#module7

[getschwiftysecurity]

Module 7: Security Everywhere - UNSW Campus Security

This week, me and my friends decided it would be a good idea to see if we could ‘break into’ a building at UNSW to study up for our assignments. 

Now Hilmer Building is a building that closes at 6pm, following this the building’s doors are all locked and you can only enter if you are a Materials Science student with the ID card access - which none of us actually were.

So we waited outside until someone left. At 6:08pm, someone was leaving the building so we walked in as they left and headed into the building. Now there are study spaces on level one that do not require any further access but we decided we wanted to go to the higher levels.

So once again, we waited for someone to come downstairs and open the door so that we could sneak up. This took around an hour of waiting before someone came down which allowed us in. 

We were not trying to hide or anything from the security guards but just wanted to see how long it’d take before they would kick us out. It was not until 10:30pm until a security guard asked out to leave.

But even then he didn’t escort us out, just simply asked us to leave and left us. If anything we could’ve packed up and just changed locations.

UNSW Campus Security is not strong enough. Considering that anyone else could’ve made their way into the building and stolen things from laboratories or offices. 

[cse6441-blog]

Trump da Chump

[spcomp6441blog]

Module 7: Lecture 2 Notes

Presentation 1: Bug Bounties

 Where to start Hunting?

Crowd-sourced bug bounty website

Bug crowd

Open to public

Tips to get started

Learn web application principles

Look for wider scope and less competition

Increase number of bugs

Less likelihood of dupes

Stay in scope

Look for assets which have changed recently

Look for publicly disclosed reports

Start at comfortable difficulty

Work towards your skills

Teamwork

 Process of Bug Bounty

Find a suitable program

Review the scope

Find the target via recon

Hit target and find vulnerability

Write a report

Submit the report to the company

 Training resources

Hacker101

Sql injections

Password management

Fuzzing

Eg of fuzzing software - afl

Technique used to look for bugs

Have program and repeatedly feed it input and observe if any bugs are produced

Different types of fuzzers:

Multination-based vs generation based

Aware of input size

The Heartbleed bug

 Presentation 2: Pen Testing

 Pen Testing

Detect vulnerabilities and expose them

Is an authorised simulated cyberattack on a computer system to evaluate risks

Repercussions of an attack on your security system

Why it is important

It allows us to discover vulnerabilities in our system before attackers do

It can test your security controls (firewalls, ips, ids)

Sometimes thinking like an attacker is the best way

Practical uses of pen testing

Gives coverage to companies without getting hacked

Get ahead of the curve

Stages of pen testing

Recon - intelligence is gathered

Planning

Exploitation

Post exploitation

Pen testing tools

Metasploit

Gobuster

Burb

Wireshark - analysing network connections

Nnmap

Kali - package has tools like info gatherinr, reverse engineering, reporting tools, password attacks, maintaining access, exploitation tools, forensics tools, wireless attacks

Burpsuite - most popular software used to test sofware

CTF Websites

Pwnable.com can be used to practise

Read up about the NSW LPI and think about what assets they have and what risks arise from them having been privatised  eg https://en.wikipedia.org/wiki/New_South_Wales_Land_and_Property_Informat

 Shared secret - when the person that needs to be authenticated and the person is authenticated have a secret between them. This can be used to authenticate. Eg. A certain code word

Problem with authentication - if computer has been preloaded with shared secrets and these secrets have been used once, then that's a problem

How can you detect and protect against the man in the middle?

Web of trust (PgP) and PKI. (check out how PGP does authentication using web of trust)

PKI

Links your public key to usually a web domain. It's certified to something that everyone trusts

SSL/TLS

Read Bruce Schneir's paper

Certificate authority ties the key to a domain name. it doesn't tie the key to anyone in the world

 Look up how the TLS handshake works

Look up a simple rsa version

[m7-christianlerche]

Baby steps - 1st post 6th of Feb

Well, here goes my first intern blog post of module 7 in Global Nutrition and Health, specialization of public health & health policies.  Buckle up kids because this is going to be a wild ride YEEHAW! *Ahem-beseriouschristian!-Cough*

After carrying your 31kg of luggage 1 km through rain I bet you would look terrific as well.

I’ve decided to start doing this post now, sooner rather than later, because it’s been crazy to be honest these last three days, it’s feels like a lifetime ago since I landed. So, better write while the memory is still fresh. I arrived Tuesday the 31st of January by plane. Travelling was quite easy, you basically click the country you’ve gotten an internship into momondo.com and BAM you buy the cheapest route there, one way, because, honestly, it’s eight weeks, worry about getting home later, you’ll need money for food (don’t do this at home kids- plan better!). This ended up with me paying more for the return ticket, because, buying a return ticket along your ticket to the country in question is cheaper. Whoops. Also, here are some consequences of buying without thoroughly checking your ticket:  you don’t end up in the airport of Reykjavik, you happen to land at Klaflavik, 45min bus ride away from the capitol of Iceland. Which, at first puts you into a state of panic because you have no idea where Klaflavik is and if you’re even on the right coast. Later (around five minutes) I found out there are busses to Reykjavik and I am on the correct coast. Alright, no biggie. You know you’re not travelling unless you’re subject to a mild form of anxiety. I do feel the display at the airport in CPH gave the wrong impression though....

“The destination is a lie....”

Internship lesson #1: Plan your start and exit days, before you start your internship.  

