Blogging about comp6441

An example that I have been hearing on the news are fake medical practitioners. There are individuals who practise in the medical field for many years but do not have the qualification or really any knowledge in the area. 

A case in 2018 was that a woman practised psychiatry for almost 22 years without any qualifications and actually had dropped out of med school in first year. This issue wasn’t raised until she had committed a crime of altering the will of a client to gain personal financial benefits.

Analysis of how it could have been done: 

In the situation above, during registration it was claimed that she was a graduate from the University of Auckland

Faked documents? 

Knowing someone on the medical board

How it could have been prevented?

Thorough background check

Further testing if qualifications were obtained in different countries

This week I watched a documentary on Netflix called The Great Hack. Within this documentary was explored the infamous scandal with Cambridge Analytica, it’s connections with the Trump presidential win in 2016 and Brexit.  It also contained main individuals including a journalist , Carole Cadwalladr, from The Guardian who had broke the story, an academic who is suing the company for breach of data and in individual who was a former employee of the company. 

In 2016, Facebook allowed data to be taken through a quiz which was called “This is Your Digital Life”. Cambridge Analytica used a loophole to gain personal information that would  put individuals into different sets of personalities. With each person who took the quiz, the data of their friends were also taken. 

Google yourself: After downloading my data from Google, it was quite surprising that I had 68GB of data with them. Honestly quite scary. It was split into 18 files with 4GB worth of data each. Looking through the files these are some interesting points:

It had stored my “home” and “work” address even though they are slightly inaccurate

Google timeline has data of places that I have been since 2016…with associated photos that I had taken at the location…concerning. Maybe some sort of automatic geotagging because of using a Google pixel phone.

Facebook Data: Looking through my Facebook data, it doesn’t seem too surprising as these are the types of information that I have put out there myself. For example, posts that I have liked, commented on or reacted to, pages that have been liked, ads I have clicked on etc. But something crazy is in the section “Advertisers Who Uploaded a Contact List With Your Information”, many of these companies I have never heard of and assume I have not interacted with before.

Grateful that my something awesome was recorded in motion! It shortly stopped working after I started to try and make it look better.

Privacy:

Methods of prevention: 

Private mode/incognito – not very effective as it still sends ip addressing 

Different browser – duckduckgo

Take care of your accounts – don’t link accounts, logout when you can 

VPN 

Onion Routing – divert request through different nodes and at each node it is encrypted and decrypted 

Main ways it will go wrong – if you log into a service then it compromises the anon.

Why be concerned? 

Imbalance of power

Forensics:

Technicians and examiners

Stages: 

Acquisition/imaging – create an image of the drive, hashing, chain of custody 

Analysis: Keyword searches, recover deleted files

Types of Forensics:

Computer – memory forensics, data forensics 

Mobile Devices – phone

Network Forensics – router, switches, packet capture o Database forensics

Tooling: 

Encase, autopsy, the sleuth kit 

FTK Imager

Driver and Partitioning (FAT32)

Three Mile Island:

Interesting books: Just culture, Human Error, The Challenger Launch, Normal Accidents, Commander in Cheat, History Lessons, the Art of Social Engineering Watch: The China Syndrome

Errors:

Root Cause Analysis: Work out what went wrong o For future prevention, stop mistakes being repeated o Reactive way is not that great, looking behind the causes is better. o Most common stories when issue happens: (blame) 

 1. User Error/Operator Error/ Human Error – solve the problem quickly, humans like blaming people, sack that person and there’s nothing in wrong with the system. (In cyber security there is always human error but it isn’t one person, it is a group).  previously it used to be the last person who touched it, i.e. the puppy dog syndrome 

2. Equally Easy to use as an excuse as (1) – Culture – No one is really to blame, there is just a bad culture. We are all to blame. How to fix it? Educational sessions, training sessions. Changing culture is difficult. 

3. System – too tightly coupled and non coherent therefore vulnerable to attack.

Human Weakness: 

Honesty – It is human nature – lying to yourself is the best lie. 

Some unis have a honour code, study to see if the honour code will affect individual’s behaviour. The study took a group – result: signing the honour code first and then the test and the second scenario is signing it after the test. People were more honest signing it before the test.

Misdirection and Limited Focus: 

Humans can’t really stay in focus 

Subject to misdirection, focusing on somewhere else instead of what you’re supposed to; it is usually what grabs your attention. 

Groups of people who use misdirection: Social Engineers and magicians.

 How? Talking, gestures, sudden events. 

Logically Important vs psychologically salient 

Similarity Matching – make a situation look that a situation that has happened before but it actually isn’t. – don’t have to think very much (Problem Solving Strategy) 

Frequency gambling – When there is a match, the pattern you pick is the one used most often in the past that has worked. (Problem Solving Strategy)

How is an accident different to an attack? intent. Murphy’s law – Randomness can protect you in normal situations but not in security. Attackers can line it up. 

Can get away with accidents but cant get away with attacks.

