Our lecture 3 of Information Technology Security course is about Program Security. Lecture start with En. Mohd Zaki briefly explained the difference between failures and fault. According to him, fault is inside view from developer while failures are outside view from user. A failure normally occurs because of fault. Besides, En. Mohd Zaki also mentioned that vulnerabilities most commonly found in web application.
According to En.Mohd Zaki, program errors are generally divided into two types which are malicious and nonmalicious program error. Nonmalicious program errors are unintentional error which causes by mistakes made by programmers and developer. Nonmalicious program errors causes program malfunction but do not lead to serious security vulnerabilities. En. Mohd Zaki had explained to us two types of nonmalicious program error which are buffer overflows and incomplete mediation.
In the other hand, malicious code exploit the weaknesses in computer software and is intended to cause undesired effects, security breaches or damage to a system. Form of damage caused by malicious code could be in the form of modification, stolen data and unauthorized access. En. Mohd Zaki told us that malicious programs can be divided into need host program and independent. Malicious programs that need host program are trapdoors, logic bombs, Trojan horses and viruses while independent malicious program are bacteria and worms. En. Mohd Zaki had explained some of malicious code to us and he stressed on virus and worm.
After listened to En. Mohd Zaki explanation, I know that Trojan horse is a program which masquerades as a legitimate program, but does something other than what was intended. Virus is program which, when executed can add itself to other program, without permission and in such a way that the infected program, when executed, can add itself to still other program. Virus requires a host program as a carrier and replication is limited to virtual system. Virus normally hides in a compiler, database manager or a file manager, attachment to email and public download file. In order to gain control, virus has to control CPU which execute it by overwrite program on disk, move original program and after CPU executes it then transfer control to the program or install itself in memory and change the pointer of OS. Detection tools, identification tools and removal tools can be used to protect against viruses. Scanners and disinfectors are the most popular classes of antivirus software. Truths and misconceptions about viruses also have been discussed by En. Mohd Zaki.
Unlike a virus, a worm does not require a host program in order to survive and propagate itself as it is a self contained program. It sends itself or part of itself to other computers, most often through a network connection. One of the examples given by En. Mohd Zaki is worm propagate normally through email. When we open an attachment in email, worm will scan email address book and then send email to all email address automatically. The effect of worm propagation is causes network shutting down. Bacteria is different from worm is in the aspects of it does not affect network, but replicates itself until fills all disk space. Activation of logic bombs is triggered by a pre-determined time or event. Trap door occurs when programmer leaving debug routines in the code using code giving chance to exploit program. One of the famous trapdoors is Salami Attack.
At the end of lecture, En. Mohd Zaki had briefly explained on the attack associated to program error. He told us that cross site scripting, injection flaws and malicious execution are three most important attacks and will cover in lab section.
