Ask a non-specialist about computer security, and he will probably mention viruses and attacks by malicious hackers, if only because they are so much more visible than other security problems. Take viruses first. Like their biological counterparts, computer viruses are nasty strings of code that exploit their hosts to replicate themselves and cause trouble. Until a few years ago, viruses merely infected files on a single computer. Eventually, an infected file would be moved, typically on a floppy disk, to another machine where the virus could spread. Modern viruses, however, are far more insidious, because they can jump from one computer to another across the Internet, most often by e-mail. (Since self-propagating programs are technically known as worms, such viruses are sometimes called worm-virus hybrids.)
Recent high-profile examples include Sircam, which struck in July 2001 and generated much comment because as well as e-mailing copies of itself to everyone in an infected PC’s address book, like previous viruses, it also enclosed random documents from the infected machine’s hard disk with each message. Users thus unwittingly sent half-finished screenplays, unsent letters and private diary jottings to their friends, sometimes with embarrassing results. Code Red, which also struck that month, was a worm that exploited a security vulnerability in Microsoft’s web-server software to spread from one server to another. Infected servers were programmed to flood the White House website with traffic for a week.
Patching It Up
The weakness that Code Red exploited had been discovered in June, and Microsoft had issued a software “patch” to correct it. But software patches are issued all the time, and keeping up with new patches and deciding which to install is more than many system administrators can manage. Within a week of Code Red’s appearance, 300,000 computers were infected with it. Sometimes it defaced infected web servers with the message “Hacked by Chinese!”, which suggested a political motivation, but the identities and motives of virus writers can rarely be determined for sure. Similarly, Nimda, a particularly vigorous virus/worm which struck on September 18th 2001, was initially assumed to have some connection with the previous week’s terrorist attacks, though this now seems unlikely.
Viruses are extremely widespread, which is more than can be said for meaningful statistics about them. The annual survey carried out by the Computer Security Institute (CSI) in San Francisco, in conjunction with the Federal Bureau of Investigation’s local computer-intrusion squad, is generally regarded as one of the more authoritative sources of information about computer security. According to the most recent CSI/FBI report, published in April 2002, 85% of respondents (mainly large American companies and government agencies) encountered computer viruses during 2001. Quantifying the damage done by viruses, however, is extremely difficult. Certainly, cutting off e-mail or Internet connections can seriously hamper a company’s ability to do business. In severe cases every single computer in an office or school may need to be disinfected, which can take days.
Yet assigning costs to outbreaks is guesswork at best. Computer Economics, a consultancy, puts the worldwide costs imposed by viruses in 2001 at $13.2 billion. But few outside the marketing departments of anti-virus-software vendors take such figures seriously. Critics point out that if most companies are themselves unable to quantify the cost of cleaning up viruses in their systems, it is hard to see how anyone else can. Far easier to quantify is the surge in sales of anti-virus software that follows each outbreak. Following the Code Red and Nimda strikes, for example, anti-virus sales at Symantec, a leading security-software firm, in the last quarter of 2001 were 53% up on a year earlier.
Anti-virus software works by scanning files, e-mail messages and network traffic for the distinguishing characteristics, or “signatures”, of known viruses. There is no general way to distinguish a virus from a non-malicious piece of code. Both are, after all, just computer programs, and whether a particular program is malicious or not is often a matter of opinion. So it is only after a virus has infected its first victims and has started to spread that its signature can be determined by human analysts, and that other machines can be inoculated against it by having their database of signatures updated. Inevitably, the result is an arms race between the mysterious folk who write viruses (largely for fun, it seems, and to win the kudos of their peers) and makers of anti-virus software. Some viruses, including a recent one called Klez, even attempt to disable anti-virus software on machines they infect, or spread by posing as anti-virus updates.
Viruses are a nuisance, but the coverage they receive is disproportionate to the danger they pose. Some vendors of anti-virus software, particularly the smaller ones, fuel the hysteria by sending out jargon-filled warnings by e-mail at every opportunity. From a technical point of view, protecting a computer or network against viruses is tedious but relatively simple, however: it involves installing anti-virus software on individual machines and keeping it up to date. Virus-scanning software that sits on mail servers and scans e-mail messages before they are delivered can provide an extra defensive layer.
Dealing with intrusions by malicious hackers is an altogether more complex problem. (The word “hacker” merely means a clever programmer, but is commonly applied to those who use their skills to malicious ends.) Computers are such complex systems that there are endless ways for unauthorised users to attempt to gain access. Attackers very often use the same security flaws that worms and viruses exploit; such worms and viruses can be seen as an automated form of malicious hacking.
Having gained access to a machine, an attacker can deface web pages (if the machine is a web server), copy information (if the machine stores user information, financial data or other documents), use the machine as a base from which to attack other machines, or install “Trojan horse” software to provide easy access in future or to enable the machine to be remotely controlled over the Internet. Savvy attackers cover their tracks using special software known as a “root kit”, which conceals the evidence of their activities and makes unauthorised use difficult to detect.
