democapitalis-blog

[democapitalis-blog]

Drone delivery service - Security Everywhere Wk08

A recent article in ABC news has talked about Wings, a drone delivery company that is a subsidiary of Google. This has led me to write this post on delivery drones.

It is extremely likely that in the future, smaller and lighter items will all be delivered through a drone service to reduce the time required for delivery and the personnel needed. However, the use of drones can cause many issues. In the circumstance that someone hacks the drone or intercepts the wireless command signals and sends their own command signals to the drone (man in the middle), then the company will have little way of knowing that the parcel was intercepted and not delivered to the right address.

In this case, the actual purchaser of the item would not receive the item and most likely complain to the company. However the company will have a record of the drone delivering the item to the location. In this circumstance, who would be held responsible, since there is very little evidence for either side to prove their case. The biggest winner would the person who intercepted the drone.

Another issue would be the situation where the delivery drone has delivered the item but no one is home to collect it. Would the drone then deliver the item to the post office or a different collection point? If they do not and leave the item outside, what is stopping people from taking it. Furthermore there is no evidence to prove that someone took it.

Most collection points such as post offices are located inside shopping centres. Would it be expected for the drone to carry the parcel and fly into the shopping centre? That sort of situation could cause many issues, hitting people and being a public nuisance.

A less likely possibility but one that still happens is a GPS glitch or weak signal due to bad weather conditions. This could potentially lead to the drone delivering the item to the wrong address assuming it to be the right one because the GPS pointer has glitched a bit in a different direction.

At the moment there are still many problems with the drone delivery service that need to be addressed. I feel that most importantly, there has to be some failsafe to protect drones from being hacked or commands being intercepted leading drones delivering to the wrong location.

[democapitalis-blog]

Stargate Ghost problem - Case Study Wk08

So the case study this week was the stargate ghost problem. Since I was not at the night time lecture (reasons mentioned in previous blogs), I will go off the summary that Hugh posted on open learning.

“The Stargate problem is the scenario when you have a group of military people standing outside a Stargate to another dimension/reality/univerise/whatever (irrelevant). One of the brave young cadets volunteers to walk through the portal and ends up in this fantastic universe, full of beautiful, charismatic aliens. One of the aliens asks if he can join the cadet back into his universe. The cadet agrees. When they walk back into the Earth universe, the cadet disintegrates and becomes a ghost. The alien can however see and hear the ghost, but no living thing on Earth can either see or hear the ghost of the young cadet. How can one ensure that the ghost can communicate legitimately through the alien, with the people of Earth?”

The first thing that comes to mind would be the use of public private keys. Even under the assumption that alien A is questionable, Major M and invisible man X will still be able to determine whether what they are communicating with each other has been tampered and can rest assured that A will not be able to understand what they are saying.

Simply both X and M work out their own public and private keys, then give each other the public key. To ensure integrity and authenticity, they should encrypt the message first with their private key and then the other person’s public key. This ensures that the message has not been tampered with and that the alien cannot decrypt the message.

[democapitalis-blog]

Lecture Reflection - Wk08

This week we looked at errors, especially human error. We focused a lot on the fact that human attention is extremely limited and when looking at systems, we tend to focus on a few things and selectively ignore everything else that can possibly go wrong.

Furthermore Richard talked about human behavioural patterns and how it was more likely for people to believe that events that they are familiar with are more likely to happen purely because the fact that it happened in the past makes it feel more likely to happen again in the future.

Human behavioural patterns focuses a lot on frequency gambling, we stick with what we know and tend to ignore what we do not and hope that the chance of something we do not know going wrong is low. For accidents, the chances of that happening is possible, but in the case of an attack, probability is useless as the attacker will definitely go for the weakest point.

[democapitalis-blog]

Something Awesome Final Summary Part 2

Now that I have talked about the various ciphers I researched, I will talk about the programs I wrote.

