Information Security 2024 Spring

Data security course, in English as you asked.

Understand adversarial view on security. Recognize key concepts of security. Be able to safely practice hands-on with security tools.

Course name and code:Information Security ICI002AS2AE-3002
Timing2024 period 3, early spring, w03-w11, not w08
Credits5 cr
ClassesMondays 08:15 - 13:45, in Pasila pa5001, bring your laptop
Max students30
LanguageEnglish
TypeContact, in physical classroom, mandatory participation [as requested]
Feedback4.2 - 4.6 / 5 Excellent feedback Five star experience *
ServicesMoodle, Laksu. Optionally Tero's list.
First class2024-01-15 w03 Monday 08:15, classroom pa5001, physically present with your laptop

* Feedback average of each course instance: from 4.2 "good" to 4.6 "excellent", including the same course under the name Data Security from the previous curriculum. I'm giving other security courses, too. Penetration testing (challenging course in Finnish) has reached excellent 5.0 /5, with every participant giving feedback and each feedback being 5. And Master level (YAMK) Trust to Blockchain has reached excellent 4.9 /5.

Agenda

Eight security Mondays in Pasila. All classes require active participation.

I have changed this course to contact (physically in the class) as requested in the feedback.

Mondays from 08:15 to 13:45 in Pasila pa5001.

DateTheme
2024-01-15 w031. Organizing. Fundamentals. Practice environments.
2024-01-22 w042. Threath modeling. Cyber kill chain. (Optional: a bit of ATT&CK.)
2024-01-29 w053. Web security. OWASP 10.
2024-02-05 w064. Encryption. Asymmetric vs symmetric. GPG. SSH.
2024-02-12 w075. Passwords. Hashes. Cracking hashes.
2024-02-19 w08(Winter holiday, no classes)
2024-02-26 w096. Chelsea: The threat of deepfake technology. Applied. (E.g. cryptocurrencies or darknet)
2024-03-04 w107. Kiana: How to convince AI to help us in hacking? Bishwas: RATs and Phishing Attack Demo. Ruwan: Bitwarden. Andrew: ILOVEYOU worm. Daniel: Pegasus – between law enforcement, total surveillance, and modern warfare. Presentations. Recap.
2024-03-11 w118. Roope: Darknet markets and OPSEC. Panagiotis: Ransomware. Sille: How to be Invisible Online. Wrapping up.

There will likely be updates to the contents of the classes as the course advances.

Goals

After completing this course, you will

  • Understand adversarial view on security
  • Recognize key concepts of security
  • Be able to safely practice hands-on with security tools

Hands-on exercises will emphasize environments fully controlled by you, using free open source software in your possession.

Assessment

  • Active participation in classes
  • Homework (66%)
  • Presentation (33%)

Evaluation of the course is based on totality of the work presented.

Previous courses - student feedback, old homework

Feedback

Thanks already! Your feedback is very important to me. I will read it all (twice+) and make improvements. Please give your feedback to two channels.

1) Free form feedback as a comment on this page

Write your comment on this page.

You can write what ever you want. No need to repeat the questions, but they are here to get you started.

  • Did you learn something? Do you now know something you did not know before the course? (Models, frameworks, ideas, tools?)
  • Did you do something for the first time? (Broke passwords, broke into web service, create treath models, used password manager, encrypted messages? Used some technique or a tool for the first time?)
  • Is this useful? Are these skills useful in companies?
  • How did you like the presentations? Interesting subject? Did you like presenting? Useful information? Actionable?
  • How did you like comments and feedback? Did you get answers to your questions? (from classmates, teacher; to your homework, presentations)
  • Feelings: did you enjoy the course?
  • How could I improve the course? (I can make almost any change here, if it's important)
  • Would you recommend the course? Have you already recommended it? Who would benefit from the course (a colleague, a fellow student)?

2) Numeric feedback to Haaga-Helia feedback system (Peppi)

Feedback in MyNet (Peppi)

1-worst, 5-best

  • Your active participation in studies
  • Achieving the learning goals
  • The study methods supported learning
  • The study environment supported learning
  • Benefits to your career

Open, you can copy the same answer you gave earlier

  • What promoted your learning?
  • How would you develop the implementation / group of implementations further so that the learning goals could be achieved better?

Your overall assessment of the implementation, 1-worst, 5-best

How likely would you recommend the course to your fellow students? 1-worst, 10-best.

Thank you for your feedback, and thank you for our course!

Optional: Keep up with Linux & security, join Tero's list. (And get invitations to visitors on security)

See you in my future courses!

Homework

Homeworks are done with a computer and reported at the same time. If some task does not require performing tests with a computer, it's specied writing.

Each homework is returned

  • 24 h before start of next lecture
  • you can publish your homework report in any website you like
  • return a link to Laksu
  • cross-evaluate two other homeworks

To save everyone's time, I will remove those from the course who don't return homework.

Github is a convenient place to publish your reports, others are Gitlab and Wordpress.com. I highly recommend publishing your work, it seems to help getting job offers. But if you don't dare or want to publish, you can put your web page behind a password (e.g. in Wordpress.com, same password for all reports), and share this password with your group.

