\documentclass[dvipsnames,14pt,t, xelatex]{beamer}
\usepackage{../slides}
\usepackage{../graphics}
\usepackage{../langs}

\setmonofont[Scale=.88]{Consolas}
\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 
\renewcommand{\slidecaption}{SEN 01, King's College London}

\lstset{language=JavaScript,
        style=mystyle,
        numbersep=0pt,
        numbers=none,
        xleftmargin=0mm}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{%
  \begin{tabular}{@ {}c@ {}}
  \LARGE Security Engineering (1)\\[-3mm] 
  \end{tabular}}

  \begin{center}
  \includegraphics[scale=0.3]{../pics/barrier.jpg}
  \end{center}

  \normalsize
  \begin{center}
  \begin{tabular}{ll}  
  Email:  & christian.urban at kcl.ac.uk\\
  Office: & S1.27 (1st floor Strand Building)\\
  Slides: & KEATS
  \end{tabular}
  \end{center}
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}

\begin{center}
\includegraphics[scale=0.5]{../pics/barrier.jpg}
\end{center}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{This is a Misconception!}

\begin{center}
\includegraphics[scale=0.55]{../pics/cryptographic-small.png}
\end{center}

\centering
\begin{bubble}[10cm]
\small
There is some consensus that the NSA can probably not
brute-force magically better than the ``public''. 
\end{bubble}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
The content of this course is very much inspired by the work of 
three people:\bigskip

\small
\begin{center}
\begin{tabular}{ccc}
\includegraphics[scale=1.4]{../pics/schneier.png} &
\includegraphics[scale=0.103]{../pics/ross.jpg} &
\includegraphics[scale=0.2]{../pics/halderman.jpg} \\
Bruce Schneier & Ross Anderson & Alex Halderman\\
\tiny\url{en.wikipedia.org/wiki/Bruce_Schneier} & 
\tiny\url{www.cl.cam.ac.uk/~rja14} & 
\tiny\url{jhalderm.com}
\end{tabular}
\end{center}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]

\alert{\bf Security engineers} require a particular \alert{\bf mindset}:
\bigskip\medskip

\begin{overlayarea}{\textwidth}{5cm}
\small
\only<1>{\begin{bubble}[10cm]
``Security engineers --- at least the good ones --- see
the world differently. They can't walk into a store without
noticing how they might shoplift. They can't use a computer
without wondering about the security vulnerabilities. They
can't vote without trying to figure out how to vote twice.
They just can't help it.''\\
\hfill{}---Bruce Schneier
\end{bubble}}%
\only<2>{\begin{bubble}[10.5cm]
``Security engineering\ldots requires you to think
differently. You need to figure out not how something works,
but how something can be made to not work. You have to imagine
an intelligent and malicious adversary inside your system
\ldots, constantly trying new ways to
subvert it. You have to consider all the ways your system can
fail, most of them having nothing to do with the design
itself. You have to look at everything backwards, upside down,
and sideways. You have to think like an alien.''\hfill{}---Bruce Schneier
\end{bubble}}
\end{overlayarea}

\begin{flushright}
\includegraphics[scale=0.0087]{../pics/schneierbook1.jpg}\;
\includegraphics[scale=0.0087]{../pics/schneierbook2.jpg}\;
\includegraphics[scale=0.23]{../pics/schneierbook3.jpg}\;
\includegraphics[scale=0.85]{../pics/schneier.png}
\end{flushright}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Breaking Things}

For example:

\begin{center}
\begin{bubble}[10cm]\small
Prof.~V.~Nasty gives the following final exam question (closed books, 
closed notes):\bigskip

\noindent
\begin{tabular}{@ {}l}
Write the first 100 digits of $\pi$:\\
3.\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_\,\_
\end{tabular}
\end{bubble}
\end{center}

How can you cheat in this exam and how can you defend against such cheating?

