesting evidence, is not in and of itself enough. Is it possible someone else used my computer? Yes, it is. Is it possible that I accidently had confidential information (for example, mistakenly took home documents I should not have) and then immediately deleted it? Yes, it is. So you must find additional facts. For example, you would want to know if my username was the one logged in when the files were deleted. Once you recover the deleted files, you would want to know when they were last accessed and modified (which might tell you if I was using the files). You might also want to check my email to see if there is any communication with a third party that might have an interest in these documents.

In addition to hypotheses and theories, another principle in science is the issue of falsifiability. Falsifiability means that it is possible to falsify a question or to get a false answer. In other words, it is possible to get a negative answer. This rules out questions of opinion or questions that cannot be refuted.

Standards

A wide range of industry standards are relevant to digital forensics. Being at least generally familiar with them is critical for every forensic examiner:

Images SWGDE: Scientific Working Group on Digital Evidence

Images ASCLD: The American Society of Crime Laboratory Directors

Images RFC 3227: Order of evidence collection

Images ISO/IEC 27037:2012: Good practice methods and processes for forensic capture and investigation of digital evidence

Images ISO/IEC 27041: Guidance on the assurance aspects of digital forensics

Images ISO/IEC 27042: Covers what happens after digital evidence has been collected (that is, its analysis and interpretation)

Images ISO/IEC 27043: Covers the incident investigation activities within which forensics usually occurs

Images ISO/IEC 27050: Concerns electronic discovery

Forensics Reports

Your forensics report should be sufficiently detailed that any competent forensic examiner can replicate your tests and either confirm or refute your work.

This means, among other things, that you need a great many screenshots. You should take screenshots and bookmark evidence via your forensic application of choice (EnCase, FTK, OSForensics, Autopsy, X-Ways Forensics, and so on). Also, use the built-in logging/reporting options within your forensic tool and highlight and export data items into .csv or .txt files, which may become appendixes or exhibits attached to your report.

In their introductory computer forensics course, the Infosec Institute requires that students create a report that includes “a general overview of the methodology that you will use, and provide a reasoned argument as to why the particular methodology chosen is relevant.”³

3. https://resources.infosecinstitute.com/topic/computer-forensics-investigation-case-study/

A barebones outline of a forensics report is as follows:

Images Your qualifications

Images Be specific

Images What exactly did you do?

Images Show steps taken

Images Tools used

Images Details of items examined

Images Why did you do that?

Images Why that tool/technique/process

Images Use footnotes

Images Conclusions

Tools

We have previously discussed imaging a drive with either Linux commands or FTK disk imager. There are a variety of tools available for conducting forensic analysis and examination. In this section I will review a few of these for you. There are certainly other tools, but the ones listed here are very widely used.

FTK

We mentioned FTK previously, and a brief description is also given here. The company AccessData is the creator of the Forensic Toolkit, better known as simply FTK. This robust computer forensics tool allows you to recover deleted files, examine Registry settings, and perform a variety of forensic examination tasks. The software itself can be cost-prohibitive but is quite popular with law enforcement.

AccessData has added additional features such as Known File Filtering for finding certain types of files. FTK can also search and detect files involved in child pornography. AccessData makes a phone forensics tool as well. You can learn more at http://accessdata.com.

EnCase

This tool, made by Guidance Software, is quite popular with law enforcement and is a direct competitor with FTK. It allows you to image drives, recover deleted files, examine the Registry, and carry out other common tasks. It can also be cost-prohibitive for some organizations. You can learn more at https://e-forensic.ca/products/encase-forensic-suite/.

OSForensics

OSForensics is a very low-cost and easy-to-use tool. It is full featured, allowing you to recover deleted files, examine the Registry, and search drives. OSForensics is constantly working to add new features to the tool. You can find out more and download a fully working trial version at www.osforensics.com.

Magnet Forensics

The primary claim to fame of Magnet Forensics is that it handles both PC and phone forensics in one tool. You can visit https://www.magnetforensics.com to request a free trial.

Sleuth Kit

Sleuth Kit is a suite of open-source tools. The full suite of tools is full featured but rather difficult to use. Each tool can require you to learn a set of command line (or shell) commands to execute. You can find out more at www.sleuthkit.org.

Oxygen

Oxygen is a tool specifically for phone forensics. It does a very good job of analyzing iPhones and a reasonably good job of analyzing modern Android. It is not (at least currently) as effective with older Androids or Windows phones. You can learn more at www.oxygen-forensic.com.

Cellebrite

Cellebrite is perhaps one of the most popular phone forensics tools, at least with law enforcement. It is very effective with a number of different phones. The only downside is that it is one of the most expensive phone forensics tools available. You can find out more at www.cellebrite.com.

Finding Evidence on a PC

Once you have secured evidence and made a forensic copy, it is time to start looking for evidence. That evidence can come in many forms. The tools mentioned in the preceding section can be used to extricate this evidence for you. However, in this section I will show you what it is these tools search for. It is important not to simply regurgitate what some automated tool tells you, but rather to understand what it is the tool is doing.

Finding Evidence in a Browser

A browser can be a source of both direct evidence and circumstantial or supporting evidence. Obviously in cases of child pornography, the browser might contain direct evidence of the specific crime. You may also find direct evidence in the case of cyber stalking. However, if you suspect someone of creating a virus that infected a network, you would probably only find indirect evidence such as the person having searched virus creation/programming-related topics.

Even if the person erases his history, it is still possible to retrieve it. Windows stores a lot of information (such as web addresses, search queries, and recently opened files) in a file called index.dat. Most forensics tools can extract a wide range of evidence from a computer. OSForensics has multiple options for this. Among them is Recent Activity, shown in Figure 14.7.

Figure 14.7 OSForensics Recent Activity option.

From this screen you can find all browser activity, installed programs, USB devices that have been connected, and much more.

Finding Evidence in System Logs

Regardless of what operating system you are using, the operating system has logs. Those logs can be critical in any forensic investigation, and you should retrieve them.

Windows Logs

Let’s start with Windows 7/8/10/11. With all of these versions of Windows, you find the logs by clicking on the Start button in the lower-left corner of the desktop and then clicking the Control Panel. You then click on Administrative Tools and the Event Viewer. Here are the logs you would check for (though not all of them appear in every version of Windows):

Note

With all these tools, you have to turn on logging; otherwise, there will be nothing in these logs.

Images Security log: This is probably the most important log from a forensics point of view. It has both successful and unsuccessful login events.

Images Application log: This log contains various events logged by applications or programs. Many applications will record their errors here in the application log.

Images System log: The System log contains events logged by Windows system components. This includes events like driver failures. This particular log is not as interesting from a forensics perspective as the other logs are.

Images ForwardedEvents log: The ForwardedEvents log is used to store events collected from remote computers. This will only have data in it if event forwarding has been configured.

Images Applications and Services logs: This log is used to store events from a single application or component rather than events that might have systemwide impact.

Windows servers have similar logs. However, with Windows systems, you have an additional possible concern. It is possible that the attacker cleared the logs before leaving the system. There are tools that will allow one to wipe out a log. It is also possible to simply turn off logging before an attack and turn it back on when you are done. One such tool is auditpol.exe. auditpol \\ipaddress /disable turns off logging. Then when the criminal exits, she can use auditpol \\ipaddress /enable to turn it back on. There are also tools, like WinZapper, that allow you to selectively remove certain items from event logs in Windows.

Linux Logs

Obviously, Linux also has logs you can check. Depending on your Linux distribution and the services you have running on it (like MySQL), some of these logs may not be present on a particular machine:

Images /var/log/faillog: This log file contains failed user logins. This can be very important when tracking attempts to crack into the system.

Images /var/log/kern.log: This log file is used for messages from the operating system’s kernel. This is not likely to be pertinent to most computer crime investigations.

Images /var/log/lpr.log: This is the printer log and can give you a record of any items that have been printed from this machine. That can be useful in corporate espionage cases.

Images /var/log/mail.*: This is the mail server log and can be very useful in any computer crime investigation. Emails can be a component in any computer crime and even in some noncomputer crimes such as fraud.

Images /var/log/mysql.*: This log records activities related to the MySQL database server and will usually be of less interest to a computer crime investigation.

Images /var/log/apache2/*: If this machine is running the Apache web server, then this log will show related activity. This can be very useful in tracking attempts to hack into the web server.

Images /var/log/lighttpd/*: If this machine is running the Lighttpd web server, then this log will show related activity. This can be very useful in tracking attempts to hack into the web server.

Images /var/log/apport.log: This records application crashes. Sometimes these can reveal attempts to compromise the system or the presence of a virus or spyware.

Images /var/log/user.log: These contain user activity logs and can be very important to a criminal investigation.

Getting Back Deleted Files

It is a fact that criminals frequently attempt to destroy evidence. This is also true with computer crimes: Criminals may delete files. However, there are a variety of tools you can use to recover such files, particularly in Windows. Most forensics tools, such as AccessData FTK, OSForensics, Encase, and others also recover deleted files. There are also free and low-cost utilities for recovering deleted files. DiskDigger is a free tool that can be used to recover Windows files. This is a very easy-to-use tool. There are more robust tools, but the fact that this is free and easy to use makes it perfect for students learning forensics. Let’s walk through its basic operation. It should be noted that all the aforementioned forensics tools will recover deleted files for you. It must also be noted that there are many file recovery tools available on the Internet. DiskDigger is simply shown as an example of what is available.

On the first screen, shown in Figure 14.8, you select the drive/partition you wish to recover files from.

Figure 14.8 Adding a new scan.

On the next screen, you select the level of scan you want to do. This is shown in Figure 14.9. Obviously, the deeper the scan, the longer it can take.

Figure 14.9 Selecting the depth of scan.

Then you will get a list of the files that were recovered. You can see this in Figure 14.10.

Figure 14.10 Recovered files.

You can see the file and the file header. You can also choose to recover the file if you wish. Obviously, it is possible that DiskDigger will only recover a file fragment. But that can be enough for forensics.

Note

In addition to deleted files, it is important to check slack space. When a file is saved, the entire cluster is allocated whether it is needed or not. Consider this example: You have a computer with a cluster size of 10 sectors. You save a file that takes only up 3 sectors. As far as the operating system and file system are concerned, all 10 sectors are in use. That leaves 7 sectors unaccounted for. This space is slack space. It is possible to hide data in slack space.

OSForensics also allows you to search for and recover deleted files, as shown in Figure 14.11.

Figure 14.11 OSForensics Deleted File Search Option.

Operating System Utilities

There are a number of utilities built in to the operating system that can be useful in gathering forensic data. Given that Windows is the most commonly used operating system, we will focus on those utilities that work from the Windows command line. However, one of the key issues in conducting forensics work is to be very familiar with the target operating system. You should also note that many of these commands are most useful on a live running system to catch attacks in progress.

net sessions

The net sessions command lists any active sessions connected to the computer you run it on. This can be very important if you think an attack is live and ongoing. If there are no active sessions, the utility will report that, as shown in Figure 14.12.

Figure 14.12 net sessions.

openfiles

openfiles is another command useful for finding live attacks ongoing. This command will list any shared files that are currently open. You can see this utility in Figure 14.13.

Figure 14.13 openfiles.

fc

fc is a command you can use with a forensic copy of a machine. It compares two files and shows the differences. If you think a configuration file has been altered, you can compare it to a known good backup. You can see this utility in Figure 14.14.

Figure 14.14 fc.

netstat

The netstat command is also used to detect ongoing attacks. It lists all current network connections—not just inbound but outbound as well. You can see this utility in Figure 14.15.

Figure 14.15 netstat.

The Windows Registry

The Windows Registry is an incredible repository of potential valuable forensics information. It is the heart of the Windows machine. There are a number of interesting pieces of data you can find here. It is beyond the scope of this chapter to make you an expert in the Windows Registry, but it is hoped that you will continue on and learn more. Microsoft describes the Registry as follows:⁴

4. Microsoft Computer Dictionary 5th Edition

A central hierarchical database used in the Microsoft Windows family of Operating Systems to store information necessary to configure the system for one or more users, applications and hardware devices.

The registry contains information that Windows continually references during operation, such as profiles for each user, the applications installed on the computer and the types of documents that each can create, property sheet settings for folders and application icons, what hardware exists on the system and the ports that are being used.

The Registry is organized into five sections referred to as hives. Each of these sections contains specific information that can be useful to you. The five hives are described here:

Images HKEY_CLASSES_ROOT (HKCR): This hive stores information about drag-and-drop rules, program shortcuts, the user interface, and related items.

Images HKEY_CURRENT_USER (HKCU): This hive is very important to any forensic investigation. It stores information about the currently logged-on user, including desktop settings and user folders.

Images HKEY_LOCAL_MACHINE (HKLM): This hive can also be important to a forensic investigation. It contains those settings common to the entire machine, regardless of the individual user.

Images HKEY_USERS (HKU): This hive is very critical to forensics investigations. It has profiles for all the users, including their settings.

Images HKEY_CURRENT_CONFIG (HCU): This hive contains the current system configuration. This might also prove useful in your forensic examinations.

You can see the Registry and these five hives in Figure 14.16.

Figure 14.16 Windows Registry.

Most people use the regedit tool to interact with the Registry. In Windows 7 and Windows Server 2008, you select Start, Run, and then type in regedit. In Windows 8 and 10, you have to go to the applications list, select All Apps, and then find Regedit or press Windows key+R and type in regedit. Most forensics tools provide a means for examining the Registry as well.

Every Registry key contains a value called LastWriteTime associated with it. This value indicates when this Registry value was last changed. Rather than being a standard date/time, this value is stored as a FILETIME structure. A FILETIME structure represents the number of 100-nanosecond intervals since January 1, 1601. Clearly, this is important forensically.

It is also interesting to note that Microsoft rarely uses strong encryption to hide items in the Registry. If an item is encrypted, it is likely encrypted with some simple algorithm such as ROT 13.

Most internal text strings are stored and processed as 16-bit Unicode characters. Unicode is an international character set standard that defines unique 2-byte values (maximum 65,536 characters) for most of the world’s known character sets.

You can export a specific key from the command line with

Click here to view code image

reg export HKEY_LOCAL_MACHINE\System\ControlSet\Enum\UBSTOR

or within regedit, you can right-click on a key and select Export.

Specific Entries

Now that you have a basic working knowledge of the Registry, it is important to look at some specific Registry information you may find.

USB Information

One of the first things most forensic analysts learn about the Windows Registry is that they can find out what USB devices have been connected to the suspect machine. The Registry key HKEY_LOCAL_MACHINE\System\ControlSet\Enum\USBSTOR lists USB devices that have been connected to the machine. It is often the case that a criminal will move evidence to an external device and take it with him. This could indicate to you that there are devices you need to find and examine. This Registry setting will tell you about the external drives that have been connected to this system. You can see this in Figure 14.17.

Figure 14.17 Windows Registry—USBSTOR.

However, this does not give the complete picture. Some related keys are quite useful. For example, SYSTEM\MountedDevices allows investigators to match the serial number to a given drive letter or volume that was mounted when the USB device was inserted. Incidentally, this particular Registry key is not limited to USB devices.

The user who was using the USB device can be found here:

Click here to view code image

\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

The vendor and product ID can be found here:

Click here to view code image

SYSTEM\CurrentControlSet\Enum\USB

All of these related USB Registry keys should be examined in order to get a complete and accurate picture of what happened regarding specific USB devices.

Autostart Locations

This key is frequently used by malware to remain persistent on the target system. It shows those programs that are configured to start automatically when Windows starts. The following is an example:

Click here to view code image

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Obviously, you should expect to see legitimate programs in this Registry key. However, if there is anything you cannot account for, it could indicate malware.

Last Visited

The key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU shows recent sites that have been visited. The data is in hex format, but you can see the text translation when using regedit, and you will probably be able to make out the site visited just by looking at regedit.

Recent Documents

Recent documents can be found at the following key:

Click here to view code image

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

This can be quite forensically important, particularly in cases involving financial data or intellectual property. This key allows you to determine what documents have been accessed on that computer.

As you can see, this key is first divided into document types, Then, once you select the type, you can see the recent documents of that type that have been accessed.

User Assist

UserAssist, which can be found at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist, is used to populate a user’s Start menu with frequently used applications. This is achieved by maintaining a count of applications used in each user’s NTUSER.DAT registry file. Thus this Registry entry tells you how many times an application has been executed and the most recent time.

Prefetch

Prefetch, which can be found at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameter, is a file that contains the name of an executable, a Unicode list of DLLs used by that executable, a count of how many times the executable has been run, and a time stamp indicating the last time the program was run. In conjunction with UserAssist, this Registry key can give you a good picture of programs executed on the device.

Uninstalled Software

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall is a very important Registry key for forensic examination. An intruder who breaks into a computer might install software on that computer for various purposes such as recovering deleted files or creating a backdoor. He will then, most likely, delete the software he used. It is also possible that an employee who is stealing data might install steganography software so he can hide the data. He will subsequently uninstall that software. This key lets you see all the software that has been uninstalled from this machine.

ShellBags

The ShellBags entry, which can be found at HKCU\Software\Microsoft\Shell\Bags, indicates whether a given folder (rather than file) was accessed. This Windows Registry key is of particular interest in child pornography investigations. It is common for a defendant to claim they were not aware that illegal files were on the computer in question. ShellBags entries can confirm or refute such a claim.

There are certainly other keys of interest. And the aforementioned forensics tools will pull this information (and more) for you. If you are going to be working with forensics, particularly with Windows machines, it is critical that you learn the Windows Registry.

Windows Date/Time Stamps

When collecting data from a device, you need to be aware of date/time stamps. For example, the following date/time stamps in Windows have specific meanings:

Images File Created: This date/time stamp usually shows when a file or folder was created. When a file is moved onto a different volume using the Windows command line or drag-and-drop feature, the File Created date/time stamp for the new copy is set to the current time. When a file is moved onto a different volume using the Cut and Paste menu options, the File Created date/time stamp does not change; however, the Last Accessed date/time stamp does.

Images Modified: This date/time stamp indicates the last time some change was made to the file.

Images Last Accessed: This date/time stamp represents the most recent time a file or folder was accessed by the file system. It need not be opened to be accessed.

Mobile Forensics: Cell Phone Concepts

You need to know about some basic devices and terminology before we delve into cell phones. Some of these, such as SIM, are probably at least somewhat familiar to you.

Cell Phone State

When examining a cell phone, you should document the state you found it in. The U.S. National Institute of Standards identifies four states:

Images Nascent state/factory default state: Devices are in the nascent state when received from the manufacturer. In this state, a device contains no user data and is set to factory configuration settings.

Images Active state: Devices that are in the active state are powered on, performing tasks, and able to be customized by the user and have their file systems populated with data.

Images Semi-active state: The semi-active state is a state partway between active and quiescent. This state is triggered after a period of inactivity, at which point the device preserves the battery life by dimming the display and taking other appropriate actions.

Images Quiescent state: The quiescent state is a dormant mode that conserves battery life while maintaining user data and performing other background functions. Context information for the device is preserved in memory to allow quick resumption of processing upon return to the active state.

Cell Phone Components

The following sections describe the parts of a cell phone.

Subscriber Identity Module

A subscriber identity module, or SIM, is the heart of a phone. It is a circuit, usually a removable chip. The SIM stores the international mobile subscriber identity (IMSI). The IMSI, which we will discuss in detail in just a moment, uniquely identifies a phone. So if you change the SIM, you effectively change the IMSI and thus change the phone’s identity. This SIM will also usually have network information, services the user has access to, and two passwords. Those passwords are the personal identification number (PIN) and the personal unblocking code (PUK). The PUK is a code used to reset a forgotten PIN. However, using the code wipes the phone and resets it to its factory state, thus destroying any forensic evidence. If the code is entered incorrectly 10 times in a row, the device becomes permanently blocked and unrecoverable.

International Mobile Subscriber Identity

The international mobile subscriber identity (IMSI) is usually a 15-digit number but can be shorter in some cases. (Some countries use a shorter number.) It is used to uniquely identify a phone. The first 3 digits are a mobile country code (MCC), and the next digits represent the mobile network code. In North America that is 3 digits; in Europe it is 2 digits. The remaining digits are the mobile subscription identifier number (MSIN) that identifies the phone within a given network. To prevent tracking and cloning, the IMSI is only sent rarely. Instead, a temporary value or TMSI is generated and sent.

Integrated Circuit Card Identification

While the international mobile subscriber identity (IMSI) is used to identify the phone, the SIM chip itself is identified by the ICCID. The ICCID is engraved on the SIM during manufacturing, so it cannot be removed. The first seven digits identify the country and issuer, and are called the issuer identification number (IIN). After that is a variable-length number that identifies this chip/SIM, then a check digit.

International Mobile Equipment Identity

The international mobile equipment identity (IMEI) number is a unique identifier used to identify GSM, UMTS, LTE, and satellite phones. It is printed on the phone, often inside the battery compartment. You can display it on most phones by entering #06# on the dial pad. Using this number, a phone can be blacklisted or prevented from connecting to a network. This works even if the user changes the SIM card.

Cellular Networks

In addition to understanding the cell phones themselves, it is necessary to understand the networks. All cell phone networks are based on radio towers. The strength of that radio signal is purposefully regulated to limit its range. Each cell tower base station consists of an antenna and radio equipment. Following is a brief description of the different types of networks.

Global System for Mobile Communications

Global System for Mobile Communications (GSM) is an older technology that is commonly called 2G. This is a standard developed by the European Telecommunications Standards Institute (ETSI). Originally, GSM was developed just for digital voice, but it was expanded to include data. GSM operates at many different frequencies, but the most common are 900MHz and 1800MHz. In Europe, most 3G networks use the 2100MHz frequency.

Enhanced Data Rates for GSM Evolution

Many consider Enhanced Data Rates for GSM Evolution (EDGE) a level between 2G and 3G. It is technically considered pre-3G but was an improvement on GSM (2G). It was specifically designed to deliver media such as television over the cellular network.

