SystemsSec 2016W Lecture 5 - Revision history

Sultani: /* Physical attacker, authenticated */

2016-04-17T01:29:35Z

Physical attacker, authenticated

← Older revision		Revision as of 01:29, 17 April 2016
Line 139:		Line 139:
	- Nilofar Mansourzadeh		- Nilofar Mansourzadeh
	- Noor sabri		- Noor sabri
			- Haamed Sultani

	- Targeted system		- Targeted system

Sam at 15:24, 26 January 2016

2016-01-26T15:24:36Z

← Older revision		Revision as of 15:24, 26 January 2016
Line 210:		Line 210:

	==Remote attacker, unauthenticated==		==Remote attacker, unauthenticated==
			=== Group 6 ===
			==== Members ====
	* Samuel Prashker		* Samuel Prashker
	* Daniel Lehman		* Daniel Lehman

Sultani: /* Physical attacker, authenticated */

2016-01-26T15:16:05Z

Physical attacker, authenticated

← Older revision		Revision as of 15:16, 26 January 2016
Line 131:		Line 131:

	==Physical attacker, authenticated==		==Physical attacker, authenticated==
			Members:

			- Matthew Preston
			- Jon Simpson
			- Allan Luke
			- Chang Xu
			- Nilofar Mansourzadeh
			- Noor sabri

			- Targeted system
			- Place of work’s system
			- server(remote/local)
			- Attacker
			- anyone who has the “attacker goals"
			- employee
			- pretend to be employee
			- Goals
			- remotely look at data
			- deny access
			- destroy data
			- corrupt
			- social engineering
			- Means
			- If data is on a server, attacker needs some level of access to the data (some way to connect to the data)
			- Put a physical key logger
			- physically freeze system
			- could look over your shoulder
			- pull the plug
			- physically disable verification points
			- slow down system
			- get admin access
			- steal employee's hardware
			- can get data by looking at camera feed
			- steal mobile phone

			- Attack strategies
			- could put a physical key logger
			- could take out the RAM(live)
			- infect hardware and reconnect it to the system
			- sell the stolen hardware
			- stolen employee’s computer has auto-login
			- most hardware is portable now so it’s easier to steal
			- disable cameras
			- record their behaviours
			- accessible weaknesses
			- isolated computers
			- points of least physical security
			- on/off devices
			- somewhat easier to attack powered-on devices

	==Physical attacker, unauthenticated==		==Physical attacker, unauthenticated==

Sam at 15:15, 26 January 2016

2016-01-26T15:15:45Z

← Older revision		Revision as of 15:15, 26 January 2016
Line 11:		Line 11:
	* Agheil Fazeli		* Agheil Fazeli
	* Brandon Hurley		* Brandon Hurley
	* Abdulkadir Addulkadir

	==== Scenarios ====		==== Scenarios ====
Line 168:		Line 167:
	* Gilbert Lavergne-Shank		* Gilbert Lavergne-Shank
	* Xiusan Zhou		* Xiusan Zhou
			* Abdulkadir Addulkadir


	'''Scenarios'''		'''Scenarios'''

Sam at 15:15, 26 January 2016

2016-01-26T15:15:05Z

← Older revision		Revision as of 15:15, 26 January 2016
Line 11:		Line 11:
	* Agheil Fazeli		* Agheil Fazeli
	* Brandon Hurley		* Brandon Hurley
			* Abdulkadir Addulkadir

	==== Scenarios ====		==== Scenarios ====

Aboodmufti: /* Local attacker */

2016-01-22T18:09:08Z

Local attacker

← Older revision		Revision as of 18:09, 22 January 2016
Line 2:		Line 2:

	==Local attacker==		==Local attacker==

			=== Group 1 ===
			==== Members ====
			* Abdulrahman Mufti
			* Josiah Konrad
			* William forest
			* Andrew Belu
			* Agheil Fazeli
			* Brandon Hurley

			==== Scenarios ====

			* '''Scenario #1:'''
			** Targeted System:
			*** home computer - parent computer
			*** > Windows 7
			** Attackers:
			*** sibling
			*** someone who lives in the house
			** Goals:
			*** the little brother wants to access big brother's account
			*** to access programs that the little brother doesn't have
			*** play games for a loner time
			** Means:
			*** watching them typing the password
			*** using safe mode to change the parents' password
			*** change clock (to be able to play for a longer time)
			*** take down security through the registry

	==Administrative attacker==		==Administrative attacker==

Miranmirza: /* Physical attacker, unauthenticated */

2016-01-22T03:32:32Z

Physical attacker, unauthenticated

← Older revision		Revision as of 03:32, 22 January 2016
Line 105:		Line 105:

	==Physical attacker, unauthenticated==		==Physical attacker, unauthenticated==
	Abdul Bin Asif Niazi~~<br>~~		* Abdul Bin Asif Niazi
	Dusan Rozman~~<br>~~		* Dusan Rozman
	Sam Whiteley~~<br>~~		* Sam Whiteley
	Jake Brown~~<br>~~		* Jake Brown
	Nicholas Laws~~<br>~~		* Nicholas Laws
	Miran Mirza~~<br>~~		* Miran Mirza

	Typically targeted systems include: portable systems such as laptops, smartphones, tablets, USB keys, card systems, banking machines.~~<br>~~		Typically targeted systems include: portable systems such as laptops, smartphones, tablets, USB keys, card systems, banking machines.

