Information Security
Course ICI002AS2AE-3005 - Early Autumn 2024

Data security course, in English as you asked.

Understand adversarial view on security. Recognize key concepts of security. Be able to safely practice hands-on with security tools.

Enrolment is closed, keep your eyes open for the next instance. Feel free to subscribe for open lecture invites.

Course name and code:Information Security ICI002AS2AE-3005
Timing2024 period 1, early autumn, w34-w50.
Credits5 cr
ClassesMondays 08:00 - 10:45, in Pasila pa5001, bring your laptop
Max students30
LanguageEnglish
TypeContact, in physical classroom, mandatory participation [as requested]
Feedback4.6 / 5 Excellent feedback Five star experience *
ServicesMoodle, Laksu. Optionally Tero's list.
First class2024-08-19 w34 Monday 08:00, Pasila pa5001, physically present with your laptop

* I'm giving other security courses, too. Penetration testing (challenging course in Finnish) has reached excellent 5.0 /5, with every participant giving feedback and each feedback being 5. And Master level (YAMK) Trust to Blockchain has reached excellent 4.9 /5.

Agenda

Mondays from 08:15 to 10:45 in Pasila pa5001. Bring your laptop!

DateTheme
2024-08-19 w341. Organizing. Threath modeling.
2024-08-26 w352. Cyber kill chain. (Optional: a bit of ATT&CK.)
2024-09-02 w363. Practice environments. Asmir: Cryptocurrency in practice.
2024-09-09 w374. Web security. OWASP 10. Henrik: Social Engineering.
2024-09-16 w385. Encryption. Asymmetric vs symmetric. GPG. SSH. Alvari: Onion routing and TOR. Benjamin: Penetration testing.
2024-09-23 w396. Passwords. Hashes introduction. Cracking hashes and passwords. Jade: OSINT. Oluwadamiloju: Hardware security.
2024-09-30 w407. Darknet, TOR. Saku: Algorithm to detect and prevent romance scams in instant messaging. Jaakko: Cyber warfare in Finland. Anja: LAN Security Threats.
2024-10-07 w418. Recap. Ruwani: Phishing Attacks. Ayush: SSL/TLS. Srabonty: Supply chain attacks. Marcus: Illegal streaming services. Zhenyu: GFW. Olga: Instant messengers. Yasmin: CEO scams. Zahidul: Bank heist. Phuoc: Facebook scams in Vietnam. Thilini: Metaverse. Selma: Ransomware. Zubair: Multifactor authentication. Emmanuel: Security data analysis.

Eight security Mondays in Pasila. All classes require active participation. I have changed this course to contact (physically in the class) as requested in the feedback.

There will likely be updates to the contents of the classes as the course advances.

You can reserve a spot for your presentation as soon as on the second class.

Goals

After completing this course, you will

  • Understand adversarial view on security
  • Recognize key concepts of security
  • Be able to safely practice hands-on with security tools

Hands-on exercises will emphasize environments fully controlled by you, using free open source software in your possession.

Assessment

  • Active participation in classes
  • Homework (66%)
  • Presentation (33%)

Evaluation of the course is based on totality of the work presented.

Previous courses - student feedback, old homework

Feedback

Thanks already! Your feedback is very important to me. I will read it all (twice+) and make improvements. Please give your feedback to two channels.

1) Free form feedback as a comment on this page

Write your comment on this page.

You can write what ever you want. No need to repeat the questions, but they are here to get you started.

  • Did you learn something? Do you now know something you did not know before the course? (Models, frameworks, ideas, tools?)
  • Did you do something for the first time? (Broke passwords, broke into web service, create treath models, used password manager, encrypted messages? Used some technique or a tool for the first time?)
  • Is this useful? Are these skills useful in companies?
  • How did you like the presentations? Interesting subject? Did you like presenting? Useful information? Actionable?
  • How did you like comments and feedback? Did you get answers to your questions? (from classmates, teacher; to your homework, presentations)
  • Feelings: did you enjoy the course?
  • How could I improve the course? (I can make almost any change here, if it's important)
  • Would you recommend the course? Have you already recommended it? Who would benefit from the course (a colleague, a fellow student)?