Universal Mobile Telecommunications Systems

The Universal Mobile Telecommunications Systems (UMTS) is 3G and is essentially an upgrade to GSM (2G). It provides text, voice, video, and multimedia at data rates up to and possibly higher than 2 megabits per second.

Long Term Evolution

Long Term Evolution (LTE), commonly called 4G, provides broadband Internet, multimedia, and voice. LTE is based on the GSM/EDGE technology. It can theoretically support speeds of 300Mbps. Unlike GSM and GSM-based networks, LTE is based in IP, just like a typical computer network.

5G

5th-Generation Wireless Systems (abbreviated 5G) meets ITU IMT-2020 requirements and conforms to the 3GPP Release 15 standard. There is a peak data rate of 20 Gbit/s.

Integrated Digitally Enhanced Network

Integrated Digitally Enhanced Network (iDEN) is a GSM-based architecture that combines cell phone, two-way radio, pager, and modem into a single network. It operates on 800MHz, 900MHz, or 1.5GHz frequencies and was devised by Motorola.

Understanding the networks that cell phones work on is important to understanding cell phone forensics. Today you are most likely encountering LTE, though 3G networks/phones still exist.

Remember that a modern cell phone or tablet is actually a computer. A few short years ago, this was not the case. However, modern mobile devices are, in every respect, full-fledged computers. This means they have hardware, operating systems, and applications (often called apps). It is important to have at least a working knowledge of the operating systems used on mobile devices in order to successfully perform forensic analysis.

iOS

Apple’s iPhone, iPod, and iPad are very common, and all run on the same operating system, iOS. The iOS operating system was originally released for the iPhone and iPod in 2007 and later expanded to include the iPad. It is based on a touch interface, wherein the user performs gestures such as swiping, dragging, pinching, and tapping on the screen. iOS is based on macOS but is heavily modified.

iOS is divided into four layers. The first is the Core OS layer, which is the heart of the operating system. This is a layer that users and applications don’t directly interact with. Instead, applications interact with the Core Services layer, the second layer. The third layer, or Media layer, is responsible for music, video, and more. Finally, there is the Cocoa Touch layer, which responds to user gestures.

iOS uses the HFS+ file system. HFS+ was created by Apple as a replacement for the Hierarchical File System (HFS) and is used in both iOS and OSX. iOS can use FAT32 when communicating with Windows machines (such as when synchronizing an iPhone with a Windows PC).

iOS divides its data partition as follows:

Images Calendar entries

Images Contact entries

Images Note entries

Images iTunes configuration

Images iTunes music

Clearly, the calendar and contact entries can be of interest in any forensic investigation. However, some of the data hidden in the iPod_control directory is also very important.

Android

Android is the single largest alternative to iOS. It is based on Linux; in fact, it is a modified Linux distribution, and it is open source. This means that if you have the programming and operating system knowledge to follow it, you can download and read the Android source code for yourself (see http://source.android.com). It should be noted that proprietary Android phones often make their own modifications or additions to the open-source Android source code.

The Android OS, first released in 2003, is the creation of Rich Miner, Andy Rubin, and Nick Sears; however, Google acquired Android in 2005. The versions of Android have been named after desserts/sweets:

Images Version 1.5: Cupcake, released in April 2009

Images Version 1.6: Donut, released in September 2009

Images Version 2.0–2.1: Eclair, released in October 2009

Images Version 2.2: Froyo, released in May 2010

Images Version 2.3: Gingerbread, released in December 2010

Images Version 3.1–3.2: Honeycomb, released in February 2011

Images Version 4.0: Ice Cream Sandwich, released in October 2011

Images Version 4.1–4.2: Jelly Bean, released in June 2012

Images Version 4.4: KitKat, released in September 2013

Images Version 5.0: Lollipop, released in November 2014

Images Version 6.0: Marshmallow, released in October 2015

Images Version 7.0: Nougat, released in August 2016

Images Version 8.0: Oreo, released in August 2017

Images Version 9.0: Pie, released in August 2018

Images Android Q Beta 2019: Now just called by number 10 and widely used

Images Android 11 Beta: Launched in June 2020

Images Android 11: Red Velvet Cake, released in September 2021

Images Android 12: Snow Cone v1, released in October 2021

Images Android 12L: Snow Cone v2, released in March 2022

Images Android 13: Tiramisu, released in August 2022

The differences from version to version usually involve new features, not radical changes to the operating system. They are all Linux based, and the core functionality, even from Cupcake to Tiramisu, is remarkably similar. This means that if you are comfortable with any version of Android, you should be able to perform a forensic analysis with all versions of Android.

What You Should Look For

What are general principles that help you determine what to look for in a cell phone or other mobile device? Items you should attempt to recover from a mobile device include the following:

Images Details of the phone itself

Images Call history

Images Photos and video

Images GPS information

Images Network information

Information about the phone should be one of the first things you document in your investigation. Just as you would document the specifics of a PC (model, operating system, and so on) you were examining, you should also document the phone or tablet specifics. This will include model number, serial number of the SIM card, operating system, and more. The more descriptive information you can document, the better.

The call history will let you know who the user has spoken to and for how long. Obviously, call records by themselves are not sufficient to prove most crimes. With the exception of stalking or breaking a restraining order, just showing that one person called another is not enough to prove a crime. However, it can begin to build a circumstantial case.

Photos and videos can provide direct evidence of a crime. In the case of child pornography, the relevance is obvious. However, it may surprise you to know that it is not uncommon for some criminals to actually photograph or videotape themselves committing serious crimes. This is particularly true of young criminals conducting unplanned crimes or conducting crimes under the influence of drugs or alcohol. There are numerous cases of perpetrators filming or photographing themselves performing crimes ranging from vandalism to burglary to rape.

GPS information has become increasingly important in a variety of cases. So many individuals have devices with GPS enabled that it would seem negligent for a forensic analyst to not retrieve this information. GPS cannot confirm that a suspect committed a crime, but it can show that the suspect was at a location where a crime was committed. Of course, GPS can also help to exonerate someone. If a person is suspected of committing a crime but his vehicle and cell phone GPS are shown to be many miles away at the time of the crime, this can help establish an alibi.

Network information is also important. What Wi-Fi networks does the phone recognize? This might indicate where the phone has been. If a phone has connected to a coffee shop that is near the scene of a crime, it at least shows the perpetrator was in the area. It is also possible that traditional computer crimes, such as denial of service (DoS) and SQL injection, might trace back to a public Wi-Fi point, and the perpetrator was clever enough to mask his computer’s identity. If you can show that his cell phone GPS was connected to that Wi-Fi, it will help establish he had the opportunity to commit the crime.

The Need for Forensic Certification

Why certifications? This question has been bandied about the information technology field for years. Various pundits come down upon one extreme or the other. Some claim certifications are invaluable, and others claim they are worthless. Also, some subindustries within IT have different attitudes about certifications. In the Cisco world, certifications are king. In the Linux community, certifications have negligible value. So what is the worth of certifications in forensics?

First, you must examine the purpose of certifications. What does it mean to be certified? Frequently, people who have a dim view of certifications have that view because they have encountered someone with a certification who was not very competent. This denotes a misunderstanding of what any certification is. Certification is supposed to indicate that the holder of that certification has met a minimum standard. It does not mean that the person in question is the master of that topic, but rather she is competent. Similarly, a medical degree does not guarantee the person is a great doctor, merely that she has obtained a minimum competency in medicine.

However, it is possible to pass a certification and not be very good at the topic. But the same is true of any field and any educational endeavor. There are certainly some medical doctors (thankfully few) who are incompetent. But if you suddenly have chest pains, I bet you would prefer someone call you a medical doctor rather than a plumber. The odds of a medical doctor having the requisite skill are much higher than that of a plumber. The same is true for IT certifications. While it is certainly possible that someone could be certified and not be competent, the odds that a certified person is competent are much higher. That is why employers frequently require or prefer certifications. It makes the job of filtering through applicants much easier.

Any IT certification can be one valuable indicator of a job applicant’s skill. It is not the only indicator and certainly should not be the only thing considered, but it is one factor. This brings us to forensic certifications. Is there a need for another one? First look at what cyber forensics certifications are currently available. All forensics certifications come in one of two types. The first type is vendor certifications. These usually are focused only on the product (or products) that vendor sells. The second type is conceptual certifications. These tests are not about a specific tool, but rather forensic concepts.

AccessData, the creator of the Forensic Toolkit, has multiple certifications for its product. So does Guidance Software, the creator of EnCase. Both of those vendor certifications are quite good. However, they are both vendor certifications. The emphasis is on the particular proprietary suite of tools rather than a general coverage of cyber forensics. If you are going to work with either tool, it is a very good idea to get the appropriate vendor certification, but that is not the same thing as a broad-based cyber forensics course/test.

The EC-Council has its Certified Hacking Forensics Investigator (CHFI) test, and it has been somewhat popular. However, as the name suggests, it has an emphasis on hacking and counter hacking. The EC-Council’s primary focus has always been hacking.

The SANS Institute offers a number of certifications, including the Certified Forensics Analyst (GCFA) and Certified Forensics Examiner (GCFE). Both of these are well respected in the industry. The only issue with either one is the cost. SANS courses and their certification tests are among the most expensive in the industry.

Expert Witnesses

At some point, any forensic examiner might be called to testify in court. Being an expert witness is very different from being a witness of fact. To begin with, an expert witness is allowed to testify about things he did not see or hear. Second, an expert witness is allowed to make inferences and formulate theories.

However, there are definite limits to and requirements for expert testimony. You cannot simply get on the stand and essentially state, “Well, I am an expert and this is true because I say so.” There are some rules. The following sections give a brief overview of some of those rules.

Federal Rule 702

Federal Rule 702 defines what an expert witness is and the rules concerning when she can testify and what she can testify to. Essentially, Rule 702 states the following:

A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if:

The expert’s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue;

The testimony is based on sufficient facts or data;

The testimony is the product of reliable principles and methods; and

The expert has reliably applied the principles and methods to the facts of the case.

What this means is that, first and foremost, the expert must be an expert in that specific topic or field. That person’s testimony must be useful to the judge or jury in understanding technical or specialized facts in the case. But just as important, the expert must base her opinions on reliable scientific methods.

Daubert

The Daubert standard is used in U.S. federal courts to determine whether or not an expert’s scientific testimony is based on reasoning or methodology that is scientifically valid and can properly be applied to the facts at issue. Under this standard, the factors that may be considered in determining whether the methodology is valid are (1) whether the theory or technique in question can be and has been tested; (2) whether it has been subjected to peer review and publication; (3) its known or potential error rate; (4) the existence and maintenance of standards controlling its operation; and (5) whether it has attracted widespread acceptance within a relevant scientific community. The Daubert standard is the test currently used in the federal courts and some state courts. This is very similar to Federal Rule 702.

Additional Types of Forensics

Digital forensics is a growing field. Computer and phone forensics are the most widely encountered types of digital forensics, but not the only areas of digital forensics. In this section, you will see a brief overview of some other subdisciplines of digital forensics.

Network Forensics

The first, most fundamental thing to learn about network forensics is packet analysis. Before we continue, you may wish to review the material from Chapter 2, “Networks and the Internet,” to ensure that you are comfortable with basic networking.

Essentially, network forensics involves capturing the network packets traversing the network and examining them for evidence. Many things can be determined from network forensics: where a packet came from, what protocol it is using, what port it is using, and whether it is encrypted or not.

The following are some of the popular tools for network analysis:

Images Wireshark: www.wireshark.org

Images CommView: www.tamos.com/products/commview/

Images SoftPerfect Network Protocol Analyzer: www.softperfect.com

Images EffeTech HTTP Sniffer: www.effetech.com/sniffer/

Images ngrep: http://sourceforge.net/projects/ngrep/

Any of these tools can work for network analysis.

Virtual Forensics

Virtualization is a broad term that encompasses many technologies. It is a way to provide various IT resources that are independent of the physical machinery of the user. The virtualization makes a logical IT resource that can operate independently of the end user’s operating system as well as hardware. The most basic issue for forensics is the situation where a suspect machine has a virtual machine running on it. There are also issues with getting data from cloud servers.

Virtual Machines

A virtual machine is an interesting concept and was the precursor of more broad-based virtual systems that we will discuss later in this chapter. A virtual machine essentially sets aside a certain portion of a computer’s hard drive and RAM (when executing) to run in complete isolation from the rest of the operating system. It is much like you are running an entirely separate computer; it simply shares the resources of the host computer. It is, quite simply, a virtual computer—thus, the name virtual machine.

Each vendor stores data in a slightly different manner. The following list shows the most forensically interesting files for three of the most widely used virtual machine vendors:

Images VMware Workstation:

Images .log files: This is a log of activity for a virtual machine.

Images .vmdk: This is the actual virtual hard drive for the virtual guest operating system. Virtual hard drives can be fixed or dynamic. Fixed virtual hard drives remain the same size. Dynamic virtual hard drives expand as needed.

Images .vmem: This is a backup of the virtual machine’s paging file/swap file. This can be very important to a forensic investigation.

Images .vmsn: These are VMware snapshot files, named based on the name of the snapshot. A VMSN file stores the state of the virtual machine when the snapshot was created.

Images .vmsd: A VMSD file contains the metadata about the snapshot.

Images Oracle VirtualBox:

Images .vdi: These are VirtualBox disk images called virtual disk images.

Images /.config/VirtualBox: This is a hidden file that contains configuration data.

Images .vbox: This is the machine settings file extension. Prior to version 4.0, it was .xml.

Images Virtual PC:

Images .vhx: These are the actual virtual hard disks. They are obviously quite important to a forensic examination.

Images .bin files: These contain the memory of the virtual machine, so these absolutely must be examined.

Images .xml files: These files contain the virtual machine configuration details. There is one of these for each virtual machine and for each snapshot of a virtual machine. These files are always named with the GUID used to internally identify the virtual machine in question.

Cloud

A cloud is a pool of virtualized computer resources. People often speak of the cloud as if there were only one cloud, or at least one type of cloud. This impression is inaccurate. There are multiple clouds and multiple types of clouds. Any organization with the appropriate resources can establish a cloud, and it may establish it for diverse reasons, leading to different types of clouds.

Public clouds are defined by the NIST as those clouds that offer their infrastructure or services to either the general public or at least a large industry group.

Private clouds are those used specifically by a single organization without offering the services to an outside party. There are, of course, hybrid clouds that combine the elements of a private and public cloud. These are essentially private clouds that have some limited public access.

Community clouds are a midway point between private and public. These are systems wherein several organizations share a cloud for specific community needs. For example, several computer companies might join to create a cloud devoted to common security issues.

A cloud system depends on several parts. Each of these could be a location for evidence:

Images Virtual storage: The virtual servers are hosted on one or more actual/physical servers. The hard drive space and RAM of those physical servers are partitioned for the various virtual servers’ usage.

Images Audit monitor: There is usually an audit monitor that monitors usage of the resource pool. This monitor will also ensure that one virtual server does not/cannot access data of another virtual server.

Images Hypervisor: The hypervisor mechanism is the process that provides the virtual servers with access to resources.

Images Logical network perimeter: Since the cloud consists of virtual servers, not physical ones, there is a need for a logical network and a logical network perimeter. This perimeter isolates resource pools from each other.

Individual cloud implementations might have additional utilities, such as administration consoles that allow a network administrator to monitor, configure, and administer the cloud.

There are two issues with cloud forensics. The first is jurisdictional. Often cloud data is replicated across servers in different countries, each with its own laws. Then there is the technical issue of getting the data. It is very unlikely that you would be able to image the entire cloud in question. So you will probably have to perform a logical copy of the data in question or even a live analysis.

Summary

In this chapter, you have seen the basics of computer forensics. The most important things you have learned are to make a forensics copy to work with and to document everything. You simply cannot over document. You have also learned how to retrieve browser information and recover deleted files, and you have learned some commands that may be useful forensically. You have explored the forensic value of the Windows Registry and even cloud forensics.

Test Your Skills

Multiple Choice Questions

1. In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

A. Rules of evidence

B. Law of probability

C. Chain of custody

D. Policy of separation

2. Ian is performing a forensic examination on a Linux server. He is trying to recover emails. Where does Linux store email server logs?

A. /var/log/mail.*

B. /etc/log/mail.*

C. /mail/log/mail.*

D. /server/log/mail.*

3. Why should you note all cable connections for a computer you want to seize as evidence?

A. To know what outside connections existed

B. In case other devices were connected

C. To know what peripheral devices exist

D. To know what hardware existed

4. Pedro is examining a Windows 10 computer. He has extracted the index.dat file and is examining that file. What is in the index.dat file?

A. Internet Explorer information

B. General Internet history, file browsing history, and so on for a Windows machine

C. All web history for Firefox

D. General Internet history, file browsing history, and so on for a Linux machine

5. What is the name of the standard Linux command that is also available as a Windows application that can be used to create bitstream images and make a forensic copy?

A. mcopy

B. image

C. MD5

D. dd

6. When cataloging digital evidence, the primary goal is to do what?

A. Make bitstream images of all hard drives.

B. Preserve evidence integrity.

C. Avoid removing the evidence from the scene.

D. Prohibit the computer from being turned off.

7. Mahmoud is using a range of Windows utilities to extract information from a computer he is triaging. He has just used the openfiles command. What does the command openfiles show?

A. Any files that are opened

B. Any shared files that are opened

C. Any system files that are opened

D. Any files open with ADS

8. “Interesting data” is what?

A. Data relevant to your investigation

B. Pornography

C. Documents, spreadsheets, and databases

D. Schematics or other economic-based information

9. Which of the following are important to the investigator regarding logging?

A. The logging methods

B. Log retention

C. Location of stored logs

D. All of these answers are correct

Exercises

EXERCISE 14.1: DiskDigger

Download DiskDigger and search your computer for deleted files. Attempt to recover one file of your choice.

EXERCISE 14.2: Making a Forensic Copy

This exercise requires two computers. You must also download either Kali Linux or Knoppix. (Both are free.) Then attempt to make a forensic copy of computer A by sending its data to computer B.

EXERCISE 14.3: OSForensics

Download a trial copy of OSForensics from https://www.osforensics.com/osforensics.xhtml.Using tutorials at https://www.osforensics.com/faqs-and-tutorials/video_demonstrations.xhtml, perform basic forensics on your own computer with OSForensics.

Chapter 15

Cybersecurity Engineering

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

Images Understand basic systems engineering concepts

Images Understand how to integrate systems engineering into cybersecurity

Images Utilize engineering tools in cybersecurity

Images Explain the use of standards in cybersecurity engineering

Introduction

The field of cybersecurity is growing rapidly. While this rapid expansion has been beneficial for the career prospects of cybersecurity practitioners, it has presented challenges for defining the profession, including the roles and requirements within cybersecurity. It is not even clear where cybersecurity belongs in a university. A wide range of approaches are used in cybersecurity and cybersecurity education. In some cases, cybersecurity is taught and practiced as a business management discipline, with a focus on policies and procedures. In other instances, it is approached as a computer science subdiscipline. This disparity in even defining cybersecurity is a significant problem for both practitioners and academia.

One result of this lack of a coherent definition of cybersecurity is the wide range of technical backgrounds and skillsets for practitioners. There are cybersecurity professionals with a strong background in computer science or engineering, and others with virtually no technical background at all. This ambiguity leads to difficulty in even defining what cybersecurity is. Some people approach it as a management issue, primarily focused on the formulation and implementation of appropriate security standards and policies. In this approach, technical skills are a secondary (or even tertiary) concern and only relevant to the implementation of security standards and policies.

A different approach to cybersecurity is to view it as a highly technical discipline. In this view, policies and procedures are still a part of cybersecurity, but they are ancillary to technical skills. This approach focuses on the technical aspects of cybersecurity, and the technical skillset of practitioners. In this view, cybersecurity practitioners are likely to have a strong computer science background, perhaps including a degree in computer science or a related discipline. This chapter embraces the technical viewpoint of cybersecurity but provides more specificity and refinement to that definition. The approach outlined in this chapter is to view cybersecurity as an engineering discipline—in fact, as a subdiscipline of systems engineering.

Defining Cybersecurity Engineering

In order to define cybersecurity engineering as a discipline, it is first necessary to define engineering. The Accreditation Board for Engineering and Technology defines engineering as follows:¹

1. http://users.ece.utexas.edu/~holmes/Teaching/EE302/Slides/UnitOne/tsld002.htm

The profession in which a knowledge of the mathematical and natural sciences gained by study, experience, and practice is applied with judgment to develop ways to utilize, economically, the materials and forces of nature for the benefit of mankind.

This definition indicates that any engineering discipline must be predicated on knowledge of mathematical and natural sciences. If you consider traditional engineering disciplines (aerospace, electrical, mechanical, and so on), you realize that engineering is heavily focused on planning and testing. One must plan everything from requirements gathering to testing and rollout. Modeling is also a central concept. These are things not often done in cybersecurity.

Traditional engineering disciplines include mechanical, electrical, civil, and chemical. In the twentieth century, that list was expanded to include aerospace, bio, nuclear, computer, and other types of engineering. In the past 50 years we have seen a rise in the field of systems engineering. What all these diverse fields of engineering have in common is that they all are predicated on the same engineering principles, including rigorous design, based on application of mathematics and natural sciences. Engineering is primarily concerned with a mathematical and scientific approach to design. That systematic approach to design carries on into development and testing—and, in fact, throughout the systems life cycle. Even the rigorous design is in turn predicated on a scientific and methodical approach to requirements engineering.

Based on an understanding of engineering definitions and principles, it should be clear that in order to make cybersecurity engineering a true engineering discipline, there are elements of the practice and teaching of cybersecurity that must be changed. The most efficient way to effect such changes is to model cybersecurity engineering after some existing engineering discipline. It might seem appropriate to choose computer engineering or software engineering as templates for cybersecurity engineering; however, cybersecurity engineering inherently involves a symbiosis of a wide range of systems. Cybersecurity is not limited to computers. It also includes human factors, policies, and legal issues that are foreign to computer engineering and software engineering.