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{\textcolor{red}{Warning}}
\small

\begin{itemize}
\item<1-> I will be teaching techniques that can be used to
      compromise security and privacy. 
\end{itemize}

\onslide<2->{
\begin{itemize}
\item Don’t be evil! 
\only<3>{\item Using those techniques in the real world may
violate the law or King’s rules, and it may be unethical.}
\only<3>{\item Under some circumstances, even probing for weaknesses of a
system may result in severe penalties, up to and including
expulsion, fines and jail time.} 
\only<3>{\item Acting lawfully and ethically is \underline{your} responsibility.} 
\only<4>{\item Ethics requires you to
refrain from doing harm.} 
\only<4>{\item \underline{Always} respect privacy and rights of
others.} 
\only<4>{\item Do not tamper with any of King's systems.} 
\only<5>{\item If you try
out a technique, always make doubly sure you are working in a
safe environment so that you cannot cause any harm, not even
accidentally.} 
\only<5>{\item Don't be evil. Be an \underline{ethical} hacker.}
\end{itemize}}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Secure Systems}

For a secure system, four requirements need to come 
together:

\begin{itemize}
\item {\bf Policy}\\
  {\small What is supposed to be achieved?}
\item {\bf Mechanism}\\
  {\small Cipher, access controls, tamper resistance, \ldots} 
\item {\bf Assurance}\\
  {\small The amount of reliance you can put on the mechanism.}
\item {\bf Incentive}\\
  {\small The motive that the people guarding and maintaining the 
  system have to do their job properly, and also the motive 
  that the attackers have to try to defeat your policy.}
\end{itemize}



\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Chip-and-PIN}

\begin{center}
\includegraphics[scale=0.3]{../pics/creditcard1.jpg}\;
\includegraphics[scale=0.3]{../pics/creditcard2.jpg}
\end{center}

\begin{itemize}
\item Chip-and-PIN was introduced in the UK in 2004
\item before that customers had to sign a receipt\bigskip
\item \bf Is Chip-and-PIN a more secure system?
\end{itemize}

\begin{flushright}
\small\textcolor{gray}{(some other countries still use the old method)}
\end{flushright}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Yes \ldots}

\ldots if you believe the banks:\bigskip

\begin{bubble}[10cm] 
\small ``Chip-and-PIN is so effective in this country [UK]
that fraudsters are starting to move their activities
overseas,''\smallskip\\ 
\hfill{}said some spokesman for Lloyds TSB\\ 
\hfill(in The Guardian, 2006)
\end{bubble}\bigskip


\begin{itemize}
\item mag-stripe cards cannot be cloned anymore
\item stolen or cloned cards need to be used abroad 
\item fraud on lost, stolen and counterfeit credit 
cards was down \pounds{60m} (24\%) on 2004's figure
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{But let's see}


\begin{textblock}{1}(3,4)
\begin{tabular}{c}
\includegraphics[scale=0.3]{../pics/bank.png}\\[-2mm]
\small Bank
\end{tabular}
\end{textblock}

\begin{textblock}{1}(7,4.5)
\begin{tabular}{c}
\includegraphics[scale=3]{../pics/store.png}\\[-2mm]
\end{tabular}
\end{textblock}

\begin{textblock}{1}(4.5,9.9)
\begin{tabular}{c}
\includegraphics[scale=0.16]{../pics/rman.png}\\[-1mm]
\small customer / you
\end{tabular}
\end{textblock}  

