GET SCHWIFTY SECURITY

MY ADVENTURES TRYING TO PASS COMP6441

[getschwiftysecurity]

Module 7: Security Everywhere - UNSW Campus Security

This week, me and my friends decided it would be a good idea to see if we could ‘break into’ a building at UNSW to study up for our assignments. 

Now Hilmer Building is a building that closes at 6pm, following this the building’s doors are all locked and you can only enter if you are a Materials Science student with the ID card access - which none of us actually were.

So we waited outside until someone left. At 6:08pm, someone was leaving the building so we walked in as they left and headed into the building. Now there are study spaces on level one that do not require any further access but we decided we wanted to go to the higher levels.

So once again, we waited for someone to come downstairs and open the door so that we could sneak up. This took around an hour of waiting before someone came down which allowed us in. 

We were not trying to hide or anything from the security guards but just wanted to see how long it’d take before they would kick us out. It was not until 10:30pm until a security guard asked out to leave.

But even then he didn’t escort us out, just simply asked us to leave and left us. If anything we could’ve packed up and just changed locations.

UNSW Campus Security is not strong enough. Considering that anyone else could’ve made their way into the building and stolen things from laboratories or offices. 

[getschwiftysecurity]

Something Awesome: Update 6

I have just finished my video and will now send it off. I double checked through my report to check for any things that I could’ve missed and actually added another section about the customer’s journey when they are shopping online.

WIth my poster, I added another page with some security requirements because all good things come in threes.

I am really happy with my effort during this project.

[getschwiftysecurity]

Something Awesome: Update 5

I have completed my poster now and very happy with how it looks. I have a section about how users can protect themselves online also included some graphs with my data that I collected from my family and friends. I decided to focus on making it simple to ensure to not overload the reader with a lot of information. I drew information from my report and summarised it by a lot.

[getschwiftysecurity]

Module 7: Trump Phishing

Craft a phishing email attack aimed at Donald Trump that would succeed in luring Trump into clicking a link in an email.

Hello Donald,

It was very nice seeing you last week at the White House last week and giving me the time to speak to you about your future as the president of the United States. My team of editors have recently put together a montage of clips that we have taken of you over the past few year and I would love the opportunity to share this with you before it airs on national television.

https://www.youtube.com/watch?v=pNFRuHyntW0

Steve Doocy,

Host of Fox and Friends

[getschwiftysecurity]

Module 7: Email Phishing

Recon and Background Research

PuppyLove:

Website:  puppylove.org.au

Email: https://www.facebook.com/Puppy-Love-Australia-154384201787157

Address: 363 George Street, Sydney, NSW 2000

Sarah Jenkins:

Email: [email protected]

Instagram: https://www.instagram.com/sarah.jenkins0583

Dogs: Jasper, Max, Bella

Children: James (12/02/2014)

David Quest:

Email: [email protected]

Dogs: Angela, Jessie

Birthdate: (04/06/1984)

Facebook Password

Using the combination of keywords: Sarah, Facebook and Password.

Hi, Yep no worries. The facebook login details are: username: [email protected] password: COMP6441{MakeSureYouSetUpTwoFactorAuthToPreventThis!!} Kind regards, Sarah

Banking Account

Using the combination of keywords: David, Payment and Urgent.

Okay. I understand - it’s an urgent payment! I’ve just put the transfer through now on netbanking. The confirmation code is COMP6441{paymentfraudisreal!} Cheers, David

[getschwiftysecurity]

Module 7: Snoop

Should the government or government agencies collect and have access to your data for good purposes, or should citizens, e.g. have a right to privacy which stops them?

For Data Collection

Increased convenience for consumers. For examples, Amazon’s “Just Walk Out” allows customers to choose their items and simply walk out of the store with the items they took with them and pay through their face.

Like most data collection agencies, only take information when the customer choose to ‘opt in’ to the program. This will ensure that people who do not feel comfortable aren’t forced to take part.

One less card to carry around if a customer forgot their opal card or if they have no room in their wallet.

Government agencies like the police can easily detain criminals who are walking around the streets and takes pressure off them to search them down with clues.

Improper access to the information and data from employees or people with access can result in imprisonment.

Track every person entering into our country to possibly prevent any attacks on Australia.

Against Data Collection

Impossible to only scan people’s faces who have opted in since the cameras are always on and don’t pick and choose who they are tracking.

Government cannot be trusted with this technology.

“People have a right to expect a certain level of privacy when navigating public spaces, and must have trust that governments are taking appropriate action to protect that privacy.” Digital Rights Watch

Removes most physical security like locks and keys if everything is biometric.

People in power can take advantage of the data for political reasons or financial gain.

