\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {4}
\sloppy
 
\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}
 
\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}
 
\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}
 
\begin{document}
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%               ordinal number of the lecture
%               date of the lecture
%               lecturer
%               scribe---that is you
%
\lecture{2}{September 10, 1996}{Ron Rivest}{Joseph Figueroa} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
\section{Physical Security}
 
Physical security is the basis of computer security.  By studying it we 
gain insight into a good metaphor for other types of security which will 
study later on.  We are going to discuss the two main uses of physical 
security: protection against natural risks and malicious attacks.
 
\subsection{Natural Risks}
 
Next we will examine which natural risks are the most common threats to 
computer physical security.  To see specific examples of a variety of things 
that can go wrong, and how things can go wrong simultaneously read 
{\em Computer-Related Risks} by Peter Neumann.
 
\begin{itemize}
\item {\bf Power interruption}:
Power interruption may be hard to recover from.  Sometimes it may
result in permanent system damage, since electronic components are
not designed to absorb sudden power fluctuations.  UPS (uninterrupted
power supply), surge protectors, alternative power generators are
possible security measures although many times their natural state 
is untested and/or broken.
\newline {\it example}: Neumann p. 16.  AT\&T backup battery drain and ultimately causing a 3 airport shut downs.
 
\item {\bf Fire}:
Use of chemical fire supressants (ie. halon), smoke detectors and sprinklers 
are possible security measures.  Chemical fire supressants like halon can be tricky to use because we want to be able to evacuate people easily, but we also want to seal the room to keep the halon contained.  When using water sprinklers to put out fires we have to make sure that the water from the sprinklers will not wet the systems, as this may cause electrical fire and/or water damage (see below.) 
 
\item {\bf Storm/Flood:} Lightning during storms can be very damagging (surge
protectors usually don't protect against surges of these magnitudes).  
The increase of waterfall during storms can critically overload pipes and 
cause them to rupture.  There are two distinctions to be made
between raising waters and falling waters. The first can happen in case
of flood for example. Systems should be placed in high stands and 
possibly in higher floors of buildings (not in the basement.)
Falling waters may happen because of leakage during heavy storms or 
because of fire alarm sprinklers. The easiest form of protection 
in this case is lots of plastic sheets. Others advocate the use of
foam fire extinguishers instead of water ones.  However, the previous security
measures together with a backup system kept offsite would be ideal.
\newline {\it example}: Neumann p. 56.  Passengers were stranded in
Sydney's monorail due to water damage to control computer.
 
\item {\bf Earthquake/Meteor/War}:
These risks may destroy a whole building.  In order to quickly
restart the computer system first of all we need up to date backups
(see section on backups below). Of course the backups should be
kept in a separate place possibly miles away. In some cases a 
{\em cold site} may be needed, i.e. a facility with power, 
cooling and network connections (i.e., at least phone lines), available to 
install a computer system. For more critical task {\em hot sites} may be 
required. A hot site is a facility with a computer system ready to run 
and be used. The cost of maintaining a hot site is high but companies usually
share the services of a single hot site provider (given the very rarity
of use) making the cost fairly affordable. 
 
\item {\bf Communications interruption}:
Lines may be cut by people or animals.  To protect against accidental 
severance of communication lines, duplicate lines at different sites are 
needed.
\newline {\it example}: Neumann p. 15.  Chicago area telephone cable.
\newline {\it example}: Neumann p. 16.  Virginia cable cut.
\newline {\it example}: Neumann p. 17.  Beaver chews on cables.
 
\item {\bf Operator error}: 
Errors such as coffee or coke spills and accidental file deletion are very
common.  Errors such as mounting the wrong tapes or accidentally hitting the
wrong key can also occur.
\newline {\it example}: Neumann p. 77.  Chernobyl accident, 1986.
 
\item {\bf Software/Hardware error}
\newline {\it example}: Neumann p. 68.  Therac-25 chemotherapy machine
killed and injured several patients due to software bugs (ie. hardware 
safelocks were removed and substituted by software ones).
\end{itemize}
 
{\bf Backups:} 
The most effective solution to many of these natural risks is to
create backups.  Many types of backups are possible-- daily, weekly,
and monthly, as well as full, incremental, and differential.  Backups
can be used either for quick restart or restoration of damaged
systems, as well as for record keeping and tracking purposes.  Backups
should be separately stored in a secure place away from the system.
Backups should be regularly tested to make sure that the data on the
backups are intact. Also backups may contain sensitive information so they
should be protected since they provide an attacker with a potential
entry point to private data other than the computer system itself. 
 
