Welcome to exploring computing.
Today's video is computer security introduction.
So I want to start off by talking about some stories,
about some security problems.
And I'll admit these are a little bit scary.
We will be talking about how to protect your computer
in a couple lectures.
So you can keep that in mind when you're
listening to these stories.
All right, so our first story has to do with the Dalai Lama
and a attack using a network called the GhostNet.
In 2009 the Dalai Lama's computers were infected
and a program called the GhOst RAT--
where RAT stands for remote access tools--
was installed on the computers in his offices.
The RAT tools gave remote access, including access
to files on the computer-- being able to transfer them
off the computer to elsewhere on the internet,
gave complete control over the microphones and cameras.
And ultimately, GhOst RAT ended up
infecting over 1,200 computers in over 100 countries.
Most of the computers were in foreign affairs ministries,
embassies and non-governmental organizations.
The attack vector that was used to install these programs
on the Dalai Lama's computers, was
a email from an email address marked, campaign@freetibet.org.
There was a Word document attached
to the email, entitled, "Translation
of freedom of movement for Tibetans in exile dot doc."
Well, we don't have 100% certainty
who attacked the Dalai Lama's computers.
One year investigation by Canadian security experts,
tracked where the GhOst RAT was sending information back
to Hainan Island in China, which is the home of Chinese Signals
Intelligence Unit.
So it's likely, given who might want to hack the Dalai Lama,
and given what they were able to discover
about how the tools work, it was probably China.
All right, here's another story.
In 2010, the FBI monitoring software
detected anomalies from the NASDAQ Stock Exchange
computers.
When they went in, they discovered
that there was software installed on the computers,
that included destructive code.
They weren't able to 100% discern what
the destructive code was supposed to do,
but it included two day-zero exploits.
And this is a subject that's going to come up
in a bunch of other places.
A day-zero exploit, is an exploit
that nobody has seen before.
So this is something that somebody has found
is a vulnerability in existing software,
and nobody knows about it.
So if you have a day-zero exploit,
generally, that's considered a pretty huge deal,
and you're going to want to keep that in your back pocket,
and only use it when you really, really need to.
Because basically, it's kind of like the coronavirus, where
there's a whole wide field out there
and nobody has any defenses against it.
So to give you an example of the opposite of that,
we'll be talking in more detail about this particular example
later in this lecture series.
But there was a ransomware attack
that happened a couple of years ago, that among other things
took out the British National Health computers.
That was not a day-zero exploit.
If anybody had updated their Windows computers,
they were not vulnerable to that virus.
So this was a known issue.
Again, not a day-zero exploit.
A day-zero exploit is something where nobody's seen it before,
and it's pretty much guaranteed to work on any computer
that you use it on.
So in this particular case, there
were two day-zero exploits used in order
to get to the NASDAQ computers.
The signature on the software that was used to attack NASDAQ
matched Russian FSB.
Russian FSB is the successor to the KGB, and--
well, it's half of the successor to the KGB.
There's another successor agency as well,
and it's basically roughly equivalent to the US FBI.
You can hear Maddie in the background,
she really wants me to play with her.
So it's likely that this came from the FSB
but it's also possible that somebody
stole the code from the FSB.
It also turns out that, for example,
code that the NSA uses to attack computers at one point
was stolen, or was misplaced and ended up out on the internet.
So it is possible that this wasn't
the FSB using their code.
It's possible somebody else was using their code.
Ultimately, we don't know who attacked the NASDAQ.
Some people point the finger at China,
but it's most likely Russia.
At around the time that hack occurred,
Russia was working on the Russian Stock Exchange,
so it's possible that the people hacking
the NASDAQ were actually looking for techniques,
and the internal workings of the computers
to use for the Russian Stock Exchange.
However, in addition to the original attack,
the FBI found other pieces of software also installed
on NASDAQ.
This is kind of scary.
They found signs of various groups operating on the NASDAQ
computers, including criminal hackers and Chinese cyberspies.
They also discovered that the One Liberty Plaza building
management-- that's where the NASDAQ is located.
Their website had been infested with a Blackhole exploit
kit, which basically anybody who visited their website, if they
were trying to pay their bills or doing other maintenance,
they would get infected.
In May 5, 2000, an email titled ILOVEYOU was sent out.
And it included a virus, and it was designed as a worm
to distribute itself across the internet.
Ultimately, 45 million computers were infected.
It used a Visual Basic Script file,
which copied itself to other Visual Basic Script files.
It sent out copies of itself to everyone in the Outlook email
address book.
So if you were using Outlook, it would look through your email
addresses and it would just basically create
duplicate copies then mail message.
And that would affect everybody in your mail book.
It overwrote multimedia files, including JPEGs.
It sent copies of itself to people on chat rooms,
and it contacted four websites in the Philippines.
The perpetrators were identified, but at the time
no computer crime laws existed in the Philippines,
so they were ultimately not charged.
In 2016, John Podesta, who was chairman of Hillary Clinton's
2016 presidential campaign, received an email claiming
to be a Google security alert.
He clicked on the link, and entered his password
information.
And of course, it wasn't Google.