	'''Attack strategies:''' ~~<br>~~		'''Attack strategies:'''
	• Duplicated cards~~<br>~~		* Duplicated cards
	• Card Readers~~<br>~~		* Card Readers
	• RFID readers: can be used to duplicate RFID data and steal NFC enabled bank access systems~~<br>~~		* RFID readers: can be used to duplicate RFID data and steal NFC enabled bank access systems
	• Radio-Frequency generator used to unlock different cards~~<br>~~		* Radio-Frequency generator used to unlock different cards

	'''Sort of attacks that can happen:'''~~<br>~~		'''Sort of attacks that can happen:'''
	• Man in the middle attack on physical phone lines, people can access phone conversations by inserting some sort of hardware in a SIM card or a landline.~~<br>~~		* Man in the middle attack on physical phone lines, people can access phone conversations by inserting some sort of hardware in a SIM card or a landline.
	• Using the USB auto install feature to spread attacks, exploit this vulnerability to install software. An attacker can plug a USB thumb drive into computer and install software in order to escalate privileges.~~<br>~~		* Using the USB auto install feature to spread attacks, exploit this vulnerability to install software. An attacker can plug a USB thumb drive into computer and install software in order to escalate privileges.
	• Phishing attack, a user can install some sort of software to reroute traffic through their system in order to collect data. A user can physically rewrite the hosts file on system to tamper with the DNS on the system and steal data.~~<br>~~		* Phishing attack, a user can install some sort of software to reroute traffic through their system in order to collect data. A user can physically rewrite the hosts file on system to tamper with the DNS on the system and steal data.
	• For secured areas such as labs a vulnerability would be the door which requires some sort of card based authentication, since this can be stolen it is vulnerable.~~<br>~~		* For secured areas such as labs a vulnerability would be the door which requires some sort of card based authentication, since this can be stolen it is vulnerable.
	• Bank Machines: a lot of bank machines have a USB port in the bank and thus can get software installed on them. People can also install a card reader on top of the card slot to collect card numbers and other sensitive data.~~<br>~~		* Bank Machines: a lot of bank machines have a USB port in the bank and thus can get software installed on them. People can also install a card reader on top of the card slot to collect card numbers and other sensitive data.

	'''Scenarios:'''~~<br>~~		'''Scenarios:'''
	• A user gets physical access to a device using sort of card access and then physically destroys a computer (a literal denial of service attack).~~<br>~~		* A user gets physical access to a device using sort of card access and then physically destroys a computer (a literal denial of service attack).
	• An attacker swaps a keyboard for a keylogging keyboard and uses it to steal sensitive data. They are exploiting the fact that users won't notice the change~~.<br>~~		* An attacker swaps a keyboard for a keylogging keyboard and uses it to steal sensitive data. They are exploiting the fact that users won't notice the change
	• A user can exploit the reset feature on a router in order to gain access to it's settings, they can then go on to flash the firmware and infect all connected devices on the network.		* A user can exploit the reset feature on a router in order to gain access to it's settings, they can then go on to flash the firmware and infect all connected devices on the network.

	==Remote attacker, unauthenticated==		==Remote attacker, unauthenticated==

Miranmirza: /* Physical attacker, unauthenticated */

2016-01-22T03:30:42Z

Physical attacker, unauthenticated

← Older revision		Revision as of 03:30, 22 January 2016
Line 105:		Line 105:

	==Physical attacker, unauthenticated==		==Physical attacker, unauthenticated==
	Abdul Bin Asif Niazi		Abdul Bin Asif Niazi<br>
	Dusan Rozman		Dusan Rozman<br>
	Sam Whiteley		Sam Whiteley<br>
	Jake Brown		Jake Brown<br>
	Nicholas Laws		Nicholas Laws<br>
	Miran Mirza		Miran Mirza<br>

	Typically targeted systems include: portable systems such as laptops, smartphones, tablets, USB keys, card systems, banking machines.		Typically targeted systems include: portable systems such as laptops, smartphones, tablets, USB keys, card systems, banking machines.<br>

	'''Attack strategies:'''		'''Attack strategies:''' <br>
	• Duplicated cards		• Duplicated cards<br>
	• Card Readers		• Card Readers<br>
	• RFID readers: can be used to duplicate RFID data and steal NFC enabled bank access systems		• RFID readers: can be used to duplicate RFID data and steal NFC enabled bank access systems<br>
	• Radio-Frequency generator used to unlock different cards		• Radio-Frequency generator used to unlock different cards<br>

