#security everywhere

[security-engineering]

Have you ever considered how no one enters an elevator when police are inside and are storming the building? 

This is because they use features built into most elevators.

If you hold down two buttons, the floor you want and close doors, the elevator will skip all other floors and go straight to your floor. Just hold it down until the doors actually close. I have personally used this feature when I was running late to a movie and I had to go up 5 floors. The elevator I was on even travelled faster than usual, though that might be because it didn't not have to consider stopping.

Sometimes this won’t work because a master key is required, which can either be found with the building manager or a firefighter, if you can convince them to lend you a hand. Sometimes they can be found online, but always check if you can legally possess them before you buy.

There are other features you can use.

Cancelling a floor number depends on the lift’s model. Some allow for a double click of the floor number, some require 5 repeated button presses, and others want you to hold the open door button while double clicking the floor number. Just don’t blame me if other users click their floor number when they see it turn off. 

But if elevators have all their features, why don’t people use and abuse them? 

I think this is mostly because people don’t know about them. Which is just security by obscurity. 

There may also be social pressures to not mess with other’s people’s use of the technology. I don’t think knowledgable users want to be left in an enclosed space with one or more someones that are frustrated that you skipped their floor. It won’t stop someone what wants to use it on their own though. 

It would seem that having these features available to police is more important than having some people that abuse the features. 

My concern is if a person of interest uses this feature to avoid police encounters. I think this is avoided by how police approach a building they want to storm. Exits should be covered, so even if the individual does avoid police on the different lift, they should not succeed avoiding a confrontation. 

So it seems that even if there is a risk of misuse, it has a low impact on the standard operation and use of the lift, and if the feature was misused by a police person of interest, that person should still encounter the police, meaning the risk of loosing them is low. It’s also not a high impact risk for the building owner in most cases.

https://www.wikihow.com/Make-an-Elevator-an-Express-Elevator

[kelvindoescomp-blog]

Tay AI

Tay is a conversational AI released by microsoft on March 23rd 2016, and it was only active for 16 hours before it got taken offline by Microsoft due to politically incorrect messages. Since it was designed to build up its vocabulary from its conversations with the other users, the AI would pick the controversial vocabularies straight from its interaction uncensored. In the end, it made the vice president of Microsoft publicly apologized for its offensive tweets and messages on twitter and a “critical oversight for the possible abuse of software.”

 After reading about this incident, a really huge realization came to me-- no one knows how to proper protect their software, not even when you are a multi-billion top tier software company. The problem here has occurred so many times in different forms-- some malicious users discovered a way to compromise the software using the user inputs. Such is the case of buffer overflow, format string attack, and basically most of the attacks in the world use some variations of this approach; yet although it is such a common method, a multi-billion software company didn’t realize it can cause a huge problem; it only proves that as software engineers, or we should even just call ourselves coders since our engineered products break all the time, we really don’t know how to properly secure our software, and such an incident is also indicative of the prevalent lack of software security education.

[supersecure-blog]

Security Everywhere - facial recognition

I admit it, it’s enjoyable seeing how I would look if I was aged 30 years, or if I was reverted back to a child-like state through technology like Snapchat filters and FaceApp, but I’ve never really thought about the implications about using technology like this.

In lectures and tutorials, we’ve had some interesting discussions about privacy, and talked about authentication. Specifically, how you can be authenticated through:

What you are - your face, voice or fingerprint

What you know - like a password or secret

What you have - a key to our house etc,

When things like our email accounts get compromised, we change the password. If our house gets broken into, we change the locks. These factors of authentication can change, but when data about who we are gets collected and then exploited, it can be very hard to change. And the thing about data; once it’s out there - you can’t take it back.

When we use apps like Snapchat or FaceApp, often we don’t read the terms and conditions, and more often, we don’t consciously acknowledge that by using the app, you are accepting their terms and conditions. If outlined in their terms and conditions, for example with FaceApp, these companies are able to modify and save any images that you create the app, which are allowed to be commercialised, or freely used by the company. Even if you delete the app, those images still belong to the company, so there’s not much you can do to take them back. 

As users of these of these apps, we have to be aware of the potential implications of data collection, and be willing to bear the risks of data misuse. If a company like FaceApp had a data breach or was subjected to an insider attack, and data about millions of users’ identities was sold or exploited, how would we protect the safety and privacy of these users? 

Overall, even seemingly innocuous apps like this have security concerns which might not be considered by every day users, and it’s in our best interest to spread awareness and inform people about the potential implications of using technology like this.

References:

https://nypost.com/2019/07/17/faceapp-security-concerns-russians-now-own-all-your-old-photos/?utm_source=reddit.com

[security-engineering]

Today I watched as a man walked purposefully into a woman’s bathroom only to come out not 5 seconds later a tad embarrassed and walk into the men’s room. (Not judging him; if you're distracted, it can happen.)