Cybersecurity and Systems Engineering

Cybersecurity inherently involves diverse computer systems, human processes, varying operating systems, and other systems involved in cybersecurity. Cybersecurity could appropriately be labeled a system of systems; therefore, systems engineering is the appropriate template for cybersecurity engineering. One of the proposals in this chapter is that cybersecurity be formalized as a subdiscipline of systems engineering.

Before cybersecurity engineering can be defined as a subdiscipline of systems engineering, it is critical to first establish a clear understanding of what systems engineering is. The International Council on Systems Engineering (INCOSE) defines systems engineering as follows:²

2.. https://www.incose.org/docs/default-source/TWG-Documents/09_iw14-se-summit_lacntydpw.pdf?sfvrsn=80cc82c6_0

Systems Engineering is an interdisciplinary approach and means to enable the realization of successful systems. It focuses on defining customer needs and required functionality early in the development cycle, documenting requirements, then proceeding with design synthesis and system validation while considering the complete problem: Operations, Performance, Test, Manufacturing, Cost & Schedule, Training & Support, Disposal.

Systems engineering is, by definition, an interdisciplinary engineering discipline. It brings together diverse fields of engineering and includes project management activities. Systems engineering is concerned with a given system, or system of systems, throughout the system life cycle. This begins with the concept phase and continues through system disposal. This is an appropriate approach for cybersecurity engineering as well.

The first area to consider is requirements engineering, which involves defining the requirements for the system to be developed. The process begins with an informal and often vague articulation of requirements as per the stakeholders and moves on to processing that information into specific and actionable system requirements. In cybersecurity, requirements engineering is a critical component that is often overlooked. Many cybersecurity projects are done simply because they meet minimum requirements for some regulatory requirement or because they are common cybersecurity tasks. Formalized requirements engineering is not a common occurrence in cybersecurity. This indicates that one benefit of formally defining cybersecurity engineering is that requirements engineering can then be integrated into cybersecurity projects.

Applying Engineering to Cybersecurity

While the engineering processes apply to all aspects of cybersecurity, it can be beneficial to consider a specific example to illustrate the application of requirements engineering. For that purpose, one can consider a penetration test. Currently penetration testing is often done in an ad hoc manner. In penetration testing, the requirements engineering process can be used to define the specific requirements for a particular penetration test. Clients often have only vague ideas about what a penetration test is and about what they want to accomplish with pen testing.

According to IEEE 830-1993, requirement is defined as:

A condition or capability needed by a user to solve a problem or achieve an objective.

A condition or a capability that must be met or possessed by a system…to satisfy a contract, standard, specification, or other formally imposed document.

Every cybersecurity project should begin by defining the requirements. For a requirement to be effective, there are several criteria the requirement must meet. There is a helpful acronym to help you understand and remember those criteria, SMART:

Specific

Measurable

Achievable

Realistic

Timely

This SMART acronym is meant to assist you in understanding what makes a good requirement. A requirement must first and foremost be specific. Stating “I want to be more secure” is too vague. Stating “I want to reduce virus outbreaks by 23% in the next fiscal year” is quite specific. If you cannot measure it in some way, how will you know if you have achieved it or if you have missed the mark? Measurability goes hand in hand with specificity. A requirement must also be achievable. Stating “I want to never have a security incident again” is simply unrealistic and unachievable. While realistic and achievable overlap, they are not exactly the same thing. For example, stating “I want to reduce virus incidents by 15%” is achievable. Stating that you want to accomplish this goal by end of business tomorrow is simply not realistic. It must also be timely, meaning that the requirement will/can be achieved in an appropriate timeline.

Requirements engineering activities begin with requirements elicitation. This is a process wherein stakeholders and engineers meet to discuss requirements. As the name suggests, the engineers elicit requirements from the stakeholders. The requirements initially gathered are then analyzed. During the requirements analysis phase UML diagrams, SysML diagrams (which we will explore later in this chapter), user stories, and other techniques may be used to clarify the requirements. Often requirements analysis is then followed with system modeling. Modeling can be done with UML or SysML modeling, or tools such as MATLAB. The idea is to explore the requirements that have been gathered. Next the requirements are specified and validated.

In requirements engineering, the systems engineer uses techniques to elicit requirements from the client or other stakeholders. This is a process that can be readily tailored to cybersecurity engineering. As one example, this can be applied to penetration testing, a subset of cybersecurity. For penetration testing, requirements engineering can involve several techniques:

Images Review past incidents the client organization has had and incidents that have occurred in the same industry. Extrapolate from those specific requirements and seek the client’s agreement on those requirements.

Images Use-case diagrams are common in systems engineering. They provide a very easy to understand model that even a very nontechnical stakeholder can understand. Penetration testers can use misuse cases to model potential misuses of the client’s systems. These misuse cases can include insider threats, external attackers, and even accidental security violations. Misuse cases are described in detail later in this chapter, in the section “SecML.”

Images Review specific requirements from relevant regulatory bodies and industry standards. Many standards, such as the Payment Card Industry Data Security Standard (PCI DSS), define specific penetration testing requirements.

Once requirements have been gathered and approved by the stakeholder, those requirements should form the foundation of the penetration test. In systems engineering a bidirectional requirements matrix is a common tool for tracing requirements. For penetration testing, this will trace every requirement to at least one specific test that was conducted, and every single test should trace back to a specific requirement. This ensures that all requirements were met in the penetration test, and that all tests conducted were necessitated by one or more specific requirements. Figure 15.1 displays a simplified requirements matrix for a penetration test.

Figure 15.1 Requirements bidirectional traceability matrix.

Clearly, an actual penetration test would have many more activities and requirements. But this figure demonstrates the usefulness of the requirements bidirectional traceability matrix when applied to penetration testing. The primary issue in this example is to integrate requirements engineering into the penetration test. The specific requirements will vary depending on the specific needs for that particular penetration test. The current issue is that existing cybersecurity curriculums do not include any systems engineering. Thus it is not uncommon to find cybersecurity professionals with no formal training in requirements engineering.

Once the requirements are established, it is necessary to plan the actual penetration test. Systems engineering provides several effective tools to aid in planning. One such tool is the Work Breakdown Structure (WBS). The WBS is a diagram that takes a large process and breaks it down into smaller, manageable pieces. This is useful for ensuring all tasks have been planned. It also breaks the project into smaller tasks to facilitate both scheduling and budgeting. A simplified Work Breakdown Structure for a single server is shown in Figure 15.2.

Figure 15.2 Work Breakdown Structure.

Simply by applying requirements engineering and a Work Breakdown Structure to a penetration test, one will achieve a more systematic and consistent test. This can improve efficacy of penetration testing as well as streamline efficiency. This cannot be accomplished, however, if the penetration tester is not educated on these fundamental concepts from systems engineering.

Beyond the particular example of planning and executing a penetration test is the broader issue of designing any security system. Such design principles apply to any security implementation such as deploying a new intrusion detection system (IDS), implementing new network policies, or developing a honey pot (decoy system). The current trend in cybersecurity is to perform tasks with minimal (if any) planning. This is another area where systems engineering can enhance cybersecurity.

As was previously discussed, elements from reliability engineering can also be applied to cybersecurity engineering. By integrating the established methodologies for measuring reliability, cybersecurity engineering has a ready-made set of metrics. At its core, reliability engineering is about risk management. And that is also the ultimate goal of cybersecurity.

Any integration of systems engineering with cybersecurity will have to be based on specific standards. The IEEE 15288 standard defines the system development life cycle. This same life cycle should be applied to developing security in any environment. Thus, when implementing a new intrusion detection system, or in implementing new network policies, one should follow the IEEE 15288 system development life cycle, which includes the following clauses:

Images Clause 6.4.1—Stakeholder Requirements Definition Process

Images Clause 6.4.2—Requirements Analysis Process

Images Clause 6.4.3—Architectural Design Process

Images Clause 6.4.4—Implementation Process

Images Clause 6.4.5—Integration Process

Images Clause 6.4.6—Verification Process

Images Clause 6.4.7—Transition Process

Images Clause 6.4.8—Validation Process

Images Clause 6.4.9—Operation Process

Images Clause 6.4.10—Maintenance Process

Images Clause 6.4.11—Disposal Process

IEEE 15288 defines the process for developing or acquiring any system, beginning with defining requirements. This process is commonly taught in introductory systems engineering courses but might be foreign to many cybersecurity practitioners. Understanding the system development life cycle is essential to development of any system, including cybersecurity systems.

Any cybersecurity system must begin with the requirements engineering process. One of the hallmarks of requirements engineering is requirements elicitation. This is a process whereby the engineer elicits requirements from stakeholders. The idea is that the stakeholders may not be aware of what can be done or what should be done. The engineer’s expertise is needed to elicit a set of requirements. This is particularly applicable to cybersecurity. It is very likely that the stakeholders are not well versed in cybersecurity and will not effectively arrive at a complete list of requirements, without some assistance from an engineer.

Another tool from systems engineering that can be of significant benefit in cybersecurity engineering is the use-case diagram. This was originally part of UML and is now incorporated into SysML. The use-case diagram shows a range of users, including other systems, and how they will interact with the system of interest. The details of the use case are expounded upon later in this chapter, in the section “SecML.” However, the simple concept of modeling how users interact with a system can be very useful in defining system functionality. It is also an effective tool for communicating with stakeholders during requirements elicitation.

Unified Modeling Language (UML) is a set of diagrams used to model software. These diagrams include use-case diagrams that show how the software will be used. UML also includes deployment diagrams describing how the software should be deployed. There are a total of 14 different UML diagrams. SysML (or Systems Modeling Language) is similar but applies to any system. There are 9 different SysML diagrams.

The tools discussed in this section are just a few of the techniques that systems engineering uses that can be effectively applied to cybersecurity in general and penetration testing in particular. It can be advantageous for any penetration tester to take a course in systems engineering. Educational institutions may wish to consider adding a systems engineering course to any existing cybersecurity curriculum. At a minimum, a cybersecurity engineer should at least become familiar with the INCOSE handbook.

The tools presented in this section are only a sample of the tools utilized in systems engineering. As important as the tools are the concepts of systems engineering. For example, system modeling and simulation is common in systems engineering, but not commonly done in cybersecurity. Defining cybersecurity engineering as a subdiscipline of systems engineering requires that modeling and simulation be included.

Modeling and simulation provide a useful mechanism for testing systems in a variety of scenarios. For example, if one is developing a system to counter denial of service (DoS) attacks, then it would be useful to simulate a DoS attack to determine how the system will respond. MATLAB is already widely used to model network traffic. It is therefore appropriate to utilize MATLAB to model network traffic-based attacks. However, this modeling is not common in cybersecurity. This is one example of the application of modeling and simulation to cybersecurity engineering.

MATLAB is a tool that is commonly used in systems engineering and in other engineering disciplines. This tool has been applied to a wide range of engineering disciplines, including aerospace engineering and bioengineering. This tool should be included in cybersecurity engineering as well. The versatility of this modeling tool makes it an effective tool in many diverse engineering disciplines.

Reliability analysis is another important component of systems engineering—and one that would be well applied to cybersecurity engineering. Reliability engineering and analysis is the process of determining how reliable a given system is. Often in cybersecurity, systems are implemented without knowledge of their reliability. Reliability engineering includes a number of techniques and formulas for determining reliability.

One hallmark of all engineering disciplines is quantifiable data. It is necessary to have objective metrics in order to make informed decisions. Reliability engineering includes a number of formulas that can assist in acquiring such metrics. Fortunately, many of these do not require advanced mathematical knowledge.

The mean squared deviation formula is relatively simple and provides insight into how any system deviates from expectations. This formula is shown in Figure 15.3.

Figure 15.3 Mean squared deviation formula.

In this formula, yi is the actual value (that is, how the system was supposed to perform), and T is the target value.

Adjusting the settings of controllable inputs allows one to alter the MSD. This is a relatively simple formula from reliability engineering that can be applied to the reliability of any cybersecurity system. This would be particularly useful in evaluating the efficacy of intrusion detection systems (IDSs) and antivirus software. The MSD formula could be coupled with modeling and simulation to fine-tune the cybersecurity system before it is put into operation.

The MSD formula naturally leads to the MPE formula. The mean percentage error (MPE) is the mean number of errors from modeling, that is, the mean error of the model versus actual values. This is critical in modeling as it can be used to evaluate the efficacy of the model itself. Figure 15.4 shows the MPE formula.

Figure 15.4 Mean percentage error formula.

In this formula, n is the number of different times for which the variable is forecast, at is the actual value of the quantity being forecast, and ft is the forecast.

In addition to useful formulas for cybersecurity engineering, reliability engineering involves concepts that are applicable to cybersecurity. For example, the concept of mean time between failures (MTBF) estimates the mean time before a component will fail. For an antivirus software solution this could be the mean time before a given file is misidentified as being a virus or not being a virus. The mean time between failures can be calculated as shown in Figure 15.5.

Figure 15.5 MTBF Formula 1.

This formula appears in some cybersecurity books (including this one) and is addressed in some certification courses. A more accurate explanation of the MTBF formula can be defined as the arithmetic mean value of the reliability function R(t), which can be expressed as the expected value of the density function f(t) of time until failure. This requires integral calculus, which is shown in Figure 15.6.

Figure 15.6 MTBF Formula 2.

Don’t panic if this is new math to you. That symbol is the definite integral. I believe integration is often covered in calculus II in many universities. Clearly the MTBF formula has a clear application to cybersecurity. Understanding when a device is expected to fail is useful information. This can first be a measure of the efficacy of a given cybersecurity device or component. It can also be useful in evaluating whether any system or subsystems failure is expected or not. Furthermore, an unexpected failure could indicate an attack. However, this also indicates the need for at least basic calculus as a part of a cybersecurity curriculum.

Another concept from reliability engineering is the mean time to repair (MTTR). That is another metric that actually is currently covered in many cybersecurity books and certification courses. Continuing with the example of an antivirus software suite, what is the mean time after a virus that is not interdicted for a system to recover from the virus infection. This data would allow the cybersecurity engineer to objectively evaluate the cybersecurity system in question.

As outlined previously, cybersecurity engineering is appropriate viewed as a subdiscipline of systems engineering. By integrating elements from other domains within systems engineering, cybersecurity can be elevated to a true engineering discipline. This requires integration of reliability engineering and requirements engineering into cybersecurity. Furthermore, cybersecurity engineering requires implementing robust and effective modeling techniques. The end result of these efforts is a formal cybersecurity engineering discipline. This engineering discipline is then well defined, and the professional requirements much clearer than the current state of the cybersecurity profession.

Standards

Every engineering discipline has specific standards. The cybersecurity industry has many standards as well; however, to truly be considered cybersecurity engineering, these standards take on a more prominent role. They must be embraced fully. A few of those standards are described in the sections that follow.

RMF

NIST SP 800-37, “Guide for Applying the Risk Management Framework,” is the guiding document for this standard. It outlines specific steps:

Categorize: Determine the criticality of the asset in terms of potential adverse impacts on the organization, mission/business functions, and the system.

Select: Select security controls starting with the appropriate baseline using the selection process from the previous step. NIST has identified 18 categories of security controls (NIST SP 800-53), as outlined in Table 15.1.

Table 15.1 NIST 800-53 Security Control Families

ID

Family

ID

Family

AC

Access Control

MP

Media Protection

AT

Awareness and Training

PE

Physical and Environmental Protection

AU

Audit and Accountability

PL

Planning

CA

Security Assessment and Authorization

PS

Personnel Security

CM

Configuration Management

RA

Risk Assessment

CP

Contingency Planning

SA

System and Services Acquisition

IA

Identification and Authentication

SC

System and Communications Protection

IR

Incident Response

SI

System and Information Integrity

MA

Maintenance

PM

Program Management

Implement: Implement security controls within assets using sound system security engineering practices.

Assess: Determine the effectiveness of security controls and whether they are operating as intended. Also assess whether such controls meet security requirements and goals.

Authorize: Examine the output of the security controls assessment to determine whether the risk is acceptable.

Monitor: Continuously monitor the controls that are implemented for the system and its environment of operation for possible changes, signs of attack, and so on that might affect controls, and reassess the effectiveness of the controls.

ISO 27001

ISO 27001, “Standard for Information Security Management System (ISMS),” provides a framework to assist in securing systems regardless of industry or the size of the organization. You have probably heard of or even been involved in ISO 27001 audits. The standard has 14 different domains:

Images A.5: Information Security Policies: The controls in this section describe how to handle information security policies.

Images A.6: Organization of Information Security: The controls in this section provide a basic framework for the implementation and operation of information security by defining the internal organization (for example, roles, responsibilities, and so on), as well as organizational aspects of information security, such as project management, use of mobile devices, and teleworking.

Images A.7: Human Resources Security: The controls in this section ensure that people who are under the organization’s control are hired, trained, and managed in a secure way; it also addresses the principles of disciplinary action and terminating agreements.

Images A.8: Asset Management: The controls in this section ensure that information security assets (for example, information, processing devices, storage devices, and so on) are identified, that responsibilities for their security are designated, and that people know how to handle them according to predefined classification levels.

Images A.9: Access Control: The controls in this section limit access to information and information assets according to real business needs. These controls are for both physical and logical access.

Images A.10: Cryptography: The controls in this section provide a basis for proper use of encryption solutions to protect the confidentiality, authenticity, and/or integrity of information.

Images A.11: Physical and Environmental Security: The controls in this section prevent unauthorized access to physical areas and protect equipment and facilities from being compromised by human or natural intervention.

Images A.12: Operations Security: The controls in this section ensure that the IT systems, including operating systems and software, are secure and protected against data loss. Additionally, controls in this section require the means to record events and generate evidence, periodic verification of vulnerabilities, and make precautions to prevent audit activities from affecting operations.

Images A.13: Communications Security: The controls in this section protect the network infrastructure and services, as well as the information that travels through them.

Images A.14: System Acquisition, Development, and Maintenance: The controls in this section ensure that information security is taken into account when purchasing new information systems or upgrading existing ones.

Images A.15: Supplier Relationships: The controls in this section ensure that outsourced activities performed by suppliers and partners also use appropriate information security controls and describe how to monitor third-party security performance.

Images A.16: Information Security Incident Management: The controls in this section provide a framework to ensure the proper communication and handling of security events and incidents so that they can be resolved in a timely manner; they also define how to preserve evidence, as well as how to learn from incidents to prevent their recurrence.

Images A.17: Information Security Aspects of Business Continuity Management: The controls in this section ensure the continuity of information security management during disruptions and the availability of information systems.

Images A.18: Compliance: The controls in this section provide a framework to prevent legal, statutory, regulatory, and contractual breaches, and they audit whether information security is implemented and is effective according to the defined policies, procedures, and requirements of the ISO 27001 standard.

ISO 27001 also lists 114 security controls. This standard is one of the most widely accepted cybersecurity standards. Integrating the requirements of this standard into your cybersecurity engineering approach will improve your systems security.

ISO 27004

The ISO 27004 standard is all about metrics. Recall the SMART acronym from earlier in this chapter and remember that all requirements must be measurable. ISO 27004 is helpful in ensuring that your security systems have measurable metrics. Specifically, ISO 27004 offers guidelines on how to determine the performance of ISO 27001. You can certainly use ISO 27004 without ISO 27001, but ISO 27004 was created to provide metrics for ISO 27001. Security metrics can provide insight into the efficacy of a security system. Metrics are central to the processes of an engineer. If you cannot measure something, it very likely is not engineering.

NIST SP 800-63B

NIST SP 800-63B, “Digital Identity Guidelines,” provides guidance for authentication. Specifically, it identifies authenticator assurance levels (that is, how reliable a given level of authenticator assurance is).

Assurance level 1 includes:

Images Memorized Secret (Section 5.1.1)

Images Look-Up Secret (Section 5.1.2)

Images Out-of-Band Devices (Section 5.1.3)

Images Single-Factor One-Time Password (OTP) Device (Section 5.1.4)

Images Multi-Factor OTP Device (Section 5.1.5)

Images Single-Factor Cryptographic Software (Section 5.1.6)

Images Single-Factor Cryptographic Device (Section 5.1.7)

Images Multi-Factor Cryptographic Software (Section 5.1.8)

Images Multi-Factor Cryptographic Device (Section 5.1.9)

Assurance level 2 includes:

Images When a multi-factor authenticator is used, any of the following MAY be used:

Images Multi-Factor OTP Device (Section 5.1.5)

Images Multi-Factor Cryptographic Software (Section 5.1.8)

Images Multi-Factor Cryptographic Device (Section 5.1.9)

Images When a combination of two single-factor authenticators is used, it SHALL include a Memorized Secret authenticator (Section 5.1.1) and one possession-based (i.e., “something you have”) authenticator from the following list:

Images Look-Up Secret (Section 5.1.2)

Images Out-of-Band Device (Section 5.1.3)

Images Single-Factor OTP Device (Section 5.1.4)

Images Single-Factor Cryptographic Software (Section 5.1.6)

Images Single-Factor Cryptographic Device (Section 5.1.7)

Assurance level 3: AAL3 authentication SHALL occur by the use of one of a combination of authenticators satisfying the requirements in Section 4.3. Possible combinations are:

Images Multi-Factor Cryptographic Device (Section 5.1.9)

Images Single-Factor Cryptographic Device (Section 5.1.7) used in conjunction with Memorized Secret (Section 5.1.1)

Images Multi-Factor OTP Device (software or hardware) (Section 5.1.5) used in conjunction with a Single-Factor Cryptographic Device (Section 5.1.7)

Images Multi-Factor OTP Device (hardware only) (Section 5.1.5) used in conjunction with a Single-Factor Cryptographic Software (Section 5.1.6)

Images Single-Factor OTP Device (hardware only) (Section 5.1.4) used in conjunction with a Multi-Factor Cryptographic Software Authenticator (Section 5.1.8)

Images Single-Factor OTP Device (hardware only) (Section 5.1.4) used in conjunction with a Single-Factor Cryptographic Software Authenticator (Section 5.1.6) and a Memorized Secret (Section 5.1.1)

SecML

This section is adapted from a paper written by the book’s author. That paper first defined Security Modeling Language (SecML) as a new modeling language.

