What Does It Mean To You? Internet Security. 1.Use you to spread their worms and viruses. 2.Install spyware programs on your computer so they can monitor

What Does It Mean To You?

Internet Security

1. Use you to spread their worms and viruses.2. Install spyware programs on your computer so they

can monitor everything you do on the Internet.3. Alter your browser, forcing it to visit websites you

don't want to visit.4. Get your personal information so they can steal

your money and identity.

Hackers want to…

Goal 1 is usually about “FUN”Goals 2, 3 and 4 are usually about MONEY!

How You Get Hacked:

Via email attachments Trojan/viruses Trojan/worms

Via malicious websites Spyware Browser hijacking

Via email Phishing Pharming

Greeks bearing gifts…

TROJAN HORSES Gifts you want that contain things you don’t want…

A Trojan horse is a normal application, such as a game or self-displaying photo, that contains a hidden program – often a virus - that executes when the Trojan is executed.

Trojan horses are usually email attachments

VIRUSES

A program that attaches itself to another program so that it can reproduce without the victim’s knowledge Much like the common cold, it wants to spread – often

using the victim’s email address book as a source for new victims to whom it sends itself Viruses generally spread via email-attached Trojans or

embedded in illicitly downloaded software.

eMail Viruses

Open the attachment, enjoy your infection.

Antivirus 2010, 2011

Antivirus 2010 properties:• Changes browser settings• Shows commercial adverts• Connects itself to the Internet• Stays resident in background

It is distributed through online advertisements that are disguised as anti-virus scanners. If user clicks on such a banner, he or she is receives false reports about infections detected. Antivirus2010 tries to intimidate people by reporting nonexistent threats in order to get them interested in downloading this application.

The Internet Is Not A Virus Scanner

Tried to go to a Website and got redirected and warned that you had a virus?

More than likely the legitimate site you were going to was involved in DNS hijacking.

DNS hijacking, also known as DNS poisoning merely manipulates the numeric resolver to a new address.

WORMS

A specially written program that replicates itself Unlike a virus, it does not attach itself to other

programs Worms, in general are resource hogs; some have

bogged down major portions of the Internet Worms generally spread via server vulnerabilities (e.g.

buffer overflows) – not via email attached TrojansThe Blaster Worm infected multiple systems in the mid 2000s causing an overflow within Windows NT 5.x based systems (XP, 2003). It had no other use than to replicate and cease productivity.

Conflicker

Little is known about the use of conflicker other than it easily replicates to insecure machines and has multiple open ports.

It is assumed the usage is as a Zombie to be used in large scale DDOS attacks.

Viruses vs.Worms

In the final analysis, most people who are affected by a virus or worm could care less about the distinctions between them.

Most viruses and worms are launched into the Internet by attackers who have no particular target in mind

They just want to see what will happen – or they seek notoriety among their “colleagues”

Spyware

Spyware: Any software that covertly gathers user information. Monitors victim’s Internet activity and transmits that

information via the Internet to the hacker, who sells it. Often bundled as a hidden component of “free”

programs that are downloaded from the Internet

Symptoms: SLOW Web browsing PCs are often infested with 50 -1000 spyware

programs The more you surf, the more invested you become Real time protection is free and readily available

Spyware

RealPlayer tracks and “phoneshome” your listening habits

Kazaa - You are trusting infected users to share their music and files with you – enough said.

Comet Systems has over 160,000 customers to whom it sells the data collected by its spyware

Wild (Tangent) Games are “free” but you agree to a lot when you accept them!

Browser Hijacking

Symptoms: Your browser’s default start page is changed Porn and gambling links are added to your favorites

list Porn sites pop up on your screen

Goal: To force your browser – and entice you - to visit

websites whose owners pay the hacker for sending people to their sites

Spyware, browser hijacking, and phishing are all about MONEY!

Browser Hijacking

The malicious website makes changes to your computer via known vulnerabilities, for which patches exist

Sometimes, the changes are easily reversed More often, a “cleaner” tool is needed to fix things It’s often necessary to manually edit the Windows

registry Often, the hijacking software redoes the hacked settings

every time you reboot the computer

Phishing

Phishing: The act of sending an email that falsely claims to be from a bank or other E-commerce enterprise

The e-mail: Directs the user to visit a cloned website where they are asked to “update” personal information.

Goal: To trick the recipient into surrendering private information that will be used for identity theft.

Usernames/passwords; credit card, social security, and bank account numbers

Perpetrators: Increasingly used by organized crime syndicates, many based in central and eastern Europe. Those who have been arrested were young, American males.

A bad day phishin’, beats a good day workin’

• 2,000,000 emails are sent• 5% get to the end user – 100,000 (Anti-Phishing Working

Group)• 5% click on the phishing link – 5,000 (APWG)• 2% enter data into the phishing site –100 (FTC)• $1,200 from each person who enters data (FTC)• Potential reward: $120,000

In 2005 David Levi made over $360,000 from 160 people using an eBay Phishing scam

Phishing

From can easily be spoofed

Not a match

Images from Anti-Phishing Working Group’s Phishing Archive

Typical Phishing Site

Not https – not secure

An IP address, not a resolved name


Typical Phishing Site


Fake Site

Not https:No security lock


Real Site


Corporate Phishing/Spear Phishing

Spear-Phishing: Improved Target Selection

• Socially aware attacks Mine social relationships from public data Phishing email appears to arrive from someone known to

the victim Use spoofed identity of trusted organization to gain trust Urge victims to update or validate their account Threaten to terminate the account if the victims not reply Use gift or bonus as a bait Security promises

• Context-aware attacks “Your bid on eBay has won!” “The books on your Amazon wish list are on sale!”

Another Example


But Wait!!

WHOIS 210.104.211.21:

Location: Korea, Republic Of

Even bigger problem:

I don’t have an account with US Bank!


Pharming

How To Tell If An E-mail Message is Fraudulent

Here are a few phrases to look for if you think an e-mail message is a phishing scam.

• "Verify your account."Businesses should not ask you to send passwords, login names, Social Security numbers, or other personal information through e-mail. If you receive an e-mail from anyone asking you to update your credit card information, do not respond: this is a phishing scam.

• "If you don't respond within 48 hours, your account will be closed."These messages convey a sense of urgency so that you'll respond immediately without thinking. Phishing e-mail might even claim that your response is required because your account might have been compromised.

Continued

• "Dear Valued Customer."Phishing e-mail messages are usually sent out in bulk and often do not contain your first or last name.

• "Click the link below to gain access to your account."HTML-formatted messages can contain links or forms that you can fill out just as you'd fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company's name and are usually "masked," meaning that the link you see does not take you to that address but somewhere different, usually a phony Web site.

Documents

What Does It Mean To You? Internet Security. 1.Use you to spread their worms and viruses. 2.Install spyware programs on your computer so they can monitor