\subsection{Preventing Malicious Attacks}
We will focus on attacks where attacker ``needs to get close'' to mount attack,
rather than on penetration by remote login.  Here are some reasons why someone might want to attack: financial gain, disgruntled employee seeking revenge,
you are the first available target, to gain fame, diversion, military 
advantage, etc...  It is important to note the difference between a targetted 
attack and a generic attack: the former requires more robust security measures.
 
\subsubsection{Physical access control}
 
{\bf Walls} and {\bf fences} define the security perimeter, while {\bf
guards} and {\bf locks} enforce access control policy.  Only
authorized users may enter the perimeter.  Possible security leaks
include:
 
\begin{itemize}
\item {\bf Masquerading}:
A person disguised as an authorized user.  This can be done using
forged IDs or pretending to be a repair man.
 
\item {\bf Piggy-backing}:
A person who enters the security perimeter by following an authorized
user.
 
\item {\bf Lock-picking}:
Any locked can be picked.  Sometimes there is substantial savings over
combinatorial brute-force.  However, many times the easiest way is simply 
to go through dropped ceilings or removing the hinges from door.
\newline {\it example}: {\em MIT Lockpicking Guide}
 
(see http://web.mit.edu/course/6/6.857/www/)
 
\item {\bf Visual/auditory access}:
An unauthorized person can gain passwords by bouncing laser off window to
pick up vibrations caused by sound waves.  They can also use binoculars, 
telephone bugs, etc.
\newline {\it example}: Russians spied on Americans by installing a telephone near coderoom.  They got the secret key by hearing the selectric balls on typewriters.
 
\end{itemize}
 
Possible solutions to these attacks include:
 
\begin{itemize}
\item {\bf Safes, doors with special locks}
Locks are useless unless the keys are hard to fake or to obtain (ie. bribery).
\newline {\it example}: Hotel doors with special access keys based on
a sequence of random numbers.
 
\item {\bf Clearing or destroying}
{\it Clearing} overwrites data multiple times with some character.
{\it Destroying} completely destroys the media by, for example, burning or 
melting.  However, it is hard to remove all traces of data (ie. look at
how much information has been gathered from the TWA wreckage).
 
\item {\bf Motion detectors}
\newline {\it example}: the movie {\it Sneakers}.
\end{itemize}
 
\section {Protecting Computer Systems}

Every weekend, one or two notebooks are stolen from the labs in 
Technology Square.  The prevent theft, computers can be secured 
by locking the machine to a heavy or bulky object (such as a desk), 
locking the media readers (making it difficult or impossible to
use), or locking the computer itself to prevent operation (such as a 
keyboard or a power supply lock).

\subsection {Protecting Physical Media}

Possible security leaks include:
\begin{itemize}
	\item {\bf Dumpster Diving:} Disposed documents and printouts 
may yield many secrets such as passwords and confidential information.
	\item {\bf Magnetic Storage Media:} Deleted information can 
often be undeleted.
\end{itemize}

Possible solutions to these attacks include:

\begin{itemize}
	\item {\bf Clearing:} Overwrite the media many times with 
random bits.  Writing to magnetic media can be thought of as spray 
painting a wall.  To cover up old information, you need to ``paint'' 
over it several times.
	\item {\bf Purging:} Using ultraviolet lights to destroy 
EEPROMs or using a strong magnet on magnetic storage.
	\item {\bf Destruction:} Burning paper documents, grinding 
off magnetic coating, melting tapes, etc.
\end{itemize}

The idea of protecting media is to build fences.  Physical protection
is never perfect; you want to build the barriers high enough so that
your attacker will choose an easier target.

\subsection{Protecting Software}

Another facet of media protection is against software piracy.  
Software companies such as Microsoft and Nintendo have often utilized
the following techniques:

\begin{itemize}
	\item {\bf Serial Number/Manual Text Check}
	\item {\bf CPU/Network Address Check}
	\item {\bf Harware Dongles:} A special hardware device that 
attaches to the serial port.  It contains circuitry or data that is 
needed to run the software.
	\item {\bf Holograms:} Special packaging that prevents foreign
duplicators from making ``offical looking'' copies.
	\item {\bf Watermarking:} Each software package has a unique 
feature or generates a unique output.

