Auburn COMP5370 Computer and Network Security Exams 1, 2, 3 material
Overly Complicated Ballots
Misunderstand and no-vote races Misunderstand and double-vote races¡ ...questionably...structured ballots Unclear Intent: circle? check? fill in? etc.
RSA Trapdoor Function
Modular Exponentiation -Multiply a value by itself enough times over a finite field and it becomes itself again -(m^d)^e mod n = m
ARP spoofing/poisoning
More commonly known as ARP poisoning, this involves the MAC (Media Access Control) address of the data being faked. -a set of techniques used to confuse the switch and mis-route traffic. -Malicious actor on local network -Can be used to: --DoS another client --Cause network to thrash --Intercept traffic
Defending against ARP attacks
More intelligent switching -"Sticky" MACs: 1 physical port = 1 MAC addr --once you see an ARP announcement, that physical port is attached to that mac. If the switch sees the MAC change... it will turn off the port -802.1X: Authenticate physical port access -<many more> More intelligent topology -Network partitioning -Reduce the "blast radius" of an attack
Usage: Building Block
Most commonly a component on motherboard Software treats as black-box operations -Hardened interface
Firewall Usage
Most networked devices in 2020 have some sort of built-in firewall -Including most consumer-grade equipment Most, but not all, routers have some sort of coarse-grained traffic management
Firewall Inception
Most networked devices in 2020 have some sort of firewall built-in or readily add-able -Including consumer-grade equipment Most, but not all, routers have some sort of coarse-grained traffic management Most end-devices in 2020 have a built-in firewall via the OS -Linux = iptables, macOS = Firewall, Windows = Firewall - Exception is IoT and embedded devices
Example CPU Instructions
Move a value to a register -mov eax, 0x34 Add a value to a register -add eax, 10 Change execution path -jmp 0x12345678 #can't return -call 0x12345678 #can return -ret #return from call instr. -leave does 2 actions --> mov esp, ebp --> pop ebp
Paper as a Defense (when voting)
Paper is slow and expensive to tally -Verified by voter Memory Card is fast and cheap to tally -Unverified *Move away from DREs
What is one of the most popular forms of authentication?
Passwords -Original and most ubiquitous form of authentication -Relatively weak mechanism -Many well-known and widely exploited problems
Cookies
Third-Party Cookies are mechanism by which websites allow arbitrary actors to track their users across the Internet.
Cipher Block Chaining (CBC)
"A process in which each block of plaintext is XORed with the block of cipher text immediately preceding it before it is encrypted using the DES or AES algorithm." Block of plaintext combined (XOR) with IV goes through block cypher (AES algorithm) and outputs ciphertext. That ciphertext is now the "IV" of the next block. It is combined (XOR) with the next block of plaintext which goes through the block cypher (AES algorithm) outputting a ciphertext. The cycle repeats. -IV is the previous block's CT -Pad last block in a deterministic way --AES-128 (16-byte block) with 24-byte message BAD -why bad? Side Channels CBC mode usually vulnerable to padding oracle attacks due to the difficulty of handling the padded block --Extremely easy to leak internal cipher state --Writing safe software is hard || Writing safe security-related software is really, really hard --Writing safe crypto-software is one of the many reasons we don't roll our own crypto
Replay Attack
"A type of network attack where an attacker captures network traffic and stores it for retransmission at a later time to gain unauthorized access to a network." Mallory makes a copy of Bob's transmission for later use -can send that copied message to Alice anytime (pretending to be Bob) -message/transmission can be valid -this means you don't have sender authenticity
Electoral Systems
"First Past the Post" -Majority-post -Plurality-post Rank-Choice Single-Winner Multi-Winner -Single vote -Multi-vote
Cryptographic Doom Principle
"If you have to perform any cryptographic operation before verifying the MAC on a message you've received, it will somehow inevitably lead to doom"
Degrees of Malware
"Potentially Unwanted Apps" (PUPs) "Potentially Harmful Apps" (PHAs)
Cryptojacking
(sometimes referred to as "crypto-miners" with context) uses victim's resources to generate revenue for controller. -Often injected via JS and run in browser -Miner "pools" make it profitable even with limited computation
Characteristics of TLS Protocol
-Content agnostic -One or both endpoints can be authenticated -Well-studied and iteratively improved --SSL v1, v2, v3 --TLS v1.0, 1.1, 1.2, 1.3 Client -> HTTP -> TLS -> TCP -> Internet (CipherText) Internet(CipherText) <- TCP <- TLS -< HTTP <- Server
Web of Trust
-A decentralized model used for sharing certificates without the need for a centralized CA. -a simple trust model that relies on each user creating and signing their own certificate. -"I know Alice, this is her key Bob! Here ya go!"
Certificate Chaining
-A process that combines all certificates within a trust model. It includes all the certificates in the trust chain from the root CA down to the certificate issued to the end user. --Linking several certificates together to establish trust between all the certificates involved.
SSL Stripping
-A specific type of man-in-the-middle attack against SSL -network-level technique that prevents clients from upgrading to HTTPS by blocking the redirect response. -Mallory sits in the middle of the client and the server and takes the client's HTTP request & blocking the redirect request to HTTPS In order to "strip" the SSL, an attacker intervenes in the redirection of the HTTP to the secure HTTPS protocol and intercepts a request from the user to the server. The attacker will then continue to establish an HTTPS connection between himself and the server, and an unsecured HTTP connection with the user, acting as a "bridge" between them.
Return Oriented Programming (ROP)
-Arbitrary instructions via ROP "gadgets" -IDEA: Return-to-libc w/o functions
Superfish
-Came pre-installed on Lenovo laptops -Was an ad-supported visual search startup -Actively MitM traffic for ad injection -Injected root CA -SAME PRIVATE KEY ON EVERY SINGLE INSTALL
Adaptions to Kerckoff's Principle
-Ciphertext must be realistically secure at a minimum but provably secure if possible. -Implementation shouldn't rely on its own secrecy for to remain secure. -Don't make unrealistic assumptions about the abilities or competence of the humans who use/operate the system. (humans are the weakest link in security) -Key material must be easy to transfer, store, change, and verify. --Static keys are bad (keys used for a long time), Key rotation is good. --Also, knowing that you're using the right key is more important than people realize. -Interoperate with existing infrastructures, topologies, and protocols at higher and lower levels. --Ideally, a system should be 100% transparent to existing infrastructure. --Systems with dependability issues don't get deployed. (Can work over any network protocols, hardware, software, etc.) -Should be generic and reusable across many different hardware and software platforms. --Reusable and re-implementable. --Over customization for a single use-case reduces ability to be leveraged for others
Client Write KEX
-Client generates random secret -Encrypts to server's public key -Server decrypts to recover shared secret instead of sharing, the client picks the key and sends it to the server BAD -removed entirely in TLSv1.3 -it is NOT a forward secret KEX!!! Client -> c = ENCRYPTcert(r) send c Server then does r = DECRYPTpriv(c)
Onion Routing
-Connections transverse "circuit" to destination. Entry Node --> Middle Node(s) --> Exit Node. -Can transverse many or few middle nodes, but default is 3. -Uses telescoping encryption. -Circuits are created and destroyed automatically -Anonymous services are available
How U2F Works (Google)
-Currently, U2F devices are usually small USB devices that you insert in your computer's USB port -When you insert it into your computer's USB port or tap it against your phone, the browser on your computer can communicate with the USB security key using secure encryption technology and provide the correct response that lets you log into a website. -Because this runs as part of the browser itself, this gives you some nice security improvements over typical two-factor authentication -First, the browser checks to ensure it's communicating with the real website using encryption, so users won't be tricked into entering their two-factor codes into fake phishing websites. -Second, the browser sends the code directly to the website, so an attacker sitting in between can't capture the temporary two-factor code and enter it on the real website to gain access to your account
ROP Concepts
-Execute existing code instructions -Each gadget is very small amount of logic -Gadget ends with ret instruction -Wide array of gadgets in normal applications -Can used linked libs for more gadgets & more stable gadgets -Logic is "messy" --Lots of side-effects
4 Good Practices For Users when dealing with Authentication
-High-entropy password generation -Enable MFA wherever possible -Never reuse passwords -Identify and account for pivotable services and credentials
MFA- Push Authentication
-In-context verification via separate channel -Relies on security of device & service -Can be Phished -Can be Stolen maybe (depends on device) Effectiveness- Good, not great ex. Auburn Duo Push (when logging in) ex. someone can have a push sent to your phone to login to your account
MFA- Universal 2nd Factor Authentication (U2F)
-Keypairs generated on the devices -Private key never leaves the device -Challenge-Response protocol to ensure freshness -Internal keypairs -Cannot be Phished -Can be Stolen maybe (depends on config) -Effectiveness= Very Good -Pure Crypto -These tokens can use USB, NFC, or Bluetooth to provide two-factor authentication across a variety of services.
Asymmetric Tradeoffs
-Low cost for attacker to do -High cost for defender to stop/prevent
Credential Pivoting Attack
-Many different services attackers can pivot through --Email, phone, storage, etc Idea: -Use access to service A to obtain access to service B --Gain read-access to email --Request password reset from service --Read reset link/code from email --Use link/code to log into new service
MFA- One Time Code
-Out-of-Band, single-use secret transmission -Usually implemented as SMS or voice call -Can be Phished -Can be Stolen -Effectiveness= Better than Nothing ex. Google 2FA code sent to phone when logging in
MFA- One Time Password
-Password calculated via shared secret --HOTP: secret, counter --TOTP: secret, time -Can be Phished -Can be Stolen (locally) -Effectiveness= Better, not by much (compared to one time code) -HOTP --The first is the secret key, called the "seed", which is known only by the token and the server that validates submitted OTP codes. The second piece of information is the moving factor which, in event-based OTP, is a counter. The counter is stored in the token and on the server. The counter in the token increments when the button on the token is pressed, while the counter on the server is incremented only when an OTP is successfully validated. -TOTP --based on HOTP but where the moving factor is time instead of the counter. TOTP uses time in increments called the timestep, which is usually 30 or 60 seconds. This means that each OTP is valid for the duration of the timestep. ex. Microsoft authentication code that is time based, you only have 30 seconds to input the code before another is generated
Generating Strong Passwords
-Remove the human as much as possible -Automated generation -Physical generation ("diceware") --Roll dice to generate entropy --Use wordlist to improve usability and memorability
What is a Bug? What is a Weakness? What is a Vulnerability? What is an Exploit? What is an Attack?
