Safe(r) Web Browsing IT Security Roundtable April 9, 2010 Harvard Townsend Chief Information Security Officer harv@ksu. edu
Agenda “The Internet is a bad neighborhood. ” n n n The dangers of web browsing Helpful features built into web browsers Tools you can add to your web browsers Trend Micro is your friend Misc. cautions/tips/tricks Q&A 2
The Risks n n n n Computer infected with malicious software (malware) Stolen, altered, and/or deleted K-State or personal information (do you have SSNs on your computer? ) Identity theft Financial fraud – stolen credit card and/or bank account information Your computer is used to send spam Your computer stops working because of damage done by the malware Your computer is used to infect other computers Your computer’s network access is blocked by the security team to prevent further damage 3
The Threats n n Malicious links/sites – to click or not to click, that is the question. Malicious advertisements Drive-by Download (don’t even have to click!) Search engines tricked to present malicious/bogus result near the top of your search results (aka Blackhat Search Engine Optimization (SEO) Poisoning) 4
Real K-State Federal Credit Union web site Fake K-State Federal Credit Union web site used in spear phishing scam 5
Spear phishing scam received by K-Staters in January 2010 6
The malicious link in the email took you to an exact replica of K-State’s single sign-on web page hosted on a server in the Netherlands which will steal your e. ID and password if you enter it and “Sign in”. Note the URL highlighted in red – “flushandfloose. nl”, which is obviously 7 not k-state. edu
Fake SSO web page Real SSO web page 8
Fake SSO web page – site not secure (http, not https) and hosted in the Netherlands (. nl) Real SSO web page – note “https” 9
Can I click on this? n Watch for displayed URL (web address) that does not match the actual displayed: http: //update. microsoft. com/microsoftupdate actual: http: //64. 208. 28. 197/ldr. exe n Beware of link that executes a program (like ldr. exe above) Avoid numeric IP addresses in the URL n Some even use hexadecimal notation for the IP: n Watch for legitimate domain names embedded in an illegitimate one n http: //168. 234. 153. 90/include/index. html http: //0 xca. 0 x 27. 0 x 30. 0 xdd/www. irs. gov/ http: //leogarciamusic. com/servicing. capitalone. com/c 1/login. aspx/ 10
Can I click on this? n Beware of email supposedly from US companies with URLs that point to a non-US domain (Kyrgyzstan in example below) From: Capital One bank <cservice@capitalone. com> URL in msg body: http: //towernet. capitalonebank. com. mj. org. kg/onlineform/ n IE 8 highlights the actual domain name to help you identify the true source. Here’s one from an IRS scam email that’s actually hosted in Pakistan: 11
Can I click on this? n Beware of domains from unexpected foreign countries Kyrgyzstan: http: //towernet. capitalonebank. com. mj. org. kg/onlineform/ Pakistan: http: //static-host 202 -61 -52 -42. link. net. pk/IRS. gov/refunds. php Lithuania: http: //kateka. lt/~galaxy/card. exe Hungary: http: //mail. grosz. hu/walmart/survey/ Romania: http: //www. hostinglinux. ro/ Russia: http: //mpo 3 do. chat. ru/thanks. html n MANY scams originate in China (country code =. cn) n Country code definitions available at: www. iana. org/domains/root/db/index. html 12
Can I click on this? n Analyze web links w/o clicking on them by copying the URL and testing them at these sites: ¡ Trend Micro’s Web reputation query – reclassify. wrs. trendmicro. com/wrsonlinequery. aspx ¡ Mc. Afee Site. Advisor (enter URL on this web page – you don’t have to install their software): www. siteadvisor. com 13
Can I click on this? n Watch for malicious URLs cloaked by URL shortening services like: ¡ ¡ ¡ Tiny. URL. com Bit. ly Cloaked. Link. com 14
Can I click on this? n n Tiny. URL has a nice “preview” feature that allows you to see the real URL before going to the site. See tinyurl. com/preview. php to enable it in your browser (it sets a cookie) Bit. ly has a Firefox add-on to preview shortened links: addons. mozilla. org/en-US/firefox/addon/10297 It also warns you if the site appears to be malicious: 15
Can I click on this? 16
Malicious Advertisements n n Major ad networks (aka “ad aggregators”) affiliated with Google (e. g. Doubleclick. com), Yahoo (yieldmanager. com), Fox and others, covering more than 50% of online ads, have been infiltrated with “poisoned ads” containing malicious code (Source: Avast!) Happened to the New York Times website last fall 17
