Lecture 4
- 1. Computer Network Security 1 Protection in OS A brief history There were no Operating Systems Programs were entered by users by means of switches Programs were entered by means of inputs devices like keyboards Each user had exclusive access to the computing system Time sharing Required to load libraries, compilers, linkers, assemblers and then clean up for the next user by removing sensitive code or data
- 2. Computer Network Security 2 A brief history The first OS were simple utilities called executives Designed to assist programmers and to smooth user to user transition Provided linkers and loaders, compilers and assemblers, and automatic loading of subprograms from libraries Multiprogramming allowed two users to interleave access to resources of a single computing system Researchers developed scheduling, sharing and parallel use
- 3. Computer Network Security 3 A brief history Multiprogramming OSs, called monitors oversaw each program’s execution While an executive stayed in the background, waiting to be called into action by the user, a monitor maintained control of the computing system and gave access to a resource only if consistent with good use of the system User Multiprogramming brought complications: one user making a mistake on an executive would feel foolish, but a user could not adversely affect the computation of another user
- 4. Computer Network Security 4 User authentication An OS bases much of its protection on knowing who a user of the system is In real-life, you may ask for an ID before cashing a cheque, or issuing a book Over time organizations and systems have developed means of authentication: documents, voice recognition, fingerprint, retina matching etc In computing, the choices are limited and possibilities are less secure. Anyone can attempt to login to a computing system. A computer can not recognize electrical signals as one person being any different from another
- 5. Computer Network Security 5 User authentication Most computer authentication systems must be based on something only shared between the user and the computer Authentication mechanism based on: Something the user knows: passwords, PINs, mother’s maiden name Something the user has: identity badges, physical keys, driver’s license Something the user is: biometrics are based on a physical characteristic of the user, such as a fingerprint, the pattern of a person's voice. Two or more forms can be combined for strong security for example, a bank card and a PIN
- 6. Computer Network Security 6 Use of passwords The most common authentication mechanism for user to operating system is a password Mutually agreed upon code words, assumed to be known only to the system and the user Seems to offer relatively secure system BUT: human practice sometimes degrades its quality
- 7. Computer Network Security 7 Passwords: loose-lipped systems Consider a would-be intruder: Knows nothing of the system Enter a common name as user name • Invalid user name • Password dialog Enter a guessed password Intruder finds out OS, valid user name
- 8. Computer Network Security 8 Passwords: additional authentication information Day and time of access Location of access
- 9. Computer Network Security 9 Attacks on passwords Passwords are somewhat limited as protection devices due to relatively small number of bits of information they contain. Here are some ways you might be able to determine a user's password. Try all possible passwords Try many probable passwords Try passwords likely for the user Search for the system list of passwords Ask the user
- 10. Computer Network Security 10 Exhaustive attack: brute force All possible passwords: usually automated If a system has a maximum password length of 8 alphabets (26 possibilities): 261 one-character 262 two-character 268 eight-character 26+ 262 +…….+ 268 =5 million At one password per milliseconds, it will take only 150 years to try all possibilities At one password per microseconds, only two months
- 11. Computer Network Security 11 Probable passwords We prefer smaller passwords that are easy to remember, spell and pronounce At one password per million, it takes only 18.278 seconds for three character passwords Or about 8 minutes for 4 character Or about 3.5 hours for 5 character This analysis assumes that people choose passwords like vxlag and msms as often as they pick enter and boring However, people tend to choose names or words they can remember Programs contain dictionaries of English words It takes only 80 seconds to test all 80,000 words in a dictionary as passwords
- 12. Computer Network Security 12 Passwords likely for a user People choose passwords that is meaningful to them Spouse name Child’s name Brother or sister’s name Pet’s name Street name Trying this list takes under a second One can try ten of these by hand in under two minutes
