Sec Space @secspace-blog - Tumblr Blog

Week 3 Plan

I wish I had more time then I wouldn’t need to be doing things on the train. But I can also think about it as with my great time management skills I make use of my spare time on the bus and train where I would normally just browse the internet to do work. The start of this week has been hectic but I was able to stick to plan so far.

Tuesday - Work & Interview

Reply CompClub emails

Send out Winter School promo

Wednesday - Work

Catch up on 2041 lecture

Catch up on 6441 lecture

Catch up on 2511 lecture

2041 Lab

Case study preparation

Thursday

Finish off case study preparation

Remaining lectures

Work on assignment

2511 lecture

Friday

2041 lecture

2041 lab

2511 lab

6441 homework

Saturday

Plan for Ideation Workshop

Work on assignment

Watch remaining lectures

Finish labs

Sunday

Work on assignment

Watch remaining lectures

Finish labs

Something Awesome Proposal

My something awesome will be completing CTF challenges and then creating my own to be displayed on a website. These challenges are aimed at high school level so the CTF can be used for a high school security workshop.

Credit Level

Consistent weekly CTF challenges - at least 3 a week

Develop at least 2 challenges a week

Consistent blogging of my progress

Distinction Level

Consistent weekly CTF challenges - at least 3 a week

Develop at least 3 challenges a week

Consistent blogging of my progress

Developed a basic platform for students to log in and complete challenges

High Distinction Level

Aesthetic platform with HTML, CSS and Javascript

Leaderboard feature

Solutions for each challenge

Weekly Tasks

All the tasks for this week was completed on time!

My favourite this week is of course the weekly cryto as well as the warm up. The warm up was fairly easy if you think about how its strange that every word is the same length and then you see that you need those numbers together and so forth.

Type I and II errors were really interesting too, this is what I learnt from:

Credits to Khan Academy for such a clear explanation.

I really like the shredding analysis too!

All activities were completed on time this week!!

Mid/Pre End of Week Check In

Everything was going well until Thursday when Jeremy @supersecure and I had to work on CompClub Rural SCDG which took up a lot more time than I expected. This meant I had to shuffle everything back :(

Security Everywhere #3

This is something that is obvious if you think about it but we still do it anyways. We spend so much time on public transport that we do a lot of work or do the little things we have to deal with. I’m particularly guilty of this, I always do my homework, reply emails, sort out payments etc on the train to reduce time.

The other day I wanted to see how easy it was for me to get some information about someone, I peeked over the shoulder of someone and she was making a medical appointment. Didn’t want to get myself into trouble but I can only imagine how much information I can find out about her. Not only that she pulled out her credit card to complete a payment. Again, of course I didn’t attempt to get that number but I feel like I could pretty easily and discretely. Besides the creepy person peeking over your shoulders, there are also cameras that can capture your password.

I was watching an episode of Futurama, the protagonist was typing his password at the bank. Someone wanted to get a hold of his 60 million fortune and so gets into the security camera and records down the password.

Knowing this I will probably never complete card payments on the train and be a little more discrete when I am filling out any forms. This can include dimming my screen, avoiding to have to do it in a public area etc.

Case Study #2

This case study was quite strange, I didn’t really understand the premise of this activity until the actual tutorial. But as a team we made a really good plan I think.

The first thing we need to be aware of is that the protocol can’t be too complicated so then Bess will be confused and forget or be tempted to write it down. This then is a security vulnerability because people can try to find any written evidence or written messages.

The next thing is to reduce single points of failure, we don’t want there to just be one part of the protocol then they might be able to guess but the probability is highly reduced if you increase it to 2 especially if order matters. We want to try to increase security by increasing our lines of defence.

Our final idea is to get the medium to say the location of their first date, then lock themselves in a cupboard for 10 seconds and then take off their shoe.

The problem with just having verbal protocols will lead to Bess reacting if it is correct giving it away and confirming it so to reinforce the defence, gotta use other protocol ideas that aren’t words.

After talking with the tutor who made really good points about after one medium gets through the security measures then everyone will know the protocol and this protocol is not unusable again - better know as replay attack.