\only<2->{
\begin{textblock}{1}(4.5,7.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,-1) node (Y) {};
  \draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\only<3->{
\begin{textblock}{1}(6.8,7.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,1) node (Y) {};
  \draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(4.8,5.9)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1.4,0) node (Y) {};
  \draw[red, <->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\only<4->{  
\begin{textblock}{1}(12,6.5)
\begin{tabular}{c}
\includegraphics[scale=0.8]{../pics/factory.png}\\[-1mm]
\small card\\[-2mm]\small terminal\\[-2mm] \small producer
\end{tabular}
\end{textblock}
  
\begin{textblock}{1}(10,7)
  \begin{tikzpicture}[scale=1.6]
  \draw[white] (0,0) node (X) {};
  \draw[white] (-1,0.6) node (Y) {};
  \draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}  
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Chip-and-PIN}

\begin{itemize}
\item A ``tamperesitant'' terminal playing Tetris on 
\href{http://www.youtube.com/watch?v=wWTzkD9M0sU}{youtube}.\smallskip\\
\footnotesize(\url{http://www.youtube.com/watch?v=wWTzkD9M0sU})
\end{itemize}
 
\includegraphics[scale=0.2]{../pics/tetris.jpg}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}
\frametitle{Chip-and-PIN}

\begin{itemize}
\item in 2006, Shell petrol stations stopped accepting Chip-and-PIN after 
  \pounds{1M} had been stolen from customer accounts\smallskip 
\item in 2008, hundreds of card readers for use in Britain, Ireland, 
  the Netherlands, Denmark, and Belgium had been expertly tampered with 
  shortly after manufacture so that details and PINs of credit cards 
  were sent during the 9 months before over mobile phone networks 
  to criminals in Lahore, Pakistan
\end{itemize}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Chip-and-PIN is Broken}

\begin{flushright}
\includegraphics[scale=0.01]{../pics/andersonbook1.jpg}\;
\includegraphics[scale=1.5]{../pics/anderson.jpg}
\end{flushright}

\begin{itemize}
\item man-in-the-middle attacks by the group around Ross Anderson\medskip
\end{itemize}

\begin{center}
\mbox{}\hspace{-20mm}\includegraphics[scale=0.5]{../pics/chip-attack.png}
\end{center}

\begin{textblock}{1}(11.5,13.7)
\begin{tabular}{l}
\footnotesize on BBC Newsnight\\[-2mm] 
\footnotesize in 2010 or 
\href{http://www.youtube.com/watch?v=JPAX32lgkrw}{youtube}
\end{tabular}
\end{textblock}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{\Large Chip-and-PIN is Really Broken}

\begin{flushright}
\includegraphics[scale=0.01]{../pics/andersonbook1.jpg}\;
\includegraphics[scale=1.5]{../pics/anderson.jpg}
\end{flushright}

\begin{itemize}
\item same group successfully attacked in 2012 card readers and ATM machines
\item the problem was: several types of ATMs generate poor random numbers, 
  which are used as nonces
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{The Real Problem \ldots}

\begin{textblock}{1}(3,4)
\begin{tabular}{c}
\includegraphics[scale=0.3]{../pics/bank.png}\\[-2mm]
\small Bank
\end{tabular}
\end{textblock}

\begin{textblock}{1}(7,4.5)
\begin{tabular}{c}
\includegraphics[scale=3]{../pics/store.png}\\[-2mm]
\end{tabular}
\end{textblock}

\begin{textblock}{1}(12,6.5)
\begin{tabular}{c}
\includegraphics[scale=0.8]{../pics/factory.png}\\[-1mm]
\small terminal\\[-2mm] \small producer
\end{tabular}
\end{textblock}

\begin{textblock}{1}(4.5,9.9)
\begin{tabular}{c}
\includegraphics[scale=0.13]{../pics/rman.png}\\[-1mm]
\small customer / you
\end{tabular}
\end{textblock}  
  
\begin{textblock}{1}(4.5,7.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,-1) node (Y) {};
  \draw[gray, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(6.8,7.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,1) node (Y) {};
  \draw[gray, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(4.8,5.9)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1.4,0) node (Y) {};
  \draw[gray, <->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(10,7)
  \begin{tikzpicture}[scale=1.6]
  \draw[white] (0,0) node (X) {};
  \draw[white] (-1,0.6) node (Y) {};
  \draw[gray, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}  
  