-Something that fails in unintended ways -A bug that may be able to harm S & P -Weakness that can be intentionally triggered -Way to leverage vulnerability -Intentional exploit for attacker's gain & victim's loss
Poor Client-Side Validation
-Straight up Accidents in validating SSL Certs --code bugs/mess ups -Validating an SSL Cert in a non-browser software --Often, unlike in a browser, there is no user to show a dialog to. "Cert is broken, Proceed: yes/no"
HSTS (HTTP Strict Transport Security)
-Strict Transport Security. -HTTP header indicating always send HTTPS -Prevents downgrade attacks -Protects all sessions after the first -Preload lists can protect the first policy allows web servers to instruct client to always talk HTTPS for a set amount of time. -Sent via HTTP header -Time is n seconds until try HTTP -As long as client can communicate with the server once, will be safe for n seconds ISSUE -Trust on first use mechanism
HTTPS Redirect
-Uses 3XX "redirect" status codes -Instructs the client to try again using the HTTPS protocol instead of HTTP -shows redirect location in the status (from response)
Injected Root CA
-attacker is intentionally man in the middling HTTPS "for security" and injecting their own Root CA into the client's browser If an adversary would be able to inject a root certificate, the victim could be susceptible to eavesdropping or hidden malicious software. Malicious software is checked for by virus scanners, and has to be active on the infected computer. Usually virus scanners do not verify root certificates, because there is no simple way of distinguish a legitimate root certificate from its malicious counterpart.
True Randomness
-cannot be created, can only be measured from external process ("in the wild") -ex. vegas casino -must be measured in secret -is extremely slow and scarce (makes fast computers slow)
Kerckoff's Principle
A cryptosystem should remain secure even if 100% of the system is public-knowledge except the key material.
Pseudo-randomness
-data that mimics randomness but is actually deterministic -starts with little randomness -less trustworthy than true randomness but more achievable than true randomness (b/c computers are very good at doing very tedious things very quickly)
SSL Certificate (Pre 2014)
-enormous pain to deal with. -Incredibly complicated configuration --One mistake and 100% vulnerable -Manually verify with CAs via admin@, hostmaster@, webmaster@, ... addresses -Cost $70 -$400 per year -Start over every time a new TLS vulnerability is found or crypto is broken
Random Data
-unpredictable bits to an attacker without a pattern -any bit has the same chance -> 50% to be 1 or 0 -computers are really bad at randomness
TLS 1.3
-~100ms latency -Single round-trip required by default --May require additional -Able to create connection and pass content with zero round-trips --0RTT
Malware Installed via Exploitation
0-Day Vulnerability -Brand-new to vendor, defenders, and users -Find, exploit, & install N-Day Vulnerability -Patch exists but is not applied to host -Old =!= Ineffective -Google, exploit, & install Perma-Vuln (∞-day) -Worse version of n-day -Will never be patched Password Guessing -Default creds are scary -Repeatedly try until successful or blocked -Gain access & install Drive-by-Download -Clients are largely not arbitrarily accessible -Get client to interact w/attacker & hijack -Get interaction, profile, select, & install
Problems with DREs
1. Attacker infects memory card containing ballot programming files. 2. When officials place the card into the machine, it becomes infected. -AccuVote TS-X can be infected through: ●Unauthenticated software update mechanism; ●Buffer overflows in code that reads ballot design; or ●Interpreted programming language(AccuBasic) used to print result tape. 3. Malware running on the machine can arbitrarily change electronic records and printouts.
2010 D.C. System
100% Compromise with very little effort Acquire administrator credentials Replace all existing ballots Add ballots for voters who didn't vote De-anonymize ballots Hide all evidence in logs *100% REAL-WORLD COMPROMISE*
Linux File Permissions
3 normal permission bits per object (RWX) -Each object has an "owner" and a group -Only owner can change the permissions or group rwx rwx rwx Owner Group Others
2017 Google Phishing Worm
A "wormed" phishing attack via misleading UI and poor defenses Clicking link to you to a real Google Doc Granting permissions gave access to email
What is a Hash Collision?
A Hash Collision Attack is an attempt to find two input strings of a hash function that produce the same hash result. Because hash functions have infinite input length and a predefined output length, there is inevitably going to be the possibility of two different inputs that produce the same output hash. If two separate inputs produce the same hash output, it is called a collision
AES (Advanced Encryption Standard)
A block cypher created in the late 1990s that uses a 128-bit block size and a 128-, 129-, or 256-bit key size. -Bigger key == same algorithm with more rounds Good to use AES256- approved by CNSA -replaces DES -invertible s-boxes (obscures key from ciphertext) --same used for both encrypt & decrypt, this is why its invertible because it can be used to encrypt & reversed to decrypt
Trusted Platform Module (TPM)
A chip on the motherboard of the computer that provides cryptographic services. OR is additional built-in, self-contained ASIC that provides a central "root of trust" for a device.
Trusted Computing Base (TCB)
A collection of all the hardware, software, and firmware components within a system that provide security and enforce the system's security policy. OR is the collection of all components within a system critical to providing security properties.
Hardware Security Module (HSM)
A device that can safely store and manage encryption keys. This can be used in servers, data transmission, protecting log files, etc. OR a special-purpose add-on component that securely stores cryptographic keys and performs cryptographic operations. -High-performance operations -Restricted logic --Most commonly used for signing operations -Commonly available "in the cloud" for use with AWS/GCP/...
Certificate Transparency
A fix to Root CA leak -When issued, domain --> fingerprint published --Browsers require inclusion in multiple DBs -Allows real-time and historical monitoring -List of what Root CA signed what & when 3 Goals: 1. Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible to the owner of that domain. 2. Provide an open auditing and monitoring system that lets any domain owner or CA determine whether certificates have been mistakenly or maliciously issued. 3. Protect users (as much as possible) from being duped by certificates that were mistakenly or maliciously issued."
Trapdoor Function
A function that is easy to compute in one direction, yet believed to be difficult to compute in the opposite direction (finding its inverse) -can be inverted only with knowledge of private key F(pk, m) = v -> computationally easy F^-1(sk, v) = m -> computationally easy F^-1(v) = m -> computationally difficult
The Onion Routing (Tor) Network
A privacy- and anonymity-centic, volunteer-run communications network. -Started by DoD's Naval Research Lab. -"Low-latency" overlay network. -Used by both "good" and "bad" actors (researchers, intelligence agents, regular people, activists, and journalists but also drug dealers, pedophiles, and terrorists).
CPU Registers (32 bit)
General Purpose Registers -EAX, EBX, ECX, EDX Semi-General Purpose Registers -EDI, ESI Special Purpose Registers: -EIP, ESP, EBP
URL (Uniform Resource Locator)
A location or address identifying where documents can be found on the Internet; a Web address -A way of encoding an enormous amount of data in machine handle-able way -Sometimes called "Universal Resource Identifiers" (URIs) -encode all the info the web needs in one string -protocol, location, etc.
What is a secure channel & what 3 properties must it have?
A secure channel is a mechanism for which Alice & Bob can communicate securely. It must have: Confidentiality Message Integrity Send Authenticity
Cross-Site Request Forgery (CSRF)
A method of attacking a system by sending malicious input to the system and relying upon the parsers and execution elements to perform the requested actions, thus instantiating the attack. XSRF exploits the trust a site has in the user's browser. OR a class of attacks that extends XSS to maliciously use client-side credentials. -XSS which makes requests from the client's browser to an authenticated API
Galois/Counter Mode (GCM)
A mode that starts with CTR mode, but adds a special data type known as a Galois field to add integrity. GOOD-- (problem if key-unique IV was ever compromised) -CTR mode with built-in integrity checking -Key-unique IV -Relatively new but is being adopted widely --2007 NIST approval -Makes protocols much easier to implement Like in CTR, blocks are numbered sequentially, and then this block number is combined with an IV and encrypted with a block cipher E, usually AES. The result of this encryption is then XORed with the plaintext to produce the ciphertext --like other counter modes, its essentially a stream cipher
Security Archetype
A named actor that is used as a representative of a nuanced actor and their capabilities/intentions Ex. "foo", "bar", "baz" ... also Alice, Bob, Mallory, Eve
Cipher Suite
A named combination of the encryption, authentication, and message authentication code (MAC) algorithms that are used with SSL and TLS. ex. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Spear Phishing
A phishing attack that targets only specific users. OR an expansion of standard phishing techniques which is custom-built for specific people. -Relies on knowledge of the victim -Is crafted for the best-possible chance of the victim falling for it
Virus
A piece of code that is capable of copying itself and typically has a detrimental effect, such as corrupting the system or destroying data OR type of malware that copies itself to other local applications. -A single bad-app creates many bad-apps -Often have the ability to "mutate" own code to be harder to detect --Polymorphic: Uses encrypted payload and each copy generates a new key --Metamorphic: Rewrites self each time it replicates but maintains all functionality
Principle of Least Privilege
A security discipline that requires that a particular user, system, or application be given no more privilege than necessary to perform its function or job. OR access to data & resources is limited those who need for routine, authorized purposes. -Specific apps can only start w/ specific users
TLS (Transport Layer Security)
A security protocol that uses certificates and public key cryptography for mutual authentication and data encryption over a TCP/IP connection. Used to protect most of the common Internet protocols -HTTP --> HTTPS -FTP --> FTPS SMTP --> SMTPS -Some VPNs -Many, many more -SSH uses its own, unrelated protocol
Rootkit
A set of software tools used by an attacker to hide the actions or presence of other types of malicious software. OR program that hides in a computer and allows someone from a remote location to take full control of the computer OR a type of malware that strives to hide itself and other various components. -Hook system calls to: --Remove certain results --Add certain results -Persistence and stealth are the hallmarks
Side-Channels
A side-channel is anything A) measurable by an ignorant actor and B) dependent on otherwise unknown information. Side-channels are not required to be perfect nor straight-forward = Is Toomer's Corner rolled after the game? = Is person happy or sad when leaving exam? Types: Timing Cache Heat Power Sound Error-code RF-Emissions Heap-allocation SSH Password Side-Channels Keystrokes to log-in Word-length Inter-key timing Packet timing Packet timing via light
Message Authentication Code (MAC)
A small block of data that is generated using a secret key and then appended to the message. This attempts to provide message integrity -a tag = a short piece of information used to authenticate a message in other words, to confirm that the message came from the stated sender (its authenticity) and has not been changed
IDS (Intrusion Detection System)
A software and/ or hardware system that scans, audits, and monitors the security infrastructure for signs of attacks in progress. "network monitoring component that is able to watch for signs of maliciousness." Capable of granular and complex rules -Beyond L2/L3 (IP/TCP) headers -"Deep Packet Inspection" (DPI) Capable of pattern/regex matching Capable of searching for multi-flow patterns
Virtual Machines
A software implementation of a computer system, allowing one physical computer to run several "virtual computers", each with their own independent operating system and application software. Completely separate OS installations -Similar to dual-boot but simultaneous A "hypervisor" coordinates hardware access OSes are isolated (Linux VM on Windows)
Adware
A software program that delivers advertising content in a manner that is unexpected and unwanted by the user. OR software that interferes with standard advertising to generate revenue for the malware's controller.