As with viruses, meaningful figures for unauthorised intrusions are hard to find. Many attacks go unnoticed or unreported. But the CSI/FBI survey gives some flavour of the scale of the problem. Of the 503 large companies and government agencies that participated in the survey, 40% detected system intrusions during 2001, and 20% reported theft of proprietary information. Of the companies that were attacked, 70% reported vandalism of their websites. But it is dangerous to lump all attacks together. Just as there is a difference between a graffiti-spraying youth and a criminal mastermind, there is a world of difference between vandalising a web page and large-scale financial fraud or theft of intellectual property.
The principal tool for keeping unwanted intruders out of computers or networks is the firewall. As its name suggests, a firewall is a device that sits between one network (typically the Internet) and another (such as a closed corporate network), enforcing a set of rules about what can travel to and fro. For example, web pages might be allowed inside the firewall, but files might not be allowed to go outside.
Walls Have Ears
Firewalls are no panacea, however, and may give users a false sense of security. To be effective, they must be properly configured, and must be regularly updated as new threats and vulnerabilities are discovered. “What kind of firewall you have matters far less than how you configure it,” says Bill Murray of TruSecure, a security consultancy. There are dozens of competing firewall products on the market, but most of them come in two main forms: as software, which can be installed on a machine to regulate traffic, and as hardware, in the form of appliances that plug in between two networks and regulate the flow of traffic between them.
The leader in the field, with 40% of the market, is Check Point Software of Ramat Gan, Israel. Four years ago, says Jerry Ungerman, Check Point’s president, people thought the firewall market was almost saturated, because most firms had one, but the market has continued to grow. The notion that each company simply needs one firewall, between its internal network and the Internet, is now outmoded. Companies often have many separate links to the Internet, want to wall off parts of their internal networks from each other, or choose to install firewall software on every server. Some of Check Point’s clients, says Mr Ungerman, have over 1,000 firewalls installed. The advent of fixed broadband connections means that home users, who often leave their computers switched on around the clock, now need firewalls too if they are to protect their machines from intruders. Even mobile phones and hand-held computers, he predicts, will have firewalls built into them.
Firewalls have their uses, but there are many kinds of attacks they cannot prevent. An attacker may be able to bypass the firewall, or exploit a vulnerability by sending traffic that the firewall regards as legitimate. Many attacks involve sending artfully formulated requests to web servers, causing them to do things that would not normally be allowed, says Geoff Davies of i-Sec, a British security consultancy. To show how easily this can be done, he types a string of database commands into the search field of an online travel agent, and instead of a table of flight departures and arrivals, the website comes up with a table of information about its users. (Mr Davies carried out this demonstration, called an “SQL insertion” attack, on a dummy server specially set up for the purpose, but it is a widespread vulnerability on real websites.) To a firewall, such an attack may look just like a legitimate use of the web server.
Halt! Who Goes There?
An alternative is the “intrusion-detection system” (IDS), which monitors patterns of behaviour on a network or an individual computer and sounds an alarm if something looks fishy. Some kinds of detection systems monitor network traffic, looking for unusual activity, such as messages passing to and from a Trojan horse on the network; others sit on computers, looking for unusual patterns of access, such as attempts to retrieve password files.
Compared with anti-virus software and firewalls, detection is a relatively immature technology, and many people believe it is more trouble than it is worth. The difficulty is tuning an IDS correctly, so that it spots mischievous behaviour reliably without sounding too many false alarms. An IDS may end up like the boy who cried wolf — when a genuine attack occurs after too many false alarms, nobody pays any attention. And even when it is properly tuned, people may not know how to stop the problem when an IDS sounds the alarm. All too often the response is, “We just got hacked — what do we do?”, says Chris King of Meta Group.
Other tools in the security toolbox include encryption, the mathematical scrambling of data so that only the intended recipient can read them, and the related technique of cryptographic authentication to verify that people are who they claim they are. These tools can be integrated into an e-mail system, for example, using encryption to ensure that messages cannot be read in transit, and authentication to ensure that each message really did come from its apparent sender. The same techniques can also be used to send information (such as credit-card details) to and from websites securely.
Another popular use of encryption and authentication is the “virtual private network” (VPN), which allows authenticated users to establish secure communications channels over the Internet to a closed network. VPNs are widely used to knit a company’s networks in different parts of the world together securely across the Internet, and to allow travelling employees to gain secure access to the company network from wherever they are.
There is still plenty of room for innovation in security technology, and there are dozens of start-ups working in the field. Company 51 of San Mateo, California, has devised an “intrusion-prevention system”, based on the workings of the human immune system. When an attack is detected, the attacker is promptly disconnected. Cenzic, also based in Silicon Valley, has devised a novel approach to security testing called “fault injection”. Greg Hoglund, the company’s co-founder, says most testing of security software is akin to testing a car by driving it on a straight, flat road. Just as cars are crash-tested, Cenzic’s software, called Hailstorm, stress-tests software by bombarding it with attacks.
Blame It on the Bugs
A typical network, then, is secured using a multi-layered combination of security technologies. But these fancy measures merely treat the effects of poor security. A parallel effort is being made to deal with one of its main causes: badly written software. According to @Stake, a security consultancy based in Cambridge, Massachusetts, 70% of security defects are due to flaws in software design. Code Red, for example, exploited a “bug”, or coding error, in the way Microsoft’s web-server software handles non-Roman characters. Buggy software tends to be insecure. So by taking a firmer stand against bugs and making their programs more reliable, software firms can also improve security.
