|
0
|
1 |
\documentclass[dvipsnames,14pt,t]{beamer}
|
|
|
2 |
\usepackage{beamerthemeplainculight}
|
|
|
3 |
\usepackage[T1]{fontenc}
|
|
|
4 |
\usepackage[latin1]{inputenc}
|
|
|
5 |
\usepackage{mathpartir}
|
|
|
6 |
\usepackage[absolute,overlay]{textpos}
|
|
|
7 |
\usepackage{ifthen}
|
|
|
8 |
\usepackage{tikz}
|
|
|
9 |
\usepackage{pgf}
|
|
|
10 |
\usepackage{calc}
|
|
|
11 |
\usepackage{ulem}
|
|
|
12 |
\usepackage{courier}
|
|
|
13 |
\usepackage{listings}
|
|
|
14 |
\renewcommand{\uline}[1]{#1}
|
|
|
15 |
\usetikzlibrary{arrows}
|
|
|
16 |
\usetikzlibrary{automata}
|
|
|
17 |
\usetikzlibrary{shapes}
|
|
|
18 |
\usetikzlibrary{shadows}
|
|
|
19 |
\usetikzlibrary{positioning}
|
|
|
20 |
\usetikzlibrary{calc}
|
|
|
21 |
\usepackage{graphicx}
|
|
|
22 |
|
|
|
23 |
\definecolor{javared}{rgb}{0.6,0,0} % for strings
|
|
|
24 |
\definecolor{javagreen}{rgb}{0.25,0.5,0.35} % comments
|
|
|
25 |
\definecolor{javapurple}{rgb}{0.5,0,0.35} % keywords
|
|
|
26 |
\definecolor{javadocblue}{rgb}{0.25,0.35,0.75} % javadoc
|
|
|
27 |
|
|
|
28 |
\lstset{language=Java,
|
|
|
29 |
basicstyle=\ttfamily,
|
|
|
30 |
keywordstyle=\color{javapurple}\bfseries,
|
|
|
31 |
stringstyle=\color{javagreen},
|
|
|
32 |
commentstyle=\color{javagreen},
|
|
|
33 |
morecomment=[s][\color{javadocblue}]{/**}{*/},
|
|
|
34 |
numbers=left,
|
|
|
35 |
numberstyle=\tiny\color{black},
|
|
|
36 |
stepnumber=1,
|
|
|
37 |
numbersep=10pt,
|
|
|
38 |
tabsize=2,
|
|
|
39 |
showspaces=false,
|
|
|
40 |
showstringspaces=false}
|
|
|
41 |
|
|
|
42 |
\lstdefinelanguage{scala}{
|
|
|
43 |
morekeywords={abstract,case,catch,class,def,%
|
|
|
44 |
do,else,extends,false,final,finally,%
|
|
|
45 |
for,if,implicit,import,match,mixin,%
|
|
|
46 |
new,null,object,override,package,%
|
|
|
47 |
private,protected,requires,return,sealed,%
|
|
|
48 |
super,this,throw,trait,true,try,%
|
|
|
49 |
type,val,var,while,with,yield},
|
|
|
50 |
otherkeywords={=>,<-,<\%,<:,>:,\#,@},
|
|
|
51 |
sensitive=true,
|
|
|
52 |
morecomment=[l]{//},
|
|
|
53 |
morecomment=[n]{/*}{*/},
|
|
|
54 |
morestring=[b]",
|
|
|
55 |
morestring=[b]',
|
|
|
56 |
morestring=[b]"""
|
|
|
57 |
}
|
|
|
58 |
|
|
|
59 |
\lstset{language=Scala,
|
|
|
60 |
basicstyle=\ttfamily,
|
|
|
61 |
keywordstyle=\color{javapurple}\bfseries,
|
|
|
62 |
stringstyle=\color{javagreen},
|
|
|
63 |
commentstyle=\color{javagreen},
|
|
|
64 |
morecomment=[s][\color{javadocblue}]{/**}{*/},
|
|
|
65 |
numbers=left,
|
|
|
66 |
numberstyle=\tiny\color{black},
|
|
|
67 |
stepnumber=1,
|
|
|
68 |
numbersep=10pt,
|
|
|
69 |
tabsize=2,
|
|
|
70 |
showspaces=false,
|
|
|
71 |
showstringspaces=false}
|
|
|
72 |
|
|
|
73 |
% beamer stuff
|
|
1
|
74 |
\renewcommand{\slidecaption}{APP 01, King's College London, 25.~September 2012}
|
|
0
|
75 |
|
|
|
76 |
|
|
|
77 |
\begin{document}
|
|
|
78 |
|
|
|
79 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
80 |
\mode<presentation>{
|
|
|
81 |
\begin{frame}<1>[t]
|
|
|
82 |
\frametitle{%
|
|
1
|
83 |
\begin{tabular}{@ {}c@ {}}
|
|
|
84 |
\LARGE Access Control and \\[-3mm]
|
|
|
85 |
\LARGE Privacy Policies (1)\\[-6mm]
|
|
|
86 |
\end{tabular}}
|
|
|
87 |
|
|
|
88 |
\begin{center}
|
|
|
89 |
\includegraphics[scale=1.3]{pics/barrier.jpg}
|
|
|
90 |
\end{center}
|
|
|
91 |
|
|
|
92 |
\normalsize
|
|
|
93 |
\begin{center}