2) Numeric feedback to Haaga-Helia feedback system (Peppi)

Feedback in MyNet (Peppi)

1-worst, 5-best

  • Your active participation in studies
  • Achieving the learning goals
  • The study methods supported learning
  • The study environment supported learning
  • Benefits to your career

Open, you can copy the same answer you gave earlier

  • What promoted your learning?
  • How would you develop the implementation / group of implementations further so that the learning goals could be achieved better?

Your overall assessment of the implementation, 1-worst, 5-best

How likely would you recommend the course to your fellow students? 1-worst, 10-best.

Thank you for your feedback, and thank you for our course!

Optional: Keep up with Linux & security, join Tero's list. (And get invitations to visitors on security)

See you in my future courses!

Homework

Homeworks are done with a computer and reported at the same time. If some task does not require performing tests with a computer, it's specied writing.

Each homework is returned

  • 24 h before start of next lecture
  • you can publish your homework report in any website you like
  • return a link to Laksu
  • cross-evaluate two other homeworks

To save everyone's time, I will remove those from the course who don't return homework.

Github is a convenient place to publish your reports, others are Gitlab and Wordpress.com. I highly recommend publishing your work, it seems to help getting (better) job offers. But if you don't dare or want to publish, you can put your web page behind a password (e.g. in Wordpress.com, same password for all reports), and share this password with your group.

AI and large language models (LLM): You can ask AI or LLM a question and use the answer as facts for your own answer, written in your own words. AI must be marked as a reference, with details such as prompt (and for advanced users system prompts, temperature, jailbreaks...). LLMs tend to hallucinate, so you should check answers from more reliable sources. It's not allowed to generate text with AI or similar technologies. For example, it's not allowed to generate essay answers or summaries with AI, LLM or similar technologies.

The homeworks are official after they are given in the class. Don't start them before, because they might change.

h0 Hello, web!

a) Publish a web page. Show that you can make headings (h1 #, h2 ##...), paragraphs (p, empty line), links (a http://example.com) and code style (code or pre, four spaces at start of line). Markdown recommended.

Tips

Karvinen 2023: Create a Web Page Using Github

h1 Should Tero wear a helmet?

  • x) Read / watch / listen and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like. Add some question or idea of your own.)
  • a) Security hygiene. What basic security practices should everyone follow? Are there some security hygiene practicies that every company or average Joe should follow? (This subtask does not require tests with a computer. A bullet list is enough)
  • b) Make-belief boogie-man - a threat model for imaginary company.
    • This subtask does not require tests with a computer.
    • Create an imaginary company and create threat model.
    • Business requirements come from business, technical specialist help with tech. Inlude this in your narrative.
    • Your analysis should cover all parts of the four question model (four key questions in Threat modeling manifesto)
      • (1) What are we working on?
        • Our assets
          • Priorization, key assets
          • E.g. customer health data is a crown jevel, personel gaming server is probably not
        • Security supports business
        • Draw a diagram of the company systems
        • Customer is the king
          • What do we have to do the serve the customer (to keep getting paid)
          • How does customer see our systems? Touchpoints?
        • Write a description.
      • (2) What can go wrong?
        • Apply one or more named models: Attack trees, STRIDE, CIA, ATT&CK...
          • Give some examples of identified risks - you don't need to find all risks or likely vulnerabilites, as there would be too many for this homework.
        • Priorize biggest risks
          • High expected value (or other very high risk)
          • Expected value = probability * monetary value
          • Expected value is a tool for discussion, it's not exact science as we have to guestimate the input numbers
        • Are you targetted by specific threat actors? Are there actors that target your geographical or political area or industry?
          • Known TTPs? (tactics, techniques, procedures)
          • COI - Capability, Opportunity, Intent
        • Business continuity
          • We have to keep serving the customer to receive money.
          • Stakeholders (customer, employees...) trust us. Trust is hard to get and easy to lose.
      • (3) What are we going to do about it?
        • Can you: reduce attack surface, limit entry points...
        • META: Mitigage, Eliminate, Transfer, Accept.
      • (4) Did we do a good enough job?
        • Security audits, pentests, assesments, continous threat modeling and evaluation
        • Process, not a one time job. It never ends.