Push & Pop
Add elements: push instruction -push 0x00000000 #adds 4 null-bytes on top (of stack) -push eax #copies adds EAX register value on top (of stack) Remove elements: pop XXXinstructions -pop eax #stores removed value in EAX register and de-allocates 4-bytes push 0x0a push 0x6c push 0xff pop eax #0xff pop eax #0x6c push 0x88 push eax #0x6c
Fuzzing
A technique used to discover flaws and vulnerabilities in software. OR a technique of penetration testing that can include providing unexpected values as input to an application to make it crash -Automatically generate and test inputs --Random, patterns, mutations, etc -Process input and see if program crashed --If so, input as something to be investigated --If not, try again -Code coverage measurements used to explore different generation paths
Three-Way Handshake
A three-step process in which Transport layer protocols establish a connection between nodes. The three steps are: -Node A issues a SYN packet to node B -node B responds with SYN-ACK -then node A responds with ACK.
Tracking Pixel
A transparent image that provides information about a specific user. For instance, can send a signal once a user has opened a specific email.
Spyware
A type of Malware that locates and saves data from users without them knowing about it. OR software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive. OR type of malware that provides remote access to local information such as activity, sensors, and other information. -Key loggers, screen captures, data exfiltration, GPS/microphone/camera data -Some examples are obvious base on their by their users and capabilities --Law Enforcement --Intelligence Orgs --...the like... -Often sold openly -Sometimes used in less-than-ideal situations
Security CPU Instructions
AES-NI -Perform specific AES operation in HW --Encrypt/Decrypt round --Generate round key RDRAND -Read random value from HW and store in given register
Malware Installed via Third Party
Added to benign SW by developer -Leverage existing userbase & trust -Change of control -Explicitly for Revenue Added by attacker via supply-chain access -Unknown to developer -External dependencies -Distribution mechanism "Owner" adds for compliance/policy -Bossware, mobile device management (MDM) -Proctoring Software? Preinstalled w/ device -May not be obvious -May be force-installed
Completely Secure Channel
Alice -->g^a, sig keyshare (keyshare = g^a mod p) Bob <--g^b, sig keyshare (keyshare = g^b mod p) Alice -->AES256_GCM_SIV(g^ba, What's 1+1? Include the bytes ABCD), IV, sig IV ||CT Bob <-- AES256_GCM_SIV(g^ab, ABCD || 2), IV, sig IV || CT Alice needs Bob's public key to verify Signature & vice versa
Security Archetypes used in this course
Alice & Bob - passive, send messages back and forth Eve - passive, malicious actor who can read messages; however, cannot modify, delay, discard, etc Mallory - active, malicious actor who can read, modify, delay, discard messages. Man in the middle attack
Merkle Trees
Allow a large number of arbitrary, unrelated elements to be validated in a structured way. Iterative hashing of values Distribute Merkle Root for integrity checking Structure allows use of efficient Inclusion Proofs That's 80% of Cryptocurrency FX "ledger" or 'blockchain" — Merkle tree "transaction" — leaf-nodes of Merkle tree "proof of work" — solve via brute-force: root(current) || nonce = root(next) W/hardness "hardness" — restrictions on root(next)
Enclave Logic
Allow arbitrary logic from developers Extremely small TEE standard library Statically compile against TEE standard library & dependencies
Rowhammer
Allows arbitrary process to flip bits in memory
HTTPS (Hypertext Transfer Protocol Secure)
An encrypted version of HTTP. (It uses port 443) Solution to HTTP -HTTP inside of TLS -Often incorrectly called "SSL" (really old version) -Various "upgrade" mechanisms
IPS (Intrusion Prevention System)
An active, inline security device that monitors suspicious network and/ or system traffic and reacts in real time to block it Also called a Network Intrusion Prevention System (NIPS). type of IDS which is able to actively block maliciousness when found -Capable of granular and complex rules --Beyond L2/L3 (IP/TCP) headers --"Deep Packet Inspection" (DPI) -Capable of pattern/regex matching -Capable of searching for multi-flow patterns
Elliptic Curve Cryptography (ECC)
An algorithm that uses elliptic curves instead of prime numbers to compute keys. -public-key scheme that provides the same operations via a different mechanism. -Widely used curves are named and their names may/may not be meaningful
Amplification Attack
An attack instigated using small, simple requests that trigger very large responses from the target. DNS, NTP, ICMP, and SNMP lend themselves to being used in these kinds of attacks. -An attack that increases the amount of bandwidth sent to a victim. OR type of reflection attacks where the victim receives more traffic than the attacker sends. -Obvious asymmetry -DNS is a common vector for them --Request: 10s of bytes --Response: 100s of bytes
Phishing
An attack that sends an email or displays a Web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information OR an attack technique which attempts to trick the user into willingly surrendering information
Port Scanning
An attack were an attacker scans your systems to see which ports are listening in an attempt to find a way to gain unauthorized access OR reconnaissance technique that is used by attackers to gain information to aid them in their attacks
Distributed Denial of Service (DDoS)
An attack where a firm's computer systems are flooded with thousands of seemingly legitimate requests, the sheer volume of which will slow or shut down the site's use. DDoS attacks are often performed via botnets. OR An attack that uses multiple zombie computers (even hundreds or thousands) in a botnet to flood a device with requests. OR is a type of DoS attack where the "source" of the attack is distributed across the Internet. -Often accomplished via botnets -Each bot under the attacker's control contributes negligible amount of traffic but the sum is non-negligible
Concept of Freshness in Communication
An important aspect of S&P is ensuring not only sender authenticity, but also freshness of the messages being exchanged Knowing who you're talking with Knowing when you're talking with them (Making sure you aren't a victim of a replay attack) *add nonce
Anti-Virus
Anti-Virus and "host-based defense systems" are very ... complicated... Good-They can quarantine and alert you when there's known malware. Maybe-They can only tell you about known malware and the naïve versions Bad-They love to quarantine dev-tools and are incredibly privacy-invasive Worse-They have to touch everything
Hash Function
Any function that can be used to map data of arbitrary size to fixed-size values. H(x) = y Function[H] that is 100% public & deterministic Input[x] with arbitrary length Output[y] - fixed-length "digest" The values returned by a hash function are called hash values, hash codes, digests, or simply hashes
Vulnerabilities are Inevitable
Any non-trivial software will have bugs Some non-zero percent are controllable Some non-zero percent are exploitable Humans can be the vulnerability
TEE Operation
App loads enclave blob via OS driver App can make function calls into the enclave Enclave executes outside the influence of OS, apps, etc
TCP/IP Model
Application (Message to Transit), Transport(Make it Cohesive), Internet(Get to Final Destination), Link(Get to Next Hop) The TCP/IP Model is way of thinking about and conceptualizing the various protocols used in network communications. -Reduced "OSI Model" -Specifics differ greatly based on the source, time, and writer -Is NOT a perfect representation of the real-thing
Short-Cutting TCB with TEEs
Applications, OS, network, cloud, etc removed from TCB Enclave-to-enclave secure channels are available DoS attacks prevalent but known
"Turtles All The Way Down"
Attack surface is exponentially larger b/c malicious lower-levels Level N bug means levels >=N are untrustworthy Bugs and vulns mimic each other due to abstraction
RC4 stream cipher
BAD -Extremely fast PRNG (originally a "trade secret") -why bad? biased output at beginning & after few GBs It is used to encrypt the data as it is transmitted through the air.
Ballot Secrecy
Ballot Secrecy means that a vote can not be meaningfully attributed to a voter by anyone. Weak Secrecy - Can't correlate vote + voter Strong Secrecy - Can't sell vote reliably
DRE Systems
Ballots are recorded via the device Ballots are stored on the devices At the end, of the election, output the device's tally and add *DREs are just old computers
AWS EC2
Bash Environment SSH protocol design SSH app architecture SSH app logic Crypto math Crypto impl. TCP protocol design TCP implementation OS implementation HW components SoC design/impl. CPU design/arch Silicon traces
DES (Data Encryption Standard)
Block Cipher A shared-key encryption algorithm that uses a 56-bit encryption key to encode data in 64-bit blocks. BAD -1977 -Standardized by NIST -Software implementation is very slow -Often implemented in hardware -why bad? 1998 -EFF DES Cracker built (brute force attack on key) PS before it was broken, 1990 -Differential cryptanalysis discovered -General technique against block ciphers
Branch Prediction
BranchPredictionisa formofspeculativeexecutionusedbyCPUstoimproveperformancebypre-executinginstructions.Basedonmanythingsbutmoststraight-forwardisthelasttimeitran thecodeIfpredictright:freeexecutiontimeIfpredictwrong:abandonandignore=Keepstrackofwhatvaluesdependon check
What would be examples of "low hanging fruit" when attacking?
Brute Force Enter and Stay Ask for access
Cyber-kneecapping: Bug-doors
Bug-doors are an especially scary type of back door in software implementation that grants access to anyone who knows of them Intentionally added errors Easily attributed to benign mistake Impossible to attribute to a malicious actor
HTTP details
CLIENT -Methods (often referred to as "verbs") -GET: Fetch content from a web server -POST: Send content to a web server -others exist but are largely used in similar ways in 2020 SERVER -Passes information via a "body" and arbitrary "headers" describing the body -CR/LF ("\r\n") separated key-value pairs
Censorship Avoidance
Censorship avoidance is intentionally designing, building, using, and maintaining systems whose goal is explicitly to give users ability to bypass local censorship. Attempts to modify the censor's trade-off =Increase the negative impacts of blocking =Decrease the user-effort to avoid
Censorship
Censorship is the suppression of access to information that is deemed harmful for the perceived advancement of the greater good. Can be performed by many parties Governments censor citizen-access Companies censore mployee-access Corporations censor customer-access Schools censor student-access User-Side Compliance: Software installed on user device to block content Infrastructure Compliance: Require ISP and telco-providers to censor traffic = Censor creates requirements and delegates responsibility to enforce Solution: Manually configure DNS to non-censored server directly Retaliation: DNS injection Retaliation solution: Wrap DNS in TLS channel
Usage: Attestation
Challenge-Response protocol using keys Allows 3rd parties to verify device state Often registered at the factory -May use CA-like chain -May be unique values
CSRF Example
Client (POST) -> Login: username & password cookie: name=BankAuth, value= 39f2097fasc <- Server Client (GET) -> Accounts: , Cookie (tries to access account, sends cookie back) <- Server Client (POST) -> Transfer (makes a transfer, sends cookie with) <- Server
Sender Authenticity
Messages can't be created by a non-1st party (1P)
Cryptographic Hash Function Resistances (assumed hardness)
Collision Resistance- it is hard to find x1 & x2 such that H(x1) == H(x2) Preimage Resistance- Given H(x), hard to find x 2nd Preimage Resistance- Given x1, it is hard to find x2 such that H(x1) == H(x2) Change Propogation- Small input changes make big output changes
Ballot Marking Device
Combination of DRE and optical-scan -Vote via electronics -Print ballot for voter Ballot is paper Ballot is scanned into completely separate device for tally Problem: Voters implicitly trust BMDs, voters need to check their ballots *Computers can be hacked
Contact Chaining
Contact Chaining is a technique in which digital metadata allows recovery of social-graph Useful in locating cliques and hidden members of groups =Alice, Bob, Charlie call eachother a lot
Safe Finite-Field DH Parameters
Correctly generated 2048-bit group -Thought to be safe -Widely used in the real-world Correctly generated 3072-bit group -Thought to be safe -Relatively rare in the real-world -CNSA approved
Safe RSA Parameters
Correctly generated 2048-bit parameters (modulus n size) -Thought to be safe -Widely used in the real-world Correctly generated 3072-bit parameters (modulus n size) -Thought to be safe -Relatively rare in the real-world -CNSA approved
Other Important Properties
Cost Effectiveness Accessibility Convenience Intelligibility
Access Control Policy
Create a logical representation of who has access to what file. -Enumerate users -Enumerate files -Give specific users specific access to specific files -Default: no-access
What should you implement in a system design?