Systems engineering utilizes a number of approaches to modeling systems and subsystems. Modeling is an integral part of design and testing. In fact, there is an entire field of model-based systems engineering. One of the primary modeling methods utilized in systems engineering is Systems Modeling Language (SysML). SysML is an extension of the earlier Unified Modeling Language (UML). UML was created by the Object Management Group (OMG) in order to design software. SysML extends that to modeling a wide range of systems. SysML includes nine diagrams, some of which are taken directly from UML and others of which were created for SysML.

Software engineering also includes a number of other modeling languages. For example, there are domain-specific modeling languages, such as framework-specific modeling languages (FSMLs). FSMLs are used in object-oriented programming. There are multiple, specific modeling languages for a wide range of software engineering applications.

SysML was developed for modeling systems and systems of systems. SysML is the primary modeling tool used in systems engineering. It was originally developed as an open-source specification that extended UML. In 2001 INCOSE started the SysML initiative. Eventually INCOSE worked with the OMG to create SysML. SysML v1.0 was released in 2007. The current version of SysML is 1.5 and was introduced in 2017. It is specified in ISO Standard 19514:2017, “Information Technology: Object Management Group Systems Modeling Language (OMG SysML).” A revision to version 1.9 was released in 2019.

As has been discussed, there are specific modeling techniques and even modeling languages for particular engineering disciplines. If cybersecurity engineering is to be truly defined as a separate engineering discipline, it would also benefit from its own modeling language. This would facilitate modeling that is tailored to cybersecurity needs.

An important part of systems engineering is modeling. In fact, there is an entire subdiscipline of systems engineering concerned with modeling. The concept is to facilitate better understanding of a system at any stage in the system development life cycle. Being able to simulate and model system behavior can even be used during requirements gathering. This fact supports the need for cybersecurity engineering to include a modeling language.

It is clear the modeling is an integral part of engineering, and particularly systems engineering. It is also true that modeling has been used, in a limited fashion in some aspects of cybersecurity. These facts support the need for a cybersecurity specific modeling language.

What is being proposed in this chapter is a modification to SysML in order to facilitate modeling in security. This modeling is termed SecML and is used to model security needs. The SecML definition uses some SysML and UML diagrams and adds a few new diagrams. The concept is to provide a modeling language that is specific to cybersecurity. Software engineering uses UML and systems engineering SysML; it is only natural that cybersecurity engineering should have a modeling language specific to the domain.

SecML Concepts

The general concept for Security Modeling Language (SecML) is to provide a modeling tool that can be used to effectively model both cyber-attack scenarios and defense postures. Given that cybersecurity involves systems of systems, it is appropriate to begin with SysML as a basis and modify that modeling language to formulate SecML.

Some of the diagram types are very similar to SysML diagrams, with only slight modifications. Other diagram types were created explicitly for cybersecurity applications. Unlike in UML, the language SysML is based on, the diagrams in SecML are not divided into categories such as structural, behavioral, or interaction. However, some clearly are oriented toward behavior or structure. It might seem advantageous to divide the diagrams into attack or defense-oriented diagrams; however, this was intentionally not done. Clearly diagram types such as the misuse-case diagram are appropriate for attack modeling. Similarly, the security block diagram (SBD) could be viewed as a defense-oriented diagram type. However, other diagrams such as the security sequence diagram are appropriate for both attack and defense. Therefore, the diagrams are not divided into attack and defense categories.

Misuse-Case Diagram

The first SecML diagram, and the easiest to understand, is the misuse-case diagram (MCD). Both SysML and UML utilize use-case diagrams in order to understand how users interact with a given system. Users also include other systems that might use a given system. For security purposes, the largest concern is on how an attacker might misuse a system. Therefore, it is logical to diagram misuse cases. The essence of an attack is misusing a system. Figure 15.7 shows a typical use-case diagram.

Figure 15.7 Typical use-case diagram.

In the traditional use-case diagram, some relatively simple elements are utilized. The image that appears to be a stick figure is used to represent any user of the system. This can, of course, be a human user. However, another system can in fact be a user and will still be depicted with the stick figure. Activities that are done in the system are labeled ovals. The connection between a user and a system action is represented via a line. Furthermore, when one activity extends another, that relationship is demonstrated with the dotted line and the <<extends>> label.

The UML use-case diagram has been widely used to model specific uses of a system of interest. Its utility derives from the ease of understanding it. The diagram elements are self-evident and easily understood. That is one reason why this particular UML diagram is useful in communicating with nontechnical stakeholders.

The concept of misuse cases already exists. However, the modification here is to have formal notation for the misuse. The logical starting point is the UML use-case diagram that is then modified to demonstrate misuses. This involves adding/modifying some symbolism. For the SecML misuse-case diagram, the notations shown in Figure 15.8 are added.

Figure 15.8 Misuse-case notation.

Figure 15.9 shows an exemplary use-case diagram. The diagram shows a normal user and an abuser misusing the system. It also shows which activities have some mitigation provided to address misuse and which do not yet have any mitigating factors.

Figure 15.9 Misuse-case diagram example.

The diagram can be enhanced with additional notation. For example, the indication of a countermeasure could be further described, indicating what the countermeasure is. A number is also indicated on the countermeasure symbol indicating that there are multiple countermeasures. The number of mitigating factors would be an integer inside the circle with the X, as illustrated in Figure 15.10.

Figure 15.10 Another misuse-case example.

Figure 15.9 would then be enhanced with explanatory notes about the countermeasures employed. For example, the countermeasures could be (1) policy against downloading attachments and (2) antivirus to counter viruses sent from an abuser/attacker to a victim. The misuse-case diagram allows a cybersecurity engineer to model how the attacker would misuse the system, and what countermeasures are currently in place. More importantly, by modeling all misuse cases, it will become obvious which attack vectors have adequate mitigation measures and which do not.

Figure 15.11 provides a specific example of a misuse case. This figure shows a normal, authorized user logging in to the system. It also shows an abuser (that is, an attacker) sending an email with a malware attachment. It can be seen clearly how the abuser is misusing the normal process of sending email. It is also clear in this example that the abuser’s remote login is blocked by two mitigating factors, but there are not mitigating factors for sending email with malware attachments.

Figure 15.11 Specific misuse-case example.

Obviously, Figure 15.11 presents a rather simplified example; however, it illustrates the utility of this diagram. It immediately clarifies the attack vectors an abuser might use. Furthermore, it becomes abundantly clear that there appears to be adequate mitigation for remote connections, but not for sending malicious emails. That lack of mitigation would also facilitate phishing campaigns. The concept is that misuse-case diagrams should be created for all attack vectors to facilitate modeling and understanding of attacks, as well as selection and application of mitigating countermeasures.

Security Sequence Diagram

In SysML a sequence diagram shows how objects interact over time. Specifically, sequence diagrams show how actions are related between objects. In a security context, this is of significant importance. In any attack scenario, the sequence of data flow from one object to another is critical to the analysis. This is also applicable for defense and mitigation strategies. Understanding how an intrusion detection system interacts with security information event management (SIEM) is relevant to modeling the security of any system of interest. It would be possible to utilize the sequence diagram as it exists in SysML without any modification for security purposes.

While the sequence diagram could be used without any modification for security purposes, slight modifications would improve its utility. Thus, SecML defines a minor modification to the sequence diagram named the security sequence diagram (SSD). In SecML the sequence diagram is used in almost the same manner as it is in SysML. Figure 15.12 shows the current UML/SysML sequence diagram.

Figure 15.12 UML/SysML sequence diagram.

The sequence diagram demonstrates a sequence of actions; however, these models were meant to diagram intended activities, not attacks. To modify the sequence diagram involves adding/modifying some symbolism. For the SecML, the notation shown in Figure 15.13 is added to the security sequence diagram.

Figure 15.13 Cybersecurity addition to sequence diagrams.

Traditional sequence diagrams do not differentiate between authorized and unauthorized actions. In fact, nothing in SysML even contemplates unauthorized activities. However, in cybersecurity, unauthorized actions are of critical importance. Figure 15.14 shows an exemplary modified sequence diagram.

Figure 15.14 Modified sequence diagram.

As in a traditional SysML sequence diagram, the messages are still written with the message name above and the directionality of the message. However, the modification for SecML allows one to differentiate between normal operations and unauthorized actions. Seeing unauthorized and authorized actions as they actually occur in a system provides a very effective understanding of system operations.

The modified sequence diagram provides an overview of the sequence of events in any cyber attack. This allows the cybersecurity engineer to model various attacks. Coupling the security sequence diagram with a misuse-case diagram provides an effective overview of the attack vector in question.

Data Interface Diagram

This diagram type is created specifically for SecML. The data interface diagram (DID) is used to provide the cybersecurity engineer an understanding of data flow in the system of interest. It models the flow of data into and out of any system. The concept is to look at any system or subsystem and diagram all interfaces for data to flow into and out of the system of interest. Any place that data can flow is an area for security concerns. Data flowing outward can lead to data exfiltration. Data flowing inward can lead to malware being introduced to the system. This is shown in Figure 15.15.

Figure 15.15 Data interface diagram.

Figure 15.16 shows the specific elements of a data interface diagram.

Figure 15.16 Data interface diagram elements.

This diagram is intentionally simple. The goal is to make the process one that cybersecurity engineers can efficiently use with minimal training required. The concept is to ensure that all data flow points have been identified, and that mitigation measures have been identified. This diagram is used to examine the system of interest and to determine what, if any, mitigation strategies have been put into place for each data interface. This is essentially a limited interface diagram.

Security Block Diagram

UML, which was the basis for SysML, has a component diagram. In UML, component diagrams are used to identify components in software and to model how they connect. For example, UML contains assembly connectors that model a connection when one component requires another component. The delegation connector links an external component.

This section described the foundations of SecML, which is based on the preexisting SysML. It may be that further research leads to enhancements to these models and the addition of new models to SecML. As with all other modeling languages, it is expected that SecML will be revised and expanded.

Modeling

When considering threats, modeling is an important topic. Essentially all cybersecurity engineering is directed toward some threat. The concept of modeling is to ensure that you are building your security to counter the threats specific to your systems.

STRIDE

Threat modeling is important in any cybersecurity approaches. Microsoft created the acronym STRIDE for identifying security threats in six separate categories: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privileges. When using this tool, it is important to ensure that you are modeling all of the enumerated threats.

PASTA

Process for Attack Simulation and Threat Analysis (PASTA) is a risk-centric seven-step methodology for evaluating risk. As the name suggests, it is about simulating attacks in order to analyze the threats. PASTA was developed in 2012. Table 15.2 lists the seven stages.

Table 15.2 Seven Stages of PASTA

Stage

Description

Define objectives

Identify business objectives

Identify security and compliance requirements

Perform business impact analysis

Define technical scope

Determine the boundaries of the technical environment

Capture infrastructure dependencies

Application decomposition

Identify use cases

Define entry points and trust levels

Identify threat actors

Perform data flow diagramming

Determine trust boundaries

Threat analysis

Examine probabilistic attack scenarios

Perform regression analysis on security events

Perform threat intelligence correlation

Vulnerability and weakness analysis

Review existing vulnerability reports

Analyze design flaws and abuse cases

Review scorings such as CVSS and CVE

Attack modeling

Perform attack surface analysis

Perform attack tree development

Match vulnerabilities and exploits to attack trees

Risk and impact analysis

Qualify and quantify business impact analysis

Identify countermeasures

Perform residual risk analysis

Identify risk mitigation strategies

DREAD

DREAD is a mnemonic for risk rating using five categories: damage potential, reproducibility, exploitability, affected users, and discoverability. How much damage would an attack cause? How easy is it for an attacker to reproduce this attack? How much effort is required to execute the attack? How many users will be impacted? Finally, how easy is it to discover the threat?

Summary

In this chapter, you have seen the application of systems engineering to cybersecurity. The goal is that you would begin to apply a methodical, systematic approach to cybersecurity. Penetration testing, as one example, should not be just a set of random hacking attempts. Rather, it should be a carefully engineered process that is mapped to specific testing requirements. It is also beneficial to model cybersecurity scenarios in order to better understand system security requirements. The SecML modeling language that was briefly introduced in this chapter provides such a methodology.

Test Your Skills

Multiple Choice Questions

1. What type of diagram is used to show how any entity might interact with a system?

A. Use-case diagram

B. Sequence diagram

C. Data interface diagram

D. Requirements diagram

2. What is the most appropriate tool for capturing the requirements of any security process or system?

A. Use-case diagram

B. Sequence diagram

C. SysML

D. Traceability matrix

3. Which of the following cybersecurity activities would be most accurately described as engineering?

A. Implementing complex IPS rules

B. Implementing asymmetric cryptography

C. Creating a requirements traceability matrix

D. Conducting a forensic investigation

4. Which modeling language is used by systems engineers?

A. SecML

B. SysML

C. UML

D. DML

5. What does this symbol represent in SecML?

A. A forbidden action

B. A blocked system

C. A countermeasure

D. An attack

6. What does this symbol represent in SecML?

A. Attack victim

B. System abuser

C. System user

D. Isolated user

7. What does this symbol represent in SecML?

A. Blocked activity

B. External attack

C. Unauthorized activity

D. Internal attack

8. What standard has 14 domains?

A. ISO 27001

B. RMF

C. NIST 800-63B

D. STRIDE

9. How many assurance levels are there in NIST 800-63B?

A. 14

B. 3

C. 4

D. 0

10. Which are the elements of STRIDE?

A. Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privileges

B. Spyware, tampering, repudiation, information disclosure, denial of service, execution

C. Spoofing, tampering, reflection attack, information disclosure, denial of service, elevation of privileges

D. Spoofing, threats, repudiation, information disclosure, denial of service, execution

Exercises

EXERCISE 15.1: Misuse-Case Diagram

Create a misuse-case diagram for a specific type of attack. You can choose any attack described in this book.

EXERCISE 15.2: Requirements Gathering

Consider the cybersecurity requirements of a college campus. Create a requirements traceability matrix for penetration testing a campus computer network.

Glossary

This section contains terms from both hackers and security professionals. To truly understand computer security, you must be familiar with both worlds. General networking terms are also included in this Glossary.

admin: Short for system administrator.

adware: Software that is used to display advertisements.

AES: Advanced Encryption Standard; a symmetric cipher that uses 128-, 192-, or 256-bit keys.

APT: Advanced persistent threat; an attack that takes place over a long period of time using multiple advanced techniques.

audit: A check of a system’s security. This check usually includes a review of documents, procedures, and system configurations.

authentication: The process of proving that someone is who he claims to be.

backdoor: A hole in a security system that is deliberately left by the creator of the system.

bid shielding: Putting a fake but very high bid on an item to discourage other bidders from bidding on it.

bid siphoning: Attempting to lure bidders from a legitimate site to a site that may be used for malicious purposes, such as phishing.

black hat hacker: Someone who uses hacking skills for malicious and illegal purposes.

BlowFish: A well-known symmetric key encryption algorithm that uses a variable-length key and was invented by Bruce Schneier.

blue team: The defensive team in a penetration testing exercise.

braindump: The act of telling someone everything one knows.

breach: To successfully break into a system; to get past security.

brute force: To try to crack a password by simply trying every possible combination.

bug: A flaw in a system.

Caesar cipher: One of the oldest encryption algorithms. It uses a basic mono-alphabetic cipher.

CHAP: Challenge Handshake Authentication Protocol; a commonly used authentication protocol.

CIA triangle: A common security acronym for confidentiality, integrity, and accessibility.

cipher: Synonym for cryptographic algorithm.

cipher text: Encrypted text.

code: The source code for a program; or the act of programming, as in “to code an algorithm.”

codegrinder: An unflattering reference to one who works in an uncreative corporate programming environment.

cookie: A small bit of data, often in plain text, that is stored by web browsers.

cracker: One who breaks into a system in order to do something malicious, illegal, or harmful. Synonymous with black hat hacker.

cracking: Breaking into a system or code.

crash: A sudden and unintended failure, as in “My computer crashed.”

cryptography: The study of encryption and decryption.

cyber fraud: Using the Internet to defraud someone.

cyber stalking: Using the Internet to harass someone.

DDoS: Distributed denial of service; a type of denial of service attack launched from multiple source locations.

demigod: A hacker with years of experience who has a national or international reputation.

DES: Data Encryption Standard; a block cipher that was developed in the 1970s. It uses a 56-bit key on 64-bit blocks. It is no longer considered secure enough.

Diffie-Hellman: An asymmetric protocol used for key exchange.

DoS: Denial of service; a type of attack that prevents legitimate users from accessing a resource. This is usually done by overloading the target system with more workload than it can handle.

Doxing: The process of finding personal information about an individual and broadcasting it, often via the Internet.

EDoS: Economic denial of sustainability (EDoS); a type of denial of service attack that involves bots sending fake requests in order to disrupt or discontinue the availability of cloud resources.

elliptic curve: A class of algorithms that provides asymmetric encryption.

Encrypting File System: Also known as EFS, Microsoft’s file system that allows users to encrypt individual files. It was introduced in Windows 2000.

encryption: The act of encrypting a message. Encryption usually involves altering a message so that it cannot be read without the key and the decryption algorithm.

espionage: The process of illicitly gathering information, usually from a government or corporate source.

ethical hacker: One who hacks into systems to accomplish some goal that he feels is ethically valid. Often called a penetration tester.

firewall: A device or software that provides a barrier between your machine or network and the rest of the world.

gray hat hacker: A hacker who usually obeys the law but in some instances will cross the line into black hat hacking.

hacker: One who tries to learn about a system by examining it in detail and reverse engineering.

hash: An algorithm that takes variable-length input and produces fixed-length output and is not reversible.

honey pot: A system or server designed to be very appealing to hackers that is, in fact, a trap to catch them.

hub: A device for connecting computers.

IKE: Internet Key Exchange; a method for managing the exchange of encryption keys.

information warfare: Attempts to influence political or military outcomes via information manipulation.

intrusion detection system (IDS): A system for detecting attempted intrusions.

IP: Internet Protocol; one of the primary protocols used in networking.

IPsec: Internet Protocol Security; a method used to secure VPNs.

IP spoofing: Making packets seem to come from a different IP address than they really originated from.

key logger: Software that logs keystrokes on a computer.

MAC address: The physical address of a network card. It is a 6-byte hexadecimal number. The first 3 bytes define the vendor.

malware: Any software that has a malicious purpose, such as a virus or a Trojan horse.

MD5: Message Digest 5; a cryptographic hashing algorithm.

MS-CHAP: A Microsoft extension to Challenge Handshake Authentication Protocol (CHAP).

multi-alphabet substitutions: Encryption methods that use more than one substitution alphabet.

NIC: Network interface card; a device that provides connectivity to a network.

packet filter firewall: A firewall that scans incoming packets and either allows them to pass or rejects them. It only examines the header, not the data, and does not consider the context of the data communication.

penetration testing: Assessing the security of a system by attempting to break into the system. Penetration testing is the activity of most penetration testers.

phreaker: Someone who hacks into phone systems.

port scan: The process of sequentially pinging ports to see which ones are active.

PPP: Point-to-Point Protocol; a somewhat old connection protocol.

PPTP: Point-to-Point Tunneling Protocol; an extension to PPP for VPNs.

proxy server: A device that hides internal IP addresses and presents a single IP address to the outside world.

red team: A penetration testing team that emulates a specific type of attacker.

router: A device that connects two networks.

RSA: A public key encryption method developed in 1977 by three mathematicians: Ron Rivest, Adi Shamir, and Leonard Adleman. The name RSA is derived from the first letter of each mathematician’s last name.

RST cookie: A simple method for alleviating the danger of certain types of DoS attacks.

script kiddy (or kiddie): A slang term for an unskilled person who purports to be a skilled hacker.

SHA: Secure Hashing Algorithm; a cryptographic hash that has several versions: SHA1, SHA2 (with variations), and SHA3.

Smurf: A specific type of distributed denial of service attack.

sneaker: Someone who is attempting to compromise a system in order to assess its vulnerability. This is an old term; most people use the term penetration tester today.

sniffer: A program that captures data as it travels across a network. Also called a packet sniffer.

snort: A widely used open-source intrusion detection system.

social engineering: The use of persuasion on human users in order to gain information required to access a system.

SPAP: Shiva Password Authentication Protocol; a proprietary version of Password Authentication Protocol (PAP) that basically adds encryption to PAP.

spoofing: Pretending to be something else, as when a packet might spoof another return IP address (as in a Smurf attack) or when a website is spoofing a well-known e-commerce site.

spyware: Software that monitors computer use.

stack tweaking: A complex method for protecting a system against DoS attacks. This method involves reconfiguring the operating system to handle connections differently.

stateful packet inspection: A type of firewall that not only examines packets but knows the context within which the packet was sent.

symmetric key system: An encryption method where the same key is used to encrypt and decrypt the message.

SYN cookie: A method for ameliorating the dangers of SYN floods.

SYN flood: The process of sending a stream of SYN packets (requests for connection) and then never responding, thus leaving the connection half open.

tribal flood network: A tool used to execute DDoS attacks.

Trojan horse: Software that appears to have a valid and benign purpose but really has another, nefarious purpose.

virus: Software that is self-replicating and spreads like a biological virus.

war-dialing: Dialing phones and waiting for a computer to pick up. War-dialing is usually done via some automated system.

war-driving: Driving and scanning for wireless networks that can be compromised.

white hat hacker: A hacker who does not break the law; often synonymous with ethical hacker.

worm: A virus that can spread without human intervention.

Appendix A

Resources

Note: The links in this appendix are valid as of September 2022.