How can we be guaranteed that the information will not be shared or sold off the private companies.

“Unacceptable to assume the majority of Australians, who are not criminal and have the expectation to be kept safe by the state, are willing to succumb to heightened surveillance”.

Type I/Type II Errors

Google and Microsoft believe that the use fo facial recognition technology could unleash mass government surveillance on an unprecedented scale

The Capability

A Face Verification Service (FVS), which is a one-to-one image-based match of a person’s photo against a government record such as a passport (already operational)

Face Identification Service (FIS), which is a one-to-many, image match of an unknown person, such as the suspected criminal against multiple government records to help establish their identity. (Access will be limited)

[getschwiftysecurity]

Something Awesome: Update 4

My report has been completed and I am now working on the poster for people to look at. The report now has a references section as well with all the websites that I used.

Just to ensure that it wasn’t too long I cut out around a page worth of information that I felt was not too important. And I added instead sections about security threats and requirements to my report

[getschwiftysecurity]

Module 6: 5G Networks

To: Telstra, Vodafone and Optus

As the Prime Minister of Australia, I have written an Executive Order to discontinue and prevent any further work with the company Huawei from contributing to the infrastructure and building of our future 5G networks in Australia. This is due to a matter of national security as it has come to my knowledge that it would make it easy for foreign countries like China and Russia to spy on our citizens. Even though this will increase production costs by threefold, nothing is more important than the privacy of Australian people. 

Thank you for complying.

[getschwiftysecurity]

Module 6: One Time Pads

To encrypt a one time pad, each letter is given a value - A is 1, B is 2 etc. This means that is the key is A, then the plaintext character is shifted one letter whereas if the key is B, then the plaintext character is shifted two letters. It is vital that the key is randomly generated and the same length or longer than the plaintext.The key must never be reused

Each encrypted string uses the same one time pad key:

LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl

WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs

UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg

LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu

LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp

Cracking the One Time Pad

Noticing that 1, 4 and 5 begin with Lpa, I believe that they decrypt into The.

T (20) and L (12) ... Key is 18 ( 20 + 18 mod 26  = 38 mod 26 = 12 )

H (8) and P (16) ... Key is 8 ( 8 + 8 mod 26 = 16 mod 26 = 16 )

E (5) and A (1) ... Key is 22 ( 5 + 22 mod 26 =  27 mod 26 = 1 )

We can test this new key sequence: 18 8 and 22 onto 2 and 3.

Key Sequence: 18 8 22 

Message 1: The

Message 2: Eve

Message 3: Can

Message 4: The

Message 5: The

I then continued to test the letters after message two, guessing that it would be the key would be 14 for the letter R. Which would make the messages now:

Key Sequence: 18 8 22 14

Message 1: The S

Message 2: Ever

Message 3: Can Y

Message 4: The M

Message 5: The P

At this stage I then tried a bunch of guesses and eventually noticed that number of letters in the first letter of message 2 was quite long, 8 letters in fact which would be the word Everyone, so I tested that and applied it to all the other messages.

Key Sequence: 18 8 22 14 23 25 14 24

Message 1: The Secre

Message 2: Everyone

Message 3: Can You Pl

Message 4: The Most I

Message 5: The Price

I continued with discovering words that came after such as finish off Secret in Message 1 and Please in Message 3. Until I got to a stage where I can make out most of the messages.

Key Sequence: 18 8 22 14 23 25 14 24 0 20 20 19 13 9 16 19

Message 1: The Secret To Winning

Message 2: Everyone Deserves

Message 3: Can You Please 

Message 4: The Most Important

Message 5: The Price Of Bitcoin

Using an online modulo calculator, I finished off the messages:

Message 1: The Secret To Winning Eurovision Is Excellent Hair

Message 2: Everyone Deserves A Hippopotamus When Theyre Sad

Message 3: Can You Please Help Oliver Find The Flux Capacitor

Message 4: The Most Important Person In The World Is Me Myself

Message 5: The Price Of Bitcoin Is Too Damn High Given The Data

[getschwiftysecurity]

Module 6: Safer

Suppose we are thrust into a war with a superpower such as Russia. List what sorts of computer and internet related attacks might we suffer?

Espionage using mobile devices and computers so that they can obtain sensitive information about the opposing side.

Denial of Service attacks can be used to prevent networks from working and effectively cut the enemy’s form of communication with themselves.

Resource grids such as water dams and electricity power stations could be hacked into and shut down to prevent the enemy from having any power to use their devices.

False advertising and propaganda could be used to sway the opinions of the public. This can be in the form of social media posts, online news websites and videos. This can cause chaos and therefore distract the enemy from their original goals.

