COMPUTER AND

NETWORK
SECURITY
LEARNING OUTCOMES

At the end of the lesson, you should be able to

1. Discuss some threats to computer and network security.
2. Understand some important defensive measures in protecting computers
from malware.
3. Explore cyber attacks have been used as a means to achieve criminal
ends.
HACKERS IN THE PAST
• In its original meaning, a hacker was an explorer, a risk taker, someone who was trying to
make a system do something it had never done before.
• Hackers in this sense of the word abounded at MIT’s Tech Model Railroad Club in the 1950s
and 1960s. The club constructed and continuously improved an enormous HO-scale model
train layout.
• built an elaborate electronic switching system to control the movement of the trains.
HACKERS IN THE PAST

• To them, a “hack” was a newly constructed piece of equipment that not

only served a useful purpose but also demonstrated its creator’s technical
virtuosity/skill.
• Calling someone a hacker was a sign of respect; hackers wore the label with
pride.
HACKERS IN THE PAST

• In 1959, after taking a newly created course in computer programming,

some of the hackers shifted their attention from model trains to electronic
computers.
• The term “hacker” came to mean a “person who delights in having an
intimate understanding of the internal workings of a system, computers and
networks in particular”.
HACKERS IN THE PAST

In the 1983 movie WarGames, a

teenager breaks into a military
computer and nearly causes a
nuclear Armageddon. After seeing
the movie, a lot of teenagers were
excited at the thought that they
could prowl cyberspace with a home
computer and a modem. A few of
them became highly proficient at
breaking into government and
corporate computer networks. These
actions helped change the everyday
meaning of the word “hacker.”
HACKERS TODAY

Hacker - People who gain unauthorized

access to computers and computer
networks.

Three other low-tech techniques for

obtaining login names and passwords are
1. eavesdropping,
2. dumpster diving, and
3. social engineering.
THREE LOW-TECH TECHNIQUES FOR
OBTAINING LOGIN NAMES & PASSWORD

1. Eavesdropping, such as simply looking over the shoulder of a

legitimate computer user to learn his login name and password.
2. Dumpster diving means looking through garbage for interesting bits
of information.
3. Social engineering refers to the manipulation of a person inside the
organization to gain access to confidential information.
PENALTIES FOR HACKING
PHILIPPINES REPUBLIC ACT NO.8792
AN ACT PROVIDING FOR THE RECOGNITION AND USE OF ELECTRONIC COMMERCIAL
AND NON-COMMERCIAL TRANSACTIONS, PENALTIES FOR UNLAWFUL USE THEREOF, AND
OTHER PURPOSES
Sec. 33. Penalties. - The following Acts shall be penalized by fine and/or imprisonment,
as follows:
a) Hacking or cracking which refers to unauthorized access into or interference in a
computer system/server or information and communication system; or any access in
order to corrupt, alter, steal or destroy using a computer or other similar information
and communication devices, without the knowledge and consent of the owner of the
computer or information and communications system, including the introduction of
computer viruses and the like, resulting in the corruption, destruction, alteration, theft
or loss of electronic data messages or electronic document shall be punished by a
minimum fine of one hundred thousand pesos (P100,000.00) and a maximum
commensurate to the damage incurred and a mandatory imprisonment of six (6)
months to three (3) years.
MALWARE

Malware, or malicious software, is any program or file that is harmful to a

computer user.
Types of malware can include computer viruses, worms, Trojan horses and
spyware.
VIRUSES
A virus is a piece of self-replicating code
embedded within another program
called the host.

One way a computer virus can

replicate.
(a) A computer user executes program
P, which is infected with a virus.
(b) The virus code begins to execute. It
finds another executable program
Q and creates a new version of Q
infected with the virus.
(c) The virus passes control to program
P. The user, who expected program
P to execute, suspects nothing.
HOW AN EMAIL VIRUS SPREADS

1. A computer user reads an email

with an attachment
2. The user opens the attachment,
which contains a virus
3. The virus reads the user’s email
address book
4. The virus sends emails with virus-
containing attachments
THE INTERNET WORM

A worm is a self-contained program that

spreads through a computer network by
exploiting security holes in the computers
connected to the network.
The technical term “worm” comes from
The Shockwave Rider, a 1975 science
fiction novel written by John Brunner.

