102 \end{frame}} |
105 \end{frame}} |
103 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
106 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
104 |
107 |
105 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
108 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
106 \mode<presentation>{ |
109 \mode<presentation>{ |
107 \begin{frame} |
110 \begin{frame}[c] |
108 |
111 |
109 \begin{center} |
112 \begin{textblock}{1}(2,5) |
110 %\includegraphics[scale=2.1]{pics/barrier.jpg} |
113 \begin{tabular}{c} |
111 \end{center} |
114 \includegraphics[scale=0.15]{pics/servers.png}\\[-2mm] |
112 |
115 \small Server |
113 \end{frame}} |
116 \end{tabular} |
114 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
117 \end{textblock} |
115 |
118 |
116 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
119 \begin{textblock}{1}(5.6,4) |
117 \mode<presentation>{ |
120 \begin{tikzpicture}[scale=1.1] |
118 \begin{frame}[c] |
121 \draw[white] (0,1) node (X) {}; |
119 \frametitle{\begin{tabular}{@ {}c@ {}}Security Engineers\end{tabular}} |
122 \draw[white] (2,1) node (Y) {}; |
120 |
123 \draw[white] (0,0) node (X1) {}; |
121 According to Bruce Schneier, {\bf security engineers} require |
124 \draw[white] (2,0) node (Y1) {}; |
122 a particular {\bf mindset}:\bigskip |
125 \draw[white] (0,-1) node (X2) {}; |
123 |
126 \draw[white] (2,-1) node (Y2) {}; |
124 \begin{tikzpicture} |
127 \draw[red, <-, line width = 2mm] (X) -- (Y); |
125 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
128 \node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {}; |
126 {\normalsize\color{darkgray} |
129 \draw[red, ->, line width = 2mm] (X1) -- (Y1); |
127 \begin{minipage}{10cm}\raggedright\small |
130 \node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X1)!.5!(Y1) $) {}; |
128 ``Security engineers --- at least the good ones --- see the world dif$\!$ferently. |
131 \draw[red, <-, line width = 2mm] (X2) -- (Y2); |
129 They can't walk into a store without noticing how they might shoplift. They can't |
132 \node [inner sep=7pt,label=above:\textcolor{black}{POST data}] at ($ (X2)!.5!(Y2) $) {}; |
130 use a computer without wondering about the security vulnerabilities. They can't |
133 \end{tikzpicture} |
131 vote without trying to figure out how to vote twice. They just can't help it.'' |
134 \end{textblock} |
132 \end{minipage}}; |
135 |
133 \end{tikzpicture} |
136 |
|
137 \begin{textblock}{1}(9,5.5) |
|
138 \begin{tabular}{c} |
|
139 \includegraphics[scale=0.15]{pics/laptop.png}\\[-2mm] |
|
140 \small Browser |
|
141 \end{tabular} |
|
142 \end{textblock} |
|
143 |
|
144 \only<2>{ |
|
145 \begin{textblock}{10}(2,13.5) |
|
146 \begin{itemize} |
|
147 \item programming languages, compilers |
|
148 \end{itemize} |
|
149 \end{textblock}} |
|
150 |
|
151 |
|
152 \end{frame}} |
|
153 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
154 |
|
155 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
156 \mode<presentation>{ |
|
157 \begin{frame}[c] |
|
158 |
|
159 transforming strings into structured data\\[10mm] |
|
160 |
|
161 {\LARGE\bf Lexing}\medskip\\ |
|
162 \hspace{5mm}(recognising ``words'')\\[6mm] |
|
163 |
|
164 {\LARGE\bf Parsing}\medskip\\ |
|
165 \hspace{5mm}(recognising ``sentences'') |
|
166 |
|
167 \end{frame}} |
|
168 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
169 |
|
170 |
|
171 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
172 \mode<presentation>{ |
|
173 \begin{frame}[c] |
|
174 |
|
175 The subject is quite old: |
|
176 |
|
177 \begin{itemize} |
|
178 \item Turing Machines, 1936 |
|
179 \item first compiler for COBOL, 1957 (Grace Hopper) |
|
180 \item but surprisingly research papers are still published now |
|
181 \end{itemize} |
134 |
182 |
135 \begin{flushright} |
183 \begin{flushright} |
136 %\includegraphics[scale=0.0087]{pics/schneierbook1.jpg}\; |
184 \includegraphics[scale=0.3]{pics/hopper.jpg}\\ |
