Information Technology News Archive

1996 - 2017

You are here: Home / Archives for Voice and Data Services / Network Security

Network Security

Computer Security

by

Computer security continues to demand attention at UCI. In the first eight months of 2001, at least 952 attempts were made to scan systems on campus, seeking one of at least 60 different security vulnerabilities.

The good news is that almost all of these efforts failed, thanks to the ongoing effort of NACS staff and system administrators around campus. The bad news is that it will continue to be necessary for computer users on campus to stay informed and protect themselves. Three relatively recent attacks have gained publicity: Sircam, Code Red, and Nimda.

Sircam is a virus which comes as an e-mail attachment. Opening that attachment on Windows computers will execute “malicious code” which can harm your computer or distribute confidential information. Once a system is infected, it can also infect any other computer with which it is sharing disk resources (i.e., “network drives.”) Sircam can generate a large number of e-mail messages, each with a large attachment (200KB or more). It floods new victims’ mailboxes and places a great load on campus mail servers, thus interfering with systems beyond those infected. All “antivirus software” (such as McAfee and Norton) if up-to-date can detect and eliminate Sircam. This is easiest if you allow your antivirus software to use its automatic update feature. Code Red (and Code Red II) are “internet worms” which act through the Web server software IIS. This worm would change the content of your web site, and possibly launch “denial of service” attacks against other systems (seehttp://www.nacs.uci.edu/news/2001.4.html). Because Code Red could generate a lot of network traffic, it could even render HP printers with network (JetDirect) cards unusable. Code Red is deterred by having the latest update (“patch”) for IIS, but even the most careful administrators of Windows NT systems are vulnerable. (Windows 2000 systems are can be more thoroughly secured against Code Red.)

Nimda was another internet worm, which (among other techniques) could exploit vulnerabilities left behind by Code Red. Nimda was particularly insidious in that it could infect any computer using Internet Explorer to browse an affected Web site, with no sign to the person doing the browsing. Defense against Nimda is available at both ends: by patching IIS and making other prudent security changes to servers, and by running an up-to-date browser (Internet Explorer 5.01 or 5.5 with Service Pack 2, or Internet Explorer 6.)

NACS is coordinating a series of discussions on security techniques for computer support staff. If you would like to be included in the next meeting (to be held in October), please contact NACS.

Computer Security News

by

Did you ever wonder if your firewall hardware has known vulnerabilities? Would you like to read an authoritative document on securing Microsoft’s Web Server, IIS? Are you curious about the impact of latest Internet worm?

NACS makes a diligent effort to stay current on issues of network security, to make UCInet the safest infrastructure it can be, consistent with the mission of a public University. We are working with system administrators around campus to upgrade software and close security holes. Nevertheless, an informed community is perhaps our best defense against malicious network attacks.

If you would like an easy way to enhance your knowledge of computer security, do what we at NACS do: subscribe to the weekly newsletter published by the SANS Institute, “SANS NewsBites.” For a free subscription e-mail sans@sans.org with the subject: “Subscribe NewsBites”. Archives of the newsletter can be found at http://archives.neohapsis.com/archives/sans/

Computer Security

by

Computer Viruses and Hoaxes

New computer viruses arrive daily. There are a few practical steps that everyone can take to help keep computers safe.

First, be sure that your computer has updated anti-virus software installed. All modern anti-virus software can be configured for automatic updates. If your computer is using VirusScan, the “About…” menu item should report a Scan Engine of 4.1.40 and a virus definition creation date within one week of the current date. Ask your school’s computing help desk for assistance in configuring your software if you need it.

Many computer viruses arrive as e-mail attachments. Use caution when opening attachments. For example, if your co-worker routinely sends you Excel spreadsheets which you collaborate on, you would expect to open those. But if the same associate sends you a Visual Basic script (a file whose name ends with .vbs), DON’T OPEN IT! It’s probably a virus. Use the good old-fashioned telephone to call and confirm that your co-worker meant to send you an unusual attachment. In general, never open an email attachment unless you know what it is — even if it comes from someone you know and trust: many viruses exploit innocent users and computers to spread themselves.

Another problem is virus hoaxes. Whenever you see a message informing you to e-mail “everyone you know”, it’s probably a hoax. It may even be carrying a virus. DON’T e-mail everyone you know. Instead check with your computing support help desk, or check the Web for hoax reports. Places to check include:

Links on these pages to commercial Web sites do not represent endorsement by the University of California or its affiliates.

Network Attacks Continue

by

A May 5, 2001 advisory from NIPC (National Infrastructure Protection Center) reported an increase in “distributed denial of service” (DDOS) attacks around the country. In fact, even whitehouse.gov was laid low by such an attack on Friday, May 4. (For more information, please see http://www.cnn.com/2001/TECH/internet/05/08/dos.warning.idg/index.html)

Ordinary DOS attacks involve keeping a computer or network device so busy handling spurious requests that the device becomes unable to manage the business for which it is intended. Sometimes these attacks are launched from a computer directly under the control of an attacker. Other times the attack is indirect, where a hacker takes control of a remote computer and uses it to launch an attack. (This intermediate computer is called a Zombie). Distributed DOS goes one step further by using a fleet of Zombies to launch coordinated streams, or to send many small bursts so that no one Zombie is easily noticed. (More can be found at http://www.staff.washington.edu/dittrich/misc/ddos/elias.txt)

NACS is undertaking a project to upgrade the campus border router which will provide better management of incoming network traffic. This project includes an intrusion detection system and a firewall to help detect such traffic flows. Additionally, UCI’s border router has already been configured to limit certain types of network traffic which reduces the threat of DOS attacks.

But firewalls and intrusion detection are only part of the picture. The best defense against having a computer being broken into and turned into a Zombie is to keep the system software on it up-to-date (“patched”), turn off all unused network services (“ports”), and to log activity on the system and scan the logs regularly.

Recently, NACS ran a scan on campus subnets looking for Windows 2000 machines running Microsoft IIS5.0, which has a well-publicized vulnerability on port 80 that allows remote hackers to establish telnet sessions with the system. Over 100 potentially vulnerable machines were found on campus, and this information was made available to departmental Computing Support Coordinators. NACS also regularly updates all DCS-supported machines to protect them against known kinds of attacks, and monitors the logs of these machines looking for suspicious connections from the Internet. NACS offers security updates to key support personnel around campus as well. If you do your own support and do detect DDOS activity of the type described by NIPC, please contact nacs@uci.edu. NACS is responsible for evaluating attacks and reporting to the FBI when warranted.

Computer Security

by

NACS Distributed Computing Support has developed software to improve campus computer security.

In the same way a night watchman proceeds through a building, turning doorknobs to check that they’re locked, hackers scan the network looking for open ports on computers. The new NACS system collects and analyzes information from UCI Unix and Linux computers to check for activity indicative of possible misuse or attempted misuse.

This system is modeled on security features integral to Linux, and delivered to other Unix systems on campus through NACS’s autoinstall software. It depends on modified network applications (such as telnet and ftp) which are often used for compromising system security. These modified applications report to NACS’s logging system whenever they are used. Certain patterns of use are clues that a particular system may need attention.

Intrusion efforts which can be caught by this system range from the simple-minded (probing for improperly secured network ports) to some very sophisticated kinds of attacks (e.g., “buffer overflow” exploits). While the only way to guarantee a computer is safe from network-based attacks is to remove it from the network, this new system represents another way NACS is making it harder to cause harm to UCI computers.