2nd PUC Computer Science Chapter 12 Security Aspects Notes

Chapter Overview

As computers and devices become increasingly connected, different network threats can affect computer systems and data. Network security is concerned with protecting devices and data from illegitimate access or misuse.

This chapter discusses threats and prevention, malware, antivirus, spam, HTTP and HTTPS, firewalls, cookies, hackers and crackers, and different network security threats.

12.1 Threats and Prevention

A computer that has no link to an external device or computer is free from security threats arising through such connections. However, staying completely disconnected is not an ideal solution because the world is becoming increasingly connected.

The connectedness of different devices and computers brings various network threats into focus. Threats include the different ways in which someone can exploit a vulnerability or weakness in a network or communication system to cause harm or damage a person’s reputation.

12.2 Malware

Different types of malware have been created over time and have caused large-scale damage. Different types continue to appear regularly and can compromise computer security and cause intangible damage.

Some kinds of malware mentioned in the chapter are: Viruses, Worms, Ransomware, Trojans, Spyware, Adware and Keyloggers.

12.2.1 Virus

• The term computer virus was coined by Fred Cohen in 1985.
• The term was borrowed from biological science because of similar behaviour.
• A computer virus infects other systems by copying or inserting its code into computer programs or executable files.
• A virus remains dormant on a system and becomes active when the infected file is opened or executed by a user.
• It can spread when it comes into contact with another system.

Common Motives of Viruses

• Stealing passwords or data.
• Corrupting files.
• Spamming the user’s email contacts.
• Taking control of the user’s machine.

Examples Mentioned in the Chapter

CryptoLocker, ILOVEYOU, MyDoom, Sasser, Netsky, Slammer and Stuxnet.

12.2.2 Worms

The major difference between a worm and a virus is that a worm does not need a host program or software into which it inserts its code.

• Worms are standalone programs.
• They are capable of working on their own.
• A virus needs human triggering for replication.
• A worm replicates on its own.
• A worm can spread from one computer to another through a network.

Examples

Storm Worm, Sobig, MSBlast, Code Red, Nimda and Morris Worm.

Virus vs Worm

12.2.3 Ransomware

• Some ransomware blocks access to data.
• Other ransomware encrypts data, making it difficult to access.
• The attacker demands ransom payment.

WannaCry Example from the Chapter

In May 2017, WannaCry infected almost 200,000 computers across 150 countries. It worked by encrypting data and demanding ransom payments in Bitcoin cryptocurrency.

12.2.4 Trojan

• The name is based on the story of the Trojan horse.
• A Trojan does not self-replicate.
• It does not infect other files.
• It spreads through user interaction.
• Examples of user interaction include opening an email attachment or downloading and executing a file from the Internet.
• Some Trojans create backdoors that give malicious users access to a system.

12.2.5 Spyware

• It records and sends collected information to an external entity without consent or knowledge.
• It usually tracks Internet usage data.
• The collected information may be sold to advertisers.
• It can track and capture credit card or bank account information.
• It can capture login and password information.
• It can capture personal identity information.

12.2.6 Adware

• It displays online advertisements through pop-ups, web pages or installation screens.
• After infecting a substantial number of systems, it can generate revenue through displayed advertisements.
• It can also use a pay-per-click mechanism.
• Adware is usually annoying but harmless.
• It can sometimes provide a way for other malware by displaying unsafe links as advertisements.

12.2.7 Keyloggers

• A keylogger records keyboard usage in logs.
• The logs may be sent to an external entity.
• Passwords, emails and private conversations can be revealed without the user’s knowledge.
• The chapter suggests using a virtual keyboard while signing into online accounts from an unknown computer as one strategy to avoid password leaks by keyloggers.

Online Virtual Keyboard vs On-Screen Keyboard

Hardware Keylogger

To implement a keylogger in hardware, a thin transparent keyboard can be placed over the actual keyboard or input pad of the intended machine. It records the keystrokes pressed by the user.

12.2.8 Modes of Malware Distribution

Malware can use different routes to reach a computer. The common distribution channels described in the chapter are:

12.2.9 Combating Malware

Common Signs of Malware Infection

• Frequent pop-up windows prompting the user to visit a website or download software.
• Changes to the default homepage of the web browser.
• Mass emails being sent from the user’s email account.
• An unusually slow computer with frequent crashes.
• Unknown programs starting when the computer is turned on.
• Programs opening and closing automatically.
• Sudden lack of storage space.
• Random messages, sounds or music appearing.
• Programs or files appearing or disappearing without the user’s knowledge.