137 %\includegraphics[scale=0.0087]{pics/schneierbook2.jpg}\; |
185 \footnotesize\textcolor{gray}{Grace Hopper} |
138 %\includegraphics[scale=0.85]{pics/schneier.png} |
|
139 \end{flushright} |
186 \end{flushright} |
140 |
187 |
|
188 {\footnotesize\textcolor{gray}{(she made it to David Letterman's Tonight Show, \url{http://www.youtube.com/watch?v=aZOxtURhfEU})}} |
141 |
189 |
142 \end{frame}} |
190 \end{frame}} |
143 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
191 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
144 |
192 |
145 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
193 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
146 \mode<presentation>{ |
194 \mode<presentation>{ |
147 \begin{frame}[c] |
195 \begin{frame}[c] |
148 \frametitle{\begin{tabular}{@ {}c@ {}}Chip-and-PIN\end{tabular}} |
196 \frametitle{\begin{tabular}{c}This Course\end{tabular}} |
149 |
197 |
150 \begin{center} |
198 \begin{itemize} |
151 %\includegraphics[scale=0.3]{pics/creditcard1.jpg}\; |
199 \item regular expression / regular expression matching |
152 %\includegraphics[scale=0.3]{pics/creditcard2.jpg} |
200 \item a bit of sets (of strings) |
153 \end{center} |
201 \item automata |
154 |
202 \item the Myhill-Nerode theorem |
155 \begin{itemize} |
203 \item parsing |
156 \item Chip-and-PIN was introduced in the UK in 2004 |
204 \item grammars |
157 \item before that customers had to sign a receipt\medskip |
205 \item a small interpreter / webbrowser |
158 \item Is Chip-and-PIN a more secure system? |
206 \end{itemize} |
159 \end{itemize} |
207 |
160 |
208 \end{frame}} |
161 \begin{flushright} |
209 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
162 \small\textcolor{gray}{(Some other countries still use the old method.)} |
210 |
163 \end{flushright} |
211 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
164 |
212 \mode<presentation>{ |
165 |
213 \begin{frame}[c] |
166 \end{frame}} |
214 \frametitle{\begin{tabular}{c}This Course\end{tabular}} |
167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
215 |
168 |
216 \begin{itemize} |
169 |
217 \item the ultimate goal is to implement a small web-browser (really small)\bigskip |
170 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
218 \end{itemize} |
171 \mode<presentation>{ |
219 |
172 \begin{frame}[c] |
220 Let's start with: |
173 \frametitle{\begin{tabular}{@ {}c@ {}}Yes \ldots\end{tabular}} |
221 |
174 |
222 \begin{itemize} |
175 \begin{tikzpicture} |
223 \item a web-crawler |
176 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
224 \item an email harvester |
177 {\normalsize\color{darkgray} |
225 \item a web-scraper |
178 \begin{minipage}{10cm}\raggedright\small |
226 \end{itemize} |
179 ``Chip-and-PIN is so effective in this country [UK] that fraudsters are starting to move their activities overseas,'' |
227 |
180 said Emile Abu-Shakra, spokesman for Lloyds TSB (in the Guardian, 2006). |
228 \end{frame}} |
181 \end{minipage}}; |
229 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
182 \end{tikzpicture}\bigskip |
230 |
183 |
231 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
184 |
232 \mode<presentation>{ |
185 \begin{itemize} |
233 \begin{frame}[c] |
186 \item mag-stripe cards cannot be cloned anymore |
234 \frametitle{\begin{tabular}{c}Scala\end{tabular}} |
187 \item stolen or cloned cards need to be used abroad |
235 |
188 \item fraud on lost, stolen and counterfeit credit cards was down \pounds{}60m (24\%) on 2004's figure |
236 \footnotesize a simple function for reading webpages |
189 \end{itemize} |
237 |
190 |
238 {\lstset{language=Scala}\fontsize{8}{10}\selectfont |
191 |
239 \texttt{\lstinputlisting{app0.scala}}}\pause\bigskip |
192 \end{frame}} |
|
193 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
194 |
|
195 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
196 \mode<presentation>{ |
|