Some information on different classes of ciphers:

Transposition ciphers - only permute the position of letters in a message. Includes columnar, railfence, route

Monoalphabetic substitution ciphers - each letter is replaced with another letter. This includes caesar, affine, substitution

Polyalphabetic substitution ciphers - different alphabets are used to encrypt the message. Includes vigenere

Coincidence index - the coincidence index is used to determine the composition of the letter in an encrypted message compared to that of plain text. It can be used to narrow down the possible classes of ciphers used to encrypt a message. The coincidence index (IC) of english is 1.73. If a transposition cipher was used, the the index of the encrypted message will not deviate much from that value. The IC for mono ciphers are much lower. For poly ciphers, there should be a large spike in IC for the correct period compared to the average IC (period means taking every second/third/fourth ... letter and finding the IC of that string)

Detect english - a program was also made to determine the number of words in a sentence/paragraph that was actually english. The program determined that as long as 80% of the words could be found in the english dictionary, then the sentence was english. This is because proper nouns do not exist in the dictionary but can occur in sentences.

Caesar cipher - instead of directly brute forcing the caesar cipher, I found the most common letter in the encryption and mapped that to “etaoinshrdlcumwfgypbvkjxqz” in that order (most common to least common) which should reduce the brute forcing time needed. Could have improved the frequency analysis used here but deemed it unnecessary.

Transposition cipher - as I mentioned this was for the columnar transposition cipher and was done through brute force method

Affine cipher - once again a brute force method. However it does take much longer to brute force compared to caesar and columar transposition.

Vigenere cipher - used kasiski’s method to find the possible keyword lengths (periods) and then determined the actual period. Used a certain form of frequency analysis to determine which letters were the most likely to be the keys for the multiple caesar ciphers. Then it was simply brute forcing all possible keys with all possible periods, from most likely to least likely until an english message was found.

Frequency analysis - this is not a completely legitimate frequency analysis as it only compares the 6 most common and 6 most uncommon letters. For every letter found in the right place, a higher score is given. The idea was taken off a website.

[democapitalis-blog]

Something Awesome Final Summary Pt 1

Only two days left until the something awesome project is due and I doubt that there is enough time left to complete a program to crack substiution ciphers or find collisions for MD5. Hence I decided to instead write a final recap of everything I have learnt and achieved for my something awesome project.

So what was my something awesome project: it was to write a program in python (emphasis on python because it is a new language to me and I had to spend time to learn it) to crack various encryption methods.

The marking criteria: 

Pass - write a program to crack caesar cipher

Credit - on top of pass, write a program to crack transposition cipher or another cipher

Distinction - to improve the one of the programs so that cracking the encryption will be at a faster time complexity than brute force time

High Distinction - writing a program to crack a modern cipher

Research:

Caesar cipher - is one of the easiest methods of encryption where every letter in the message is shifted a certain number of letters down the alphabet. Each letter is shifted the same amount. This means that in total there are only 26 possible keys to encrypt the message by (since the english alphabet only has 26 letters, there can only be a maximum of 26 different shifts including not shifting at all). This makes it extremely easy to brute force since only 26 different possibilities need to be brute forced.

Transposition cipher - another quite easy method of encryption where the message is simply jumbled by a certain pattern. There are many different types of transposition ciphers, all with different methods of jumbling the letters of the message. Without knowing the exact type of transposition cipher used, brute forcing the cipher will still work but will take an extremely long period of time since it involves all possible combinations of the letters making up the message. The longer the message, the longer it will take. I focused on the columnar transposition cipher. With the columnar transposition cipher, the message is written out in a table row by row and the key is the number of rows (or potentially columns) that exist. The message is encrypted by printing the characters in the table column by column, effectively jumbling up the message. This means that the longer the message, the more possible keys there are as more columns can be used.

Substitution cipher - a caesar cipher is a subset of the substitution cipher. With the substitution cipher, every letter in the alphabet is mapped to another letter in the alphabet randomly, but two letters cannot be mapped to the same letter. The message is then encrypted using these mapped letters. It is still possible to brute force a substitution cipher but extremely short messages are extremely hard to brute force as multiple decryptions may all be possible. The longer the message, the easier it becomes to decrypt a substitution cipher as frequency analysis can be used to roughly determine a range of letters that each letter is mapped to.

