eiswideshut

Some of my peers (in and out of my tutorial) have had interesting posts up from their blogs, and I’ve really felt enlightened reading through them. Here are a few snippets of the feedback I’ve given them.

I also received feedback from my peers for my post on ‘How to Steal a Penguin”

(Week 8 Activity)

Designer handbags are beautiful no doubt, you pay the price for quality material and touch of class and time taken to handcraft each piece. But what has always been interesting for me is to see the almost exact (well pretty much exact to most eyes) fake being sold in markets in certain parts of the world for largely lesser prices. If you are a fashion enthusiast and pay attention to touch and feel of the material, sure you would find a way to unspool yourself. But for majority of the folks, you just wouldn’t be able to say. I remember walking through a street market on holiday and we came across a store that sold ‘designer handbags’ at non-designer prices - your first thought? PECULIAR. But looking close, you couldn’t say the difference unless you held the original by its side to observe subtle changes in pattern position, or the stitch used, the shine of a buckle, or the way the logo was placed.

To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.

For this challenge, I had to research on setuid:

setuid is a linux command which allows any unprivileged user (anyone but the owner user or group of the program) to acquire temporary privileged permission to execute the given program/s. This poses a security risk, as anyone can now execute or alter the program, hence someone can spread malicious bugs through this executable program.

The ‘s’ permission icon states that special permission setuid has been activated as :

-rws------   setuid for a user ----rws---   for setgid for groups

This challenge spec states the home directory has a setuid binary that has to be run. I was confused at how to use the binary at first, as I was not sure about ‘id’ even though I understood the functionality of the command in general, so I had to play with every possibility until I realised where I was going wrong with usage. At the end, a simple ‘cat’ saved the day!

So using the setuid binary given, I changed my current id to act as the owner – which in this case is ‘bandit20’.

This challenge was a bit frustrating, I kept getting logged out automatically when trying to log in to the system. 

.bashrc is a shell script that loads every time you launch BASH interactively. this script is found in the user’s home directory and can be edited. My first instinct was to open and edit it, but I wasn’t quite sure of how to do it. .bashrc is used to load all the user’s terminal preferences and environment variables when the terminal is launched. 

Therefore, I had to find a way to get what I needed, without actually getting in to the server! How to solve this? For some reason , I feel like I may have solved this the cheeky way! I might want to check and see of there was another way of solving it! I used:

ssh [email protected] -p 2220 cat readme

means then the .bashrc file wouldn’t have to run! 

There are 2 files in the homedirectory: passwords.old and passwords.new. The password for the next level is in passwords.new and is the only line that has been changed between passwords.old and passwords.new

This one was relatively simple.

The diff command prints intsructions on how to change/add/delete lines in the first file to match the second file. Since the password is contained in the .new file (and the only difference), we set it to be the first file. 

The diff instructions then state that the line in the first file must be changed to match the same line position in the second file. Hence this is single line has to be the new password!

The credentials for the next level can be retrieved by submitting the password of the current level to a port on localhost in the range 31000 to 32000. First find out which of these ports have a server listening on them. Then find out which of those speak SSL and which don’t. There is only 1 server that will give the next credentials, the others will simply send back to you whatever you send to it.

Once inside, I first had to see what ports I had running currently. Initially I had no idea how to do this, but I started by researching on the given suggested commands. I then realised using nmap to scan target hosts, outputs a port table with each ports state currently. nmap (network mapper) alongside many other behaviours, is a tool used to scan ports. It does this by sending raw packets to available ports, and listening to see which ones are open or closed or any other state.

Once I got the states of the ports, I ran the same openssl command from before to check which ports returned the new password.

The first of the two possible ports returned the same passcode I entered, hence they weren’t the correct ones.

The next (last) port worked and gave me an ssh private RSA key to get the ssh key needed to login to Bandit17. Going ahead, I had to add the RSA private key given into a .pem file and use ssh -i to login with it. 

When I was browsing through some news websites, I happen to click on the secure padlock icon next to the website name (by accident!) and out popped the Public Key Certificate for the website. Lets have a look at what's happening here.