{\em example:} Postscript.
\end{itemize}

Often the most effective copy protection is no protection at all.  By 
lowering the price of the software or by providing excellent support 
services, many users are willing to buy their own copy of the 
software.

Defeated software protection mechanisms are often detected through 
increased support calls, decreased sales, and by finding anonymous
postings of binaries on web sites.

\subsection{Protecting Devices and Circuitry}

The category of devices and circuitry covers all of the electronic 
components not considered strictly a computer.  Examples of such
items include ATM machines, smart cards, electronic wallets, Nintendo 
security chips, etc.  There are two protection techniques: passive 
(preventative) and active (counter measures).

\subsubsection{Passive Protection Techniques}

\begin{itemize}
	\item {\bf Burying Circuitry in Epoxy:} Makes components hard 
to remove and study.
	\item {\bf Special Coating:} Make the circuitry packaging out
of specia materials.
	      
{\em example: } A layer of alumina, silicon bits, diamond 
dust, sodium, and binder coating encapsulates the chip making it hard 
to etch.  The sodium is reactive causing further damage when exposed.  
These coatings are expensive.
\end{itemize}

\subsubsection{Active Protection Techniques}

\begin{itemize}
	\item {\bf Self Destuct Device:} Destroys a device or 
circuitry because any useful funciton or information can be accessed 
or obtained.
	\item {\bf Sensors:} Wires, beams, radio waves, etc. that 
detect motion, heat, light, sound, and radiation generated by an 
attacker.  Alarms are usually triggered.
\end{itemize}

Possible security leaks for active techniques include:

\begin{itemize}
	\item {\bf Fast Attacks:} Enemy may destroy counter measures
before they are activated.  Examples include bombs and guns.
	\item {\bf Slow Attacks:} Techniques that carefully bypass the
counter measures.  For example, carefully drilling into an ATM.
	\item {\bf Power usage and timing:} By looking at other properties
of a system, functionality information may be detected.
\end{itemize}

\subsection{Electromagnetic Radiations}

Computers (in particular their monitors and their communications
lines) emit electromagnetic radiation.  It is possible for an attacker
to make use of such emissions in order to create privacy breaches.

Computer CRT signals can be picked up from distances of up to several
thousand feet with simple, cheap equipment.  Ordinary phone wires are
prone to both active attacks (using alligator clips and listening
to the signal) which can be detected or inductive attacks which are
harder to notice.  Fiber optic cables can be compromised by splicing 
a repeater, bending or nicking the wire, or placing the wire in 
high-refractive liquids and allowing the light to escape.

It is possible to shield a computer, but it is difficult and expensive
to do it well.  One possible solution to the CRT problems is to replace
conventional tubes with LCD screens.  {\sc Tempest} is the name of the 
U.S. Government program under which computer equipment is certified as 
not emitting detectable signals.  One approach is to surround circuits
with metal shielding.  Shielding the whole computer is difficult, since
the shield should enclose everything.  Some companies choose to shield
their entire facility.

{\em example:} Schwartau, p.138.

\section {Communications}

The phone system is the biggest communications system around.
Securing this medium has proven to be a difficult task.  Watching how
security on the phones has changed, in adaptation to the different
attacks on the system, is a good way to study the evolution of
security, in general.  Phone booths and pay phones have evolved into
highly impenetrable fortresses.  They are designed against physical
attacks and attempts to make money off of them as well as being
difficult to vandalize.

Some terminology was brought up: phone freaks, computer hackers, and
phracks.  A phone freak is someone who uses phones illegally, a
computer hacker is someone who breaks into computer systems illegally;
the combination of the two is called a phrack.

We observed that phone system users depend on:
\begin{itemize}
\item Reliability

	Phone systems are expected to be working all the time.  A
	January 15, 1990 incident was described where a bug in AT\&T
	telephone switching software caused an outage for half of the
	United States.  The bug was traced down to a case statement in
	some C code.  According to {\em The Hacker Crackdown}, ``Within
	the C software was a long `do... while' construct. The
	`do... while' construct contained a `switch' statement. The
	`switch' statement contained an `if' clause. The `if' clause
	contained a `break.'  The `break' was supposed to `break' the
	`if clause.' Instead, the `break' broke the `switch'
	statement.''  This single bug caused all of the mayhem.
\item Authenticity

	For instance, when one calls a bank phone number, one expects
	the bank to answer on the other side.  But an example was
	given where phone phracks reprogrammed a Bell South telephone
	switch to divert the Palm Beach County Probation Department's
	incoming calls to a phone sex line.  