|
|
|
94 |
\begin{tabular}{ll}
|
|
|
95 |
Email: & christian.urban at kcl.ac.uk\\
|
|
|
96 |
Office: & S1.27 (1st floor Strand Building)\\
|
|
|
97 |
Slides: & KEATS
|
|
|
98 |
\end{tabular}
|
|
|
99 |
\end{center}
|
|
|
100 |
|
|
|
101 |
|
|
0
|
102 |
\end{frame}}
|
|
|
103 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
104 |
|
|
1
|
105 |
|
|
|
106 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
107 |
\mode<presentation>{
|
|
|
108 |
\begin{frame}[c]
|
|
|
109 |
\frametitle{\begin{tabular}{@ {}c@ {}}Security Engineers\end{tabular}}
|
|
|
110 |
|
|
|
111 |
According to Bruce Schneier, {\bf security engineers} require
|
|
|
112 |
a particular {\bf mindset}:\bigskip
|
|
|
113 |
|
|
|
114 |
\begin{tikzpicture}
|
|
|
115 |
\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
|
|
|
116 |
{\normalsize\color{darkgray}
|
|
|
117 |
\begin{minipage}{10cm}\raggedright\small
|
|
|
118 |
``Security engineers --- at least the good ones --- see the world dif$\!$ferently.
|
|
|
119 |
They can't walk into a store without noticing how they might shoplift. They can't
|
|
|
120 |
use a computer without wondering about the security vulnerabilities. They can't
|
|
|
121 |
vote without trying to figure out how to vote twice. They just can't help it.''
|
|
|
122 |
\end{minipage}};
|
|
|
123 |
\end{tikzpicture}
|
|
|
124 |
|
|
|
125 |
\begin{flushright}
|
|
|
126 |
\includegraphics[scale=0.0087]{pics/schneierbook1.jpg}\;
|
|
|
127 |
\includegraphics[scale=0.0087]{pics/schneierbook2.jpg}\;
|
|
|
128 |
\includegraphics[scale=0.85]{pics/schneier.png}
|
|
|
129 |
\end{flushright}
|
|
|
130 |
|
|
|
131 |
|
|
|
132 |
\end{frame}}
|
|
|
133 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
134 |
|
|
4
|
135 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
136 |
\mode<presentation>{
|
|
|
137 |
\begin{frame}[c]
|
|
|
138 |
\frametitle{\begin{tabular}{@ {}c@ {}}Chip-and-PIN\end{tabular}}
|
|
|
139 |
|
|
|
140 |
\begin{center}
|
|
|
141 |
\includegraphics[scale=0.3]{pics/creditcard1.jpg}\;
|
|
|
142 |
\includegraphics[scale=0.3]{pics/creditcard2.jpg}
|
|
|
143 |
\end{center}
|
|
|
144 |
|
|
|
145 |
\begin{itemize}
|
|
|
146 |
\item Chip-and-PIN was introduced in the UK in 2004
|
|
|
147 |
\item before that customers had to sign a receipt\medskip
|
|
5
|
148 |
\item Is Chip-and-PIN a more secure system? What do you think?
|
|
4
|
149 |
\end{itemize}
|
|
|
150 |
|
|
|
151 |
\begin{flushright}
|
|
|
152 |
\small\textcolor{gray}{(Some other countries still use the old method.)}
|
|
|
153 |
\end{flushright}
|
|
|
154 |
|
|
|
155 |
|
|
|
156 |
\end{frame}}
|
|
|
157 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
158 |
|
|
1
|
159 |
|
|
0
|
160 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
161 |
\mode<presentation>{
|
|
|
162 |
\begin{frame}[c]
|
|
1
|
163 |
\frametitle{\begin{tabular}{@ {}c@ {}}Yes\ldots\end{tabular}}
|
|
|
164 |
|
|
|
165 |
\begin{tikzpicture}
|
|
|
166 |
\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
|
|
|
167 |
{\normalsize\color{darkgray}
|
|
|
168 |
\begin{minipage}{10cm}\raggedright\small
|
|
5
|
169 |
``Chip-and-PIN is so effective in this country that fraudsters are starting to move their activities overseas,''
|
|
|
170 |
said Emile Abu-Shakra, spokesman for Lloyds TSB (in the Guardian, 2006).