Microsoft is now making a particular effort to improve its reputation for shoddy security. New bugs and vulnerabilities in its products are found weekly. This does not necessarily mean that Microsoft’s software is particularly badly written, but has much to do with its ubiquity. Microsoft has a monopoly in desktop operating systems, after all, and a near-monopoly in web browsers and office productivity software. Find a hole in Internet Explorer, Microsoft’s web browser, for example, and you are capable of attacking the vast majority of the world’s PCs. Find a hole in Netscape’s rival web browser, which is far less widely used, and you will be able to attack fewer than 10% of them.
Now that the threat to Microsoft of dismemberment by America’s Department of Justice has receded, the company’s poor reputation in security looks like its single biggest problem. Last year, following the Code Red and Nimda outbreaks, both of which exploited security flaws in Microsoft products, John Pescatore at Gartner, an influential consultancy firm, suggested that companies that wanted to avoid further security problems should stop using Microsoft’s software. Bill Gates responded by issuing his company-wide memo in January on “trustworthy computing”.
Microsoft is pulling out all the stops to reduce the number of security vulnerabilities in its products. “There was a sea change in the way our customers were thinking,” says Pierre de Vries, Microsoft’s director of advanced product development. The company, he says, realised that it had “a real problem” even before Mr Pescatore’s report. Earlier this year, the 8,500 programmers in the company’s Windows division were given new security training, after which they spent two months combing their code for potential vulnerabilities. New tools devised by the company’s research division, called “Prefix” and “Prefast”, are used to scan for possible problems. And when coding errors are found, they are not only fixed but an effort is now made to find out how they slipped through the net in the first place.
The work the programmers are doing now will not be reflected in the company’s products for a year or two, but Microsoft has also tightened security in other ways. The latest version of its web-server software, for example, arrives with most options switched off by default. Customers have to decide which options they want to use, and make a conscious choice to switch them on. This reduces their exposure to problems in parts of the software they were not using anyway. But some customers complained about having to work out which options they did and did not need, says Mr de Vries. One of them even asked for a button to turn everything on. The cost of improved security, it seems, is often a reduction in convenience.
This kind of thing goes against the grain for Microsoft. Traditionally, its products have had all the bells and whistles (such as the infamous talking paper) turned on by default, to make it more likely that users will discover and use new features. Microsoft is also renowned for encouraging users to upgrade for extra features. But priorities have changed. As Mr Gates wrote to his workforce, “When we face a choice between adding features and resolving security issues, we need to choose security.”
Microsoft’s policy of tight integration between its products, which both enhances ease of use and discourages the use of rival software makers’ products, also conflicts with the need for security. Because Microsoft’s programs are all linked, a flaw in one of them can be used to gain access to others. Many viruses, for example, exploit holes in Microsoft’s mail or browser software to infect the underlying Windows operating system.
Many observers believe that Microsoft’s new-found concern over security is mere window-dressing. The Windows operating system is the largest piece of software ever written, so implementing security retrospectively is a daunting task. Mary Ann Davidson, chief security officer at Oracle, contends that American federal agencies are “really angry” with Microsoft over the insecurity of its products. Oracle, whose flagship database software grew out of a consulting contract for the Central Intelligence Agency, has many black-suited “professional paranoids” among its customers, so the company has security awareness far more deeply ingrained in its corporate culture, she says. But what of Oracle’s advertising claims that its own software is “unbreakable”? Perfect security is impossible, she concedes; the campaign “is about being fanatical about security.”
Need to Know
A key test of a company’s commitment to security is the speed with which it responds to vulnerabilities. The difficulty, says Steve Lipner, Microsoft’s director of security assurance, is that when a new vulnerability is discovered, customers want a patch immediately, but they also want the patch to be properly tested, which takes time. Furthermore, issuing a separate patch for every vulnerability makes life harder for systems administrators, so Microsoft now prefers to group several patches together. But that lays it open to the charge that it is not responding fast enough. Once a vulnerability has been announced, attackers will start trying to exploit it immediately. According to Mr Davies, some big websites get attacked as little as 40 minutes after the publication of a new vulnerability. But the patch may not be available for weeks.
Mr Lipner says he would prefer researchers who find flaws to report them to Microsoft, but not to publicise them until a patch is available. The trouble is that software makers have little incentive to fix patches that nobody knows about, so many security researchers advocate making vulnerabilities public as soon as they are found. Admittedly, this alerts potential attackers, but they may already have known about them anyway. Proponents of this “full disclosure” approach argue that its benefits outweigh the risks. “Sunlight is the best disinfectant,” says Mr Diffie at Sun Microsystems.
Will software makers ever come up with products that are free of security vulnerabilities? It seems very unlikely, but even if they did, there would still be plenty of systems that remained unpatched or incorrectly configured, and thus vulnerable to attack. No matter how clever the technology, there is always scope for human error. Security is like a chain, and the weakest link is usually a human.