\begin{textblock}{14}(1,13.5)
\begin{itemize}
\item the burden of proof for fraud and financial liability was shifted to the costumer (until approx.~2009/10)
\end {itemize} 
\end{textblock}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{The Bad Guy Again}

\begin{bubble}[10.5cm]
\small
Some anonymous hacker from earlier:\medskip\\ 
``Try to use
`Verified-By-Visa' and `Mastercard-Securecode' as rarely as
possible. If only your CVV2 code is getting sniffed, you are
not liable for any damage, because the code is physically
printed and could have been stolen while you paid with your
card at a store. Same applies if someone cloned your CC
reading the magnetic stripe or sniffing RFID. Only losing your
VBV or MCSC password can cause serious trouble.''\\
\hfill{}\url{www.goo.gl/UWluh0}
\end{bubble}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Being Screwed Again}

\begin{flushright}
\includegraphics[scale=0.3]{../pics/rbssecure.jpg}
\end{flushright}

\begin{itemize}
\item {\bf Responsibility}\\
``You understand that you are financially responsible for all uses 
of RBS Secure.''\medskip\\
\footnotesize\url{https://www.rbssecure.co.uk/rbs/tdsecure/terms_of_use.jsp}
\end{itemize}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Web Applications}

\begin{textblock}{1}(2,5)
\begin{tabular}{c}
\includegraphics[scale=0.15]{../pics/servers.png}\\[-2mm]
\small Servers from\\[-2mm] 
\small Dot.com Inc.
\end{tabular}
\end{textblock}

\begin{textblock}{1}(5.6,6)
  \begin{tikzpicture}[scale=2.5]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,0) node (Y) {};
  \only<2>{\draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {};}
  \only<3>{\draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X)!.5!(Y) $) {};}
  \only<4>{\draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=7pt,label=above:\textcolor{black}{POST data}] at ($ (X)!.5!(Y) $) {};}
  \end{tikzpicture}
\end{textblock}


\begin{textblock}{1}(9,5.5)
\begin{tabular}{c}
\includegraphics[scale=0.15]{../pics/laptop.png}\\[-2mm]
\small Client(s)
\end{tabular}
\end{textblock}
  
\begin{textblock}{13}(1,13)  
\begin{itemize}
\item What are pitfalls and best practices?
\end{itemize}  
\end{textblock}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{JavaScript + Node.js}

A simple response from the server:

\small
\lstinputlisting{../progs/ap0.js}
\medskip\pause

\small
alternative response:\smallskip\\


\lstinline{response.write('<H1>Hello World</H1>');}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]

\footnotesize
\lstinputlisting{../progs/ap1.js}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Cookies}

\begin{textblock}{1}(1.5,5)
\begin{tabular}{c}
\includegraphics[scale=0.15]{../pics/servers.png}\\[-2mm]
\small Servers from\\[-2mm] 
\small Dot.com Inc.
\end{tabular}
\end{textblock}

\begin{textblock}{1}(5.6,5.6)
  \begin{tikzpicture}[scale=2.5]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,0) node (Y) {};
  \draw[white] (0.05,-0.3) node (X1) {};
  \draw[white] (0.95,-0.3) node (Y1) {};
  \only<1-2>{\draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{GET request}] at ($ (X)!.5!(Y) $) {};}
  \only<1>{\draw[white, <-, line width = 1mm] (X1) -- (Y1);
  \node [inner sep=2pt,label=below:\textcolor{white}{read a cookie}] at ($ (X1)!.5!(Y1) $) {};}
  \only<2>{\draw[red, <-, line width = 1mm] (X1) -- (Y1);
  \node [inner sep=2pt,label=below:\textcolor{black}{read a cookie}] at ($ (X1)!.5!(Y1) $) {};}
  \only<3->{\draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{webpage}] at ($ (X)!.5!(Y) $) {};}
  \only<3->{\draw[red, ->, line width = 1mm] (X1) -- (Y1);
  \node [inner sep=2pt,label=below:\textcolor{black}{write a cookie}] at ($ (X1)!.5!(Y1) $) {};}
  \end{tikzpicture}
\end{textblock}


\begin{textblock}{1}(9.5,5.5)
\begin{tabular}{c}
\includegraphics[scale=0.15]{../pics/laptop.png}\\[-2mm]
\small Client
\end{tabular}
\end{textblock}
  