|
|
1
|
171 |
\end{minipage}};
|
|
|
172 |
\end{tikzpicture}\bigskip
|
|
|
173 |
|
|
0
|
174 |
|
|
1
|
175 |
\begin{itemize}
|
|
|
176 |
\item mag-stripe cards cannot be cloned anymore
|
|
|
177 |
\item stolen or cloned cards need to be used abroad
|
|
|
178 |
\item fraud on lost, stolen and counterfeit credit cards was down \pounds{}60m (24\%) on 2004's figure
|
|
|
179 |
\end{itemize}
|
|
|
180 |
|
|
|
181 |
|
|
|
182 |
\end{frame}}
|
|
|
183 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
184 |
|
|
|
185 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
186 |
\mode<presentation>{
|
|
|
187 |
\begin{frame}[c]
|
|
5
|
188 |
\frametitle{\begin{tabular}{c}Let's see\ldots\end{tabular}}
|
|
1
|
189 |
|
|
|
190 |
|
|
|
191 |
\begin{textblock}{1}(3,4)
|
|
|
192 |
\begin{tabular}{c}
|
|
|
193 |
\includegraphics[scale=0.3]{pics/bank.png}\\[-2mm]
|
|
|
194 |
\small Bank
|
|
0
|
195 |
\end{tabular}
|
|
|
196 |
\end{textblock}
|
|
1
|
197 |
|
|
|
198 |
\begin{textblock}{1}(7,4.5)
|
|
|
199 |
\begin{tabular}{c}
|
|
|
200 |
\includegraphics[scale=3]{pics/store.png}\\[-2mm]
|
|
|
201 |
\end{tabular}
|
|
|
202 |
\end{textblock}
|
|
|
203 |
|
|
0
|
204 |
\only<2->{
|
|
1
|
205 |
\begin{textblock}{1}(12,6.5)
|
|
|
206 |
\begin{tabular}{c}
|
|
|
207 |
\includegraphics[scale=0.8]{pics/factory.png}\\[-1mm]
|
|
|
208 |
\small terminal\\[-2mm] \small producer
|
|
0
|
209 |
\end{tabular}
|
|
|
210 |
\end{textblock}}
|
|
|
211 |
|
|
1
|
212 |
\begin{textblock}{1}(4.5,9.9)
|
|
|
213 |
\begin{tabular}{c}
|
|
|
214 |
\includegraphics[scale=0.16]{pics/rman.png}\\[-1mm]
|
|
|
215 |
\small costumer / you
|
|
|
216 |
\end{tabular}
|
|
|
217 |
\end{textblock}
|
|
0
|
218 |
|
|
|
219 |
\end{frame}}
|
|
|
220 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
221 |
|
|
|
222 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
223 |
\mode<presentation>{
|
|
|
224 |
\begin{frame}[c]
|
|
1
|
225 |
\frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}}
|
|
0
|
226 |
|
|
|
227 |
|
|
1
|
228 |
\begin{itemize}
|
|
5
|
229 |
\item A ``tamperesitant'' terminal playing Tetris on
|
|
|
230 |
\textcolor{blue}{\href{http://www.youtube.com/watch?v=wWTzkD9M0sU}{youtube}}.\\
|
|
1
|
231 |
\textcolor{lightgray}{\footnotesize(\url{http://www.youtube.com/watch?v=wWTzkD9M0sU})}
|
|
|
232 |
\end{itemize}
|
|
|
233 |
|
|
|
234 |
|
|
|
235 |
\includegraphics[scale=0.2]{pics/tetris.jpg}
|
|
|
236 |
|
|
|
237 |
|
|
0
|
238 |
\end{frame}}
|
|
1
|
239 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
0
|
240 |
|
|
|
241 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
242 |
\mode<presentation>{
|
|
|
243 |
\begin{frame}[c]
|
|
1
|
244 |
\frametitle{\begin{tabular}{c}Chip-and-PIN\end{tabular}}
|
|
|
245 |
|
|
0
|
246 |
|
|
|
247 |
\begin{itemize}
|
|
5
|
248 |
\item in 2006, Shell petrol stations stopped accepting Chip-and-PIN after \pounds{}1m had been stolen from customer accounts\smallskip
|
|
1
|
249 |
\item in 2008, hundreds of card readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been
|
|
|
250 |
expertly tampered with shortly after manufacture so that details and PINs of credit cards were sent during the 9 months
|
|
|
251 |
before over mobile phone networks to criminals in Lahore, Pakistan
|
|
0
|
252 |
\end{itemize}
|
|
|
253 |
|
|
|
254 |
\end{frame}}
|
|
|
255 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
256 |
|
|
|
257 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
258 |
\mode<presentation>{
|
|
|
259 |
\begin{frame}[c]
|
|
1
|
260 |
\frametitle{\begin{tabular}{c}Chip-and-PIN is Broken\end{tabular}}
|
|
0
|
261 |
|
|
1
|
262 |
\begin{flushright}
|
|
|
263 |
\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\;
|
|
|
264 |
\includegraphics[scale=1.5]{pics/anderson.jpg}
|
|
|
265 |
\end{flushright}
|
|
0
|
266 |
|
|
|
267 |
\begin{itemize}
|
|
5
|
268 |
\item man-in-the-middle attacks by the group around Ross Anderson\medskip
|
|
0
|
269 |
\end{itemize}
|
|
|
270 |
|
|
1
|
271 |
\begin{center}
|
|
5
|
272 |