The bus are my main means of transportation is the public transport system, which is very reminiscent of DK. Except our busses don’t wait for anything. Here you “can” call upon other bus to wait for you if the current bus you are in is behind schedule. “Hey chief, I need bus 5 to get to Nordica, could you let them know?” – “sure thing chief” And then you get off, and WHAM it’s actually waiting for your student butt to get in.

The view from the busses are as gorgeous as they look - when there’s daylight

I got settled in the outskirts of town, Störhofdi, in a room not bigger than the one I have at my kollegium. Except I’m paying twice the amount I usually pay. Get your accommodation early guys, it’s only going to get more expensive as time progresses.

When I came to my designated spot of internship, the unit of nutritional research next to the “Landspitali” - the hospital of Reykjavik, close to the university of Iceland, I was first introduced to the other interns who were also here as well as my host supervisor, Bryndis. 

From left to right: Bryndis Eva Birgirsdottir (host supervisor), Me (intern in third semester), Joanna (intern for bachelor thesis) & Debrah (Ph.D student) having a icelandic meal before getting into the thick of it. The amount of information I got from then is blurry at best. I became quickly aware that now I am no longer an aspiring student trying to get his bachelor, now I am a functioning adult with knowledge that enables me to get involved with governmental changes to the school meals, researching sources to improve Icelandic shopping habits to improve population health, and… Darn, a lot of other stuff. I am basically working full time now. And it’s awesome. Busy, but awesome.  

Suddenly everything shifts into a different focus. People here are fighting real issues in real time. It’s no longer a subject where you gather around the coffee table and discuss the different problems in the country, now you’re trying as hard as possible to improve the system. Now you’re no longer figuring out how habits develop or how to implement new (fictional) policies into a country. You are doing stuff that matters. Right now, real time.  

The list of projects is quite huge, some are time sensitive, others are ongoing projects that will be done “when it’s done”.  As of right now the list is as follows:

1.      Improving school meals in Kindergartens of Reykjavik. Cooperation with the department of Education and Reykjavik municipality.  (INSERT Picture here)

2.      Helping with presenting of the “Bachelor of Nutrition”  of the university of Iceland, with the possibility to get a masters afterward in either clinical-, public health-, or sports nutrition. To be done on Friday the 3rd.  This I have already  completed - I did the word-cloud you can see in the picture below and talked about how it is to study nutrition and the possibility to go abroad.

3.      On-going allergy project spearheaded by the head of unit to treat or improve allergy treatments of patients with light allergic reactions.

4.      Meeting with a “Kronan”(a nationwide grocery chain where I also purchase my day-to-day needs) representative to make suggestions to improve consumers shopping habits.

5.      Creating a FFQ (food frequency questionnaire), calculating the nutritional amount onto excel.

6.      Mapping governmental action status for health. Are their policies transparent etc.

  Optional stuff:

1.      Spend a day with health practitioners working within the national hospital right next to UNR.

2.      Join guest lecture on food culture on the 7t of February.

In this writing moment I am working toward making suggestions for the “Kronan” representative who is coming in tomorrow. 

More information will comes as time passes!

[izzyrachel17]

To finally rebuilding...

[diginnovations]

Cybersecurity made fun . .

The NOVA cybersecurity lab is an interactive beginner friendly way of understanding concepts of cyber attacks on a website. The lab helps users understand how social media platforms (or any website with several users) protects its servers and data. For myself personally I had played for " Einstagram " , the lab has different levels of security that help the user learn to purchase anti-virus software and other ways to protect from data breech. The more coins you accumulate the better your chances are of surviving attacks. For example in one of the games you are required to learn how to code as shown in the image above. Each command will help move your robot to the proper place, this is to help teach us how coding helps in screening firmware and blocking any attacks through the coding of your site. Another example of a lab identifying phishing in emails and calls. Often times emails will have give aways like the email address they are sending to, the name having been misspelled or clear motive to gain personal or financial information. Often times users are susceptible to Cyber attacks like these because they may look identical to a legitimate person/corporation.

[mishallejogezaieid100]

TUT Week #7

During the password cracking challenge, I felt it was a way for me to actually put into practice what we learnt about malware and password security. Inputing the number of characters and letting the system do its thing to crack a simple password was surprising. It is weird how easy this has become today. It made me realize how unique passwords are one of the keys to keeping your accounts safe. While completing the social engineering challenge, I realized how spotting fake websites online can be very tricky, but not impossible. I was presented with a google login screen during this challenge and when put side by side with the real thing, it was very easy to spot difference but would be hard otherwise. One primary giveaway however was the url being used for the fake website. It was very evidently shady, which helped me connect back to the staying secure aspect of the cybersecurity topic discussed in module 7. Lastly, while listening to the scam call, I could connect back to the topic of cyberstalking as these scammers slyly try to gather information like ones name, address and banking information that can then be used for financial scams and stalking or fraud.

[lilibevs]

Module 7

Process of Writing

This module introduces the Process of Writing, the definitions, parts and types of writing.

Writing is an act or process of one who writes, such as the act or art of forming visible letters or characters specifically handwriting sense, the act or practice of literary or musical composition.

A writing system is a method of visually representing verbal communication, based on a script and a set of rules regulating its use. While both writing and speech are useful in conveying messages, writing differs in also being a reliable form of information storage and transfer.

Prewriting is the first stage of the writing process, typically followed by drafting, revision, editing and publishing.

Drafting, also spelled draughting, also called engineering drawing, graphical representation of structures, machines, and their component parts that communicates the engineering intent of a technical design to the craftsman or worker who makes the product.