Tips:

  • Reading is for you.
    • Read the articles.
      • You learn the subject matter required to
        • complete the tasks
        • understand how the tasks are related to the field of infosec
      • You learn the channels to follow the scene after the course
    • Don't generate content with AI. Not understanding the arcticle will make it harder and harder to succeed in the future. Generating a lot of useless AI spam for classmates to read is disrespectful of their time.
    • You can answer with just a few bullets.
  • Refer to sources
    • Any book, page, video, man-page, report you use for home work task should be listed as a source.
    • This task page is of course one source for the report: Karvinen 2024: Information Security Course, https://terokarvinen.com/information-security/
  • Work on your own level
    • If you have background in security and IT, feel free to challenge yourself.
    • If you're just starting, just fumble around - bravely try the models. We will not implement your plan, nothing will happen in real life even if your threat model is not perfect.
  • Security hygiene
    • No brainer: Wouldn't it be great if you could just recommend some practices - even before conducting laboursome threat modeling?
  • Threat modeling
    • Think about the moment when you're using this in real life. You sit down on a table. You identify risks and choose how to use your limited resources. You colleagues will trust you can keep company systems safe and running.
  • Darknet Diaries
    • AntennaPod is convenient Android program for listening podcasts. It's available in F-Droid and Google Play. Of course, there are hundreds if not thousands other programs for podcasts, too.
    • Pick any episode. Check descriptions, and pick one that's likely to be suitable here. It's recommended to pick other than the latest or the one on top of the homepage, so we can look at different episodes.
  • When cross evaluating
    • Give comments
    • Use the whole scale (5 is every non-voluntary task solved and reported clearly)

h2 Kill chain

We'll start zooming in from threat modeling ("what & why") to cyber kill chain ("how").

You will read the famous Cyber Kill Chain paper. And start your own hacker laboratory, which we'll expand next week.

You'll write a techincal report of the installation. We'll later learn how technical report is also a tool to solve complex hands-on techincal problems.

  • x) Read (or listen) and summarize. (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary. Add a bullet for your own question or insight)
  • a) Bookworm. Install Debian 12-Bookworm Linux, in a virtual machine in VirtualBox. Detailed technical report is required, including installing and configuring Virtualbox. It should be repeatable, another person should be able to repeat all you did using your report. Use past tense (I installed, gave a command...) and tell what actually happened. Include some screenshots. (See also: Karvinen 2021: Install Debian on VirtualBox. If you want and know how, you can use another virtualization tool such as UTM or virt-manager)
  • b) Voluntary bonus: Update all software on your Linux box using 'apt-get'.
  • c) Voluntary bonus: Install a local web server on Linux, 'apache2'.
  • d) Voluntary bonus: Download a web page from your local web server - manually, using netcat 'nc'.
  • e) Voluntary bonus: Find a log line created by your manual web page download in previous task.
  • f) Voluntary bonus: ATT&CK. Compare MITRE ATT&CK framework to Cyber Kill Chain.

Tips

h3 Hack to Learn Hacking

Tips

  • For x - "Read and summarize":
    • Just some bullets per article is enough.
    • I want to you understand the content.
    • Also learn about channels/books/blogs/articles to follow to keep up with infosec after the course
  • The original Nakamoto Bitcoin paper is voluntary reading for now. Maybe we'll have another look once we learn what public keys and hashes are, and then have these articles as part of mandatory homework. But as Asmir talked about many cryptocurrencies, some of you might want to know what they actually mean.
  • Yes, Disobey is in Helsinki. Tickets are sold out fast. In 2024, thousands of regular tickets sold out in seconds.
  • Can't fish
    • Also test commands when Internet is connected. This way, you show that the command is correctly testing the network.
    • You can kill 'ping' with ctrl-C
    • Explain what each part of command does
    • Explain how the result shows that network is disabled.
  • Port scanning
    • 'sudo nmap -A localhost' # port scans 1000 most common TCP ports, -A does banner grabbing, scripts...
    • Analyzing means you explain the meaning of each little part of each command and output; then give clear conclusion; optionally end with an ELI5 (explain like I'm five years old).
    • Only port scan localhost.
    • Disconnect computer from the Interet when port scanning.
    • Finland even has our highest court case where a minor (17 years old) was punished for port scanning. Court case took years, 1998-2003. KKO:2003:36.
    • You can install nmap with apt-get.
  • Daemon
    • 'sudo apt-get update'
    • 'sudo apt-get -y install apache2' # you could also install "ssh"
    • 'sudo systemctl start apache2' # you can use start, stop, restart, status. You can control any daemon, like "ssh"
  • O'Reilly Learning € (former Safari) is a bit pricey, but Haaga-Helia students get free access trough Haaga-Helia library A-Z page. Full disclosure: they've sold half a million of books I've co-authored.
  • UnderTheWire
    • ssh century1@century.underthewire.tech
    • If your ssh command gives error: "Terminal initialization failure. See server logs for more info. Hint: Try requesting a different terminal environment. Connection to century.underthewire.tech closed.", use 'export TERM="xterm-256color"'. (As noted by Leo)

h4 Webbed

Remember to keep it safe, legal and ethical. Especially if you grasp OWASP 10, you still can't try these to machines you don't own.

