This is an English summary of my master’s term project, “Information Security in the Virtual World,” prepared in 2016 in the Management Information Systems graduate program at Haliç University under the supervision of Asst. Prof. Dr. Ahmet Erkoç. The project compiles and discusses material from many sources, including news reports and industry studies listed in the Turkish version. Figures and events reflect the situation in 2015–2016.

Preface

I would like to thank my thesis advisor, Asst. Prof. Dr. Ahmet Erkoç, for following my work with great effort and dedication and for supporting me with patience throughout my master’s studies; Giray Uslu for sharing his experience and examples; my fellow master’s student Mesut Çorbacı for his help with the evaluations; and, finally, my dear mother and father, who have supported me throughout my education and stood behind every decision I made.

Abstract

At the time of writing, there were an estimated 400 million computers connected to the internet, more than a billion internet users and nearly 100 million websites worldwide, with around 15 million users in Turkey alone. The internet has become indispensable: we use it for email, banking, downloading files, researching products and applying for jobs. In doing so, we constantly share personal information such as credit card numbers, usernames, passwords and personal details, and we download files and attachments. This exposes us to spyware, identity theft and fraud, so taking security precautions is essential.

Keywords: Internet, information, security, hacking, attack

1. Browsing the internet safely

  • Be careful with what you click on social networks. A few years ago, many Facebook users found explicit links being posted on their timelines in their own name. Once infected, such malware spreads by reposting itself to all your friends. The defense is simple: don’t click suspicious links or sensational headlines designed to provoke outrage or curiosity.
  • Take your security details seriously. A strong password is not enough if you type it on a shared computer. Avoid shopping or banking from internet cafés or open Wi-Fi networks, buy only from online stores with a real-world address and trustworthy payment options, keep your browser up to date, and remove programs you don’t need, since software running in the background can open security holes.
  • Ignore “Your computer has a virus!” ads. These pop-ups either carry malware themselves or try to trick you into paying for fake software. Use a reputable antivirus product and keep it updated instead.
  • Read every step when installing software. Clicking “Next” repeatedly often installs unwanted adware along with the program you wanted.

2. Antivirus software

Computer viruses are small malicious programs written to spread from one computer to another, disrupt them and steal data. Early antivirus products relied on signatures: they took the hexadecimal code of a known virus and searched every file for it. This worked well in the 1990s, but in the 2000s trojans, keyloggers and worms forced vendors to go further.

Modern products also watch programs while they run in memory: do they drop extra files, modify the Windows Registry, or call suspicious functions? Because all real work eventually goes through low-level kernel functions (via instructions such as sysenter or syscall), malware cannot easily hide from this kind of monitoring. Heuristic detection looks for suspicious combinations of behavior. For example, a program that adds itself to the startup list in the Registry, hooks the keyboard and opens network sockets is very likely a password stealer. Heuristics trade certainty for speed and can produce false positives, so they work best combined with dynamic analysis.

Viruses spread through many channels, and email is one of the most common: attackers send messages with tempting subjects so that users click a link or open an attachment themselves. Using an antivirus product with a constantly updated database is essential. (At the time, the project also noted that switching to a Linux-based system such as Ubuntu or Pardus greatly reduced exposure to common Windows malware.)

Antivirus vendors are always one step behind: when a new virus appears, they must first analyze it through reverse engineering, document how it behaves and spreads, and then add its signature to their databases so that users receive protection through updates.

3. Firewalls

A firewall controls all the traffic entering and leaving your system. It protects against internal and external attacks, hides your computer from opportunistic port scans, blocks malicious trojans from reaching the internet and helps keep personal data from being stolen. Typical components include an application monitor (no program runs or connects without permission), a component monitor (inventories installed software and checks it for malicious code), a network monitor (inspects traffic and blocks malicious connections) and application behavior analysis.

