pkasjan-blog

[pkasjan-blog]

Crypto App Progress

Throughout the course from the start to now, I really wanted to get better at using the NSA crypto app. When I first got introduced to the app I was amazed at how one could solve the puzzle when absolutely nothing was known. Well, at the time I thought there was nothing known. After the advice that was given in the lecture and tutorials to follow, I started understanding more on how they could be solved. I continued to home my skills with predicting what certain words can be based on the pattern of letter occurrence and common phrases that are used.

This culminated into being able to solve the Sun Tzu quote in the mid semester exam with relative ease. In fact it was very satisfying to be able to decipher such a long and complex quote. I managed to go from the slowest ranking in the app to at least getting below average.

[pkasjan-blog]

Hard Drive Disposal

About 2 months ago I received a laptop from my parents from their business. They thought I could find a use for it in some way and I did find something to do with it. I decided to open the whole computer up to get a look at the different parts of what made a laptop up. When it came to the hard drive, I wanted to look inside of it to cement something I had learned in a previous term. And so I unscrewed the casing and opened it up. I went through the thing piece by piece trying to identify the different sections, most of which I remembered. When it got the actual disk itself I was intrigued at how lightweight it was and mused about being able to store large amounts of data on it. I placed a bit of force to bend the disk thinking that it would bend just like a CD and was very surprised when the entire thing shattered into hundreds of pieces.

This investigation happened before I started the security course so I remember thinking to myself “Well that’s one way of getting rid of a hard drive!” Now after one lecture that Richard gave about the importance of disposing hard drives properly I know that that is not a perfect way to dispose of a hard disk. Through the exercise of putting together a shredded document I came to realize that, however difficult it might be, that disk that shattered to hundreds of pieces could theoretically be reconstructed to its original form. From there a microscope could be used to read the disk itself and the data extracted from that. So that got me thinking what would be the perfect way of disposing of a hard drive. The disks themselves are made from either aluminum or glass depending on the application. Therefore I believe one method would be to incinerate the hard drive and melt it to liquid. This would ensure the certain destruction of the disks with no possibility of recovery. However because glass had a melting point of around 1500 degrees Celsius it is a bit impractical to do so. Instead the way I would do it is to disassemble the drive, retrieve the disks then pulverize them to dust with a hammer. If there is no reasonable way to ascertain where each particle is meant to go then there is no practical way to reconstruct the disk. Doing this in addition to standard protocols like writing over the disk with junk and contact with an very powerful magnet would ensure the data is completely gone.

I thought of this a while ago but for some reason did not make a post about it and only recently got reminded of it.

[pkasjan-blog]

Some Thoughts on Devices and Passwords

Recently at the place I currently work my manager has introduced a music system that allows the attendant to select the music that is playing. Basically, he set up a bluetooth speaker with one of his old phones and had spotify running on that. He gave us the password to the phone itself so people could change things at will but I don’t think the intended for people to go looking thorough the phone.

One night I was working it was particularly quiet and I had nothing to do. I changed the music on the phone and thought to myself “I wonder if I can access anything else on this phone?” So knowing the password I went through the app that he had installed and among them, like most people’s phones, he had facebook. I went into the application wondering if it was logged into anything and sure enough the manager was still logged on. I had access to  all of the data that he posted on facebook, messages that he had sent and I could even reset his password if I wanted to and make his account my own. For obvious reasons I did not actually reset his password nor look at his messages, but the option was there. I told him about this potential breach to which he thanked me. I informed him of the risks that are associated with this kind of behavior and he thanked me for bringing it to his attention. I think now that he has had first hand experience on how easy it is for your data to get away from you, he will be more conscious in the future.

This made me think about the amount of trust that people put in one another even if they do not know them fully. In the case with my manager we are not particularly close or anything but he put trust in me to not do something malicious with the a large degree of power. With being able to access his facebook and previous messages and call history, it was more ignorance on his part. However this is not the first occurrence of a situation like this. The micros system that is in place where I work is used to manage the service aspect. To be able to place orders one must have a number to sign in and each person’s number is given a role. The role restricts what areas of the system they are able to access and with the manager’s number you can access most of the system. The manager’s number is something that is common knowledge among the people I work with which is a serious breach in the security of the system. I have explored the areas the I am able to access with this code (not actually changing or storing any of the data) and I could that I could go to every location except those associated with the setup of the system. This I would assume is only available to the IT admin that set everything up. However this is still very concerning as anyone with the manager’s code (which is everyone) can change the value of any payments made, open closed bills, edit the prices of items and even look at personal data on each employee. I do not believe that people have looked into these areas as most of the people I work with are not as computer literate as I am but they could stumble into these areas by accident with the number.

The massive potential breach in the system was caused mostly for convenience sake. I was told the number when I asked him to void a bill I accidentally made for a customer and he just told me to void it myself with the number. So from that point on, I was able to manipulate the sales within our department simply because he was lazy. I believe it is like this in many places; people having access to areas because of convenience and laziness. This is a culture that is in many industries that needs to be changed. Back to the issue of trust; nothing may happen due to the person knowing more than they should being trustworthy. The thing with that reasoning is it only takes one untrustworthy person to destroy the entire system. If I wanted to, the next time I had a shift I could cripple the whole system if I wanted to.

Perhaps people do not know the potential danger that can occur as a result of this culture. In that vein, everyone needs to be educated in these areas. Until that happens, people will keep releasing their sensitive passwords to people who do not need to know them. In that respect I believe I have changed the view of my manager in this area. I hope that he goes and reevaluates what he believes his personal security is and that of his position and at least changes his manager number. I will follow up with him in a week or so.

[pkasjan-blog]

Learning Lock Picking

I recently purchased a set of beginner lock picks and tried my luck at learning the craft. Unfortunately I bought them a bit late in the course so I did not get as much time as I would have liked to perfect or even get adept at picking locks, but here is my experience.