- 13. Computer Network Security 13 Weak passwords Several web sites post dictionaries of phrases, science fiction characters, places, mythological names, Chinese words, Yiddish words, and other specialized lists These help admins identify weak passwords but the same dictionaries can also be used by attackers of sites that do not have such attentive administrators. Tools such as COPS, Crack, and Satan allow an admin to scan a system for weak passwords People think they can be clever by picking a simple password and replacing certain characters such as 0 for o, 1 for I or l, 3 for E, or @ for a
- 14. Computer Network Security 14 Steps an attacker would take Here are attackers some password guessing steps: No password Same as user id User name or derived from it Common: password, secret, private, asdfg, aaaaa Short college dictionary Complete English word list Common non-English dictionary
- 15. Computer Network Security 15 Steps an attacker would take Short college dictionary with capitalizations: PaSsWoRd and substitutions of 0 for o etc Complete English with capitalization and substitutions Common non-English dictionary with capitalization and substitutions Brute force, lowercase alphabetic Brute force, full character set
- 16. Computer Network Security 16 Plaintext system password list To validate passwords, a system must have a way of comparing entries with actual passwords Rather than trying to guess the password why not target the password file Two column: user ID, password Too obvious: Don’t leave out in the open Have to protect it
- 17. Computer Network Security 17 Protecting plaintext password file Various security approaches are used to conceal the password table from those who should not see it. Strong access controls Only OS can access it Not every OS module needs access, e.g. the operating system scheduler, accounting routines, or storage manager have no need to know the table's contents. Avoid dumping of memory An attacker may carefully time the dump of memory Protect system backups
- 18. Computer Network Security 18 Encrypted password file Conventional encryption One-way hash
- 19. Computer Network Security 19 Conventional encryption Receive user password, decrypt stored password and compare But plain text password is available in memory for a while That is, the password is available to anyone who could obtain access to all of memory. Safer to use one-way hash
- 20. Computer Network Security 20 One-way hash The password table's entries are encrypted by a one-way encryption and then stored. When the user enters a password, it is also encrypted and then compared with the table. If the two values are equal, the authentication succeeds. Unix password file can be read by anyone, unless special access controls have been installed. What if two people choose the same password? I notice that another user’s hashed password is the same as mine in the file
- 21. Computer Network Security 21 One-way hash - salt Unix circumvents this vulnerability by using a password extension, called the salt. Salt is a 12-bit number derived from the current system time and the process id Likely to be unique for every user Concatenate salt and plaintext password, then hash it Store hash with salt User enters password, fetch salt from file, hash and compare
- 22. Computer Network Security 22 Indiscreet users Tape to the monitor Card inside the top desk Give away for sharing files
- 23. Computer Network Security 23 Password selection criteria Use characters other than alphabets Choose long passwords Avoid actual names or words Choose an unlikely password: 2BrnB Change password regularly Don’t write down Don’t tell anyone else
- 24. Computer Network Security 24 Good password choices Some systems help users by providing meaningless but choices of pronounceable passwords. e.g. VAX VMS Easy to forget and misspell: bliptab Some systems encourage users to change passwords frequently Warn a few days ahead of expiry Leave no choice on day of expiry
- 25. Computer Network Security 25 One-time passwords Changes every time it is used Assign a static mathematical function, the system provides an argument to the function, and the user computes and returns the function value. Such systems are also called challenge-response systems f(x)=x+1, f(x)=3x2 -9x+2, f(x)=px, px is the xth prime number f(x)=r(x) use x as seed to a random number generator, or the xth random numbers f(a1a2a3a4a5a6)=a3a1a1a4 f(E(x))=E(D(E(x))+1) System provides encrypted value, decrypt, perform arithmetic, re-encrypt One-time passwords are very effective because intercepted passwords are useless
- 26. Computer Network Security 26 Authentication process Even a terrible typist should be able to type password correctly in a few tries A legitimate user will not complain on a delay of 5 to 10 seconds A penetrator’s job would be made unfeasible Repeated failure = not authorized user
- 27. Computer Network Security 27 Fixing flaws Trojan horse: a program displays standard prompt e.g. SYSTEM ERROR, DISCONNECTED Make sure system is reinitialized Turn terminal off and then on Pressing break key Ctrl+alt+del System could display something only the user and the system know, such as last login time
- 28. Computer Network Security 28 ANY QUESTIONS ?