\mbox{}\hspace{-20mm}\includegraphics[scale=0.5]{pics/chip-attack.png}
|
|
1
|
273 |
\end{center}
|
|
5
|
274 |
|
|
|
275 |
|
|
|
276 |
\begin{textblock}{1}(11.5,13.7)
|
|
|
277 |
\begin{tabular}{l}
|
|
|
278 |
\footnotesize on BBC Newsnight\\[-2mm]
|
|
|
279 |
\footnotesize in 2010 or \textcolor{blue}{\href{http://www.youtube.com/watch?v=JPAX32lgkrw}{youtube}}
|
|
|
280 |
\end{tabular}
|
|
|
281 |
\end{textblock}
|
|
0
|
282 |
|
|
|
283 |
\end{frame}}
|
|
|
284 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
285 |
|
|
|
286 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
287 |
\mode<presentation>{
|
|
|
288 |
\begin{frame}[c]
|
|
1
|
289 |
\frametitle{\begin{tabular}{@ {}c@ {}}Chip-and-PIN is Really Broken\end{tabular}}
|
|
0
|
290 |
|
|
1
|
291 |
\begin{flushright}
|
|
|
292 |
\includegraphics[scale=0.01]{pics/andersonbook1.jpg}\;
|
|
|
293 |
\includegraphics[scale=1.5]{pics/anderson.jpg}
|
|
|
294 |
\end{flushright}
|
|
0
|
295 |
|
|
|
296 |
\begin{itemize}
|
|
5
|
297 |
\item same group successfully attacked this year card readers and ATM machines
|
|
1
|
298 |
\item the problem: several types of ATMs generate poor random numbers, which are used as nonces
|
|
0
|
299 |
\end{itemize}
|
|
1
|
300 |
|
|
0
|
301 |
\end{frame}}
|
|
|
302 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
303 |
|
|
|
304 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
305 |
\mode<presentation>{
|
|
|
306 |
\begin{frame}[c]
|
|
1
|
307 |
\frametitle{\begin{tabular}{c}The Problem\ldots\end{tabular}}
|
|
0
|
308 |
|
|
|
309 |
|
|
1
|
310 |
\begin{textblock}{1}(3,4)
|
|
|
311 |
\begin{tabular}{c}
|
|
|
312 |
\includegraphics[scale=0.3]{pics/bank.png}\\[-2mm]
|
|
|
313 |
\small Bank
|
|
|
314 |
\end{tabular}
|
|
|
315 |
\end{textblock}
|
|
|
316 |
|
|
|
317 |
\begin{textblock}{1}(7,4.5)
|
|
|
318 |
\begin{tabular}{c}
|
|
|
319 |
\includegraphics[scale=3]{pics/store.png}\\[-2mm]
|
|
|
320 |
\end{tabular}
|
|
|
321 |
\end{textblock}
|
|
0
|
322 |
|
|
1
|
323 |
\begin{textblock}{1}(12,6.5)
|
|
|
324 |
\begin{tabular}{c}
|
|
|
325 |
\includegraphics[scale=0.8]{pics/factory.png}\\[-1mm]
|
|
|
326 |
\small terminal\\[-2mm] \small producer
|
|
|
327 |
\end{tabular}
|
|
0
|
328 |
\end{textblock}
|
|
1
|
329 |
|
|
|
330 |
\begin{textblock}{1}(4.5,9.9)
|
|
|
331 |
\begin{tabular}{c}
|
|
|
332 |
\includegraphics[scale=0.13]{pics/rman.png}\\[-1mm]
|
|
|
333 |
\small costumer / you
|
|
|
334 |
\end{tabular}
|
|
|
335 |
\end{textblock}
|
|
0
|
336 |
|
|
1
|
337 |
\begin{textblock}{14}(1,13.5)
|
|
|
338 |
\begin{itemize}
|
|
5
|
339 |
\item the burden of proof for fraud and financial liability was shifted to the costumer
|
|
1
|
340 |
\end {itemize}
|
|
0
|
341 |
\end{textblock}
|
|
|
342 |
|
|
|
343 |
\end{frame}}
|
|
|
344 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
345 |
|
|
|
346 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
347 |
\mode<presentation>{
|
|
|
348 |
\begin{frame}[c]
|
|
1
|
349 |
\frametitle{\begin{tabular}{c}Screwed Again\end{tabular}}
|
|
0
|
350 |
|
|
|
351 |
|
|
1
|
352 |
\begin{flushright}
|
|
|
353 |
\includegraphics[scale=0.3]{pics/rbssecure.jpg}
|
|
|
354 |
\end{flushright}
|
|
|
355 |
|
|
0
|
356 |
\begin{itemize}
|
|
1
|
357 |
\item {\bf Responsibility}\\
|
|
|
358 |
``You understand that you are financially responsible for all uses of RBS Secure.''\\
|
|
|
359 |
\textcolor{lightgray}{\footnotesize\url{https://www.rbssecure.co.uk/rbs/tdsecure/terms_of_use.jsp}}
|
|
0
|
360 |
\end{itemize}
|
|
|
361 |
|
|
|
362 |
\end{frame}}
|
|
|
363 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
364 |
|
|
2
|
365 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
366 |
\mode<presentation>{
|
|
|
367 |
\begin{frame}[c]
|
|
3
|
368 |
\frametitle{\begin{tabular}{c}Web Applications\end{tabular}}
|
|
2
|
369 |
|
|
|
370 |
|
|
|
371 |
\begin{textblock}{1}(2,5)
|
|
|
372 |
\begin{tabular}{c}
|
|
|
373 |
\includegraphics[scale=0.15]{pics/servers.png}\\[-2mm]
|
|
|
374 |
\small Servers from\\[-2mm]
|
|
|
375 |
\small Dot.com Inc.