Affine cipher - the affine cipher is a bit like the substitution cipher, but instead of randomly mapping letters to each other, the affine cipher uses a mathematical formula to map letters to another letter. The formula is E(x) = (ax + b) mod m, where x is the letter number (alphabet numbered 1-26 respectively), m is 26 and a and b are the keys for encryption. The decryption method for the affine cipher is simply reversing the above formula where D(x) = c(x - b) mod m, where c is the modular multiplicative inverse of a. The interesting thing is the modular multiplicative inverse of a only exists of a and m are coprime. This means that a can only be a possible 12 different keys and b can be a total of 26 different keys (since there are 26 letters in the english alphabet). Altogether there are only 312 combinations for the affine cipher which can be easily brute forced.

Vigenere cipher - a vigenere cipher is a bit harder to explain. In a vigenere cipher, the alphabet is written 26 times to create a table. However, starting from the second row, every following row is shifted a certain number of columns compared to the row above it (similar to a caesar cipher). Hence a 26x26 table of letters is formed. We then allot the rows and columns a letter. Row 1 is A, row 2 is B and so on. Column 1 is A, column 2 is B and so on. Then a separate keyword is chosen (usually quite short). This keyword is repeated until the number of letters corresponds to the number of letter in the message to be encrypted. To encrypt the message, the first letter of the message and the first letter of the repeated keyword is taken. The letter corresponding to both these letters in the table made earlier is then the encrypted letter. Vigenere cipher is much harder to break using brute force. However there is a method called kasiski’s method which finds sets of repeating letters to determine the length of the keyword. It then separates the message to multiple phrases corresponding to each letter of the keyword, effectively turning it into brute forcing multiple caesar ciphers. This has made it much easier to break vigenere ciphers.

[democapitalis-blog]

Lecture Reflection - Wk07

This week during the lecture Richard talked about the Diffie Hellman key exchange and how it allowed two people from different sides of the world to send encrypted messages to each other and be able to decrypt them without having met before to decide on an encryption key beforehand.

Then we looked into some vulnerabilities: especially social engineering - no matter how strong the defenses of a system are, as long as humans are the ones making the decisions, then it is extremely vulnerable to social engineering. Other exploits we looked at include buffer overflow, memory corruption and format strings.

Then we looked at determining the importance of various assets and that it was important to understand what assets needed to be protected and what assets could be sacrificed. The idea is to focus on protecting the most valued assets and to sacrifice the less important ones if need be in order to protect the important ones.

[democapitalis-blog]

Something Awesome

So then newest update: I have managed to get a version of the code working to crack vigenere ciphers using the kasiski method. Furthermore also made a file to compute the coincidence index of the input message. 

Still working on my python.

Update from previous weeks I forgot to write about: changed from cracking a transposition cipher to cracking a columnar transposition cipher. This is simply because brute forcing a general transposition cipher took way too long and there was really no point.

In the last two days before the something awesome project is due, I will either attempt writing a program to crack substitution cipher or have a look at a program for MD5 collisions. Not sure if my knowledge in python is good enough for MD5 and not sure if I have enough time left.

[democapitalis-blog]

Snoop - Case Study Wk07

This week we debated privacy - whether government agencies should be able to collect and have access to all of a citizen’s data for good purposes or should citizens have a right to privacy which prevents this from happening.

Both sides seem to have their own arguments which are all valid and important in their own right. We shall first have a look at the argument pro government collecting and accessing data:

Allowing the government to do this would affectively allow the government to increase CCTV cameras for much more widespread coverage and to include biometric recognition systems within these cameras. At the same time all communications could possibly be monitored and everything that a person does can be tracked. This in effect puts the country under surveillance which can greatly increase the efficieny of police in capturing criminals, making it almost impossible to flee. At the same time, it also ensures that any criminal acts will definitely be seen and the perpetrator identified within seconds of the crime happening or even just before a crime happens. This threat will greatly reduce many would be criminals from acting. Furthermore it can catch anyone who is breaking the law at any time in any location and the appropriate sentence/fine can be passed down.