	In general, one should not rely on the phone system for
	air-tight security or authentication.

\end{itemize}

Other examples of phone abuse were cited.  In the mid 70's, devices
called {\em blue-boxes} emulated the 2600Hz signal used by phone
switches to make long distance calls.  With this device, phone users
could make free long distance calls.  (You didn't have an excuse
not to call home).  The 2600Hz signal became the symbolistic name for
the phreaks.  The alt.2600 newsgroup and FAQ discuss vboxes,
red-boxes, blue-boxes, and code for ethernet sniffers.

The cellular phone system is also vulnerable to attack.  CNN reported
that over 80,000 cell phone numbers were collected while unsuspecting
motorists whizzed by on a busy Brooklyn highway.  Thieves used a
``black box'' scanner to intercept numbers.  See {\tt
http://cnn.com/US/9607/02/newsbriefs/index.html}.

Break-ins to company PBX's where also mentioned.  Phracks were able to
``bounce'' off company PBX's for free long distance calls.

Items for warning of phone system abuse (eg, caller ID and callback modems)
are also circumventable.  Such devices are simply ``higher fences'' for
intruders to jump over.

\section {Risk Analysis}


Risk Analysis is about analyzing a situation and the risks that
apply to it, as well as the security measures being taken currently
and the measures that could be taken (more or less measures).  It is a
standard approach for deciding the seriousness of a risk.  It is done
to show the validity of an expensive system that appears to do nothing
useful.  It is a validation for security budgets.  In class we discussed
the Lojack system, a device to aid in re-acquiring a stolen car.

To recover a stolen car equipped with Lojack, a call is first made to
Lojack officials.  Then a beacon is set off in the stolen car.  Police
track down the car and [usually] apprehend the thief.

\begin{figure}[bp]
\hspace{1in}\begin{tabular}{|l|l|l|} \hline
				& Without Lojack	& With Lojack \\ \hline
Pr(lost forever)		& 75\%			& 10\% \\
Emotional [therapy] factor	& \$2000 		& \$2000 \\ \hline
Pr(recovered)			& 25\%			& 90\% \\
Emotional [therapy] factor	& \$1000 		& \$750 \\ \hline
Expected Loss			& \$1750		& \$900 \\ \hline
\end{tabular}
\caption{Cost analysis of a {\bf stolen} car in Boston, where Pr(car is
stolen)=1\%/yr}
\end{figure}

Risk Analysis Process:
\begin{enumerate}
  \item Identify assets \& penalties and determine value
\begin{tabbing}
sssss \= ssssssssssssssssssssssssssssss \= ssssssssss \= ssssssssss \= \kill
\> car \> 50 \\
\> emotional stress \> 100 \\
\> late lecture notes delivery \> \ldots \\
\end{tabbing}
  \item Find vulnerability
	\begin{itemize}
	\item theft
	\item accidental loss
	\item damage
	\end{itemize}
  \item Estimate likelihood of exploitation
\begin{tabbing}
sssss \= ssssssssssssss \= ssssssssss \= ssssssssss \= \kill
\> 1\% Chance \> Car stolen in a year in Boston \\
\end{tabbing}

  \item Figure annual loss

Approximate the loss taking into account insurance, car value,
and emotional stress per year.

  \item Determine cost of added security

	We guestimated a \$250 initial registration fee and a \$500
	fee for actually requesting the beacon to be switched on.  The
	benefit of using the Lojack system is reduced insurance (save
	\$50/yr).  Assume a \$500 deductible.

  \item Estimate likelihood of exploitation under added security

The Lojack system decreases the likelihood that a thief will get away.

  \item Form conclusion

The Lojack system will save the consumer money on the average as
described in figure 1.  The expected cost of a car without Lojack is
\$17.50/yr while a car with Lojack is \$25 (registration) + \$9
(stolen) - \$50 (insurance) = -\$16/yr.

\end{enumerate}

Notice how silly this can be, since the numbers are all such rough
estimates.  Even though it may seem silly here, especially
with our soft numbers and no research done into the problem, in big
systems, where a computer company has a vested interest in finding
out whether or not to protect themselves, risk analysis is useful.
This example was more meant to show the method of the procedure, rather
than its usefulness. 
 
\end{document}
