My Argumentative Research Paper: How Unsafe Can You Get?

In late August 2003, a malicious code called “Sobig.F” unleashed its terror upon the World Wide Web. The worm has the capability to evolve from the instructions it gets from 20 computers. Because of this “adaptation,” it is impossible for antivirus programs to detect, block and repair the damage. Unlike other malicious code, the sender does not have to send the message to his contacts for the infection to take place. The virus takes the initiative to send itself to all persons in the mailing list.

The infection was so severe that 1 in 17 mails sent worldwide are infected and reporters at the New York Times had to turn off all their terminals. Also, Sobig.F does not do any damage to hard drives. This means that all files in the computer’s hard drive are intact. So what do we need to worry about? Sobig.F might not deal destruction to hard drives but networks get napalmed. All internet applications, and including email, crashed and became as good as nothing. Thankfully, before the infection spread even further, investigators were able to track and shut down 19 of the 20 computers used to give instructions to the virus and the last computer redirects the infected computers to a “run-of-the-mill sex site” (Taylor, 2003).

The first paragraph might be an apt synopsis for a sci-fi thriller. However, that amount of destruction does not end in the movies. This is true. Virus infections are everywhere. If it could happen to the best of us (i.e. denial of service attacks on large computer corporations like Microsoft), it could happen to any of us. This paper deals with how one of the new media of communications, called email, has made life easier but more unsafe for us.

Most Common Threats

The number one threat to an email’s integrity (authenticity of data and other factors associated with it) are viruses. The biological virus is harmless outside a cell. When it comes in contact with a cell, it multiplies inside the cell until the cell ruptures. Likewise, computer viruses are virtually harmless outside of a “host” computer. The good part ends at that since viruses do not stay outside of a host computer forever.

Because of the relatively high frequency of virus infections, antivirus software are the most used security tool by large companies. In the United Kingdom alone, all large businesses and 49 out of 50 businesses use this kind of software overall (Pricewaterhouse, 2006). Email has a significant amount of contribution for this infection. Virus-infected messages usually have attachments that have subjects that are sexual in nature to make sure that the owner of the email address would at least stop and be curious enough to open the attachment (the file bundled to the message). Anti-spyware software ranks a close second. There is reason for this kind of security paranoia. In 2006, almost half of all businesses in Great Britain were infected with at least one kind of virus. But another problem comes to mind: viruses are revised by the same or different programmers and, therefore, antivirus software cannot recognize such threats. To counter this, most software offer updates to their virus database or list of viruses. This means that new viruses or modifications of old ones can be recognized. There are two kinds of updates: signature files and critical updates. Both are crucial to antivirus software’s function. Signature files contain the signatures (what makes the virus different from harmless code and what makes it different from the other virus) for specific viruses. Critical updates contain updates about the overall program itself, usually with the database and the workings of the programs. But to recognize the infection, some damage must be done by the new virus to be officially called a virus. In other words, antivirus software would not detect a new virus unless the virus shows its effects (“Viruses and malicious software,” 2006). Much like what a vaccine does to the human body but, this time, email is the syringe. This amount of complexity in the part of the antivirus program mirrors the destructive capability of viruses. In this arms race, email users are always on the defensive.

Spyware are the more stealthy cousins of viruses. From the name itself, its function can be deduced. This type of malicious code aims to get personal information (such as name, birthday, email and social security number, etc.) from the user. This type of infection is usually less destructive than a virus. Aside from websites, they are usually in the form of email attachments. The subject of the email would probably be something about winning in a lottery or a jackpot. The senders would usually ask for personal information (name, birthday, social security number, etc.) to be emailed to them. Even if the user recognizes that the message is a fake one, a well-constructed message might already have embedded spyware at the email user’s mailbox or at the user’s hard drive. A possible way of data gathering by the spyware is by recording the letters or numbers typed by the program user. The spyware then sends the recorded set of characters to the spyware’s creator. The first set of characters typed by someone is the person’s password in the Windows interface. This is far less dangerous than the spyware in the mailbox since the hacker must be physically present to open the account using the password. In Yahoo! Mail, for example, whenever the user tries to access the URL http://mail.yahoo.com or http://www.yahoomail.com, the spyware is prompted to begin recording information. Whatever is typewritten in the username and password field is stored by the spyware for future use. Though these are but some possible scenarios, with the vast amount of spyware available, it is impossible that no programmer has at least took into consideration the said plan of attack.