On the other hand, some people may be uncomfortable with being monitored 24/7 and with good reason. Everyone has secrets or activities they like doing in private. Being monitored all the time can greatly increase people’s stress and mental anxiety. Furthermore, even though the government agencies are using this gathered information to protect its citizens, certain individuals may misuse this information which can cause significant harm to others. Another point is that the amount of information may not even be able to be processed since the activity of everyone 24/7 is a huge amount of data to go through. Finally, I highly doubt that anyone knows all the laws in Australia and the exact requirements of each law. This makes it highly possible that an individual can break the law without themselves even knowing and hence can be penalised randomly.

Overall I do not like the idea of complete government control as it seems quite over the top and unnecessary. The losses greatly outweigh the gains in this situation, especially since additional information that is not timely will not have any great affect on the actions of the government. 

[democapitalis-blog]

Video Conferencing - Security Everywhere Wk07

Lifesize is a company that offers software similar to skype for business and is tailored for conferencing. With its software comes a set of hardware also manufactured by lifesize to complement the software during video calls and conference calls.

In February, a security researcher from security firm Trustwave found vulnerability to take over video conferencing tools made by lifesize. The flaw would allow for a command injection that would allow malicious users to access the support interface and execute commands on the operating system.

Last week a serious zero-day vulnerability for the zoom conferencing app on Macs was disclosed. The flaw would allow any website to open up a video call on any Mac with the zoom app installed. Zoom is another video conferencing company similar to Lifesize. 

Zoom and Lifesize are important video conferencing tools that many companies currently use to discuss important decisions between executives who are situated long distances from each other. Flaws in these conferencing tools could mean that many company secrets and executive level decisions could easily be intercepted. While it is impossible for there to be no flaws within these tools, it is important to pay more attention to discovering major weaknesses and consequently fixing them at an earlier stage.

Companies should also have a better understanding of the risks behind using video conferencing tools to discuss and confirm major decisions and the amount of sensitive information to be reviewed during conferences with video equipment.

[democapitalis-blog]

Escape Rooms - Security Everywhere Wk06

Extremely tired after my exam on saturday and just finished my assignment so I decided to do something a bit different for my security everywhere post this week. Went to an escape room with a couple of my friends on the weekend and had a great time doing one of the escape rooms.

Even thought the puzzles and challenges probably will never occur in real life, I find that they give great practice in problem solving, logical analysis and thinking outside the box - encouraging you to try new ideas to solve puzzles. I find these to be important traits for every security engineer and hence would like to say that doing escape rooms could potentially be constructive.

[democapitalis-blog]

Lecture Reflection - Wk06

This week’s lecture was quite awkward with Richard dialling in on skype. 

We revised initialisation vectors and how some designs are unsafe - the major example being WEP which we talked about in the previous week. Then the topic moved on to buffer overflows where Richard proceeded to give some anecdotes on buffer overflow examples.

The other important things that were talked about included modern ciphers and how, even though RSA is one of the more secure ciphers, it is not that regularly used and it is still the ciphers that were developed earlier that have greater uses.

A lot was also mentioned on authentication with many recent events and newer technologies allowing people to be able to fake videos and news extremely easily

[democapitalis-blog]

Warfare - Case Study Wk06

So this week we discussed the many ways countries could use cyber attacks to attack another country during wartime. Then we would decide some countermeasures to be put in place to reduce the damage caused by these attacks in the case of a war.

Some of the main uses of cyber attacks we decided on include:

- Intercepting communication within the military, relaying false messages through the enemy’s communication lines

- Remotely controlling enemy drone system or missile launch

- Destroying public infrastructure such as the electricity grid, financial systems

- False flag attacks

A few recommendations we came up with to counter these issues included: - a back up communications system: in the case of a war, communication within the military and being able to trust that communication system is extremely vital. As long as the military is stable and able to function properly with a chain of command, then there is a chance for retaliation and proper defense against invasion. A back up communication system can be used when the original one is compromised or destroyed