It made me consider how bathrooms protect their intended users in most cases by pure social pressure. I also considered girls’ tendencies to hide out in bathrooms when they want to escape certain situations. 

Social pressure is a strong driving force. Children get warned about peer pressure, and whilst it’s less discussed after that period, it doesn't stop once you leave school. You hardly even notice how society shapes many of your every day decisions like keeping to a specific side when walking. 

Consider why you wear shoes. Yes, there is some level of comfort that comes from the padding between one’s sole and cement. Yes, they can keep your feet clean and dry. But we don’t actually need to wear shoes. We have been conditioned to wear them. If you saw someone wearing a suit in the city but no shoes, what would you think of them?

So, social pressure is definitely strong enough to work in most situations. The problem with only using social pressure is that anti-social individuals won’t always adhere to these standards. If someone really wanted to get to someone in that bathroom, their not going to wait until you come out to get you. If a man decides that he’s going to use the female bathroom, are the women really going to force him out? Maybe, maybe not. It would depend on the woman and the man. (The reverse could happen as well, with a woman entering the men’s.)

Some places do enforce these rules, but this risk is not deemed high priority. It hardly would impact the business. Doors are not going to be watched to make sure nothing can happen. It’s more likely that in the case of an individual reporting the event to security that the rules are imposed after the fact.

[kelvindoescomp-blog]

Something Awesome Project Proposal

Topic: Malware Analysis

Motivation:

In this project, I want to acquire pragmatic knowledge and develop practical skills on malware analysis, in areas such as identifying common malware structures, researching on widely used exploits and vulnerabilities, and means of propagations, and practicing on common methods to detect and combat the malwares and to remediate the effects of them.

Skills:

To achieve this goal, I believe I need to have a good understanding of how to set up and manage a safe vm for malware analysis purpose, have practical knowledge on reverse engineering including x86 assembly language, tools of trades like Ghidra or Binary Ninja, and common anti-analysis methods such as obfuscation. I would also need to develop practical knowledge of dissecting real-world malware to remediate their effects. In order to think like a malicious hacker, I would need to gain experiences of developing malwares using common anti-disassembly techniques.

I Will Achieve This By:

1. Gain a systematic knowledge of setting up a safe environment for malware analysis by reading chapter 2 of Malware Analysis in Virtual Machines in Practical Malware Analysis by Michael Sikorski and Andrew Honig.

2. Get a taste of reverse engineering malwares by following the instruction on https://repo.zenk-security.com/Virus-Infections-Detections-Preventions/Practical_Malware_Analysis.pdf.

3. Follow the Ghidra tutorial https://www.reddit.com/r/ReverseEngineering/comments/az5cv7/ghidra_quickstart_tutorial_solving_a_simple/ to get started on using Ghidra and compare it with Binary Ninja to determine a suitable software for my purpose.

4. Develop through practical understanding of x86 assembly by reading chapter 6 A Crash Course of x86 Assembly in Practical Malware Analysis.

5. Follow online tutorials to analyze 3 major malwares as of January 2019-- Emotest, Kovter and WannaCry.

6. Develop my own harmless malware with anti-reverse engineering techniques.

Marking Criteria:

Evidence of all of the above should be presented on my blog whether that is by posting and analysing my solution, discussing the topics presented in the chapters, presenting my own thoughts and demo of a safe malware analysis environment, reflecting on my understanding of the topics discussed in the books, doing write ups on using reverse engineering tools, or documenting the process that I took for reversing the major malwares and developing my own anti-reverse malwares.

Pass: Completion of #1, #2, #3

Credit: Completion of #1, #2, #3, #4

DN: Completion of #1, #2, #3, #4, #5

HD: Completion of #1, #2, #3, #4, #5, #6

[security-engineering]

When you pixelate a photo, is that similar to a hash?

[security-engineering]

Surveillance has made fading into obscurity almost impossible. Secret agents are now finding it difficult to perform. Creating a realistic digital history is too difficult with the amount of data that is constantly collected. Not producing the data is suspicious. Inconsistencies are suspicious. 

Agencies can use young people, who are expected to have little digital history, but they can only do a few missions before they are discovered, putting their lives at risk.

You might think it’s only the secret agents because they have something to hide, but once they are all found out, the next people to be inspected will be the general public. 

https://www.abc.net.au/news/2019-07-29/cia-james-olson-western-spy-agencies-outgunned-by-adversaries/11338096

[ia6441blog]

Logitech keyboards and mice vulnerable to extensive cyber attacks | Hacker News

Don’t trust anything wireless (especially Bluetooth). Logitech makes some of the finest wireless keyboard and mice around and this showcases 2 major vulnerabilities.

If an attacker can press some keys, or observe some keys being pressed while monitoring network traffic. They can inject key presses without the key to the crypto.

If an attacker can observe the pairing process, they can decrypt all key presses.

So if Logitech, which is one of the biggest and most mature kb manufacturers around can have a vulnerability of this magnitudes. I wonder how secure those el cheapo wireless keyboards are.