计算机科学概述 Introduction to Computer Science

1. 计算机科学概述 Introduction to Computer Science 陆嘉恒 中国人民大学 信息学院 www.jiahenglu.net

2. Computer Crime and Ethical Issues（计算机犯罪与职业道德）

3. Computer Crime Introduction Hacking Online Scams Fraud, Embezzlement, Sabotage, Information Theft, and Forgery Crime Fighting Versus Privacy and Civil Liberties

4. Introduction • Computers Are Tools • Computers assist us in our work, expand our thinking, and provide entertainment. • Computers Are Used to Commit Crimes • Preventing, detecting, and prosecuting computer crime is a challenge.

5. Hacking • The Phases of Hacking • Phase One: The early years • 1960s and 1970s. • Originally, hacker referred to a creative programmer wrote clever code. • The first operating systems and computer games were written by hackers. • The term hacking was a positive term. • Hackers were usually high-school and college students. Q: Describe a modern-day version of “clever” hacks.

6. Hacking • The Phases of Hacking (cont’d) • Phase Two: Hacking takes on a more negative meaning. • 1970s through 1990s. • Authors and the media used the term hacker to describe someone who used computers, without authorization, sometimes to commit crimes. • Early computer crimes were launched against business and government computers. • Adult criminals began using computers to commit their crimes. Q: Distinguish between the hacking done by Kevin Mitnick and Robert J. Morris.

7. Hacking • The Phases of Hacking • Phase Three: The Web Era • Beginning in the mid-1990s. • The increased use of the Internet for school, work, business transactions, and recreation makes it attractive to criminals with basic computer skills. • Crimes include the release of malicious code (viruses and worms). • Unprotected computers can be used, unsuspectingly, to accomplish network disruption or commit fraud. Q: Why are denial-of-service attacks difficult to prevent?

8. Hacking • Hactivism • …is the use of hacking expertise to promote a political cause. • This kind of hacking can range from mild to destructive activities. • Some consider hactivism as modern-age civil disobedience. • Others believe hactivism denies others their freedom of speech and violates property rights. Q: Argue the case that hactivism is ethical.

9. Hacking • The Law • Computer Fraud and Abuse Act (CFAA, 1986) • It is a crime to access, alter, damage, or destroy information on a computer without authorization. • Computers protected under this law include: • government computers, • financial systems, • medical systems, • interstate commerce, and • any computer on the Internet. Q: Is your personal computer protected under this law?

10. Hacking • The Law (cont’d) • USA Patriot Act (USAPA, 2001) • Amends the CFAA. • Allows for recovery of losses due to responding to a hacker attack, assessing damages, and restoring systems. • Higher penalties can be levied against anyone hacking into computers belonging to criminal justice system or the military. • The government can monitor online activity without a court order. Q: Are anti-hacking laws adequate?

11. Hacking • Catching Hackers • … requires law enforcement to recognize and respond to myriad hacking attacks. • Computer forensics tools may include: • Undercover agents, • Honey pots (sting operations in cyberspace), • Archives of online message boards, • Tools for recovering deleted or coded information. • Computer forensics agencies and services include: • site and telephone logs, etc.. Q: What computer forensics tools or agencies have been in the news lately?

12. Hacking • Questions About Penalties • Intent • Should hackers who did not intend to do damage or harm be punished differently than those with criminal intentions? • Age • Should underage hackers receive a different penalty than adult hackers? • Damage Done • Should the penalty correspond to the actual damage done or the potential for damage?

13. Hacking • Security • Security weaknesses can be found in the computer systems used by: • businesses, • government (classified and unclassified), and • personal computers. • Causes of security weakness: • characteristics of the Internet and Web, • human nature, • inherent complexity of computer systems. Q: How secure is your computer at home? At work?

14. Hacking • Security can be improved by: • Ongoing education and training to recognize the risks. • Better system design. • Use of security tools and systems. • Challenging “others” to find flaws in systems. • Writing and enforcing laws that don’t stymie research and advancement. Q: Does weak security justify intrusion?

15. Online Scams • Auctions • Selling and buying goods online has become popular. • Problems: • sellers don’t send the goods, • sellers send inferior goods, • price is driven up by shill bidding, and • illegal goods sold. • Solutions: • educate customers,

16. Fraud, Embezzlement, Sabotage, Identity Theft, and Forgery • Some Causes of Fraud • Credit-Card • Stolen receipts, mailed notices, and cards. • Interception of online transaction or weak e-commerce security. • Careless handling by card-owner. • ATM • Stolen account numbers and PINs. • Insider knowledge. • A counterfeit ATM. • Telecommunications • Stolen long-distance PINs. • Cloned phones. Q: What is the legal definition of fraud? Embezzlement? Sabotage? Theft?

17. Fraud, Embezzlement, Sabotage, Identity Theft, and Forgery • Some Defenses Against Fraud • Credit-Card • Instant credit-card check. • Analysis of buying patterns. • Analysis of credit card applications (to detect identity theft). • Verify user with Caller ID. • ATM • Redesigned ATMs. • Limited withdrawal. • Telecommunications • match phone “signature” with serial number. • identify phone without broadcasting serial number. Q: Identify a business’ defense against fraud that you have witnessed.

