Archive for the 'Computer Security' Category

Is Your Cat Infected with a Computer Virus

Introduction to RFID
Radio Frequency Identification (RFID) is the quintessential Pervasive Computing technology. Touted as the replacement for traditional barcodes, RFID’s wireless identification capabilities promise to revolutionize our industrial, commercial, and medical experiences. The heart of the utility is that RFID makes gathering information about physical objects easy. Information about RFID tagged objects can be transmitted for multiple objects simultanously, through physical barriers, and from a distance. In line with Mark Weiser’s concept of .ubiquitous computing.[20], RFID tags could turn our interactions with computing infrastructure into something subconscious and sublime.

Norman Book on Computer Viruses

What is a virus?
The terms “computer virus” and “virus” are used very loosely in everyday conversation and have become synonymous with “trouble”.

A virus is usually not something that creates cool screen effects and enables you to hack into Pentagon. The “Launching virus” screen as seen in Hollywood movies bear no resemblance with real life viruses. In reality, a virus infection is most often invisible to the user. The machine may slow down a little. Some programs may be unstable and crash at irregular intervals, but then again that happens ever so often on clean systems too.

Still, some viruses have some sort of screen effect. The Windows virus “Marburg” fills the desktop with red circles with a white “X” inside”. A couple of viruses will make desktop icons escape the mouse cursor. Such effects are not particularly common, since they expose the existence of the virus. In order to explain such vexing programs, we will need to look at what programs really are.

Creating a Secure Computer Virus Laboratory

Laboratory Protocol

Our laboratory protocol to regulate behavior in the laboratory was initially based on biohazard protocols (Health Canada, 2001); biologists and chemists have had decades of experience working with dangerous substances, and it is only prudent to build on their experience. Obviously, the analogy breaks down after a certain point, but there were a number of things to be learned about laboratory access, operation, and personnel training.

Since the contagions of concern in the computer virus lab are electronic, we had to add a number of provisions with respect to media handling, and any means of electronic transmission, both wired and wireless. Our initial thought was to let students bring media into the lab, so long as it was not brought out again, to allow material researched on the Internet to be brought in, but after negative reviewer feedback we scrapped this idea. Printouts were also contentious, in two ways: first, that we were allowing them to be made at all; second, how they were to be handled by students. We eventually clarified the protocol to specify how printouts should be handled, but still allowed them to be made – at the very least, printouts can be useful for debugging purposes.

Learn More About Viruses and Worms

How does this program work?

The VBSim program is a computer simulation that demonstrates how viruses and worms spread through and between corporations. The simulation graphically shows the difference between computer viruses and computer worms as they spread throughout a simulated corporation. Since this is a simulation, each time the program runs it will produce a different outcome and different infection patterns, and it can help to give you an idea of how companies might be affected by the next Melissa or Love Letter worm.

How to download and install program above
Once you download this file, run vbsim.exe to extract the contents of the archive. There are three files in this archive:

  • README.TXT – The README file
  • VBSIM.EXE – The simulation program
  • VBSIM.PDF – Simulation documentation

A Self-Learning Worm Using Importance Scanning

INTRODUCTION
A worm attacks vulnerable computer systems and employs self-propagating method to flood the Internet rapidly Worms, such as Code Red [10], Slammer [9], and Witty [17], have infected hundreds of thousands of hosts and become a significant threat to network security and management. It is therefore of great importance for defenders to characterize the spread of worms that employ distinct scanning methods and to study countermeasures accordingly.

Different scanning methods have been employed by previous worms. For instance, Morris worm used topological scanning that relies on the information contained in the victim
host to find new targets. Code Red v2 and Slammer worms employed random scanning that selects targets randomly. Code Red II and Nimda worms exercised localized scanning that preferentially searches for targets on the “local” address space.

Worm Evolution Tracking via Timing Analysis

INTRODUCTION
Worm outbreaks are security events that occur with relatively low frequency, but when they do occur, they can have significant impact on daily network operations. This ever-present threat of severe network disruption has been the motivating factor behind most, if not all, research on practical strategies for worm detection and containment ( see [11, 16, 18, 20, 21] ). There is, however, one desirable aspect of research that falls under the general umbrella of worm mitigation that has received far less attention in the past, namely back-tracking the evolution of a worm outbreak. In fact, thus far there has been little progress in the design and analysis of effective strategies for discovering the sequence with which a worm infected its victims. Even for worms that exhibit uniform scanning behavior, uncovering this sequence is a daunting task, but one that provides invaluable information. For one, doing so has direct pragmatic implications as it allows network operators to pinpoint the initial set of infected machines, thereby gleaning potentially useful forensic evidence.