You're only allowed to start these tasks after accepting course rules in Moodle.

Tips:

  • If you get stuck
  • F12 Developer tools: I'm using Firefox F12. But it probably works on Chromium, too.
  • You can update all software in Linux with
    • Open terminal
    • 'sudo apt-get update'
    • 'sudo apt-get dist-upgrade'
    • If this is your first full upgrade, reboot (it's only needed for kernel upgrades)
  • SQLZoo
    • If you've got a lot of experience with databases already and SQLZoo is too easy, you can instead install a relational database (Postgre, Mariadb...) and show CRUD operations using command line client and SQL.
    • Yes, I think they really run your queries on database management system
    • In SQL, you can often write long numbers in engineering notation, nine zeroes after two as 2e9 instead of 2000000000
  • Johnny tables
    • You only need your browser (even though the official example solution uses a paid tool by the makers of the lab)
    • Try different places. But if you're completely out of options: peek the solution, apply it to use just browser (no mitm proxy needed), mention in your report the hints used - and try to explain how the solution works.
  • WebGoat
    • What kind of quotes did SQL have?
    • If you raise everyone's salaries, are you the richest anymore?
    • The names here are the same as in OWASP 10 2021 and OWASP 10 2017.
    • In injections, it's nice to know:
      • SQL string delimiter (single quote, aphostrophe) "'" (end of user input, start of my hostile injection)
      • SQL comment (double dash) "--" (end of my evil injection, you can ignore the rest, dear database management system)
      • There are many ways to do SQL injection
  • b) Injected. Solve WebGoat:
    • A1 Injection (intro)

h5 Uryyb, Greb!

Public keys. You use them every day. Would you like to know more?

Also starring: my favourite crypto textbook. PGP and SSH, my favourite encryption tools / standards.

Stay tuned for darknet: we'll try it hands on on w40, so I can advice a little more on it. Feel free to remind me then.

  • x) Read and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like)
  • a) Pretty Good indeed. Encrypt and decrypt a message with 'gnupg', using PGP public key cryptography. (Note that here you learn each step; for end users, you can often automate and make it look simple)
  • b) Password manager, open and cloudless. Choose a password manager that 1) works without cloud 2) is free, open source sofware. Install it. Demonstrate its use. Explain why a password manager is needed i.e. what kind of attacks or threats it protects against.
  • m) Voluntary bonus: Encrypt and decrypt messages using a tool other than 'gnupg'. Explain each step. Why did you choose the tool you used here? Evaluate the tool.
  • n) Voluntary bonus: send and receive encrypted message over email.
  • o) Voluntary bonus: Find out frequency distribution of letters for a language that you know (other than English). What are the six most common letters? (This subtask y does not require tests with a computer if the question can be answered without them)
  • p) Voluntary bonus: Install OpenSSH server, connect to it using 'ssh' client.
  • q) Voluntary bonus: Automate SSH connection using public keys.
  • r) Voluntary bonus: TLS. Choose a transport layer security (TLS) certificate used for the web. Explain key fields. How do you / browser know it's legit? Who says so?
  • s) Voluntary bonus: ETAOIN. Crack this ciphertext:
    • HDMH'B TH. KWU'YI AWR WSSTOTMJJK M OWQINYIMLIY! MB KWU BII, BTGPJI BUNBHTHUHTWA OTPDIYB OMA NI NYWLIA RTHD SYIEUIAOK MAMJKBTB. BII KWU MH DHHP://HIYWLMYCTAIA.OWG
  • t) Voluntary bonus, easy: try rot13, the military grade top-secret encryption of the top-2 empire of year zero. Could double rot13 provide extra security? Why?
  • u) Voluntary difficult multiweek bonus, requries coding skills: Cryptopals (recommended, if you have what it takes).