197 \begin{frame}[c] |
|
198 \frametitle{\begin{tabular}{c}But let's see \ldots\end{tabular}} |
|
199 |
|
200 |
|
201 \begin{textblock}{1}(3,4) |
|
202 \begin{tabular}{c} |
|
203 %\includegraphics[scale=0.3]{pics/bank.png}\\[-2mm] |
|
204 \small Bank |
|
205 \end{tabular} |
|
206 \end{textblock} |
|
207 |
|
208 \begin{textblock}{1}(7,4.5) |
|
209 \begin{tabular}{c} |
|
210 %\includegraphics[scale=3]{pics/store.png}\\[-2mm] |
|
211 \end{tabular} |
|
212 \end{textblock} |
|
213 |
|
214 \begin{textblock}{1}(4.5,9.9) |
|
215 \begin{tabular}{c} |
|
216 %\includegraphics[scale=0.16]{pics/rman.png}\\[-1mm] |
|
217 \small costumer / you |
|
218 \end{tabular} |
|
219 \end{textblock} |
|
220 |
|
221 \only<2->{ |
|
222 \begin{textblock}{1}(4.5,7.5) |
|
223 \begin{tikzpicture}[scale=1.3] |
|
224 \draw[white] (0,0) node (X) {}; |
|
225 \draw[white] (1,-1) node (Y) {}; |
|
226 \draw[red, ->, line width = 2mm] (X) -- (Y); |
|
227 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
228 \end{tikzpicture} |
|
229 \end{textblock}} |
|
230 |
|
231 \only<3->{ |
|
232 \begin{textblock}{1}(6.8,7.5) |
|
233 \begin{tikzpicture}[scale=1.3] |
|
234 \draw[white] (0,0) node (X) {}; |
|
235 \draw[white] (1,1) node (Y) {}; |
|
236 \draw[red, ->, line width = 2mm] (X) -- (Y); |
|
237 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
238 \end{tikzpicture} |
|
239 \end{textblock} |
|
240 |
|
241 \begin{textblock}{1}(4.8,5.9) |
|
242 \begin{tikzpicture}[scale=1.3] |
|
243 \draw[white] (0,0) node (X) {}; |
|
244 \draw[white] (1.4,0) node (Y) {}; |
|
245 \draw[red, <->, line width = 2mm] (X) -- (Y); |
|
246 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
247 \end{tikzpicture} |
|
248 \end{textblock}} |
|
249 |
|
250 \only<4->{ |
|
251 \begin{textblock}{1}(12,6.5) |
|
252 \begin{tabular}{c} |
|
253 %\includegraphics[scale=0.8]{pics/factory.png}\\[-1mm] |
|
254 \small card\\[-2mm]\small terminal\\[-2mm] \small producer |
|
255 \end{tabular} |
|
256 \end{textblock} |
|
257 |
|
258 \begin{textblock}{1}(10,7) |
|
259 \begin{tikzpicture}[scale=1.6] |
|
260 \draw[white] (0,0) node (X) {}; |
|
261 \draw[white] (-1,0.6) node (Y) {}; |
|
262 \draw[red, ->, line width = 2mm] (X) -- (Y); |
|
263 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
264 \end{tikzpicture} |
|
265 \end{textblock}} |
|
266 |
|
267 \end{frame}} |
|
268 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
269 |
|
270 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
271 \mode<presentation>{ |
|
272 \begin{frame}[c] |
|
273 \frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}} |
|
274 |
|
275 |
|
276 \begin{itemize} |
|
277 \item A ``tamperesitant'' terminal playing Tetris on |
|
278 \textcolor{blue}{\href{http://www.youtube.com/watch?v=wWTzkD9M0sU}{youtube}}.\\ |
|
279 \textcolor{lightgray}{\footnotesize(\url{http://www.youtube.com/watch?v=wWTzkD9M0sU})} |
|
280 \end{itemize} |
|
281 |
|
282 |
|
283 %\includegraphics[scale=0.2]{pics/tetris.jpg} |
|
284 |
|
285 |
|
286 \end{frame}} |
|
287 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
288 |
|
289 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
290 \mode<presentation>{ |
|
291 \begin{frame}[c] |
|
292 \frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}} |
|
293 |
|
294 |
|
295 \begin{itemize} |
|
296 \item in 2006, Shell petrol stations stopped accepting Chip-and-PIN after \pounds{}1m had been stolen from customer accounts\smallskip |
|
297 \item in 2008, hundreds of card readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been |
|
298 expertly tampered with shortly after manufacture so that details and PINs of credit cards were sent during the 9 months |
|
299 before over mobile phone networks to criminals in Lahore, Pakistan |
|
300 \end{itemize} |
|
301 |
|
302 \end{frame}} |
|
303 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
304 |
|
305 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
