Serang-Cybersecurity.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
AN INTRODUCTION TO CYBERSECURITY Copyright Oliver Serang 2019, all rights reserved Contents 1 INTRODUCTION 9 1.1 Briefly: why this book? . 9 1.2 Why study cyber? . 9 1.3 \Phone phreaking" . 10 1.4 Swords and shields . 11 1.5 Why don't people just make things secure? . 11 1.6 Don't do it. And if you do, don't get caught. 14 1.7 Practice and discussion questions . 15 2 PERMISSIONS 17 2.1 Seeing a file's permissions . 17 2.2 Why we have permissions . 18 2.2.1 Prevent us from doing anything we don't mean to do . 18 2.2.2 Keeping data private . 19 2.2.3 Keeping executables trusted . 19 2.3 \Cuckoo's eggs" . 20 2.4 Practice and discussion questions . 21 3 BASIC CRYPTO 23 3.1 Overview . 24 3.2 Substitution ciphers . 25 3.2.1 Caesar . 25 3.2.2 General substitution . 26 3.2.3 Substition with state space . 32 3.2.4 One-time pads . 33 3.2.5 The weakness of substitition ciphers . 35 3.2.6 Steganography . 35 3.3 Practice and discussion questions . 36 3 4 CONTENTS 4 NUMBER-THEORETIC CRYPTO 37 4.1 Basic modulo arithmetic . 37 4.2 Integer factorization . 38 4.3 Discrete logarithm . 39 4.4 Diffie-Helman . 40 4.4.1 \Logjam" attack . 41 4.5 Fermat's little theorem . 42 4.6 Asymmetric cryptography with RSA . 48 4.6.1 Finding the greatest common divisor (GCD) via the Euclidean algorithm . 49 4.6.2 The extended Euclidean algorithm . 52 4.6.3 The RSA method . 58 4.6.4 Signing documents . 63 4.6.5 The complexity of the \RSA problem" . 64 4.6.6 Attack: brute force . 64 4.6.7 Attack: Shor's algorithm via quantum computers . 64 4.6.8 Attack: man-in-the-middle . 65 4.6.9 Defense: certificate authority (CA) . 65 4.6.10 Defense: tamper detection . 66 4.6.11 Attack: partial knowledge of plaintext . 67 4.6.12 Defense: optimal asymmetric encrypt padding (OAEP) 67 4.7 Efficiently finding big primes . 67 4.7.1 Beware of special cases . 74 4.7.2 Beware of probabilistic primes . 74 4.7.3 Practice and discussion questions . 75 4.8 Cryptographic hashing . 76 4.8.1 Weakness of SHA-1 . 79 4.8.2 Attack: collision attack . 79 4.8.3 Practice and discussion questions . 82 4.8.4 Attack: brute force . 83 4.8.5 Attack: rainbow tables . 83 4.8.6 Defense: salt . 84 4.8.7 Practice and discussion questions . 85 4.9 HMAC . 85 4.10 Security through obscurity . 85 4.11 Practical RSA: public-key ssh . 86 CONTENTS 5 5 BREAKING AND ENTERING 87 5.1 Breaking into a Ubuntu laptop . 88 5.1.1 Defense: disk encryption . 88 5.1.2 Practice and discussion questions . 89 5.2 Digital forensics of an executable . 89 5.2.1 Disassembly with objdump . 90 5.2.2 Finding strings with the strings command . 92 5.2.3 Defense: checking a hash of the password instead . 92 5.3 Exploit: vulnerable system call . 92 5.4 Exploit: stack smashing . 93 5.4.1 System calls in C ..................... 94 5.4.2 Basic x64 assembly . 95 5.4.3 Launching a shell in x64 assembly . 98 5.4.4 Anatomy of a C stack . 99 5.4.5 Highjacking the return address . 103 5.4.6 Smashing the stack in a vulnerable program . 104 5.4.7 Defense: stack canaries . 117 5.4.8 Counter-exploit: canary leak . 117 5.4.9 Counter-exploit: random access modification . 117 5.4.10 Defense: address space layout randomization (ASLR) . 118 5.4.11 Defense: the NX bit and noexec data . 120 5.4.12 Counter-exploit: return-oriented programming (ROP) . 120 5.5 Exploit: dangling pointer . 121 5.5.1 Virtual functions and the virtual table . 123 5.5.2 The dangling pointer exploit . 129 5.5.3 Defense: point deleted pointers to NULL . 131 5.6 Penetration testing . 131 5.6.1 Cracking a hash . 132 5.6.2 Practice and discussion questions . 137 5.6.3 Breaking into a WLAN router . 137 5.6.4 Practice and discussion questions . 142 5.7 Breaking into a computer on the network . 143 5.8 Monitoring network traffic . 143 5.9 Breaking into systems with hydra . 144 5.10 Attack: \evil-twin" . 144 6 CONTENTS 6 MALWARE 147 6.1 Crashing and destroying . 147 6.2 Hijacking . 148 6.2.1 Ransomware . 149 6.2.2 Keyloggers . 149 6.2.3 Hardware keylogging and the \evil-maid" attack . 