#rawnotes

Heap

·       Used when space you need is not known at runtime. It is less controlled and requires the user to free() the memory

Format Strings

·       "%n" means write to memory

·       "%x" means print out next byte and put out as a hexadecimal. It can print out the function innards of previously used functions.

 Bug Bounties

·       Finding a bug on a program and informing the company using a report. Monetary rewards are often given out.

·       Relies on the following of scope - details elements of the program that can be touched and tampered

Process

1.     Find target via recon

2.     Hit target and find vulnerability

3.     Write a report

4.     Submit report to company

Fuzzing

·       Provide program with continuous input and monitor output and anomalies

·       Mutation-based: user provides sample input and fuzzer mutates the input

Pen Testing

Repercussions if not completed:

·       Data breach

·       Ransomware

Importance:

·       Discover vulnerabilities in system before attacks occur

·       Helps test security elements

Process

1.     Recon

2.     Planning exploitation

3.     Exploitation

4.     Post exploitation: establish persistence

Tools

·       Kali

·       NMAP

• Important to understand what your assets are and how you will protect them • It is extremely difficult to do

Strategies for Identification

• Regularly survey the values of people of the involved in what you are protecting - multiple pairs of eyes is a good asset ○ Survey a large range of people - no single person or group should be solely evaluating the assets ○ Examples of the following information that should be gathered are as follows: § How much money would you lose where this data centre to go down for 24 hours? § How much will you lose if your company is disconnected to the internet for 3 hours? • Develop a sensible plan - well designed to tease this information out of them ○ Humans are generally poor at regurgitating everything they know, however they are generally very good critic ○ You need a plan to help you avoid the situation where you overlook things • Periodically revise current list of assets ○ Don’t sent and forget. Values and assets of an organisation can drift

Examples

1. Assets of the share registry of the stock exchange?

• Intellectual data and the share registry data - we don't want people to see the data ○ We don’t people want to change the data • Reputation - if a company loses their reputation, they lose their credibility ○ You can lose your reputation on lack of availability

2. Coke

• Reputation - they don't want to seem like a company profiting on diabetes ○ It is a potential that people consume their products due to their branding ○ Emails may need to be protected ○ Social media accounts

Categories of Types of Assets

Tangible Assets: those that are easily given a value • Gold chain valued at some relatively static amount • Jewellery in a jewellery store

Intangible assets: those that cannot be easily and objectively be valued

• Employee morale and security • Customer information • Company secrets • Availability of services

Is/Ought is a concept brought about by David Hume.

In an irrational mood, an individual may mistake what 'is' as something 'ought' to be.

They may not be able to distinguish between what is correct and what they perceive as correct

Train delay scenario

What would you do when the train breaks down and delays are incurred? - perhaps find the exit

Not sure where this is going

Assessment of risk is dependent on an individual's past experience and intuition

Statistically, people cannot accurately estimate events with a low probability occurrence

Decisions are also dependent on whether there is a high impact consequence

Taking the risk, even when the probability is high and no consequence had occurred is just as bad as taking the risk and producing a consequence/ impact during failure

- e.g. not using a seatbelt and avoiding an accident is still illegal

- The media sensationalizes the consequence and the risk is still present but not invisible

- This is the case for the BF Skinner pigeon training experiment. A good outcome is usually generated by luck because risk is always present. Habit is therefore created by successful repetition of an action or decision with no consequence however this does not always quantify the decision as correct or safe

Terrorism

Number of Australians dying overseas due to terrorism is less than 200 – not as drastic as perceived by the media

Governments have taken advantage of this obsession with terror to pass legislation that have more oppressive consequences than the terrorism act itself on a long term regard.

Mitigation of risks

Use a risk matrix/register - these are arbitrary and subjective

Richard Fineman – research him

He was transparent about the risks involved with a launch (NASA) - they launched at low temperatures which raised the risk of failure because the O-ring is brittle at that temperature

Top managers in the hierarchy of a company will have a less severe understanding of risk involved with failure (e.g. 1 in 1000000 chance of failure)

Engineers working with the details (lower in the pyramid) will have a higher understanding of failure (e.g. perhaps 1 in 10)

How to develop a genuine risk register?