Create a system that is capable of being defended. Maintain the mechanism for defending it. Train & Educate in order to reduce the overall burden on non-malicious actors
Deep Packet Inspection (DPI)
Deep Packet Inspection (DPI) is a network monitoring component that is able to watch for signs of deemed-harmful content. DPI is an IDS specifically for censorship Use VPN to defeat
Cipher Mode
Defined method that determines how a plaintext block is input and changed to produce ciphertext. Examples include: Electronic Code Book (ECB) mode, Cipher Block Chaining (CBC) mode, and more. -a way to use a fixed-size block cipher with arbitrary-sized data -AES-256 is using the 256-bit key -Not needed for stream ciphers b/c XOR the message-length number of bytes
Usefulness of the TCP/IP Model
Delegate responsibilities Spiral development cycle Improved interoperability Tractable mental model
Online Attacker Motivations?
Different attackers use different attacks in order to achieve their goal. -Passive eavesdropping isn't very useful for standard attackers -DoS isn't very useful for stealing credit card and/or social security numbers -Reconnaissance is hard and takes a lot of skill to do correctly
Differential Privacy
Differential Privacy is a technique in which a data set can contain partially incorrect data on an individual but it is simultaneously: Guaranteed to be correct as-a-whole Impossible to attribute to an individual
Metadata
Digital meta data is any information about a digital artifact/object but is explicitly not the artifact/object itself.
RSA Cryptosystem
Discovered in 1973 by Clifford Cocks Published in 1978 by Ron Rivest, Adi Shamir, and Leonard Adleman First public key cryptosystem-asymmetric Generate two large primes p & q -Calculate modulus n from p & q (n = p * q) -Select relatively prime public exponent e (Usually 3 or 65,537) -Find a private exponent d so that (e * d) mod lcm((p-1) * (q-1)) = 1 -Priv-Key = (d, n) && Pub-Key = (e, n)
Diffie-Hellman's security is based off of 2 Mathematical Assumptions
Discrete Logarithm Problem -Given g^a mod p, it is hard to find a Decisional Discrete Logarithm Problem -Given g^a mod p && g^b mod p, it is hard to find g^ab mod p
What are potential options when defending a system?
Do Nothing Complete Overhaul Defense in Depth
Domain Fronting
Domain Fronting is a censorship avoidance technique which relies on protocol implementations being independent.
What's rule number 1 of Cryptography?
Don't roll your own crypto There are experts that do this for a living, it is not something you can just pick up on and do yourself over night. It isn't reliable unless an expert created it and other experts reviewed it.
How to Prevent Content Injection
Don't use user-provided data...ever -Create/store server-side and give client DB key Protected data stored client-side with a server-only secret used to validate -AES-GCM(keyserver-only, "Bob") -"Bob" + HMAC(keyserver-only, "Bob") Validate *everything*about client supplied data every time you touch it -re.search("^[a-zA-Z]{2,}]$", data)
Dark Patterns
Done out in the open. Manipulate the user. Example: Link to sign up for email notifications to receive a 15% off coupon and the "no" option says "I'd rather pay full price... :'("
Availability
Endpoints and/or data can always be accessed by authorized parties
Confidentiality
Messages can't be read by a 3rd party (3P)
Browser Fingerprinting
Each browser keeps some information about the elements it encounters on a given webpage to differentiate between users. For instance, a browser will keep information on a text font so that the next time that font is encountered on a webpage, the information can be reproduced more easily. Because each of these saved elements have been accessed at different times and in different orders, each instance of a browser is to some extent unique. Tracking users using this kind of technology continues to become more prevalent.
Desired Attributes of a MAC
Easy to compute and verify for Alice & Bob Hard for not-Alice/-Bob to create Doesn't grow with message length
Election Availability
Election Availability is that the system is available when needed and performs reasonably. Accepts Votes - Not overly burdensome Timely Results - Waiting months is not ideal
Election Integrity
Election Integrity is the property that the outcome matches voter intent. Cast as Intended - Choice, Competence Counted as Cast - Didn't get changed/ignored
TEE Application
Enclave logic is compiled and signed with enclave key Enclave blob compiled into application binary Application binary behaves as normal
Virtual Private Network (VPN)
Encrypt all content from self to cloud =Protection against local actors only =VPN service sees all traffic and can act Known instances of some being malicious
Example: Sealed Data
Encrypt data such that it can only be decrypted by self Arbitrary logic based on internal state and sealed metadata -Creation date -Version number
Toolbox of Exploitation Techniques
Every vulnerability is different -Some are not exploitable at all Sometime it takes multiple bugs to create a working exploit ("Bug Chains") -Buffer over-read (get canary) + Buffer overflow (exploit)
Local TCB
Everything needed to run the application safely Each layer relies on the layers below it to behave correctly Debugging difficulty going down the stack
Evil Maid Attacks
EvilMaidAttackiswhereanattackergainsphysicalaccesstothetarget'sdeviceforlongenoughtogainaccess,exploit,orotherwiseleveragethatphysicalaccess.ImagestorageforfutureforensicsCompletelyreplaceandproxyinteractionInstallfirmware-levelmalwareInstall/replaceHWwithcustomaccess
Anonymized Data
Ex: Post months of search queries but erase user identities, but can piece together who someone is based on what they're searching.
De-Identified Data
Ex: Publish pick-up/drop-off locations of cabs, hashes of taxi IDs, number of passengers.
Cryptography
Extremely high Math Fundamental aspect of S & P (security & privacy) A tool to have when making a secure system
Phase 3: Authenticate & Verify
GOAL: Ensure that: -Endpoints are who they claim to be -Both endpoint saw the same transcript Client authentication is optional in the TLS protocol Hash/sign handshake messages sign key exchange -good b/c only you have priv-key to sign with & they can verify with pub-key
GDPR
General Data Protection Regulation EU-only
Access Control Model
Formal Models -Discretionary Access Control (DAC) -Mandatory Access Control (MAC) -Role-based Access Control (RBAC) -Bell-LaPadula -<many, many more> The real-world is a mixture of all. Subjects- Users Permissions- Read/Write Objects- "Files"(data, binary, device) | Hierarchies- (multiple files)
Phase 2: Shared Secret
GOAL: Create a shared secret known only to endpoints Derive session keys used for content protection Options: -Diffie-Hellman -Client-Write
Phase 1: Parameter Negotiation
GOAL: Determine how endpoints will communicate -Symmetric Cipher -Signature Algorithm -KEX method Arbitrary extensions -Many are generic -Some are specific to underlying protocol Client -> Support Params (Client Hello gives cipher suites) Selected Params <- Server (Server Hello gives the selected cipher suite)
Length Extension Attack
Given a message we can compute the hash for a longer message. The vulnerable hashing functions work by -taking the input message -use it to transform an internal state. -After all of the input has been processed, the hash digest is generated by outputting the internal state of the function. It is possible to reconstruct the internal state from the hash digest, which can then be used to process the new data. In this way, one may extend the message and compute the hash that is a valid signature for the new message. an attacker can use Hash(message1) and the length of message1 to calculate Hash(message1 ‖ message2) for an attacker-controlled message2, without needing to know the content of message1.
Integer Overflow
Going past the integer's range by adding to the maximum, or subtracting from the minimum OR When arithmetic operations attempt to create a numeric value that is too big for the available memory space. OR A condition that occurs when a very large integer exceeds its storage capacity -Buffer Overflows usually rely on unsafe functions (gets(), strcpy(), etc) -Best Practice is to track size and compare -IDEA: Math tricks to avoid size checks
HSTS Preload
HSTS Preload is another patch for HTTP where the browser consults a list of domains to always talk HTTPS to. (way around trust on first use mechanism) -Any website can be added to list @ hstspreload.org -Can't be easily reverted if added --don't break certificate ... if you do and you use HSTS then you pretty much just told every they can't communicate with you (b/c can only use HSTS if you have a valid cert)
HMAC
Hashed Message Authentication Code Cannot use SHA256 with MAC b/c it is easy for 3P to create ... use HMAC instead Function[HMAC] - Slight modification of a standard hash function Key[k] - Is a secret only known to 1P actors Input[x] - Arbitrary length data Output[y] - Fixed-length "digest" HMAC(k,x) = y Any Hash can be turned into an HMAC using a simple construction HMAC-SHA256 == HMAC using SHA-256 Using an HMAC-SHA256 with your message can give you message integrity, 3P cannot create it or get the key used - HMAC-SHA256(key,m)
Diffie-Hellman recap
How Finite-Field DH Works: Each actor selects a secret (a,b) =» Create/Send "keyshares" based on secret =Use secret and others' key share to create a shared secret only known to actors DH's security is based on the hardness of two mathematical problems: Discrete Logarithm Problem = Given g^x mod P, hard to find x. Decisional Discrete Logarithm Problem = given g^a mod p and g^b mod p, it is hard to find g^ab mod p Safe Finite-Field DH Parameters =Correctly generated 2048-bit group -- Thought to be safe. Widely used in the real-world =Correctly generated 3072-bit group -- Thought to be safe. Relatively rare in the real-world. CNSA approved
Buffer Over-Read
Humans are bad at safely extracting data from buffers similar to being bad at safely inserting data into buffers Buffer overflow bugs in reverse IDEA: Read off the end of a buffer
Public Key Crypto Example
If a teacher wants our HW encrypted to send to him, he will give his public key. We encrypt our HW with his public key and send it. The teacher decrypts it with his private key (only way). -he and only he has his private key When he sends back the HW, he signs it using his private key and we can verify it with the public key.