I bought the lock picks on advice from Richard and the course as a whole. I have always been interested in how locks have worked and the ways you can break through them, so naturally I thought lock picking was a cool skill to have. During the presentation to do with lock picking in the lectures, sets of the tools and practice locks were supplied to whoever wanted to give it a go. For some reason or another I did not actually try it then but I did want to at some point. So I decided to buy my own, which I did not actually do until week 6. It took just over a week to arrive at my door which game me about 5 days to learn it before the assignment was due.

I knew the basics of how to pick the locks but of course theory does not translate as you want to practice. The first time I attempted it I think I put too much tension of the tension wrench which made the key pins set above the shear line and prevent the lock from opening. I think this would be the hardest thing to gauge when learning the skill. Finding the proper amount of torque to apply that prevents what I said above happening and also still allows the driver pins to set. After I while of observing the behavior of the pins in the practice lock, I managed to find the sweet spot for tension I could unlock it through raking in seconds and under 10 with single pin picking. That is with me being able to see the movements of the pins and knowing when there was too much tension. When I tried it out on my door lock, I found it to be much more difficult. Firstly was the placement of the tension wrench. The area that the lock is located is in a slight recess in the handle so the straight wrench that I was using had trouble maintaining proper tension. After that the amount of tension needed was different for that lock, and that is one thing that I found out on all the locks I attempted to pick. They are all different and requite adaptability in the skill of the picker to get open. Another thing that I had difficulty with was not being able to see the pins themselves. Often I would reset the lock to make sure that I was not setting the key pins again. I did manage to open the lock after a bit more time than the practice lock but I resorted to rake it rather then pick each pin. Not seeing the pins was a large factor in this course of action. In the time I had I was not able to fully practice with single pin picking so it is something I will continue to hone even after the course is finished. I will need to look for tips on the proper technique. For now being able to rake the lock is good for me.

I tried to pick one other door in my quest and that was my front door lock. This one is an individual unit not integrated into a handle and so was located close to the right side of the door and on the same plane as the door (not in a recess). This proved to be the first challenge as the wrench was too long to be able to insert into the side I have been using up till this point and I had to move it to the opposite position to even apply any tension. This in itself was really awkward as the arm of the wrench and the rake tool were almost on top of each other. In a similar time frame as the other previous door I managed to rake the lock open. This portion had the same problems; not knowing the right tension to apply and not knowing when to reset the lock. After I opened it i realized another problem with this lock. The mechanism to retract the lock itself was quite heavy and put a lot of pressure on the wrench that I thought it might break. I did attempt to single pin pick the lock but quit after my palm where the tool was resting started to hurt.

The last lock I had a go at was the small 3 pin lock that keeps my locker at work shut. I thought this lock would be the easiest as it only had 3 pins but I was not actually able to get the lock open in the time I tried. There were two main problems that I faced. Firstly; the wrench and the pick would not fit in the lock side by side. Because of the small nature of the lock itself, the keyhole was very narrow. Even the relatively thin wrench that I was using would not allow standard picking techniques. To counter this I had to only insert the wrench a small way into the keyhole to allow proper access to the pins with the pick. Second problem was that when I applied some tension the pick would itself get wedged in the lock and could not be moved. In most locks the wider keyhole allows some sideways leeway for the pick to move in the hole which allows the pick to move when tension is placed. With the narrow keyhole this margin is reduced considerably and through my attempts got wedged.

All the locks other than the practice lock give me further insights into security ideas themselves. One such thought being that sometimes the simple solution is the best one. The locks being located in such a way as to provide reduced access for items like lock picks are the example of this. Now I was just using a basic set of picks so obviously other tools exist that allow for more diverse operations exist. But for anyone who buys a $50 set like myself, these simple features could prevent access.

I am enjoying learning more about lock picking but for someone that bought a simple set off the internet and had the basic understanding of how it works, I managed to get through a few locks with some practice. I will continue to hone my skills in the future but this was just an overview of my experience with the skill.

[pkasjan-blog]

Certificate Authorities

Recently in the lectures, Richard talked about PKI and one of the implementations of this is the use of certificate authorities or CA. One thing I was not too sure about was the use of chains and how this impacted the structure as a whole. So I did some additional research.

At its basis, the CA chain leads all the way back to the root CA which is an entity that is able to issue, authorize and sign other CA. The proof of the root CA being just that lies within the browser that is being used. All have a stockpile of root CA that are hard coded into the browser code itself. These root CA have been verified by the company creating the software and are deemed trustworthy. So this is where the  chain of CA start.

As stated above, the root CA can sign other CA which will in turn be able to sign others. This is the basic structure of the chain; one being verified being verified by another being verified by the root. One of the main reasons for such a structure is security. If the root CA always signs off on other ones then that leaves it open to many attacks. It being the root CA makes it a prime target as control of this would ensure that anything signed by this is trustworthy itself, even if it is not. Therefore root CA have intermediate CA that authorize more, which distances the root from the leaf and increases security.

Another reason for this, unfortunately, is money. The holders of a root CA are in themselves in a great position to sell their signature, as it could be seen. This however could lead to the poisoning of a branch of the tree because a corrupt entity could buy a CA and in itself function as a CA to authorize certificates for shady and malicious websites. This would lead to people visiting those sites thinking that they are trustworthy when they are not. Whenever money is involved, corruption can come in and take a hold over the system. So the signing of a not so trustworthy CA can lead to a whole offshoot of not trustworthy CA and thus the poisoning of that branch. Though it is not all doom and gloom, as the revocation of that holder’s CA would prevent the rest of the branch being trusted as the CA chain can not lead back to the root CA.

To sum up, the positives of having a CA chain are that it distances the root CA from the leaves to prevent potential poisoning of the whole tree and increases security on the whole.