Use a lot of people with diverse mindsets

You can ask a third party to help you but as all humans are self-interested, there is still bias involved

Compliance

This is a useful tool for the prevention of unsatisfactory outcomes

Sets the minimum standard for satisfaction but there is no absolute certainty that this standard will correctly apply to all situations

Read about: Sundance Resource Limited – Republic of Congo

Yezhov – head of police for Stalin during the Great Purge

Better that ten innocent people should suffer than one spy get away – what is the significance of this quote

Bits of Information

Similar to bits of security

Generated by a 1 or 0  

To do:

Mina Margery Crandon was the wife of a senior Boston surgeon Dr Le Crandon

Crandon was an instructor at Harvard Medical School

In 1923, Crandon became interested in psychical research. Attempted table tipping, spirit raps

Mina's spirit control was her deceased brother Walter who died in a train crash.

Professor William McDougall, head of Harvard's Department of Psychology declared his opinion that spiritualism was produced by fraudulent means.

Malcolm Bird from Scientific American magazine asked Mina to prove that psychic phenomena existed.

Committee included Harry Houdini, Hereward Carrington, Dr Walkter Prince, Dr Comstock, Dr William McDougall and Malcom Bird (secretary).

She was subjected to many tests. Harry Houdini was determined that she was a fraud.

He brought an electric doorbell that would not ring. He was admonished about his dishonesty.

Houdini continuously tried to confused Margery but was uncovered by Walter the ghost

They also put an amount of coloured water in her mouth but still were able to allow the spirits to speak freely.

Houdini wrote Houdini Exposes the Tricks Used by the Boston Medium Margery in 1924 to present his explanations of how her tricks were devised. He also accused Carrington and Bird for assisting Margery.

She showed that Walter could produce breezes, raps, spirit writing in several languages, voice manifestations and imprint of spirit fingerprints in paraffin.

A fingerprint left in wax by Walter was found to be that of a Boston dentist Caldwell.

Margery was considered a martyr in the minds of Spiritualists 

Ciphers

Exploitation of order/ entropy

Caesar cipher - shift every letter by one letter

Vignere: each letter is shifted a specific number of letters depending on its position in the word (shifted by Caesar-shift)

Abba - 1221

Decode Hello using money - superimpose 'money' on top of 'hello' and use table (Kasiski test)

HW: index of co-incidence - learn it

Enigma Machine

Substitution cipher

Each letter of the plain text was uncyphered by a different substitution

An almost infinite password (password extender)

HW: look it up and make sure I can use it (rotors only). Understand its weakness - 4 things were not taken into account by the operators

Cyphers are amenable to brute force attacks but they are very time consuming

Bits of Work (Brute force)

2^10 = 1,024

2^20 = 1,048,576

2^30 = 1,073,741,824

Therefore, the work that a hacker must do to decode something is usually half the combination of keys. Therefore 1 million keys means 2^29 bits of work (2^30 is around 1 million so half of that is 2^29)

For the scope of the course, 256 bits of work is the limit

Brute force should be the last resort

India invented chess :P

OTP (one time pad)

Password is the length of the message and shifted by a random amount

Length is known but the message, once decoded can be represented by many types of messages

Key cannot be sent over with the message - can be intercepted by the hacker

You cannot use the key more than once. You can use two messages to decipher each other

Tempest: (verona) - electromagnetic radiation can be monitored (side channel attack)

Number stations: audio recording of someone reading numbers out

HW: lava lamps used to generate random bits

False Positives

e.g. a person is guilty but are tried as innocent vs an innocent person is tried as guilty

To minimise one, you will increase the other - trade-off

Type 1 and Type 2

It will cause more embarrassment for people when there is an error - benefit the company to be more liberal in their security

Liberal Type 1, Labour Type 2

Cyber Security Attack

Spear Phishing

Privilege escalation

Exploitation of trust

Not highly technical

HW: Bruce Schneir

ANU hack - what to advise? 