A worm spreads to other computers by exploiting

security holes in computer networks.
SASSER

• The Sasser worm, launched in April 2004, exploited a previously identified

security weakness with PCs running the Windows operating system.
• Computers with up-to-date software were safe from the worm, but it
infected about 18 million computers worldwide nonetheless.
• The effects of the worm were nonthreatening; infected computers simply
shut themselves down shortly after booting.
• Still, the worm made millions of computers unusable and disrupted
operations at Delta Airlines, the European Commission, Australian railroads,
and the British coast guard
INSTANT MESSAGING WORMS

• W32/Hello and Choke worm- appeared in 2001 (MSN Messenger)

• Kelvir worm - appeared in 2005, penetrated Reuters Messaging system,
which is closely linked with AOL's Instant Messenger and Microsoft's MSN
Messenger. Forced the Reuters news agency to remove 60,000 subscribers
from its Microsoft-based instant messaging service for 20 hours.
• Palevo instant messaging worm - rapidly spread through Romania, Mongolia,
and Indonesia in 2010.
CONFICKER
• A computer worm that targets the Microsoft Windows operating system that was first
detected in November 2008.
• Also known as “Downadup” worm
The worm is able to spread in several ways
1. The original variant of the worm spread to computers that were not up-to-date with the
latest security patches from Microsoft.
2. The second version of the worm, which appeared about a month later, had two new
features that accelerated its spread: the ability to invade computers with weak password
protection and the ability to propagate through USB memory sticks and shared files on local
area networks.
• Early in 2009, between 8 and 15 million computers were infected with Conficker, including portions
of military networks in France, the United Kingdom, and Germany.
CROSS-SITE SCRIPTING

• Cross-site scripting is another way in which malware may be downloaded

without a user’s knowledge.
• Web sites that allow users to read what other users have posted are
vulnerable to this security problem. The attacker injects a client-side script
into a Web site. When an innocent user visits the site sometime later, the
user’s browser executes the script, which may steal cookies, track the user’s
activity, or perform another malicious action.
CROSS-SITE SCRIPTING
DRIVE-BY DOWNLOADS

• A drive-by download refers to the unintentional download of malicious code

to your computer or mobile device that leaves you open to a cyberattack.
• You don't have to click on anything, press download, or open a malicious
email attachment to become infected.
• A drive-by download can take advantage of an app, operating system, or
web browser that contains security flaws due to unsuccessful updates or lack
of updates.
TROJAN HORSES AND BACKDOOR
TROJANS
• A Trojan horse, or trojan, is any malware which misleads users of its true
intent.
• Mocmex - is a trojan, which was found in a digital photo frame in February
2008. It was the first serious computer virus on a digital photo frame. The virus
was traced back to a group in China.
• A backdoor Trojan is a Trojan horse that gives the attacker access to the
victim’s computer.
• For example, a backdoor Trojan may design to cleanse malware from a
computer, but in actuality it installs spyware.
ROOTKITS

• A rootkit is a set of programs that provide privileged access to a computer.

• A rootkit may contain a number of malicious tools such as keyloggers,
banking credential stealers, password stealers, antivirus disablers, and
bots for DDoS attacks.
SPYWARE AND ADWARE

• Spyware is a program that communicates over an Internet connection

without the user’s knowledge or consent.
• Spyware programs can monitor Web surfing, log keystrokes, take snapshots
of the computer screen, and send reports back to a host computer.
Spyware is often part of a rootkit.
• Adware is a type of spyware that displays pop-up advertisements related to
what the user is doing.
BOTS AND BOTNETS

• A bot is a particular kind of backdoor Trojan that responds to commands

sent by a command-and-control program located on an external computer.
• A collection of bot-infected computers is called a botnet, and a person who
controls a botnet is called a bot herder.
• Botnets can range in size from a few thousand computers to over a million
computers. In most cases, people have no idea that their PCs have been
compromised and are part of a botnet.
DEFENSIVE MEASURES

Three defensive measures are important in protecting personal computers

from malware:
1. security patches - software makers release security patches so that the
users of the software can update their systems to remove the vulnerabilities
that have been uncovered
2. antimalware tools - designed to protect computers against malware, such
as viruses, worms, Trojan horses, adware, and spyware
3. Firewalls - a software application installed on a single computer that can
selectively block network traffic to and from that computer
CYBER CRIME AND CYBER ATTACKS
PHISHING AND SPEAR PHISHING

• Phishing (pronounced “fishing”) attack is a large-scale effort to gain sensitive

information from susceptible computer users.
• Spear phishing is a variant of phishing in which the attacker selects email
addresses that target a particular group of recipients. For example, an
attacker may target elderly people judged to be more gullible or members
of a group that have access to valuable information
SQL INJECTION

SQL injection is a method of attacking a database-driven Web application

that has improper security.
The attacker accesses the application like any other client of the application,
but by inserting (injecting) an SQL query into a text string from the client to the
application, the attacker can trick the application into returning sensitive
information.
DENIAL-OF-SERVICE AND DISTRIBUTED
DENIAL-OF-SERVICE ATTACKS
• A denial-of-service (DoS) attack is an intentional action designed to prevent
legitimate users from making use of a computer service.

• In a distributed denial-of-service (DDoS) attack, the incoming traffic flooding

the victim originates from many different sources. This effectively makes it
impossible to stop the attack simply by blocking a single source.
CYBERCRIME IN THE PHILIPPINES
DO’S & DON’TS WHILE SURFING THE
INTERNET