#securiyeet

[junscoolsecurityblog]

W3 - CS Doors

Doors to the cockpit in commercial flights have warranted many issues such as evil co-pilots hijacking the plane and the door jamming after a pilot went to relieve himself. This week’s case study asked for a list of recommended actions to take so that cases like these don’t happen. My group’s list included:

1. Additional checkups on pilots to ensure their mental state is safe for flying.

2. Implementing several levels of locks on the door, level 1 locking out any non-pilots, level 2 locking out pilots too, but can be overridden by a message to air traffic control.

3. Improving manufacturing and maintenance standards.

[junscoolsecurityblog]

W3 - Merkel Puzzle

Merkel puzzles allow for messages to be communicated over an untrusted medium. They work by making the workload sufficient for the other party, and excessive for any attackers by essentially passing a large number of easy-moderate level difficulty puzzles, and allowing the other party to crack one, and return a unique identifier and key. Messages can then be shared between the parties by mentioning the key that was used as both know the key. This makes it difficult for attackers as they would on average need to decode at least half of the puzzles (compared to only one), creating an excessive workload.

[junscoolsecurityblog]

W3 - Lecture Summary

Risks Risks are especially difficult to assess due to their low rate of occurrences, however there are ways to reduce their impact:

- Prevention: eradicating the threats which pose the risks (i.e. shaving your head so that your hair doesn’t get stuck in the disk sander in DT) - Limit: accepting that the risk may occur, and placing measures to contain the damage (i.e. padding a parcel in several layers, so that if it is handled roughly, ideally only the padding would get damaged) - Passing the risk to a 3rd party: shifting the blame lol - Wear the risk

Bits A measure of work, log2 of the number of cases (i.e. 8 cases = 2^3 = 3 bits)

[junscoolsecurityblog]

W2 - CS Houdini

This week’s case study was to design a protocol using Houdini’s wife to test the authenticity of any mediums which try to commune with a dead Houdini. My group agreed that regardless of the method, the wife would be the only source of authentication and thus the greatest point of weakness in any plans (especially if bribed, extorted or if there was human error i.e. forgetting information). Working with the flaw, we decided on a number of steps:

1. Provide the wife with a code which she could remember easily (dangerous, as may be guessable), or write it and store it in a secure place. 

2. Append or prepend a code relating to the date and time of each commune.

3. Allow any medium to try an commune with dead Houdini, and disregard them if they fail to mention the code.

This is a use of two-factor authentication as they use two pieces of information the code and date (as a password and token). The third factor of biometrics would not be applicable in this case.

[junsecurityawesome]

W1 - US Prisons Banning Books Which Teach Inmates Coding

“The Oregon Department of Corrections [DOC] has barred inmates from reading dozens of books about technology and programming — many of which teach basic skills for many entry-level jobs.”

There have been over 1600 books banned by the Oregon Department of Corrections which cover topics such as sexual content, criminal activity, escape, and more recently technology. Examples of the latter can be seen in the image below, with ‘Code’ being cited as a violation.

The justification of the bans was to lessen prisoners’ ability to utilise the computer as they are often accessible within their sentence and may pose as a ‘potential threat’.

I find many flaws with the above decision and am almost entirely against it. I don’t believe that learning to code with especially the books in the above image, written for beginners, would contain much if any information on hacking a system. They include the fundamentals of coding languages to help the reader become familiar with the process, and potentially assist in their employment after they are let back into society. Regardless of if these books are banned, this solution would not address inmates who have prior knowledge of hacking, and other solutions should be implemented regarding the computers contents or usage protocol.

More effective solutions include: 

Random inspections of computer activity without the inmates knowledge. Due to the unpredictable occurrence of checks, inmates would not be able to prepare for checks and thus would be more difficult to plan something suspicious. This could detect suspicious activity early while also allowing inmates to gain the knowledge to assimilate into the workforce.

Banning only hacking-related books as beginner books should not be deemed as a threat.

Monitoring keystrokes for suspicious key words or combinations. This requires less man power and thus less money, while also detecting suspicious activity almost instantly. It would require a list of key words/combinations to be gathered first which could make this entire process unreliable if done poorly.

[junscoolsecurityblog]

W2  - Lecture Summary

Type 1 and Type 2 Errors There are 4 different combinations when considering the potential outcomes of a scenario. We can see this if we examine the case of a doctors diagnosis of a patient:

The patient is sick, and the doctor’s diagnosis is positive

The patient is not sick, and the doctor’s diagnosis is negative

The patient is sick and the doctor’s diagnosis is negative

The patient is not sick and the doctor’s diagnosis is positive

As shown, the bottom two cases provide scenarios when the doctor is incorrect about his diagnosis of the patient; in case 3 (type 1 error), where something true claimed as false, and case 4 (type 2 error), where something false is claimed as true. One error may hold less consequence than the other, if continuing the scenario and saying the patient could have a life-threatening illness with the prescribed treatment holding little side-effect, we can see that receiving treatment and being subject to minor side effects holds much lesser consequence than not being treated and dying. Thus situations of similar nature are often implemented to favor the less detrimental outcome in case of error.