Adware is one of the most visible types of security breaches. Compared to a virus and spyware, any ordinary personal computer user can create an adware. Adware (from the root words “advertisement” and “software”) is in the form of a promotion of a commercially available product. Whether this product is for sale or not or whether the product even exists is most usually unknown by the recipient of adware. Adware would range from fully-colored and graphically complex ones to a text-only email. The more visually appealing adware sometimes have an animated button that says “Click Me!” or a variation of that device. The advertisement contains text saying, “You won $1,000,000” or “Congratulations! You are the 999,999^th visitor,” both of which are too good to be true. If the user, by any means, accessed the link given in the adware, a site, heavily-infected with viruses, spyware, adware, etc. would appear. This would make the adware an indirect way but, nonetheless, another way of infecting computers. With the text-only kind of adware, a message containing the name of the product, a tagline and a link to a website is used as a method of cheap (has costs so negligible that it is almost free) product endorsement. Most users would think that not clicking the link or deleting the message solves the problem. However, adware has a defining characteristic: “persistence.” The same message could be sent 10 times, registering as 10 emails in a recipient’s mailbox. This would be a complete waste of time for email users. Of course, if the messages use the same words for its subjects, the email user could open the message, read the message and delete the other emails since they would most probably contain the same texts for the message itself. However, it is more recommended that this kind of email should not be opened at all and should be deleted immediately. People might think that avoiding adware is easy and that personal information cannot be taken from them if the users do not give it. As a matter of fact, the mere presence of an adware in an email message is an indicator that the sender knows the user’s email address or the email address of the user’s group at the least.

Problems with the Predecessors of Email

Before email, prototypes or what is popularly called beta versions, were used which cater only to specific audiences. These services are similar to email in the aspect of delivering a message in a way that can be read by the computer.

A proposal for a more efficient form of communications was made in 1977. Compared to the traditional snail mail which took days to reach its destination, this proposal claimed that this new communications system, called electronic mail, will “reduce transmission time to minutes” (Potter 1161). By 1986, an electronic mail system (EMS) capable of “computer text processing and communication tools to provide a high speed information exchange service” (Sproull and Kiesler 1493) was already in use. The user of this system needs only to make an account, as all email clients/providers require up to the present, and he can then use email to send messages to email accounts of computer users connected to a network the sender is connected to. The rudimentary text processing has greatly improved. Today, Microsoft Word is the dominant text-processing software due mainly to it being bundled to most Windows operating systems (OS), which is the most iconic OS since the late ‘80s. Also, Microsoft Word Documents (abbreviated as Word documents and carrying the .doc format) can now be “linked up” with email through attachments, the information exchange capability of email. The information exchange capability is what malicious software writers employ to bundle viruses, spyware, adware, etc. with an innocent-looking email. One of the best features of email is its non-simultaneous capability. Whether the receiver is connected or not connected to the internet, he will be able to receive an email. Compare this to telephones which require that the caller and receiver by on the phone at the same time (Sproull and Kiesler 1495). There should be conscious coordination between caller and receiver due to time zones, schedules and other such constraints. There is the factor of time and place. Communication via snail mail already solved both these problems but it is too slow (Sproull and Kiesler 1945). The 1986 EMS was able to solve the problem of synchronicity but it will take years before email can be used anywhere (the advent of the laptop and wireless technology are credited for this). Because of being non-simultaneous, virus writers can now “fire-and-forget.” All they have to do is compose a message, attach a virus and send the message. Afterwards, they could hide safely in the anonymity of their fake accounts knowing that, their message will be received almost always. As of today, email can transmit messages in seconds. The extremely quick transmission time is an obvious benefit of this system. However, this is a double-edged sword. This also means that infection-laden emails can propagate in a very short amount of time. The author of the article even predicted the use of high-speed media in conjunction with the internet and the reduction of prices in communications.

One could envision future generations of communicating equipment using magnetic media, such as disks, or high-speed tapes with higher throughput capability and highspeed modems. This would further reduce the cost of transmission and provide a tremendous communication savings for the user, providing his volume can justify the investment in the terminals and systems (Potter 1161).

Today, the most popular email web clients like Yahoo! Mail and Gmail even offer email free of charge. As a consequence of this, fake email accounts, which are accounts with forged personal information, have multiplied in number. These fake accounts are an essential tool for virus writers due to the privacy that it offers. In essence, email has been used against itself.

The first users of electronic mail are companies. Because of this factor, knowledge of even the simple workings of the system is limited to few. Now, electronic mail is a very prevalent form of communication that almost all people in first world countries own one. Because of its negligible cost, email, which was once a luxury available for top companies only, was now a necessity available to all people. This has made the knowledge of the weakness of email known to a large number of individuals.

