Security Engineering

by UNSW Comp6441 Student

[kxy-6441]

Job Application

Dear Gitzon team,

I am writing to apply for your security engineering position. I have outlined and addressed the criteria of the position requires: 

Analysis

Time Management

Skills

Community and Professionalism

Something Awesome Project

Should you have any further question, please do not hesitate to contact me. 

Best Regards, Kai.

[kxy-6441]

Analysis

Throughout the term I have constantly been developing and demonstrating the ability to analyse. 

I have also shown that I have decent analytical skill:

Deepwater Horizon Disaster [link]

Doors on Plane [link]

Dropping the Bomb [link]

I have shown that I am capable of applying learnt concept to each activities I encountered during this term as listed below:

Harry Houdini: Message Encryption [link]

Doors on planes: Centralization of risk [link]

Electricity Network: Threat Modelling [link]

Stargate Ghost Problem: Knowledge Based Authentication [link]

[kxy-6441]

Time Management

Although I have a packed timetable this semester and illness disrupted my some of my timestamp, I did manage to get most of the content on time which is by Monday every week. 

I have most of the post on time. Check out activities’ timestamp below:

Week 1 [link]

Week 2 [link]

Week 3 [link]

Week 4 [link]

Week 5 [link]

Week 6 [link]

Week 7 [link]

Week 8 [link]

I have a plan whenever I fall behind:

Catch up plan [link]

[kxy-6441]

Community and Professionalism

In-tute participation

I work in a group for every tutorial I attend. I am not much of a speaker, so instead of sharing my ideas in every group discussion, I do sometimes be a good listener, so when my group speak their idea out, what I usually do is tell them what I think about their idea. I gave others to present most of the time as my part to a community.

Blog Posting

I have been posting things that I’ve learn across the term and post it to my blog so my knowledge is available to the public. 

OWASP Top Vulnerabilities [link]

Passwords [link]

Reconnaissance [link]

Backdoor Trojan Triada [link]

[kxy-6441]

Skills

I have developed a skill set as a security engineer by participating both inside and outside course content activities.

Reconnaissance

I have read the book “Hacking the hackers” and made a blog post to share about this topic. [link]

As part of the information gathering, I have restored a shredded newspaper. [link]

Threat Modelling [link]

Penetration

Exploitation

Web Exploitation [link] [link] [link]

Buffer Overflow [link]

Cryptography

CTF challenges [link] [link]

Lockpicking [link]

[kxy-6441]

Something Awesome - Capture The Flags

I figured my Something Awesome Project would not be appropriate to record a video to show my progression, so I have documented it on my GitHub [link] and on Tumblr [link]

As outlined in my Something Awesome Proposal  I have to spend 5 hours weekly and solve 3-5 CTF Challenges per week, read at least one chapter of the book I set and summarize what I have learnt every week.  

Here is my actual timeline for this project:

Week 2

Proposal was set [link]

Did a brief CTF [link]

Week 3

CTF are harder that I initially expected [link]

Did some reading on the book and posted it [link]

Week 4

Continued to solve CTF, solved 3 of it. [link]

Week 5

Started a new series of CTF by picoCTF [link]

Solved 18 Warmup Challenges 

Week 6

Things are getting harder [link]

Solved 6 of CTF Challenges

Week 7

Solved all of the CTF challenges provided in the course for COMP6841 Students [link]

Week 8

Solved 1 challenges from plsdonthaq.me [link]

Summary of the entire Something Awesome Project [link]

As shown above, I only have successfully complected parts of the requirement I set for myself in order to get a High Distinction, averaging over 4 challenges per week. Overall I would give myself a Credit.

[kxy-6441]

Something Awesome CTF Week 8

Update

I was introduced to a new CTF challenge website plsdonthaq.me. I managed to capture 1 flag and failed to capture the other web exploitation challenge. However I will write them all into my GitHub although some of it are not completed. 

[kxy-6441]

Stargate Ghost Problem

This week’s case study is similar to Houdini Case Study. We as Minister M can communicate with Alien A who claimed it can communicate with a ghost friend X

We want to be able to authenticate the present of the ghost

We want to know whether the alien can be trusted.

Assuming the alien doesn’t have any kind of advanced technology that can extract information, and torturing doesn’t occur, in order to authenticate the present of the ghost there has to be some sort of shared knowledge between Minister and Ghost that is not known to A (Knowledge Base Authentication). This could be any memories they shared, any common language such as Morse code that is not known to the alien. 

If they shared the same knowledge that is not known to the alien, they could just communicate through the alien, alien would have no idea of what they are communicating that’s great. However there is no way of telling what the aliens are capable of, they might speak English or they might happen to know Morse code...

