Jump to content

Computer security software

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Beland (talk | contribs) at 05:56, 15 June 2021 (→Futuristic security concepts: drop weird speculative section). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.


Computer security software or cybersecurity software is any computer program designed to influence information security. This is often taken in the context of defending computer systems or data, yet can incorporate programs designed specifically for subverting computer systems due to their significant overlap, and the adage that the best defense is a good offense.

The defense of computers against intrusion and unauthorized use of resources is called computer security. Similarly, the defense of computer networks is called network security.

The subversion of computers or their unauthorized use is referred to using the terms cyberwarfare, cybercrime, or security hacking (later shortened to hacking for further references in this article due to issues with hacker, hacker culture and differences in white/grey/black 'hat' color identification).

Common Programs or Utility Apps

Programs that are generalized enough they are commonly applied whether a user identifies themselves as white, grey, or black. Often referred to as utility applications, utility apps in this context are programs that enhance a user's experience in traditional display devices, augmented reality (AR), or virtual reality (VR); with a few options for support programs. Often referred to outside the context of hacking specifically, yet the potential for hacking uses depends on the way that they modify the experience, as they may provide the equivalent of enhancements directed towards hacking and subversion goals.

Bootloader

An IT tool used working with the boot code of a device. When most computers are turned on, they don't possess an operating system, or applications, and need to load a series of progressively greater complexity programs to enable their operation. When healthy, a bootloader simply loads the correct programs, and the computer functions normally. However, compromised bootloaders allow commands (often hidden in the hacking context) to be input into the device after the next reboot. Popular options include announcing the location of the device when it connects to a network, adjusting the processing of the device so that the default device attributes are the choice of the hacker, annoying the owner of the device, and making a record of every action on the device. These programs allow for a variety of tasks to be set up in the boot record rather than just destroying the functionality of the device.

Browser and Search Engines

Browser and search engine combos reduce the time for relevant information searches on most web hosts by exploring the data structure of the host, building some form of hierarchical information representation, and then allowing for rapid retrieval of information from specific leaf nodes. From a 2020 computing perspective, this exploration is usually performed much prior to the interaction with an endpoint user, and often involves significant corporate expenditures for data centers[1] with extended costs[2] devoted to building and maintaining the hierarchical representation of the semantic web. A physical comparison to the challenge these systems face could be made to a blind and deaf person starting from a random position on Earth and attempting to find a specific piece of paper without knowing the searcher's location or the target's location and then solving for a minimal distance path to the desired object while providing relevant navigation information along the route.

Configurator (Hot Swap)

Sold to general users with the purpose of configuring their systems and guiding them through the setup process, these systems have applications towards hacking from the perspective of hot swapping and configuration templates. When run, a configuration for the user's operating system or hardware is chosen other than its current state from among a selection of alternate configurations stored in the Configurator. Rather than switching only a few programs or settings, a user may switch to the full configuration stored in the program, even if it means the Configurator stops running at that point. Usually, the configuration stored in this program doesn't change when used, with the intent that a user can switch back and forth between multiple configuration as necessary. In a hacking context, this process is then useful for hot swapping a system configuration in response to challenges encountered while attempting to interact with a target system. From a traditional computing perspective, this could be compared to booting into a completely different operating system while still using the same hardware.

Diagnostics

An ongoing self-evaluation system that monitors all the devices in a user's personal area network (PAN), giving constant vital statistics on their behavior. Popular with computer-literate and interested users who enjoy trying to squeeze every last bit of usefulness out of devices, they are also popular in keeping people aware of attacks against, and infections within, the computational devices that represent their PAN.

Editor

These programs make editing easier with a smart interface that learn a user's style and can even give suggestions based on their prior activity. Traditionally attached to the idea of software or text editing, these programs approach the physical with the advent of fully programmable hardware architectures like general purpose graphical processing units and field programmable gate arrays.

Games

Typically casual games that are displayed in some form of computer environment, allowing a user to enjoy them as a pastime while also still somewhat paying attention to reality. The number on the market is huge, with some older games being modified to run on modern hardware. Significant potential exists for games used in hacking that specifically "gamify" the hacking experience or translate the hacking experience into game terms, providing objectives, metrics of performance, and translations of the experience. An extremely simplistic variation on this concept is Wikiracing, a game where users attempt to traverse the links of Wikipedia as rapidly as possible, yet at the same time gain significant knowledge about the topology of Wikipedia and concepts like Six Degrees of Separation. Notably, this idea can also extend to the environment surrounding hacking, such as cultures like DEF CON and Pwn2Own that have gamified the activity of hacking itself in an annual or multiannual competition related to hacking specific targets for fun and prizes.