Coincidence Index To assist with cryptoanalysis we can determine how likely some text matches the frequency distribution of a set of data through the use of a coincidence index. This can be done as follows:

This allows us to provide a quantification of the likelihood of our text matching, and also provides information on effective (and ineffective) decryption methods to apply through testing. There are also other unreliable techniques which can be applied such a shifting the letters of the encrypted text, and seeing the recurrence of a letter between the the original and shifted versions.

[junscoolsecurityblog]

Something Awesome Proposal

Aim: To achieve a broad understanding of relevant security topics such to widen my perspective when analysing the quality of projects in the future. 

Main Task: To familiarise myself with trendy security news, I will spend an hour a week browsing a variety of security news articles from websites (my primary focus will be on but is not limited to user privacy). From this, I will select one article and create a comic strip as a brief explanation of the issue, and also accompany it with an in-depth description. This description will also include my opinion regarding the topic and suggest implications and/or solutions. I estimate that the creation of my posts will take another 3+ hours each week.

Success Criteria: - Create a comic strip (minimum 3 panels) and description (minimum 200 words) each week, totaling to 5 over this course. - Upload blog posts with the process of the comic strip.  - At the end of each week, blog about a reflection of what could be done better in the following week regarding my conveyance of information through comic strip, and any takeaways from the chosen article.

Extension Criteria: If there is extra time during the project: - Blog about potential contenders for the chosen article that week. - Create diagrams, animations or videos to assist in conveyance of information on the topic. - Polish or redraw a comic strip to better convey its message.

Contingency Plan: If a comic strip is taking longer than anticipated and cannot be completed to the same standard: - Simplify the panels in the strip such that the message retains, i.e. reducing characters to stick figures.

If a description is taking longer than anticipated and cannot be completed to the same standard: - Convey the main point(s) of the article and my views on it. - Provide links to assist in the explanation of concepts where it was lacking.

Plan: Week 3 - Gain Hayden’s approval.

Week 3 - 7 - Create comic strips, descriptions, and blog.

Week 7 - Formulate my comic strips, descriptions, and main takeaways from this project into a video.

Week 8 Submit final project.

Here’s my email in the case that commenting is unavailable: [email protected]

[junscoolsecurityblog]

W2 - Shredding Analysis and Dumpster Dive

I looked at and completed the shredding analysis task today and was surprised at the lack of difficulty required to recreate the original document. My preconception was backed up by how the media has portrayed the destruction of forms through shredders in tv shows and movies, and also my initial thoughts of the ambiguity of the individual strips of paper. However, taking a step at a time and linking alike strips, the image had begun to form smoothly. I began by recognising the iconic face of Donald Trump, and from then I would look for matching adjacent pieces either to the image or by completing letters in the familiar font in the title.

I had also looked into the dumpster dive activity with my observations and deductions below:

-  The individual’s name is Adam Surname, and he has the email [email protected] and phone number 0412345678. He lives at No Street St, Suburb, Postcode. - He uses apple device(s), as he has a lightning cable packaging and a receipt for an iPad case.  - He may Christian as he has an envelope from Jesuit Mission, a Christian organisation. - He likely wears contact lenses and glasses as he has a box of Acuvue (contact lenses) and is shown wearing glasses in his visitor ID. He also may suffer from hay fever and allergies as he has a box of Telfast (medicine used to relieve those symptoms). - He frequents McDonalds, and seeing as he has the packaging of beans and a decent amount of sugarless beverages and water, he attempts to watch his diet, but not strictly. He also frequents UNSW, and is likely a student or worker as he has a UNSW lanyard attachment with his name, and also several parking tickets at the university. He also has parking tickets for Hickson Rd and Campbell St, both located in Sydney CBD, both in the late afternoon/night for only a few hours. This is likely not for business purposes due to the hour and short time frame of the parking. - He likely lives around the north-west (West Ryde/Gladesville/Ermington) as he has many receipts from around that location from establishments such as Coles, Silver Service Dry Cleaning, KFC, and Mcdonalds and follows the Gladesville local newspaper, The Weekly Times. He also sometimes goes to Kingsford Mcdonalds before/after he goes to UNSW. - Is subscribed to or follows The Weekly Times, a Gladesville local newspaper. - May own a pet as there seems to be fur on a black jumper. - May have recently visited Victoria as he has a card from the Nunnery, accommodation located in Victoria, and a Myki card, a public transport card also used in Victoria. - May be part of an infosec group called Platypus Initiative (LetsJustHackShit) and has attended several Sydney based conferences such as Startcon and Sunrise by Blackbird. - He wears Ralph Lauren clothing. - He has some friends who he has recently given Christmas presents to such as Shaun.

I did not expect to find this much information (such as where he lives, what devices he has, and where he has recently been). I also didn’t think I would get so invested as to research the organisations that he has receipts/cards from to uncover more information about him.