\documentclass[dvipsnames,14pt,t, xelatex]{beamer}

\usepackage{beamerthemeplaincu}

\usepackage{fontenc,xltxtra,xunicode}

\defaultfontfeatures{Mapping=tex-text}

%%\usepackage[latin1]{inputenc}

\usepackage{mathpartir}

\usepackage[absolute,overlay]{textpos}

\usepackage{ifthen}

\usepackage{tikz}

\usepackage{pgf}

\usepackage{calc} 

\usepackage{ulem}

%%\usepackage{courier}

\usepackage{listings}

\renewcommand{\uline}[1]{#1}

\usetikzlibrary{arrows}

\usetikzlibrary{automata}

\usetikzlibrary{shapes}

\usetikzlibrary{shadows}

\usetikzlibrary{positioning}

\usetikzlibrary{calc}

\usepackage{upquote}

\usetikzlibrary{plotmarks}

\usepackage{graphicx} 

\usepackage{pgfplots}

\definecolor{javared}{rgb}{0.6,0,0} % for strings

\definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments

\definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords

\definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc

\makeatletter

\lst@CCPutMacro\lst@ProcessOther {"2D}{\lst@ttfamily{-{}}{-{}}}

\@empty\z@\@empty

\makeatother

\lstset{language=Java,

	basicstyle=\consolas,

	keywordstyle=\color{javapurple}\bfseries,

	stringstyle=\color{javagreen},

	commentstyle=\color{javagreen},

	morecomment=[s][\color{javadocblue}]{/**}{*/},

	numbers=left,

	numberstyle=\tiny\color{black},

	stepnumber=1,

	numbersep=10pt,

	tabsize=2,

	showspaces=false,

	showstringspaces=false}

\lstdefinelanguage{scala}{

  morekeywords={abstract,case,catch,class,def,%

    do,else,extends,false,final,finally,%

    for,if,implicit,import,match,mixin,%

    new,null,object,override,package,%

    private,protected,requires,return,sealed,%

    super,this,throw,trait,true,try,%

    type,val,var,while,with,yield},

  otherkeywords={=>,<-,<\%,<:,>:,\#,@,->},

  sensitive=true,

  morecomment=[l]{//},

  morecomment=[n]{/*}{*/},

  morestring=[b]",

  morestring=[b]',

  morestring=[b]"""

}

\lstset{language=Scala,

	basicstyle=\consolas,

	keywordstyle=\color{javapurple}\bfseries,

	stringstyle=\color{javagreen},

	commentstyle=\color{javagreen},

	morecomment=[s][\color{javadocblue}]{/**}{*/},

	numbers=left,

	numberstyle=\tiny\color{black},

	stepnumber=1,

	numbersep=10pt,

	tabsize=2,

	showspaces=false,

	showstringspaces=false}

% beamer stuff 

\renewcommand{\slidecaption}{APP 01, King's College London, 24.~September 2013}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}<1>[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \LARGE Access Control and \\[-3mm] 

  \LARGE Privacy Policies (1)\\[-6mm] 

  \end{tabular}}

  \begin{center}

  \includegraphics[scale=1.3]{pics/barrier.jpg}

  \end{center}

\normalsize

  \begin{center}

  \begin{tabular}{ll}  

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS

  \end{tabular}

  \end{center}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}

\begin{center}

\includegraphics[scale=2.1]{pics/barrier.jpg}

\end{center}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}

\onslide<-1>{

\begin{center}

\includegraphics[scale=0.1]{pics/snowden.jpg}

\small{}

\end{center}}

\only<1->{

\begin{textblock}{1}(4.5,7.5)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {\includegraphics[scale=0.1]{pics/rman.png}};

  \draw[white] (4,0) node (Y) {\includegraphics[scale=0.1]{pics/gman.png}};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \draw[white] (1.3, -1) node (NSA) {\includegraphics[scale=0.05]{pics/nsa.png}};

  \draw[white] (2.7, -1) node (GCHQ) {\includegraphics[scale=0.3]{pics/gchq.jpg}};

  \draw[black] (2, -2) node (OTHER) {\huge\ldots};