Iconography Alignment

Similar to a browser or search engine, these programs differ in that they support search actions when looking for specific data on a specific host that contains that data. When loaded, these programs tailor the search algorithms to match the specific iconography of the host, increasing the probability of finding relevant results with the targeted search data. Physical world comparison can be made to the difference between attempting to find a specific town on a map versus attempting to find a USB key lost in a landfill. From a biological systems perspective, this can also be compared to the concept of structural alignment which attempts to establish homology between two or more polymer structures based on their shape and three-dimensional conformation to aid in comparison and classification.

Shredder

Shredders are designed to assist in erasing files and all their redundant back-up options that might be around inside a computer system. A shredder functions by entering a large amount of random junk data into designated files, overwriting them repeatedly to help deter attempts at recovering them. From the perspective of 2020 software patterns this erasure process usually either utilizes the Gutmann method[3] of destroying data (often built from the CBL Data Shredder) or the ATA Secure Erase standard. Recovering a file that has been Shredded (or destroyed by a Logic Bomb, for that matter) requires access to the host the file was on originally, often with need for prior knowledge of the files contents, which explains why offline back-ups are quite popular.

Memory Management Utilities

Programs that support removing unnecessary memory allocation, detecting illicit system memory use, testing memory functionality within a system, or optimizing the system cache-management. Can become necessary in cases where the hacker's system may have a borderline amount of memory for the task being attempted or when processing large volumes of data rapidly and the speed of the operations is being inhibited by inefficient memory use. From a common Windows user's perspective, opening task manager and culling unnecessary operations represents a very basic form of this type of interaction, with some of the most valuable traits being the ability to view memory use, set process priorities, start and stop services, and forcibly terminate processes.

Social networking

Apps that monitor and support all other social networks that a person might use, incorporating them into a web of information. Possibly generating a relevance or impact score that is a piece of status in virtual social groups. Can have hacking relevance, as the worth of many network systems is based on the geometric complexity of the contributing nodes using relationships like Metcalfe's law. The social network itself my either be performing the hack or contributing to the hack, and in some cases may be the target or the recipient of the desired result of the hack. An example of this type of interaction from the 2020 perspective is the behavior of the Anonymous hacktivist collective known for its cyber attacks against governments, government agencies, corporations, and the Church of Scientology.

Software agent

Agents are autonomous computer programs built with varying levels of artificial intelligence that have some capability in general categories of computer use, hacking, and cyberwarfare. Agents perform actions within or across computer systems toward the goals of their users and are often given their own names, personalities, functions, and styles. An example of such a system used for non-hacking purposes is the Wikipedia 1.0 bot (notably a "user" from the perspective of Wikipedia) that performs data collection and processing on the categories of Wikipedia, while an example used expressly for cyberwarfare purposes is the Stuxnet worm developed jointly by the United States and Israel specifically to target the programmable logic controllers (PLCs) operating machinery and processes for gas centrifuge separation of nuclear material.

Theme music

An algorithm that constantly monitors the owner of the PAN in all their interactions with devices. Taking this data, it attempts to determine the emotional state of the person and generates a playlist of songs to better support said user, either enhancing the feelings or dampening them. Essentially the similar to a musical mood ring. Has significant potential for hacking if the themes are then synced to either the owner or the network being interacted with. A basic example being that if security within a targeted system appears to have been notified (such as through increased lag or line noise) then battle music begins to transition into the theme.

Ticker

A series of operating system apps that provide an information feed from a specified source, the vast majority being legitimate, such as stock markets and news organizations. Some services also use these apps to give details on other users, admins, sysops, systems, police or military responses, and current payment rates for a variety of services and bribes. In the current world of 2020, there are a great many topics that generate enough traffic to merit an information feed. For example, a hacker could subscribe to a feed with up-to-the-minute news about market movement if the hacker's goal was a system related to stock market manipulation.

Virtual Machine

This program creates a virtual memory space on a user's disk. Virtual machines have traditionally been used to emulate specific hardware or architectures where the programs and environment are specifically tailored to a particular manufacture's walled garden, such as in the case of the Apple ecosystem and programs like Xcode. However, with the advent of cloud computing, virtual machines have moved into a realm where they are used to emulate multiple different architectures simultaneously on a single machine, often for the business needs of multiple endpoint users, while simultaneously providing the protection of a sandbox environment.

Types of Software to Secure Computers or Data

Below follow a series of software patterns and groups from the perspective of a host system interacting with users and attempting to secure itself or its assets against their interactions.

Prevent Access

The primary purpose of these types of systems is to restrict and often to completely prevent access to computers or data except to a very limited set of users. The theory is often that if a key, credential, or token is unavailable then access should be impossible. A physical comparison is often made to a fortress, armor, or jamming. A shell that even if abandoned would still present a significant challenge for computer access. This often involves taking valuable information and then either reducing it to apparent noise or hiding it within another source of information in such a way that it is unrecoverable.