Preventive Measures Against Malware

1. Use antivirus, anti-malware and related software and update them regularly.
2. Configure browser security settings.
3. Check for a lock button in the address bar while making payments.
4. Never use pirated or unlicensed software. Instead, use Free and Open Source Software (FOSS).
5. Apply software updates and patches released by manufacturers.
6. Take regular backups of important data.
7. Enforce firewall protection in the network.
8. Avoid entering sensitive or personal information on unknown or public computers.
9. Avoid entering sensitive data on an unknown network, such as public Wi-Fi, even when using your own computer.
10. Avoid clicking links or downloading attachments from unsolicited emails.
11. Scan removable storage devices with antivirus software before transferring data to or from them.
12. Never share online account or banking passwords/PINs with anyone.
13. Remove programs that are not recognised from the system.
14. Do not install anti-spyware or antivirus software presented through a pop-up or advertisement.
15. Use the pop-up window’s X icon at the top-right to close an advertisement instead of clicking its “close” button.
16. If an installation starts unexpectedly, cancel it immediately to avoid further damage.

12.3 Antivirus

12.3.1 Methods of Malware Identification Used by Antivirus

(A) Signature-Based Detection

This method uses a signature database known as the Virus Definition File (VDF).

• The VDF contains virus signatures.
• It is continuously updated on a real-time basis.
• Regular antivirus updates are therefore necessary.
• An outdated VDF may fail to detect new malware.
• The method can fail against malware that changes its signature, known as polymorphic malware.
• It can also fail when some portion of the malware code is encrypted.

(B) Sandbox Detection

A new application or file is executed in a virtual environment called a sandbox. Its behavioural fingerprint is observed to determine whether it may be malware.

• The antivirus engine observes the behaviour.
• The method is somewhat slow.
• It is considered very safe because the unknown application is not given access to the actual system resources.

(C) Data Mining Techniques

This method uses data mining and machine learning techniques to classify the behaviour of a file as either benign or malicious.

(D) Heuristics

Malware infection often follows a certain pattern. In this method, the source code of a suspected program is compared with viruses already known and stored in a heuristic database.

If most of the source code matches code in the heuristic database, the code is flagged as a possible threat.

(E) Real-Time Protection

Some malware remains dormant or becomes active after some time. Real-time protection checks for such malware continuously.

• The anti-malware software keeps running in the background.
• It observes an application’s or file’s behaviour for suspicious activity while it is being executed.
• The checking occurs while the program/file resides in the active or main memory of the computer system.

12.4 Spam

Organisations or individuals may buy or create mailing lists containing email addresses and repeatedly send advertisement links and invitation emails to many users.

• It creates unnecessary junk in the receiver’s inbox.
• It can trick a user into buying something.
• It can trick a user into downloading paid software or malware.
• Email services such as Gmail and Hotmail have automatic spam-detection algorithms.
• A user can mark an undetected unsolicited email as spam.

12.5 HTTP vs HTTPS

HTTP and HTTPS are sets of rules or protocols governing how data is transmitted over the World Wide Web. They provide rules for communication between client web browsers and servers.

12.6 Firewall

• A firewall can be implemented in software, hardware or both.
• It acts as the first barrier against malware such as worms.
• It acts as a network filter.
• It continuously monitors and controls incoming and outgoing traffic.
• It works according to predefined security rules.

Example of a Firewall Rule

A rule can be configured in a school LAN so that a student cannot access data from the finance server, while the school accountant can access the finance server.

12.6.1 Types of Firewall

Activity 12.1

Ask your teacher to show you how to enable and disable a firewall on your computer.

12.7 Cookies

The term “cookie” was derived from the term “magic cookie” used by Unix programmers for a packet of data that a program receives and sends back unchanged.

• A website stores the cookie on the client’s computer.
• The cookie is edited only by the website that created it.
• The client’s computer acts as the host for storing the cookie.
• Cookies are used to store browsing information.

Uses of Cookies

On an e-commerce website, cookies can record items added to a shopping cart.

Cookies can also store user-centric information such as:

• Login credentials
• Language preference
• Search queries
• Recently viewed web pages
• Music choice
• Favourite cuisine

Such information can help improve user experience and make browsing more productive.

Types of Cookies Discussed in the Chapter

The chapter also explains that cookies can support automatic filling of information such as name, address, contact details and date of birth in online forms.

12.7.1 Threats Due to Cookies

• Usually, cookies enhance browsing and do not infect a computer with malware.
• Some malware may disguise itself as cookies, such as “supercookies”.
• A “Zombie cookie” can be recreated after being deleted.
• Some third-party cookies may share user data without consent for advertising or tracking.
• Third-party cookies can cause advertisements for similar items to appear on other websites after a user searches for an item.
• Users should be careful when granting websites permission to create and store cookies.

Activity 12.2

Open the Internet browser and check the settings for cookies. Also try to locate some cookie files on the computer system.

12.8 Hackers and Crackers

Hackers and crackers have thorough knowledge of computer systems, system software such as operating systems, computer networks and programming. They use this knowledge to find loopholes and vulnerabilities in computer systems or networks and gain access to unauthorised information.