NY Times incident n n Ad placed via phone call from person posing as Vonage, an intl phone company and regular advertiser on NY Times web site Since Vonage well known, they allowed ads to be served by remote 3 rd party host (i. e. , not the NY Times web server) Legitimate Vonage ads displayed all week During the weekend, legitimate ad switched to a malicious one that served up fake antivirus scareware which tried to get people to buy bogus security software with a credit card 18
Malicious Advertisements n Isn’t just NY Times… ¡ ¡ ¡ ¡ n ratemyprofessors. com (!!) msnbc. msn. com health. msn. com music. msn. com astrology. msn. com realestate. msn. com usatoday. com cnbc. com digg. com mail. live. com addictinggames. com foxsports. com hollywoodreporter. com These legitimate sites are not in cahoots with the criminals, they’re just not careful enough in screening ads from third party ad networks 19
Drive-by Downloads n n n The scary thing is you don’t even have to click on anything – just visiting a site with malicious code can initiate a download that installs malware on your computer without you knowing it. Symantec claims every one of the top 100 websites in the world have served up malicious code at some point Java. Script in the ad executes when the page is loaded and tries to exploit a vulnerability in Adobe PDF reader, Java, or Flash… or all three; this is why a tool like No. Script or something that blocks ads is effective 20
Drive-by Downloads n n n Commonly used to promote fake antivirus software (aka “scareware” or “extortionware”) – make you believe your computer is infected with lots of malware, enticing the nervous user to “Click Here” to buy fake security software for $30 -$100, plus they steal your credit card information Can be used to infect your computer with any malware – keyloggers, Trojans, Torpig, … Malware changes at a very rapid rate to escape detection by AV software; hackers test their malware against 40 popular AV products at virustotal. com before launching 21
Search Engine Poisoning n n n Search engines, like Google, are tricked into presenting a malicious link in the top 10 results for popular searches Known as “Blackhat Search Engine Optimization (SEO) Poisoning” 13% of Google searches for popular or trendy topics yield malicious links Currently used mostly for fake antivirus scams Exploit current events, popular topics ¡ January 2010 an all-time high with hackers capitalizing on Haitian earthquake, release of movie Avatar, and announcement of the i. Pad 22
Blackhat SEO Poisoning Search for “Oscars 2010 winners” Malicious pages that infect with Fake. AV scareware Source: Sophos security blog March 8, 2010 23
Blackhat SEO Poisoning n Examples of exploited topics in 2010: ¡ ¡ ¡ ¡ Tiger Woods car wreck, affairs Death of Patrick Swayze Affair of Sandra Bullock’s husband with Michelle “Bombshell” Mc. Gee Rumored death of Bill Cosby (pretty common to make up a sensational hoax) Chilean earthquake Moscow subway explosions Plane crashing into IRS building in Austin, TX Sea World killer whale attack Sentencing of TJX hacker Oscars Kids’ Choice Awards Olympics (esp. death of Georigian luge athlete) March Madness basketball tournament April Fools Day (a natural…) 24
Blackhat SEO Poisoning How does it work? n Legitimate web server compromised (often due to a vulnerability in a content management system) and SEO poisoning code loaded (usually a PHP script) n When the PHP script determines a search engine “crawler” (Google, Bing, MSN, Yahoo, AOL, etc. ) is making the request for the web page, it returns content filled with lots of info appropriate for the event it’s trying to mimic (keywords, phrases, other high-ranking URLs about the event, images and videos copied high-ranking sites) n They’ll also harvest search engine results to extract popular phrases used to search hot topics (ie, they let the search engines do the research for them!) 25
Blackhat SEO Poisoning How does it work? n When PHP code determines it is a user, not a search engine, visiting the site, it redirects them to a malicious site to try to infect their computer or just pop-up bogus security warnings and try to get them to buy the fake antivirus software (i. e. , you’re not always infected when you’re tricked into clicking on the link) n The redirection domain name can change as often as every 10 minutes, based on instructions from a “command & control” server making it harder to identify 26