Isolate / Regulate Access

The purpose of these types of systems is usually to restrict access to computers or data while still allowing interaction. Often this involves monitoring or checking credential, separating systems from access and view based on importance, and quarantining or isolating perceived dangers. A physical comparison is often made to a shield. A form of protection whose use is heavily dependent on the system owners preferences and perceived threats. Large numbers of users may be allowed relatively low-level access with limited security checks, yet significant opposition will then be applied toward users attempting to move toward critical areas.

Monitor Access

The purpose of these types of software systems is to monitor access to computers systems and data while reporting or logging the behavior. Often this is composed of large quantities of low priority data records / logs, coupled with high priority notices for unusual or suspicious behavior. A physical comparison to eyes, goggles, scanning, or spying is often made. Observing user's behavior, often with the secondary goal of remaining hidden themselves.

Surveillance monitor

These programs use algorithms either stolen from, or provided by, the police and military internet observation organizations to provide the equivalent of a police Radio scanner. Most of these systems are born out of mass surveillance concepts for internet traffic, cell phone communication, and physical systems like CCTV. In a global perspective they are related to the fields of SIGINT and ELINT and approach GEOINT in the global information monitoring perspective. Sources for such information and the organizations that provide them, in the year 2020, within their particular jurisdictions, include (although may not be exclusive to):

Note that several instant messaging programs such as ICQ (founded by "former" members of Unit 8200), or WeChat and QQ (rumored 3PLA/4PLA connections[7][8]) may represent extensions of these observation apparati.

Remove Programs or Malicious Code

The purpose of these types of software is to remove malicious or harmful forms of software that may compromise the security of a computer system. These types of software are often closely linked with software for computer regulation and monitoring. A physical comparison to a doctor, scrubbing, or cleaning ideas is often made, usually with an "anti-" style naming scheme related to a particular threat type. Threats and unusual behavior are identified by a system such as a firewall or an intrusion detection system, and then the following types of software are used to remove them. These types of software often require extensive research into their potential foes to achieve complete success, similar to the way that complete eradication of bacteria or viral threats does in the physical world. Occasionally this also represents defeating an attackers encryption, such as in the case of data tracing, or hardened threat removal.

Types of Software to Subvert Computers or Data

Similar to systems used to secure systems, below are a series of software patterns and groups from the perspective of users attempting to subvert, invade, or infect computer systems. Many of these ideas where theorized as early as the 1960s and 1970s in the fields of cyberpunk literature with magazines like New Worlds and solidified in the 1980s with novels like Neuromancer. Note that most of these types of program also have applications in securing systems and countering hacking, yet are primarily known in the fields of hacking, espionage, and computer subversion. Because of their similarity to securing computers, these ideas fall into similar categories.

General Terms

Bot

copied from main wikipedia article (with slight modification) on 3/19/2021 for ease of reference

An Internet bot, web robot, robot or simply bot, is a software application that runs automated tasks (scripts) over the Internet.[9] Not necessarily malicious, bots perform tasks that are simple and repetitive, much faster than a person could. The most extensive use of bots is for web crawling, in which an automated script fetches, analyzes and files information from web servers. More than half of all web traffic is generated by bots.[10]

Botnet

A collection of programs or software agents operating over a collection of computers and internet addresses. Behaving like a swarm or collective, these groups often route information through each other, perform coordinated actions with each other, or redundantly store information throughout the group. Often viewing as being controlled through command and control software. However, botnets can be created in a "fire and forget" structure, where an infectious program is released into the wild, replicates itself, and then operates autonomously based on its guiding parameters. Can be composed of bots, virii, worms, or trojan horse software or a combination of the types.

Virus

copied from main wikipedia article on 3/19/2021 for ease of reference

A computer virus[11] is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code.[12][13] If this replication succeeds, the affected areas are then said to be "infected" with a computer virus.[14][15]

Computer viruses generally require a host program.[12] The virus writes its own code into the host program. When the program runs, the written virus program is executed first, causing infection.

Worm

copied from main wikipedia article on 3/19/2021 for ease of reference

A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers.[16] It often uses a computer network to spread itself, relying on security failures on the target computer to access it.

Trojan Horse

A software program that disguises its actual purpose, often with malicious intent. Usually downloaded while imitating legitimate software, a trojan horse may then immediately execute and transform into a different type of software, or imitate the legitimate software while covertly running secondary programs.

Perspective on "Malicious"

Although viruses and worms are often created maliciously, both could theoretically simply evolve from ideas like software bugs that cause a program to begin replicating and spreading, without any initial intended malicious behavior. Much like their organic counterparts, a tapeworm isn't necessarily "malicious", simply another organism growing in its natural environment. Yet from the perspective an animal's digestive tract, this might be interpreted as aggressive or invasive behavior. Several types of worms and virii in the organic environment have evolved to be symbiotic with their hosts, and similar situations may be possible in the digital environment.