|
|
|
376 |
\end{tabular}
|
|
|
377 |
\end{textblock}
|
|
|
378 |
|
|
6
|
379 |
\begin{textblock}{1}(5.6,6)
|
|
|
380 |
\begin{tikzpicture}[scale=2.5]
|
|
|
381 |
\draw[white] (0,0) node (X) {};
|
|
|
382 |
\draw[white] (1,0) node (Y) {};
|
|
|
383 |
\only<1>{\draw[red, <-, line width = 2mm] (X) -- (Y);
|
|
|
384 |
\node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {};}
|
|
|
385 |
\only<2>{\draw[red, ->, line width = 2mm] (X) -- (Y);
|
|
|
386 |
\node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X)!.5!(Y) $) {};}
|
|
|
387 |
\only<3>{\draw[red, <-, line width = 2mm] (X) -- (Y);
|
|
|
388 |
\node [inner sep=7pt,label=above:\textcolor{black}{POST data}] at ($ (X)!.5!(Y) $) {};}
|
|
|
389 |
\end{tikzpicture}
|
|
|
390 |
\end{textblock}
|
|
|
391 |
|
|
|
392 |
|
|
2
|
393 |
\begin{textblock}{1}(9,5.5)
|
|
|
394 |
\begin{tabular}{c}
|
|
|
395 |
\includegraphics[scale=0.15]{pics/laptop.png}\\[-2mm]
|
|
|
396 |
\small Client
|
|
|
397 |
\end{tabular}
|
|
|
398 |
\end{textblock}
|
|
|
399 |
|
|
|
400 |
\begin{textblock}{13}(1,13)
|
|
|
401 |
\begin{itemize}
|
|
|
402 |
\item What are pitfalls and best practices?
|
|
|
403 |
\end{itemize}
|
|
|
404 |
\end{textblock}
|
|
|
405 |
|
|
|
406 |
\end{frame}}
|
|
|
407 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
408 |
|
|
5
|
409 |
|
|
|
410 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
411 |
\mode<presentation>{
|
|
|
412 |
\begin{frame}[c]
|
|
|
413 |
\frametitle{\begin{tabular}{c}Scala + Play\end{tabular}}
|
|
|
414 |
|
|
6
|
415 |
\footnotesize simple response from the server:
|
|
|
416 |
|
|
5
|
417 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
|
418 |
\texttt{\lstinputlisting{app0.scala}}}\bigskip
|
|
|
419 |
|
|
|
420 |
\footnotesize
|
|
|
421 |
alternative response:\\
|
|
|
422 |
|
|
|
423 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
6
|
424 |
\texttt{\lstinline{Ok("<H1>Hello world!</H1>").as(HTML)}}}
|
|
5
|
425 |
\end{frame}}
|
|
|
426 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
427 |
|
|
|
428 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
429 |
\mode<presentation>{
|
|
|
430 |
\begin{frame}[c]
|
|
|
431 |
|
|
|
432 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
|
433 |
\texttt{\lstinputlisting{app1.scala}}}
|
|
|
434 |
|
|
|
435 |
|
|
|
436 |
\end{frame}}
|
|
|
437 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
438 |
|
|
6
|
439 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
440 |
\mode<presentation>{
|
|
|
441 |
\begin{frame}[c]
|
|
|
442 |
\frametitle{\begin{tabular}{c}Cookies\end{tabular}}
|
|
|
443 |
|
|
|
444 |
|
|
|
445 |
\begin{textblock}{1}(1.5,5)
|
|
|
446 |
\begin{tabular}{c}
|
|
|
447 |
\includegraphics[scale=0.15]{pics/servers.png}\\[-2mm]
|
|
|
448 |
\small Servers from\\[-2mm]
|
|
|
449 |
\small Dot.com Inc.
