无标题 @wdamond-blog - Tumblr Blog

Posts

The beauty of hackers, says cybersecurity expert Keren Elazari, is that they force us to evolve and improve. Yes, some hackers are bad guys, but many are working to fight government corruption and advocate for our rights. By exposing vulnerabilities, they push the Internet to become stronger and healthier, wielding their power to create a better world.

TED Talk Subtitles and Transcript: 你的电脑是怎么染上病毒的？这些病毒窥探你的数据，盗取你的银行信息。通常，在你每天不假思索地点击电脑时，病毒就趁虚而入了。詹姆斯·莱恩提醒到，我们不仅受到美国安全局的监视，还有更高深的网络罪犯在利用简单的代码和轻信的人性在偷窥我们的隐私。

Cybercrime in everyday life -- what should we do about it

comp6841

Tutorial - Week 8

Case Study: Ghost

The problem was basically the following scenario:

Suppose you are the friendly Major M from the base who can see the alien A but who cannot see the invisible man X.

Q: What you would you, M, do to get from X his report on the Alien’s (A’s) planet?

Note: Consider the report may contain information including:

Is the alien A to be trusted?

Is there anything urgent we should do based on the information you obtained in your trip to the alien planet?

My immediate thought with this problem is it is basically trying to defend against a man-in-the-middle attack - there are two main ways we can approach this problem:

Authentication

Use a 3rd party to verify the endpoints of the communication (basically PKI) so we know the messages are going between M and X

OR a previously shared secret between the parties M and X which we can use in communications

Tamper detection

Using a hash function which takes a significantly long time to compute such that each endpoint party can determine tampering by discrepancies in response times

Tutorial

The tutorial ran a bit different to the other days in the sense that we didn’t present one-at-a-time on the projector but instead setup 5 stations around the room, where each person could present for a longer period of time to the class as a whole (but only marked for 2-3 minutes each). I found this a much more useful way of doing things as got the opportunity to share further details about our projects and learn more about others. A couple of ones I remember include CTFs, a slowloris demonstration, cryptographic hash function proofs, buffer overflows & spawning shells, neural network CAPTCHA training, intercepting network traffic, audio steganography and a presentation on ‘catfishing’. It was cool to see the variety of things people had got up to!

There were so many things I learnt throughout the ‘Something Awesome’ so I found it difficult to sum it up in such a short period of time. My demoed item (I ran thru) was a license forging reverse challenge (namely HTS Application 18); going through the process in which I determined the format of the license file and wrote a program to forge the contained key. Overall, it was pretty fun. We spent so much time on the projects, we didn’t actually get to the case study, however I think the solutions I devised prior were about as good as you were going to get for the problem. (I’m going to keep this one short and succinct today!)

Security Everywhere

I admit it, it’s enjoyable seeing how I would look if I was aged 30 years, or if I was reverted back to a child-like state through technology like Snapchat filters and FaceApp, but I’ve never really thought about the implications about using technology like this.

In lectures and tutorials, we’ve had some interesting discussions about privacy, and talked about authentication. Specifically, how you can be authenticated through:

What you are - your face, voice or fingerprint

What you know - like a password or secret

What you have - a key to our house etc,

When things like our email accounts get compromised, we change the password. If our house gets broken into, we change the locks. These factors of authentication can change, but when data about who we are gets collected and then exploited, it can be very hard to change. And the thing about data; once it’s out there - you can’t take it back.

When we use apps like Snapchat or FaceApp, often we don’t read the terms and conditions, and more often, we don’t consciously acknowledge that by using the app, you are accepting their terms and conditions. If outlined in their terms and conditions, for example with FaceApp, these companies are able to modify and save any images that you create the app, which are allowed to be commercialised, or freely used by the company. Even if you delete the app, those images still belong to the company, so there’s not much you can do to take them back.

As users of these of these apps, we have to be aware of the potential implications of data collection, and be willing to bear the risks of data misuse. If a company like FaceApp had a data breach or was subjected to an insider attack, and data about millions of users’ identities was sold or exploited, how would we protect the safety and privacy of these users?