Isolate or Modify Access

The purpose of these programs from an attack perspective is to isolate or control access to a system while still allowing the normal users to operate the system. This may imply that the normal users are completely unaware of the issue, or that the normal users experience a degradation of their user experience without an obvious cause until the malicious software is found. In larger internet context, this may also involve isolating a computer from interaction with the wider internet, possibly without their notice, or installing software that might allow for the possibility for future control of the user's system without immediately taking control. A physical world comparison is copying the keys to an owner's house without their knowledge. Vandalism and intimidation could happen in the future, yet don't necessarily happen immediately.

Monitor Access

The purpose of these programs is simply to monitor a user's interactions with a computer system. Often there is little or no degradation of the user experience, as obvious degradation would give away the monitoring. Stealth tends to be a priority as information gathering is preferable to short-term benefit. A physical world comparison would be a deep-cover spy that might exist as part of a society for decades, going to work in factory, earning promotions with increased trust or responsibility, all with the purpose of silently gathering and reporting information.

Prevent Access

These programs are designed to stop normal users from interacting with their systems, often permanently. The stuxnet worm was a program within this category, designed to find specific computer systems related to nuclear refining, and destroy those systems. In hacking culture, this behavior is often referred to as "bricking" a target's computer system.

Warez

Programs usually designed for an economic benefit to the attacker, which install an application, often hidden, on the targets hardware. These programs then usually either provide information (such as unwanted ads), restrict information in a form of blackmail, or record information that can later be sold or used to find further vulnerabilities. The unifying theme, however, tends to be the economic motivation with some type of implied payout from the activity. This can be contrasted to other types of programs that might have social, military, or nationalistic motivations with no perceivable economic motivation. Physical world comparisons are challenging, yet might include aggressive advertising billboard placement, loudspeakers blaring out propaganda, thieves stealing objects and demanding payment, or kidnappers stealing family or friends and demanding payment.

Software run on computers to secure other systems

These types of software are programs run on computers that are primarily intended to secure systems other than themselves. This is usually achieved by providing interactions with physical world systems or by evaluating data that may not be "directly" related to computer security.

See also

References

  1. ^ "How Many Servers Does Google Have?". Data Center Knowledge. Retrieved 20 September 2018.
  2. ^ Sattiraju, Nikitha (2 April 2020). "The Secret Cost of Google's Data Centers: Billions of Gallons of Water to Cool Servers". Time Magazine. Bloomberg. Retrieved 22 October 2020.
  3. ^ Rubenking, Neil J. (July 29, 2005). "CBL Data Shredder". PC Magazine. Archived from the original on June 23, 2018. Retrieved 23 June 2018.
  4. ^ "SIRENE cooperation". European Commission, official website. European Commission. Retrieved 22 October 2020.
  5. ^ Pike, John (25 July 2002). "Directorate for Inter-Services Intelligence". Federation of American Scientists. Archived from the original on 15 May 2008. Retrieved 13 December 2008.
  6. ^ "Tipping the scales: Security & surveillance in Pakistan" (PDF). Privacy International. Privacy International. Retrieved 31 May 2021.
  7. ^ O'Neill, Patrick Howell (3 May 2017). "Under tough surveillance, China's cybercriminals find creative ways to chat". SNG. cyberscoop. Retrieved 22 October 2020.
  8. ^ Dasgupta, Binayak (1 July 2020). "Mass surveillance risk real with Chinese apps: Experts". Hindustan Times, New Delhi. Retrieved 22 October 2020.
  9. ^ Dunham, Ken; Melnick, Jim (2009). Malicious Bots: An Inside Look into the Cyber-Criminal Underground of the Internet. CRC Press. ISBN 9781420069068.
  10. ^ Zeifman, Igal. "Bot Traffic Report 2016". Incapsula. Retrieved 1 February 2017.
  11. ^ "The Internet comes down with a virus". The New York Times. August 6, 2014.
  12. ^ a b "Worm vs. Virus: What's the Difference and Does It Matter?". Avast Academy. Avast Software s.r.o. Retrieved 9 March 2021.
  13. ^ Stallings, William (2012). Computer security : principles and practice. Boston: Pearson. p. 182. ISBN 978-0-13-277506-9.
  14. ^ Aycock, John (2006). Computer Viruses and Malware. Springer. p. 14. ISBN 978-0-387-30236-2.
  15. ^ Alan Solomon (2011-06-14). "All About Viruses". VX Heavens. Archived from the original on 2012-01-17. Retrieved 2014-07-17.
  16. ^ Barwise, Mike. "What is an internet worm?". BBC. Retrieved 9 September 2010.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Computer_security_software&oldid=1028644630"