6.857 Computer and Network Security Fall Term, 1996

Lecture 2 : September 10, 1996

Lecturer: Ron Rivest Scribe: Joseph Figueroa

1 Physical Security

Physical security is the basis of computer security. By studying it we gain insight into a good metaphor for other types of security which will study later on. We are going to discuss the two main uses of physical security: protection against natural risks and malicious attacks.

1.1 Natural Risks

Next we will examine which natural risks are the most common threats to computer physical security. To see specific examples of a variety of things that can go wrong, and how things can go wrong simultaneously read Computer-Related Risks by Peter Neumann.

• Power interruption: Power interruption may be hard to recover from. Sometimes it may result in permanent system damage, since electronic components are not designed to absorb sudden power fluctuations. UPS (uninterrupted power supply), surge protectors, alternative power generators are possible security measures although many times their natural state is untested and/or broken. example: Neumann p. 16. AT&T backup battery drain and ultimately causing a 3 airport shut downs.

• Fire: Use of chemical fire supressants (ie. halon), smoke detectors and sprinklers are possible security measures. Chemical fire supressants like halon can be tricky to use because we want to be able to evacuate people easily, but we also want to seal the room to keep the halon contained. When using water sprinklers to put out fires we have to make sure that the water from the sprinklers will not wet the systems, as this may cause electrical fire and/or water damage (see below.)

• Storm/Flood: Lightning during storms can be very damagging (surge protectors usually don’t protect against surges of these magnitudes). The increase of waterfall during storms can critically overload pipes and cause them to rupture. There are two distinctions to be made between raising waters and falling waters. The first can happen in case of flood for example. Systems should be placed in high stands and possibly in higher floors of buildings (not in the basement.) Falling waters may happen because of leakage during heavy storms or because of fire alarm sprinklers. The easiest form of protection in this case is lots of plastic sheets. Others advocate the use of foam fire extinguishers instead of water ones. However, the previous security measures together with a backup system kept offsite would be ideal. example: Neumann p. 56. Passengers were stranded in Sydney’s monorail due to water damage to control computer.

• Earthquake/Meteor/War: These risks may destroy a whole building. In order to quickly restart the computer system first of all we need up to date backups (see section on backups below). Of course the backups should be kept in a separate place possibly miles away. In some cases a cold site may be needed, i.e. a facility with power, cooling and network connections (i.e., at least phone lines), available to install a computer system. For more critical task hot sites may be required. A hot site is a facility with a computer system ready to run and be used. The cost of maintaining a hot site is high but companies usually share the services of a single hot site provider (given the very rarity of use) making the cost fairly affordable.

• Communications interruption: Lines may be cut by people or animals. To protect against accidental severance of communication lines, duplicate lines at different sites are needed. example: Neumann p. 15. Chicago area telephone cable. example: Neumann p. 16. Virginia cable cut. example: Neumann p. 17. Beaver chews on cables.

• Operator error: Errors such as coffee or coke spills and accidental file deletion are very common. Errors such as mounting the wrong tapes or accidentally hitting the wrong key can also occur. example: Neumann p. 77. Chernobyl accident, 1986.

• Software/Hardware error example: Neumann p. 68. Therac-25 chemotherapy machine killed and injured several patients due to software bugs (ie. hardware safelocks were removed and substituted by software ones).

Backups: The most effective solution to many of these natural risks is to create backups. Many types of backups are possible– daily, weekly, and monthly, as well as full, incremental, and differential. Backups can be used either for quick restart or restoration of damaged systems, as well as for record keeping and tracking purposes. Backups should be separately stored in a secure place away from the system. Backups should be regularly tested to make sure that the data on the backups are intact. Also backups may contain sensitive information so they should be protected since they provide an attacker with a potential entry point to private data other than the computer system itself.

1.2 Preventing Malicious Attacks

We will focus on attacks where attacker “needs to get close” to mount attack, rather than on penetration by remote login. Here are some reasons why someone might want to attack: financial gain, disgruntled employee seeking revenge, you are the first available target, to gain fame, diversion, military advantage, etc... It is important to note the difference between a targetted attack and a generic attack: the former requires more robust security measures.

1.2.1 Physical access control

Walls and fences define the security perimeter, while guards and locks enforce access control policy. Only authorized users may enter the perimeter. Possible security leaks include:

• Masquerading: A person disguised as an authorized user. This can be done using forged IDs or pretending to be a repair man.

• Piggy-backing: A person who enters the security perimeter by following an authorized user.