Different people’s ideas were really interesting:

Telling Bess an item and a plain text string but she doesn’t know where the item is and how to find it. Houdini will tell the medium how to find the item which has a cipher which he needs to decode and match with the string Bess has

I think this idea is really good besides the complexity, fragility of the protocol such as the item being moved etc and possibility for replay

The medium needs to say a certain word + the current date + the name of the medium.

This is also pretty cool but doesn’t really prevent the replay such as if they hear the words they could eventually figure out that the pattern

Using a safe that Bess doesn’t know the passcode to and put an item inside, the medium has to say the item, blog about it and then crack open the safe to check

This can be a bit flawed as the box can be switched out for a known box with a known item inside

I think my main concern regarding this is the authentication part of CIA, how can you guarantee that no one will buy out Bess to say yes you are Houdini and mediums are real. Definitely a really interesting problem and worth investigating.

I was soo happy when i got it decently quick until I saw the average 😂

Dumpster Dive

This activity is actually super interesting considering we throw away confidential information everyday. Beyond the basics of being able to access his information, suburbs he frequent and food cravings, we can extrapolate a lot about this person and potentially exploit some of the information. Knowing the places he usually order items from, you can pretend to be someone from the company with his details and ask for money or passwords etc to get more information. His hobbies, food and drink preferences can be used for advertisers to target him. His information can be sold and used for fake identities especially when there is a photo of him.

Plan for Week 2

Monday

Plan for Wednesday Ideation workshop

Plan for COMP1521 class

Plan for Global COMP1521 class

2511 lab

Finish 2041 lab

Tuesday - Work

2041 lab

6441 Homework

Wednesday - VIVID Meeting

Catch up on 2041 lecture

Catch up on 6441 lecture

Catch up on 2511 lecture

Case study preparation

Thursday

Finish off case study preparation

Remaining lectures

2511 lecture

Work on SCDG grant proposal

Friday

2041 lecture

2041 lab

2511 lab

6441 homework

Start on assignment if possible

Saturday

Work on assignment

Watch remaining lectures

Finish labs

Sunday

Work on assignment

Watch remaining lectures

Finish labs

#week2plan

Security Everywhere #2

When I actively try to notice vulnerabilities, it usually happens because of trust and the exploitation of it. The bouldering gym I often go to doesn’t have lockers or if they do, people don’t use them. On top of that, phones are left around the benches while people are climbing. When I first went there, this idea was strange to me but my friend reassured me that it was normal and the climbing community is pretty trusting. Since then I’ve been at least 10 times and I’ve always had the mentality to trust the people there and I have yet to be proven wrong. However, this is obviously not safe even though there are staff there. This really does prove that insecurities arise from trust.

Time Management Reflection

This week was pretty good in terms of time management, been on top of everything which is what I hope since its only the first week. Also I finished all the challenge activities!! Not sure if I can do that every week but this week’s was fun (NSA crypto, crown jewels and how to burgle a house). Looking back at my plan for week 1, the Thursday deadline wasn’t really feasible for all those activities. It was a little ambitious considering I finish uni at 7 and got home at 8 but I did manage to do the case study and security lecture. The tasks I didn’t do shuffled into Friday where I did a little bit of work but majority of the tasks were completed on Saturday. I think for next week I’ll try not to jam so many activity into one day knowing that I will be tired and won’t be motivate and also have a spare day to catch up on activities that overflowed into the next day is super useful. Overall, proud of my time management this week!

#week1reflection

Deepwater Horizon Postclass Analysis

It was really interesting how different people has a different analysis of the situation like how others ranked each recommendation. The effects of the incident is obvious and we can all agree that it has a major impact especially on the environment but also the company. Our group came up with these recommendations regarding the incident.

1. Regular Testing & Maintenance - Testing is the precursor of everything, it is the crux of planning. Easily prevents other events from happening.

Ensuring negative pressure tests should be run

Cementing and casing design must be certified by a professional

Appropriate maintenance of security measures

2. Education/Training - There are 60 staff members working at a time, if they do not cooperate or have an understanding of how to act safely then the safety of the site and project can be compromised.