[pkasjan-blog]

RSA Clarification

When we briefly went over the theory behind the RSA cryptosystem in the lectures, I came away from it quite confused and not knowing how to worked. So I decided to do some additional research into the subject for it to become clearer. So the act of encryption and decryption was fairly straight forward to me, what I had trouble with was the generation of the key pair.

The main reason that RSA is so effective is that it is difficult to find three integers e, d and n such that for all integers m  (0 <= m <= n): (m^e)^d is congruent with m (mod n). The variable d in this instance denotes the private key in the key pair and even if one of the other variables is known, finding d is very difficult.

The generation of the key involves a few main steps: 1. Chose two prime numbers p and q that are distinct and random 2. Compute n = pq 3. Compute lambda(n) which equals the lowest common multiple of phi(p), phi(q) which equals the lowest common multiple of (p-1, q-1) 4. Chose an integer e such that 1 < e < lambda(n) and gcd(e, lambda(n)), ie e and lambda(n) are co-prime 5. Solve de is congruent to 1 (mod lambda(n)) After this d is kept secret as the private key exponent and the public key consists of the modulus n and exponent e. The key is broadcast in the form (n, e)

After these are calculated, the public key can be broadcast for use in encryption. To encrypt something to send back to the key owner, the message must be translated to plaintext then calculated as c: c is congruent to m^e (mod n). This is transmit back to the key distributor and no one can decipher what the message is meant to say.

At the other end, the ciphertext is received and subsequently decrypted in the method: c^d is congruent to m (mod n). After this the plaintext message m can be translated back to the original message by reversing the scheme originally used to convert.

This is how secure communication can be achieved. Again it runs on the principle that very large prime numbers are hard to factor, even if some are known.

[pkasjan-blog]

Week 7 Debate

 During the tutorial in week 7, the case study that we did involved debating on the issue of privacy. The class got split into two sections, obviously one for and one against the topic. The topic was “Should the government or government agencies collect and have access to your data for good purposes?” In the debate I got put on the against side, arguing that the government should not have collect our data. This was problematic as I had the view at the time that the government should be able to do it to a certain degree. So I was opening my mind to the possibilities of different ways of thinking. And I must say that after the debate concluded, I changed my views. The arguments that our team thought of and the lack of good arguments for it convinced me that the government collecting and using our data is a bad thing. So in a way I am extremely glad that this case study happened.

So in out preparation, our team came up with a few large points to argue on, namely: - Everyone has a right to privacy - Gives too much control to one entity - Storing the data would be hard

And we also thought from the other side wondering what they would come up with and thought of some counter points: - If it is for protection, then whats protecting the data? - Is there an automated system to convict people? - If so, would you put trust in a system with a high rate of failure?

The format of the debate itself was a bit odd. It started off with both sides giving their main arguments forward then a small break for each side to prepare a rebuttal. After a couple rounds of rebuttal the debate quickly turned both sides just talking about the subject not necessarily having a debate. However the quick points going back and forth were quite good for the discussion.

The main points that the for side put across were that: - It protects everyone from potential terror threats - It allows for faster access to the data rather than have it spread over private companies networks - It prevents people attempting to cheat the system (With regard to the facial recognition of train travel proposed in the readings)

From this, me and my group were able to give counter points to each of these arguments, namely that:  - If it is for people’s protection then who is going to get charged? Will an automated system trawl through the data to find potential threats and convict them based on this? If so, how will the large failure rate of such a system which has been recorded affect this? - All the data being in one database leads to a single point of failure. Once someone has managed to get into that database then the data is out there for everyone - To prevent cheating the system, what if religion and other beliefs prevent the exposure of faces  (Again regarding train transport)

As I stated, this then changed to a discussion rather than a debate but many good points got brought to attention. Myself a two other members to the group were mainly active in this section of the “debate” and as I stated previously; this got me to change my mind on the subject. I was originally on the fence but leaning more towards the side of acceptance because I did not have anything to hide so why should I bother. The point that hit me the most in my mind was the fact that this data could be used in the same way that the precogs functioned in the file Minority Report. That is that based on the data that has been collected, interactions with others and extrapolations from all the available data, it could be calculated an individuals possible threat to the government and society as a whole. This idea could be modified in any way possible. Seeing as your data is closely linked to who you are and your identity as a person, knowing this data could be used to target the individual for various things. As said above; criminal possibility, targeted ads, social segregation.

All this power in one point can lead to corruption, just like the well known quote “absolute power corrupts absolutely.” Corruption of the government is a gateway into so many issues that many science fiction novels and films explore. The formation of a massive police state where everything is monitored and everyone is made to conform to a certain norm is just one of the things that could happen. This loops the idea back around to the start when I said that privacy is a basic right because privacy and freedom are closely linked. In a state where one entity controls everything it leads to the loss of individuality and in turn freedom. So this chain of thought is one that really stuck to me, even if it is a bit obscure and outlandish. The possibility is still there.

Another large issue that resonated with me was the storage of all the data that is being potentially collected. The government does not currently have the infrastructure to house all this data currently. More facilities can be build however with the government messing up a vital project such as the NBN, I do not trust the government to do something that could be so volatile. If not the government then they could outsource the storage to private companies. However this introduces other problems to the mix. Namely now that the data is in under the control of private companies, whats to stop those companies using the data themselves or selling it to someone who wants to use it? Increasing the links in a chain only to have some of those links rotten and rusted does not increase the strength of the chain.

At the end of it all, when I once had the view of acceptance in the collection and use of data by the government, I now have the opposite view. Everyone should be entitled to their own data and privacy, period. Having so much power and knowledge in one place can only lead to disaster.