	'''Sort of attacks that can happen:'''		'''Sort of attacks that can happen:'''<br>
	• Man in the middle attack on physical phone lines, people can access phone conversations by inserting some sort of hardware in a SIM card or a landline.		• Man in the middle attack on physical phone lines, people can access phone conversations by inserting some sort of hardware in a SIM card or a landline.<br>
	• Using the USB auto install feature to spread attacks, exploit this vulnerability to install software. An attacker can plug a USB thumb drive into computer and install software in order to escalate privileges.		• Using the USB auto install feature to spread attacks, exploit this vulnerability to install software. An attacker can plug a USB thumb drive into computer and install software in order to escalate privileges.<br>
	• Phishing attack, a user can install some sort of software to reroute traffic through their system in order to collect data. A user can physically rewrite the hosts file on system to tamper with the DNS on the system and steal data.		• Phishing attack, a user can install some sort of software to reroute traffic through their system in order to collect data. A user can physically rewrite the hosts file on system to tamper with the DNS on the system and steal data.<br>
	• For secured areas such as labs a vulnerability would be the door which requires some sort of card based authentication, since this can be stolen it is vulnerable.		• For secured areas such as labs a vulnerability would be the door which requires some sort of card based authentication, since this can be stolen it is vulnerable.<br>
	• Bank Machines: a lot of bank machines have a USB port in the bank and thus can get software installed on them. People can also install a card reader on top of the card slot to collect card numbers and other sensitive data.		• Bank Machines: a lot of bank machines have a USB port in the bank and thus can get software installed on them. People can also install a card reader on top of the card slot to collect card numbers and other sensitive data.<br>

	'''Scenarios:'''		'''Scenarios:'''<br>
	• A user gets physical access to a device using sort of card access and then physically destroys a computer (a literal denial of service attack).		• A user gets physical access to a device using sort of card access and then physically destroys a computer (a literal denial of service attack).<br>
	• An attacker swaps a keyboard for a keylogging keyboard and uses it to steal sensitive data. They are exploiting the fact that users won't notice the change.		• An attacker swaps a keyboard for a keylogging keyboard and uses it to steal sensitive data. They are exploiting the fact that users won't notice the change.<br>
	A user can exploit the reset feature on a router in order to gain access to it's settings, they can then go on to flash the firmware and infect all connected devices on the network.		• A user can exploit the reset feature on a router in order to gain access to it's settings, they can then go on to flash the firmware and infect all connected devices on the network.

	==Remote attacker, unauthenticated==		==Remote attacker, unauthenticated==

Miranmirza: /* Physical attacker, unauthenticated */

2016-01-22T03:27:46Z

Physical attacker, unauthenticated

← Older revision		Revision as of 03:27, 22 January 2016
Line 105:		Line 105:

	==Physical attacker, unauthenticated==		==Physical attacker, unauthenticated==
			Abdul Bin Asif Niazi
			Dusan Rozman
			Sam Whiteley
			Jake Brown
			Nicholas Laws
			Miran Mirza

			Typically targeted systems include: portable systems such as laptops, smartphones, tablets, USB keys, card systems, banking machines.

			'''Attack strategies:'''
			• Duplicated cards
			• Card Readers
			• RFID readers: can be used to duplicate RFID data and steal NFC enabled bank access systems
			• Radio-Frequency generator used to unlock different cards

			'''Sort of attacks that can happen:'''
			• Man in the middle attack on physical phone lines, people can access phone conversations by inserting some sort of hardware in a SIM card or a landline.
			• Using the USB auto install feature to spread attacks, exploit this vulnerability to install software. An attacker can plug a USB thumb drive into computer and install software in order to escalate privileges.
			• Phishing attack, a user can install some sort of software to reroute traffic through their system in order to collect data. A user can physically rewrite the hosts file on system to tamper with the DNS on the system and steal data.
			• For secured areas such as labs a vulnerability would be the door which requires some sort of card based authentication, since this can be stolen it is vulnerable.
			• Bank Machines: a lot of bank machines have a USB port in the bank and thus can get software installed on them. People can also install a card reader on top of the card slot to collect card numbers and other sensitive data.

			'''Scenarios:'''
			• A user gets physical access to a device using sort of card access and then physically destroys a computer (a literal denial of service attack).
			• An attacker swaps a keyboard for a keylogging keyboard and uses it to steal sensitive data. They are exploiting the fact that users won't notice the change.
			A user can exploit the reset feature on a router in order to gain access to it's settings, they can then go on to flash the firmware and infect all connected devices on the network.

	==Remote attacker, unauthenticated==		==Remote attacker, unauthenticated==

Ibrahim: /* Administrative attacker */

2016-01-21T19:45:06Z

Administrative attacker

← Older revision		Revision as of 19:45, 21 January 2016
Line 46:		Line 46:
	** Attackers: Students with editor privilege on the wiki.		** Attackers: Students with editor privilege on the wiki.
	** Goals:		** Goals:
	*** Modify or delete other groups' entries ~~to make them look bad~~.		*** Modify or delete other groups' entries.
	** Means: Full access to edit the page using credentials given by the professor.		** Means: Full access to edit the page using credentials given by the professor.