|
|
|
450 |
\end{tabular}
|
|
|
451 |
\end{textblock}
|
|
|
452 |
|
|
|
453 |
\begin{textblock}{1}(5.6,5.6)
|
|
|
454 |
\begin{tikzpicture}[scale=2.5]
|
|
|
455 |
\draw[white] (0,0) node (X) {};
|
|
|
456 |
\draw[white] (1,0) node (Y) {};
|
|
|
457 |
\draw[white] (0.05,-0.3) node (X1) {};
|
|
|
458 |
\draw[white] (0.95,-0.3) node (Y1) {};
|
|
|
459 |
\only<1-2>{\draw[red, <-, line width = 2mm] (X) -- (Y);
|
|
|
460 |
\node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {};}
|
|
|
461 |
\only<2>{\draw[red, <-, line width = 1mm] (X1) -- (Y1);
|
|
|
462 |
\node [inner sep=2pt,label=below:\textcolor{black}{read a cookie}] at ($ (X1)!.5!(Y1) $) {};}
|
|
|
463 |
\only<3->{\draw[red, ->, line width = 2mm] (X) -- (Y);
|
|
|
464 |
\node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X)!.5!(Y) $) {};}
|
|
|
465 |
\only<3->{\draw[red, ->, line width = 1mm] (X1) -- (Y1);
|
|
|
466 |
\node [inner sep=2pt,label=below:\textcolor{black}{write a cookie}] at ($ (X1)!.5!(Y1) $) {};}
|
|
|
467 |
\end{tikzpicture}
|
|
|
468 |
\end{textblock}
|
|
|
469 |
|
|
|
470 |
|
|
|
471 |
\begin{textblock}{1}(9.5,5.5)
|
|
|
472 |
\begin{tabular}{c}
|
|
|
473 |
\includegraphics[scale=0.15]{pics/laptop.png}\\[-2mm]
|
|
|
474 |
\small Client
|
|
|
475 |
\end{tabular}
|
|
|
476 |
\end{textblock}
|
|
|
477 |
|
|
|
478 |
\only<4->{
|
|
|
479 |
\begin{textblock}{13}(1,11)
|
|
|
480 |
\small\begin{itemize}
|
|
|
481 |
\item cookies: max 4KB data\\[-2mm]
|
|
|
482 |
\item cookie theft, cross-site scripting attacks\\[-2mm]
|
|
|
483 |
\item session cookies, persistent cookies, HttpOnly cookies, third-party cookies, zombie cookies
|
|
|
484 |
\end{itemize}
|
|
|
485 |
\end{textblock}}
|
|
|
486 |
|
|
|
487 |
\only<5>{
|
|
|
488 |
\begin{textblock}{11}(1,3)
|
|
|
489 |
\begin{tikzpicture}
|
|
|
490 |
\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm]
|
|
|
491 |
{\normalsize\color{darkgray}
|
|
|
492 |
\begin{minipage}{10cm}\raggedright\small
|
|
|
493 |
{\bf EU Privacy Directive about Cookies:}\smallskip\\
|
|
|
494 |
``In May 2011, a European Union law was passed stating that websites that leave non-essential cookies on visitors' devices have to alert the visitor and get acceptance from them. This law applies to both individuals and businesses based in the EU regardless of the nationality of their website's visitors or the location of their web host. It is not enough to simply update a website's terms and conditions or privacy policy. The deadline to comply with the new EU cookie law was 26th May 2012 and failure to do so could mean a fine of up to \pounds{}500,000.''