Compromised Root CA - The Harm
If an attacker has a Root CA, they can sign anything & the web automatically trusts whatever they signed -ex. DigiNotar Hack --They got hacked, private key got stolen, hacker made their own certificates for whatever & people's browsers automatically trusted them. --How to fix? --revoke their CA .... now everything they signed is invalid ... what a pain .... clients now have to update their browser to know that the CA is invalid (this means it could take weeks or longer to fix a Root CA leak)
Access Control Mechanism
Implement the policy in the real-world. -Users assigned user id -Users can masquerade as other users ¡Users assigned to groups for simplicity (logic/mgmt) -Groups are meta-users in some but not all aspects
Data Encapsulation
In networking, encapsulation is a method of designing modular communication protocols in which logically separate functions in the network are abstracted from their underlying structures by inclusion or information hiding within higher level objects.
DNS Request
In the Domain Name System (DNS), a message sent by a DNS client to a DNS server, listing a hostname or fully qualified domain name (FQDN), asking the server to discover and reply with the IP address associated with that hostname or FQDN.
TMP Internals
Includes suite of crypto primitives -RNG -Algorithm implementations -Secure storage Arbitrary control logic -Timers, persistent counters, etc
Security of RSA based off 2 Mathematical Assumptions
Integer Factorization Problem -Given n, it is hard to recover p & q RSA Problem -Given only the pub-key, it is hard to perform a priv-key operation
Natural Entropy
Internal state is rarely 100% predictable -Call depth moves stack frames -Compilers aren't 100% clones of each other
Voting Systems
Internet Voting Direct Recording Electronic (DRE) Optical Scan Punch/Chad Mechanical -Brass Ball Drop -Tokens/"Stones in Jars" -Levers/Buttons/Analogs
2 Parts to Public Key Cryptography
Key Generation Algorithm Trapdoor Function
Why would you use ECC?
Keys are significantly smaller -256-bit vs. 3072-bit for 128-bit security Signatures are significantly smaller Attacks against ECC aren't as mature as those against RSA -"as mature", eventually more and more people will attack it and come up with newer and faster attacks for it Significantly faster than RSA
/dev/urandom /dev/random
Kinda random source of bytes always generates data even if they're not really random really fast really random source of bytes blocks if it cannot safely generate (really random) data at current time
SSL Certificate (Post 2014)
LET'S ENCRYPT -Let's Encrypt is an automated service that issues browser-trusted SSL certificates based on proof-of-ownership of the domain. -Run a couple of bash commands -Cost $0 and takes 5-minutes total -NO REASON FOR A WEBSITE NOT TO BE HTTPS Also have Caddy or Caddy 2 -sets up SSL cert, TLS config, website, etc.
Should We Vote Online?
LOL No. At this time, safe, secure, and trustworthy Internet voting system is out of reach given the current technology and science. -Too many unsolved CS problems -Too many unsolved security problems -Unknown long-term cryptographic promises -Many of the problems with known solutions rely on technical experts' assertions --"you trust us don't you?"
Cyber-kneecapping: Legal restrictions
Legal restrictions are a mechanism to ensure that nation-states have low-cost access to cryptographic defeats. Many different ways of writing the law Has trended towards the "nerd harder" variety as opposed to the prescriptive EXPORT control-style
Process Isolation
Logical control that attempts to prevent one process from interfering with another. OR A form of data hiding which protects running threads of execution from using each other's memory Isolated memory via virtual memory Managed via OS scheduler Extremely efficient but very little protection
CPU instructions
Low-level commands passed to CPU Carried out via physical gates -AND, OR, NOT, etc -Latches, Counters, Adders, etc
Malware Distribution
Malware is distributed via almost every imaginable technique and vector. -Installed via Exploitation -Installed via Third Party -Installed via User
Message Integrity
Messages can't be unknowingly modified by 3P
Unsafe libc Functions
Many commonly-used functions are nearly impossible to use safely (no dest length) -strcpy(char *dest, const char *src) -strcat(char *dest, const char *src) -gets(char *s) -scanf(const char *format, ... )
Merkle-Damgård
Many hash functions use this type of construction - Break message into constant-size blocks - Static internal-state and output size - Pad the last block block-length used to build Collision resistance hash functions
Why is Public Key Cryptography Useful?
Many-to-1 encryption -Encrypt with the public key -Decrypt with the private key Digital Signature
Common Hash Functions
Md5- bad/broken (can collide easily) Sha1- bad/broken (can collide with some effort) Sha2- will break eventually Sha256- widely used, still relatively safe Sha384- CNSA approved
Data v Code Clarity
No execute bit (NX bit) -Hardware support for marking non-code pages Data Execution Prevention (DEP) -Windows OS-level implementation Write XOR Execute (W^X) -Read/write (stack/heap) -Executable (.text/code segments) IDEA: Know what's code & what's data
Side Channel
Non-Intrusive Attack that uses information (timing, power consumption) that has been gathered to uncover sensitive data or processing functions. Often tries to figure out how a component works without trying to compromise any type of flaw or weakness. -uses internal state
Stack Canaries
Non-executable segments defends against shellcode in data segments Doesn't defend against the root problem -Ability to modify the return address IDEA: If defender can't prevent buffer overwrites, at least fail-safe when they happen.
Port Scan to Explore
Once you find a host, what is that host servicing itself?
Ways for key distribution and the Issues
Out-of-Band- "something else handles it" --ex. calling someone over the phone & reading out your key to them or mailing your key to them or even meeting up IRL and exchanging them Relayed introductions- very sketchy, Alice got Bob's key from Bob then proceeds to give that key to Charlie --smaller scope of out-of-band distribution --If Charlie talks to Bob, Bob won't know it's charlie --Also, if Alice gives the wrong key then Charlie wouldn't know if he is talking to Bob or not Unpredictable needs are unpredictable- Bob and Charlie don't know they need to talk (Charlie got the key from Alice) Managing keys is an enormous pain and easy to mess-up -if I have a phone with a key and I give that to all of my friends, but one day I drop my phone and it breaks... I get a new phone but now I have to restart and re-distribute my key to all my friends
Out-of-order execution
Out-of-OrderExecutioniswhenthingsaren'tactuallyexecutedinalogicalorder.Compilersre-arrangewhenvaluesareloadedtoshareacrosscode-pathsCPUpipelinesre-arrangeinstructionstominimizeL1-3cachevs.RAMlatencyAsingleCPUcorewillexecuteinstructionsconcurrentlytouseinternalcomponentsatfull-capacity
Air Gap Hardware
Physically separated systems/networks No logical interaction across boundary Physical data transfer across boundary
What are four problems when dealing with passwords?
Poor Entropy -humans are the weakest link ... they are so bad at randomness --commonly used passwords, reusing passwords, patterns (incrementing numbers, repeated words, etc) Phishing -humans are poor choices in character --Users predictably give passwords to attackers without knowing they did so Reuse -Humans reuse passwords due to relatively small storage capacity --In 2020, nearly everything requires a login --Important and unimportant services Credential Pivoting -Humans fail to account for implicit trust and reset mechanisms --Few services are willing (or able) to bind userdata to passwords --Would rather treat passwords as a policy protection and allow overriding --Provide automated "password reset" mechanisms usually through email
Canonical DH Vulnerabilities
Poor randomness when selecting a or b -If can recover one, g^ab mod p is trivial Poor selection of p -Pohlig-Hellman Algorithm -Non-trivial sub-group with different generator Computation over-match -Discrete Log Record: 795-bit in ~100 days
Canonical RSA Vulnerabilities
Poor randomness when selecting p & q -If can recover one, other is trivial Insecure strategy for generating p & q -Vulnerable example: p = prime(n), q= prime(n+1)¡ Brute-force computation overmatch -Can factor 512-bit non EC2 for ~$75 -$100M of special-purpose ASICs Algorithmic advances -Pre-Quantum: Number Field Sieve (NFS) -Post-Quantum: Shor's algorithm
Return-to-libc
Reuse code from vulnerable binary -Already loaded into memory -Already marked as executable IDEA: Setup a ret so it acts as a call
Cloud Provider TCB
SaaS: Software -Amazon WorkMail PaaS: Platform -Elastic Container Service IaaS: Infrastructure -EC2 Instances <many more layers of internal services> All on top of Local TCB
Accelerator Usage
Primitive-Level Variant -Offload actions -Software provides: --Action-specific input - CT/PT/data/sig+data --Instance-specific secret -Accelerator provides --Primitive algorithms --Action-specific output Protocol-Level Variant -Offload layers -Software provides: --Configuration --Long-term secrets -Accelerator provides: --Protocols negotiation --Primitive algorithms --Short-term secrets --Plaintext messages
Security Design is not a Product, it's a
Process Can't be added later on It's an on-going effort throughout the lifecycle *Security is not a checkbox to hit on the way to releasing a product
SELinux/App Armor
Process Isolation + OS-level sandboxing HEAVILY patched set of kernel modules "Know what an application is suppose to do and don't let it do anything else." -ls doesn't need network access -Print driver doesn't need keystrokes
Linux Process Model
Processes permissions are nearly identical with a slightly different security mechanism. -Process inherits user permissions (default) -Have an Effective User ID (EUID) and Effective Group ID (GUID) -EUID/GUID can be set in various ways: --sudo, setuid, sg, ... --Requires root user
UDP (User Datagram Protocol)
Protocol that operates instead of TCP in applications where delivery speed is important and quality can be sacrificed. -Extremely simple connectionless protocol -16-bit checksum is only functionality -Often used when: --Dropped packets are OK (streaming video) --Want to handle recovery at application layer (no ACK, SYN/ACK, etc. ... just sends packets regardless of whether they make it or not)
Textbook RSA Operations
Sign(m)[using priv-key] -sig= H(m)^d mod n Verify(m)[using pub-key] -(sig)^e mod n =?= H(m) Encrypt(m) [using pub-key] -ct= m^e mod n Decrypt(m) [using priv-key] -m = ct^d mod n
Why use TLS?
Provides generic, secure channel with very little overhead Getting the details correct for a secure channel is very difficult The network is evil!! -Government surveillance -ISP tracking / ad injection -Compromised Wi-Fi routers -used to get your info/message across securely
Risk limiting Audits
Random sample of ballots are manually reviewed Even with relatively small sample size, can gain high confidence
Refraction Networking
Refraction Networking is a censorship avoidance technique which relies on mimicking multiple protocols simultaneously in a way that only a secret can extract inner.
ASLR (Address Space Layout Randomization)
Requires many changes to compilation and/or loading -Code must be "relocatable" or "position independent" -<Details are out-of-scope> IDEA: Make it impossible to predict addrs
HTTP Response
Response to client's get/post request -Has status, headers, body -new content defined with \r\n -end of header defined with just a \r\n -if status is ... --200s = server got what you wanted --300s = redirect --400s = error (invalid, can't find, etc) --500s = something went terribly wrong, server crash, etc.