If the ghost happens to be able to hear us and see us (One way communication), one way of authenticating its present is we ask some random question that can verify its present in a place that the alien could not see or hear us and the ghost answers the questions by telling the alien what to say. Again, there is no guarantee that the alien doesn’t have ability to telepathy. 

In the cryptography world, we have something called digital signature. Digital signature ensure that the message is not tampered since the moment it was sent. This idea can be used to communicate with the ghost without worrying that the alien could tamper with the messages.

Moving on to the next question, we want to know whether the alien can be trusted. There are really no way of telling anyone can be trusted. I am stuck with this question in this moment, hopefully someday someone would find a way.

[kxy-6441]

Something Awesome CTF Week 7

Updates

For this week CTF Challenges, since I am going nowhere with the picoCTF which I started a few weeks ago. I wanted to try something special which is Buffer Overflow Challenges that secedu published for COMP6841 Student. Although I am not a COMP6841 Student, I wanted to attempt it as CTF Challenges for my Something Awesome Project. I will have it included to my GitHub. 

Turns out it took me quite awhile to solve all of them, I need to study a lot of things such as how C memory works. Other than that I’d say it was a very fun challenge but luckily I am not enrolled in COMP6841 because that would be hard for me to work in a exam environment.

[kxy-6441]

Email Phishing

This week’s activity gives us a social engineering simulation. We are required to  get facebook password and to get someone send us a payment.

So what I did is learn everything I can from the puppy love page. These include name, email. There is an instagram link to Sarah’s instagram from her instagram we can learn her baby’s name, her husband, etc.

Then I started writing her a email as David, her partner to get the login password of the facebook page.

I got the first flag!!!!

Next, we need to get someone to send us a payment. I tried the same way to get Sarah send me the payment, but she replied that she don’t handle all sort of payment. 

So I started another message to David.

I noticed there is a unexpected behavior here: I send a message to Sarah, she says she doesn’t handle payment. I did the same thing to David as Sarah. He say the same thing too but He suggest me to talk to David which is him and In the end this is what bothers me.

Kind Regards, Sarah

I did the same thing many times with some minor changes to the message. And I receive the same thing everytime. I think the activity is broken I will try that again at some later date.

[kxy-6441]

Catch up plan

My body has failed me. I was sick because of the extreme weather of Sydney and I was unable to attend to tutorial which I really would like to. I am taking a rest from everything but I will catch everything up once I feel better. I have a catch up plan as follow:

Listen to the lectures

Do pre-reading for this week’s tutorial which I missed and read my classmate’s note which I am sure they will write one.

Attempt the weekly activities.

Continue my Something Awesome Project

[kxy-6441]

Something Awesome CTF Week 6 Update

As I progress further things are getting more and more harder so I only solved 6 CTF challenges this week and I expect it will be harder next week. So solving 3 or 4 CTF challenges is what I expect for next week. 

Other than that, I have also started writing some markdown for each CTF challenges that worth mentioning and I find interesting also to show that I am learning things from each challenge as I solve. Hopefully I can get my account activated and I can post it on my GitHub page by the end of due date.

[kxy-6441]

Threat Modelling - Electricity Transmission Network Attack

Upon consideration, the biggest threat of a high voltage electricity transmission network is its employees. Employees are the one who work everyday in this infrastructure, they must be familiar with the infrastructure in some degree and how to misconduct. Every second they can choose to misbehave and cause damage to the network. Furthermore they are susceptible to social engineering attack and are difficult to prevent.

Defense 

Prevent single point of failure 

Have some equipment like resistor to prevent power over surge.

So that even if the power plant blows up, the network is still there

Prevent Insider Attack

Educate workers

Further prevent unauthorized access

Implement a fail-safe procedure/system

Random Thought

I would sabotage their finance by creating a competitor company then undercharge the customer so that all of the customer would use my electricity. They would eventually be kicked out by the market and I would have monopoly over the market.

[kxy-6441]

Something Awesome CTF Week 5 Update

I released CTF challenges that I did last week were JS-heavy and I was hoping to do something more general and broad, so I started a series of challenges provided by picoCTF to get myself started. It introduces many tools like John the Ripper which is used to crack a Unix system hash password and Netcat which is used to read from and write to network connections using TCP and UDP. It was fun and interesting but I think it is probably known to most of you. 

Each challenge looks something like this

Which I find it interesting because I have to do some research myself to understand what it means and how can I exploit it. Which lead me into a blog/forum like this and solved it eventually. 

Cracking Unix Password Hashes with John the Ripper (JTR)

These warm up challenges will get me cracking some real CTF in the future weeks.