Tips:

  • Gnupg is explained in the article.
  • I do hope you're using a password manager. If not, this is a good day to start.
  • Frequency distributions for most languages can be found in search engines and probably Wikipedia
  • ETAOIN
    • This challenge can be solved with pen and paper, no coder skills required. (Like most things, it's faster with a computer, though.)
    • Just like this course, the cleartext is in English
    • Looking at word lengths and spaces, this ciphertext is likely using a simple substitution cipher.
    • Use your eyes - can you identify possible common words or parts of them?
    • After ruling out Caesar (e.g. rot13), we can use frequency analysis
    • Most common letter in English is E, the second most common is T... The frequency table is ETAOIN shrdlu.
      • Frequency is about statistics and probability. It's not guaranteed that E is the most common, it's just likely. Especially short texts make statistical analysis less efficient.
      • It's much more likely that most common letters are from ETAOIN than the from the least frequent j, x or z.
    • Use your sisu
      • If first guess does not crack it, try another one.
      • Make notes as you work.
      • Document your approaches and how far you can get, even if you couldn't crack the whole thing.
  • O'Reilly Learning € (former Safari) is a bit pricey, but Haaga-Helia students get free access trough Haaga-Helia library A-Z page.
  • SSH is the leading tool to control servers
    • 'sudo apt-get install ssh', 'sudo systemctl start ssh', 'whoami', 'ssh tero@localhost', 'exit'
    • Public key authentication 'ssh-keygen', 'ssh-copy-id tero@localhost'

h6 September2024!

  • x) Read or watch and summarize (This subtask x does not require tests with a computer. Some bullets per article is enough for your summary, feel free to write more if you like)
  • a) Install Hashcat. Test it with a sample hash. See Karvinen 2022: Cracking Passwords with Hashcat
  • b) Crack this hash: d595b2086532422bbe654bc07ea030df
  • m) Voluntary: Compile John the Ripper, Jumbo version. Karvinen 2023: Crack File Password With John.
  • n) Voluntary: Crack a zip file password
  • o) Voluntary: create a password protected file other than ZIP. Crack the password. How many formats can you handle?
  • p) Voluntary: Watch and summarize: Forbes 2019: Jackpotting ATM's (Automated Teller Machines) - Its easier than you might think. Presented in Disobey 2019.

Tips:

h7 Going Dark

In Finland, it's legal to use TOR at the time of writing. If you reside in another juristiction (e.g. taking course remotely from a dystopia), laws might be different. Obviously, it's illegal to do illegal things in TOR, just like it's illegal to do illegal things anywhere. Only do legal things.

If you are currently in a juristiction where using TOR is illegal (e.g. taking the course remotely from a repressive country), you obviously can't install it and do the related tasks if it's illegal where you are. For those cases, alternative task is: based on literature only (no hands on tests, no installation), compare anonymous/pseudonymous networks, such as TOR, I2P, Freenet and others. How do their goals, technology and other features differ? How are they similar?

x) Read and summarize (briefly, e.g. with some bullets)

a) Install TOR browser and access TOR network (.onion addresses). (Explain in detail how you installed it, and how you got access to TOR. If you got TOR installed in the class, you can write this part from memory. Make not of it if you're writing it from memory and not as you work).

b) Browse TOR network, find, take screenshots and comment

  • search engine for onion sites
  • marketplace
  • forum
  • a site for a well known organization that has a physical street address in the real world

c) Voluntary or alternative task: No onion. You can do this task in place of a and b. Install a darknet browser other than TOR, such as I2P or Freenet. Search, screenshot and describe examples of contents there.

d) Voluntary: Crypto hunter. Find Bitcoin address from a darknet site. Use the public ledger to find out if money has been transferred to that address.

Tips

  • Alternatives for installing TOR
  • OPSEC is hard, any single tool will not magically make you untraceable
  • Be cautious: don't trust anonymous sites, don't enter your name or other personal details anywhere.
  • O'Reilly Learning € (former Safari) is a bit pricey, but Haaga-Helia students get free access trough Haaga-Helia library A-Z page.
  • Bitcoin explorer
  • Other darknets include
    • GNUnet
    • Hypanet
    • I2P

h8

Adminstrivia

I will keep updating this page during and after the course.