Computer Crime

In the past decade, computer and networking technology has seen enormous growth. This growth however, has not come without a price. With the advent of the "Information Highway", as it's coined, a new methodology in crime has been created. Electronic crime has been responsible for some of the most financially devastating victimizations in society. In the recent past, society has seen malicious editing of the Justice Department web page (1), unauthorized access into classified government computer files, phone card and credit card fraud, and electronic embezzlement. All these crimes are committed in the name of "free speech." These new breed of criminals claim that information should not be suppressed or protected and that the crimes they commit are really not crimes at all. What they choose to deny is that the nature of their actions are slowly consuming the fabric of our country's moral and ethical trust in the information age. Federal law enforcement agencies, as well as commercial computer companies, have been scrambling around in an attempt to "educate" the public on how to prevent computer crime from happening to them. They inform us whenever there is an attack, provide us with mostly ineffective anti-virus software, and we are left feeling isolated and vulnerable. I do not feel that this defensive posture is effective because it is not pro-active. Society is still being attacked by highly skilled computer criminals of which we know very little about them, their motives, and their tools of the trade. Therefore, to be effective in defense, we must understand how these attacks take place from a technical stand-point. To some degree, we must learn to become a computer criminal. Then we will be in a better position to defend against these victimizations that affect us on both the financial and emotional level. In this paper, we will explore these areas of which we know so little, and will also see that computers are really extensions of people. An attack on a computer's vulnerabilities are really an attack on peoples' vulnerabilities. Today, computer systems are under attack from a multitude of sources. These range from malicious code, such as viruses and worms, to human threats, such as hackers and phone "phreaks." These attacks target different characteristics of a system. This leads to the possibility that a particular system is more susceptible to certain kinds of attacks. Malicious code, such as viruses and worms, attack a system in one of two ways, either internally or externally. Traditionally, the virus has been an internal threat (an attack from within the company), while the worm, to a large extent, has been a threat from an external source (a person attacking from the outside via modem or connecting network). Human threats are perpetrated by individuals or groups of individuals that attempt to penetrate systems through computer networks, public switched telephone networks or other sources. These attacks generally target known security vulnerabilities of systems. Many of these vulnerabilities are simply due to configuration errors. Malicious Code Viruses and worms are related classes of malicious code; as a result they are often confused. Both share the primary objective of replication. However, they are distinctly different with respect to the techniques they use and their host system requirements. This distinction is due to the disjoint sets of host systems they attack. Viruses have been almost exclusively restricted to personal computers, while worms have attacked only multi-user systems. A careful examination of the histories of viruses and worms can highlight the differences and similarities between these classes of malicious code. The characteristics shown by these histories can be used to explain the differences between the environments in which they are found. Viruses and worms have very different functional requirements; currently no class of systems simultaneously meets the needs of both. A review of the development of personal computers and multi-tasking workstations will show that the gap in functionality between these classes of systems is narrowing rapidly. In the future, a single system may meet all of the requirements necessary to support both worms and viruses. This implies that worms and viruses may begin to appear in new classes of systems. A knowledge of the histories of viruses and worms may make it possible to predict how malicious code will cause problems in the future. Basic Definitions To provide a basis for further discussion, the following definitions will be used throughout the report; Trojan Horse - a program which performs a useful function, but also performs an unexpected action as well; Virus - a code segment which replicates by attaching copies to existing executables; Worm - a program which replicates itself and causes execution of the new copy and Network Worm - a worm which copies itself to another system by using common network facilities, and causes execution of the copy on that system. In essence, a computer program which has been infected by a virus has been converted into a "trojan horse". The program is expected to perform a useful function, but has the unintended side effect of viral code execution. In addition to performing the unintended task, the virus also performs the function of replication. Upon execution, the virus attempts to replicate and "attach" itself to another program. It is the unexpected and uncontrollable replication that makes viruses so dangerous. As a result, the host or victim computer falls prey to an unlimited amount of damage by the virus, before anyone realizes what has happened. Viruses are currently designed to attack single platforms. A platform is defined as the combination of hardware and the most prevalent operating system for that hardware. As an example, a virus can be referred to as an IBM-PC virus, referring to the hardware, or a DOS virus, referring to the operating system. "Clones" of systems are also included with the original platform. History of Viruses The term "computer virus" was formally defined by Fred Cohen in 1983, while he performed academic experiments on a Digital Equipment Corporation VAX system. Viruses are classified as being one of two types: research or "in the wild." A research virus is one that has been written for research or study purposes and has received almost no distribution to the public. On the other hand, viruses which have been seen with any regularity are termed "in the wild." The first computer viruses were developed in the early 1980s. The first viruses found in the wild were Apple II viruses, such as Elk Cloner, which was reported in 1981 [Den90].