|
|
|
495 |
\end{minipage}};
|
|
|
496 |
\end{tikzpicture}
|
|
|
497 |
\end{textblock}}
|
|
|
498 |
|
|
|
499 |
\end{frame}}
|
|
|
500 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
501 |
|
|
|
502 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
503 |
\mode<presentation>{
|
|
|
504 |
\begin{frame}[c]
|
|
|
505 |
\frametitle{\begin{tabular}{c}My First Webapp\end{tabular}}
|
|
|
506 |
|
|
|
507 |
{\bf GET request:}\smallskip
|
|
|
508 |
\begin{enumerate}
|
|
|
509 |
\item read cookie from client
|
|
|
510 |
\item if none is present, set \texttt{visits} to \textcolor{blue}{$0$}
|
|
|
511 |
\item if cookie is present, extract \texttt{visits}
|
|
|
512 |
\item if \texttt{visits} is greater or equal \textcolor{blue}{$10$}, \\
|
|
|
513 |
print valued customer message\\
|
|
|
514 |
otherwise just normal message
|
|
|
515 |
\item increase \texttt{visits} by \textcolor{blue}{$1$} and store new cookie with client
|
|
|
516 |
\end{enumerate}
|
|
|
517 |
|
|
|
518 |
|
|
|
519 |
\end{frame}}
|
|
|
520 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
521 |
|
|
|
522 |
|
|
|
523 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
524 |
\mode<presentation>{
|
|
|
525 |
\begin{frame}[c]
|
|
|
526 |
\mbox{}\\[-9mm]
|
|
|
527 |
|
|
|
528 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
|
529 |
\texttt{\lstinputlisting{app2.scala}}}
|
|
|
530 |
|
|
7
|
531 |
\footnotesize
|
|
|
532 |
\begin{itemize}
|
|
|
533 |
\item cookie value encoded as hash
|
|
|
534 |
\end{itemize}
|
|
|
535 |
\end{frame}}
|
|
|
536 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
537 |
|
|
|
538 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
539 |
\mode<presentation>{
|
|
|
540 |
\begin{frame}[c]
|
|
|
541 |
|
|
|
542 |
\begin{center}
|
|
|
543 |
\includegraphics[scale=1.8]{pics/barrier.jpg}
|
|
|
544 |
\end{center}
|
|
|
545 |
|
|
|
546 |
\end{frame}}
|
|
|
547 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
548 |
|
|
|
549 |
|
|
|
550 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
551 |
\mode<presentation>{
|
|
|
552 |
\begin{frame}[c]
|
|
|
553 |
\mbox{}\\[-9mm]
|
|
|
554 |
|
|
|
555 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
|
556 |
\texttt{\lstinputlisting{app3.scala}}}
|
|
|
557 |
|
|
6
|
558 |
|
|
|
559 |
\end{frame}}
|
|
|
560 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
561 |
|
|
7
|
562 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
563 |
\mode<presentation>{
|
|
|
564 |
\begin{frame}[c]
|
|
|
565 |
\frametitle{\begin{tabular}{c}SHA-1\end{tabular}}
|
|
|
566 |
|
|
|
567 |
\begin{itemize}
|
|
|
568 |
\item SHA-1 is a cryptographic hash function
|
|
|
569 |
\item no known attack exists, except brute force\bigskip\pause
|
|
|
570 |
\item but dictionary attacks can be very effective for extracting passwords
|
|
|
571 |
\end{itemize}
|
|
|
572 |
|
|
|
573 |
\end{frame}}
|
|
|
574 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
575 |
|
|
|
576 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
577 |
\mode<presentation>{
|
|
|
578 |
\begin{frame}[c]
|
|
|
579 |
\mbox{}\\[-9mm]
|
|
|
580 |
|
|
|
581 |
{\lstset{language=Scala}\fontsize{8}{10}\selectfont
|
|
|
582 |
\texttt{\lstinputlisting{app4.scala}}}
|
|
|
583 |
|
|
|
584 |
\end{frame}}
|
|
|
585 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
586 |
|
|
6
|
587 |
|
|
7
|
588 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
589 |
\mode<presentation>{
|
|
|
590 |
\begin{frame}[c]
|
|
|
591 |
\frametitle{\begin{tabular}{c}Unix Passwords\end{tabular}}
|
|
6
|
592 |
|
|
7
|
593 |
% Unix password
|
|
|
594 |
% http://ubuntuforums.org/showthread.php?p=5318038
|
|
|
595 |
|
|
|
596 |
\end{frame}}
|
|
|
597 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
598 |
|
|
|
599 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
600 |
\mode<presentation>{
|
|
|
601 |
\begin{frame}[c]
|
|
|
602 |
\frametitle{\begin{tabular}{c}Password Blunders\end{tabular}}
|
|
6
|
603 |
|
|
3
|
604 |
% linkedIn password
|
|
|
605 |
% http://erratasec.blogspot.co.uk/2012/06/confirmed-linkedin-6mil-password-dump.html
|
|
2
|
606 |
|
|
7
|
607 |
\end{frame}}
|
|
|
608 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
609 |
|
|
3
|
610 |
% rainbow tables
|
|
|
611 |
% http://en.wikipedia.org/wiki/Rainbow_table
|
|
|
612 |
|
|
7
|
613 |
|
|
3
|
614 |
|
|
|