In 1978, an early but fully-functional form of email is the Electronic Mail System (EMS). This system was first used by the United States military under the Advanced Research Project Agency (ARPA) of the Department of Defense. The “…concept was to install dedicated minicomputer systems in selected facilities or clusters, tied together in a logical mail network…” (Crawford 2). This is very similar to what the servers do to support the growth and data stored in the World Wide Web. Multiple servers are currently used to relay information from one computer to the next. This relay can be in the form of web pages or emails. Also, the number of servers used is directly proportional to the distance between the two computers. Like email, EMS can store data in a network in organized arrays, resulting in files. This military system used civilian establishments, most notably companies, as guinea pigs to find out the user’s response to the new system of communication. In offices, the most commonly utilized forms of communication are memos (physically attached to a location where it is visible to the personnel concerned), telephones and fax machines. The response was an increase in the rate of productivity. “Secretaries estimated that EMS saved them an estimated eight to ten hours per week, and managers estimated their saving [sic] to be about seven hours per week…” (Crawford 4). This was the beginning of a psychological dependence, on part of humans, on email. Because EMS reduced workload, people tried to use the system to its limit to achieve maximum efficiency. What they did not take into consideration at that time are certain factors which they just considered as theoretical. These include increasing connection time resulting in inadequate service and, further, more users being added on to the network. Similar to adware, office memos became more informal but EMS cannot differentiate between adware and a useful email message Because of this, “…the mass storage capabilities of the system can become swamped rather quickly.” More problems were later discovered including “… high frustration for all users because of poor resistance, undue internode message delays and, even worse, low probability of access to the system during prime time [sic]. The popularity of the new tool almost became its downfall! (sic)” (Crawford 8). Email groups were formed in businesses as different groups specialized in various tasks to keep the business running. In EMS, only one note is needed to send a memo to a group. The group then sends the message to each and every member of the team. Each contains a field where the recipient ID is seen. If this is seen by a third party (another person or group of persons not included in the network), like the EMS, the members of the group are compromised.

Electronic Data Interchange (EDI) is another form of email used by companies. EDI is capable of transmitting information via a specified format. “Transactions may be initiated directly by customers and vendors. The authorization of transactions is controlled by limiting those trading partners that can gain access to the computer system” (Hansen and Hill 403). This could only mean that certain features comparable to today’s emails, like username and password for authentication, was shared by at least two groups. One of the most common tips in cyberspace was to make a password known only to the account’s owner. The sharing of an account needs a very strong sense of trust (a very hard thing to come by between business partners) especially in an extremely competitive area like business. “A paper-driven system naturally creates a trail of documents that allow tracking of the transaction activities. These documents are not necessary to process transactions in an EDI system [sic]” (Hansen and Hill 410). The paper trail, though cumbersome and takes up huge amount of resources, is good form tracking business transactions. EDI is considerably harder to trace than a paper trail, making it ideal for hiding anomalous transactions as well as for hackers to sneak into.

Prevention and Protection

A message can be protected by encryption. Encryption changes the original message (called “plaintext”) into a garbled, incomprehensible and unreadable form (called “ciphertext”). Two types of key encryption are utilized by email: symmetric key encryption and asymmetric key encryption.

Symmetric key encryption involves the possession of a key. A long set of letters (both uppercase and lowercase) and numbers comprises the key. This key contains instructions to be given to the computer to change plaintext into ciphertext. However, the sender and the receiver must have a copy of this key as this key can be used to reverse the instructions given to the previous computer and apply this to the ciphertext sent to the receiver computer. The receiver computer changes the ciphertext back to its readable form, the plaintext. This change is called decryption. Ideally, only one sender and one receiver should have the same key. This means that for a person with 10 contacts, he should possess 10 distinct symmetric keys. Applying this further, if all 10 of the person’s contacts have also 10 contacts and uses symmetric key encryption, there should be a total of 55 distinct symmetric keys for that specific network. Due to being reversible, a symmetric key is hard for ordinary people to crack but, compared to the next techniques in encryption, fairly easy for a determined hacker to get and very easy for government agencies, specifically, the Central Intelligence Agency (CIA) and the National Security Agency (NSA) of the United States. If in the case that the hacker was able to get the key, by any means possible, the connection between the sender and receiver is compromised (Schneier, 1995).