General Computer Crime and Cyber Terrorism

Cybercrime: https://www.justice.gov/criminal-ccips

Computer security: https://www.sei.cmu.edu/about/divisions/cert/index.cfm

Symantec’s antivirus site: https://www.broadcom.com/support/security-center

FBI cyber crime: https://www.fbi.gov/investigate/cyber

General Knowledge

Hellbound Hackers: https://hbh.sh/home

Dark Reading: https://www.darkreading.com

Cyber Stalking

Norton: https://us.norton.com/internetsecurity-how-to-what-is-cyberstalking.xhtml

Identity Theft

Federal Trade Commission: https://consumer.ftc.gov/features/identity-theft

Identity Theft Resource Center: https://www.idtheftcenter.org

Port Scanners and Sniffers

Nmap: https://nmap.org

SecTools: https://sectools.org/tag/port-scanners/

Password Crackers

Ophcrack: http://ophcrack.org

Password crackers: https://resources.infosecinstitute.com/topic/10-popular-password-cracking-tools/

Countermeasures

Various security and hacking tools: insecure.org

Snort, an open-source IDS: https://www.snort.org/ The SANS Institute Cyber Security Tools: https://www.sans.org/tools/

The Association of Computing Machinery IDS page: https://xrds.acm.org

Cyber Investigation Tools

Whois tool: https://whois.domaintools.com

Viewing previous versions of websites: https://archive.org

General Tools

Scanning tool: http://www.rawlogic.com/netbrute/

Virus Research

CNET virus center: https://www.cnet.com/tech/services-and-software/cybersecurity/

F-Secure: https://www.f-secure.com/us-en

vxHeaven: https://vxug.fakedoma.in/archive/VxHeaven/vx.php@tbs=1.xhtml

Appendix B

Answers to the Multiple Choice Questions

Chapter 1

1. C

2. B

3. B

4. B

5. A

6. C

7. D

8. A

9. C

10. A

11. C

12. A

13. A

14. A

15. B

16. A

17. B

18. B

19. C

20. C

Chapter 2

1. D

2. D

3. A

4. C

5. A

6. B

7. B

8. D

9. A

10. C

11. A

12. B

13. C

14. B

15. C

16. C

17. B

18. A

19. A

20. C

21. A

22. B

23. A

24. A

25. B

Chapter 3

1. A

2. B

3. C

4. A

5. A

6. B

7. C

8. B

9. A

10. C

11. B

12. B

13. D

14. B

15. C

16. A

17. C

18. B

19. A

20. B

21. A

22. D

23. C

24. A

Chapter 4

1. A

2. C

3. D

4. C

5. B

6. D

7. A

8. A

9. C

10. D

11. C

12. A

13. A

14. D

15. D

16. D

17. D

18. B

19. D

20. A

Chapter 5

1. D

2. A

3. B

4. C

5. A

6. A

7. A

8. A

9. C

10. D

11. A

12. B

13. A

14. D

15. C

16. B

17. D

18. D

19. A

20. D

Chapter 6

1. B

2. A

3. A

4. B

5. A

6. D

7. D

8. B

9. D

10. C

11. A

12. B

13. D

14. A

15. C

Chapter 7

1. D

2. A

3. C

4. D

5. C

6. A

7. A

8. B

9. A

10. A

11. B

12. A

13. A

14. B

15. D

Chapter 8

1. A

2. C

3. D

4. B

5. C

6. A

7. B

8. A

9. D

10. B

11. A

12. C

13. B

14. A

15. D

16. C

17. D

18. A

Chapter 9

1. A

2. C

3. D

4. B

5. C

6. A

7. A

8. A

9. D

10. A

11. A

12. A

13. A

14. A

15. B

Chapter 10

1. C

2. C

3. C

4. B

5. A

6. B

7. A

8. B

9. A

10. B

11. B

12. D

13. B

14. C

15. B

Chapter 11

1. C

2. A

3. A

4. C

5. B

6. A

7. D

8. C

9. D

10. B

11. C

12. D

13. D

14. B

15. A

16. B

17. C

18. C

19. A

20. D

Chapter 12

1. C

2. C

3. C

4. D

5. B

6. A

7. B

8. A

9. A

10. C

11. B

12. B

13. D

14. C

Chapter 13

1. A

2. B

3. B

4. D

5. D

6. B

7. B

8. C

9. A

10. D

11. C

12. B

13. A

14. D

15. A

Chapter 14

1. C

2. A

3. B

4. B

5. D

6. B

7. B

8. A

9. D

Chapter 15

1. A

2. D

3. C

4. B

5. C

6. B

7. C

8. B

9. B

10. A

Index

Numbers

3DES (3 Data Encryption Standard), 240

5G (Fifth Generation Wireless Systems), 454

6LoWPAN wireless protocol, 41

802.11a wireless connections, 39

802.11a Wireless Gigabyte Alliance wireless connections, 39

802.11ac wireless connections, 39

802.11af wireless connections, 39

802.11ah wireless connections, 39

802.11aj wireless connections, 39

802.11ax wireless connections, 39

802.11b wireless connections, 39

802.11be wireless connections, 39

802.11g wireless connections, 39

802.11n wireless connections, 39

802.11n-2009 wireless connections, 39

2014 Data Breach Investigation Report (Verizon), 18

A

abelian (commutative) groups, 242

acceptance, risk assessments, 7

access control, 321–322

ACK, SYN.ACK communications, 50

active code scanning, 271

active IDS (Intrusion Detection Systems), 280

active scanning techniques, 169

connect scans, 170

enumeration, 174–175

FIN probes, 173

FIN scans, 171

FTP bounce scans, 173

ping scans, 170

port scanning, 169–173

Shodan, 175–176

SNMP scans, 173

SYN scans, 171

vulnerability assessments, 173

active state, cell phones, 452

activities, security

auditing, 21

authentication, 21

administration policies, 316

breaches, 319–321

change requests, 317–319

departing employee policies, 316–317

DoS attacks, 320

hacker intrusions, 320–321

new employee policies, 316

viruses, 319–320

advertised relay nodes, The Dark Web, 193

AES (Advanced Encryption Standard), 240–242

age of passwords, 344

AI (Artificial Intelligence) and information warfare, 395–396

ALE (Annualized Loss Expectancy), 6

algorithms

encryption, 237

hashing

HMAC, 254

MAC, 254

MD5, 253

RIPEMD, 254

SHA, 253–254

alphabet substitution

Atbash cipher, 230–231

Caesar cipher, 229–230

mono-alphabet substitution, 230

multi-alphabet substitution, 231

Vigenere cipher, 231

analysis

cryptanalysis, 257–258

frequency analysis, 258

AND operations, 235

Android, cyber forensics, 455–456

ANT+ wireless protocol, 41

anti-malware, 157

antispyware, 278–279

antivirus software, 153–156, 272

Apple viruses 1, 2, and 3, 140

application gateways, 274

Application layer (OSI network model), 60

Application layer (TCP/IP network model), 61

application-layer firewalls, 276

applications, patches, 338

approaches, security

hybrid security approaches, 23–24

layered security approaches, 23

passive security approaches, 23

perimeter security approaches, 23

APT (Advanced Persistent Threats), 152, 381

armored viruses, 133

ARO (Annual Rate of Occurrence), 6–7

ARP (Address Resolution Protocol), 56–57

arp command, 56–57

ASCLD (American Society of Crime Laboratory Directors), 437

assessing

risk, 7, 17–18

acceptance, 7

ALE, 6

ARO, 6

avoidance, 7

mitigation, 7

SLE, 6

system vulnerabilities, 5–6

threat inventories, 5–6

transference, 7

system security

overview, 337

patches, 337–338

physical security, 345–346

ports, 338–341

probes, 344–345

protection phase, 341–342

security checklists, 344

security policies, 343–344

Assessing and Managing Security Risk in IT Systems: A Structured Methodology, 21–22

assets

identifying, 203–205

information as an asset, 203–205

asymmetric (public-key) encryption, 227, 245

Diffie-Hellman key exchange, 250

elliptic curve cryptography, 250

PGP, 250–251

RSA encryption, 246–249

Atbash cipher, 230–231

Atlanta ransomware attack, 136

attachments

security policies, 312

virus scanners, 270

attacks. See threats

auction fraud, 78–79

bid shielding, 79

bid siphoning, 79, 80

CHAP, 289

security settings, 97–98

shill bidding, 79

audits, 21

audit monitors, 462

risk assessments, 5–6

system vulnerabilities, 6

authentication, 21

deauthentication attacks, 181

EAP, 289

EAP-TLS, 289

HMAC, 254

Kerberos, 289–292

LEAP, 289

MAC, 254

PAP, 288

PEAP, 289

SPAP, 289

autostart locations, cyber forensics, 450

avoidance, risk assessments, 7

AWS (Amazon Web Services), DoS attacks, 120

B

backups

differential backups, 326

full backups, 326

incremental backups, 326

old backup media, 349

bandwidth

Bluetooth connectivity, 40–41

cabling, 36–37

BASHLITE attack, 135–136

BCP (Business Continuity Plans), 325

Beard, Andrew, harassment, 85

BIA (Business Impact Analysis), 325

bids, auction fraud

bid shielding, 79

bid siphoning, 79, 80

shill bidding, 79

binary number conversions, 44

binary operations, ciphers, 235

AND operations, 235

OR operations, 235

XOR operations, 235–236

Black Basta virus, 134

black hat hackers, 19, 167

BlackEnergy, 383

blackholing, 122

blacklists/whitelists, 276–277

Black’s Law Dictionary, 84

block ciphers, 237

Blowfish, 243

Blue jacking, 181

blue teams, 167

Bluebugging, 181

Bluesnarfing, 181

Bluetooth connectivity, 40–41

bombs, logic, 9

boot sector viruses, 132

Boston Globe, 121

botnets, 119

breaches

2014 Data Breach Investigation Report (Verizon), 18

defined, 8

security policies, 319–321

bridge nodes, The Dark Web, 193

browsers

security settings, 92–97

TOR browser, 190–191, 400–401

Windows browsers, finding evidence in, 440–441

brute-force attacks, 182, 230

Brutus password cracking tool, 183

buffer-overflow attacks, 145–146

bugs/phone taps, industrial espionage, 211

Burkett, Alyssa, harassment, 85

BYOD (Bring Your Own Device), 314

C

cabling

bandwidth, 36–37

crossover cabling, 37

local networks, 35–37

speeds, 36–37

STP cabling, 36

types of, 35–36

uses of, 35–36

UTP cabling, 36

Caesar cipher, 229–230

CAPTCHA, login attacks, 119

cars, hacking, 17

Castillo, Andy, harassment, 85

CBC (Cipher Block Chaining) mode, 244

CC (Challenge Collapsar) attacks, 120

cell phones

active state, 452

attacks, 181

cellular networks, 453–454

cyber forensics

Android, 455–456

information to look for, 456–457

iOS, 454

states, 452

ICCID, 453

IMEI, 453

IMSI, 453

nascent state/factory default state, 452

quiescent state, 452

semi-active state, 452

SIM, 452

Cellebrite forensics tool, 440

cellular networks, 453–454

CERT (Computer Emergency Response Teams), 25, 204

certificates, digital, 292–293

certifications, 6

cyber forensics, 457–458

professional help, 366–368

Certified Ethical Hackers, 367

CFB (Cipher Feedback) mode, 244

chain of custody, 433

Chandler, James, identity theft, 81

change requests, 317–319

CHAP (Challenge Handshake Authentication Protocol), 289

chat rooms, 49

Chavarri, Johao, cyber stalking, 83

checklists, security, 344

children, crimes against, 88–90

China, cyber terrorism, 381

chosen plain text attacks, 258

Chrome (Google), security settings, 96

CIA triangle, 21–22

CIDR (Classless Interdomain Routing), 47

cipher text encryption, 237

cipher text only attacks, 259

ciphers

Atbash cipher, 230–231

block ciphers, 237

Caesar cipher, 229–230

Feistel ciphers, 237

Polybius cipher, 233

rail fence cipher, 232

Rijndael block cipher. See AES

Scytale cipher, 233

stream ciphers, 237, 243

transposition ciphers, 232

Vigenere cipher, 231

circuit-level gateways, 276

CISSP (Certified Information Systems Security Professionals), 367

civil court records, cyber detectives, 415–416

classes, IPv4 addresses, 44–45

classification policies, data, 323

CLD 6.3.1, 63

CLD 8.1.5, 63

CLD 9.5.1, 63

CLD 9.5.2, 63

CLD 12.1.5, 63

CLD 12.4.5, 63

CLD 13.1.4, 63

CLDAP reflection, 119–120

client errors, 48

Clop virus, 136

cloud computing, 61–64

audit monitors, 462

community clouds, 461

hypervisors, 462

logical network perimeters, 462

private clouds, 461

public clouds, 461

virtual forensics, 461–462

virtual storage, 462

COBO (Company-Owned/Business Only), 314

coding, malicious web-based, 150–151

command injection attacks, 181

commercial antivirus software, 272

community clouds, 62, 461

commutative (abelian) groups, 242

company searches, 413

company versus company, industrial espionage, 206

compromising system security

cracking attacks, 9

social engineering attacks, 10

war flying, 10

war-dialing, 10

war-driving, 10

Computer Security Act of 1987, 24

computer system security, 336–337

assessing

overview, 337

patches, 337–338

physical security, 345–346

ports, 338–341

probes, 344–345

protection phase, 341–342

security checklists, 344

security policies, 343–344

firewalls, 342

networks, 350–352

scanning techniques, 352–363

testing/scanning standards, 360–365

old backup media, 349

online resources, 346

professional help, 366–368

servers, 348–350

shutting down services in Windows, 339–340

workstations, 345, 346–348

concepts, security

CIA triangle, 21–22

McCumber cube, 21–22

privileges, 22

configuring

desktops, security policies, 313–314

firewalls, 272–275

connect scans, 170

connectivity

802.11a wireless connections, 39

802.11a Wireless Gigabyte Alliance wireless connections, 39

802.11ac wireless connections, 39

802.11af wireless connections, 39

802.11ah wireless connections, 39

802.11aj wireless connections, 39

802.11ax wireless connections, 39

802.11b wireless connections, 39

802.11be wireless connections, 39

802.11g wireless connections, 39

802.11n wireless connections, 39

802.11n-2009 wireless connections, 39

Bluetooth connectivity, 40–41

DSo connections, 38

Internet connection types, 38

ISDN connections, 38

local networks

cabling, 35–37

connection speeds, 38

hubs, 37

repeaters, 37

RJ-45 connectors, 35

routers, 38

switches, 37

terminators, 35

OC3 connections, 38

OC12 connections, 38

OC48 connections, 38

T1 connections, 38

T3 connections, 38

controlling information, 389–390

converting binary numbers, 44

cookies

poisoning, 180

TCP SYN flood attacks

RST cookies, 114

SYN cookies, 114

COPE (Company-Owned/Personally-Enabled), 314

court records, cyber detectives, 413, 415–416

COVID-19, Internet fraud, 75

Crack Station password cracking tool, 184

crackers, 167

cracking attacks, 9

password cracking, 182

brute-force attacks, 182

Brutus password cracking tool, 183

Crack Station password cracking tool, 184

dictionary attacks, 182

hybrid attacks, 182

John the Ripper password cracking tool, 183

ophcrack, 182–183

rainbow tables, 182

THC-Hydra password cracking tool, 184

WebCracker password cracking tool, 183

WebCracker password cracking tool, 183

credibility, evaluating cyber stalking threats, 87

Creeper virus, 140

crimes against children, 88–90

criminal checks, cyber detectives, 413

crossover cabling, 37

cross-site request forgeries, 180

Cross-Site Scripting (XSS) attacks, 13, 81–82, 179–180

cryptanalysis, 257–258

chosen plain text attacks, 258

cipher text only attacks, 259

known plain text attacks, 258

related-key attacks, 259

cryptography, 226–227

3DES, 240

AES, 240–242

algorithms, 237

asymmetric encryption, 227

Atbash cipher, 230–231

binary operations, 235

AND operations, 235

OR operations, 235

XOR operations, 235–236

block ciphers, 237

Blowfish, 243

Caesar cipher, 229–230

cipher text, 237

cryptanalysis, 257–258

chosen plain text attacks, 258

cipher text only attacks, 259

known plain text attacks, 258

related-key attacks, 259

decryption, 227

DES, 237–240

Diffie-Hellman key exchange, 250

digital signatures, 252

elliptic curve cryptography, 250

Enigma machine, 234–235

Feistel ciphers, 237

frequency analysis, 258

hashing, 253

HMAC, 254

MAC, 254

MD5, 253

RIPEMD, 254

SHA, 253–254

history of, 228–229

key schedules, 238

keys, 237

legitimate versus fraudulent encryption methods, 251–252

mono-alphabet substitution, 230

“old” encryption, 251

online resources, 228–229

PGP, 250–251

plain text, 237

Polybius cipher, 233

public-key (asymmetric) encryption, 245

Diffie-Hellman key exchange, 250

elliptic curve cryptography, 250

PGP, 250–251

RSA encryption, 246–249

quantum computing cryptography, 259–260

rail fence cipher, 232

rainbow tables, 254–255

Rijndael block cipher. See AES

RSA encryption, 246–249

Scytale cipher, 233

Serpent, 243

single-key (symmetric) encryption, 236, 237

3DES, 240

AES, 240–242

Blowfish, 243

CBC mode, 244

CFB mode, 244

DES, 237–240

ECB mode, 244

GCM, 245

PCBC mode, 244

RC4 stream ciphers, 243

Serpent, 243

Skipjack, 243

Skipjack, 243

steganography, 255–256

history of, 256–257

methods/tools, 257

stream ciphers, 237

substitution alphabets, 230

symmetric encryption, 227

transposition ciphers, 232

Vigenere cipher, 231

CryptoLocker virus, 135

CryptoWall virus, 135

custody, chain of, 433

cyber detectives, 408–409

civil court records, 415–416

company searches, 413

court records/criminal checks, 413

email searches, 412

general searches, 410

online resources, 411

privacy, 412

Yahoo! People Search, 410–411

Google searches, 418

image searches, 411

Maltego, 418–420

mistaken identity, 415

online resources, 416–417

privacy, 412

sex offender databases, 413–415

Usenet, 417–418

cyber forensics, 426, 427

ASCLD, 437

cell phones, finding on

Android, 455–456

information to look for, 456–457

iOS, 454

states, 452

Cellebrite, 440

certifications, 457–458

chain of custody, 433

Daubert standard, 459

defined, 427

document trails, 432

EnCase, 439

EU evidence gathering, 435–436

expert witnesses, 458–459

falsifiability, 437

FBI forensics guidelines, 433–434

Federal Rule 702, 459

Forensics Toolkit, 428–431

FTK Imager, 428–431, 439

goal of, 427

handling suspect drives, 427–428

industry standards, 437

ISO/IEC 27037:2012, 437

ISO/IEC 27041, 437

ISO/IEC 27042, 437

ISO/IEC 27043, 437

ISO/IEC 27050, 437

live machines, 432

Locard’s Principle of Transference, 436

Magnet Forensics, 439

network forensics, 460

OSForensics, 439

Oxygen, 439

PC, finding evidence on

autostart locations, 450

browsers, 440–441

Last Visited, 450

Linux logs, 442

logs, 441

operating system utilities, 445–447

Prefetch, 451

recent documents, 450

recovering deleted files, 442–444

ShellBags, 451

uninstalled software, 451

USB information, 449–450

UserAssist, 450

Windows Date/Time Stamps, 451

Windows Registry, 447–448

reports, 438

RFC 3227, 437

scientific method, 437

securing evidence, 432–433

Sleuth Kits, 439

SWGDE, 436, 437

U.S. Secret Service forensics guidelines, 434–435

virtual forensics, 460

cloud computing, 461–462

VM, 460–461

cyber stalking, 75, 82–83

cases, 83–86

crimes against children, 88–90

evaluating, 87–88

grooming, 88–89

harassment, 84, 98

sex offender databases, 90

swatting, 86

cyber terrorism, 378–379. See also information warfare

actual cases of, 379–380

BlackEnergy, 383

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

Dark Web, The, 400–401

defending against, 399

economic espionage, 384–386

FinFisher, 383

Flame virus, 382–383

footprinting, 385

general attacks, 387

India, 381

Iran, 381–382

military operations, 386–387

negative trends, 398

NSA ANT catalog, 384

Pakistan, 381

positive trends, 396–398

recruiting/communications, 399–400

Russian hackers, 381

Saudi Arabia, 381–382

SCADA systems, 387–388

StopGeorgia.ru malware, 383

Stuxnet, 382

TOR browser, 400–401

U.S. PATRIOT Act, 396–397

Cybercrime Magazine, 3

cybersecurity engineering, 466–467, 475–476

defined, 467–468

IEEE 830–1993, 468–469

IEEE 15288, 472

ISO 27001, 477–478

ISO 27004, 478

MATLAB, 473

modeling/simulation, 473

MPE formula, 474

MSD formula, 474

MTBF formula, 474–475

MTTR formula, 475

NIST SP 800–63B, 478–480

quantifiable data, 474–475

reliability engineering, 471–472, 473

requirements, 469–471, 472

RMF, 476

SecML, 480–481

concepts, 481

DID, 488

MCD, 484–486

security block diagrams, 489

security sequence diagrams, 486–488

SMART acronym, 469

systems engineering, 468

threat modeling, 489–490

WBS, 471

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

cyclic groups, 242

CYOD (Choose Your Own Device), 314

D

Dallas, TX police department, insider threats, 14

DAM (Database Activity Monitoring), 287

Dark Web, The

advertised relay nodes, 193

bridge nodes, 193

cyber terrorism, 400–401

entry node, 192

exit node, 192

exploits, 192

onion routing, 189–190

online resources, 193

People’s Drug Store, The, 191

relay node, 192

TOR browser, 190–191

DASH7 wireless protocol, 41

data breaches

2014 Data Breach Investigation Report (Verizon), 18

defined, 8

data classification policies, 323

Data Link layer (OSI network model), 60

data packets

contents of, 49–50

filtering, 273–274

headers, 49–50

ICMP packets, blocking, 122

SPI, 274

data transmission, 41

ports, 43

protocols, 42–43

databases

National Vulnerability Database, 365

sex offender databases, 413–415

Daubert standard, 459

DDoS (Distributed DoS) attacks, 11, 119, 121

deauthentication attacks, 181

decryption, 227

deep fakes, 152–153

degradation of service attacks, 120

deleted files, recovering, 442–444

departing employee policies, 316–317

DES (Data Encryption Standard), 237–240

desktop configurations, security policies, 313–314

detecting

IDS, 21, 23, 279

active IDS, 280

elements of, 281

identifying intrusions, 280

passive IDS, 280

Snort, 281–286

viruses and spyware

antivirus software, 153–156

machine learning and malware, 157

remediation steps, 157–158

detectives, cyber, 408–409

civil court records, 415–416

company searches, 413

court records/criminal checks, 413

email searches, 412

general searches, 410

online resources, 411

privacy, 412

Yahoo! People Search, 410–411

Google searches, 418

image searches, 411

Maltego, 418–420

mistaken identity, 415

online resources, 416–417

privacy, 412

sex offender databases, 413–415

Usenet, 417–418

development policies, 322–323

DHCP starvation, 118

dictionary attacks, 182

DID (Data Interface Diagrams), 488

differential backups, 326

Diffie-Hellman key exchange, 250

digital certificates, 292–293

digital signatures, 252

directory traversals, 180

disaster recovery, 324

BCP, 325

BIA, 325

differential backups, 326

DRP, 324

fault tolerance, 326–327

full backups, 326

impact analysis, 325

incremental backups, 326

ISO 27035, 325

NIST 800–61, 325

RAID, 327

disinformation, 391

DiskCryptor, 214

distributed reflection DoS attacks, 109

DMZ (Demilitarized Zones), 350–351

DNS (Domain Name System) protocol, 42

DNS poisoning, 8, 15–16

documentation

cyber forensics, 432

document trails, 432

recent documents, 450

forensics reports, 438

DoD clearances, 323–324

DOJ (Department of Justice)