[pkasjan-blog]

Looking at my data

I recently downloaded the data that google and Facebook had on my and I must say that I am surprised with what I got. Not in the sense that most people would be, but I am surprised at how little information they have on me. I think that compared to other people I have supplied very little of my personal information on these social networking sites and search sites so I guess I should not be surprised with the findings.

First looking at Facebook. I knew that all the items that I have posted on Facebook would be there to look at but what I was more interested in was the logging portion of the data. It keeps records of ads interacted with, search history, location and security. The ad portion was interesting. It had kept a record of my interests and interest groups and then from that recommended the ads most suited to me. But personally I have to say that the ads on Facebook and other websites do nothing to sway me to buy their products. Search history was pretty self explanatory but one thing that I noted was that it did not store the items that I had deleted. So on looking at this I went and deleted all my search history, even though they probably do have it stored somewhere. Location was the most interesting one in this area. I thought Facebook would have tracked the IP addresses that I had accessed it from and make a dictionary with this but when I looked at it, it was empty. Perhaps the locations I am thinking of are found in another area. Lastly the security part was a bit of an eye opener. It logged all the times I had logged into Facebook, the cookie that I had and the IP of the place I logged in from. I guess this is where the location I was talking about earlier could be surmised from. All the other data as I said, I know that Facebook would keep. All the posts, likes and photos I put on the site knowing that Facebook would keep them.

Moving onto the Google information this I was again surprised at the small amount of data they kept on me, or more of that I supplied them. Because I use my google account to connect to my phone and other devices, I was interested to see that Google keeps all the configuration data of those devices. I’m not too sure what this kind of information could do, but I think its more for their product enhancement purposes. Google also kept a record of all the individuals I have emailed over the 5 years that I had this account, and because I use this account for “proper” purposes, a lot of these contacts were employees and the university. I am not too shocked that these things were stored, more just interested that it went back so far; pretty much to the creation of my account. One aspect of the Google data that I was quite surprised about is the locations or map data. There was nothing there. I would have thought it tracked all the placed I tried to go to using Google maps and from that tracked the places I visited. Instead the file was empty but one thing that was kept was the map search history. Again, search history is pretty standard so I knew this would have shown up. I never supplied more than the necessary information to the system so the profile that it had for me was pretty bare. All of my YouTube search and watch history was in the data package along with the channels I had subscribed to. This I never really thought of but I know YouTube is owned by Google so it was only natural this would be in there. It was more amusing than surprising. What concerned me probably the most was that all the emails I had sent from the account were saved in the data. Emails back from when I first created the account and was looking for some work in aviation were there. The mail portion also constituted the majority of the size for the data so I guess that was where everything was.

So all in all, I was mostly surprised at the information that these sites don’t have on me. I stopped updating things like Facebook with my personal data a few years ago, so things like where I work, where I study and other things that people don’t need to know are not there. I guess that is why a lot of information is not there, because unlike other people, I try to keep my life off the internet. The things that I knew would be kept by these sites are there; likes, posts, messages, all those kind of things so that was pretty standard. Now that I have started using a VPN, the things that I was concerned about will now start to not be logged. I know that you cannot get rid of this data, whats done is done. But I can improve what I am to do from now on and that is what I am hoping to do.

[pkasjan-blog]

Notes on Chernobyl

Summary of events: All happened because a test was being conducted reactor. The test wanted to find out if the time between power loss and backup generator kick in could be bridged by the turbine winding down. This would stop a 60 second window where no coolant was being pumped into the core

Another power station went offline so the reduction in power output from reactor 4 in preparation for the test was postponed

During this, further preparation for the test not relying on reactor output were conducted, like shutting down the emergency core cooling system (ECCS). This provides water to the core in the event of a loss of coolant event

Test go ahead 10 hours after it was scheduled to happen. Day teams were gone, evening teams were about to go and night team was not fully prepared for the test

Production of xenon 135 caused the output to drop to near shutdown levels

In order to counteract this, control rods were raised to increase the power output

Reactor poisoning kept continuing so more control rods were raised until all but 18 of the 211 rods were fully raised. A minimum of 28 of them were meant to be inserted at all times

Extra pumps were activated which increased coolant flow through the core and raised inlet temperatures because the coolant had less time to cool in the condenser. This temp was close to the nucleate boiling temp of water

Steam pressure in the separator reduced triggering an alarm, decreased reactor temp and power due to water absorbing some of the neutrons so operators turned off two pumps  

This lead to an unstable reactor configuration going into the test that was to be conducted. Automatic and passive safety features were disabled to keep the power level up but the control rods could still be lowered if the scram was activated

Test started with 4 pumps active. Steam to the turbines was shut off to mimic a power failure. Diesel generators started but needed time to wind up, turbine was meant to pick up the slack in this time frame which was what the test was for

The turbines wound down and decreased power to the pumps so the water flow to the reactor decreased, increasing the amount of bubbles or steam voids in the reactor

Reactor designed had a positive void coefficient so voids caused more reaction which caused more heat which caused more voids. Potential spiral was counteracted by the automatic system lowering more rods in but this system was disabled previously.