152 6.2.4 The problem with pozzed firmware . 152 6.2.5 Zombie machines and distributed denial-of-service at- tacks (DDoS) . 153 6.3 Spreading . 154 6.3.1 Practice and discussion questions . 155 7 GOING DARK 157 7.1 Defective by design: smartphones . 158 7.2 IP address . 159 7.3 MAC address . 159 7.4 Proxies . 160 7.5 VPNs . 160 7.5.1 Defective by design: broken encryption . 161 7.6 The Onion-routing protocol (Tor) . 161 7.6.1 Changing your Tor circuit . 162 7.6.2 Vulnerabilities of Tor . 162 7.6.3 Hidden services . 163 7.6.4 Tor is not completely anonymous . 164 7.6.5 Specifying and excluding nodes from particular countries164 7.6.6 Practice and discussion questions . 165 7.7 Attack: browser fingerprinting . 165 7.7.1 Under the influence . 166 7.7.2 Practice and discussion questions . 167 7.8 Reverse image search . 167 7.8.1 Practice and discussion questions . 168 7.9 Metadata on images and other uploaded files . 168 7.9.1 Practice and discussion questions . 169 7.10 Facial recognition . 170 7.11 Attack: javascript \beacons" . 170 7.12 Attack: behavioral fingerprinting . 171 7.13 Attack: printer \microdots" . 172 7.14 EURion and automated censorship . 172 CONTENTS 7 7.15 Archiving to resist censorship . 173 7.16 Censorship-resistant codes . 174 7.17 Erasing a disk . 175 8 PUBLIC POLICY 177 8.1 Beware of technical answers to political questions . 177 8.2 Civil liberties vs. order . 179 8.2.1 Global connectedness and pressure for greater political homogeneity . 179 8.2.2 London: smile, you're on camera . 180 8.2.3 Europe: Article 13, an unlucky number? . 180 8.2.4 China: The Great Firewall/Golden Shield . 180 8.2.5 America: \defending freedom and liberty at any cost. even liberty" . 181 8.3 Influence in a connected world: from markets to warfare . 182 8.4 Consumer protection . 182 8.5 Military use of cyber in an offensive capacity . 183 8.5.1 Argument pro: \third-offset” . 183 8.5.2 Argument con: proliferation . 184 8.5.3 The balance: swords and shields . 184 8.6 Practice and discussion questions . 185 8 CONTENTS Chapter 1 INTRODUCTION 1.1 Briefly: why this book?1 This book is designed for one specific goal: to give you a foothold into the world of cybersecurity. From this book, you will not become special forces h4x0r #12 overnight; however, you will become fluent enough to learn what- ever else you need from here. You will be a guerrilla fighter trained in the ancient ways that date back to the mid 90s, heck even the early 80s.3 This course will be a mix of several things: programming, mathematics, history, training to use software, and of course some good old MacGyvering. 1.2 Why study cyber? Imagine a vault that contains inside it nearly all private communications (in- cluding our most intimate personal conversations and consumption habits), banking records, medical records. Not only are the banking records con- tained in this vault, so are the records of land ownership, debt, and all other assets. With access to the vault, it's possible to change ownership of property 1For one thing, the best computer security demos I found online were written for old 32-bit systems and were a pain to get to work on my computer. On one hand, this may have been by choice, since older executables are more likely to be less security focused. But on the other hand, it is now $fcurrent yearg. 2Some assembly required (see Breaking and Entering chapter), Dragon Tattoo sold separately. 3In the words of Kristine Acielo, \That's how far back... our family ties... belong to in the city." 9 10 CHAPTER 1. INTRODUCTION and debt with the stroke of a pen. The vault contains nearly all intellectual property: the formula of Coca-Cola4 and the yield of silicon wafers5. The vault also contains the primary means by which people are informed ahead of elections. Inside the vault are historical records. As George Orwell wrote in the novel 1984, \Those who control the present, control the past and those who control the past control the future." Access to the vault allows a person to influence the political views of many people in the world. To the.