Compartmentalise the system. Remove any risks related to one points of failures

Attempt to change the behaviour of others (students) 

Professionalism is defined by: 

Trust

Secrets

Humans

Engineering - Risk and Complexity 

Trust 

Honestly you cannot trust anybody

Scepticism can be helpful 

Defence in Depth 

There is no such thing as an impenetrable castle/security system

Using the analogy of a castle, the outer shell of the castle would be the most protected as it was the most exposed. The inside of the castle - villages, living area of the monarchs were vulnerable. As enemies continued to penetrate the walls of the castle, the thicker the walls that were built. This was the old approach for designing software security systems.

Defence in depth relies on designing multiple layers in the system so that there is no one point of failure. If one section breaks, the entire section does not break. This is similar to the analogy of designing inner layers (e.g. concentric circles) or walls within the castle. 

Bell LaPadua 

Hierarchal system where orders are filtered down the ranks. The effectiveness of the system depends on human obedience and the intelligence of the leader

This is an example of a single point of failure

Centralised control system 

Wargames (movie) 

Dual control - find out more about this

Tamper-evident: concept where a deliberate creation of physical evidence reveals that the system has been broken into

Authentication (important aspect of CIA concept) - in wargames, a dual control system is a security measure. The location of the key controls are more than an arm span length away. Therefore, it requires 2 people to activate the missile. A missile will not be launched if one person was deceased - good. Or for an enemy, it will allow them to stop a launch if that was their intention. 

Hardware 

People have been trying to create software that can detect hardware damage in its machine - this is not resolved

Attack someone where they least expect it - for a software expert, attack their hardware

Key locker: old technology that captured keystrokes on a keyboard

Having contact with hardware will always leave evidence

There is no way to disable parts of your hardware via software 'solutions' 

Physical Data Destruction 

Physical security is the most vulnerable 

HW: try and break something of your own - demonstrate weakness of physical security

HW: what's better than a lock? 

Side Channel 

Power side channel attack - you can attack a system and determine its use through its power consumption patterns

e.g. merger and acquisition company - its rival can purchase an apartment opposite the company and they can observe their activities, clients, times 

Engineers are highly respected and they work with notions of complexity 

·       They take simple things and make them reliable

·       Sometimes governed by law - outcomes cannot be achieved unless they are signed off 

Cybersecurity: 

·       Grown organically and problems have grown faster than solutions

·       There's always a strive to make software and hardware bug free - goes through so many reviews, and quality assurance. However, there are always going to be never ending issues with security.

·       There is no identified way of writing secure software. It will be compromisable

·       NSA or big purchasers of bugs - will be to get into any machine

·       Always striving to achieve security assurance but this is difficult to measure

 Security through obscurity: 

·       By making things obscure, you're essentially relying on something that you have no assurance of. So if I tied a really knot to stop you stealing something but I can't analyse knots very well so I make it complicated by putting more knots on it. It's really hard to assess if security was increased

·       More complexity can introduce more vulnerabilities

Example: 

Mid-1800s Europe, Black Chambers period - countries would use special codes to communicate with their embassies and ambassadors. Messages travelled through insecure mediums such as horses and boats so codes were used. Idea of codes introduced obscurity. Only Vienna could decode every code. Every country thought that their code was impenetrable. 

·       Defenders are always wrong. We need to think like an attacker

·       Strength of a code should not reside on the mechanism of the code being secret. The strength of the code should reside in the key.