And Wikileaks published over 20,000 pages
of Clinton campaign emails, by getting in
through his original email access.
Security experts believe the hack
was done by hacking group called Fancy Bear, which
is associated with the Russian Intelligence Services.
Stuxnet is a program that was designed
to attack Siemen's equipment.
Ultimately, the target was believed
to be Iran's nuclear program, which
was using Siemens equipment.
And in particular, it was going after their centrifuges.
It was basically throwing off the timing on the centrifuges,
and it was designed to destroy the centrifuges being
used to refine uranium.
Stuxnet was designed to spread itself through a network.
It replicated itself through Windows computers,
and looked for Siemens Windows-based software,
where it attacked programmable logic controllers.
It included four day-zero exploits--
remember we talked about day-zero exploits--
which led everybody to believe that it
was being put out by a nation states, national security
apparatus.
There was a vulnerability it used
to spread across USB sticks.
This is believed to be necessary,
because the Iranian nuclear enrichment facilities were
probably not on the internet.
So somehow, you would have to get the virus
into their internal network.
And so, this is likely done through a USB drive.
Possibly, by actually having your agent there in place.
We'll talk about some other methods in the next lecture,
in terms of how you might get somebody
to stick a USB drive onto their computer.
Turns out it's not very hard.
It used a vulnerability in print spoolers
to spread across networks using shared printers,
and it used two different vulnerabilities
to gain proper privileged access,
once it got on a particular computer.
All right, so we're going to have three different lectures
on security.
The rest of today's lecture is going
to focus on mechanisms for security--
Different ways that computer scientists
protect your computers.
The next lecture is going to focus on different ways
your computer can get attacked, and then
the third lecture will focus on how to defend
your computer from attacks.
For today's lecture, I want to focus on four
different security concerns--
confidentiality, authentication, integrity, and non-repudiation.
Confidentiality has to do with-- when
I'm talking to somebody else, how
do I know that somebody else isn't listening in?
So I'm going to use--
for most of these examples, I'm going
to use Alice, Bob, and Mallory.
These are traditional names used by security researchers,
so if your name's Mallory, I'm sorry.
It's not my fault. And there's actually
over 20 different names of different people
in different roles, but I'm just going
to use Alice and Bob, who are just two people that are trying
to communicate over the internet,
and then Mallory is the attacker.
There's all sorts of different variants, where like,
Eve is there to eavesdrop, Mallory
is there to do malicious things.
And as I said, there's over 20 different names,
but we're just going to use Alice, Bob, and Mallory,
for most of the examples.
So Alice is sending a message to Bob, she says, hey,
do you want to meet for lunch?
And confidentiality, means that only Alice and Bob
can read that message.
If a third party like Mallory is able to read it,
that means we don't have confidentiality.
Authentication means that the person
we're communicating with, actually
is who they say they are.
So in this case, Alice is communicating
over the internet, and she thinks she's talking to Bob,
but how do we know she's talking to Bob?
Maybe she's talking to Mallory.
And so authentication, is how can Bob
prove that Bob really is Bob?
How can Alice be sure that that's Bob over there
and not Mallory.
Integrity has to do with--
can somebody manipulate the message?
So you might be able to manipulate
the message, or corrupt the message,
without actually being able to read the message.
So this is interrelated with confidentiality
and authentication, but there's different variants here,
in terms of what a malicious person could do.
That don't necessarily violate confidentiality,
or don't necessarily violate authentication.
All right, so Alice sent this message
to meet for lunch to Bob, and maybe Mallory
is not able to actually change the message,
but he's able to add on to the message.
So he says, meet for lunch at Coho, and Bob goes to Coho,
and Alice is somewhere else and doesn't
know why Bob didn't show up.
Another possibility is Mallory might
be able to actually see the message being sent,
grab the message, and then send the same message
at a later point in time.
And Bob might not realize that he's actually
seeing a message that's been seen previously.
So if the system's not set up properly,
he'll know that it was sent from Alice, because maybe there
is some security credentials on it,
but if Mallory is able to grab the whole thing, including
the security credentials and just resend at a later date,
Bob's going to think he's supposed to meet for lunch,
and Alice won't be there because this is actually
a repeat from a message that was sent a couple of days ago.
All right, non-repudiation.
So suppose I send out an email that
says there's no final exam.
And usually, there's a point in the quarter where
I make a joke about, but there really is a final exam.
So I'm not saying this is not a real example,
but hey, turns out this quarter, there is no final exam.
So yay.
All right, so suppose I send an email that says, no final exam,
and you guys all get it.
And then I claim, I didn't send it out.
Is there a way that you can prove I actually sent it?
And so that's what non-repudiation has to do with.
OK, so this is just a quick reminder
that this lecture was originally recorded last spring,
and that in fact, we do have a final this quarter.
But it will be open-book--
open-note.
And it should be pretty easy for you.
You will have plenty of time for it.
Very low pressure.
All right, back to your prerecorded lecture.
All right, so in the next video, we're
going to talk about different mechanisms
that we use for computer security,
and how they might be used to address these four issues.
I'll talk to you soon.