AI and large language models (LLM): You can ask AI or LLM a question and use the answer as facts for your own answer, written in your own words. AI must be marked as a reference, with details such as prompt (and for advanced users system prompts, temperature, jailbreaks...). LLMs tend to hallucinate, so you should check answers from more reliable sources. It's not allowed to generate text with AI or similar technologies. For example, it's not allowed to generate essay answers or summaries with AI, LLM or similar technologies.

The homeworks are official after they are given in the class. Don't start them before, because they might change.

h1 First steps

Become a hacker, step 0

Start the homework only after you've accepted the rules in course Moodle.

Tips:

h2 Should Tero wear a helmet?

  • x) Read / watch and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like)
  • a) Security hygiene. What basic security practices should everyone follow? Are there some security hygiene practicies that you consider useful, but might be above an average Joe? (This subtask does not require tests with a computer. A bullet list is enough)
  • b) Make-belief boogie-man - a threat model for imaginary company.
    • This subtask does not require tests with a computer.
    • A long, extensive answer with narrative, analysis and a diagram is expected.
    • Create an imaginary company and create threat model.
    • Business requirements come from business, technical specialist help with tech. Inlude this in your narrative.
    • Your analysis should cover all parts of the four question model (four key questions in Threat modeling manifesto)
      • (1) What are we working on?
        • Our assets
          • Priorization, key assets
          • E.g. customer health data is a crown jevel, personel gaming server is probably not
        • Security supports business
        • Draw a diagram of the company systems
        • Write a description.
      • (2) What can go wrong?
        • Apply one or more named models: Attack trees, STRIDE, ATT&CK...
          • Give some examples of identified risks - you don't need to find all risks or likely vulnerabilites, as there would be too many for this homework.
        • Priorize biggest risks
          • High expected value (or other very high risk)
          • Expected value = probability * monetary value
          • Expected value is a tool for discussion, it's not exact science as we have to guestimate the input numbers
        • Are you targetted by specific threat actors?
          • Known TTPs? (tactics, techniques, procedures)
          • COI - Capability, Opportunity, Intent
      • (3) What are we going to do about it?
        • Can you: reduce attack surface, limit entry points...
        • Reduce, transfer, avoid, accept
      • (4) Did we do a good enough job?
        • Security audits, pentests, assesments, continous threat modeling and evaluation

Tips:

h3 Web

Remember to keep it safe, legal and ethical. Especially if you grasp OWASP 10, you still can't try these to machines you don't own. You can only start doing the excercises after accepting course rules in Moodle.

You're only allowed to start these tasks after accepting course rules in Moodle.

Tips:

  • If you get stuck
  • F12 Developer tools: I'm using Firefox F12. But it probably works on Chromium, too.
  • You can update all software in Linux with
    • Open terminal
    • 'sudo apt-get update'
    • 'sudo apt-get dist-upgrade'
    • If this is your first full upgrade, reboot (it's only needed for kernel upgrades)
  • SQLZoo
    • If you've got a lot of experience with databases already and SQLZoo is too easy, you can instead install a relational database (Postgre, Mariadb...) and show CRUD operations using command line client and SQL.
    • Yes, I think they really run your queries on database management system
    • In SQL, you can often write long numbers in engineering notation, nine zeroes after two as 2e9 instead of 2000000000
  • Johnny tables
    • You only need your browser (even though the official example solution uses a paid tool by the makers of the lab)
    • Try different places. But if you're completely out of options: peek the solution, apply it to use just browser (no mitm proxy needed), mention in your report the hints used - and try to explain how the solution works.
  • WebGoat
    • What kind of quotes did SQL have?
    • If you raise everyone's salaries, are you the richest anymore?
    • The names here are the same as in OWASP 10 2021 and OWASP 10 2017.
    • In injections, it's nice to know:
      • SQL string delimiter (single quote, aphostrophe) "'" (end of user input, start of my hostile injection)
      • SQL comment (double dash) "--" (end of my evil injection, you can ignore the rest, dear database management system)
      • There are many ways to do SQL injection
  • b) Injected. Solve WebGoat:
    • A1 Injection (intro)

h4 ETAOIN

  • x) Read and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like)
    • € Schneier 2015: Applied Cryptography: Chapter 1: Foundations
    • Disobey 2023:
      • Watch and summarize a presetation of Disobey 2023 conference
      • Presentation videos are on Disobey Youtube Channel
      • Skill level and background knowledge required varies a lot, choose a video you can understand.
  • a) Encrypt and decrypt a message. Explain the purpose of each step. Explain why you choose the tool you're using. (You can use any tool you want. You must do and report the encryption at the same time, it's not enough to try to remember what we did in the class. )
  • m) Voluntary bonus: send and receive encrypted message over email.
  • n) Voluntary bonus: Find out frequency distribution of letters for a language that you know (other than English). What are the six most common letters? (This subtask y does not require tests with a computer if the question can be answered without them)
  • o) Voluntary bonus: ETAOIN. Crack this ciphertext:
    • HDMH'B TH. KWU'YI AWR WSSTOTMJJK M OWQINYIMLIY! MB KWU BII, BTGPJI BUNBHTHUHTWA OTPDIYB OMA NI NYWLIA RTHD SYIEUIAOK MAMJKBTB. BII KWU MH DHHP://HIYWLMYCTAIA.OWG
  • p) Voluntary bonus, easy: try rot13, the military grade top-secret encryption of the top-2 empire of year zero. Could double rot13 provide extra security?
  • q) Voluntary difficult bonus, requries coding skills: Cryptopals (recommended, if you have what it takes).