A public key certificate is an electronic document that proves that the website has a public key that can be used to communicate with it. This certificate is basically an SSL certificate (now more known as a TLS - Transport Layer Security) certificate. When you access a website, your browser looks for a SSL certificate on the server end in order to create a secure communication link between you and the website, so that no one else can tamper with the information you are passing through. This is when you see an ‘https://’ on the site url - which indicates that the connection is secure with the SSL protocol and a padlock icon aside it. This is specially mandatory when you are sharing credit card details to this website when shopping online for example.

The certificate typically shows the following:

I wrote up a post on password security for my College group and posted in our Facebook group, in order to advice them. Some of the tips are general ones we all know of, but there are some who need to be reminded!

There were a lot of lunchtime/ dinnertime discussions over the topic so I was really happy and glad I had them talking and getting enlightened!

(I have blocked names for security purposes).

For Week 7, we were given the classic topic of ‘Privacy’, the class was to debate on : “should the Government or Government agencies collect and have access to your data for good purposes, or should citizens, e.g. you, have a right to privacy which stops them?” I was on the team that represented the Government. This debate was quite interesting, I felt that the opposing team obviously had a stronger debate, but it was interesting to see things from the governments perspective. For Government Surveillance:

Promote deference - will help to minimise/stop crime as criminals now know they are watched and all traces will be made.

Collected data can be used for growth of the country, using the statistics to analyse pitfalls, improvements needed in relevant sectors etc.

Prevention of attacks of terrorism, organised crime and counter foreign espionage, by tapping into communication lines and filtering in order to catch such attack plans well ahead.

In Medical sectors, it is good to have medical records stored for Doctors in case of emergencies, so that the right action can be taken by just looking at a database.

In the financial sector, it is good to keep financial records of citizens, so that white collar crime can be targeted.

Monitoring social media profiles allows for identifying and destroying fake profiles, fake bots and prevent the circulation of fake news.

Through Government surveillance and data collection, less resources will be needed for police task forces and physical surveillance, and these resources can be used in much needed departments like infrastructure etc.

Track people’s activities, jobs in other countries, so that in the event of a situation, information is at hand for defence.

Against Government Surveillance / Pro Privacy:

Data can be leaked, no matter how good the intention is in collecting it.

Higher risk of an insider attack - a single point of failure.

Data can be collected and sold to other organisations for large sums.

Abuse of Memes using people’s faces! People lose their right to speech - where people with an alternate opinion to the majority or the higher power, will be drowned out or ‘addressed’ for having such an opinion and being a barrier.

The password for the next level can be retrieved by submitting the password of the current level to port 30001 on localhost using SSL encryption.

This challenge was similar to the previous one, but using openssl. 

Firstly, I had to familiarise myself with openssl. SSL is the Secure Sockets Layer, which creates a secure encrypted link between you the client, and the remote server you are trying to connect to. To create this connection, an SSL certificate must be issued and the website will begin with ‘https’ where ‘s’stands for SSL. This is a visible indication of the website safety here onward.

Using the following command got me the password to get to the next level:

openssl s_client -connect localhost:30001

s_client creates an ssl client for communicating with a remote server, where once authenticated, the client can have secure interaction with the server. The -connect option must state the host name and the desired port number.. Once fully connected, the two ends can communicate to each other. This is similar to using telnet, but obviously more safer.

When I entered the current level password, it gave me the next password in return.

WatchDog is a app that was created in Sri Lanka following the terrible Easter  Terrorist Blasts that took place in Colombo on April 21 2019. Starting from moments after the blasts, the country faced a chaotic rampage of outbursts on social media, news websites and test messages on news updates. Some news were genuine and helpful informing people of the current state of chaos in the country, while others were circulated by sick nasty individuals who just wanted to create more chaos (fake bomb threats, and news based on other disturbing threats). In this state of emergency, people were told to stay indoors and the roads of Colombo and surrounding districts were deserted - and the only way people knew what went on, was by hanging on to the news. Therefore at this point, it was critical to know what to believe and what not to. The aim of the WatchDog was to verify news circulating so that people knew if such news were fake or real.