12.8.1 White Hats: Ethical Hacker

A hacker who uses knowledge to find and help fix security flaws in a system is termed a White Hat hacker.

• They have good intentions.
• They are security experts.
• Organisations may hire them to check and fix potential security threats and loopholes.
• Technically, white hats work against black hats.

12.8.2 Black Hats: Crackers

Hackers who use their knowledge unethically to break the law and disrupt security by exploiting flaws and loopholes in a system are called Black Hat hackers.

12.8.3 Grey Hats

The distinction between hackers is not always clear. Grey hats represent a class between the other categories. They exploit system vulnerabilities but do not do so for monetary or political gains.

The chapter states that grey hats take system security as a challenge and hack systems for the fun of it.

White Hat vs Black Hat vs Grey Hat

12.9 Network Security Threats

12.9.1 Denial of Service

• The victim resource is flooded with traffic.
• The resource appears busy.
• A website can be flooded with a very large number of network packets.
• The web server becomes overloaded and cannot provide service to legitimate users.
• DoS attacks can also target email servers and network storage.
• They can disrupt connections between machines or reset sessions.

If a DoS attack makes a server crash, the server or resource may be restarted to recover. However, flooding attacks are difficult to recover from because some requests in the traffic may be genuine.

Distributed Denial of Service (DDoS)

• The attacker installs malicious software called a Bot on zombie machines.
• The bot gives the attacker control over those machines.
• A network of zombie computers is called a Bot-Net.
• The attacker activates the bot-net to carry out a DDoS attack.
• DDoS is difficult to resolve because the attack comes from multiple distributed locations.

12.9.2 Intrusion Problems

Such activities may involve unauthorised use of network resources, such as DoS, or threaten the security of the network and its data.

Network intrusion is a serious problem. The network administrator needs to devise strategies and implement security measures to protect the network. The chapter has already discussed DoS, Trojans and Worms as intrusion attacks. Other attacks are discussed below.

(A) Asymmetric Routing

In asymmetric routing, the attacker attempts to avoid detection by sending intrusion packets through multiple paths and thereby bypassing network intrusion sensors.

(B) Buffer Overflow Attacks

In this attack, the attacker overwrites certain memory areas of computers within the network with code or a set of commands that can be executed later when a buffer overflow occurs due to a programming error.

Once the malicious code is executed, an attacker can initiate a DoS attack or gain access to the network.

(C) Traffic Flooding

Traffic flooding is a simple method of network intrusion. It floods the network intrusion detection system with message packets.

• The huge load makes the detection system incapable of adequately monitoring packets.
• The hacker uses the congested and chaotic environment to enter the system undetected.

12.9.3 Snooping

• It can be performed using a computer program or utility with network traffic monitoring capability.
• The hacker taps or listens to a communication channel and picks up traffic passing through it.
• The network packets are analysed.
• The exact traffic packets can be reproduced and placed back in the channel.
• Unencrypted data is vulnerable to snooping.
• Snooping can cause serious damage depending on the information leaked.
• Snooping is also used by network administrators for troubleshooting network issues.
• Snooping is also known as Sniffing.
• Some network hubs and switches provide a SPAN (Sniffer Port Analyser) port function for snooping.

12.9.4 Eavesdropping

• The term originated from secretly listening to conversations by standing under the eaves of a house.
• Unlike snooping, eavesdropping involves real-time interception or monitoring.
• Private communication channels can include phone calls (VoIP), instant messages, video conferences and fax transmissions.
• In older days, eavesdropping on conventional telephone lines was called wiretapping.
• Digital devices with microphones or cameras can be hacked and eavesdropped using rootkit malware.