18. Fraud, Embezzlement, Sabotage, Identity Theft, and Forgery • Forgery • Some Causes • Powerful computers and digital manipulation software. • High-quality printers, copiers, and scanners. • Some Defenses • Educate consumers and employees. • Use anti-counterfeiting techniques during production. • Use counterfeit detection methods. • Create legal and procedural incentives to improve security. Q: How would you educate your peers about the risks of digital forgery? A parent? A child?

19. Crime Fighting vsPrivacy and Civil Liberties • Scams • Crime Fighting • Automated surveillance software to look for suspicious Web activity. • Privacy and Civil Liberties • No search warrant nor proof of probable cause. • Biometrics • Crime Fighting • Exact match of biological characteristics to a unique person. • Privacy and Civil Liberties • Easy to build complete dossier on people. Q: How much of your privacy and civil liberties are you willing to give up in order to allow law enforcement to better fight computer crime?

20. Crime Fighting vsPrivacy and Civil Liberties • Search and Seizure of Computers • Crime Fighting • Obtain evidence of a crime. • Privacy and Civil Liberties • Day-to-day business ceases; non-criminal contact with others ends. • The Cybercrime Treaty • Crime Fighting • U.S. and European governments agree to cooperate with investigations. • Privacy and Civil Liberties • Potential for government spying is great. Q: Might there be incriminating data stored about you in the logs of your ISP?

21. Current situation of cyber crime in China

22. The development of Internet A cow was lost in Jan 14th 2003. If you know where it is, please contact with me. My QQ number is 87881405. QQ is one of the most popular IM in China.

23. Number of cases

24. Age of the offenders

25. Computer Crime Vs Computer facilitated crime

26. Major categories of cyber facilitated crime

27. Hacking case: HOW?Major categories of intrusion technology used by hackers in the cases we investigated

28. Hacking case: HOW? • The following intrusion methods increased rapidly in recent year and became one of the major intrusion technology • Large-scale intrusion by exploiting vulnerability of client software • Large-scale intrusion by decoying users to install malicious code through P2P, IM, Email network

29. A virus on QQ (a most popular IM) were created to spread malware in order to creat an IRC botnet: 60,000 hosts were infected. Case example Wi.ourmid.com “Please visit wi.ourmidi.com”

30. How did the criminal (“hackers”) occupy the victim hosts? Those who don’t know a lot about technology make profit by damage the network security directly. Those who know technology make profit by selling technology.

31. “Hacking” without knowledge of technologyCase example: Netbank accounts stealing • Case outline: • In August, a malicious code were widely distributed and more than 300 Netbank accounts were stolen. • The suspect intruded into a website and put malicious code on the main webpage. • When users browsing the website, the malicious code will be installed automatically onto the user’s hosts. • The malicious code will steal all kind of Netbank accounts and post onto another website hacked by the suspect. • However: • The suspect know nothing about hacking technology. • The suspect bought the malicious code and victim websites totally from other hackers. • The suspect only working step by step according to the manual provided by other hackers.

32. Hacking cases: WHY?

33. Hacking cases: WHERE?How did they connected to Internet? Mobile/Wireless crime increased at the same time.

34. Hacking cases: TARGET? Personal computers become the major part of victim in computer crime in recent year.

35. “Preference” of hackers Damage to Internet Security Profit

36. Why did they become criminal? • They think: • It’s not a crime, it’s just a game. • A lot of people do it on Internet, so I can do it. • I know it’s a crime, but I need money. • I can hide myself very well. • No one will investigate it.

37. What we learn from these data • Computer crime and traditional crime are intermingle with each other. • XSS vulnerability with phishing • DDOS/IRC botnet with extortion • … • Current protection technology have not successfully protect against following attack yet. • Sql injection • XSS • Distribute malware over P2P/IM network • Social engineering • …

38. What we learn from these data • Those who don’t know a lot of technology cause most of the damage to Internet directly. • Their major aim is to make profit by stealing identity, Netbank account, online stock account, online game account etc. • Most of them don’t realized that there activity cause severe damage to Internet security.

39. What we learn from these data • Exploit/Malicious code seller is one of the most big threat to cyber security. • Investigation of exploit and malicious code should be emphasized by cyber police. • Personal computer is becoming the major target of computer crime. • Antivirus software will play a more important role in cyber protection.

40. How can anti-virus industry help cyber police? • Report to police authority before publishing the detail information about the malcode/virus • We have investigate the source of several virus this year. • However, the detail information about the virus were published and the suspect never access the related network resource anymore. • If you reporting to us beforehand, the source of most identity stealing malicious code can be revealed.

41. How can anti-virus industry help cyber police? • Save the trail of virus. • When we try to investigate a Botnet in 2003, we try to trace the source of the malicious code. • However, malicious codes on a lot of victim hosts were killed by the anti-virus software. • For example, save the following information • Time stamp • Hash value. • Etc.

42. How can anti-virus industry help cyber police? • Compare the character of different kinds of virus in order to find out the virus produced by the same author. • A criminal is not grown up in one day. • They always create more than one kind of virus.

43. How can anti-virus industry help cyber police. • Integrate basic forensic analysis function into antivirus software. • For example, extract the automatic running program list, there time stamp and hash value. • When the user report an incident to anti-virus company, you will get more chance to collect the malicious code. • Integrate antivirus technology into popular P2P, IM, Email and WEB server. • Just kill the malicious code on personal computer fail to throttle the spread of malicious code. • The malicious code distributed through P2P, IM, Email and WEB server can hardly be monitored and throttled.