DOC PREVIEW
Berkeley COMPSCI 161 - Lecture Notes

This preview shows page 1-2 out of 6 pages.

Save
View full document
Premium Document
Do you want full access? Go Premium and unlock all 6 pages.
Access to all documents
Download any document
Ad free experience

Unformatted text preview:

CS 161 Computer Security Fall 2008 Dawn Song 1 Notes 1 The scope of this class Our goal in this class is to teach you the some of the most important and useful ideas in computer security By the end of this course we hope you will have learned How to build secure systems You ll learn techniques for designing implementing and maintaining secure systems How to evaluate the security of systems Suppose someone hands you a system they built How do you tell whether their system is any good We ll teach you how systems have failed in the past how attackers break into systems in real life and how to tell whether a given system is likely to be secure How to communicate securely We ll teach you some selections from the science of cryptography which studies how several parties can communicate securely over an insecure communications medium Computer security is a broad field that touches on almost every aspect of computer science We hope you ll enjoy the scenery along the way What is computer security Computer security is about computing in the presence of an adversary One might say that the defining characteristic of the field the lead character in the play is the adversary Reliability robustness and fault tolerance are about how to deal with Mother Nature with random failures in contrast security is about dealing with actions instigated by a knowledgeable attacker who is dedicated to causing you harm Security is about surviving malice and not just mischance Whereever there is an adversary there is a computer security problem Adversaries are all around us The Code Red worm infected a quarter of a million computers in less than a week and contained a time bomb set to try to take down the White House web server on a specific date Fortunately the attack on the White House was diverted but one research company is estimating the worm cost 2 billion in lost productivity and in cleaning up the mess caused by infected machines One company estimated that viruses cost businesses over 50 billion in 2003 Hackers armed with zombie networks of tens of thousands of compromised machines sell their services brazenly promising to take down a competitor s website for a few thousand dollars It s been estimated that as of 2005 at least a million computers worldwide have been penetrated and owned by malicious parties many are used to send massive amounts of spam or make money through phishing and identity fraud Studies suggest that something like half of all spam is sent by such zombie networks It s a racket and it pays well the perpetrators are raking in money fast enough that they don t need a day job How are we supposed to secure our machines when there are folks like this out there That s the subject of this class CS 161 Fall 2008 Notes 1 1 2 It s all about the adversary The early history of computer security is interwoven with military applications probably because the military were one of the first big users of computers and the first to worry seriously about the potential for misuse so it should not be surprising that much of the terminology has military connotations We speak of an attacker who is trying to attack computer systems of defenders working to protect their system from these threats and so on Well you get the idea It might be surprising that we are going to spend so much time studying attackers and thinking about how to break into systems Aren t the attackers the bad guys Why on earth would we want to spread knowledge that will help bad guys be more effective Part of the answer is that you have to know how your system is going to be attacked if you want to defend it properly Civil engineers need to learn what makes bridges fall down if they want to have any chance of building a bridge that will stay standing Software engineering is no different you need to know how systems fail in real life if you want to have the best chance of building a system that will resist attack This means you d better know what kinds of attacks you are likely to face in the field And because attacks change and get better with time you d better learn to anticipate the attacks of the future While learning about recent history is certainly a good start it s not enough to learn only about attacks that have been used in the past Attackers are intelligent or some of them are anyway If you deploy a new defense they will respond If you build a new system they will try to find its weak points and attack there Attackers adapt This means that we have to find ways to anticipate what kinds of attacks might be mounted against us in the future Security is like a game of chess only it is one where the attackers often get the last move We design a system and then it is very hard to change once it has been deployed If attackers find a security hole in a widely deployed system the consequences can be pretty serious Therefore we d better learn to predict in advance what the attackers might do to us so that we can eliminate all the security holes before the system is deployed We have to practice thinking like an attacker so that we will know in advance how secure the system is Thinking like an attacker is not always easy Sometimes it can be a lot of fun to try to outwit the system like a game Other times it can be disconcerting to think about what could go wrong and who could get hurt and that s not fun at all What happens if you don t anticipate how you may be attacked The cellphone industry knows the answer In the 1980 s they designed and deployed an analog cellphone infrastructure with essentially no security measures cellphones transmitted all their billing information in the clear and security rested on the assumption that attackers wouldn t bother to put together the equipment to intercept it That assumption held for a while but sooner or later criminals were bound to catch on and they did Technically savvy attackers built black boxes that intercepted the radio communications and cloned phones and criminals used these to make fraudulent calls en masse and to mount call selling operations for profit Cellphone operators were unprepared for this and in the early 90 s it had gotten so bad that the US cellphone carriers were losing more than 1 billion per year At one point I was told that 70 of the long distance cellphone calls placed from downtown Oakland on a Friday night were fraudulent By this point the cellphone service providers were already well aware that they had a serious problem but because it takes 5 10 years and a great deal


View Full Document

Berkeley COMPSCI 161 - Lecture Notes

Documents in this Course
Rootkits

Rootkits

11 pages

Load more
Download Lecture Notes
Our administrator received your request to download this document. We will send you the file to your email shortly.
Loading Unlocking...
Login

Join to view Lecture Notes and access 3M+ class-specific study document.

or
We will never post anything without your permission.
Don't have an account?
Sign Up

Join to view Lecture Notes and access 3M+ class-specific study document.

or

By creating an account you agree to our Privacy Policy and Terms Of Use

Already a member?