[kxy-6441]

Something Awesome CTF Week 4 Update

I went on and try the challenge I could not solve last week. First I inspect the source code on all pages I immediately found a vulnerability:

Flag 1

The word “Title” was not in a <p></p> or something like that, then I went on and try to inject some HTML code.

And It does not work after I saved it. But when I navigate into the homepage.

It pop this up as an alert and my HTML code worked on homepage but not in the page.

Flag 2

I noticed the page i newly created was on page 12 but the default page was on page 1 and 2. So, I went through page 3 to 10 using the URL and this happened

Then I went to the edit page of page 7 and the flag appeared!!

Flag 3

I was given a hint to try SQL injection and then i googled it. I learned that if the URL behave unexpectedly if you append a colon to the URL, it is susceptible to SQL injection. So I tried this on every page.   

And I worked!!

Flag 4

I still have no luck solving this flag I will try it again in a later date.

[kxy-6441]

OWASP Top 2 Vulnerabilities

1. Injection

In an injection attack, an attacker supplies malicious input to an application. This malicious input is then interpreted as a execute command or query, therefore alternating the execution of the program.

Most of the injection attack allow attackers to spoof identity, temper with existing data and hence leading to data thief, data loss, loss of data integrity, denial of service as well as full system compromise. 

What makes injection vulnerabilities particularly scary is that injection attacks are a very well known vulnerability class, there are many freely available tools and cheat sheets that allow even inexperienced attackers to abuse these vulnerabilities.

Most Common Injection Attack - SQL Injection (SQLi)

SQL (Structured Query Language) is widely used to communicate with a database. It is a standard language for storing, manipulating and retrieving data in databases. However, most of the webpages work with at least one database at the back. When a user type some input into the page, it is going to send a request down to the database whether it is to add, alter or validate input. 

SQLi occurs when the user input is not validated, filtered, or sanitized. Hence attackers can supply malicious query to the page and trick the backend database to alter or return the data stored in the database.

Form submissions aren’t the only input that come from browsers, SQLi can also happen in URL. One way to know the URL is susceptible to SQLi is inserting ‘ or %27 just after the parameters’ number and press enter. If a SQL Error appears there is some probability that the website is injectable.

Preventing injection requires keeping data separate from commands and queries. All forms of input must be sanitized, not only web form inputs such as login forms to remove potential malicious code elements such as single quotes.

2. Broken Authentication

Many website require users to login to access their accounts, make a purchase or posting. Most of it are done by providing a username/email and password. With this info, a site will assign and send each logged in visitor a unique session ID that serves as a key to the user’s identity. Broken Authentication is a type of weaknesses that allow an attacker to either capture or bypass the authentication methods that are used by a web application, allowing attacker to impersonate the target.

Exploitation

When a user sign in to a website, the site uses a proprietary algorithm to generate a unique session ID used as a key to authenticate the user’s identity for the remainder of their login session. The given session ID has to be sent back and forth between a client and the server. If that information is not encrypted properly, there is a fair chance that an attacker would intercept the session ID and impersonate the user, this method is also known as Man in the Middle Attack.

A attacker would also use automated attacks such as credential stuffing, the use of lists of known passwords, to brute-force into the right combination of username and password to gain access to a user’s account. If an application does not implement automated threat or credential stuffing protections, the application can be used as a password oracle to determine if the credentials are valid.

Multifactor Authentication

Multifactor Authentication is designed to prevent broken authentication. Instead of only providing username and password, an application uses machine learning to identify suspicious activities. If a login attempt is classified as suspicious, multi factor authentication such as SMS verification, Email verification or any other authentication method is required to proceed.

[kxy-6441]

Case Study Week 4

In this week, there is no pre-readings for us to prepare however in this week we are given a few question to answer under a exam condition.

Summary

We are the head of security of Google. Google are having a new secret lab. What are the main things needing to be protected? and what Key features does this secret lab needs to have?

Main things need to be protected:

Here are the things I have considered

Access of the building

No one random could enter our lab with no authority.

The hardware of the system

This includes our server farm, network sever, USB ports.

Network / Data

Our network should be secure and not vulnerable to all kinds of network attack.

Lab Equipment

Such as computer, tech, key cards, etc.

Key Features

Multi Factor Authentication Door

Requires biometric to enter and a keycard to enter a certain room / lab. Therefore stealing someone’s keycard would not have clearance to enter the room.

Multi level access 

This prevents a janitor from entering a top secret lab. Every worker can only access the door they have clearance to.

Lockdown System

In a case of attacks, the building should not allow someone to easily exit.

Safety Protocol are Easy to Follow