Compromised war machines could be a threat if they are hacked into by the opposite side. This could mean that they would be able to turn your weaponry against you.

Hacking government computers to obtain crucial, top secret information that can change the tide of the war.

You have been asked to consider the main threats we face in the cyber domain of war, and to produce 10 recommendations for actions to be taken. State and justify your top ten recommendations in decreasing order of importance. 

Developing data corrupting viruses to be used as an offensive to clear the enemies information and a defence for if anybody tries to access a system without the proper authorisation.

Compartmentalise knowledge of intelligence

Background checks on programmers

Keeping the identities of government officials anonymous to ensure that they cannot be singled out and targeted.

Create backdoors in other nation’s software or hardware to exploit in case of war

Staying offline to completely prevent cyberattack

Create nationwide intranet

Prepare financial resources for cyberwar

Use locally sourced applications 

[getschwiftysecurity]

Something Awesome: Update 3

I completed a majority of my report today, it currently has 2400 words which I think might be too long considering I wanted to add a section involving Uber’s security threats as well. So shall see what my tutor says tomorrow.

[getschwiftysecurity]

Module 6: Security Everywhere - HTTPS

HTTPS, Hypertext Transfer Protocol Secure, is a secure method of communication between a user and the website. It ensures that personal and credit card information as well as passwords are not stolen. 

Most days, the place that we can see this is through the lock icon in the address bar of your web browser. This means that your sensitive information is safeguarded and prevents tampering.

HTTPS prevents intruders from being able to passively listen to communications between your websites and your users. Every unprotected HTTP request can potentially reveal information about the behaviours and identities of your users.

HTTPS helps prevent intruders from tampering with the communications between your websites and your users’ browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages.

[getschwiftysecurity]

Module 5: Security Everywhere - eCommerce Security Threats

Most people usually are very oblivious with their card details especially when shopping online. It is possible for stores to take advantage of this and illegally acquire information from their customers.

Financial Fraud

Spam

Phishing

Denial of Service

Some solutions to ensure that you can not be taken advantage of is by:

Using HTTPS

Antivirus Software

Firewalls

SSL Certificates

[getschwiftysecurity]

Module 5: Week 5 Lectures and Reflection

Due to mid semester exams, I decided not to attend this week’s lectures but instead focused on studying because there were a few areas of content in which I was not too confident with. This strategy actually really helped out.

[getschwiftysecurity]

Something Awesome: Update 2

I have my survey has now been completed by a substantial amount of people. One of the questions I asked is what is a website or application that most people use on a weekly basis and the most common was Uber. I have decided to use Uber as one of my main case studies to see really how secure their online payments are. The report is starting as well, I will be talking about:

Types of eCommerce

Security of Transactions

Security Threats to eCommerce

Implementing Security Threats to eCommerce

[getschwiftysecurity]

Module 5: Broken Authentication

Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys or session tokens, or to exploit other implementation flaws to assume other user’ identities temporarily or permanently.

What is Broken Authentication?

Broken authentication allows attackers to bypass the authentication methods used by a web application to take over accounts and privileges from the user.

Authentication credentials not protected

Easily guessed login credentials

Session ID in URL

Session do not timeout or get invalidated after logout

Passwords and Session IDs not send over unencrypted connections 

Password Management

Password Length: minimum 8 characters makes it difficult to brute force

Password Complexity: mix of alphanumeric characters

Password Authentication: error responses for incorrect passwords

Session Management

User information should be encrypted

Session ID should not be exposed

Session ID should timeout

[getschwiftysecurity]

Module 5: Dropping the Bomb

Most important assets that required protecting?

The nuclear missile is an important asset that needs protecting because it is extremely dangerous. The toxic fuel is flammable and can cause people to die if they are in contact with it. 

Access to the nuclear missile should be very strict and only people with proper training and clearance should be allowed to access the missile. It would be very irresponsible to let anyone near it.

State your reasoning and recommended approach for ensuring that the asset is adequately protected.

The nuclear missile should undergo consistent testing to ensure that the physical body is not under any damage and if it is, the necessary repairs can be fixed. This include parts like the rubber linings, valves and platform. All the necessary tools and equipment that is being used to fix the missile should be close by. The parts that were put onto the missile should have been a lot stronger as well since a wrench was able to rip a hole from just being dropped on it.

All staff on site should be properly vetted and training to interact or be near the missile with known safety procedure to follow if anything did go wrong. Everything in the site should also be heavily regulated and mapped out, this means that each person will have a list of things to do and must strictly follow it. It would also be a good idea to hire more staff to ensure that workers are not tired and will be less likely to take it easy.