\only<4->{  
\begin{textblock}{13}(1,11)  
\small\begin{itemize}
\item cookies: max 4KB data\\[-2mm]
\item cookie theft, cross-site scripting attacks\\[-2mm]
\item session cookies, persistent cookies, HttpOnly cookies, third-party cookies, zombie cookies 
\end{itemize}  
\end{textblock}}

\only<5>{
\begin{textblock}{11}(1,3)
\begin{bubble}[10cm]\small
{\bf Cookie Law:}\smallskip\\ ``In May 2011, a
European Union law was passed stating that websites that leave
non-essential cookies on visitors' devices have to alert the visitor
and get acceptance from them. This law applies to both individuals and
businesses based in the EU regardless of the nationality of their
website's visitors or the location of their web host. It is not enough
to simply update a website's terms and conditions or privacy
policy. The deadline to comply with the new EU cookie law was 26th May
2012 and failure to do so could mean a fine of up to
\pounds{500,000}.''  \hfill\small\textcolor{gray}{$\rightarrow$BBC
  News}, \url{www.goo.gl/RI4qhh}
\end{bubble}
\end{textblock}}
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{My First Real Webapp}

{\bf GET request:}\smallskip
\begin{enumerate}
\item read the cookie from client
\item if none is present, set \texttt{counter} to \textcolor{blue}{0}
\item if cookie is present, extract \texttt{counter}
\item if \texttt{counter} is greater or equal than \textcolor{blue}{$5$}, \\
print a valued customer message\\
otherwise just a normal message
\item increase \texttt{counter} by \textcolor{blue}{$1$} and store new cookie with client
\end{enumerate}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\mbox{}\\[-9mm]

\footnotesize
\lstinputlisting{../progs/ap2.js}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]

\begin{center}
\includegraphics[scale=0.5]{../pics/barrier.jpg}
\end{center}

\begin{itemize}
\item data integrity needs to be ensured
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\mbox{}\\[-7mm]

\footnotesize
\lstinputlisting{../progs/ap3.js}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{SHA-1}
  
\begin{itemize}
\item SHA-1 is a cryptographic hash function\\
(MD5, SHA-256, SHA-512, \ldots) 
\item message $\rightarrow$ digest
\item attacks exist: $2^{80} \rightarrow 2^{61}$ \bigskip\pause
\item but dictionary attacks are much more effective for extracting passwords (later)
\end{itemize}  
  
\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\mbox{}\\[-2mm]

{\footnotesize\lstinputlisting{../progs/ap4.js}}

\begin{textblock}{1}(9,0)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (3.5,0) node (Y) {};
  \draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{\small should be random}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(12.6,6.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (-1,-1) node (Y) {};
  \draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\begin{textblock}{1}(9.9,11.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (1,-1) node (Y) {};
  \draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:{}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\mode<presentation>{
\begin{frame}[c]
\frametitle{\begin{tabular}{c}Unix Passwords\end{tabular}}

\begin{itemize}
\item passwords must \alert{\bf not} be stored in clear text
\item instead \texttt{/etc/shadow} contains
\end{itemize}

{\small
\texttt{name:\$1\$QIGCa\$/ruJs8AvmrknzKTzM2TYE.:other\_info}
}

\begin{itemize}
\item \texttt{\$} is the separator
\item \texttt{1} is MD5 (actually SHA-512 is used nowadays, \texttt{6})
\item \texttt{QIGCa} is the salt
\item \texttt{ruJs8AvmrknzKTzM2TYE.} $\rightarrow$ password + salt
\end{itemize}