As temps kept increasing the scram was pressed and the control rods started being inserted into the reactor. This however took 20 seconds to fully insert

The design of the rods had a water displacement rod attached to the end which increases reactor output when the rods were extended. Initial scram action caused the water that was helping control the reaction to be displaced and a spike in temperature

The spike caused the core to overheat and some fuel rods crack, blocking the control rods and preventing further insertion. They were stuck at 1/3

Increased temperature from that point caused increased steam buildup and steam pressure. This caused the fuel containers to break further and the fuel coming into contact with the coolant and rupturing the channels they were held

This caused a further heat up of the coolant as the fuel and coolant mixed and more steam produced. Steam build up so much pressure that it exploded, causing the upper plate of the reactor assembly to shoot through the roof of the containment building

Steam explosion destroyed the fuel containers even more and cut off the coolant supply which made the remaining coolant in the reactor to turn to steam and escape the area

Seconds after the first explosion, another larger one happened which fully dispersed the core (stopping the reaction), compromised the casing even more and ejected super heated graphite moderator out of the building

The ejected graphite and remnants of the core caught on fire on exposure to oxygen and caused even more radiation to be released

Fire teams sent to contain the fires were not notified of a destroyed core so they did not use protection. Radiation detectors overflowed and caused low readings to be displayed so the extent of the damage to outside viewers was not known properly

In the initial report published in 1986, the primary blame was put to the plant operators; attributing the entire accident to human factors. How typical. A different report later published in 1992 after the KGB declassified documents relating to the accident attributed it to the design of the reactor itself. I believe that the problem lies with both these areas and with the management of the plant itself. The dangerous configurations that the plant was operating at during the time of the test did not help the situation, but it did not cause it either. The fact that the reactor was build with many flaws including a positive void coefficient of reactivity and counter intuitive control rod designs was a large portion of the problem, however the plant had been running previously with no problems before that point. It was a combination of these areas that led to the accident. This is where the problems with the management comes in. The design flaws that spurred the accident were known to the authorities previous to the accident. It had been know that the formation of steam voids could produce a spiral reaction that could destroy the reactor itself but it was deemed null by automatic safety features that could prevent such a thing happening.  It had been recorded that inserting the control rods initially caused the power output to increase but the view was that the effects of this would never cause any problems. The officials who did know this did not actually communicate so to the operators of the plant. So the people who were actively controlling the plant were oblivious to these design flaws. If they had known about such things, would they have operated the plant with such low safety margins? Who knows? Its too easy to point out the problems in hind sight but in the moment, making the right decision is hard. So the combination of the actions taken by the operators of the plant at the time, the design of the plant itself and the lack of information passed from the managers caused the accident of Chernobyl in 1986

[pkasjan-blog]

Looking at Cases

Looking around on the internet, it is easy to find cases of burglar alarms, and thus motion sensors, functioning properly and notifying of intrusions. I have read of many news articles that state people have been charged due to the direct response of motion detectors. They sense intruders, the alarm system sends a signal to a monitoring base, the people at the base then notify the home owners who advise to send the police and the police arrive to have the intruders apprehended or they flee.

This is the case with a burglary that happened in Milton; police were sent to a home after the burglar alarm was tripped. After ascertaining there was still people inside the premises, backup was called and the house was stormed. The intruders then fled and escaped but were injured in the process. Police managed to track down the perpetrators as they checked into a hospital and the stolen goods were recovered.

This is the story with most of the instances of break ins. Similarly Penarth, a duo of men broke into a cafe through brute force methods (a crowbar to the door). Once the alarm was triggered the two were seen fleeing the scene with no trace of them found afterwards. The only item stolen was a mobile phone. So the alarm system as a whole functioned perfectly and this example displays what I said earlier; that alarms and motion sensors are a notification method and not a prevention method. I do believe that without the implementation of the technologies that much more than the mobile phone would have been stolen and more property damaged.

The two cases also show the difference between two modes of function for the systems; active and silent. The active alarm still sends the signals in the event of an activation but also generates the alarm sound at the place of activation to draw attention to the act. This is what the second example is; having the two perpetrators flee after the activation for fear of being caught. The other mode, silent is most commonly employed in places like banks where the alarm is triggered but the alarm sounds are not present. This allows for the capture of the intruders and the recovery of stolen goods, but is reliant on time for a response team to arrive. In the case of the first example; the intruders were caught and everything was recovered. However there could have been a situation where speed was prioritized and before the response arrived, the intruders fled with the stolen goods. This was also one of the downsides of a notification system that I outlined previously.

The last example that I wanted to highlight does not necessarily hinge on the working of an alarm system, more of what one can do to supplement existing systems. In the city of Sammamish a home was broken into and $50,000 worth of possessions were stolen. The home had an existing CCTV system designed to identify intruders, however the main power line coming into the house and phone lines were cut at the beginning of the robbery. Once this happened the camera system was totally useless and did not notify anyone of the intruders. What this highlights for physical security systems is the need for redundant and backup systems in place in the event of smarter people trying to circumvent them. In the earlier examples, it could be inferred that the attackers were not necessarily the smartest as they utilized brute force to get in. The latter had some knowledge in how the systems worked and thus manages to circumvent one aspect. The fact that some attackers are smarter that others should not and does not give them a free pass to take what they want. Therefore having backups with backups is the best way to ensure that one compromised system does not break everything down.

Some examples of these ideas put to practice would include the dual and tri technology PIR sensors that were previously outlined in another post. These devices overcome some of the short comings of any one technology with another and so ensures a more accurate system in total. Within the alarm systems themselves, backup batteries are incorporated into the control panel. This keeps the system up and running for a short time in the event of someone cutting the power cable like in the third example I went over. These are just some of the ways that redundancies can be implemented to prevent a single point of failure in an alarm system or home security in itself.

References: Pair indicted on charges for Milton break-in, (2019 July 9), from https://www.patriotledger.com/news/20190709/pair-indicted-on-charges-for-milton-break-in

Penarth cafe The Galley asks for public help after break in, (2019 July 4), from https://www.penarthtimes.co.uk/news/17743067.penarth-cafe-galley-asks-public-help-break/

Burglary shows why your home security system might not be the best line of defense, (2019, July 18), from https://fox43.com/2019/07/18/washington-burglary-shows-why-your-home-security-system-might-not-be-the-best-line-of-defense/

[pkasjan-blog]

Exploitation of Motion Detectors

Unfortunately no system is without its flaws. I pointed out some of the problems with motion detectors in the previous post, but how can some of those be exploited? Some items I am about to go over are to do with the problems, some are to do with the alarm system as a whole and others are about people’s reactions to the systems. Here are some ways you can exploit motion detectors.