Tips:

  • Frequency distributions for most languages can be found in search engines and probably Wikipedia
  • ETAOIN
    • This challenge can be solved with pen and paper, no coder skills required. (Like most things, it's faster with a computer, though.)
    • Just like this course, the cleartext is in English
    • Looking at word lengths and spaces, this ciphertext is likely using a simple substitution cipher.
    • Use your eyes - can you identify possible common words or parts of them?
    • After ruling out Caesar (e.g. rot13), we can use frequency analysis
    • Most common letter in English is E, the second most common is T... The frequency table is ETAOIN shrdlu.
      • Frequency is about statistics and probability. It's not guaranteed that E is the most common, it's just likely. Especially short texts make statistical analysis less efficient.
      • It's much more likely that most common letters are from ETAOIN than the from the least frequent j, x or z.
    • Use your sisu
      • If first guess does not crack it, try another one.
      • Make notes as you work.
      • Document your approaches and how far you can get, even if you couldn't crack the whole thing.
  • O'Reilly Learning € (former Safari) is a bit pricey, but Haaga-Helia students get free access trough Haaga-Helia library A-Z page.

h5 Spring2024!

  • x) Read or watch and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like)
  • a) Install Hashcat. Test it with a sample hash. See Karvinen 2022: Cracking Passwords with Hashcat
  • b) Crack this hash: 8eb8e307a6d649bc7fb51443a06a216f
  • c) Choose a password manager. (This subtask b does not require tests with a computer). First, create a short list of some password managers; then pick one. Explain:
    • What threats does it protect against?
    • What information is encrypted, what's not?
    • What's the license? How would you describe license's effects or categorize it?
    • Where is the data stored? If in "the cloud", which country / juristiction / which companies? If on local disk, where?
    • How is the data protected?
  • d) Demonstrate the use of a password manager, the one you picked in previous subtask.
  • m) Voluntary: Compile John the Ripper, Jumbo version. Karvinen 2023: Crack File Password With John.
  • n) Voluntary: Crack a zip file password
  • o) Voluntary: create a password protected file other than ZIP. Crack the password. How many formats can you handle?

Tips:

h6. A. Nynomous

In Finland, it's legal to use TOR at the time of writing. If you reside in another juristiction, laws might be different. Obviously, it's illegal to do illegal things in TOR, just like it's illegal to do illegal things anywhere. Only do legal things.

If you are currently in a juristiction where using TOR is illegal, you obviously can't install it and do the related tasks. For those cases, alternative task is: based on literature only (no hands on tests, no installation), compare anonymous/pseudonymous networks, such as TOR, I2P, Freenet and others. How do their goals, technology and other features differ? How are they similar?

x) Read and summarize (briefly, e.g. with some bullets)

a) Install TOR browser and access TOR network (.onion addresses). (Explain in detail how you installed it, and how you got access to TOR).

b) Browse TOR network, find, take screenshots and comment

  • search engine for onion sites
  • marketplace
  • forum
  • a site for a well known organization that has a physical street address in the real world

c) Voluntary or alternative task: No onion. You can do this task in place of a and b. Install a darknet browser other than TOR, such as I2P or Freenet. Search, screenshot and describe examples of contents there.

d) Voluntary: Crypto hunter. Find Bitcoin address from a darknet site. Use the public ledger to find out if money has been transferred to that address.

Tips

  • Alternatives for installing TOR
  • OPSEC is hard, any single tool will not magically make you untraceable
  • Be cautious: don't trust anonymous sites, don't enter your name or other personal details anywhere.
  • O'Reilly Learning € (former Safari) is a bit pricey, but Haaga-Helia students get free access trough Haaga-Helia library A-Z page.
  • Bitcoin explorer
  • Other darknets include
    • GNUnet
    • Hypanet
    • I2P

h7. Free Tickets

Time to plan how you keep up to date on cyber after the course ends. You also need something to keep you entertained until ICT Infrastructure project pro4tf023 starts.

  • x) Free tickets. View and summarize a hacker or security conference presentation. It should be a full length (>30 min) presentation. Brief summary with some bullets is enough.
  • a) Voluntary: Feed me. Set up RSS feed reader and follow some security related feeds.

Tips

  • Security conferences
  • Helsinki has very active hacker scene, consider HelSec
  • Feel free to join Tero's list - know when hackers visit my courses

Adminstrivia

I will keep updating this page during and after the course.