Overall, even seemingly innocuous apps like this have security concerns which might not be considered by every day users, and it’s in our best interest to spread awareness and inform people about the potential implications of using technology like this.

Challenger

For one thing, it was a rare crew of seven; On the other hand, it was the first disaster in challenger's 10 space flights. NASA, which rarely fails, wanted to add a gimmick to the mission: the space teacher program.

Reviewing the incident, feynman noticed several details.

After the rocket broke free of the bolts that held it in place, the hydrogen emission arm was withdrawn from the outer storage tank, but without success. But according to video replays, the discharge arm did not touch the hull again and was not the cause of the accident. Later inspection of the launch pad also found that four bolts of the recol spring was missing, but the impact on the accident is not significant. After a routine meeting announcement, a colleague mentioned something that caught his attention: when he was fixing the nozzle of his car this morning, he remembered that the weather on challenger's departure day was unusually cold, about minus three or four degrees Celsius.

Low temperatures cause damage to some parts? Feynman caught a flash of inspiration. The supervisor arranged for information to be gathered and showed feynman a set of photographs showing a flame rising from the solid rocket booster on the right in the seconds before the explosion. The fire is near the leak test hole, where pressure can be applied to test tightness, and the hole contains two O rubber rings sandwiched in the middle. If the hole is enlarged due to rocket thrust, the o-ring should be extended and filled with holes to ensure flight safety.

What if it doesn't work? Even if the two are separated by 0.2 seconds, a catastrophic accident is bound to happen. As early as 1977, it was clear that o-rings do fail at low temperatures, and that their flaws could lead to catastrophic events.

#Challenger

security everywhere

Hope we can project our property, keep it in the eye.

supersecure-blog

Week 7 Homework - Email Phishing

The outline for this task is below:

You objective is to use social engineering over email to achieve the following objectives :

Obtain the Facebook login credentials from the Puppy Love organisation Facebook page Organise for a payment of $1200 to be made to your fake account by the Puppy Love accounts team : BSB : 123456, ACC NO : 12347890

The first step to doing any sort of phishing is doing some basic reconnaissance. Let’s take a look at the ‘Puppy Love’ website that our targets Sarah and David work at:

Information Gathering:

Sarah:

Family Relations:

Husband - David/Mark

A bit of inconsistent information - the puppy love website says that Sarah is married to David, however this instagram post (https://www.instagram.com/p/BWd9VZqBq5j/) says she is married to Mark (maybe she got a divorce or something)

Can calculate Mark’s Birthday (assuming the post is from 2017), his birthday is 04/06/1982

Son - James

Birthday - 02/12/2014 from this Instagram post: https://www.instagram.com/p/BWd-BRmhxsZ/

Interests:

Favourite Dog - Jasper

Favourite Dog - Max from this Instagram post: https://www.instagram.com/p/BWd9mRuhz1a/

Contact Info:

Email : [email protected]

Instagram: https://www.instagram.com/sarah.jenkins0583/

David:

Interests:

Microbrewing

Favourite Dogs - Angela and Jessie

Contact Info:

Email : [email protected]

Other:

Dogs - Max, Bella, Jessie, Stella

Business Address: 363 George Street Sydney, NSW 2000

Next we need to translate all of this information into something that we can use. If the task required that we try and access one of their accounts, we could try and convert the information we’ve gathered into keywords we could use to guess for passwords:

Keywords:

Dogs:

Jasper, Max, Angela, Jessie, Bella, Stella

David likes microbrewing:

Beer, brewery, microbrewing

Child:

James, 02/12/2014, 02122014

Sarah’s husband(s):

David

Max, 04/06/1982, 04061982

Phishing:

Facebook Logins:

Using the information that we’ve gathered above, I’ve created an email addressed to Sarah seemingly from David who innocuously asks for the facebook log-in details…

That gives us this response:

Easy enough! Now for the second task:

Bank Transfer

Let’s try a similar approach:

That gets us this response:

Funnily enough, Sarah doesn’t seem to be suspicious at all, and redirects us to ourselves!