615 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
616 |
\mode<presentation>{
|
|
|
617 |
\begin{frame}[c]
|
|
|
618 |
\frametitle{\begin{tabular}{c}Brute Forcing Passwords\end{tabular}}
|
|
|
619 |
|
|
|
620 |
\begin{itemize}
|
|
5
|
621 |
\item How fast can hackers crack SHA-1 passwords? \pause
|
|
3
|
622 |
|
|
5
|
623 |
\item The answer is 2 billion attempts per second\\
|
|
|
624 |
using a Radeon HD 7970
|
|
3
|
625 |
\end{itemize}
|
|
|
626 |
|
|
|
627 |
\begin{center}
|
|
5
|
628 |
\begin{tabular}{@ {\hspace{-12mm}}rl}
|
|
3
|
629 |
password length & time\smallskip\\\hline
|
|
|
630 |
5 letters & 5 secs\\
|
|
|
631 |
6 letters & 500 secs\\
|
|
|
632 |
7 letters & 13 hours\\
|
|
|
633 |
8 letters & 57 days\\
|
|
|
634 |
9 letters & 15 years\\
|
|
|
635 |
\end{tabular}
|
|
|
636 |
\end{center}
|
|
|
637 |
|
|
|
638 |
\small
|
|
5
|
639 |
5 letters $\approx$ 100$^5$ $=$ 10 billion combinations\\
|
|
|
640 |
(1 letter - upper case, lower case, digits, symbols $\approx$ 100)
|
|
|
641 |
|
|
|
642 |
\only<2->{
|
|
|
643 |
\begin{textblock}{1}(12,5)
|
|
|
644 |
\begin{tabular}{c}
|
|
|
645 |
\includegraphics[scale=0.3]{pics/radeon.jpg}\\[-6mm]
|
|
|
646 |
\footnotesize graphics card\\[-1mm]
|
|
|
647 |
\footnotesize ca.~\pounds{}300
|
|
|
648 |
\end{tabular}
|
|
|
649 |
\end{textblock}}
|
|
|
650 |
|
|
|
651 |
|
|
3
|
652 |
|
|
|
653 |
\end{frame}}
|
|
|
654 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
655 |
|
|
4
|
656 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
657 |
\mode<presentation>{
|
|
|
658 |
\begin{frame}[c]
|
|
7
|
659 |
\frametitle{\begin{tabular}{c}Passwords\end{tabular}}
|
|
4
|
660 |
|
|
|
661 |
\begin{itemize}
|
|
7
|
662 |
\item How do recover from a breakin?
|
|
4
|
663 |
\end{itemize}
|
|
|
664 |
|
|
|
665 |
\end{frame}}
|
|
|
666 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
667 |
|
|
3
|
668 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
669 |
\mode<presentation>{
|
|
|
670 |
\begin{frame}[c]
|
|
7
|
671 |
\frametitle{\begin{tabular}{c}This Course\end{tabular}}
|
|
3
|
672 |
|
|
|
673 |
\begin{itemize}
|
|
7
|
674 |
\item breakins (buffer overflows)
|
|
|
675 |
\item access control (role based, data security / data integrity)
|
|
|
676 |
\item protocols
|
|
|
677 |
\item access control logic
|
|
|
678 |
\item privacy
|
|
|
679 |
\begin{quote}
|
|
|
680 |
Scott McNealy: \\``You have zero privacy anyway. Get over it.''
|
|
|
681 |
\end{quote}
|
|
3
|
682 |
\end{itemize}
|
|
|
683 |
|
|
|
684 |
\end{frame}}
|
|
|
685 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
686 |
|
|
|
687 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
688 |
\mode<presentation>{
|
|
|
689 |
\begin{frame}[c]
|
|
|
690 |
\frametitle{\begin{tabular}{c}Thinking as a Defender\end{tabular}}
|
|
|
691 |
|
|
|
692 |
\begin{itemize}
|
|
|
693 |
\item What are we trying to protect?
|
|
|
694 |
\item What properties are we trying to enforce?\medskip
|
|
|
695 |
|
|
|
696 |
\item Who are the attackers? Capabilities? Motivations?
|
|
|
697 |
\item What kind of attack are we trying to protect?
|
|
|
698 |
\item Who can fix any vulnerabilities?\medskip
|
|
|
699 |
|
|
|
700 |
\item What are the weaknesses of the system?
|
|
|
701 |
\item What will successful attacks cost us?
|
|
|
702 |
\item How likely are the attacks?\medskip
|
|
|
703 |
|
|
|
704 |
\item Security almost always is {\bf not} free!
|
|
|
705 |
\end{itemize}
|
|
|
706 |
|
|
|
707 |
\end{frame}}
|
|
|
708 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
2
|
709 |
|
|
|
710 |
|
|
|
711 |
|
|
|
712 |
|
|
|
713 |
|
|
|
714 |
|
|
|
715 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
716 |
\mode<presentation>{
|
|
|
717 |
\begin{frame}[c]
|
|
|
718 |
\frametitle{\begin{tabular}{c}The Security Mindset\end{tabular}}
|
|
|
719 |
|
|
|
720 |
\begin{itemize}
|
|
|
721 |
\item How things can go wrong.
|
|
|
722 |
\item Think outside the box.
|
|
|
723 |
\end{itemize}
|
|
|
724 |
|
|
|
725 |
The difference between a criminal is to only think about how things can go wrong.
|
|
|
726 |
|
|
|
727 |
\end{frame}}
|
|
|
728 |
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
729 |
|
|
0
|
730 |
|
|
|
731 |
|
|
|
732 |
\end{document}
|
|
|
733 |
|
|
|
734 |
%%% Local Variables:
|
|
|
735 |
%%% mode: latex
|
|
|
736 |
%%% TeX-master: t
|
|
|
737 |
%%% End:
|
|
|
738 |
|