Gameover ZeuS virus, 135

identity theft, 80

DoS (Denial of Service) attacks, 5, 10–11, 106–107

AWS attack, 120

blackholing, 122

blocking ICMP packets, 122

Boston Globe, 121

CC attacks, 120

CLDAP reflection, 119–120

DDoS attacks, 11, 119, 121

defending against, 121–122

defined, 8

degradation of service attacks, 120

DHCP starvation, 118

distributed reflection DoS attacks, 109

EDoS attacks, 120

example of, 106–107

FastMail DDoS blackmail attack, 121

Fraggles, 116

Google attack, 120

HTTP POST DoS attacks, 118

ICMP flood attacks, 117

land attacks, 118–119

login attacks, 119

login DoS attacks, 118

LOIC, 109–110

memcache attack, 121

Mirai attack, 121, 135–136

PDoS attacks, 118

phlashing, 118

ping command, 107–108

PoD, 117

real-world examples, 120–121

registration DoS attacks, 118

security policies, 320

sinkholing, 122

Smurf IP attacks, 115–116

Stacheldraht, 111–112

TCP SYN flood attacks, 112–113

hashing, 114

micro blocks, 113

RST cookies, 114

SPI firewalls, 115

SYN cookies, 114

teardrop attacks, 118

TFN, 111

TFN2K, 111

UDP flood attacks, 116–117

weaknesses, 112

XOIC, 110

Yo-Yo attacks, 119

downloads, virus scanners, 270

doxing, 16–17

DREAD threat modeling, 490

drives

handling suspect drives, 427–428

imaging drives with Forensic Toolkit, 428–431

DRP (Disaster Recovery Plans), 324

DSo connections, 38

dual-homed host firewalls, 275

E

EAP (Extensible Authentication Protocol), 289

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security), 289

ECB (Electronic Codebook) mode, 244

economic espionage, 206, 384–386

EDGE (Enhanced Data Rates for GSM Evolution), 454

Edge security settings, Microsoft, 92–94

EDoS (Economic Denial of Sustainability) attacks, 120

EFS (Encrypted File System), Windows, 214, 215

Eisenberger, Keith, harassment, 85

eliminating viruses/spyware

antivirus software, 153–156

machine learning and malware, 157

remediation steps, 157–158

eLiTeWrap tool, 143–144

elliptic curve cryptography, 250

email

protocols, 49

searches, 412

usage policies, 311–312

virus scanners, 270

employee policies

departing employee policies, 316–317

new employee policies, 316

EnCase forensics tool, 439

encryption, 226–227

3DES, 240

AES, 240–242

algorithms, 237

asymmetric (public-key) encryption, 227

Atbash cipher, 230–231

binary operations, 235

AND operations, 235

OR operations, 235

XOR operations, 235–236

block ciphers, 237

Blowfish, 243

Caesar cipher, 229–230

cipher text, 237

cryptanalysis, 257–258

chosen plain text attacks, 258

cipher text only attacks, 259

known plain text attacks, 258

related-key attacks, 259

decryption, 227

DES, 237–240

Diffie-Hellman key exchange, 250

digital signatures, 252

elliptic curve cryptography, 250

Enigma machine, 234–235

Feistel ciphers, 237

frequency analysis, 258

hashing, 253

HMAC, 254

MAC, 254

MD5, 253

RIPEMD, 254

SHA, 253–254

history of, 228–229

key schedules, 238

keys, 237

legitimate versus fraudulent encryption methods, 251–252

mono-alphabet substitution, 230

“old” encryption, 251

online resources, 228–229

PGP, 250–251

plain text, 237

Polybius cipher, 233

public-key (asymmetric) encryption, 245

Diffie-Hellman key exchange, 250

elliptic curve cryptography, 250

PGP, 250–251

RSA encryption, 246–249

quantum computing cryptography, 259–260

rail fence cipher, 232

rainbow tables, 254–255

Rijndael block cipher. See AES

RSA encryption, 246–249

Scytale cipher, 233

Serpent, 243

single-key (symmetric) encryption, 236, 237

3DES, 240

AES, 240–242

Blowfish, 243

CBC mode, 244

CFB mode, 244

DES, 237–240

ECB mode, 244

GCM, 245

PCBC mode, 244

RC4 stream ciphers, 243

Serpent, 243

Skipjack, 243

steganography, 255–256

history of, 256–257

methods/tools, 257

stream ciphers, 237

substitution alphabets, 230

symmetric (single-key) encryption, 227

transposition ciphers, 232

Vigenere cipher, 231

Windows EFS, 214, 215

engineering, cybersecurity, 466–467, 475–476

defined, 467–468

IEEE 830–1993, 468–469

IEEE 15288, 472

ISO 27001, 477–478

ISO 27004, 478

MATLAB, 473

modeling/simulation, 473

MPE formula, 474

MSD formula, 474

MTBF formula, 474–475

MTTR formula, 475

NIST SP 800–63B, 478–480

quantifiable data, 474–475

reliability engineering, 471–472, 473

requirements, 469–471, 472

RMF, 476

SecML, 480–481

concepts, 481

DID, 488

MCD, 484–486

security block diagrams, 489

security sequence diagrams, 486–488

SMART acronym, 469

systems engineering, 468

threat modeling, 489–490

WBS, 471

Enigma machine, 234–235

entry node, The Dark Web, 192

enumeration, 174–175

errors

client errors, 48

Error 404: File Not Found messages, 48

server errors, 48

espionage, 200–202, 207–208

assets

identifying, 203–205

information as an asset, 203–205

defined, 202

DiskCryptor, 214

economic espionage, 206, 384–386

examples of, 206–207

hacking, 206

Industrial Espionage Act of 1996, 218

low-tech industrial espionage, 208–210

phishing, 219

phone taps/bugs, 211

protection against, 212–215

sensitive data, 202

spear phishing, 219

spies for hire, 212

spyware, 210–211

steganography, 211

trade secrets, 215–218

trends in, 207

VeraCrypt, 213–214

whaling, 219

Windows EFS, 214, 215

Ethernet headers, 50

ethical hacking, penetration testing, 19–20

EU evidence gathering, 435–436

Euler’s Totient, 246

evidence

cell phones, finding on

Android, 455–456

information to look for, 456–457

iOS, 454

states, 452

EU evidence gathering, 435–436

PC, finding on

autostart locations, 450

browsers, 440–441

Last Visited, 450

Linux logs, 442

operating system utilities, 445–447

Prefetch, 451

recent documents, 450

recovering deleted files, 442–444

ShellBags, 451

system logs, 441

uninstalled software, 451

USB information, 449–450

UserAssist, 450

Windows Date/Time Stamps, 451

Windows Registry, 447–448

securing, 432–433

SWGDE, 436, 437

evil twin attacks, 181

exit node, The Dark Web, 192

expert witnesses, cyber forensics, 458–459

expulsion/termination policies, 315

F

factory default state/nascent state, cell phones, 452

FakeAV virus, 137

false negatives/positives, virus scanners, 271

falsifiability, 437

faster connection speeds, local networks, 38

FastMail DDoS blackmail attack, 121

fault tolerance, 326–327

FBI forensics guidelines, 433–434

Federal Rule 702, 459

FedRAMP (Federal Risk and Authorization Management Protocol), 63

Feistel ciphers, 237

“Felony Lane Gang, The,” 81

fields, 242

files

deleted files, recovering, 442–444

virus scanners, 270

filtering packets, 273–274

FIN probes, 173

FIN scans, 171

finding

evidence

Android, 455–456

cell phones, 452–457

iOS, 454–455

PC, 440–451

firewalls, 342

FinFisher, 383

Firefox, security settings, 94–96

firewalls, 20–21, 59, 272–273

application gateways, 274

application-layer firewalls, 276

benefits of, 273

blacklists/whitelists, 276–277

circuit-level gateways, 276

configuring, 272–275

dual-homed host firewalls, 275

finding, 342

limitations of, 273

logs, 278

network host-based firewalls, 275

NGFW, 276

packet filtering, 273–274

router-based firewalls, 275

screened hosts, 275

SPI, 274

SPI firewalls, 115

types of, 276–278

WAF, 276

Windows Defender Firewall, 277–278

ZoneAlarm, 277

Flame virus, 140, 382–383

fog computing, 62–63

footprinting, 385

foreign governments, economic espionage, 206

forensics, cyber, 426, 427

ASCLD, 437

cell phones, finding on

Android, 455–456

information to look for, 456–457

iOS, 454

states, 452

Cellebrite, 440

certifications, 457–458

chain of custody, 433

Daubert standard, 459

defined, 427

document trails, 432

EnCase, 439

EU evidence gathering, 435–436

expert witnesses, 458–459

falsifiability, 437

FBI forensics guidelines, 433–434

Federal Rule 702, 459

Forensics Toolkit, 428–431

FTK Imager, 428–431, 439

goal of, 427

handling suspect drives, 427–428

imaging drives with Forensic Toolkit, 428–431

industry standards, 437

ISO/IEC 27037:2012, 437

ISO/IEC 27041, 437

ISO/IEC 27042, 437

ISO/IEC 27043, 437

ISO/IEC 27050, 437

live machines, 432

Locard’s Principle of Transference, 436

Magnet Forensics, 439

network forensics, 460

OSForensics, 439

Oxygen, 439

PC, finding evidence on

autostart locations, 450

browsers, 440–441

Last Visited, 450

Linux logs, 442

logs, 441

operating system utilities, 445–447

Prefetch, 451

recent documents, 450

recovering deleted files, 442–444

ShellBags, 451

uninstalled software, 451

USB information, 449–450

UserAssist, 450

Windows Date/Time Stamps, 451

Windows Registry, 447–448

reports, 438

RFC 3227, 437

scientific method, 437

securing evidence, 432–433

Sleuth Kits, 439

SWGDE, 436, 437

U.S. Secret Service forensics guidelines, 434–435

virtual forensics, 460

cloud computing, 461–462

VM, 460–461

Fraggles, 116

fraud, 74–75

auction fraud, 78–79

bid shielding, 79

bid siphoning, 79, 80

security settings, 97–98

shill bidding, 79

COVID-19, 75

identity theft, 80–81

phishing, 81–82

protection against, 91–92

XSS attacks, 81–82

investment offers, 75–76

common schemes, 76

protection against, 91

pump and dump scams, 77

laws/legislation, 90–91

legitimate versus fraudulent encryption methods, 251–252

Leszczymski, Alexander, 75

SEC, 75

frequency analysis, 258

frequency, evaluating cyber stalking threats, 87

F-Secure, 26

FTC (Federal Trade Commission), auction fraud, 78–79

FTK Imager forensics tool, 428–431, 439

FTP (File Transfer Protocol), 42

FTP bounce scans, 173

full backups, 326

G

Galois group, 242

Gameover ZeuS virus, 135

GCM (Galois Counter Mode), 245

general searches, 410

image searches, 411

online resources, 411

privacy, 412

Yahoo! People Search, 410–411

Georgia Medical Center, South, insider threats, 14–15

Georgia (Republic of), StopGeorgia.ru malware, 383

GIAC, system security, 368

Goldberg, Barry, cyber stalking, 83

Golden Eye, 134

good passwords, 343

Google

Chrome, security settings, 96

cyber detectives, 418

DoS attacks, 120

gray hat hackers, 19, 167

grooming, 88–89

GSM (Global System for Mobile Communication), 453

guidelines, security, 323

H

hacking, 19

active scanning techniques, 169

connect scans, 170

enumeration, 174–175

FIN probes, 173

FIN scans, 171

FTP bounce scans, 173

ping scans, 170

port scanning, 169–173

Shodan, 175–176

SNMP scans, 173

SYN scans, 171

vulnerability assessments, 173

black hat hackers, 19, 167

Blue jacking, 181

blue teams, 167

Bluebugging, 181

Bluesnarfing, 181

brute-force attacks, 182, 230

cars, 17

cell phone attacks, 181

Certified Ethical Hackers, 367

command injection attacks, 181

cookie poisoning, 180

crackers, 167

cross-site request forgeries, 180

Dark Web, The

advertised relay nodes, 193

bridge nodes, 193

entry node, 192

exit node, 192

exploits, 192

onion routing, 189–190

online resources, 193

People’s Drug Store, The, 191

relay node, 192

TOR browser, 190–191

deauthentication attacks, 181

defined, 18

dictionary attacks, 182

directory traversals, 180

ethical hacking, 19–20

evil twin attacks, 181

gray hat hackers, 19, 167

hybrid attacks, 182

industrial espionage, 206

IoT, 17

Jeep vehicles, 17

login as system attacks, 186–187

malware

creating, 184–185

TeraBIT Virus Maker, 184–185

medical devices, 17

net user script attacks, 186

New Hackers Dictionary, 20

online resources, 168–169

ophcrack, 182–183

pass the hash attacks, 185

passive scanning techniques, 167–169

password cracking attacks, 182

brute-force attacks, 182

Brutus password cracking tool, 183

Crack Station password cracking tool, 184

dictionary attacks, 182

hybrid attacks, 182

John the Ripper password cracking tool, 183

ophcrack, 182–183

rainbow tables, 182

THC-Hydra password cracking tool, 184

WebCracker password cracking tool, 183

penetration testing, 19–20, 166–167, 187

NIST 800–115, 187

NSA assessment methodology, 188

PCI DSS, 189

phreaking, 20, 167

Pod slurping, 181

rainbow tables, 182, 254–255

reconnaissance phase, 167

red teams, 167

Russian hackers, 381

script kiddies, 19, 167

security policies, 320–321

SQL script injection attacks, 177–179

TeraBIT Virus Maker, 184–185

URL hijacking, 180

white hat hackers, 18–19, 167

Windows computers, 185

login as system attacks, 186–187

net user script attacks, 186

pass the hash attacks, 185

wireless attacks, 181

WPS attacks, 181

XSS attacks, 179–180

hard drives

handling suspect drives, 427–428

imaging drives with Forensic Toolkit, 428–431

Hardy, Matthew, cyber stalking, 84

harassment, cyber stalking, 84, 98

hashing, 114, 253

HMAC, 254

MAC, 254

MD5, 253

pass the hash attacks, 185

RIPEMD, 254

SHA, 253–254

headers, packets, 49–50

Hern, U.S. Representative Kevin, harassment, 85

Herring, Mark, swatting, 86

heuristic scanning, 271

hijacking

sessions, 8, 13–14

URL, 180

HIPAA (Health Insurance Portability and Accountability Act of 1996), 25, 328–329

HMAC (Hashing Message Authentication Code), 254

HOIC (High Orbit Ion Cannons), 110

honey pots, 286

HTTP (Hypertext Transfer Protocol), 42

HTTP POST DoS attacks, 118

HTTPS (HTTP Secure), 42

hubs, 37

hybrid attacks, 182

hybrid clouds, 62

hybrid security approaches, 23–24

hypervisors, 462

I

ICCID (Integrated Circuit Card Identification), 453

ICMP flood attacks, 117

ICMP packets, blocking, 122

iDEN (Integrated Digital Enhanced Networks), 454

identifying

assets, 203–205

threats, 7–8

identity

mistaken identity, 415

theft, 80–81

Identity Theft and Assumption Deterrence Act of 1998 (U.S.C.1028), 90

phishing, 81–82

protection against, 91–92

XSS attacks, 81–82

IDS (Intrusion Detection Systems), 21, 23, 279

active IDS, 280

elements of, 281

identifying intrusions, 280

passive IDS, 280

Snort, 281–286

IEEE (Institute of Electrical and Electronics Engineers)

802.11a wireless connections, 39

802.11a Wireless Gigabyte Alliance wireless connections, 39

802.11ac wireless connections, 39

802.11af wireless connections, 39

802.11ah wireless connections, 39

802.11aj wireless connections, 39

802.11ax wireless connections, 39

802.11b wireless connections, 39

802.11be wireless connections, 39

802.11g wireless connections, 39

802.11n wireless connections, 39

802.11n-2009 wireless connections, 39

830–1993, 468–469

15288, 472

IM (Instant Messaging), security policies, 313

image searches, 411

imaging drives with Forensic Toolkit, 428–431

IMAP (Internet Message Access Protocol), 42

IMAPS (IMAP Secure), 42

IMEI (International Mobile Equipment Identity), 453

impact analysis, 325

IMSI (International Mobile Subscriber Identity), 453

incremental backups, 326

India, cyber terrorism, 381

individual workstations, securing, 346–348

industrial espionage, 200, 207–208

assets

identifying, 203–205

information as an asset, 203–205

defined, 202

DiskCryptor, 214

economic espionage, 206

examples of, 206–207

hacking, 206

Industrial Espionage Act of 1996, 218

low-tech industrial espionage, 208–210

phishing, 219

phone taps/bugs, 211

protection against, 212–215

sensitive data, 202

spear phishing, 219

spies for hire, 212

spyware, 210–211

steganography, 211

trade secrets, 215–218

trends in, 207

VeraCrypt, 213–214

whaling, 219

Windows EFS, 214, 215

industry certifications/standards, 6, 437

information as an asset, 203–205

information warfare, 388. See also cyber terrorism

actual cases of, 391–395

AI, 395–396

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

disinformation, 391

future trends, 395

information control, 389–390

machine learning, 395–396

negative trends, 398

positive trends, 396–398

propaganda, 388–389

U.S. PATRIOT Act, 396–397

Yahoo!390

insider threats, 14

common scenarios, 15

Dallas, TX police department, 14

defined, 8, 15

Snowden, Edward, 14

South Georgia Medical Center, 14–15

installing software, security policies, 312

intensity, evaluating cyber stalking threats, 88

Internet

arp command, 56–57

chat rooms, 49

cloud computing, 61–64

connection types, 38

development of, 2–4

email protocols, 49

fraud, 74–75

auction fraud, 78–80, 97–98

COVID-19, 75

identity theft, 80–81, 91–92

investment offers, 75–78, 91

laws/legislation, 90–91

Leszczymski, Alexander, 75

phishing, 81–82

SEC, 75

XSS attacks, 81–82

growth of, 2–4

history of, 50–52

IoT, hacking, 17

IPConfig command, 52–54

IPv4 addresses, 44–47

IPv6 addresses, 47–48

ISP, 43

NAP, 43

Netstat command, 56

nslookup command, 56–57

packets

contents of, 49–50

headers, 49–50

SYN/ACK communications, 50

PathPing command, 58–59

ping command, 48, 53–55

route command, 57–58

traceroute command, 48, 55

URL, 48–49

usage policies, 310–311

Internet layer (TCP/IP network model), 61

intrusions

deflection, 288

deterrence, 288

IDS, 279

active IDS, 280

elements of, 281

identifying intrusions, 280

passive IDS, 280

Snort, 281–286

inventories, threat, 5–6

investigations/cyber detectives, 408–409

civil court records, 415–416

company searches, 413

court records/criminal checks, 413

email searches, 412

general searches, 410

online resources, 411

privacy, 412

Yahoo! People Search, 410–411

Google searches, 418

image searches, 411

Maltego, 418–420

mistaken identity, 415

online resources, 416–417

privacy, 412

sex offender databases, 413–415

Usenet, 417–418

investment offers, Internet fraud, 75–76

common schemes, 76

investment advice, 76

protection against, 91

pump and dump scams, 77

iOS, cyber forensics, 454

IoT (Internet of Things)