Blackhat SEO Poisoning n How do I prevent it? ¡ ¡ Be paranoid – think before you click! Pay attention to the link – only visit reputable sites Pay attention to warnings from anti-phishing filters, Trend Micro WRS, and other tools you might use to detect malicious links (see later slides) If you click on a search result and security warnings like this pop-up, do NOT click on anything – contact your IT support person 27
Blackhat SEO Poisoning n How do I prevent it? ¡ ¡ Run antivirus software and keep it up-to-date (required to use Trend Micro on campus) Keep ALL software patched, including the web browsers and plug-ins, Adobe products, Flash, and Java n n VERY challenging for IT staff, let alone your average user Recent study found that average home user would have to patch 75 times per year (once every 5 days!) using 22 different patching mechanisms 28
What’s a feller to do? If you’re not scared by now, then I’m worried about you and I pity your IT support person 29
Browser features – IE 8 n Domain highlighting n Smart. Screen filtering – block access to malicious sites and file downloads 30
Browser features – IE 8 n n Pop-up blocker- if it causes a problem with an application, add a specific exception; don’t turn off the pop-up blocker If you don’t see a malicious pop-up message, you won’t be duped by it. 31
Browser features – IE 8 n In. Private Browsing – good if using a public computer in a lab or Internet Café since it leaves no trace of your browsing activity. The cache (“temporary Internet files” which are local copies of content from web sites you visited recently), cookies, and browser history (web address of sites you visited recently) are not stored. 32
Browser features - Firefox n Anti-phishing and anti-malware protection – detects and blocks access to known malicious sites and downloads 33
Browser features - Firefox n Pop-up Blocker ¡ n n Similar to IE; add exceptions at Tools->Options->Content Private browsing – cache, cookies, and history not saved, just like “In. Private Browsing” in IE Instant Website ID – provides detailed identity information, if available, about the site: 34
Browser add-ons No. Script from noscript. net n Extension for Firefox (not available for IE) n Prevents execution of Java. Script, Java, and Flash – the most common culprits for web-based attacks n Can selectively allow trusted sites n Often able to view content of interest without enabling all scripts – you don’t need to see the ads or that cute Flash animation! n Takes some getting used to and it takes a while to build up the exceptions for trusted sites so it’s not always getting in the way of your productive use of the web 35
Browser add-ons Web of Trust from www. mywot. com n Available for Firefox, IE, Google Chrome n Rates web sites on ¡ ¡ n n Trustworthiness Vendor reliability Privacy Child safety Warns you if about to visit a poorly rated site Tags ratings in Google search results, which is really helpful for detecting Blackhat SEO Poisoning Also tags links in web-based email like K-State’s Zimbra Webmail and Gmail Provides user comments about the site and its rating 36
Browser add-ons Adblock Plus from adblockplus. org n Again, only for Firefox (IE is not nearly as extensible as Firefox!) n I haven’t used this tool but others have recommended it for blocking advertisements n Some have argued against blocking ads since they provide the revenue that allows so much free content on the web 37
Help from Trend Micro n Web Reputation Services (WRS) ¡ ¡ ¡ n Blocks access to known disreputable sites Enabled in both Windows and Mac versions K-State IT security team regularly reports new malicious links to Trend to add to the block list Also provides traditional “antivirus” malware protection 38
Trend Micro WRS is your friend 39
Recognizing Fake Antivirus Alerts Actual pop-up alert from Trend Micro Office. Scan: 40
Recognizing Fake Antivirus Alerts Example of a Fake AV “scareware” alert that tries trick you into buying worthless software to fix a non-existent infections: 41
Misc. Tips/Tricks n n Use a Mac Firefox vs. Internet Explorer (IE)? ¡ ¡ n Stay away from questionable sites ¡ ¡ ¡ n Both have vulnerabilities Both have helpful security features Active. X in IE historically been a security concern but is less of a target these days If you use IE 6 or IE 7, upgrade to IE 8 because of significant security improvements plus application compatibility Pornography Gambling Some gaming sites Peer-to-peer file sharing applications are dangerous since they too have been infiltrated with malware; the movie you download may also have malware attached to it that will infect 42 your computer when you try to run the movie.