Morris Worm
Robert Morris, grad student at Cornell, created a program to copy a message to systems on the Internet He wasn't as careful as he should have been with limiting the propagation Brought the Internet to near collapse for several days in 1988 First Denial of Service attack -Infected 10% of the Internet -Repeatedly infected machine -First CFAA prosecution
Preventing XSS
Same as before (don't/protect/validate) Avoid dangerous patterns -dom_ele.innerHTML= untrusted_data -eval(validate(untrusted_data)) Escape user-provided data -"<" -> "<" (still renders as "<") Content Security Policy (CSP) -Server explicitly indicates what domains content will be fetched from in HTTP response
Example: Drive Encryption
Sealed decryption key stored on-disk TPM validates user password and any other logic TPM releases drive decryption key to OS
TMP Keys
Secrets are either generated on-board or injected Uses internal "fuses" to make permanent Derive many secrets from single root secret w/ validation
Why use ECDH?
Secrets are significantly smaller -384-bit vs. 3072-bit for 128-bit security -Keyshares are significantly smaller -Attacks against ECDH aren't as mature as those against Finite-Field DH -Significantly faster than Finite-Field -Significantly harder to break curves compared to prime-order cyclical groups
Oversimplified Descriptions
Security CPU Instructions -Trusted actions in standard hardware Crypto Accelerator -Fast, trusted actions in add-on hardware Trusted Platform Module -Trusted actions in built-in hardware w/ keys Hardware Security Module -Fast, trusted actions in add-on hardware w/ keys Trusted Execution Environment -Fast(ish), trusted logic in common hardware w/ keys
Over-simplified descriptions of security hardware
Security CPU Instructions = Trusted actions in standard hardware Crypto Accelerator = Fast, trusted actions in add-on hardware Trusted Platform Module = Trusted actions in built-in hardware w/keys Hardware Security Module = Fast, trusted actions in add-on hardware w/keys Trusted Execution Environment = Fast(ish), trusted logic in common hardware w/keys
Applying Principles
Security Model-An abstraction to subjects, permissions, and objects to allow reasoning about S&P properties. Security Policy-The mapping of subjects, permissions, and objects to implement the security model. Security Mechanism-The technical measure that enforces the security policy.
Link Tracking
Send Alice-specific URL via email and connects email with cookies
Common Content Injection SRC
Server relayed content -Attacker uploads data to a website that the victim later loads, fetches, and renders -Forums were a bad idea (TM) URLs -Attacker convinces victim to click on link -HINT: Project 2, Problem 2 Cookies
Thread Sandbox
Shared memory + isolated concurrency Threads interact via memory & IPCs Tainted threads can be killed and restarted -"Do one thing and do it safely" -A "policy engine" can blindly enforce data interactions and data exchanges -Very useful for web browsers --Request content, run JS, render image, etc are *very* different things with predictable inputs and outputs -Better than nothing but is exceptionally hard to get correct on non-trivial logic
Counter Mode (CTR)
Similar to OFB mode, but instead of using a random IV value CTR mode increments an IV counter for each plaintext block. GOOD -- key-unique nonce, if key is known then CTR is compromised -Key-unique nonce || counter to avoid ECB mode inter-block leak -No padding because used as stream cipher --CT = Encrypt(key, IV) XOR block || = concatenation Nonce || Counter combined with key into block cipher and that output is XORed with a block of plaintext resulting in CT The counter is incremented for use in the next block cipher
Malware Installed via User
Social Engineering -User is tricked into installing themselves -Can be last-resort of drive-by-download Freeware/Shareware -Cheap, low-effort applications as bait -Packed w/ arbitrary libs -If you can't figure out what the product is... it's probably you. Untrusted sources -Even if it works 100% the same, it's most likely not -SIDE-LOAD APKs are extremely dangerous "Cracked" software -Promise of free-version of paid software -Often actually are "key-hacked" version -WaReZ, Torrents, P2P "Bundled" software -Installs the software you want to install -Also install its friends
Problems with MFA
Something you know = something you can forget Something you have = something you can lose Something you are = something that you can mimic or cease to be
DoS Defenses
Standard DoS attacks are relatively easy to defend against via standard defenses. -Over Provisioning-Infrastructure is built for more load than is expected -Active Defenses -IPS automatically blocks abnormally high-traffic clients -Puzzles-When under duress, server requires client to solve CAPTCHA Advanced DoS attacks require specialized defenses and custom infrastructure. -use of cloudflare and others to help network huge amounts traffic --traffic goes through cloudflare --someone contacts your website, their request goes to cloudflare instead of to your website. Cloudflare requests it from your website. If someone comes again, cloudflare already has a copy of that request. This help against botnets flooding a server.
Surveillance
Surveillance is the act of monitoring a person, place, or group for explicit purpose of gathering information on their activities. HUMINT: Human Intelligence =Alice says Bob is at work right now GEOINT: Geospatial Intelligence =Imagery says Bob is at work right now SIGINT: Signals Intelligence =ELINT: Bob's phone is at his work right now =COMINT: Bob texted his wife that he was at work
3DES (Triple DES)
Symmetric Key Algorithm, Applies DES three times (to each data block), 168-bit key BAD -1995 -A "hot patch" for DES via RFC -Exact same algorithm -Encrypt -> decrypt -> encrypt why bad? -Vulnerable to "meet-in-the-middle" attacks (brute force), only gives 112 bits of security since 56 bits was already broken (DES) 168-56 = 112 -2016 -Practical collision attack (Sweet32)
TLS vs SSH
TLS: -Usually anonymous client (server-auth) -Almost always PKI for auth (CAs + SSL certs) -Lots of optimization for static(ish) content -Large number of connections to large number of hosts -Minimal/Optimized setup SSH: -Forced Bi-directional authentication -Almost always auth via manual-config + TOFU -Focused on real-time & bi-directional data -Small number of connections to small number of hosts -Very verbose setup
Usage: Out-of-Band Secret
TPM available over removable USB Explicit trust boundary Greatly improved usability with strong security properties
Example: Secure Boot
TPM validates firmware signature before booting If invalid, refuse to launch bootloader Used as foundational trust for validating higher-level software
What is the Web?
The "web" is an array of protocols, standards, and un-written conventions for providing content via the Internet. -Javascript, HTML, HTTP,HTTPS, URL, ... -More "frameworks" than should ever exist in the history of the universe *The web was built to serve cat pictures* NOT SECURE
ARP protocol
The Address Resolution Protocol (ARP)allows hosts to map IP addresses to MAC addresses in a peer-to-peer manner. -Local table of IP <-> MAC addr for local IPs -ARP Probe --"What MAC is associated with 1.1.1.1?" -ARP Announcements --"Have IP 1.1.1.1 and my MAC is XX:X...X:XX" --"I am the gateway to the Internet at XX:X...X:XX" "Default gateway" is path to the Internet
IPv4
The Internet Protocol version 4 is the dominant protocol for routing traffic on the Internet, specifying "to" and "from" addresses using a dotted decimal such as "122.45.255.0". -Commonly used for client-side addressing -4-byte address (232total == ~4 billion) --172.19.144.53 -Commonly referenced in "CIDR notation" --1.1.1.0/24 --> 1.1.1.0 -1.1.1.255 (first 24 bits are frozen)
IPv6
The Internet Protocol version 6 provides a large number of new addresses to route Internet traffic, using "from" and "to" addresses written as colon-hexadecimal notation, such as "fe80::42:acff:feaa:1bf0". -Sometimes used for server-side addressing -16-byte address (264total == ~18 quintillion) --2001:0db8:0000:0000:0000:ff00:0042:8329 -Will be the standard in 1999, 2004, 2008, 2013, 2016, 2017, 2020, 2025? Who knows....
Mirai botnet
The Mirai Botnet was mostly comprised of IoT/embedded devices breached via default usernames/passwords. -~600k bots generating 600GB -1TB of flood traffic towards victim -Took down DynDNSfor ~2 hours in 2016 (Major provider for US)
Physical Layer
The OSI layer provides the means for transmitting data bits over a physical medium (electrical engineering stuff). The actual encoding mechanism used to represent bits in a physical form. Lots of different ways to modulate signals -AM/FM, QPSK, PWM, ... Lots of ways to transit signals -RF, electrical impulse, blinking lights Mostly handled by EE not CS
Secure Shell (SSH)
The Secure Channel (SSH) protocol is another widely-used secure channel optimized for terminal-access and administration. -Similar but significantly different messages. -Bi-directional public keys for authentication -Uses "PEM" encoding, not X509 -Structured trust dependencies are very rare
Call Stack
The call stack is all of the call frames of the currently executing function calls (e.g. the main function call and all of its helper functions). These call frames are arranged in a stack, with the original function up top, and the most recent function call at the bottom. If the current function calls a helper function, you add a new frame to the bottom. When a helper function completes, you remove the call frame from the stack. -Starts at 0xffffffff -Grows toward 0x00000000 Bottom of stack is highest address and top is lowest address -ESP ( ) points to top-of-stack --"Stack Pointer" -EBP ( ) points to bottom of current frame --"Base Pointer" / "Frame Pointer"
Hash Collision Attack
The collision attack lets us generate two messages with the same MD5 hash and any chosen(identical) prefix. Due to MD5's Merkle-Damgård construction, we can append any suffix to both messages and know that the longer messages will also collide. This lets us construct files that differ only in a binary "blob" in the middle and have the same MD5 hash, i.e.prefix‖blobA‖suffix and prefix‖blobB‖suffix have the same MD5 hash
TLS Protocol
The foundation of many/most (but not all) client traffic protection on the internet. It isn't secure? The solution is probably TLS. -FTP --> FTPS (file transfer) -IMAP/POP3 --> IMAPS/POP3S (client-to-server email) -SMTP --> SMTPS (server-to-server email)
Root-of-Trust
The fundamental secrets that are used for achieving the three fundamental properties (confidentiality, message integrity, sender authenticity)
Application Layer
The highest-layer protocol and handles the logical interactions between endpoints. ex. HTTP, SMTP, DNS, etc.
Authentication
The mechanism by which parties prove their identity to the others
Root Certificate
The original digital certificate issued by a Certification Authority.
Electronic Codebook Mode (ECB)
This means to encrypt each block independently, using the same key for each. It is rarely used. -The message is divided into blocks, and each block is encrypted separately. -Blocks of plaintext combined with key through the block cipher encryption give a Cipher text output, this is done independently for every block of plaintext -Pad last block to correct length -Each block of plaintext fed through cipher -Embarrassingly parallel, random access BAD -why bad? --Because ECB encrypts identical plaintext blocks into identical ciphertext blocks, it does not hide data patterns well. || every block of plaintext has same cipher text value & vice versa, doesn't change --Lack of Diffusion: What is Diffusion? -if we change a single bit of the plaintext, then (statistically) half of the bits in the ciphertext should change. Also, if we change one bit of the ciphertext, then approximately one half of the plaintext bits should change.