hacking, 17

malware, 135–136

IP (Internet Protocol) addresses, 43

IPv4, 44

binary number conversions, 44

CIDR, 47

classes, 44–45

private IP addresses, 44, 45–46

public IP addresses, 44, 45–46

ranges, 45

subnetting, 46

IPv6, 47

CIDR, 47

link-local addresses, 47

loopback addresses, 47

M flags, 48

machine-local addresses, 47

network-local addresses, 47–48

O flags, 48

ping command, 48

site-local addresses, 47–48

traceroute command, 48

NAT, 46

private IP addresses, 44, 45–46

public IP addresses, 44, 45–46

IP headers, 49

IPConfig command, 52–54

IPsec (Internet Protocol Security), 297

Iran, cyber terrorism, 381–382

IRC (Internet Relay Chat) protocol, 42

ISDN connections, 38

ISO 17799, 307–308

ISO 17999, 305–306

ISO 27001, 306–307, 477–478

ISO 27002, 307

ISO 27004, 478

ISO 27017, 63

ISO 27018, 63

ISO 27035, 325

ISO/IEC 27037:2012, 437

ISO/IEC 27041, 437

ISO/IEC 27042, 437

ISO/IEC 27043, 437

ISO/IEC 27050, 437

ISP (Internet Service Providers), 43

J

Jeep vehicles, hacking, 17

John the Ripper password cracking tool, 183

K

Kali Linux, 359–362

Kedi RAT (Remote Access Trojan), 137

Kerberos authentication, 289–292

key loggers, 9

key schedules, 238

keys, encryption, 237

known plain text attacks, 258

Kurzynski, Joel, cyber stalking, 84

L

L2TP (Layer 2 Tunneling Protocol), 296–297

land attacks, 118–119

Last Visited, cyber forensics, 450

Latigo, Heriberto, cyber stalking, 83–84

laws/legislation, 328

Computer Security Act of 1987, 24

court records/criminal checks, cyber detectives, 413

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

Federal Rule 702, 459

HIPAA, 25, 328–329

Industrial Espionage Act of 1996, 218

Internet fraud, 90–91

OMB Circular A-130, 25

PCI DSS, 329

privacy laws, 25

Sarbanes-Oxley Act, 329

“sensitive information,” 24–25

state-specific computer security laws/legislation, 25

United States Code (the Privacy Act), 24

U.S. PATRIOT Act, 396–397

layered security approaches, 23

LEAP (Lightweight Extensible Authentication Protocol), 289

least privileges, 22

legal issues, impact on network security, 24–25

legitimate versus fraudulent encryption methods, 251–252

Leszczymski, Alexander, Internet fraud, 75

link-local addresses, 47

Linux

Kali Linux, 359–362

logs, cyber forensics, 442

live machines, cyber forensics, 432

local networks

cabling, 35–37

connection speeds, 38

hubs, 37

repeaters, 37

RJ-45 connectors, 35

routers, 38

switches, 37

terminators, 35

Locard’s Principle of Transference, 436

locks, physical security, 345–346

loggers, key, 9

logic bombs, 9, 151–152

logical network perimeters, 462

login attacks, 119

DoS attacks, 118

Linux logs, 442

login as system attacks, 186–187

logs

firewalls, 278

networks, 351

Windows logs, cyber forensics, 441

LOIC (Low Orbit Ion Cannons), 10, 19, 109–110

loopback addresses, 47

loss

ALE, 6

ARO, 6–7

SLE, 6

low-tech industrial espionage, 208–210

LTE (Long Term Evolution), 454

Lynsis, 359

M

M flags, 48

MAC (Media Access Control) addresses, 61

MAC (Message Authentication Code), 254

MacDefender virus, 137

machine learning

information warfare, 395–396

malware, 140–141, 157

virus scanners, 271

machine-local addresses, 47

macro viruses, 132

Magnet Forensics, 439

malicious web-based code, 150–151

Maltego, 418–420

malware, 5, 8, 130–131

anti-malware, 157

APT, 152

BlackEnergy, 383

buffer-overflow attacks, 145–146

characteristics of, 9

creating, 184–185

deep fakes, 152–153

defined, 8

IoT malware, 135–136

key loggers, 9

logic bombs, 9, 151–152

machine learning and malware, 140–141, 157

malicious web-based code, 150–151

rootkits, 149–150

spam, 152

spyware, 9, 146–147

antispyware, 278–279

delivery to target systems, 147

detecting/eliminating, 153–158

FinFisher, 383

industrial espionage, 210–211

legal uses of, 147

obtaining, 148–149

Pegasus spyware, 147

StopGeorgia.ru malware, 383

Stuxnet, 382

Trojan horses, 9, 116, 142–143

eLiTeWrap tool, 143–144

Kedi RAT, 137

viruses

Apple viruses 1, 2, and 3, 140

armored viruses, 133

Atlanta ransomware attack, 136

BASHLITE attack, 135–136

Black Basta virus, 134

boot sector viruses, 132

Clop virus, 136

Creeper virus, 140

CryptoLocker virus, 135

CryptoWall virus, 135

defined, 131

detecting/eliminating, 153–158

early viruses, 140

examples of, 133–140

FakeAV virus, 137

Flame virus, 140, 382–383

Gameover ZeuS virus, 135

impact of, 140

IoT malware, 135–136

MacDefender virus, 137

macro viruses, 132

memory-resident viruses, 133

metamorphic viruses, 133

Mimail virus, 138–139

Mindware virus, 136

Morris Internet worm, 139

multi-partite viruses, 133

nonvirus viruses, 139

online resources, 133–134

Petya virus, 134

polymorphic viruses, 133

Rombertik virus, 135

rules for avoiding, 141

Sasser virus, 145–146

scanners, 269–271

security policies, 319–320

Shamoon virus, 135, 382

Shlayer virus, 138

SoBig virus, 137–138

sparse infector viruses, 133

spread of, 131–132

TeraBIT Virus Maker, 184–185

Thanatos ransomware, 136

Titanium virus, 134

types of, 132–133

virulancy, 137

Wabbit virus, 140

WannaCry virus, 134

worms versus, 142

worms, 142

MATLAB, cybersecurity engineering, 473

McCullum, Juan R., harassment, 85

McCumber cube, 21–22

MCD (Misuse-Case Diagrams), 484–486

MD5, 253

medical devices, hacking, 17

Medico, Joseph, harassment, 85

memcache, DoS attacks, 121

memory-resident viruses, 133

metamorphic viruses, 133

micro blocks, TCP SYN flood attacks, 113

Microsoft Edge, security settings, 92–94

Microsoft Security Advisor, 26

military operations, cyber terrorism, 386–387

Mimail virus, 138–139

Mindware virus, 136

Mirai attack, 121, 135–136

mistaken identity, 415

mitigation, risk assessments, 7

mobile phones

active state, 452

attacks, 181

cellular networks, 453–454

cyber forensics

Android, 455–456

information to look for, 456–457

iOS, 454

states, 452

ICCID, 453

IMEI, 453

IMSI, 453

nascent state/factory default state, 452

quiescent state, 452

semi-active state, 452

SIM, 452

modeling/simulation

cybersecurity engineering, 473

SecML, 480–481

concepts, 481

DID, 488

MCD, 484–486

security block diagrams, 489

security sequence diagrams, 486–488

threat modeling, 489–490

monitoring, DAM, 287

mono-alphabet substitution, 230

Morris, Robert T.

session hijacking, 13

“Weakness in the 4.2BSD Unix TCP/IP Software, A,” 13

Morris Internet worm, 139

MPE (Mean Percentage Error) formula, 474

MSD (Mean Squared Deviation) formula, 474

MTBF (Mean Time Between Failures) formula, 474–475

MTTR (Mean Time To Repair) formula, 475

multi-alphabet substitution, 231

multi-partite viruses, 133

Murphy, Robert James, cyber stalking, 84

N

NAP (Network Access Points), 43

nascent state/factory default state, cell phones, 452

NAT (Network Address Translation), 46

National Vulnerability Database, 365

NESSUS, 352–355

net user script attacks, 186

NetBIOS protocol, 42

Netstat command, 56

Network Access layer (TCP/IP network model), 61

network host-based firewalls, 275

Network layer (OSI network model), 60

network-local addresses, 47–48

networks, 34–35

basics, 35

cellular networks, 453–454

cloud computing, 61–64

data transmission, 41

ports, 43

protocols, 42–43

DMZ, 350–351

firewalls, 59

forensics, 460

iDEN, 454

legal issues, impact on network security, 24–25

local networks

cabling, 35–37

connection speeds, 38

hubs, 37

repeaters, 37

RJ-45 connectors, 35

routers, 38

switches, 37

terminators, 35

logical network perimeters, 462

MAC addresses, 61

NAP, 43

NAT, 46

NIC, 35

OSI model, 60–61

proxy servers, 59

scanning techniques

Kali Linux, 359–362

Lynsis, 359

National Vulnerability Database, 365

NESSUS, 352–355

Nikto, 359–360

NIST 800–15, 363–364

NSA-IAM, 364–365

OpenVAS, 363

OWASP ZAP, 355–357

PCI DSS, 365

Shodan, 357–359

Sparta, 360–362

Vega, 362

system security, 350–352

TCP/IP model, 61

VPN, 296

wireless networks

6LoWPAN wireless protocol, 41

ANT+ wireless protocol, 41

Bluetooth connectivity, 40–41

connection speeds, 39–40

DASH7 wireless protocol, 41

RC4 stream ciphers, 40

Thread wireless protocol, 41

WEP, 40, 298

WirelessHART wireless protocol, 41

WPA, 40, 298

WPA2, 40, 298

WPA3, 40, 298

Zigbee wireless protocol, 41

Z-Wave wireless protocol, 41

new employee policies, 316

New Hackers Dictionary, 20

NGFW (Next-Generation Firewalls), 276

NIC (Network Interface Cards), 35, 61

Nikto, 359–360

NIST (National Institute of Standards and Technology)

800–61, 325

800–115, 187, 363–364

800–144, 63

insider threats, 15

NIST800–53, 15

SP 800–53, 306

SP 800–63B, 478–480

Nmap, 170–173

NNTP (Network News Transfer Protocol), 42

nodes, The Dark Web, 192–193

nonvirus viruses, 139

NSA (National Security Agency)

assessment methodology, 188

NSA-IAM, 364–365

NSA ANT catalog, 384

nslookup command, 56–57

nuclear secrets, industrial espionage, 206

O

O flags, 48

OC3 connections, 38

OC12 connections, 38

OC48 connections, 38

Offensive Security, 367

old backup media, 349

“old” encryption, 251

old passwords, 344

OMB Circular A-130, 25

onion routing, 189–190

online resources, 25

CERT, 25

company searches, 413

cryptography, 228–229

cyber detectives, 416–417

email searches, 412

encryption, 228–229

F-Secure, 26

general searches, 411

hacking, 168–169

image searches, 411

Microsoft Security Advisor, 26

nodes, The Dark Web, 193

professional help, 366–368

SANS Institute website, 26

sex offender databases, 90, 413–415

system security, 346, 366–368

viruses, 133–134

OpenVAS, 363

operating system utilities, cyber forensics, 445–447

OR operations, 235

ophcrack, 182–183

OSForensics forensics tool, 439

OSI network model, 60–61

OWASP (Open Web Application Security Project)

SQL injection attacks, 12–13

ZAP, 355–357

Oxygen forensics tool, 439

P

packets

contents of, 49–50

filtering, 273–274

headers, 49–50

ICMP packets, blocking, 122

SPI, 274

SYN/ACK communications, 50

Pakistan, cyber terrorism, 381

Panda Security, machine learning and malware, 141

PAP (Password Authentication Protocol), 288

pass the hash attacks, 185

passive IDS (Intrusion Detection Systems), 280

passive scanning techniques, 167–169

passive security approaches, 23

passwords

age of, 344

cracking attacks, 182

brute-force attacks, 182

Brutus password cracking tool, 183

Crack Station password cracking tool, 184

dictionary attacks, 182

hybrid attacks, 182

John the Ripper password cracking tool, 183

ophcrack, 182–183

rainbow tables, 182

THC-Hydra password cracking tool, 184

good passwords, 343

login attacks, 119

network security, 351

old passwords, 344

PAP, 288

policies, 309–310

SPAP, 289

PASTA threat modeling, 490

patches, system security, 337–338

PathPing command, 58–59

PATRIOT Act, 396–397

PC, finding evidence (cyber forensics)

autostart locations, 450

browsers, 440–441

Last Visited, 450

Linux logs, 442

logs, 441

operating system utilities, 445–447

Prefetch, 451

recent documents, 450

recovering deleted files, 442–444

ShellBags, 451

uninstalled software, 451

USB information, 449–450

UserAssist, 450

Windows Date/Time Stamps, 451

Windows Registry, 447–448

PCBC (Propagating Cipher-Block Chaining) mode, 244

PCI DSS (Payment Card Industry Data Security Standard), 189, 329, 365

PDoS attacks, 118

PEAP (Protected Extensible Application Protocol), 289

Pegasus spyware, 147

penetration testing, 19–20, 187

certifications, 166–167

defined, 166

National Vulnerability Database, 365

NIST 800–15, 363–364

NIST 800–115, 187

NSA assessment methodology, 188

NSA-IAM, 364–365

PCI DSS, 189, 365

People’s Drug Store, The, 191

perimeter security approaches, 23

Petya virus, 134

PGP (Pretty Good Privacy), 250–251

phishing, 81–82, 219

phlashing, 118

phone taps/bugs, industrial espionage, 211

phreaking, 20, 167

Physical layer (OSI network model), 60

physical security

locks, 345–346

old backup media, 349

server rooms, 345

servers, 348–350

system security, 345–346

workstations, 345, 346–348

ping command, 48, 53–55

DoS attacks, 107–108

PoD, 117

scans, 170

plain text, encryption, 237

Plaskett, Stacey, harassment, 85

PoD (Ping of Death), 117

Pod slurping, 181

poisoning

cookies, 180

DNS, 8, 15–16

policies, security, 304–305, 323

access control, 321–322

attachments, 312

BYOD, 314

data classification policies, 323

defined, 305

desktop configurations, 313–314

development policies, 322–323

disaster recovery, 324

BCP, 325

BIA, 325

DRP, 324

fault tolerance, 326–327

impact analysis, 325

ISO 27035, 325

NIST 800–61, 325

DoD clearances, 323–324

email usage, 311–312

IM, 313

Internet usage, 310–311

ISO 17799, 307–308

ISO 17999, 305–306

ISO 27001, 306–307

ISO 27002, 307

laws/legislation

HIPAA, 328–329

PCI DSS, 329

Sarbanes-Oxley Act, 329

NIST SP 800–53, 306

passwords, 309–310

software installations, 312

system administration policies, 316

breaches, 319–321

change requests, 317–319

departing employee policies, 316–317

DoS attacks, 320

hacker intrusions, 320–321

new employee policies, 316

viruses, 319–320

system security assessments, 343–344

termination/expulsion policies, 315

user policies, 308–309, 314–316

Zero Trust, 327–328

Polybius cipher, 233

polymorphic viruses, 133

POP3 (Post Office Protocol 3), 42

POP3S (POP3 Secure), 42

ports

data transmission, 43

routers, 338

scanning, 169–173

system security, 338–341

PPTP (Point-to-Point Tunneling Protocol), 296

Prefetch, cyber forensics, 451

Presentation layer (OSI network model), 60

Principle of Transference, Locard’s, 436

privacy

laws, 25

Privacy Act (United States Code), the, 24

searches, 412

private clouds, 62, 461

private IP addresses, 44, 45–46

privileges, least, 22

probes, system security, 344–345

procedures, security, 323

propaganda, information warfare, 388–389

protection phase, system security assessments, 341–342

protocols

data transmission, 42–43

DNS, 42

FTP, 42

HTTP, 42

HTTPS, 42

IMAP, 42

IMAPS, 42

IRC, 42

NetBIOS, 42

NNTP, 42

POP3, 42

POP3S, 42

SMB, 42

SMTP, 42

SMTPS, 42

SSH, 42

Telnet, 42

TFTP, 42

Whois, 42

wireless protocols

6LoWPAN wireless protocol, 41

ANT+ wireless protocol, 41

DASH7 wireless protocol, 41

Thread wireless protocol, 41

WirelessHART wireless protocol, 41

Zigbee wireless protocol, 41

Z-Wave wireless protocol, 41

proxy servers, 20–21, 59

public clouds, 62, 461

public IP addresses, 44, 45–46

public-key (asymmetric) encryption, 245

Diffie-Hellman key exchange, 250

elliptic curve cryptography, 250

PGP, 250–251

RSA encryption, 246–249

pump and dump scams, 77

Q

quantifiable data, cybersecurity engineering, 474–475

quantifying risk, 6–7

quantum computing cryptography, 259–260

quiescent state, cell phones, 452

R

RAID, 327

rail fence cipher, 232

rainbow tables, 182, 254–255

Ramos, Jeron, harassment, 85

ranges, IPv4 addresses, 45

ransomware

Atlanta ransomware attack, 136

Cybercrime Magazine, 3

Thanatos ransomware, 136

RC4 stream ciphers, 40, 243

recent documents, cyber forensics, 450

reconnaissance phase, hacking, 167

recovering deleted files, 442–444

recruiting, cyber terrorism, 399–400

red teams, 167

registration DoS attacks, 118

related-key attacks, 259

relay node, The Dark Web, 192

reliability engineering, 471–472, 473

repeaters, local networks, 37

reports, forensics, 438

Republic of Georgia, StopGeorgia.ru malware, 383

request forgeries, cross-site, 180

resources, online, 25

CERT, 25

company searches, 413

cryptography, 228–229

cyber detectives, 416–417

email searches, 412

encryption, 228–229

F-Secure, 26

general searches, 411

hacking, 168–169

image searches, 411

Microsoft Security Advisor, 26

nodes, The Dark Web, 193

professional help, 366–368

SANS Institute website, 26

sex offender databases, 90, 413–415

system security, 346, 366–368

viruses, 133–134

RFC 3227, 437

Rijndael block cipher. See AES

rings, 242

RIPEMD (RACE Integrity Primitives Evaluation Message Digest), 254

risk

assessments, 7, 17–18

acceptance, 7

ALE, 6

ARO, 6

avoidance, 7

mitigation, 7

SLE, 6

system vulnerabilities, 5–6

threat inventories, 5–6

transference, 7

quantifying, 6–7

RMF, 476

RJ-45 connectors, 35

RMF (Risk Management Framework), 476

Romania, cybercrime laws/legislation, 90–91

Rombertik virus, 135

rootkits, 149–150

route command, 57–58

router-based firewalls, 275

routers

local networks, 38

ports, 338

security, 352

routing, onion, 189–190

RSA encryption, 246–249

RST cookies, TCP SYN flood attacks, 114

Russia

hacking, 381

StopGeorgia.ru malware, 383

S

sandboxes, virus scanners, 271

SANS Institute website, 26

Sarbanes-Oxley Act, 329

Sasser virus, 145–146

Saudi Arabia, cyber terrorism, 381–382

SCADA (Supervisory Control and Data Acquisitions)