Availability Heuristic

Confirmation Bias – only pay attention to what we want o Evidence doesn’t really align

Satisficing – trying to get something that is good enough – just to get it ok and reasonable

Bounded Rationality – Small amount of focus, bounded focus. Doing shortcuts to preserve focus. o People prefer positive statements o Overriding tendency to verify generalisations rather than falsify them. o Once humans have adopted on opinion, they draw all things to support and agree with it.

Group think syndrome o Even if it’s a stupid plan – but then doesn’t speak o What you value is group membership, harmony, don’t want to be the one that causes issues. o E.g. someone says something that is not funny, but everyone is laughing so you do the same.

System Errors: e.g. Three Mile Island

When everything build up, but not plausible situations.

It is nothing’s fault – it is the system, it is a normal situation.

Everything is responsible, the system you are in. – just culture.

Good Design: 

Coherent 

Low complexity and none can be doing nothing 

Loosely coupled – Can change one thing and it wont break everything. 

Follow the above and it wont be brittle – in the future it will still work. 

 Every new change will be easily implemented. 

If you design a system with good qualities – it can be altered in the future. 

Redundancy = defence in depth. 

If one fails then the other fails – common mode fail. o In the example: buses and taxis are tightly coupled

Cassandras and Apollo – hindsight – belief event has only one significant cause.

Chekhov plays – if there is an element then it will be used.

Looking back, everything seems clear.

Don’t oversimplify things – picking and choosing what can happen in the future.

Sense of power is a dangerous thing.

Hindsight Bias – knowledge of outcome of previous event increase.

If things happen invisibility then it is a recipe for disaster.

Latent errors – when things are hidden – systems in depth – defence in depth might lead to a latent error 

amusement park with two safety features, if one fails it is invisible therefore we will always think that the system is safe. 

The quad actually works!!!!!! but overall I didn’t do as much as expected. Previously I had wanted to connect a raspberry pi and use it as a flight controller, after researching information I couldn’t find a comprehensive guide and didn’t really know how to use the pi. 

What has been learnt: 

Soldering 

Vulnerabilities of common drones

Understanding different parts of a quadcopter and how they worked

What I vision for the future of my project:

Attach a camera

I have definitely been struggling to keep up, two new assignments for 1521 and 2521 have just been released. Also keeping up with the lecture recordings for those subjects and trying to understand them have been difficult and time consuming. Furthermore, I have been in an interview process for an internship for almost 2 months and gone through 4 interviews. 

How I am to be on top of all of this: 

Do what I can

Focus on tasks that I consider more important - i.e. probably dont need to do all activities for the modules, but understanding the concepts behind them are important. 

Do prereadings and research before tutorials so that I would be feeling lost during also having my own perspective and taking in other perspectives.

Prereading/research -

For:

Reduce time for law enforcement agencies to reach guilty people

Analysis of suspicious behaviour

Security, Finding missing people

Can come in handy in places with masses of individuals/crowded public places

Your face is already everywhere? What’s the difference?

Regulations can prevent the use of data only if a situation occurs or finding someone guilty

Used in other fields such as medical emergencies – alerting authorities earlier.

Against:

Type one and type two errors o Innocent people could be recognised, guilty people may not be recognised

Privacy – we can all be tracked, where we are and our lifestyle – data collection o Can follow anyone anywhere

Sold to third party companies or able to be accessed to be used against us

There is no option to opt out

Common acts such as jaywalking?

Tracking behaviour of people which are normal but can be seen as suspicious or antisocial

A currently trending application right now is the FaceApp which transforms a selfie editing it to a predicted version of the photo when aged using AI. In the app’s terms and conditions it grants permissions including name, likeness, voice, persona which may be allowed to be used in commercial purposes. This has gained traction due to the wording in their T&Cs, and individuals are concerned as to how their data might be used, it is not a single case, but quite common in many other apps including Facebook and Twitter. It is rare that people read terms and conditions, and with that, the convenience of having able to use Facebook and Twitter is worth the trade of your data and their ability to use it. 

Terms of Use: Facebook

Terms of Use: Twitter

Lecture 7: Online

Lecture 7.0. Misdirection:

Gets an individual to focus on the wrong thing which therefore makes the person feel calm and less alert about the right thing.

Common in magicians

Lecture 7.1. Kevin Mitnick Attack

Mitnick hacked Tsutomu Shimomura – he then helped tracked Mitnick down.

Mitnick used source address spoofing and TCP sequence prediction to impersonate a trusted computer to gain access.

TCP/IP – Two protocols of networking o TCP – having a connection – send a SYN package, and send back a ACK package.

Session hijack o Sequence number prediction

When is the best time to attack? – when no one is expecting it

======= 

Buffer Overflow:

When there is more data in a buffer than it can actually handle causing an overflow into adjacent space.

Can cause systems to crash and therefore creating a place for attacks to enter.

To attack using buffer overflow by altering the path of application by overwriting parts of memory.