306 \mode<presentation>{ |
|
307 \begin{frame}[c] |
|
308 \frametitle{\begin{tabular}{c}Chip-and-PIN is Broken\end{tabular}} |
|
309 |
|
310 \begin{flushright} |
|
311 %\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\; |
|
312 %\includegraphics[scale=1.5]{pics/anderson.jpg} |
|
313 \end{flushright} |
|
314 |
|
315 \begin{itemize} |
|
316 \item man-in-the-middle attacks by the group around Ross Anderson\medskip |
|
317 \end{itemize} |
|
318 |
|
319 \begin{center} |
|
320 \mbox{}\hspace{-20mm}%\includegraphics[scale=0.5]{pics/chip-attack.png} |
|
321 \end{center} |
|
322 |
|
323 |
|
324 \begin{textblock}{1}(11.5,13.7) |
|
325 \begin{tabular}{l} |
|
326 \footnotesize on BBC Newsnight\\[-2mm] |
|
327 \footnotesize in 2010 or \textcolor{blue}{\href{http://www.youtube.com/watch?v=JPAX32lgkrw}{youtube}} |
|
328 \end{tabular} |
|
329 \end{textblock} |
|
330 |
|
331 \end{frame}} |
|
332 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
333 |
|
334 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
335 \mode<presentation>{ |
|
336 \begin{frame}[c] |
|
337 \frametitle{\begin{tabular}{@ {}c@ {}}Chip-and-PIN is Really Broken\end{tabular}} |
|
338 |
|
339 \begin{flushright} |
|
340 %\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\; |
|
341 %\includegraphics[scale=1.5]{pics/anderson.jpg} |
|
342 \end{flushright} |
|
343 |
|
344 \begin{itemize} |
|
345 \item same group successfully attacked this year card readers and ATM machines |
|
346 \item the problem: several types of ATMs generate poor random numbers, which are used as nonces |
|
347 \end{itemize} |
|
348 |
|
349 \end{frame}} |
|
350 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
351 |
|
352 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
353 \mode<presentation>{ |
|
354 \begin{frame}[c] |
|
355 \frametitle{\begin{tabular}{c}The Problem \ldots\end{tabular}} |
|
356 |
|
357 |
|
358 \begin{textblock}{1}(3,4) |
|
359 \begin{tabular}{c} |
|
360 %\includegraphics[scale=0.3]{pics/bank.png}\\[-2mm] |
|
361 \small Bank |
|
362 \end{tabular} |
|
363 \end{textblock} |
|
364 |
|
365 \begin{textblock}{1}(7,4.5) |
|
366 \begin{tabular}{c} |
|
367 %\includegraphics[scale=3]{pics/store.png}\\[-2mm] |
|
368 \end{tabular} |
|
369 \end{textblock} |
|
370 |
|
371 \begin{textblock}{1}(12,6.5) |
|
372 \begin{tabular}{c} |
|
373 %\includegraphics[scale=0.8]{pics/factory.png}\\[-1mm] |
|
374 \small terminal\\[-2mm] \small producer |
|
375 \end{tabular} |
|
376 \end{textblock} |
|
377 |
|
378 \begin{textblock}{1}(4.5,9.9) |
|
379 \begin{tabular}{c} |
|
380 %\includegraphics[scale=0.13]{pics/rman.png}\\[-1mm] |
|
381 \small costumer / you |
|
382 \end{tabular} |
|
383 \end{textblock} |
|
384 |
|
385 \begin{textblock}{1}(4.5,7.5) |
|
386 \begin{tikzpicture}[scale=1.3] |
|
387 \draw[white] (0,0) node (X) {}; |
|
388 \draw[white] (1,-1) node (Y) {}; |
|
389 \draw[gray, ->, line width = 2mm] (X) -- (Y); |
|
390 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
391 \end{tikzpicture} |
|
392 \end{textblock} |
|
393 |
|
394 \begin{textblock}{1}(6.8,7.5) |
|
395 \begin{tikzpicture}[scale=1.3] |
|
396 \draw[white] (0,0) node (X) {}; |
|
397 \draw[white] (1,1) node (Y) {}; |
|
398 \draw[gray, ->, line width = 2mm] (X) -- (Y); |
|
399 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
400 \end{tikzpicture} |
|
401 \end{textblock} |
|
402 |
|
403 \begin{textblock}{1}(4.8,5.9) |
|
404 \begin{tikzpicture}[scale=1.3] |
|
405 \draw[white] (0,0) node (X) {}; |
|
406 \draw[white] (1.4,0) node (Y) {}; |
|
407 \draw[gray, <->, line width = 2mm] (X) -- (Y); |
|
408 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
409 \end{tikzpicture} |
|
410 \end{textblock} |
|
411 |
|
412 \begin{textblock}{1}(10,7) |
|
413 \begin{tikzpicture}[scale=1.6] |
|
414 \draw[white] (0,0) node (X) {}; |
|
415 \draw[white] (-1,0.6) node (Y) {}; |
|
416 \draw[gray, ->, line width = 2mm] (X) -- (Y); |