Symmetric key encryption users have two keys: a public key and a private key. Both keys also comprises of a long set of random characters and numbers. The public key is usually posted at a forum managed by the receiver or any public accessible website owned by the receiver. Visitors of the forum or website can email the owner of the website with confidence that information sent via the internet is secure because of the system’s relatively strong indecipherability. The public key is a one way key: this means that the public key can only be used for encryption. The public key is useless for decryption. If it was used in decryption, another garbled message, which has a security that was further strengthened by double encryption, is the result of this error. The private key is similar in form to the public key: it also uses a random combination of letters and numbers. However, this key is available only to the receiver. This means that only the receiver has the capability to decrypt the message. The sender cannot decrypt the message (however, the sender composed the original message so it is useless to have the private key). The private key cannot be used as to encrypt the message. This would result in an unreadable form of the message which will render the message impossible to decrypt. In this case, the private key was used to encrypt (a task for the public key) the message. Because public and private key occur in pairs, making the private key do the task of the public key made the private key the public key. This means that another private key is needed to decrypt the message encrypted by the private key but the private key that should be used to decrypt the message does not exist. Compared to the cumbersome symmetric keys, asymmetric keys are much easier to use. For a certain individual with 10 contacts, all he needs is one public key and its corresponding private key. If all the individual’s contacts also have 10 contacts and they all use asymmetric key encryption, this means that only 10 pairs of public and private keys are needed. For this system to be compromised, a hacker must get both the public key and the private key. If the hacker succeeds in getting the private key (getting the public key is a piece of cake), the owner of both keys is compromised. In this case, only the owner is compromised but all of his encrypted incoming mails are now rendered useless (Schneier, 1995).

Digital Signatures are a set of codes embedded in an email. This is more effective if combined with asymmetric key encryption. In this system, a code is generated and inserted into the message. If the message was received and/or decrypted, the digital signature would look like a long string (i.e. combination) of characters and numbers which have no meaning and no pattern. The digital signature is unique for every email. Every email, even by the same sender, has a different digital signature. The digital signature is an indicator of the authenticity of the message. If the message was modified by a third party, a hacker for example, the digital signature would also be modified. If the receiver gets the email, he would know that it was tampered with due to the tampered digital signature.

Conclusion

The nightmare that was Sobig.F was over. However, infections due to virus, spyware, adware and the like are still roaming the Internet. It might neither be now nor tomorrow, but one thing is for sure: a bigger and badder virus might make its way into mailboxes. Who knows what adaptation this virus would have? It could send probably send itself a hundred times among all a person’s contacts. It might not only bring down the internet but even the hard drive. This time New York Times would not be the only ones beating the clock to shut down their computer terminals. At least 10 percent of email would be infected. By that time, hard drives have crashed and the whole world could be in a state of pandemonium. Industries, stock markets and whole nations would go down overnight. Too bad not all people learn from other’s mistakes. Sobig.F was stopped in its tracks. The world’s gamble paid off. However, even gamblers run out of luck. The question is: when?

Sources:

1. Crawford, A. B. Jr. “Corporate Electronic Mail—A Communication Intensive Application Information Technology.” MIS Quarterly 6.3 (Sep. 1982): 1-13. Journal Storage. Rizal Library, Ateneo de Manila University, Quezon City. 28 Nov. 2007. .

2. Hansen, James V., and Ned C. Hill. “Control and Audit of Electronic Data Interchange.” MIS Quarterly 13.4 (Dec. 1989): 403-413. Journal Storage. Rizal Library, Ateneo de Manila University, Quezon City. 28 Nov. 2007. .

3. Taylor, Chris. “Attack of the World-Wide Worms.” TIME Magazine (1 Sep. 2003): 16 pars. 24 Dec. 2007. .

4. “Information Security Breaches 2006: Viruses and malicious software.” Pricewaterhouse Coopers. Apr. 2006. Department of Trade and Industry, United Kingdom. 8 Dec. 2007. .

5. Potter, Robert J. “Electronic Mail.” Science 195.4283 (18 Mar. 1977): 1160-4. Journal Storage. Rizal Library, Ateneo de Manila University, Quezon City. 28 Nov. 2007. .

6. Schneier, Bruce. Email Security: How To Keep Your Electronic Mail Private. New York: Wiley, 1995.

7. Sproull, Lee, and Sara Kiesler. “Reducing Social Context Clues: Electronic Mail in Organizational Communication.” Management Science 32.11 (Nov. 1986): 1-21. Journal Storage. Rizal Library, Ateneo de Manila University, Quezon City. 28 Nov. 2007. .