Long & Tedious Ballots
Too many races to make informed decisions on all Give up and not make it to the end of ballot Forget to flip it over for races on the back
Onion Routing
Tor is an option for protecting against network-level attacks =Strictly better S&P b/c no single-point of failure for single actor
Preventing CSRF
Use SameSite cookie attribute -Cookie will only be sent on requests that originate from the original sender Secret HTML tokens -Website adds random tokens to its form-inputs and ensures that they are returned Referer Validation -The server checks the contents of the "referer" header in order to validate request's origin
Stream Cipher
Use a keystream generator and encrypt a message one bit at a time, usually implemented in hardware -Shared key known by all participants -Key is "expanded" to the length of the message (using PRG). This helps with our problem in One-time Pads. -Infinite length One-Time Pad Plaintext digits are combined with a pseudorandom cipher digit stream (keystream). In a stream cipher, each plaintext digit is encrypted one at a time with the corresponding digit of the keystream, this gives a digit of the ciphertext stream. In practice, a digit is a bit and the combining operation is XOR.
Multi-factor authentication
Use of several authentication techniques together -Something you know --Password, PIN, pattern -Something you have --Phone, security token, ID card -Something you are --Biometrics
Telescoping Encryption
Used in Onion Routing. -As connections traverse "circuit" to destination, layers of encryption are removed one-by-one at each node -At the exit node, message is not encrypted -As connection traverses "circuit" back, layers of encryption are added back. Example: -At entry node: Encrypt1(Encrypt2(Encrypt3(message))) -At first middle node: Encrypt2(Encrypt3(message)) -At second middle node: Encrypt3(message) -At exit node: message -Back to second middle node: Encrypt3(message) -Back to first middle node: Encrypt2(Encrypt3(message)) -Back to entry node: Encrypt1(Encrypt2(Encrypt3(message)))
Elliptic Curve Diffie-Hellman (ECDH)
Uses elliptic curve cryptography instead of prime numbers in its computation -Operates on elliptic curves over prime-order finite-fields -Widely used curves are named and their names may/may not be meaningful
How Diffie-Hellman Functions
Very Similar to RSA BUT not identical -Uses a prime modulus p instead of a composite modulus n -Uses a generator, g, instead of a message m -Modular Exponentiation w/ Prime Modulus --Multiply a value by itself enough times over a prime-order finite field and you can't figure out how many times you multiplied it -Each actor selects a secret (a, b) -Create/Send "keyshares" based on secret -Use secret and others' keyshare to create a shared secret only known to actors -standard generator g -prime modulus p Alice -> g^a mod p Bob -> g^b mod p How it works is ... g^ab mod p == g^ba mod p
Cyber-kneecapping: Backdoors
are a mechanisms used to surreptitiously weaken what is thought to be strong defenses. Most obvious is a password or interaction sequence that allows access
Voter Authentication
Voter Authentication is that votes are cast only by eligible voters and within the rules of the election. Eligible Voters - Rules differ greatly Number of Votes - Usually 1x but not always
Voter Enfranchisement
Voter Enfranchisement is that all voters are given the opportunity to vote. Inclusive Reasonable
Optical Scan Systems
Votes are marked on hard-copy paper ballots Ballots stored on-device & on-paper Running-count maintained and outputted at the end
What to do instead of internet voting?
We continue educating people on election security issues -Citizens, election officials, politicians, etc We keep trying to solve very hard problems -Usability, Attestation, Cryptography, etc We do the best we can with what we have
Why are URL's ineffective/unusable?
Were originally built to be readable and understandable but are not anymore -Were a replacement for BBS & AOL Keywords (dominant in 1990s) -You can't trick users into looking at them and web security is built around users noticing that they are malicious --why phishing is so prominent, no one checks their URL
Explicit Assumption
What are the creator's intentions? Who does the creator rely on?
What are questions that a defender should be asking?
What assets am I trying/needing to protect? Who am I trying to defend against? Who am I willing to let succeed? What am i willing to trade for security? (Cost v Benefits)
What questions should an attacker consider?
What is the easiest way in/gain access? What is assumed about the system? What did the defenders forget to consider?
Example of one way secure channel
What's 1+1? Include ABCD --> <-- AES256_GCM_SIV(key, ABCD || 2), IV, sig IV || CT AES256_GCM_SIV is your block cipher(AES), nonce reuse resistant using GCM with your key and a nonce ABCD(given by alice) concatenated with the message (2) Then you have your initialization vector It is then signed using the IV concatenated with your cipher text *Alice needs Bob's public key to decrypt/verify signature
TCP (Transmission Control Protocol)
Works at both ends of most Internet communication to ensure a perfect copy of a message is sent. -Complicated connection-oriented protocol -Usually the default for communications -Handles many different aspects --Dropped packets, congestion control, etc
Binary Whitelist
a common technique in enterprise networks used to restrict what applications can be run by the user. -Administrators make a list of approved binaries and OS blocks everything else -Prevents user from running arbitrary code -Major effort to keep updated
Denial of Service Attack
a cyber attack in which an attacker sends a flood of data packets to the target computer, with the aim of overloading its resources OR type of attack which desires to prevent legitimate users from accessing a service. -Come in many different varieties -Usually based on an "asymmetric" tradeoff that favors the attacker --Attacker's cost is very small but defender's cost is very high
Botnet Zombies
a device that has been infected with malware that causes it to participate in a botnet. -Contribute DDoS traffic -Act as a "jump-box" for arbitrary maliciousness -Whatever the owner wants to rent it for
Trusted Execution Environment (TEE)
a general computation environment that provides additional security properties such as access to keys, memory encryption, etc.
Postal Voting
a generic systems where an empty ballot is physically sent to the voter, filled-out remotely, and returned to a central tally location. -Absentee voting, vote-by-mail, mail-in voting, vote via mail -Naïve way provides near-zero protection
NOP Sleds & Repeats
a hacker sends a large number of NOP instructions into the buffer, appending command code instruction at the end. -NOP: "no operation" (i.e. do nothing) -"Sled" consists of many NOPs before desired first instruction --If execution begins anywhere in the sled, then effectively starts where desired -"Repeats" are multiple attempts at overwriting a target value
Digital Signature
a means of electronically signing a document with data that cannot be forged a cryptographic value that represents the private key holder's recognition of the data being signed -Sign data with the private key -Verify data with the public key
Block Cipher
a method of encryption that processes blocks of data rather than streams -manipulates an entire block of plaintext at one time -fixed-size input & output -really fast -Substitutions from secret internal state ("S-Boxes") -Multiple "rounds" to increase substitutions Take a block of plaintext with a key and put it through a rounded function - R(k,m) Do this for however many blocks of plaintext you have
Digital Certificate
a notice that guarantees a user or a website is legitimate
Firewalls
a part of a computer system or network that is designed to block unauthorized access while permitting outward communication. "generic name for a network component that blindly applies a rule-based policy to allow/drop network traffic" Logically, the rules are straight-forward --DO allow port 80 (HTTP) --DON'T allow port 22 (SSH) --DON'T allow port 21 (FTP) UNLESS from remote office
Trojan Horse
a program that appears desirable but actually contains something harmful OR generic type of malware that gains access to the device by claiming to be useful to victim. -Social engineering attacks -Fake anti-virus -Re-packages apps
Forward Secrecy
a property of any key exchange system that ensures that if one key is compromised, subsequent keys will not also be compromised OR property that traffic can not be decrypted by compromising either endpoint after the channel has been destroyed. -Content is protection against future compromises not current/previous --protects past sessions against future compromises of keys/passwords -generate unique session key for every session a user initiates
Stack Frame
a section of the runtime stack holding the values of all variables for one invocation of a procedure. OR A stack frame is a logical area of the call stack which is associated with a single function's execution instance. -Local variable are self-contained -Locally-used heap variables pointers -Record-keeping elements stored in-between
HTTP Cookies
a small piece of data sent from a website and stored in a user's web browser while the user is browsing that website. OR small data chunks that the client stores and returns to the server with requests. -Many, many uses: --Personalization info --Client-specific state --Session authentication -They are really bad when it comes to S&P
Password Manager
a software application that stores and organizes encrypted passwords for a user and is accessed using a single, strong master password -Greatly improves best practice usability -User only has to remember single secret -Can integrate MFA *Not all password managers are created equal
Worm
a software program capable of reproducing itself that can spread from one computer to the next over a network OR a virus that has the ability to spread itself to other devices automatically. -Most commonly via vulnerable network services and network clients -Technique can be re-used for other types of attacks and combined for more impact
Ethernet Protocol
a software program commonly used to connect computers to create a LAN -Media Access Control (MAC) addresses --DE:AD:BE:EF:4D:AD --"MAC address" is different from a "MAC" -Originally "globally unique" addresses --3-byte manufacturer + 3-byte device ID --No longer the case
Diffie-Hellman key exchange
a symmetric standard for exchanging keys. primarily used to send private keys over public networks. It is a construction through which two parties can safely create a shared secret in the presence of a passive attacker -can be used for signatures... but rare -used for exchanging keys (obviously)
Internet/Online Voting
a system where votes are cast via the Internet and often is compared to vote-by-mail in terms of security.