·       Therefore obscurity and secrets are no good. You want the entire security protocol to reside in a single secret, which is called the key which you keep safe. If a person penetrates one instance of the key, they've essentially broken them all 

Most security vulnerability arise from trust

·       Abused trust

·       Or we mistakenly trust something that we shouldn't 

House Analogy 

·       We need to think that a house is more than a door

·       Attack the key, make a copy of the key. E.g. Diebold US election machines - every computer used for the voting system was locked by the same key. Anyone with an image of the key can make their own

·       Trojan attack

·       Tailgating

·       You can trip the burglar alarm by tripping the fuse box and encouraging the battery to go flat faster by activating the sensor

·       For electronic locks, you can brute force your way through

·       Must be aware that many things are more vulnerable than they appear 

Lancaster Bombers 

·       British and Germans fighting for air supremacy but places were being shot down faster than they could be built

·       Asked a mathematician with efficient armour

·       He realised he needed to gather data - distributed diagrams of the planes to aerodromes and they would indicate with a red dot where the planes were most damaged. He built a cumulative data of the bomber's weak spots

·       He determined where the bullet holes were not present - those that were shot near the pilot never came back

What and Why?

Explosion, fire and spill - Mexico, November 18 2010

Deep Water Drilling

Offshore drilling - there is no control of the drop of the water head

A riser (section of the rig) provides no control at the top of the rig. Control is achieved by BOP (blow out preventer) however the distance between the BOP and the riser is around 5000ft. Hydrocarbons can enter the riser and through the rig (inflammable)

Dynamic positioning - uses propellers and motors to ensure the rig is fixed in the same position. Vessel must have power at all times

To shift crew rotations involved to operate - requires around 60 people to operate per shift

various contractors involved and coordinated

In the event of a power failure, the BOP and riser must separate. The rig allows this to occurs. There is also a saw in the middle of the rig to cut through the core pipe prior to the separation of the BOP and riser

Remote Operating Vehicles ROV used seal the well from the rest of the riser.

Questionable Issues

Casing Design

Long string rather than liner and tie-back (one degree of safety less than other mechanisms)

No lockdown sleeve at time of accident

single string over several formations of different pressure

Cement design

Few centralisers

Big casing, small hole

Nitrogen foam cement

No cement bond log

Negative pressure test

Unclear procedures

Conducted soon after cementing

Confusing because of unusual spacer

Misunderstood by crew

Flow monitoring

Flows confusing due to offloading

Insufficient response to flow indications

Hydrocarbons entered the riser

Ignition

Hydrocarbon flow through the MGS

Gas entry into engine room, intake not auto

Engine overspeed, power loss, fire

 BOP

Crew shut BOP but failed to seal well

EDS pushed but link to BOP lost in fire

Automatic function (separation of the riser and BOP) did not work

ROV operation of BOP didn’t work

 The Bad Stuff

Note that if one thing did not occur, the entire catastrophe would not occur.

Cement job failed to seal off the producing reservoirs. Casing seal failed

Hydrocarbon inflow was not recognised, and hydrocarbon entered the riser

Gas ignited on the rig, causing fire and loss of power

The BOP failed to seal the well. Spill will not have happened

 Cement Job

There was no uncertainty that the cement job failed

Float collar, uses pressure to enable the insertion of cement into a sealed casing

In the case of the accident, excessive pressure was applied (within the tube) and fractures can occur. Nitrofied cement was used to lower the density of the concrete core - this was so that there was a lower chance of fracturing the concrete

 Pressure Window

Well pressure must exceed pore pressure

Well pressure must not exceed fracture pressure

Casing protects shallower formations from deeper pressures

 Flow Condition not Recognised

Two negative tests conducted and accepted by crew as successful. The test procedure is very uncertain

 Spacer

 Lost circulation material and spacer (viscous material to separate mud and water) excessively used

Spacers can be discharged into water only if it has been used

The excessive use of the spacer affected the negative pressure tests

There was a high level of reliance upon manual/human intervention in the activation of DH safety systems.

Blind Shear Ram (BSR) could not shear through anything other than the core pipe during an emergency.

 Suggestions

Another blind shear ram (BSR) in the case of the first failure. It seals the well

Real time modelling of fluids and pressures in tubulars (simulations)

Significance of Deep well drilling