Snooping vs Eavesdropping

Chapter Summary

• Malware is software developed to damage computer hardware/software, steal data or cause other trouble to a user.
• A virus is software code created to perform malicious activities and hamper computer resources.
• A worm is malware that can work independently as a standalone program.
• Ransomware targets user data and can block or encrypt it while demanding ransom.
• A Trojan looks like legitimate software and tricks the user into installing it.
• Spyware secretly collects and sends information without the user’s knowledge or consent.
• Adware displays online advertisements and can generate revenue for its developer.
• A keylogger records keys pressed by a user.
• An on-screen keyboard uses a fixed QWERTY layout.
• An online virtual keyboard randomises its key layout.
• Malware distribution can occur through Internet downloads, spam email, removable storage devices and network propagation.
• Antivirus software has evolved from detecting viruses to preventing, detecting and removing a wide range of malware.
• Important malware-identification methods include signature-based detection, sandbox detection, data mining techniques, heuristics and real-time protection.
• Spam includes unwanted digital messages and advertisements, with email spam being the widely recognised form.
• HTTP and HTTPS are protocols governing data transmission over the World Wide Web.
• HTTP sends information as it is, while HTTPS encrypts data before transmission and decrypts it at the receiver end.
• A firewall protects a trusted private network from unauthorised access or untrusted traffic.
• The two basic firewall types are Network Firewall and Host-based Firewall.
• A cookie is a small file or data packet stored by a website on the client’s computer.
• Cookies can store browsing and user-centric information.
• Hackers/crackers use knowledge of systems, networks and programming to find vulnerabilities and gain access to unauthorised information.
• White Hat hackers help identify and fix security flaws.
• Black Hat hackers exploit flaws unethically and illegally.
• Grey Hats exploit vulnerabilities without monetary or political gains and may do so for challenge or fun.
• DoS floods a victim resource with traffic and makes it appear busy.
• DDoS uses compromised computer systems distributed across different locations.
• Network intrusion means unauthorised activity on a computer network.
• Snooping involves secret capture and analysis of network traffic.
• Eavesdropping involves unauthorised real-time interception or monitoring of private communication.

Questions & Answers

1-Mark Questions

2-Mark Questions

3-Mark Questions

4/5-Mark Questions

Important Questions

1 Mark

1. Why is a computer considered safe if it is not connected to a network or Internet?
2. What is malware?
3. What is a computer virus?
4. Who coined the term computer virus?
5. What is ransomware?
6. What is a Trojan?
7. What is spyware?
8. What is adware?
9. What is a keylogger?
10. What is spam?
11. What is HTTP?
12. What is HTTPS?
13. What is a firewall?
14. What is a cookie?
15. What is a White Hat hacker?
16. What is a Black Hat hacker?
17. What is a Grey Hat hacker?
18. What is DoS?
19. What is DDoS?
20. What is network intrusion?
21. What is snooping?
22. What is eavesdropping?

2 Marks

1. How is a computer worm different from a virus?
2. How is ransomware used to extract money from users?
3. How did a Trojan get its name?
4. How does an adware generate revenue for its creator?
5. Briefly explain two threats that may arise due to a keylogger.
6. How is a virtual keyboard safer than an on-screen keyboard?
7. What are the two basic types of firewalls?
8. What are session cookies?
9. What are authentication cookies?
10. What are the risks associated with cookies?

3 Marks

1. List and briefly explain the different modes of malware distribution.
2. List some common signs of malware infection.
3. List some preventive measures against malware infection.
4. Write a short note on the methods of malware identification used by antivirus software.
5. Explain White Hat, Black Hat and Grey Hat hackers.
6. Differentiate between DoS and DDoS attacks.
7. Explain network intrusion and its problems.
8. How is snooping different from eavesdropping?

4/5 Marks

1. Explain malware and its different types.
2. Explain the common signs and preventive measures of malware infection.
3. Explain the different methods of malware identification used by antivirus software.
4. Explain HTTP and HTTPS with their differences.
5. Explain firewall and its types.
6. Explain cookies, their uses, types and threats.
7. Explain White Hat, Black Hat and Grey Hat hackers.
8. Explain DoS and DDoS attacks and differentiate between them.
9. Explain asymmetric routing, buffer overflow attacks and traffic flooding.
10. Explain snooping and eavesdropping with their differences.

⚡ Quick Revision

Important Differences

Important Formulas

No numerical formulas are given in this chapter.

Important Syntax

No programming syntax is given in this chapter.

Important Programs

No programming programs are given in this chapter.

Important Diagrams / Structures to Revise

• Firewall between LAN and WAN.
• Online virtual keyboard and on-screen keyboard concepts.
• Ransomware data-blocking/encryption concept.
• HTTPS encryption and decryption process.
• DoS/DDoS distributed attack concept.
• Snooping and eavesdropping concepts.

Chapter Exercise Questions

1. Why is a computer considered to be safe if it is not connected to a network or Internet?
2. What is a computer virus? Name some computer viruses that were popular in recent years.
3. How is a computer worm different from a virus?
4. How is Ransomware used to extract money from users?
5. How did a Trojan get its name?
6. How does an adware generate revenue for its creator?
7. Briefly explain two threats that may arise due to a keylogger installed on a computer.
8. How is a Virtual Keyboard safer than On Screen Keyboard?
9. List and briefly explain different modes of malware distribution.
10. List some common signs of malware infection.
11. List some preventive measures against malware infection.
12. Write a short note on different methods of malware identification used by antivirus software.
13. What are the risks associated with HTTP? How can we resolve these risks by using HTTPS?
14. List one advantage and disadvantage of using Cookies.
15. Write a short note on White, Black, and Grey Hat Hackers.
16. Differentiate between DoS and DDoS attack.
17. How is Snooping different from Eavesdropping?

📌 Final Revision Section