|
417 \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {}; |
|
418 \end{tikzpicture} |
|
419 \end{textblock} |
|
420 |
|
421 \begin{textblock}{14}(1,13.5) |
|
422 \begin{itemize} |
|
423 \item the burden of proof for fraud and financial liability was shifted to the costumer |
|
424 \end {itemize} |
|
425 \end{textblock} |
|
426 |
|
427 \end{frame}} |
|
428 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
429 |
|
430 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
431 \mode<presentation>{ |
|
432 \begin{frame}[c] |
|
433 \frametitle{\begin{tabular}{c}Being Screwed Again\end{tabular}} |
|
434 |
|
435 |
|
436 \begin{flushright} |
|
437 %\includegraphics[scale=0.3]{pics/rbssecure.jpg} |
|
438 \end{flushright} |
|
439 |
|
440 \begin{itemize} |
|
441 \item {\bf Responsibility}\\ |
|
442 ``You understand that you are financially responsible for all uses of RBS Secure.''\\ |
|
443 \textcolor{lightgray}{\footnotesize\url{https://www.rbssecure.co.uk/rbs/tdsecure/terms_of_use.jsp}} |
|
444 \end{itemize} |
|
445 |
|
446 \end{frame}} |
|
447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
448 |
|
449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
450 \mode<presentation>{ |
|
451 \begin{frame}[c] |
|
452 \frametitle{\begin{tabular}{c}Web Applications\end{tabular}} |
|
453 |
|
454 |
|
455 \begin{textblock}{1}(2,5) |
|
456 \begin{tabular}{c} |
|
457 %\includegraphics[scale=0.15]{pics/servers.png}\\[-2mm] |
|
458 \small Servers from\\[-2mm] |
|
459 \small Dot.com Inc. |
|
460 \end{tabular} |
|
461 \end{textblock} |
|
462 |
|
463 \begin{textblock}{1}(5.6,6) |
|
464 \begin{tikzpicture}[scale=2.5] |
|
465 \draw[white] (0,0) node (X) {}; |
|
466 \draw[white] (1,0) node (Y) {}; |
|
467 \only<2>{\draw[red, <-, line width = 2mm] (X) -- (Y); |
|
468 \node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {};} |
|
469 \only<3>{\draw[red, ->, line width = 2mm] (X) -- (Y); |
|
470 \node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X)!.5!(Y) $) {};} |
|
471 \only<4>{\draw[red, <-, line width = 2mm] (X) -- (Y); |
|
472 \node [inner sep=7pt,label=above:\textcolor{black}{POST data}] at ($ (X)!.5!(Y) $) {};} |
|
473 \end{tikzpicture} |
|
474 \end{textblock} |
|
475 |
|
476 |
|
477 \begin{textblock}{1}(9,5.5) |
|
478 \begin{tabular}{c} |
|
479 %\includegraphics[scale=0.15]{pics/laptop.png}\\[-2mm] |
|
480 \small Client(s) |
|
481 \end{tabular} |
|
482 \end{textblock} |
|
483 |
|
484 \begin{textblock}{13}(1,13) |
|
485 \begin{itemize} |
|
486 \item What are pitfalls and best practices? |
|
487 \end{itemize} |
|
488 \end{textblock} |
|
489 |
|
490 \end{frame}} |
|
491 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
492 |
|
493 |
|
494 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
495 \mode<presentation>{ |
|
496 \begin{frame}[c] |
|
497 \frametitle{\begin{tabular}{c}Scala + Play\end{tabular}} |
|
498 |
|
499 \footnotesize a simple response from the server: |
|
500 |
|
501 %{\lstset{language=Scala}\fontsize{8}{10}\selectfont |
|
502 %\texttt{\lstinputlisting{app0.scala}}}\bigskip |
|
503 |
240 |
504 \footnotesize |
241 \footnotesize |
505 alternative response:\\ |
|
506 |
|
507 {\lstset{language=Scala}\fontsize{8}{10}\selectfont |
242 {\lstset{language=Scala}\fontsize{8}{10}\selectfont |
508 \texttt{\lstinline{Ok("<H1>Hello world!</H1>").as(HTML)}}} |
243 \texttt{\lstinputlisting{app1.scala}}} |
509 \end{frame}} |
244 |
510 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
245 |
511 |
246 \end{frame}} |
512 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
247 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
513 \mode<presentation>{ |
248 |
514 \begin{frame}[c] |
249 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
515 |
250 \mode<presentation>{ |
516 %{\lstset{language=Scala}\fontsize{8}{10}\selectfont |
251 \begin{frame}[c] |
517 %\texttt{\lstinputlisting{app1.scala}}} |