Code Signing
a technique that uses an architecture similar to TLS CAs to ensure the provenance of code. -Similar to binary whitelisting but much more broad and flexible -Attackers can identify correctly signed but weak binaries and use them as loaders
Cross-Site Scripting (XSS)
a technique used to compromise database data in which web page scripting is injected into the server OR An attack that injects scripts into a Web application server to direct attacks at clients OR a class of attacks which extends Content Injection to execute JavaScript in the victim's browser. -Content injection attack with JS injected -Often use "polyglots" to test websites
Obfuscation
a technique which "munges" messages in a way that can be reversed with trivial effort
Containers
a type of virtualization that allows for shared operating systems for more resource savings and faster execution Shared kernel w/ isolated perspective -Each container thinks it's the only thing running on the entire computer Managed via a OS-level "engine"
Key Distribution
actors obtaining cryptographic values (secret or not) in a trustworthy manner Symmetric - both parties need access to a shared secret Asymmetric - Verifier needs to obtain signer's public key
Double-Envelope Approach
allows security properties to be implemented with reasonable trade-offs. -Outer: Identity/verify info -Inner: Ballot w/o info -After accepted, the outer is discarded
Cryptography Accelerator
an add-on component that allows software to leverage custom ASICs for improved performance. Operations are often well-defined and repetitive -14-rounds for AES256 -Trial-and-error for bitcoin mining -Standardized protocols ASIC allows optimized pipelines for specific behavior
PRNG (Pseudo Random Number Generator)
an algorithm that generates a sequence of numbers that seems random but is actually completely predictable maps k-bit random input to an n-bit pseudo random output (n>k) -small amount of randomness turns into a large amount of kinda randomness -use a secret "seed" (s) for unpredictability -not safe for generating keys -safe for some cryptographic uses
Nonce
an arbitrary number that can be used just once in a cryptographic communication -pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks
Credential Stuffing Attack
an attacker reusing known username-password combinations from one breach on a separate service -Relies on: --Ubiquity of accounts --Static email addresses --Password reuse --Laziness
HTTPS Spoofing
an attacker uses a domain that looks very similar to that of the target website. With this tactic, also known as "homograph attack", the characters in the target domain are replaced with other non-ASCII characters that are very similar in appearance. The unsuspecting user is very unlikely to notice the difference and is rest assured by the browser's secure connection indication. This is after they inject their own root CA into the client's browser and that's why it has the secure connection indicator Looks very similar to Phishing
One-time pad
an example of perfect (unbreakable, proven, guaranteed) encryption -achieved by using, only once, a random key that is as long the message itself. -really fast, really simple -uses XOR -key has to be as long as message which results in a problem ... if your message is 10Gb then your key must be 10Gb ... that's a lot of space taken CT[i] = Msg[i] XOR Key[i] ex. Plaintext 011010101101001100 Key XOR 110101010101101011 CipherText 101111111000100111 Decrypt by XORing key with CT to get plaintext The key must be truly random. The key must be at least as long as the plaintext. The key must never be reused in whole or in part The key must be kept completely secret
SOL-Injection Attacks
are a technique that exploits mechanical database queries to gain full-access to an SQL database. Conceptually similar to injecting shellcode, XSS, and "shell injection" techniques = Exploits data vs. code confusion = "Escape" data element via built-in syntax Very common in web applications Example: Expects: '123' SELECT * FROM Users WHERE id = 123; Gets: '1 OR 1=1' SELECT * FROM Users WHERE id = 1 OR 1=1; Evenworse: '1; DROP TABLE Users'" SELECT * FROM Users WHERE id=1; DROP TABLE Users;
Cyber-kneecapping: Cryptographic backdoors
are ones who allow the holder of a secret to compromise the cryptography involved.
Cyber-kneecapping: Permitted weaknesses
are those which a nation-state has awareness of but chooses not to disclose of their existence.
Return-to-Shellcode
binary exploitation technique in which the attacker injects and executes pre-compiled instructions. -Insert instructions into buffer -Change EIP to point to own instructions -Achieve "remote code execution"
Authenticated Encryption with Associated Data (AEAD) Cipher Modes
cipher modes provide confidentiality and message integrity simultaneously -does not provide sender authenticity -Commonly use seal() and unseal() instead of encrypt() and decrypt()
Ransomeware
encrypts" the victims files and then tries to sell the decryption key. -Usually encrypts files with random secret and then encrypts that secret with pub-key -The attacker will decrypt the local encryption key once they're paid. -...sometimes...
How TCP handles dropped Packets
ex. Server can't send a full picture over the internet; therefore, they send 1/2 the pic instead. Client send an ACK saying they got it and to send more. The server send the other 1/2 ... the client sends ACK saying it got it. Secure packet transfer ... BUT What if the first 1/2 of the picture was dropped, the server sent the second 1/2 after the first. Client says "hey I only got part 2 of the pic". Sever sends the first part again and TCP rearranges the packets in the correct order (first 1/2, second 1/2).
Modify-On-Scan Attack
ex. Unclear Ballot seamlessly moves marks to the attacker's preferred candidate while preserving the voter's marking style. It is effective for a wide variety of marks and ballot designs. In the examples above, original ballot scans are shown on the left and manipulated images on the right.
Binary Exploitation
general name for techniques used to intentionally trigger bugs in a way meaningful to the attacker. -Not all buffer overflows are controllable -Even if controllable, may not be exploitable -Even if exploitable, may not be predictable -Even if predictable, may not be useful
Key Generation Algorithm
generates a related key pair simultaneously
Content Injection
generic name for attacks that are reliant on the web servers incorrectly trusting user-generated data. -inject arbitrary text into the website in order to change what is displayed to the viewer.
Spam
generic name for mass, untargeted advertising via the Internet. -Email, chat messages, SMS, robocolls -Goal is fraud and not credentials
Link Layer
handles all the physical details of interfacing with the cable, including the network interface card and a device driver. responsible for addressing and switch for intra-network endpoints -Switches dispatch to next switch based on physical port tables -"Talking among friends" -Everything inside a single router's scope
Principle of Complete Mediation
having a trusted entity validate any privilege use to ensure its validity. -OS checks if user X can run app Y
URL Example
https://example.com/about.html?src=home -Protocol: HTTPS -Host: example.com's IP address -Port: 443 (implicit via HTTPS) -Page to Display: About -Format of Page: HTML -Where came from: Home-page ("src")
Padding
includes adding data to the beginning, middle, or end of a message prior to encryption. In classical cryptography, padding may include adding nonsense phrases to a message to obscure the fact that many messages end in predictable ways
Network Input Buffer Overflow
int getField(intsocket, char* field) { intfieldLen= 0; read(socket, &fieldLen, 4); read(socket, field, fieldLen); return fieldLen; } int read(int socket_to_read,char* dest_buf,size_tlen_to_read);
Adversary
intelligent actor (person, group, organization) not restricted by expectations has own capabilities, motivations, intentions
Advanced Persistent Threat (APT)
is a class of actors with special characteristics. Advanced: Access to or able to develop special-purpose tools and techniques Persistent: Predefined targets and leverage continued/long-term access Threat: Intelligent and coordinated action across entire spectrum of operation
K-Anonymity
is a less-awful way to anonymize data that generalizes it until no longer re-identifiable to a chosen degree.
Global Passive Adversary
is a type of nation-state behavior that is able to monitor nearly-all traffic on the Internet. Do not have full control or insight but effectively do Think of a "Super Eve"
Shelling-Out
is a very common technique that involves calling a bash command from an application to perform canonical actions. Commonly used to do complicated but common and self-contained operations -File operations, start/stop other processes, etc Is unsafe when using untrusted input -Usually ends in "shell injection" vulnerabilities
Initialization Vector (IV)
is an arbitrary number that can be used along with a secret key for data encryption. This number, also called a nonce, is employed only one time in any session. -Basically it is a block of bits used to randomize the encryption & to produce distinct ciphertexts even if the same plaintext is encrypted multiple times (without the need for a slower re-keying process) Technically: "A non-secret binary vector used as the initializing input algorithm for the encryption of a plaintext block sequence to increase security by introducing additional cryptographic variance and to synchronize cryptographic equipment."
Cryptographically Secure Pseudorandom Number Generator (CSPRNG)
maps a k-bit random input to arbitrary-length pseudorandom outputs -similar to PRNG but more more complicated (also slower and harder to implement) AKA better but slower -safe for generating keys & all other randomness needed for cryptography - it is the only trustworthy way to generate arbitrary amounts of randomness from a seed
AES-GCM-SIV
mode of operation for the Advanced Encryption Standard which provides similar performance to Galois/Counter Mode as well as misuse resistance in the event of the reuse of a cryptographic nonce -SIV = Synthetic Initialization Vector -2019-- very new -nonce resistance version of GCM -still provides confidentiality & message integrity even if the nonce is reused.
Buffer Overflow
occurs when a program tries to place more information into a memory location than it can handle. OR lass of memory corruption bugs where a program inserts to put too-much data into a too-small memory allocation. void print_name(char** argv) { char buf[10]; strcpy(buf, argv[0]); printf("Running: %s", buf); }
Pseudo Random Function (PRF)
output mimics randomness regardless of input -output always "looks" random -Inputs are kept secret so attacker must guess what the output is -sounds like hash functions but isn't -using hash as PRF doesn't make it more random -using a HMAC as PRF is better HMAC(seed, x) = y seed is k & y is n
Internet Layer
responsible for addressing, packaging, and routing messages on the Internet. responsible for addressing and routing for inter-network communications. -Routers dispatch to next router based on destination groups -"Talking between organizations" --Logically grouped into "Autonomous Systems" (ASes)
Transport Layer
responsible for providing communication with the application by acknowledging and sequencing the packets to and from the application. (responsible for ensuring that the data is processed in an orderly manner.) Usually uses "ports" to indicate which program sent or should handle a message Lost message recovery Congestion control
ROP Gadgets
ret ==0xc3 -Could be part of another instruction -Could be part of an address X86 uses "variable length instructions" -The instructions' bytes are interpreted based on where decoding starts (EIP location) Any 0xc3byte is a valid ROP gadget
Malware
software that is intended to damage or disable computers and computer systems. -Operate in a non-obvious manner -Cause S&P harm in some form or fashion
Authentication in Securtiy
the act of confirming whether or not a piece of data claimed true by an entity is actually true -Often used in relation to an identity --Website authenticates user's identity via username and password --Phone authenticates user's identity via fingerprint, facial features, or PIN/password
Reflection Attack
the attacker sends packets to a known service on the intermediary with a spoofed source address of the actual target system. When the intermediary responds, the response is sent to the target. OR type of network attack where the traffic is "bounced" through a third-party in order to hide its source. -Usually relies on forging the source IP --Causes the 3P to send traffic to the victim -Victim can block the "source" but attacker can simply change the "source"
HTTP (Hypertext Transfer Protocol)
the protocol used for transmitting web pages over the Internet; base-protocol through which web servers and web clients communicate. -Idea is extremely simple -Implementation is extremely complicated
Public Key Infrastructure (PKI)
the system for issuing pairs of public and private keys and corresponding digital certificates OR is a complex system of actors, rules, and procedures intended to instill trust in the true owner of a given public key. Major Models: -Web of Trust -Distributed peer-to-peer network -Certificate Authorities -Trusted 3rd party network
HTML (Hypertext Markup Language)
the written code that creates Web pages and links; a language all computers can read -root mechanism for all web content BUT In 2020, almost no one builds websites in HTML anymore due to time/skill required. -Frameworks are almost universally used for building -ColdFusion, NodeJS,TrueForms, ASP.NETLaravel, Django, PHP, Ruby on Rails, Flask -WORDPRESS SHOULD DIE IN A FIRE People need to start using HTML for their websites, there are so many mistakes that can me made when you use prebuilt websites/website builders, etc. ... plus there's so much you can do with HTML
Implicit Assumption
think "outside the box"
Shellcode
transfer control to a user command-line interpreter, which gives access to any program available on the system with the privileges of the attacked program. OR small piece of code used as the payload in the exploitation of a software vulnerability -Compile your own code to be executed -Inject into the binary -Jump to your binary instructions void injected_function() { spin_target: goto spin_target; }
Public Key Cryptography
uses two keys: A public key the sender uses to create encrypted messages. (pub-key ... pk) A mathematically-related private key that the receiver can use to decrypt messages encrypted by that public key. (priv-key ... sk) asymmetric- Not a single shared secret between all parties (b/c one has pub key and other has priv key)
Control Flow Hijacking
when the attack gains the ability to maliciously influence the program's execution path. -End-goal of most binary exploitation attacks and technique *If you control EIP, you control the world.*