So let’s try to switch targets and bait David instead.

As the task outline specified, we’ll be trying to pose as a member of the accounts team in order to try and get a payment from David:

Apparently from the response Sarah doesn’t exactly know who she is:

So let’s, just remove any instances of the word Sarah from our previous email. Doing that lands us this response:

Finally, adding the word ‘urgent’ into our email gets us the flag:

Overall we were able to successfully extract the two flags using a bit of knowledge about phishing. If we were to attempt something like this in the real world however (purely hypothetically), because we know Sarah and David are married, they would probably contact each other about emails and then figure out that something is not quite right. Thus, the likelihood of successfully performing either information extraction or payment fraud is probably low.

Ways that we could avoid phishing after doing this activity:

Never send important and private information such as log-ins over email

Probably verify who you are talking to via in-person or on the phone before you transfer anything like money

As the first flag suggests - you could possibly set up 2-factor authentication

usmanhaidar6441-blog

Module 4 Activity: Human Weakness

Sydney Lock Out Laws

Circumstances, pressures and influence leading to the outcome:

The circumstances were based off the increasing alcohol related violence that was prevalent in Sydney’s major night life hotspots. It was a case of a moral hazard as there was an almost moral duty on behalf of NSW government to slow down the violence at the expense of business. The straw that broke the camels back was the death of Thomas Kelly who died as a result of the violence.

Violence was reduced dramatically, however it has to be noted there was much less people going out than before, consequently there was much less violence by default.

Discuss how you might design changes and policies to prevent it from happening in the future.

There needs to be a way to balance the revenue and violence components with these laws. In hindsight we see a lot of the establishments in around Kings Cross being sold off to property developers (some close mates with politicians) and the integrity of the laws can be called in to question.

In terms of reducing violence, I would have a credit rating system in place where locations less prone to violence receive a higher credit score and as such will be able to serve later into the night. This will force the establishments to stay on their toes in regards to rowdy behaviour.

Security Everywhere

https://privasec.com/services/cloud-cyber-security

I find a interesting website here.

Data encryption standard

The most famous Data Encryption Standard, Data Encryption Standard (DES), was developed by IBM in the 1970s and was adopted by the us government in November 1976 after being screened by the government's Encryption Standard. DES was subsequently recognized by the National Standards agency and the American National Standards Institute (ANSI). DES gibbons thought DES USES 56 bit key to encrypt 64 bit data block, and carries on 16 rounds of encoding to 64 bit data block. During each round of encoding, a 48-bit "per round" key value is derived from a 56-bit complete key. DES takes a long time to decode with software, while decoding with hardware is very fast. Fortunately, most hackers didn't have enough equipment to make such hardware. In 1977, it was estimated that it would cost us $20 million to build a dedicated computer to decrypt DES, and that it would take 12 hours of cracking to get results. At the time, DE S was considered a very robust encryption method. But with today's increasingly fast computers, the cost of building such a special machine has dropped to about $100,000. On the other hand, if it is only used to protect a server, then DES is really a good way, so now is not fully applicable to the requirements of encryption occasi