• Lock-picking: Any locked can be picked. Sometimes there is substantial savings over combinatorial brute-force. However, many times the easiest way is simply to go through dropped ceilings or removing the hinges from door. example: MIT Lockpicking Guide

(see http://web.mit.edu/course/6/6.857/www/)

• Visual/auditory access: An unauthorized person can gain passwords by bouncing laser off window to pick up vibrations caused by sound waves. They can also use binoculars, telephone bugs, etc. example: Russians spied on Americans by installing a telephone near coderoom. They got the secret key by hearing the selectric balls on typewriters.

Possible solutions to these attacks include:

• Safes, doors with special locks Locks are useless unless the keys are hard to fake or to obtain (ie. bribery). example: Hotel doors with special access keys based on a sequence of random numbers.

• Clearing or destroying Clearing overwrites data multiple times with some character. Destroying completely destroys the media by, for example, burning or melting. However, it is hard to remove all traces of data (ie. look at how much information has been gathered from the TWA wreckage).

• Motion detectors example: the movie Sneakers.

2 Protecting Computer Systems

Every weekend, one or two notebooks are stolen from the labs in Technology Square. The prevent theft, computers can be secured by locking the machine to a heavy or bulky object (such as a desk), locking the media readers (making it difficult or impossible to use), or locking the computer itself to prevent operation (such as a keyboard or a power supply lock).

2.1 Protecting Physical Media

Possible security leaks include:

• Dumpster Diving: Disposed documents and printouts may yield many secrets such as passwords and confidential information.

• Magnetic Storage Media: Deleted information can often be undeleted.

Possible solutions to these attacks include:

• Clearing: Overwrite the media many times with random bits. Writing to magnetic media can be thought of as spray painting a wall. To cover up old information, you need to “paint” over it several times.

• Purging: Using ultraviolet lights to destroy EEPROMs or using a strong magnet on magnetic storage.

• Destruction: Burning paper documents, grinding off magnetic coating, melting tapes, etc.

The idea of protecting media is to build fences. Physical protection is never perfect; you want to build the barriers high enough so that your attacker will choose an easier target.

2.2 Protecting Software

Another facet of media protection is against software piracy. Software companies such as Microsoft and Nintendo have often utilized the following techniques:

• Serial Number/Manual Text Check

• CPU/Network Address Check

• Harware Dongles: A special hardware device that attaches to the serial port. It contains circuitry or data that is needed to run the software.

• Holograms: Special packaging that prevents foreign duplicators from making “offical looking” copies.

• Watermarking: Each software package has a unique feature or generates a unique output. example: Postscript.

Often the most effective copy protection is no protection at all. By lowering the price of the software or by providing excellent support services, many users are willing to buy their own copy of the software.

Defeated software protection mechanisms are often detected through increased support calls, decreased sales, and by finding anonymous postings of binaries on web sites.

2.3 Protecting Devices and Circuitry

The category of devices and circuitry covers all of the electronic components not considered strictly a computer. Examples of such items include ATM machines, smart cards, electronic wallets, Nintendo security chips, etc. There are two protection techniques: passive (preventative) and active (counter measures).

2.3.1 Passive Protection Techniques

• Burying Circuitry in Epoxy: Makes components hard to remove and study.

• Special Coating: Make the circuitry packaging out of specia materials.

example: A layer of alumina, silicon bits, diamond dust, sodium, and binder coating encapsulates the chip making it hard to etch. The sodium is reactive causing further damage when exposed. These coatings are expensive.

2.3.2 Active Protection Techniques

• Self Destuct Device: Destroys a device or circuitry because any useful funciton or information can be accessed or obtained.

• Sensors: Wires, beams, radio waves, etc. that detect motion, heat, light, sound, and radiation generated by an attacker. Alarms are usually triggered.

Possible security leaks for active techniques include:

• Fast Attacks: Enemy may destroy counter measures before they are activated. Examples include bombs and guns.

• Slow Attacks: Techniques that carefully bypass the counter measures. For example, carefully drilling into an ATM.

• Power usage and timing: By looking at other properties of a system, functionality information may be detected.

2.4 Electromagnetic Radiations

Computers (in particular their monitors and their communications lines) emit electromagnetic radiation. It is possible for an attacker to make use of such emissions in order to create privacy breaches.

Computer CRT signals can be picked up from distances of up to several thousand feet with simple, cheap equipment. Ordinary phone wires are prone to both active attacks (using alligator clips and listening to the signal) which can be detected or inductive attacks which are harder to notice. Fiber optic cables can be compromised by splicing a repeater, bending or nicking the wire, or placing the wire in high-refractive liquids and allowing the light to escape.

It is possible to shield a computer, but it is difficult and expensive to do it well. One possible solution to the CRT problems is to replace conventional tubes with LCD screens. Tempest is the name of the U.S. Government program under which computer equipment is certified as not emitting detectable signals. One approach is to surround circuits with metal shielding. Shielding the whole computer is difficult, since the shield should enclose everything. Some companies choose to shield their entire facility.

example: Schwartau, p.138.