Generally the objective of exploiting a motion detector is getting past the detection area without it noticing your presence. When employed in burglar alarms, this could lead to unwanted persons getting access to your premises and the violation of your personal security. Basically they protect areas that you do not want people going into while the alarm is active. And so the circumvention of the detection devices could be catastrophic to both a business or a family. That being said, there are some relatively easy exploits that people can do to the system.

The most common type of sensors would be the PIR sensor. A very simple way of getting around these types would be to reduce the IR signature that you produce. Now you don’t need to have superpowers to lower your body temperature to levels that would kill you, merely an object that can mask it. From the perspective of the sensor, if you are hiding behind something with the same heat signature as the environment then its as if you are not there. There are caveats to this technique; the object or material that you use to mask yourself with, the speed at which you move and the path you take. Utilizing anything to obscure your heat would not necessarily work, as the material is prone to heating up itself from its contact. While I have not tested it out, I have theorized the use of Styrofoam as adequate. This material has a lower thermal conductivity index that others and is generally thicker that most possible materials. This would mean that the rate at which it is heated in contact is lower that a thinner material. Second variable is the speed of movement. The sensor is calibrated to detect a larger difference of IR over a smaller time so moving a bit slower could assist in navigating the range without triggering it. Lastly is the route taken which is a factor as the sensor utilizes the environment as a base for detection. If something of a lower IR signature was to pass in front of something of a higher one, than motion will still be detected in that situation. Additionally, it was stated that PIRs have a range of about 6m, after which error is increased. Therefore moving through the furthest path would reduce the chance of detection. That is how you can mask yourself against PIR sensors.

Another possible exploit is in relation to a solution to a previous problem. I stated previously that pet friendly sensors solved the issue of having pets trigger alarms bit this could work in favor of an attacker. The pet friendly sensors generally do not prevent detection if the creature is above 35kg however there have been instances where larger creatures go without detection. This could be taken to the extreme of having a human crawling through the field of vision not being detected as the sensor believes it to be a pet. again this is not the most reliable method of circumvention but any method that involves moving through the detectors field of vision without outright disabling the detector itself is hit and miss. Combining this with the previous methods of heat masking, moving slower and moving as far from the sensor as possible would yield the best possibility of exploitation.

Those were some exploits for PIR sensors, however ultrasonic detectors are employed and these themselves have different exploits. Introducing a masking sound to the environment is one way you can exploit these sensors. Placing one or more devices that emit sound in the same frequency band as the detector would prevent proper activation. While this could initially cause the sensor to trigger an alarm condition, after the sensor has readjusted to the environment it would utilize sporadic input as the baseline. As such, moving through the field would not trigger an alarm after the first adjustment.

This kind of leads into the final exploit that I want to talk about. This one is not related to the hardware itself but a burglar system as a whole, with humans being part of that system. To get into this, it should be known the basic structure of the system in the event of an alarm condition. Many alarm systems are actively monitored with alarm conditions being sent to a monitoring center with certain protocols in that event. Standard procedure is to talk to the home owner and notify them of the condition, with further action taken on advisement to the customer. Each time the alarm system sends a signal to the monitoring center, a cost is incurred of a standard cellular call. Now to the exploit; if the system is purposefully triggered at intervals throughout an attack, the center will consistently get notifications of the event. It is possible that the respondent will advise the client to isolate the device that would be seen as malfunctioning to save on costs and prevent further disturbances. If this isolation occurs then an alarm condition through that specific detector would be discarded and the system as a whole would not respond. So this way of mimicking a malfunctioning device can cause the owner of the system to shut down sections of the system, making the areas they were monitoring open to attack.

With all things being said and done, the motion detectors are part of a detection system, not a prevention system. It is always possible that attackers can purposefully trigger the system, attack what it is protecting and then get out before a response can be enacted. Unfortunately there have been times where this has happened and been reported on. This has lead to the discussion of the effectiveness and use of burglar systems as a whole and whether or not they are worth it entirely.

[pkasjan-blog]

Tutorial 6 Case Study

This case study had us look at the steps that we could take as the government in both the event that WW3 has broken out in the world and the preparation of such an event. In groups we had to list the top 10 actions to take that would protect Australia, given the general populace accepts it, the government has enough resources for it and it is physically possible.

1. Conscript people with the knowledge on cyber security to both increase our security defenses and help fight back. This one was not really on my original list when I did it within the tutorial but Ash brought it to everyone’s attention and it was a very good one. In the event of something happening a country will need all the human resources they need to defend and attack. This is no exception for a war including a large host of cyber related attacks. So the more people defending the country the better.

2. Ensure the security council is not compromised. This is a bit of a simple on but you would want to ensure that the people leading the operations are not working for the other side.

3. Add layers of physical security to major essential systems within the country. This is mainly aimed at something like the power network of Australia that provides a utility to all citizens of the country. If the entire network was controlled remotely then that could get hacked into and the system shutdown. Adding at least one layer of physical security would meant that this action could not take place; as one would be needing to go the the power plants themselves to deactivate them. Along the same vein, better security to power plants and the like to prevent unauthorized access to the site would be needed.

4. Implement an AI that monitors major systems for possible intrusions. This suggestion is a bit of a weird one as the AI itself could get compromised, however if you have something constantly monitoring for intrusions into a computer system then the likelihood that someone could get into the system is reduced.

5. Implement training programs in the field of security. This is in the same line of thinking of the first point. The more people that have knowledge in the field, the more that can help out and the better the country would be.

6. Dedicate resources to increasing the security of public and private systems. This would be increasing the security on private and public companies that contribute to the economic standing of the country so they would be harder to attack. Resources could be distributed on a basis of importance, so the more important the system is, the more resources they get.

