Richard gave a lot of homework this week...
Tutorial Case Study: Privacy and Biometrics
Previously I was not highly concerned with the collection of my personal data by Google, Facebook, Apple, etc; and the main reason behind this is for the convenience. Google maps suggests automatically the places I frequently travel to, like work, home and uni. I use Face ID on my phone to make payments and login to my accounts. I enjoy this ease of use. After the tutorial I reflected upon how much data I am giving away and how that data could be exploited for objectives that do not align with my intentions. For example, Apple aggregating my expense information to better market products to me: I have no choice over this...
Top ten web security risks
Broken Authentication and Session Management
Cross-Site Scripting (XSS)
Insecure Direct Object References
Security Misconfiguration
Missing Function Level Access Control
Cross-Site Request Forgery (CSRF)
Using Components with Known Vulnerabilities
Unvalidated Redirects and Forwards
NIST NATIONAL VULNERABILITY DATABASE
This is actually great as I have just started to investigate the possibilities of XSS and SQLI. This vulnerability database lists many current and fresh issues that give some insight into what approaches should be taking when testing web apps. Link.
Read up about the NSW LPI and think about what assets they have and what risks arise from them having been privatised
The NSW LPI was the division responsible for land titles, property information, valuation, surveying, and mapping and spatial information in the Australian state of New South Wales. Privatising these assets releases their control and jurisdiction of these assets to financially driven entities. This means that the enforcement on assets that hold cultural value and significance such as historical buildings and park-lands might be re-zoned to align with the economy’s interests. There exists a higher risk to lose the assets with non-financial value. Link.
Work out the current state of bio-metrics as an authentication strategy
Bio-metrics are regarded as the best (single) means of user authentication to the casual intruder. They also prevent against password stealing ware (PSW) which grabs auto-fill data and saved payment card details. Most tech companies such as Apple and Google who provide bio metric authentication are pushing for this to be a common method of authentication for websites and apps. This would be another measure towards improving user authentication. Link.
Read about Transport for NSW idea of using facial recognition rather than opal cards
This is a controversial topic. For Opal to use face recognition to authenticate and identify it’s passengers, means that it would have to store mass amounts of customer data - both images and video - which creates a very high value target for hackers. This data is also connected with location and time tracking. The guardian, linked below, discusses the privacy risks this would pose, HOWEVER, the public concern is more focused on the fact of whether or not it is technologically feasible, not on the fact it would pose major privacy risks. Link.
Read about the San Francisco ban on bio-metrics
San Francisco has banned the use of bio-metrics by police. This is because of the fear that the technology will be overused and move the United States in the direction of an overly oppressive surveillance state. There was a recent push for the use of these bio-metric systems following this mass shooting, however, there was a widespread public backlash as many showed strong discomfort with the idea. In this case, the American people seem to value their personal privacy over the additional security of widespread bio-metric identification. Link.
Read about the uni research allegedly helping Chinese security forces use to track and detain Muslim Uyghur citizens in Xinjiang
Apparently in 2017 UTS signed a lucrative deal with CETC (Chinese state-owned military tech company) that developed software for Chinese security forces to use to track and identify citizens; however recently this same technology was used to track and detain Muslim Uyghur citizens in Xinjiang. I don’t what UTS was expecting when they assisted in the development of this, it seems quite intuitive that this could and will eventually be misused by the military for purposes UTS possibly found as a human ethics violation. Link.
China’s goals and recent developments with bio-metrics:
China’s goals and implementation:
Identify a person from the 1.3 billion population in just 3 seconds using facial recognition.
Security personnel wearing eye-wear to detect people
Wearable microchips in uniforms that help with admin tasks such as authentication and monitoring
AI generated media... (news anchors)
Loudspeakers to yell at children when they got too close to water
Livestock farming and monitoring using AI
How can you detect Man in the Middle eavesdropping?
One method of detecting a MitM attack is by constantly validating if the certificates presented to you by the website is issued by a legitimate CA. The best method of doing this is using a tool to keep track of the changes relating to the certificates you use, so if there is a major change, such as Google updates its private key, you can check manually if this is actually the case.
Web of trust (PgP) and PKI. (how PGP does authentication - web of trust)
Public Key Cryptography Infrastructure (PKI) can be implemented in two different ways: first using certificates and certificate authorities, secondly, using trust relationships between regular users. The first implementation is the commonly used method of certification used by websites. The second implementation was first used by OpenPGP. This is implemented by GNU Privacy Guard (GnuPGP) which nearly all linux distributions rely on for package integrity verification. Link.
Anyone can become a CA with enough work, and then they are by default ‘trusted’
Your private key is ‘steal-able’
You cannot detect a ‘compromised’ CA
Only a single CA is needed to validate a website, PKI doesn’t cross verify
CA verifies certificates but is not an authority over the contents of the certificate
User’s aren’t included in the security design (they could play a role in the validation process)
A CA could actually be a CA + Registration Authority (RA). The RA+CA model is less secure as the link between the two could become compromised
The CA could possibly misidentify the certificate holder (a malicious individual could impersonate the certificate holder)
If/When the technology progresses and updates to a new encryption standard, all the certificates need to be updated or revoked using the Certificate Revocation Lists (CRL)
PKI was implemented as due to a minimal impact solution and even though it is not a perfect system, the industry is run by “business and the prominent voices are those with something to sell.”
Find examples of (serious) fraudulent certificates being issued
For this I researched a company called DigiNotar, a Dutch Certificate Authority. This company ‘detected’ a security breach on September 3rd 2011 which resulted in fraudulent issuing of certificates. 300,000 Irinian Gmail users were the target of the hack and Bruce Schneier says that the attack may have been “either the work of the NSA or exploited by the NSA.” however, this has been disputed with others saying NSA had only detected a foreign intelligence service using the fake certificates. Some are even pointing fingers at the 21 year old Irinian student who claimed to have hacked 4 other certificate authorities. Once 500 fake certificates were identified, DigiNotar became blacklisted. Link.
Learn about the steps in a TLS handshake
Here is a summary of the steps published by IBM (steps in [ ] are optional):
Client sends ‘hello’ containing:
Server responds with ‘hello’ containing:
Another random byte string
[Client certificate request]
Client verifies certificate
Client sends to server containing:
Random byte string encrypted using server public key
[Client certificate or ‘No digital certificate’]
[Server verifies client certificate]
Client sends server ‘finished’ message encrypted with secret key
Server sends client ‘finished’ message encrypted with secret key
They now exchange messages encrypted with the shared secret key