3 Communications

The phone system is the biggest communications system around. Securing this medium has proven to be a difficult task. Watching how security on the phones has changed, in adaptation to the different attacks on the system, is a good way to study the evolution of security, in general. Phone booths and pay phones have evolved into highly impenetrable fortresses. They are designed against physical attacks and attempts to make money off of them as well as being difficult to vandalize.

Some terminology was brought up: phone freaks, computer hackers, and phracks. A phone freak is someone who uses phones illegally, a computer hacker is someone who breaks into computer systems illegally; the combination of the two is called a phrack.

We observed that phone system users depend on:

• Reliability Phone systems are expected to be working all the time. A January 15, 1990 incident was described where a bug in AT&T telephone switching software caused an outage for half of the United States. The bug was traced down to a case statement in some C code. According to The Hacker Crackdown, “Within the C software was a long ‘do... while’ construct. The ‘do... while’ construct contained a ‘switch’ statement. The ‘switch’ statement contained an ‘if’ clause. The ‘if’ clause contained a ‘break.’ The ‘break’ was supposed to ‘break’ the ‘if clause.’ Instead, the ‘break’ broke the ‘switch’ statement.” This single bug caused all of the mayhem.

• Authenticity

For instance, when one calls a bank phone number, one expects the bank to answer on the other side. But an example was given where phone phracks reprogrammed a Bell South telephone switch to divert the Palm Beach County Probation Department’s incoming calls to a phone sex line.

In general, one should not rely on the phone system for air-tight security or authentication.

Other examples of phone abuse were cited. In the mid 70’s, devices called blueboxes emulated the 2600Hz signal used by phone switches to make long distance calls. With this device, phone users could make free long distance calls. (You didn’t have an excuse not to call home). The 2600Hz signal became the symbolistic name for the phreaks. The alt.2600 newsgroup and FAQ discuss vboxes, red-boxes, blue-boxes, and code for ethernet sniffers.

The cellular phone system is also vulnerable to attack. CNN reported that over 80,000 cell phone numbers were collected while unsuspecting motorists whizzed by on a busy Brooklyn highway. Thieves used a “black box” scanner to intercept numbers. See

http://cnn.com/US/9607/02/newsbriefs/index.html.

Break-ins to company PBX’s where also mentioned. Phracks were able to “bounce” off company PBX’s for free long distance calls.

Items for warning of phone system abuse (eg, caller ID and callback modems) are also circumventable. Such devices are simply “higher fences” for intruders to jump over.

4 Risk Analysis

Risk Analysis is about analyzing a situation and the risks that apply to it, as well as the security measures being taken currently and the measures that could be taken (more or less measures). It is a standard approach for deciding the seriousness of a risk. It is done to show the validity of an expensive system that appears to do nothing useful. It is a validation for security budgets. In class we discussed the Lojack system, a device to aid in re-acquiring a stolen car.

To recover a stolen car equipped with Lojack, a call is first made to Lojack officials. Then a beacon is set off in the stolen car. Police track down the car and [usually] apprehend the thief.

Risk Analysis Process:

1. Identify assets & penalties and determine value

car 50 emotional stress 100 late lecture notes delivery …

2. Find vulnerability

• theft

• accidental loss

• damage

3. Estimate likelihood of exploitation

1% Chance Car stolen in a year in Boston

Without Lojack With Lojack
Pr(lost forever) 75% 10%
Emotional [therapy] factor $2000  $2000
Pr(recovered) 25% 90%
Emotional [therapy] factor $1000  $750
Expected Loss  $1750  $900

Figure 1: Cost analysis of a stolen car in Boston, where Pr(car is stolen)=1%/yr 4. Figure annual loss

Approximate the loss taking into account insurance, car value, and emotional stress per year.

5. Determine cost of added security

We guestimated a $250 initial registration fee and a $500 fee for actually requesting the beacon to be switched on. The benefit of using the Lojack system is reduced insurance (save $50/yr). Assume a $500 deductible.

6. Estimate likelihood of exploitation under added security

The Lojack system decreases the likelihood that a thief will get away.

7. Form conclusion

The Lojack system will save the consumer money on the average as described in figure 1. The expected cost of a car without Lojack is $17.50/yr while a car with Lojack is $25 (registration) + $9 (stolen) - $50 (insurance) = -$16/yr.

Notice how silly this can be, since the numbers are all such rough estimates. Even though it may seem silly here, especially with our soft numbers and no research done into the problem, in big systems, where a computer company has a vested interest in finding out whether or not to protect themselves, risk analysis is useful. This example was more meant to show the method of the procedure, rather than its usefulness.