components of, 388

cyber terrorism, 387–388

scanners, virus, 269

active code scanning, 271

attachments, 270

downloads, 270

email, 270

false negatives/positives, 271

files, 270

heuristic scanning, 271

machine learning, 271

operation of, 269–270, 271

sandboxes, 271

scanning techniques, 270–271

“sheep dip” machines, 271

scanning techniques

active, 169

connect scans, 170

enumeration, 174–175

FIN probes, 173

FIN scans, 171

FTP bounce scans, 173

ping scans, 170

port scanning, 169–173

Shodan, 175–176

SNMP scans, 173

SYN scans, 171

vulnerability assessments, 173

National Vulnerability Database, 365

networks

Kali Linux, 359–362

Lynsis, 359

NESSUS, 352–355

Nikto, 359–360

OpenVAS, 363

OWASP ZAP, 355–357

Shodan, 357–359

Sparta, 360–362

Vega, 362

NIST 800–15, 363–364

NSA-IAM, 364–365

passive, 167–169

PCI DSS, 365

scientific method, cyber forensics, 437

screened hosts, 275

script kiddies, 19, 167

Scytale cipher, 233

searches

company searches, 413

email searches, 412

general searches, 410

online resources, 411

privacy, 412

Yahoo! People Search, 410–411

Google searches, 418

image searches, 411

privacy, 412

SEC (Securities and Exchange Commission), Internet fraud, 75, 77

SecML (Security Modeling Language), 480–481

concepts, 481

DID, 488

MCD, 484–486

security block diagrams, 489

security sequence diagrams, 486–488

secrets (trade), industrial espionage, 215–218

securing evidence, 432–433

security activities

auditing, 21

authentication, 21

Security Advisor, Microsoft, 26

security approaches

hybrid security approaches, 23–24

layered security approaches, 23

passive security approaches, 23

perimeter security approaches, 23

security block diagrams, 489

security checklists, 344

security concepts

CIA triangle, 21–22

least privileges, 22

McCumber cube, 21–22

security devices

firewalls, 20–21

IDS, 21, 23

proxy servers, 20–21

security policies, 304–305, 323

access control, 321–322

attachments, 312

BYOD, 314

data classification policies, 323

defined, 305

desktop configurations, 313–314

development policies, 322–323

disaster recovery, 324

BCP, 325

BIA, 325

DRP, 324

fault tolerance, 326–327

impact analysis, 325

ISO 27035, 325

NIST 800–61, 325

DoD clearances, 323–324

email usage, 311–312

IM, 313

Internet usage, 310–311

ISO 17799, 307–308

ISO 17999, 305–306

ISO 27001, 306–307

ISO 27002, 307

laws/legislation

HIPAA, 328–329

PCI DSS, 329

Sarbanes-Oxley Act, 329

NIST SP 800–53, 306

passwords, 309–310

software installations, 312

system administration policies, 316

breaches, 319–321

change requests, 317–319

departing employee policies, 316–317

DoS attacks, 320

hacker intrusions, 320–321

new employee policies, 316

viruses, 319–320

system security assessments, 343–344

termination/expulsion policies, 315

user policies, 308–309, 314–316

Zero Trust, 327–328

security resources, online, 25

CERT, 25

F-Secure, 26

Microsoft Security Advisor, 26

SANS Institute website, 26

sex offender databases, 90

security sequence diagrams, 486–488

security tools/technology, 268

antispyware, 278–279

antivirus software, 272

authentication, 288–292

DAM, 287

digital certificates, 292–293

firewalls, 272–273

application gateways, 274

application-layer firewalls, 276

benefits of, 273

blacklists/whitelists, 276–277

circuit-level gateways, 276

configuring, 272–275

dual-homed host firewalls, 275

limitations of, 273

logs, 278

network host-based firewalls, 275

NGFW, 276

packet filtering, 273–274

router-based firewalls, 275

screened hosts, 275

SPI, 274

types of, 276–278

WAF, 276

Windows Defender Firewall, 277–278

ZoneAlarm, 277

honey pots, 286

IDS, 279

active IDS, 280

elements of, 281

identifying intrusions, 280

passive IDS, 280

Snort, 281–286

intrusion deflection, 288

intrusion deterrence, 288

IPsec, 297

L2TP, 296–297

PPTP, 296

SIEM, 287

SSL/TLS, 292–296

virus scanners, 269

active code scanning, 271

attachments, 270

downloads, 270

email, 270

false negatives/positives, 271

files, 270

heuristic scanning, 271

machine learning, 271

operation of, 269–270, 271

sandboxes, 271

scanning techniques, 270–271

“sheep dip” machines, 271

VPN, 96–97, 296

semi-active state, cell phones, 452

sensitive data, industrial espionage, 202

“sensitive information,” 24–25

Serpent, 243

server rooms, physical security, 345

servers

DNS poisoning, 8, 15–16

errors, 48

proxy servers, 20–21, 59

system security, 348–350

services

degradation of service attacks, 120

shutting down in Windows, 339–340

session hijacking, 8, 13–14

Session layer (OSI network model), 60

sex offender databases, 90, 413–415

SHA (Secure Hash Algorithm), 253–254

Shamoon virus, 135, 382

“sheep dip” machines, 271

ShellBags, cyber forensics, 451

shielding bids, 79

shill bidding, 79

Shlayer virus, 138

Shodan, 175–176, 357–359

shutting down services in Windows, 339–340

SIEM (Security Information and Event Management), 287

signatures, digital, 252

SIM (Subscriber Identity Modules), 452

simulation/modeling

cybersecurity engineering, 473

SecML, 480–481

concepts, 481

DID, 488

MCD, 484–486

security block diagrams, 489

security sequence diagrams, 486–488

threat modeling, 489–490

single-key (symmetric) encryption, 236, 237

3DES, 240

AES, 240–242

Blowfish, 243

CBC mode, 244

CFB mode, 244

DES, 237–240

ECB mode, 244

GCM, 245

PCBC mode, 244

RC4 stream ciphers, 243

Serpent, 243

Skipjack, 243

sinkholing, 122

Sinn Fein website, 388–389

siphoning bids, 79, 80

site-local addresses, 47–48

Skipjack, 243

SLE (Single Loss Expectancy), 6

Sleuth Kits, 439

SMART acronym, cybersecurity engineering, 469

SMB (Server Message Block) protocol, 42

SMTP (Simple Mail Transfer Protocol), 42

SMTPS (SMTP Secure), 42

Smurf IP attacks, 115–116

sneakers, 19

SNMP scans, 173

Snort, 281–286

Snowden, Edward, insider threats, 14

SoBig virus, 137–138

social engineering attacks, 10

software

antivirus software, 153–156, 272

installing/uninstalling, security policies, 312

uninstalled software, cyber forensics, 451

South Georgia Medical Center, insider threats, 14–15

spam, 152

SPAP (Shiva Password Authentication Protocol), 289

sparse infector viruses, 133

Sparta, 360–362

spear phishing, 219

specificity, evaluating cyber stalking threats, 88

speeds, network connectivity

local networks, 38

wireless networks, 39–40

SPI (Stateful Packet Inspection), 274

SPI firewalls, TCP SYN flood attacks, 115

spying, industrial espionage, 200, 207–208

assets

identifying, 203–205

information as an asset, 203–205

defined, 202

DiskCryptor, 214

economic espionage, 206, 384–386

examples of, 206–207

hacking, 206

Industrial Espionage Act of 1996, 218

low-tech industrial espionage, 208–210

phishing, 219

phone taps/bugs, 211

protection against, 212–215

sensitive data, 202

spear phishing, 219

spies for hire, 212

spyware, 210–211

steganography, 211

trade secrets, 215–218

trends in, 207

VeraCrypt, 213–214

whaling, 219

Windows EFS, 214, 215

spyware, 9, 146–147

antispyware, 278–279

delivery to target systems, 147

detecting/eliminating

antivirus software, 153–156

machine learning and malware, 157

remediation steps, 157–158

FinFisher, 383

industrial espionage, 210–211

legal uses of, 147

obtaining, 148–149

Pegasus spyware, 147

SQL injection attacks, 11–13, 177–179

SSH (Secure Shell) protocol, 42

SSL/TLS (Secure Sockets Layer/Transport Layer Security), 292–296

Stacheldraht, DoS attacks, 111–112

stalking, cyber, 82–83

cases, 83–86

crimes against children, 88–90

evaluating, 87–88

grooming, 88–89

harassment, 84, 98

sex offender databases, 90

swatting, 86

standards, security, 304–305, 323

access control, 321–322

attachments, 312

BYOD, 314

cyber forensics, 437

data classification policies, 323

defined, 305

desktop configurations, 313–314

disaster recovery, 324

BCP, 325

BIA, 325

DRP, 324

fault tolerance, 326–327

impact analysis, 325

ISO 27035, 325

NIST 800–61, 325

DoD clearances, 323–324

email usage, 311–312

IM, 313

Internet usage, 310–311

ISO 17799, 307–308

ISO 17999, 305–306

ISO 27001, 306–307

ISO 27002, 307

laws/legislation

HIPAA, 328–329

PCI DSS, 329

Sarbanes-Oxley Act, 329

NIST SP 800–53, 306

passwords, 309–310

software installations, 312

system administration policies, 316

breaches, 319–321

change requests, 317–319

departing employee policies, 316–317

DoS attacks, 320

hacker intrusions, 320–321

new employee policies, 316

viruses, 319–320

termination/expulsion policies, 315

user policies, 308–309, 314–316

Zero Trust, 327–328

state-specific computer security laws/legislatuon, 25

steganography, 255–256

history of, 256–257

industrial espionage, 211

methods/tools, 257

StopGeorgia.ru malware, 383

storage, virtual, 462

STP (Shielded Twisted-Pair) cabling, 36

stream ciphers, 237, 243

STRIDE threat modeling, 489

Stuxnet, 382

subnetting, 46

substitution alphabets

Atbash cipher, 230–231

Caesar cipher, 229–230

mono-alphabet substitution, 230

multi-alphabet substitution, 231

Vigenere cipher, 231

suspect drives, handling, 427–428

swatting, 86

SWGDE (Scientific Working Group on Digital Evidence), 436, 437

switches, local networks, 37

symmetric (single-key) encryption, 227, 236, 237

3DES, 240

AES, 240–242

Blowfish, 243

CBC mode, 244

CFB mode, 244

DES, 237–240

ECB mode, 244

GCM, 245

PCBC mode, 244

RC4 stream ciphers, 243

Serpent, 243

Skipjack, 243

SYN/ACK communications, packets, 50

SYN cookies, TCP SYN flood attacks, 114

SYN scans, 171

SysML sequence diagrams, 486–488

system administration policies, 316

breaches, 319–321

change requests, 317–319

departing employee policies, 316–317

DoS attacks, 320

hacker intrusions, 320–321

new employee policies, 316

viruses, 319–320

system security, 336–337

assessing

overview, 337

patches, 337–338

physical security, 345–346

ports, 338–341

probes, 344–345

protection phase, 341–342

security checklists, 344

security policies, 343–344

compromising

cracking attacks, 9

social engineering attacks, 10

war flying, 10

war-dialing, 10

war-driving, 10

firewalls, 342

networks, 350–352

scanning techniques, 352–363

testing/scanning standards, 360–365

old backup media, 349

online resources, 346

professional help, 366–368

servers, 348–350

shutting down services in Windows, 339–340

workstations, 345, 346–348

system vulnerabilities, 6

systems engineering, cybersecurity engineering, 468

T

T1 connections, 38

T3 connections, 38

Taiwan Semiconductor Manufacturing Company, impact of viruses, 140

TCP headers, 49

TCP/IP network model, 61

TCP SYN flood attacks, 112–113

hashing, 114

micro blocks, 113

RST cookies, 114

SPI firewalls, 115

SYN cookies, 114

teardrop attacks, 118

Telnet, 42

TeraBIT Virus Maker, 184–185

termination/expulsion policies, 315

terminators, local networks, 35

terminology, 18

black hat hackers, 19

gray hat hackers, 19

hackers, 18

script kiddies, 19

sneakers, 19

white hat hackers, 18–19

terrorism, cyber, 378–379, 387. See also information warfare

actual cases of, 379–380

BlackEnergy, 383

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

Dark Web, The, 400–401

defending against, 399

economic espionage, 384–386

FinFisher, 383

Flame virus, 382–383

footprinting, 385

India, 381

Iran, 381–382

military operations, 386–387

negative trends, 398

NSA ANT catalog, 384

Pakistan, 381

positive trends, 396–398

recruiting/communications, 399–400

Russian hackers, 381

Saudi Arabia, 381–382

SCADA systems, 387–388

StopGeorgia.ru malware, 383

Stuxnet, 382

TOR browser, 400–401

U.S. PATRIOT Act, 396–397

testing, penetration, 19–20, 187

certifications, 166–167

defined, 166

National Vulnerability Database, 365

NIST 800–15, 363–364

NIST 800–115, 187

NSA assessment methodology, 188

NSA-IAM, 364–365

PCI DSS, 189, 365

text

chosen plain text attacks, 258

cipher text, encryption, 237

cipher text only attacks, 259

known plain text attacks, 258

plain text, encryption, 237

TFN (Tribal Flood Network), DoS attacks, 111

TFN2K, DoS attacks, 111

TFTP (Trivial File Transfer Protocol), 42

Thanatos ransomware, 136

THC-Hydra password cracking tool, 184

Thread wireless protocol, 41

threats

APT, 152, 381

breaches

2014 Data Breach Investigation Report (Verizon), 18

defined, 8

compromising system security

cracking attacks, 9

social engineering attacks, 10

war flying, 10

war-dialing, 10

war-driving, 10

DDoS attacks, 11

DNS poisoning, 8, 15–16

DoS attacks, 5, 10–11, 106–107

AWS attack, 120

blackholing, 122

blocking ICMP packets, 122

Boston Globe, 121

CC attacks, 120

CLDAP reflection, 119–120

DDoS attacks, 11, 119, 121

defending against, 121–122

defined, 8

degradation of service attacks, 120

DHCP starvation, 118

distributed reflection DoS attacks, 109

EDoS attacks, 120

example of, 107–109

FastMail DDoS blackmail attack, 121

Fraggles, 116

Google attack, 120

HTTP POST DoS attacks, 118

ICMP flood attacks, 117

land attacks, 118–119

login attacks, 119

login DoS attacks, 118

LOIC, 109–110

memcache attack, 121

Mirai attack, 121, 135–136

PDoS attacks, 118

phlashing, 118

ping command, 107–108

PoD, 117

real-world examples, 120–121

registration DoS attacks, 118

security policies, 320

sinkholing, 122

Smurf IP attacks, 115–116

Stacheldraht, 111–112

TCP SYN flood attacks, 112–115

teardrop attacks, 118

TFN, 111

TFN2K, 111

UDP flood attacks, 116–117

weaknesses, 112

XOIC, 110

Yo-Yo attacks, 119

doxing, 16–17

hacking

cars, 17

IoT, 17

Jeep vehicles, 17

medical devices, 17

phreaking, 20

identifying, 7–8

insider threats, 14

common scenarios, 15

Dallas, TX police department, 14

defined, 8, 15

Snowden, Edward, 14

South Georgia Medical Center, 14–15

inventories, 5–6

malware, 5, 8

characteristics of, 9

defined, 8

key loggers, 9

logic bombs, 9

spyware, 9

Trojan horses, 9, 116

modeling, 489–490

phreaking, 20

risk assessments, 17–18

seriousness of, 4–7

session hijacking, 8, 13–14

web attacks, 11

defined, 8

SQL injection attacks, 11–13

XSS attacks, 13

Time Stamps, cyber forensics, 451

Titanium virus, 134

TKIP (Temporal Key Integral Protocol), 40

tools/technology, security, 268

antispyware, 278–279

antivirus software, 272

authentication, 288–292

DAM, 287

digital certificates, 292–293

firewalls, 272–273

application gateways, 274

application-layer firewalls, 276

benefits of, 273

blacklists/whitelists, 276–277

circuit-level gateways, 276

configuring, 272–275

dual-homed host firewalls, 275

limitations of, 273

logs, 278

network host-based firewalls, 275

NGFW, 276

packet filtering, 273–274

router-based firewalls, 275

screened hosts, 275

SPI, 274

types of, 276–278

WAF, 276

Windows Defender Firewall, 277–278

ZoneAlarm, 277

honey pots, 286

IDS, 279

active IDS, 280

elements of, 281

identifying intrusions, 280

passive IDS, 280

Snort, 281–286

intrusion deflection, 288

intrusion deterrence, 288

IPsec, 297

L2TP, 296–297

PPTP, 296

SIEM, 287

SSL/TLS, 292–296

virus scanners, 269

active code scanning, 271

attachments, 270

downloads, 270

email, 270

false negatives/positives, 271

files, 270

heuristic scanning, 271

machine learning, 271

operation of, 269–270, 271

sandboxes, 271

scanning techniques, 270–271

“sheep dip” machines, 271

VPN, 96–97, 296

TOR browser, 190–191, 400–401

traceroute command, 48, 55

trade secrets, industrial espionage, 215–218

transference

Locard’s Principle of Transference, 436

risk assessments, 7

Transport layer (OSI network model), 60

Transport layer (TCP/IP network model), 61

transposition ciphers, 232

Trojan horses, 9, 116, 142–143

eLiTeWrap tool, 143–144

Kedi RAT, 137

tunneling protocols

L2TP, 296–297

PPTP, 296

U

Uber, industrial espionage, 206

UDP flood attacks, 116–117

UML (Unified Modeling Language), 473

UMTS (Universal Mobile Telecommunications Systems), 454

uninstalled software

cyber forensics, 451

security policies, 312

United States Code (the Privacy Act), 24

University of Dayton School of Law, cybercrime laws/legislation, 78–91

URL (Uniform Resource Locators), 48–49, 180

U.S. Department of Justice (DOJ)

Gameover ZeuS virus, 135

identity theft, 80

U.S. Federal Trade Commission (FTC), auction fraud, 78–79

U.S. National Security Agency, cloud computing, 63–64

U.S. News and World Report, 16–17

U.S. PATRIOT Act, 396–397

U.S. Secret Service forensics guidelines, 434–435

U.S. Securities and Exchange Commission (SEC), Internet fraud, 75, 77

usage policies

email, 311–312

Internet, 310–311

USB information, cyber forensics, 449–450

U.S.C. 1028 (Identity Theft and Assumption Deterrence Act of 1998), 90

Usenet, cyber detectives, 417–418

user policies, 308–309, 314–316

UserAssist, cyber forensics, 450

usernames, login attacks, 119

UTP (Unshielded Twisted-Pair) cabling, 36

V

Vega, 362

vehicles, hacking, 17

VeraCrypt, 213–214

Verizon, m2014 Data Breach Investigation Report, 18

Vigenere cipher, 231

virtual forensics, 460

cloud computing, 461–462

VM, 460–461

virtual storage, 462

viruses

antivirus software, 272

Apple viruses 1, 2, and 3, 140

armored viruses, 133

Atlanta ransomware attack, 136

BASHLITE attack, 135–136

Black Basta virus, 134

boot sector viruses, 132

Clop virus, 136

Creeper virus, 140

CryptoLocker virus, 135

CryptoWall virus, 135

defined, 131

detecting/eliminating

antivirus software, 153–156

machine learning and malware, 157

remediation steps, 157–158

early viruses, 140

examples of, 133–140

FakeAV virus, 137

Flame virus, 140, 382–383

Gameover ZeuS virus, 135

impact of, 140

IoT malware, 135–136

MacDefender virus, 137

macro viruses, 132

memory-resident viruses, 133

metamorphic viruses, 133

Mimail virus, 138–139

Mindware virus, 136

Morris Internet worm, 139

multi-partite viruses, 133

nonvirus viruses, 139

online resources, 133–134

Petya virus, 134

polymorphic viruses, 133

Rombertik virus, 135

rules for avoiding, 141

Sasser virus, 145–146

scanners, 269

active code scanning, 271

attachments, 270

downloads, 270

email, 270

false negatives/positives, 271

files, 270

heuristic scanning, 271

machine learning, 271

operation of, 269–270, 271

sandboxes, 271

scanning techniques, 270–271

“sheep dip” machines, 271

security policies, 319–320

Shamoon virus, 135, 382

Shlayer virus, 138

SoBig virus, 137–138

sparse infector viruses, 133

spread of, 131–132

TeraBIT Virus Maker, 184–185

Thanatos ransomware, 136

Titanium virus, 134

types of, 132–133

virulancy, 137

Wabbit virus, 140

WannaCry virus, 134

worms versus, 142

VM (Virtual Machines), virtual forensics, 460–461

VPN (Virtual Private Networks), 96–97, 296

vulnerabilities

assessments, 173

scanning

Kali Linux, 359–362

Lynsis, 359

National Vulnerability Database, 365

NESSUS, 352–355

Nikto, 359–360

NIST 800–15, 363–364

NSA-IAM, 364–365

OpenVAS, 363

OWASP ZAP, 355–357

PCI DSS, 365

Shodan, 357–359

Sparta, 360–362

Vega, 362

system vulnerabilities, 6

W

Wabbit virus, 140

WAF (Web Application Firewalls), 276

WannaCry virus, 134

war-dialing, 10

war-driving, 10

warfare, information, 388. See also cyber terrorism

actual cases of, 391–395

AI, 395–396

Cybersecurity Research and Education Act of 2002, 396–397

Cyberterrorism Preparedness Act of 2002, 396

disinformation, 391

future trends, 395

information control, 389–390

machine learning, 395–396

negative trends, 398

positive trends, 396–398

propaganda, 388–389

U.S. PATRIOT Act, 396–397

Yahoo!390

war flying, 10

WBS (Work Breakdown Structures), 471

“Weakness in the 4.2BSD Unix TCP/IP Software, A,” 13

web attacks, 11

defined, 8

SQL injection attacks, 11–13

XSS attacks, 13

WebCracker password cracking tool, 183

WEP (Wired Equivalent Privacy), 40, 298

whaling, 219

white hat hackers, 18–19, 167

whitelists/blacklists, 276–277

Whois protocol, 42

Wi-Fi

6LoWPAN wireless protocol, 41

ANT+ wireless protocol, 41

Bluetooth connectivity, 40–41

connection speeds, 39–40

DASH7 wireless protocol, 41

RC4 stream ciphers, 40

Thread wireless protocol, 41

war flying, 10

WEP, 40, 298

WirelessHART wireless protocol, 41

WPA, 40, 298

WPA2, 40, 298

WPA3, 40

Zigbee wireless protocol, 41

Z-Wave wireless protocol, 41

Windows computers

browsers, cyber forensics, 440–441

EFS, 214, 215

finding evidence

autostart locations, 450

browsers, 440–441

Last Visited, 450

Linux logs, 442

logs, 441

operating system utilities, 445–447

Prefetch, 451

recent documents, 450

recovering deleted files, 442–444

ShellBags, 451

uninstalled software, 451

USB information, 449–450

UserAssist, 450

Windows Date/Time Stamps, 451

Windows Registry, 447–448

hacking, 185

login as system attacks, 186–187

net user script attacks, 186

pass the hash attacks, 185

services, shutting down, 339–340

Windows Date/Time Stamps, cyber forensics, 451

Windows Defender Firewall, 277–278

Windows Registry, cyber forensics, 447–448

wireless attacks, 181

wireless networks

6LoWPAN wireless protocol, 41

ANT+ wireless protocol, 41

Bluetooth connectivity, 40–41

connection speeds, 39–40

DASH7 wireless protocol, 41

RC4 stream ciphers, 40

Thread wireless protocol, 41

war flying, 10

WEP, 40, 298

WirelessHART wireless protocol, 41

WPA, 40, 298

WPA2, 40, 298

WPA3, 40

Zigbee wireless protocol, 41

Z-Wave wireless protocol, 41

WirelessHART wireless protocol, 41

witnesses (expert), cyber forensics, 458–459

workstations

physical security, 345

system security, 346–348

worms

Morris Internet worm, 139

viruses versus, 142

WPA (Wi-Fi Protected Access), 40, 298

WPA2, 40, 298

WPA3, 40, 298

WPS attacks, 181

X

XOIC, DoS attacks, 110

XOR operations, 235–236

XSS (Cross-Site Scripting) attacks, 13, 81–82, 179–180

Y

Yahoo!

information warfare, 390

security settings, 97

TOR browser, 190–191

Yahoo! People Search, 410–411

Yo-Yo attacks, 119

Yung, Ho Ka Terence, harassment, 85

Z

ZDNet, machine learning and malware, 141

Zenmap, 170

Zero Trust, 327–328

Zigbee wireless protocol, 41

ZoneAlarm, 277

Z-Wave wireless protocol, 41

Code Snippets

Many titles include programming code or configuration examples. To optimize the presentation of these elements, view the eBook in single-column, landscape mode and adjust the font size to the smallest setting. In addition to presenting code and configurations in the reflowable text format, we have included images of the code that mimic the presentation found in the print book; therefore, where the reflowable format may compromise the presentation of the code listing, you will see a “Click here to view code image” link. Click the link to view the print-fidelity code image. To return to the previous page viewed, click the Back button on your device or app.