7. Mandatory military service for citizens. Countries do implement this idea and if Australia were to do this in the lead up to a war then the need to train more people would be reduced because everyone would already be trained.

8. Country wide surveillance to analyze potential threats within Australia. This one would be a slight breach of privacy, however the spec said that the public would accept the actions. So having a police state would for sure reduce the amount of threats from within the country but at the cost of possible civil unrest.

9. Ensure the public is trained for emergencies and each household has a “go bag” of sorts with emergency supplies. This is in a similar area to air raid drills that were taught in WW2. If you have everyone ready for the worst then the amount of casualties in an attack would be reduced significantly.

10. Insert moles in various countries. Espionage even in a modern war would be invaluable so this one is a bit of a no-brainer.

Obviously there are many different things that could be implemented but the are some of the ones that the group I was in thought were important in the even of a war.

[pkasjan-blog]

Tutorial 6 Preparation

The thing about attacks relating to computer systems and the internet is that the possibilities are endless. If the action is completed by a computational system then it can be compromised. Some things that I thought of that would have a drastic effect on not just the front line of the war but the society of the countries are:

- Disrupting the economical state of the country. Things like changing stocks, deleting bank records, transferring money out of ordinary people’s accounts, etc.

- Causing chaos within the country. This could be as small as disrupting the control of traffic lights and causing citywide accidents/shutting down road networks to shutting off power distribution from power plants and leaving large areas shrouded in darkness.

- Disabling the hardware of the country on the front lines. A lot of modern weapons used rely on having some sort of microprocessor to either control the weapon itself or assist in targeting. Most notably, drones could be hacked and used against the forces as they are piloted remotely anyways.

- Distributing propaganda to the entirety of a country through means of the internet. This day and age, the internet can be used for propaganda very easily. This has been seen through people being converted to terrorist organizations like ISIS and carrying out terrorist acts within the country, without ever have had direct contact with the groups themselves. The threat from within is always prevalent in war.

These are just a few of the computer and internet related attacks that I could think of. Again there are so many things that this could effect.

[pkasjan-blog]

Problems with Motion Detectors

I previously outlined the means of operation behind three common types of motion sensors. Obviously no system is without its flaws, so here I will discuss some problems withe the devices and some solutions to them.

Starting with the most common of the sensor types, PIR sensors have quite a few problems associated with them. While these problems may not be with the sensor itself but its interaction with the alarm system as a whole, it is still not the intended use of the device. That is that false activation of the systems occurs relatively frequently. PIR sensors generally have an effective range of 6m, with more expensive variants increasing to range slightly. They are unable however to offer the same range as a typical camera. Being a passive sensor that monitors the change in IR being emitted from the environment at all times, smaller creatures such as bugs and pets or even passing vehicles and tree branches can cause an error. The main area that the device is installed into is up high, possibly in the corner of a room to get the best field of view. Unfortunately this area is prime real estate for spiders and other bugs, and the former do utilize the device casing as a home frequently. Pets roaming around a house are also able to set the device off as with tree branches on a windy day. Additionally if the sensor is placed in an area overlooking a heat source such as a fireplace or heater vent, these could trigger a false alarm. Lastly, certain models of PIR sensors are wireless and as such are prone to flat batteries is the system is not maintained enough.

Many of these problems can be fixed with proper positioning of the sensors during installation. This ensures that no background factors interfere with the normal operation of the system. Regular maintenance and cleaning will prevent a build up of bugs/spider webs and also prevent the failure due to loss of power. The problem of pets activating the sensors can be reduced with the use of pet friendly PIR sensors. These special variants provide additionally hardware to effectively lift up the floor for the sensors, preventing activation from animals generally under the weight of 35kg. This however will not prevent false alarms if the pet likes to climb onto furniture like cats do.

The other types of sensors have similar problems as a PIR sensor does. Microwave and Ultrasound suffer from the movement of small animals, bugs and external movement with the caveat that they are more sensitive than PIR. That is due to the change in reflected wave profile being easier to detect with sound and microwaves. To compensate, many of these types of sensors incorporate an ability to set a desire level of sensitivity.

PIR sensors have an additional problem that at higher ambient temperatures the sensor is less sensitive as it is harder to determine a change in IR emitted by an object as it passes through its field. Conversely, at lower ambient temperatures, the sensor is more sensitive because a higher heat signature will be more significant against a lower environment. To counteract these type one and two errors, companies have developed dual sensor or even tri-sensor technologies. Dual sensor detectors utilize both PIR and microwave sensors. An alarm condition will only be triggered if both sensors detect movement in the area so it evens out the errors produces in any single sensor. Tri-sensor technologies employ the use of thermometers that detect the ambient temperature and adjust the sensitivity of the PIR sensor accordingly. A lux sensor is also incorporated to change sensitivity between day and night to give the best all around detection environment for the time of day and year.

These were the main problems associated with infrared detecting and wave detecting motion sensors. Many of them are to do with the environment that the sensor is deployed in and others are tied with the level of sensitivity inherent in the sensor itself. While the steps stated help to reduce the amount of errors in the system as a whole, there are still ways that the sensors can be fooled and circumvented. This I will go into next post.

[pkasjan-blog]

Physical Security Detectors

Motion detectors are generally overlooked these days when it comes to physical security. They are often passed up in lieu of their more capable and robust brothers; the camera. Modern day cameras are incredible versatile; offering motion recording, number detection and even facial recognition. These systems however come at a great cost, and that is where the family of motion detectors come in.

Motion detectors provide an effective and low cost alternative to cameras in areas that are not needed to be actively monitored. They are also used in installations that are relatively minor, such as lighting controllers and doorbells. The first use widespread use of motion sensors was in burglar alarms in the 1950s. The motion sensing element would trigger a relay when the motion was detected and activate a siren to deter burglars. This idea is still used today, although the system is much more refined and the sensors themselves have become more sensitive.

