Chapter 23 The Bleeding Edge

Transcription

1 Chapter 23 The Bleeding Edge Muhammad Barham June 11, 2014 Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

2 Outline 1 Introduction 2 Computer Games 3 Web Applications 4 Privacy Technology Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

3 Introduction We have become dependent on a vast range of applications Developers usually do not care about security until they get hacked We are going to discuss three types of applications that make up the bleeding edge of security research i Computer Games ii Web Applications (ebay, Google) iii Privacy Technology Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

4 Computer Games - Overview Millions of people play online games Millions of people make a living from online games (from developers to gold farmers) Games are software, software has bugs, this means cheating exists too Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

5 Types of Cheating There are three types of cheating: 1 The original game already has a known vulnerabilities 2 When computer security apply straight off to the world of gaming 3 New cheating tactics that emerge because of the nature computer games Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

6 Aimbots & Unauthorized Software One of the cheating strategies is to have code of your own to provide you with automation and support Aimbots come with different levels of sophistication Game companies use different methods for protection - Encryption and authentication mechanisms to protect the packet stream - Anti-virus techniques to detect attempts to hook into game code or the drivers on which it relies - In CoD4, player who is been killed, can see a replay from the pointview of the killer: this enables the killed player to see whether he was killed fairly or not Inappropriate software can also run on games server Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

7 Not all bad Uncontrolled game scripting languages turned to be useful People realized the game engines can be used to render whole movies in 3-d The growing of the new art called machinima(machine cinema) Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

8 Virtual worlds, Not so virtual economics Gold Farming is a significant export that is creating new economic opportunities Macroeconomics is effected Markets for game goods are getting better organized Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

9 Web Applications - Overview An increasing number of services are online Auction services Search engines Mail services Words processors E-commerce The rush by millions businesses to online services has totally outpaced the available security skills which causes: Many problems are common to all manner of web sites The structure of web services is partially open to malicious inspection So much personal information stored on web-based applications Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

10 ebay Along with PayPal, they are the phishermens largest target The platform for lots of old fashioned fraud Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

11 Google Google hacking Two main innovations Pagerank algorithm Linking search to targeted advertising Wave after wave of attacks click-fraud impression-spam Google arbitrage Made for Adsence sites Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

12 Google Google s achilles heel: privacy Unauthorized access to data Privacy laws Lawful access to authorized data Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

13 Privacy Technology - Overview Technology is already putting some social conventions under strain Deniability Anonymity Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

14 Privacy Technology - Overview Let s consider some specific privacy problems Andrew is a missionary in Texas whose website has attracted converts in Saudi Arabia Betty is a ten-year-old daughter, who is been warned by her teacher to remain anonymous online Charles is an engineer, and he is running a blog - in contravention of his company s rules Dai is a human-rights worker in Vietnam. The police harass her frequently Firoz is a gay man who lives in Teheran. He had like like some way to download porn without getting hanged Graziano is a magistrate in Palermo setting up a hot-line to let people tip off the authorities about Mafia activity Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

15 Anonymous - The Dining Cryptographers and Mixes There are two basic mechanisms The dining cryptographers problem Mix or anonymous r er i Cypherpunk r er ii Maxmaster r er iii Nymserver Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

16 Anonymous Web Browser - Tor Implementation of Onion Routing Tor software consists of 1 Tor client 2 Tor button Vulnerabilities: 1 Malicious exit node 2 Many side channels 3 Low latency and high bandwidth are exposed to traffic analysis 4 The applications and users identify themselves explicitly Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

17 Encryption PGP (Pretty Good Privacy) 1 Key management 2 Public keyring 3 Key fingerprint 4 Web of trust Rubber hose cryptanalysis Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18

18 Steganography and Forensics Countermeasures MP3stego Steganographic file system TrueCrypt Crowds anonymity loves company Identity escrow Muhammad Barham Chapter 23 The Bleeding Edge June 11, / 18