Industry Workshops

Simulations of emergency situations

Drills with staff

Building a culture of security -> rules are hard to enforce so need to motivate staff to act accordingly

3. Design Planning

Automation of EDS, BOP, security measures

Mechanical override for software/power failures

Reducing single points of failure

Make it easy for everyone to stay safe

4. Policymaking and Regulations with Penalties

Preventing people from taking shortcuts with audits

Issue violations & penalties to encourage companies to be more vigilant

Reduce possibility of corruption

5. Real-time Communication Systems

Monitoring data

Analyse trends

Predictive modelling/analysis to prevent potential accidents

Module 1 Lectures

Through this lecture I learnt about looking using the eyes of an attacker, detecting vulnerabilities and ways to exploit them. Often complexity makes things insecure because there are often things we miss or we don’t know the system well enough to know how to protect EVERY aspect of it.

Analysis:

How could we have known earlier that this would have happened

Where the people not motivated to take action because of other reasons?

Ineffective communication systems?

Where were all the failings in the system

Need to reach a decision with a clear reason (at the start)

Life Expectancy of Computer

Tech experts generally agree a computer should last anywhere between three to five years before needing to be replaced

I think the life expectancy of computer depends on how you use the computer, if it was used to for hardcore gaming or maybe video editing purposes then it’ll require higher specifications. When it’s too slow for its purpose, people usually opt to switch out their computer for something better or faster. This can include hardware, software or upgrade requirements. I remember we had a computer that lasted for 10 years before we got rid of it, it was so slow and made it useless to perform tasks.

https://smallbusiness.chron.com/life-span-average-pc-69823.html

#module1

Security Everywhere #1

Before the tute yesterday I was a bit skeptical about this activity and not sure why we’re doing it but I think Adam explained it pretty well and on second thoughts there are quite a few scenarios where it was insecure.

This wasn’t as recent but I remember when I lost my phone and tried to track it immediate but it was switched off. I mean that alone is a security risk if they manage to get into my phone to access phone numbers, saved passwords, full names, emails etc that can lead to the information being sold or misused especially bank details. If this does that happen, if they do get past all the security measures I tried to enforce then it would be a very very small scale version of the ANU data breach that occurred recently. If there are bad consequences for just my data I can’t imagine the scale that is 19 years of student records.

Got a bit sidetracked but I was meant to say the phone company I was with offered online chat service without needing to call up. I needed them to cancel my SIM card and send me a new one but the problem is the account is under my parent’s account but they were at work and I was desperate. So I used the online service they asked for my number, my name and my date of birth where I gave my dad’s with his permission of course and with that I was in. I blocked my card and ordered a new SIM card.

Looking back that only shows how easy it is to use that information to abuse it, I didn’t test the extent of which I can extend on that power but they might ask for address for further verification which also isn’t hard. This is quite common for families with parents who aren’t fluent with English, their child usually help them out and call up but that doesn’t stop anyone else from calling up and saying oh that’s not me but I’m his or her son or daughter. I have a feeling with that you can get a new phone with a sim plan sent to you which is a lot of money! This not only applies to phone company, this can be medical centres and ask for medical records.

Deepwater Horizon Preclass Analysis

Process and Equipment of Deepwater Drilling

Control is at the blowout preventer (BOP)

126 crew change shifts every 12 hours they changes

4 separate crews

Complex team

Difficult to access the subsurface

During hurricanes the BOP need to separate from the MLRP

Need to cut the pipe using the blind shear ram and block the pipe

Everything under the surface is done using remote controlled vehicles

Questionable Issues

Long string has one less degree of safety than the liner and tie-back method which is more costly

Lockdown sleeve - wasn’t installed at the stage of the accident

Negative pressure test - no standard procedure for the test

Results were not interpreted correctly

Conducted too soon after cementing

Issues Involved in the Accident

Cement job failed to seal off the producing reservoir, casing seal failed

Didn’t do the log, testing for the cement

Didn’t use 21 centralisers

Hydrocarbon inflow was not recognised and hydrocarbon entered the ris

Gas ignited on the rig, causing fire and loss of power

Fans were not designed to shut down automatically on gas detection

Set off alarms but needed someone to manually shut it down

BOP failed to seal the well

Emergency disconnect - button to shut it off

Automatic cut off

#module1 casestudy

Gotta thank @supersecure for taking lecture notes for me in the first week since I have work commitments.

Trending Blogs

Recently Viewed Blogs

Sec Space