The motion sensing element itself differs on the type of sensor. The most common used is know as a passive infrared sensor or PIR. This type utilizes two elements that are infrared sensitive materials sitting next to each other, directed through a lens which increases the detection range. These two sensors monitor the infrared in ambient environment and both detect the same amount. When a body that has a different infrared signature to the environment passes by one of the sensing elements it creates a positive differential change between the two elements and then a negative change when it leaves the detection area. This change in signal is then converted to an electrical signal that can be used to activate a circuit. Typical PIR sensors have a range of 6 meters but this can be increased by utilizing different lenses and encasing the elements in a temperature, humidity and noise controlled casing.

Another type is the microwave detector that functions in a similar fashion to a police radar gun. Microwaves are continuously emitted from the sensor and are reflected back towards the origin. Any disturbance in the microwave field such as an entity moving through the area are detected because there is a phase shift in the received microwaves, and similarly to the PIR, an electrical circuit is activated which is interpreted in the controller. Ultrasonic sensor use the same principle in their operation. A shift in the phase of an emitted wave is detected, however as the name implies, the ultrasonic sensor utilizes sound waves as the means of detection.

This is the basis of operation of most types of motion sensors. They do not require any software to run unlike cameras and as such are easily able to be installed plus maintained. These devices however are not without their drawbacks. The very nature of their sensitivity leads to many problems and these I shall discuss in my next post.

[pkasjan-blog]

Week 4 Tutorial

Within this tutorial we had to do a practice exam question that involved analyzing a situation and giving the best security recommendations.

The situation that was presented was that Google is about to begin work on a new secret project located near UNSW. The task given to everyone was to look into the physical security aspects of such a project while giving the major areas that need protection and naming 3 primary features that would be implemented.

The first thing that should be done is to look at the scope of the problem itself, which is only looking into the physical aspect of the security. Things like network and data security are not a main concern. Under this scope I wonder if employee health would factor as a possible security concern. The possibility of a person becoming corrupted is always present in situations that invoke people, human nature cannot be avoided, and so would it be a concern of physical security. I will have to as my tutor about this next week.

So onto the main areas that would need to be protected I would have to name these:

-- The integrity of the project being secretive as a whole The reason that this would be something to protect is that the less people that know about the project, the better. Once an outsider finds out about the fact that Google is conducting a secret project would drive more people to assault the premises containing the project. Anonymity would be a great defense.

-- Physical documents, hard drives, prototypes, etc produced by project This point is tied to the precious one in that the less people that know about it, the better. Additionally any documents that are found missing could leek important information regarding the project and possibly damage the integrity of the project as a whole. Tight measures would be implemented to ensure physical evidence relating to the project is not released outside the facility.

-- The people working on the project The threat of an inside man is always prevalent when both secrecy and people are involved. Having someone compromised will severely effect the security of the building as a whole. The main reasons that people become compromised are money and satisfaction. Therefore I propose that all persons working on the project be adequately remunerated for their work and are at all times satisfied with their work on the project. A happy workforce is not one that will readily turn to the other side.

-- The anonymity of the facility as a whole It is said that the project is to be conducted in the area around UNSW, and for this I assume it would be going into an already existing building. Therefore protecting what people think is in the building would be a large concern. A fake shopfront or reception desk would draw suspicion away from people thinking that a secret project is underway in the building. 

A lot of my points direct towards the aspect that the secret project should remain secret. I believe this to be a form of security itself. Obviously security through obscurity is not the only form of physical security in the facility and the features that would be implemented to assist in the greater picture are as follows:

-- Access control including bio-metric scanners,  ID badges/fingerprint profiles and password keypads This would prevent people attempting to access areas where they do not have authority to access and also stop people entering the premises altogether if they are outsiders. A two or even three factor authentication would be used on entry; needing an ID badge, bio-metric scanner and possible retinal scanners to verify identity.

-- A dedicated guard force that works during hours of operation Guards would provide an additional layer of security that is not mechanical. Cameras can be fooled but a well trained and committed guard cannot pass up certain potential breaches. Hours of operation would be strictly adhered to with no exceptions be made to people wishing to break them. Minimizing the night time hours of operation would keep the guards alert and ready at all times.

-- Lock-down protocols on unauthorized access or item removal Upon detection of an unauthorized access outside operation hours or the removal of items described in a previous point, the entrances  and exits would be locked down to prevent exit. The authorities would be alerted and the lock-down could only be released by administrators. This would ensure that the items are not removed and attackers trying to sneak in could not leave the premises.

This was just my ideas and in discussion with the small groups we formed to mark this, many other ideas were put forward. Unfortunately there were too many for me to remember except for the outlandish ones. Someone suggested trapdoors and shark pools to dispose of intruders. This I thought encroached on James Bond villain territory, but it was a nice respite.

[pkasjan-blog]

Something Awesome Concept

Motivation

I have always been fascinated with the concept of physical security. Whether it is creating an unbreakable safe, an inpenetrable compound or just protecting a family from home invaders. I have spent hours in various video games attempting to create the most secure facility within the simulation. A large portion of this idea lies within security systems or intrusion detection systems. It is an area that is often thought of as trivial and easily bypassable. I wish to look into this area more closely.

What to do

My idea it to reasearch various areas in relation to intrusion detection systems. Advances over the years, theory behind how it works, how to fool or bypass such systems and cases studies on the subject. Every week I will research a different area and create a report on it.

Roadmap

Credit:

At least one post per week

Basic analysis of the concepts

Distinction :

Occasional doubke posts perr week

Well thought analysis

A couple case studies looked at

High distinction:

Many posts over the research period

High level analysis

Multiple case studies both for and against the systems