  \end{tikzpicture}

\end{textblock}}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}

\begin{center}

\includegraphics[scale=0.45]{pics/lavabit-email.jpg}

\end{center}

\small{}\mbox{}\hfill{}

Lavabit email service closed down on 8 August 2013. \\

\mbox{}\hfill{}\textcolor{blue}{\url{goo.gl/bgSrVp}}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}

\frametitle{\begin{tabular}{@ {}c@ {}}Also Bad Guys\end{tabular}}

\only<1->{

\begin{textblock}{1}(4,2.5)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {\includegraphics[scale=0.1]{pics/rman.png}};

  \draw[white] (4,0) node (Y) {\includegraphics[scale=0.1]{pics/gman.png}};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<1->{

\begin{textblock}{1}(1,6)

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\normalsize\color{darkgray}

\begin{minipage}{11cm}\raggedright\footnotesize

Annonymous Hacker operating a 10k bonnet using the ZeuS hacking tool wrote:\medskip\\

``FYI I do not cash out the bank accounts or credit cards, I just sell the information 

(I know, its just as bad, hur dur...), there isn't even a law against such in most countries, 

dealing with stolen information is most of the time a legaly greyzone (I was just as surprised 

when I looked it up), I'm not talking about 3rd world countries, but about European like Spain 

(The Mariposa botnet owner never got charged, because a botnet isn't illegal, only abusing 

CC information is, but that did other guys).''\\

\hfill{}\textcolor{blue}{\url{goo.gl/UWluh0}}

\end{minipage}};

\end{tikzpicture}

\end{textblock}}

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}

\frametitle{\begin{tabular}{@ {}c@ {}}This is a Misconception!\end{tabular}}

\begin{center}

\includegraphics[scale=0.6]{pics/cryptographic-small.png}

\end{center}

The NSA can probably not brute-force magically better than the ``public''.

\end{frame}}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{@ {}c@ {}}Security Engineers\end{tabular}}

\small\alert{\bf Security engineers} require a particular \alert{\bf mindset}:\bigskip

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\normalsize\color{darkgray}

\begin{minipage}{10cm}\raggedright\small

``Security engineers --- at least the good ones --- see the world differently. 

They can't walk into a store without noticing how they might shoplift. They can't 

use a computer without wondering about the security vulnerabilities. They can't 

vote without trying to figure out how to vote twice. They just can't help it.''\\

\hfill{}---Bruce Schneier

\end{minipage}};

\end{tikzpicture}

\begin{flushright}

\includegraphics[scale=0.0087]{pics/schneierbook1.jpg}\;

\includegraphics[scale=0.0087]{pics/schneierbook2.jpg}\;

\includegraphics[scale=0.23]{pics/schneierbook3.jpg}\;

\includegraphics[scale=0.85]{pics/schneier.png}

\end{flushright}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{@ {}c@ {}}Breaking Things\end{tabular}}

For example:

\begin{center}

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\normalsize\color{darkgray}

\begin{minipage}{10cm}\raggedright\small

Prof.~V.~Nasty gives the following final exam question (closed books, closed notes):\bigskip

\noindent

\begin{tabular}{@ {}l}

Write the first 100 digits of $\pi$:\\

3.\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_

\end{tabular}

\end{minipage}};

\end{tikzpicture}

\end{center}

How can you cheat in this exam and how can you defend against such cheating?

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{@ {}c@ {}}Chip-and-PIN\end{tabular}}

\begin{center}

\includegraphics[scale=0.3]{pics/creditcard1.jpg}\;

\includegraphics[scale=0.3]{pics/creditcard2.jpg}

\end{center}

\begin{itemize}

\item Chip-and-PIN was introduced in the UK in 2004

\item before that customers had to sign a receipt\medskip

\item Is Chip-and-PIN a more secure system?

\end{itemize}

\begin{flushright}

\small\textcolor{gray}{(Some other countries still use the old method.)}

\end{flushright}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{@ {}c@ {}}Yes \ldots\end{tabular}}

\begin{tikzpicture}

\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

{\normalsize\color{darkgray}

\begin{minipage}{10cm}\raggedright\small

``Chip-and-PIN is so effective in this country [UK] that fraudsters are starting to move their activities overseas,'' 

said Emile Abu-Shakra, spokesman for Lloyds TSB (in the Guardian, 2006).