The app analysed every bit of news post circulating the networks, and matches it to a set of 5 reliable trusted news sources in the country, and if the news was confirmed by any of the sources, the app would post as verified with a green check symbol, and if not identified to be true, is marked as fake News:

I think this is a sheer project of genius - giving the people what they need, at the time they need it the most. It is always reassuring to have a trusted source of information - specially in times of trouble. The emergence of such a resource also helps mitigate the chaotic situation significantly, as fake news spreaders realise they no longer have an audience who would believe them - because the fake news is clearly identified as ‘fake’, instead of only identifying the verified and leaving the rest unanalysed - which I feel is a smart feature.

The main difference between the two is its function. 

Encryption is for two-way communication - where data is encrypted with a Public Key and sent over to the receiver who will only be able to use his/her private key to decrypt the message and read the contents. So every time you sent a WhatsApp message to someone, you can be sure your receiver is the only one who will be able to read it because it is only their private key that's able to decrypt the message. (WhatsApp uses End-toEnd Encryption - which makes sure that not even WhatsApp can read message content, since every single message/attachment has a unique lock and key that only the sender and receiver know).

In contrast, Hashing is a one-way street, by definition, it is infeasible to reverse a hash function and get back the original plaintext. This function is therefore mainly used in password storage, where the initially entered password is hashed (with a salt for added security) and stored in the system. Whenever the user enters the password to login, this entered password is taken, salt added, then hashed, and then compared to the initially stored salted password to check if correct. This way, if ever the system was hacked and all passwords were in the hands of the enemy, they are unable to get the plaintext password as it can’t be reversed.

Encryption deals with public and private keys needed to ‘decrypt’ the message, where as Hashing deals with hashing standard algorithms (currently SHA2) that transform an infinite user-entered input to a fixed hash function that is irreversible. 

Dear Grandma and Grandpa,

I hope you are both doing fine since I spoke to you last week. Im writing to you specially regarding a very important and serious topic so I hope you both read this through seriously!

Password security. I know you both have become very active online shoppers since you started using your iPads, so I just wanted to give you a heads-up on a few tips regarding safe shopping and general internet safety - I’ve been heavily inspired after the Cyber Security classes I’v been taking this semester at Uni.

For starters - Never EVER, do any online shopping or any transactions involving giving your credit card details, over a public WiFi system - stick to doing it in a safer WiFi network like your house or at any other relatives or friends house. Make sure these wifi networks are password protected and not open to anyone to join.

When choosing your password for any accounts (even Facebook specially!), here are a few tips:

Don’t use passwords that make sense or which revolve around any information about yourselves - (like our names for example!). You might think they are safe as long as you keep it a secret, but you won’t begin to imagine how easy it is for a hacker to gain this information by one glance of your profile or a scan through your identity details!

Instead you can use these approaches:

Create a random sentence that makes sense to you: ‘grandpamakesomeletteswith4eggs’ and then add uppercase letters, symbols and numbers where necessary like : ‘6randPaMakesOme1ettesWith4e66s’ 

Another variation would be to create such a long password, and then just pick the starting letters from it and use it as your password: FPMOw4Es

Lastly, and most importantly, make sure you DON’T reuse the same password in multiple account/websites! This is a big risk because if you are hacked in one account, you get hacked in all the other accounts you use the same password for.

I hope this has been helpful! I will check to see if you’ve done well next week.

Love,

(Week 5 Activity)

For this activity, we were given a few Food recipes, and C code programs and asked to spot the vulnerabilities that occur:

Recipe 1: A simple Vanilla Cake

The Recipe does not state then quantities for any of the ingredients. A good cake is all about the right proportions of to ingredients. We are however given the size of the container/s, but how do we know the mixture count overflow? This is a vulnerability.

180 F = 82 C, this is way too low a temperature to bake any cake bug or small!

Recipe 2 - Caramel Slice

No measuring units stated for condensed milk and desiccated coconut. We have no way of knowing the right measure and cannot just assumes the unit follows from the previous.

The recipe does not incorporate the golden syrup even though quantity is mentioned.

Repeated occurrence of weird phrases PLAISTOWE and &semi, thereby making the whole instruction run trustable.

Recipe 3 - Cheese Soufflé