\textcolor{gray}{\small
(\texttt{openssl passwd -1 -salt QIGCa pippo})
}
% Unix password
% http://ubuntuforums.org/showthread.php?p=5318038

\end{frame}}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\mode<presentation>{
\begin{frame}[c]
\frametitle{\begin{tabular}{@ {}c@ {}}Plain-Text Passwords\end{tabular}}

\pause
\small\textcolor{gray}{On 25 September 2012, a report on a data breach at IEEE:}


\begin{itemize}
\item IEEE is a standards organisation (not-for-profit) 
\item many standards in CS are by IEEE\medskip
\item 100k plain-text passwords were recorded in logs
\item the logs were openly accessible on their FTP server
\end{itemize}\bigskip

\begin{flushright}\small
\textcolor{gray}{\url{http://ieeelog.com}}
\end{flushright}

\only<3->{
\begin{textblock}{11}(3,2)
\begin{tikzpicture}
\draw (0,0) node[inner sep=2mm,fill=white, ultra thick, draw=red, rounded corners=2mm] 
{\normalsize\color{darkgray}
\begin{minipage}{7.5cm}\raggedright\small
\includegraphics[scale=0.6]{../pics/IEEElog.jpg}
\end{minipage}};
\end{tikzpicture}
\end{textblock}}

\end{frame}}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\mode<presentation>{
\begin{frame}[c]
\frametitle{\begin{tabular}{c}Other Password Blunders\end{tabular}}


\begin{itemize}
\item in late 2009, when an SQL injection attack against online games 
service RockYou.com exposed 32 million \alert{plaintext} passwords

\item  1.3 million Gawker credentials exposed in December 2010 containing 
unsalted(?) \alert{MD5} hashes

\item June 6th, 2012, 6 million unsalted SHA-1 passwords were leaked from linkedIn
% linkedIn password
% http://erratasec.blogspot.co.uk/2012/06/confirmed-linkedin-6mil-password-dump.html

\item in July 2015, hackers leaked a password database from 
Ashley Madison containing 31 million passwords, many of them 
poorly hashed
\end{itemize}\medskip

\small
(web user maintains 25 separate accounts but uses just 6.5 passwords.)

\end{frame}}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%For instance, SHA512crypt, which is included in Mac OS X and most Unix-based operating systems, passes text through 5,000 iterations, a %hurdle that would have limited Gosney to slightly less than 2,600 guesses per second. The Bcrypt algorithm is even more computationally %expensive, in large part because it subjects text to multiple iterations of the Blowfish cipher that was deliberately modified to increase the %time required to generate a hash. PBKDF2, a function built into Microsoft's .Net software developer framework, offers similar benefits.


% rainbow tables
% http://en.wikipedia.org/wiki/Rainbow_table



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{\begin{tabular}{c}Brute Forcing Passwords\end{tabular}}

\begin{itemize}
\item How fast can hackers crack SHA-1 passwords? \pause

\item The answer is 2 billion attempts per second\\ 
using a Radeon HD 7970
\end{itemize}

\begin{center}
\begin{tabular}{@ {\hspace{-12mm}}rl}
password length & time\smallskip\\\hline
5 letters & 5 secs\\
6 letters & 500 secs\\
7 letters & 13 hours\\
8 letters & 57 days\\
9 letters & 15 years\\
\end{tabular}
\end{center}

\small
5 letters $\approx$ 100$^5$ $=$ 10 billion combinations\\ 
(1 letter - upper case, lower case, digits, symbols $\approx$ 100)

\only<2->{
\begin{textblock}{1}(12,5)
\begin{tabular}{c}
\includegraphics[scale=0.3]{../pics/radeon.jpg}\\[-6mm]
\footnotesize graphics card\\[-1mm]
\footnotesize ca.~\pounds{}300
\end{tabular}
\end{textblock}}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Passwords}