Electronic commerce security

Electronic commerce (EC) is the use of electronic data exchange (EDI), E-mail (E mail), electronic funds transfer (EFT) and the Internet of the main technology, between individuals, enterprises and countries for paperless business information exchange. In the process of changing from traditional paper-based trade mode to electronic trade mode, how to keep the electronic trade mode as safe and reliable as the traditional trade mode is the focus of people's attention, and also one of the key problems that should be used in all aspects of e-commerce. The safety element of electronic commerce basically has the following. 1. The validity E-commerce replaces paper with electronic form, so how to ensure the effectiveness of this electronic form of trade information is the premise of EC. EC as a form of trade, the effectiveness of its information will directly affect the economic interests and reputation of individuals, enterprises or countries. Therefore, network failures, operational errors, application errors, hardware failures, system software errors and potential threats from computer viruses should be controlled and prevented to ensure that trade data is effective at a determined time and place. 2. Confidentiality As a means of trade, e-commerce information directly represents the trade secrets of individuals, enterprises or countries. the Conventional paper trade is kept confidential by mailing sealed letters or by sending commercial messages through reliable communication channels. EC is built on a relatively open network environment (especially the Internet is more open network), the maintenance of trade secrets is an important guarantee of EC comprehensive promotion and application. Therefore, it is necessary to prevent the illegal access of information and the illegal theft of information in the process of transmission. 3. Integrity E-commerce simplifies the process of trade, reduces human intervention, and brings about the maintenance of business information on all sides of trade Questions of integrity and unity. Unexpected errors or fraud in data entry may result in differences in information between trading parties. In addition, information loss, information duplication or order difference in the process of data transmission can also lead to different information of trading parties. The integrity of trade parties' information will affect trade parties' trading and business strategies. Maintaining the integrity of trade parties' information is the basis of EC application. Therefore, to prevent the arbitrary generation, modification and deletion of information, at the same time, to prevent the loss and duplication of information in the process of data transmission, and ensure the unification of information transmission order. 4. Dependability/non-dependability/discrimination EC may be directly related to the business transactions between the two parties The issue of the trading side expected by the exchange is the key to ensure the smooth operation of electronic commerce. In traditional paper trade, both parties identify their trading partners by handwritten signatures or seals on written documents such as trade contracts, contracts or trade documents, so as to determine the reliability of contracts, contracts and documents and prevent the occurrence of repudiation. This is often referred to as "in black and white". Under the paperless EC, it is impossible to identify the trade party by handwriting signature and seal.

The basic concept

Cryptography: the basic idea is to disguise information so that outsiders cannot understand its true meaning, while insiders can understand its original meaning. Clear text: source information is called clear text. Ciphertext: the disguised ciphertext is called ciphertext. Encryption: the process of converting plaintext into ciphertext is called encryption. Encryption algorithm: is used to encrypt the transformation method. Decryption: perform the inverse transformation of ciphertext and encryption, so as to obtain plaintext, this process is called decryption. Key: a string of Numbers, letters, or special symbols that controls the process of encryption and decryption.

Cryptography is an ancient and profound subject. For a long time, it was only used in a few fields, such as military, diplomatic, intelligence and so on. Computer cryptography is a science that studies the encryption, decryption and transformation of computer information. With the development of computer network and computer communication technology, computer cryptography has been paid more attention to and popularized rapidly. In foreign countries, it has become the main research direction of computer security, but also the main content of computer security course teaching. Cryptography is the main means of realizing secret communication, and it is the special symbol of covert language, text and image. A communication mode that is not recognized by the first three is called cryptographic communication. In computer communication, cryptographic technology is adopted to conceal the information, and then transmit the hidden information, so that even if the information is stolen or intercepted in the transmission process, the thief cannot understand the content of the information, so as to ensure the security of the information transmission. The history of cryptography goes back 4,000 years, to ancient Egypt, when some of the noblemen's tombstones bore inscriptions that replaced ordinary hieroglyphics with strange pictograms, the earliest form of cryptography. It contains two key elements of cryptography, namely cryptography and text morphing.

Security Everywhere

There are two main types of security threats on the Internet. (1) accidental threats, such as natural disasters, failures, misoperations, etc. (2) intentional threats are malicious ACTS of a third party and malicious ACTS of the other party in e-commerce. From malice three Such as foreign spies, criminals, industrial spies and bad employees. People often hear in the life, a hacker broke into some network again, make this network service all paralyze; A hacker, A large amount of money was stolen from a bank through the Internet. In fact, there is no such thing as an infallibly secure network, and as long as a user's network is connected to the Internet, it is in danger. Security comes from two main sources. On the one hand, the TCP/ IP protocol itself has huge security flaws, including many of the services built on it. On the other hand are human factors and natural factors. Natural factors are some accidents, such as the server suddenly cut off power and flood washed out the network; Human factors, that is, human invasion and destruction, there are many motives for this activity, but the result is the same.

week7

week6

week5

Trending Blogs

Recently Viewed Blogs

无标题