252 |
518 |
253 |
519 |
254 |
520 \end{frame}} |
255 \end{frame}} |
521 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
522 |
257 |
702 \item cookie value encoded as hash |
437 \item cookie value encoded as hash |
703 \end{itemize} |
438 \end{itemize} |
704 \end{frame}} |
439 \end{frame}} |
705 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
440 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
706 |
441 |
707 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
442 |
708 \mode<presentation>{ |
|
709 \begin{frame}[c] |
|
710 |
|
711 \begin{center} |
|
712 %\includegraphics[scale=1.8]{pics/barrier.jpg} |
|
713 \end{center} |
|
714 |
|
715 \begin{itemize} |
|
716 \item data integrity needs to be ensured |
|
717 \end{itemize} |
|
718 |
|
719 \end{frame}} |
|
720 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
721 |
|
722 |
|
723 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
724 \mode<presentation>{ |
|
725 \begin{frame}[c] |
|
726 \mbox{}\\[-7mm] |
|
727 |
|
728 %{\lstset{language=Scala}\fontsize{8}{10}\selectfont |
|
729 %\texttt{\lstinputlisting{app3.scala}}} |
|
730 |
|
731 \small |
|
732 \begin{itemize} |
|
733 \item the counter/hash pair is intended to prevent tampering |
|
734 \end{itemize} |
|
735 \end{frame}} |
|
736 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
737 |
443 |
738 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
444 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
739 \mode<presentation>{ |
445 \mode<presentation>{ |
740 \begin{frame}[c] |
446 \begin{frame}[c] |
741 \frametitle{\begin{tabular}{c}SHA-1\end{tabular}} |
447 \frametitle{\begin{tabular}{c}Exam\end{tabular}} |
742 |
448 |
743 \begin{itemize} |
449 \begin{itemize} |
744 \item SHA-1 is a cryptographic hash function\\ |
450 \item The question ``Is this relevant for the exams?'' is not appreciated!\bigskip\\ |
745 (MD5, SHA-256, SHA-512, \ldots) |
|
746 \item message $\rightarrow$ digest |
|
747 \item no known attack exists, except brute force\bigskip\pause |
|
748 \item but dictionary attacks are very ef$\!$fective for extracting passwords (later) |
|
749 \end{itemize} |
|
750 |
|
751 \end{frame}} |
|
752 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
753 |
|
754 |
|
755 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
756 \mode<presentation>{ |
|
757 \begin{frame}[c] |
|
758 \mbox{}\\[-9mm] |
|
759 |
|
760 %{\lstset{language=Scala}\fontsize{8}{10}\selectfont |
|
761 %\texttt{\lstinputlisting{app4.scala}}} |
|
762 |
|
763 \begin{textblock}{1}(9,1) |
|
764 \begin{tikzpicture}[scale=1.3] |
|
765 \draw[white] (0,0) node (X) {}; |
|
766 \draw[white] (3,0) node (Y) {}; |
|
767 \draw[red, <-, line width = 2mm] (X) -- (Y); |
|
768 \node [inner sep=5pt,label=above:\textcolor{black}{\small should be random}] at ($ (X)!.5!(Y) $) {}; |
|
769 \end{tikzpicture} |
|
770 \end{textblock} |
|
771 |
|
772 \begin{textblock}{1}(6.6,4.9) |
|
773 \begin{tikzpicture}[scale=1.3] |
|
774 \draw[white] (0,0) node (X) {}; |
|
775 \draw[white] (1,-1) node (Y) {}; |
|
776 \draw[red, <-, line width = 2mm] (X) -- (Y); |
|
777 \node [inner sep=5pt,label=above:{}] at ($ (X)!.5!(Y) $) {}; |
|
778 \end{tikzpicture} |
|
779 \end{textblock} |
|
780 |
|
781 \end{frame}} |
|
782 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
783 |
|
784 |
|
785 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
786 \mode<presentation>{ |
|
787 \begin{frame}[c] |
|
788 \frametitle{\begin{tabular}{c}Unix Passwords\end{tabular}} |
|
789 |
|
790 \begin{itemize} |
|
791 \item passwords are \alert{\bf not} stored in clear text |
|
792 \item instead \texttt{/etc/shadow} contains |
|
793 \end{itemize} |
|
794 |
|
795 {\small |
|
796 \texttt{name:\$1\$QIGCa\$/ruJs8AvmrknzKTzM2TYE.:other\_info} |
|
797 } |
|
798 |
|
799 \begin{itemize} |
|
800 \item \texttt{\$} is separator |
|
801 \item \texttt{1} is MD5 (actually SHA-512 is used nowadays, \texttt{6}) |
|
802 \item \texttt{QIGCa} is salt |
|
803 \item \texttt{ruJs8AvmrknzKTzM2TYE} $\rightarrow$ password + salt |
|
804 \end{itemize} |
|
805 |
|
806 \textcolor{gray}{\small |
|
807 (\texttt{openssl passwd -1 -salt QIGCa pippo}) |
|
808 } |
|
809 % Unix password |
|
810 % http://ubuntuforums.org/showthread.php?p=5318038 |
|
811 |
|
812 \end{frame}} |
|
813 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
814 |
|
815 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
816 \mode<presentation>{ |
|
817 \begin{frame}[c] |
|
818 \frametitle{\begin{tabular}{c}Password Blunders\end{tabular}} |
|
819 |
|
820 |
|
821 \begin{itemize} |
|
822 \item in late 2009, when an SQL injection attack against online games |
|
823 service RockYou.com exposed 32 million \alert{plaintext} passwords |
|
824 |
|
825 \item 1.3 million Gawker credentials exposed in December 2010 containing |
|
826 unsalted(?) \alert{MD5} hashes |
|
827 |
|
828 \item June 6th, 2012, 6 million unsalted SHA-1 passwords were leaked from linkedIn |
|
829 % linkedIn password |
|
830 % http://erratasec.blogspot.co.uk/2012/06/confirmed-linkedin-6mil-password-dump.html |
|
831 \end{itemize}\medskip |
|
832 |
|
833 \small |
|
834 Web user maintains 25 separate accounts but uses just 6.5 passwords |
|
835 |
|
836 \end{frame}} |
|
837 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
838 |
|
839 %For instance, SHA512crypt, which is included in Mac OS X and most Unix-based operating systems, passes text through 5,000 iterations, a %hurdle that would have limited Gosney to slightly less than 2,600 guesses per second. The Bcrypt algorithm is even more computationally %expensive, in large part because it subjects text to multiple iterations of the Blowfish cipher that was deliberately modified to increase the %time required to generate a hash. PBKDF2, a function built into Microsoft's .Net software developer framework, offers similar benefits. |
|
840 |
|
841 |
|
842 % rainbow tables |
|
843 % http://en.wikipedia.org/wiki/Rainbow_table |
|
844 |
|
845 |
|
846 |
|
847 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
848 \mode<presentation>{ |
|
849 \begin{frame}[c] |
|
850 \frametitle{\begin{tabular}{c}Brute Forcing Passwords\end{tabular}} |
|
851 |
|
852 \begin{itemize} |
|
853 \item How fast can hackers crack SHA-1 passwords? \pause |
|
854 |
|
855 \item The answer is 2 billion attempts per second\\ |
|
856 using a Radeon HD 7970 |
|
857 \end{itemize} |
|
858 |
|
859 \begin{center} |
|
860 \begin{tabular}{@ {\hspace{-12mm}}rl} |
|
861 password length & time\smallskip\\\hline |
|
862 5 letters & 5 secs\\ |
|
863 6 letters & 500 secs\\ |
|
864 7 letters & 13 hours\\ |
|
865 8 letters & 57 days\\ |
|
866 9 letters & 15 years\\ |
|
867 \end{tabular} |
|
868 \end{center} |
|
869 |
|
870 \small |
|
871 5 letters $\approx$ 100$^5$ $=$ 10 billion combinations\\ |
|
872 (1 letter - upper case, lower case, digits, symbols $\approx$ 100) |
|
873 |
|
874 \only<2->{ |
|
875 \begin{textblock}{1}(12,5) |
|
876 \begin{tabular}{c} |
|
877 %\includegraphics[scale=0.3]{pics/radeon.jpg}\\[-6mm] |
|
878 \footnotesize graphics card\\[-1mm] |
|
879 \footnotesize ca.~\pounds{}300 |
|
880 \end{tabular} |
|
881 \end{textblock}} |
|
882 |
|
883 |
|
884 |
|
885 \end{frame}} |
|
886 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
887 |
|
888 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
889 \mode<presentation>{ |
|
890 \begin{frame}[c] |
|
891 \frametitle{\begin{tabular}{c}Passwords\end{tabular}} |
|
892 |
|
893 How to recover from a breakin?\pause\medskip |
|
894 |
|
895 \begin{itemize} |
|
896 \item Do not send passwords in plain text. |
|
897 \item Security questions are tricky to get right. |
|
898 \item QQ (Chinese Skype) authenticates you via contacts. |
|
899 \end{itemize} |
|
900 |
|
901 \end{frame}} |
|
902 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