How to recover from a break in?\pause\medskip

\begin{itemize}
\item Do not send passwords in plain text.
\item Security questions are tricky to get right (you cannot hash them).
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{This Course}

\begin{itemize}
\item electronic voting
\item break-ins (buffer overflows)
\item access control\\ (role based, data security / data integrity)
\item protocols
\item zero-knowledge proofs
\item privacy
\begin{quote}
Scott McNealy: \\``You have zero privacy anyway. Get over it.''
\end{quote}
\item trust, bitcoins
\item static analysis
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Books + Homework}

\begin{itemize}
\item There is no single book I am following, but

  \begin{center}
    \includegraphics[scale=0.012]{../pics/andersonbook1.jpg}
    %%\includegraphics[scale=0.23]{../pics/accesscontrolbook.jpg}
  \end{center}\medskip\pause

\item The question ``\emph{Is this relevant for the exams?}''
      is not appreciated!\medskip\\

  Whatever is in the homework (and is not marked optional) is
  relevant for the exam. No code needs to be written.
  
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Further Information}

For your personal interest:

\begin{itemize}
\item RISKS mailing list 
\item Schneier's Crypto newsletter
\item Google+ Ethical Hacker group
\item Chaos Computer Club Conferences\\ 
(every year in December)
\begin{center}
\url{https://media.ccc.de/c/camp2015}
\end{center}
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Take-Home Points}

\begin{itemize}
\item Never store passwords in plain text.\medskip
\item Always salt your hashes!\medskip
\item Use an existing crypto algorithm; do not write your own!\medskip
\item Make the party responsible for losses that is in the position to improve 
security.
\end{itemize}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{\Large\begin{tabular}{c}User-Tracking Without Cookies\end{tabular}}

Can you track a user {\bf without}:

\begin{itemize}
\item Cookies
\item JavaScript
\item LocalStorage/SessionStorage/GlobalStorage
\item Flash, Java or other plugins
\item Your IP address or user agent string
\item Any methods employed by Panopticlick\\
\mbox{}\hfill $\rightarrow$ \textcolor{blue}{\url{https://panopticlick.eff.org/}}
\end{itemize}

Even when you disabled cookies entirely, have JavaScript turned off and use a VPN service.\\\pause
(And numerous sites use it.)

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{frame}[c]
\frametitle{Web-Protocol}

\only<1->{
\begin{textblock}{1}(2,2)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {\includegraphics[scale=0.12]{../pics/firefox.jpg}};
  \end{tikzpicture}
\end{textblock}}

\only<1->{
\begin{textblock}{1}(11,2)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {\includegraphics[scale=0.15]{../pics/servers.png}};
  \end{tikzpicture}
\end{textblock}}

\only<1->{
\begin{textblock}{1}(5,2.5)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (3,0) node (Y) {};
  \draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\only<2->{
\begin{textblock}{1}(5,6)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (3,0) node (Y) {};
  \draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=below:\textcolor{black}{\small ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
   \node [inner sep=5pt,label=above:{\includegraphics[scale=0.15]{../pics/tvtestscreen.jpg}}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\only<3->{
\begin{textblock}{1}(4.2,11)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (3,0) node (Y) {};
  \draw[red, ->, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\only<4->{
\begin{textblock}{1}(4.2,13.9)
  \begin{tikzpicture}[scale=1.3]
  \draw[white] (0,0) node (X) {};
  \draw[white] (3,0) node (Y) {};
  \draw[red, <-, line width = 2mm] (X) -- (Y);
  \node [inner sep=5pt,label=below:\textcolor{black}{\small HTTP/1.1 304 (Not Modified)}] at ($ (X)!.5!(Y) $) {};
  \end{tikzpicture}
\end{textblock}}

\end{frame}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

\end{document}



%%% Local Variables:  
%%% mode: xelatex
%%% TeX-master: t
%%% End: