#security engineering

[shacklesburst]

Scammers deepfake CEO’s voice to talk underling into $243,000 transfer

The voice had the hint of a German accent and the same “melody” that an employee recognized in his boss’s voice.

@ms-demeanor more great things are coming :(

[security-engineering]

Have you ever considered how no one enters an elevator when police are inside and are storming the building? 

This is because they use features built into most elevators.

If you hold down two buttons, the floor you want and close doors, the elevator will skip all other floors and go straight to your floor. Just hold it down until the doors actually close. I have personally used this feature when I was running late to a movie and I had to go up 5 floors. The elevator I was on even travelled faster than usual, though that might be because it didn't not have to consider stopping.

Sometimes this won’t work because a master key is required, which can either be found with the building manager or a firefighter, if you can convince them to lend you a hand. Sometimes they can be found online, but always check if you can legally possess them before you buy.

There are other features you can use.

Cancelling a floor number depends on the lift’s model. Some allow for a double click of the floor number, some require 5 repeated button presses, and others want you to hold the open door button while double clicking the floor number. Just don’t blame me if other users click their floor number when they see it turn off. 

But if elevators have all their features, why don’t people use and abuse them? 

I think this is mostly because people don’t know about them. Which is just security by obscurity. 

There may also be social pressures to not mess with other’s people’s use of the technology. I don’t think knowledgable users want to be left in an enclosed space with one or more someones that are frustrated that you skipped their floor. It won’t stop someone what wants to use it on their own though. 

It would seem that having these features available to police is more important than having some people that abuse the features. 

My concern is if a person of interest uses this feature to avoid police encounters. I think this is avoided by how police approach a building they want to storm. Exits should be covered, so even if the individual does avoid police on the different lift, they should not succeed avoiding a confrontation. 

So it seems that even if there is a risk of misuse, it has a low impact on the standard operation and use of the lift, and if the feature was misused by a police person of interest, that person should still encounter the police, meaning the risk of loosing them is low. It’s also not a high impact risk for the building owner in most cases.

https://www.wikihow.com/Make-an-Elevator-an-Express-Elevator

[nem0c]

was this written from personal experience?

[security-engineering]

Watching Star Trek Discovery and I gotta say their pseudo digital security is worse than their pseudo science. But not bad enough to turn me off the series.

[security-engineering]

Harry Houdini Death Protocol

Our case study this week was covering Houdini’s mission to expose fraud “mediums”, spiritualists that were believed to be able to contact the spiritual realm. His’ final attempt was to create a protocol with his wife, such that when he died, she would attempt to contact him via mediums, and she would know if a medium was a fake or not. 

As a tutorial, we were not told what protocol Houdini used, however we were told that it failed. We were tasked with determining characteristics the protocol must have and then trying to come up with a protocol ourselves. 

Our boundaries were:

He can hear her

She can't hear him

Medium is method of communication

As a team we came up with the following features that the perfect protocol must have:

Integrity of the message

Authentication that Houdini sent it 

unlimited/very large test cases

different mediums must not be able to share it, such that it is not compromised

encryption key or code 

My group came up with the following:

Before Death, prepare a list of pairs of words that are not normally associated with each other, for example “apple” and “saxophone” and memorise them (or write them where no one will find it)

After death at a medium, his wife would go away from the medium such that she cannot be heard and say a word. 

The medium is then to communicate this word and the code word associated with it. If the medium says the code word, then it is known that Harry Houdini is actually communicating via the medium.

It did succumb to a few issues, such that once a pair was guessed, it could not be reused, so that limited the number of mediums that could be tested. And long lists create complexity, making it more difficult for people to use and remember.

This method can work since others can verify that the method is sound, but those that verify it do not need to know the code word pairs that the two have come up with. Only the code needs to be kept secret.

[security-engineering]

Whaaahoooo - got it all right and pretty quick too. 

[shacklesburst]

Often when someone connects to your HTTPS site, their browser will first go to the regular (unsecured) HTTP endpoint before being redirected. But if the site is on the HSTS pre-load list, their browser will know to go straight to HTTPS. Microsoft shipped an update adding *.gov.uk to that pre-load list, but unfortunately not all .gov.uk sites support HTTPS yet, which made them unreachable to the people who got that update. Microsoft pushed another update to fix the issue.

[source]

The real fix, of course, would be for all .gov.uk sites to support HTTPS.