903 |
|
904 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
905 \mode<presentation>{ |
|
906 \begin{frame}[c] |
|
907 \frametitle{\begin{tabular}{c}This Course\end{tabular}} |
|
908 |
|
909 \begin{itemize} |
|
910 \item break-ins (buffer overflows) |
|
911 \item access control\\ (role based, data security / data integrity) |
|
912 \item protocols\\ |
|
913 (specification) |
|
914 \item access control logic |
|
915 \item privacy |
|
916 \begin{quote} |
|
917 Scott McNealy: \\``You have zero privacy anyway. Get over it.'' |
|
918 \end{quote} |
|
919 \end{itemize} |
|
920 |
|
921 \end{frame}} |
|
922 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
923 |
|
924 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
925 \mode<presentation>{ |
|
926 \begin{frame}[c] |
|
927 \frametitle{\begin{tabular}{c}Books + Homework\end{tabular}} |
|
928 |
|
929 \begin{itemize} |
|
930 \item there is no single book I am following |
|
931 \begin{center} |
|
932 %\includegraphics[scale=0.012]{pics/andersonbook1.jpg} |
|
933 %\includegraphics[scale=0.23]{pics/accesscontrolbook.jpg} |
|
934 \end{center}\medskip\pause |
|
935 |
|
936 \item The question ``Is this relevant for the exams'' is not appreciated!\medskip\\ |
|
937 |
451 |
938 Whatever is in the homework sheets (and is not marked optional) is relevant for the |
452 Whatever is in the homework sheets (and is not marked optional) is relevant for the |
939 exam. No code needs to be written. |
453 exam.\\ No code needs to be written. |
940 \end{itemize} |
454 \end{itemize} |
941 |
455 |
942 \end{frame}} |
456 \end{frame}} |
943 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
457 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
944 |
458 |
945 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
946 \mode<presentation>{ |
|
947 \begin{frame}[c] |
|
948 \frametitle{\begin{tabular}{c}Take-Home Points\end{tabular}} |
|
949 |
|
950 \begin{itemize} |
|
951 \item Never store passwords in plain text.\medskip |
|
952 \item Always salt your hashes!\medskip |
|
953 \item Use an existing algorithm; do not write your own! |
|
954 \end{itemize} |
|
955 |
|
956 \end{frame}} |
|
957 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
958 |
|
959 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
960 \mode<presentation>{ |
|
961 \begin{frame}[c] |
|
962 \frametitle{\begin{tabular}{c}Thinking as a Defender\end{tabular}} |
|
963 |
|
964 \begin{itemize} |
|
965 \item What are you trying to protect? |
|
966 \item What properties are you trying to enforce?\medskip |
|
967 |
|
968 \item Who are the attackers? Capabilities? Motivations? |
|
969 \item What kind of attack are we trying to protect? |
|
970 \item Who can fix any vulnerabilities?\medskip |
|
971 |
|
972 \item What are the weaknesses of the system? |
|
973 \item What will successful attacks cost us? |
|
974 \item How likely are the attacks? |
|
975 \end{itemize} |
|
976 |
|
977 \small |
|
978 \textcolor{gray}{Security almost always is {\bf not} free!} |
|
979 |
|
980 \end{frame}} |
|
981 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
982 |
|
983 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
984 \mode<presentation>{ |
|
985 \begin{frame}[c] |
|
986 \frametitle{\begin{tabular}{c}The Security Mindset\end{tabular}} |
|
987 |
|
988 \begin{itemize} |
|
989 \item How things can go wrong. |
|
990 \item Think outside the box. |
|
991 \end{itemize}\bigskip |
|
992 |
|
993 The difference between being criminal is to only \alert{\bf think} about how things can go wrong. |
|
994 |
|
995 \end{frame}} |
|
996 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
997 |
459 |
998 |
460 |
999 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
461 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
1000 \mode<presentation>{ |
462 \mode<presentation>{ |
1001 \begin{frame}[t] |
463 \begin{frame}[t] |