- each military unit, whether it be platoon or battalion will have a predefined set of orders to carry out in the case of complete loss of communications: in the case that a chain of command within the military cannot be established, this will at least ensure that the military is still able to respond and maintain order and discipline. Furthermore or units will have a certain understanding of what each other unit is currently doing and will able to unite with other units to establish a chain of command

- Many groups advocated to attempt to take public infrastructure off the grid: making it separate from the internet and hence would make it much more difficult for enemy nations to cripple the public infrastructure of the country. In this case the public would still be able to function as usual preventing loss of morale and economic or societal collapse and anarchy

[democapitalis-blog]

New updates

Once again I had an exam on saturday (second week in a row yay...) so the posts for this week will be tonight and tomorrow. Most likely I will only have time for lecture reflection, security everywhere and case study since I also have a comp assignment due next wednesday (1521 yay...).

Have slowed down a bit on the cryptograms but have done a few of the NSA cryptos instead of the puzzle baron ones - though they seem to have a lot more spelling mistakes and missing spaces.

Have not had the time to work on something awesome this week. I hope to be able to catch up next weekend once I have handed in my assignment and now that midsem exams are over.

[democapitalis-blog]

Apple Accounts - Security Everywhere Wk05

The security everywhere post for week 5 is slightly late due to the sec eng exam being on saturday which caused my timetable to change a bit. 

I would like to say that the Apple Icloud account along with the find my iphone software is seemingly quite secure. Once an Icloud account has been registered and signed in using that device, even if the apple device is wiped to a factory reset, the phone cannot be unlocked without entering the password for the Icloud account.

Furthermore, the Icloud login email is partially covered for added security. The only ways to unlock the iphone without knowing the icloud password would be to take the device to an apple store with a proof of purchase or have a reset password sent to the icloud account email which you need to type in.

However, having said that, sometimes, instead of sending the reset information to the email, it is sent as a text to the phone number attached with the account. Assuming that someone steals an iphone, chances are the sim card is still inside and it does not take much effort for someone to take the sim card out, put it into a different phone and find out what the phone number is. Furthermore I assume that they would have a method of brute forcing the email linked to the account. In this way, they can easily get the text message for password reset and find the corresponding email address for login at the same time.

[democapitalis-blog]

Updates

Improved my knowledge on python and potentially how to break substitution ciphers. Studied for the midsems. Turns out the midsem was actually quite hard except for the cryptogram. The many hours of puzzle baron paid off.

Forgot about this but also finished a program to crack affine ciphers. At the moment, it is extremely slow, so not sure how I’m going to demo it right now. The brute forcing takes forever.

[democapitalis-blog]

Lecture Reflection - Wk05

Revisited hashes and went into further detail on MD5, SHA1, SHA2 and SHA3. Listened to a talk by a guest speaker on social engineering and how companies are able to influence doctors to advertise and recommend their drugs by sponsoring lunches.

It can be seen that even though many doctors know that they are being “bribed”, they are happy to do so considering the free lunch that they are receiving and feel that it is ok to recommend the company’s drugs. It shows that social engineering does not have to be extremely subtle, depending on the personality of the person being interacted with.

[democapitalis-blog]

Self-driving cars - Case Study Wk05

This week we looked at the dangers of self driving cars and possible methods of alleviating these issues. We then went on to discuss the viability of self driving cars. This was from the perspective of the government and the company who is researching these cars.

For the government, the most important things were passenger safety and the ethics behind having the passenger’s location information continuously provided to the company operating the self driving cars. It was suggested that new roads be made to separate manually driven cars and self driving ones so that in the case of an accident, less individuals would be affected. Increased regulation and new laws would have to be drafted in regards to self driving cars.

For the company, the focus was to ensure that the system controlling the cars was not compromised. This included a back up routine that would control the car to pull over to the kerb and turn on its hazard lights in the event of a system failure. There would also be the option for the passenger inside the car to manually turn the car off and take over in the case that they felt that the car was not being operated in a safe manner. The system could log when the car was maunally overridden, and in the circumstance, any accidents that occurred would have nothing to do with the company and full responsibility would ride on the driver who did the manual override.