Misc. Tips/Tricks “… because that’s where the money is. ” Willie Sutton, famous 19 th century bank robber on why he robs banks n n n Beware of where you do your online banking – cybercriminals are actively hunting you online and targeting your computer because “that’s where the money is” 49 instances of Torpig malware at K-State thus far in 2010, 34 in 2009 – steals username/passwords and banking info The American Bankers Association recommends using a dedicated computer for online banking since malware typically gets on a computer via web surfing or email A low-end $500 PC or netbook good for this, or re-purpose the old computer when you upgrade Make sure your banking computer is protected with a strong password At the very least, don’t do online banking on the same home computer your children (and their friends) use! 43
Misc. Tips/Tricks n Risks of social network sites ¡ ¡ n People tend to reveal too much personal information Pay careful attention to the security configurations, esp. for privacy Beware of third party applications and advertisements Beware of unusual friend requests Application whitelisting (specify the programs that can run on the computer – everything else is prohibited) 44
Misc. Tips/Tricks n n Remove administrator rights from users Recent study of 2009 Microsoft security vulnerabilities claims removing administrator rights would prevent exploitation of: ¡ ¡ ¡ n With admin privileges, hacker can: ¡ ¡ ¡ n n 90% of the “critical” vulnerabilities found in Windows 7 100% of the 55 vulnerabilities found in Microsoft Office 100% of Internet Explorer 8 vulnerabilities 94% of the vulnerabilities in all versions of IE 81% of all critical vulnerabilities announced/patched by Microsoft in 2009 Install or remove/disable any software Change security settings, disable AV software Create new accounts View/copy/change/delete all files Have complete control of the computer Running as a regular user limits the damage to that user’s account Create a separate regular user account for your children on your home computer(s)!! 45
Misc. Tips/Tricks n Don’t let your browser store/remember important passwords like: ¡ ¡ n n e. ID Financial accounts 38% of bank account or username/password information stolen by Torpig malware came from the browser’s password store on the compromised computer Password-protect the browser password store 46
Misc. Tips/Tricks n n n Don’t keep yourself logged into important accounts Similar to letting the browser store username/password; effect is the same – anyone with access to the computer has access to those accounts Never do either on a public computer 47
Misc. Tips/Tricks n Use a password manager ¡ Windows: Password Safe - pwsafe. org n ¡ Macs: Password Gorilla www. fpx. de/fp/Software/Gorilla/ n n ¡ Many useful features, easy to use Also available for Windows and Linux Can read Password Safe database Multi-OS and multi-computer: Last. Pass lastpass. com n n Passwords stored on server so can access them from multiple computers Premium version @ $1/month provides mobile device support (i. Phone, Blackberry, Android, etc. ), no ads, and multi-factor auth. N support 48
Conclusion n n There’s no way to be 100% secure surfing the web these days Use multi-faceted approach to reduce your risk (browser security features, browser addons, Trend Micro security software, educate yourself) These tools and techniques make your browsing experience less convenient and may frustrate you at times, but they are necessary in today’s hostile online climate Think before you click! 49
What’s on your mind? 50
Скачать презентацию Safe r Web Browsing IT Security Roundtable April 9
c4e0ae9121848ae9f1bcb2c0ab93ed8f.ppt