Vulnerable functions include scanf, strcpy, gets …

Format String:

Exploitation occurs when data put into an input string is read as a command.

Functions that can be exposed to format string attacks include: fprintf, printf, sprintf, snprintf.

Common parimeters used in format string attacks are: %%, %p, %d, %c, %n

Assets:

Multiple pairs of eyes by asking a lot of people

Periodically revise current list of assets

There is always a new category to consider

Standards and protocols are a good starting point

Tangible Assets: Things that can be easily given value

Intangible Assets: Things that can not be easily valued

Confusion - The goal is to increase the vagueness of the ciphertext, each bit in the ciphertext depends on a few other parts of the key therefore making it difficult to find a connection. 

Diffusion - if one bit of the plaintext is changed then half of the bits in the ciphertext should also change. 

Block Ciphers rely on confusion and diffusion while stream ciphers only use confusion. 

Avalanche Effect - if the input is changed slightly then the output changes significantly. It is a desirable quality in cryptography as it ensures an attacker can not predict a message due to the changes through analysis. 

SP Boxes - A S-box substitutes the input by the output and it is one to one. A P-box is a permutation of the bits from the S-boxes. The network applies them in rounds alternating between the two. 

Feistel Networks - Splits the data block into two equal pieces and then encrypting it in rounds. 

Block Ciphers - It is an algorithm which encrypts a set number of bits at a time and they are usually 64, 128 or 256 bits. 

Stream Ciphers - Algorithm which encrypts one bit at a time, designed to approximate a one time pad. 

This activity was so much fun!!! So how I went about this was firstly going through their web page and the information I had gathered were:

The flight controller was flashed on beta flight as seen below. Follow instructions on Betaflight’s github/wiki and play around with the tabs!

The port was selected to set up the communication between the transmitter and receiver. It is set up on UART 1 as it is using IBus. 

The configuration of the motors are illustrated below, since I had put on the motors the wrong way, the toggle for reversed motor direction was selected. The motor protocol was also selected as DSHOT600. 

Lecture 6.0. One-time Pad:

Claude Shannon – father of measuring information

If XORed with something random, then the output will be random.

Each random number is used one and then thrown away

Shared secret is large – it is the size of the message.

Key distribution is a major issue.

Russians and Americans use to communicate using a one time pad. o Duplicate books/ duplicate pages in books o Inception project – Vernam o Discovered a warehouse of one-time pad

Issues with one-time pad – cracked as didn’t use a proper random number generate

Harder to analyse if it is keyboard mashed

Number Stations

Lecture 6.1. Threats:

Can’t defend and patch every single weakness and it is a quite difficult decision.

Spend resources efficiently and effectively

Build up a threat model: 

Systematic approach to list out the possible sources of attacks and problems may come from.

Consider the motives of the possible adversaries 

Think about what the adversaries can gain from the asset that is protected

Prioritizing the attackers

Threat Tree: Assets are nodes, Threats are branches, Cause of threats are sub-branches , Enumerate threat. 

Don’t always worry about the major things – i.e. Hollywood threats – remember there are more boring and smaller threats.

Think about things in advance – i.e. if you’re in mine field, think about it in advanced. o Think about the threat before it happens, and before allocating your resources.

Brainstorm all ideas before saying no.

Incidence Response: o Bush – response to 9/11 is not ideal, it is the system having issue. Failure of design. 

can’t have a single point of failure. 

Be aware of weaknesses in system.

Common threat Classes/Sources of Threats 

Users: Unintentional attacks, malicious attacks

Attackers: - all pose different threats 

Insider attacks – attack at a time that suits you

Casual Attackers – doesn’t target victims specifically, attacks victim while scanning many other targets

Determined Attackers – targets victims, look for vulnerabilities of the victim, has motive against the victim

Funded Attackers – Performs reconnaissance, hires people and purchase equipment to perform attack.

Natural Disasters/Accidents 

Movie Plot Threats

Activity 1: 

Martha's Recipes - Find the errors (vulnerabilities) in the recipes 

Recipe 1: Simple Vanilla Cake

Quantities for ingredients (sugar, butter, eggs, vanilla essence, milk, flour)

Temperature at 180 degrees F --> 82 degrees C which is quite low to bake a cake

Excessive time to bake cupcakes

Recipe 2: Caramel Slice

Extra 100g of butter but no instructions of what to do with this. 

Errors in quantity and no measurement:  

1/2 desiccated coconut - cup? tablespoon?

2 x 395 sweetened condensed milk - grams or mls

No instructions for the use of golden syrup, condensed milk

No instructions on how to make the caramel

Recipe 3: Cheese Souffle

Asked to butter the dish and then melt the butter but there wouldn’t be enough to both butter dish and melt to use in recipe.

No quantity in regards to how much butter actually needed in recipe. 

Whisking egg whites until stiff and glossy but not dry? Vague instructions if someone has not baked before.

Cooking time says 30 minutes but in instructions it says bake for 10-15 mins