4. Cyber warfare between states

According to a 2012 New York Times report, the Stuxnet worm, which damaged around 1,000 of Iran’s roughly 5,000 uranium enrichment centrifuges, was developed as part of a US operation. Stuxnet targeted SCADA industrial control systems and also spread beyond its target, affecting innocent industrial companies. It was followed by Duqu, which infiltrated similar systems to steal information without causing damage, and Flame, considered by many antivirus companies to be one of the most complex pieces of malware ever found, designed for espionage and able to delete itself after completing its mission.

5. The 2015 power outage in Turkey

On 31 March 2015, a massive power outage left around 40 million people in 44 of Turkey’s 81 provinces, including Istanbul and Ankara, without electricity for hours. Shortly afterwards, an opinion piece in the New York Observer by analyst Micah Halpern claimed that the blackout was an Iranian cyberattack in retaliation for Turkish statements about Yemen. The project summarized this claim and the related reports on Iranian hacking groups; it is worth noting that this attribution was never officially confirmed, and Turkish authorities attributed the outage to problems in the power grid.

6. Turkey’s cyber security strategy

The 2016–2019 National Cyber Security Strategy and Action Plan, prepared by Turkey’s Cyber Security Board, set out goals such as building an inventory of critical national infrastructure and protecting it, creating legislation in line with international standards, raising awareness among managers and the public, training skilled cyber security personnel, strengthening incident response teams (SOMEs), establishing a strong central authority for coordination, building a national cyber security ecosystem with all stakeholders, promoting secure software development and reducing foreign dependence through domestic R&D.

7. Security operations centers

The project also looked at managed security operations center (SOC) services offered in Turkey, which monitor, analyze and alert on security events 24/7 using technologies such as firewalls, IDS/IPS, content filtering, SSL VPN, antivirus gateways, next-generation firewalls, DDoS protection and SIEM systems, usually after an initial vulnerability assessment and penetration test.

8. White-hat hacking

Drawing on an article by ethical hacker Eyüp Çelik, the project discussed why people attack information systems (curiosity, politics, proving it can be done, religion, ethnicity, social and economic motives, culture clashes and more) and how, in Turkey, the word “hacker” is still associated with crime, while “security expert” sounds respectable. A good security expert, however, must think like an attacker: as the saying goes, you can’t learn to defend without learning to attack. Famous hackers such as Kevin Mitnick later became security consultants.

9. Well-known hacker groups

  • Anonymous: a decentralized, leaderless collective active since around 2006, known for protest attacks and its links to WikiLeaks.
  • RedHack: a Turkish group founded in 1997, known for attacks on state institutions and leaking documents.
  • LulzSec: a small, short-lived but high-profile group behind attacks on Sony, Nintendo and US agencies; many members were later arrested.
  • Chaos Computer Club (CCC): founded in Berlin in 1981, one of the oldest hacker organizations, known for its annual congress and its focus on education and civil liberties.
  • Honker Union, Red Hacker Alliance and GhostNet: Chinese groups and operations accused of attacks and espionage against foreign governments and companies.
  • Cult of the Dead Cow: founded in Texas in 1984, known for hacktivism and security tools.

10. Threat statistics from 2015

  • According to Trend Micro’s Q1 2015 report, Turkey was the fourth most affected country by ransomware, with about 5% of the 15,532 attacks recorded worldwide, and the country most targeted by online banking malware in the Mediterranean and Middle East region, with 6,375 victims in three months.
  • Adware made up 48% of threats targeting Android worldwide, and old-fashioned macro malware in Office documents made a comeback, with nearly 93,000 victims.
  • A Kaspersky Lab and B2B International survey found that a third of users in Turkey had faced financial cyber threats in the previous year, and 7% had actually lost money, on average about 345 US dollars.
  • Cylance’s “Operation Cleaver” report described an Iran-based group that had targeted around 50 organizations, mostly critical infrastructure, in 16 countries since 2012, including an oil and gas target in Antalya, Turkey.
bilgidunyadaguvenligisanal