\end{minipage}};

\end{tikzpicture}\bigskip

\begin{itemize}

\item mag-stripe cards cannot be cloned anymore

\item stolen or cloned cards need to be used abroad 

\item fraud on lost, stolen and counterfeit credit cards was down \pounds{}60m (24\%) on 2004's figure

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{c}But let's see \ldots\end{tabular}}

\begin{textblock}{1}(3,4)

\begin{tabular}{c}

\includegraphics[scale=0.3]{pics/bank.png}\\[-2mm]

\small Bank

\end{tabular}

\end{textblock}

\begin{textblock}{1}(7,4.5)

\begin{tabular}{c}

\includegraphics[scale=3]{pics/store.png}\\[-2mm]

\end{tabular}

\end{textblock}

\begin{textblock}{1}(4.5,9.9)

\begin{tabular}{c}

\includegraphics[scale=0.16]{pics/rman.png}\\[-1mm]

\small costumer / you

\end{tabular}

\end{textblock}  

\only<2->{

\begin{textblock}{1}(4.5,7.5)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (1,-1) node (Y) {};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<3->{

\begin{textblock}{1}(6.8,7.5)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (1,1) node (Y) {};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}

\begin{textblock}{1}(4.8,5.9)

  \begin{tikzpicture}[scale=1.3]

  \draw[white] (0,0) node (X) {};

  \draw[white] (1.4,0) node (Y) {};

  \draw[red, <->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}

\only<4->{  

\begin{textblock}{1}(12,6.5)

\begin{tabular}{c}

\includegraphics[scale=0.8]{pics/factory.png}\\[-1mm]

\small card\\[-2mm]\small terminal\\[-2mm] \small producer

\end{tabular}

\end{textblock}

\begin{textblock}{1}(10,7)

  \begin{tikzpicture}[scale=1.6]

  \draw[white] (0,0) node (X) {};

  \draw[white] (-1,0.6) node (Y) {};

  \draw[red, ->, line width = 2mm] (X) -- (Y);

  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};

  \end{tikzpicture}

\end{textblock}}  

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}}

\begin{itemize}

\item A ``tamperesitant'' terminal playing Tetris on 

\textcolor{blue}{\href{http://www.youtube.com/watch?v=wWTzkD9M0sU}{youtube}}.\\

\textcolor{lightgray}{\footnotesize(\url{http://www.youtube.com/watch?v=wWTzkD9M0sU})}

\end{itemize}

\includegraphics[scale=0.2]{pics/tetris.jpg}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}}

\begin{itemize}

\item in 2006, Shell petrol stations stopped accepting Chip-and-PIN after \pounds{}1m had been stolen from customer accounts\smallskip 

\item in 2008, hundreds of card readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been 

expertly tampered with shortly after manufacture so that details and PINs of credit cards were sent during the 9 months 

before over mobile phone networks to criminals in Lahore, Pakistan

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{c}Chip-and-PIN is Broken\end{tabular}}

\begin{flushright}

\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\;

\includegraphics[scale=1.5]{pics/anderson.jpg}

\end{flushright}

\begin{itemize}

\item man-in-the-middle attacks by the group around Ross Anderson\medskip

\end{itemize}

\begin{center}

\mbox{}\hspace{-20mm}\includegraphics[scale=0.5]{pics/chip-attack.png}

\end{center}

\begin{textblock}{1}(11.5,13.7)

\begin{tabular}{l}

\footnotesize on BBC Newsnight\\[-2mm] 

\footnotesize in 2010 or \textcolor{blue}{\href{http://www.youtube.com/watch?v=JPAX32lgkrw}{youtube}}

\end{tabular}

\end{textblock}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\Large\begin{tabular}{@ {}c@ {}}Chip-and-PIN is Really Broken\end{tabular}}

\begin{flushright}

\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\;

\includegraphics[scale=1.5]{pics/anderson.jpg}

\end{flushright}

\begin{itemize}

\item same group successfully attacked in 2012 card readers and ATM machines

\item the problem: several types of ATMs generate poor random numbers, which are used as nonces

\end{itemize}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[c]

\frametitle{\begin{tabular}{c}The Real Problem \ldots\end{tabular}}

\begin{textblock}{1}(3,4)