Talk By Mr. Nizam Kassim (24 March 2011)

On the 24th March 2011 (Thursday) at Lecture Room 2 (N28), there was a talk who was organized by Prof. Dr. Abdul Hanan Bin Abdullah. The one who gave the talk was actually a person from CyberSecurity Malaysia, that is Mr. Nizam Kassim. He talked about 'CyberSAFE Awareness'.


His talked more about HACKERS!! So, let's check it out what's the info... ^__^

A hacker is a person who breaks into computers and computer networks, either for profit or motivated by the challenge. The subculture that has evolved around hackers is often referred to as the computer underground but is now an open community.

Other definitions of the word hacker exist that are not related to computer security. They are subject to the long standing hacker definition controversy about the true meaning of hacker. In this controversy, the term hacker is reclaimed by computer programmers who argue that someone breaking into computers is better called cracker, not making a difference between computer criminals ("black hats") and computer security experts ("white hats"). Some white hat hackers claim that they also deserve the title hacker, and that only black hats should be called crackers.

These subgroups may also be defined by the legal status of their activities.

White hat

A white hat hacker breaks security for non-malicious reasons, for instance testing their own security system. This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. Often, this type of 'white hat' hacker is called an ethical hacker. The International Council of Electronic Commerce Consultants, also known as the EC-Council has developed certifications, courseware, classes, and online training covering the diverse arena of Ethical Hacking.

Black hat

A Black Hat Hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain"(Moore,2005). Black Hat Hackers are "the epitome of all that the public fears in a computer criminal"(Moore,2006). Black Hat Hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network.

The way Black Hat Hackers choose the networks that they are going to break into is by a process that can be broken down into two parts. This is called the pre-hacking stage.

Part 1 Targeting Targeting is when the hacker determines what network to break into. The target may be of particular interest to the hacker, or the hacker may "Port Scan" a network to determine if it is vulnerable to attacks. A port is defined as "an opening through which the computer receives data via the network"(Moore,2005). Open ports will allow a hacker to access the system.

Part 2 Research and Information Gathering It is in this stage that the hacker will visit or contact the target in some way in hopes of finding out vital information that will help them access the system. The main way that hackers get desired results from this stage is from Social Engineering, which will be explained below. Aside from Social Engineering hackers can also use a technique called Dumpster Diving. Dumpster Diving is when a hacker will literally dive into a dumpster in hopes to find documents that users have thrown away, which will help them gain access to a network.

Grey hat

A grey hat hacker is a combination of a Black Hat and a White Hat Hacker. A Grey Hat Hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked, for example. Then they may offer to repair their system for a small fee.

Elite hacker

A social status among hackers, elite is used to describe the most skilled. Newly discovered exploits will circulate among these hackers. 

Script kiddie

A script kiddie is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept—hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child—an individual lacking knowledge and experience, immature).

Neophyte

A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.

Blue hat

A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. 

Hacktivist

A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks. In more extreme cases, hacktivism is used as tool for cyberterrorism.

A typical approach in an attack on Internet-connected system is:

1. Network enumeration: Discovering information about the intended target.
2. Vulnerability analysis: Identifying potential ways of attack.
3. Exploitation: Attempting to compromise the system by employing the vulnerabilities found through the vulnerability analysis.

In order to do so, there are several recurring tools of the trade and techniques used by computer criminals and security experts.

Talk by Mr. Usama Tharwat Elhagari (2nd & 3rd March 2011)

These two days were being lectured by Mr. Usama Tharwat Elhagari from CyberSecurity. He is an Egyptian and he is doing his research in Trusted Computing. The seminar held at Lecture Room 2, N28.


LET'S CHECK IT OUT WHAT IT IS... ^__^


Trusted Computing (TC) is a technology developed and promoted by the Trusted Computing Group. The term is taken from the field of trusted systems and has a specialized meaning. With Trusted Computing, the computer will consistently behave in expected ways, and those behaviors will be enforced by hardware and software. In practice, Trusted Computing uses cryptography to help enforce a selected behavior. The main functionality of TC is to allow someone else to verify that only authorized code runs on a system. This authorization covers initial booting and kernel and may also cover applications and various scripts. Just by itself TC does not protect against attacks that exploit security vulnerabilities introduced by programming bugs.


Can you trust your computer? --> By Richard Stallman

• What should your computer take its orders form?
• Treacherous computing
• The plan is designed to make sure your computer will systematically disobey you
• In fact, it is designed to stop your computer from functioning as a general-purpose computer. every operation may require explicit permission.

Key Concept

Trusted Computing encompasses six key technology concepts, of which all are required for a fully Trusted system, that is, a system compliant to the TCG specifications:

1. Endorsement key
2. Secure input and output
3. Memory curtaining / protected execution
4. Sealed storage
5. Remote attestation
6. Trusted Third Party (TTP)

Hard Drive Encryption

The Microsoft products Windows Vista and Windows 7 make use of a Trusted Platform Module to facilitate BitLocker Drive Encryption.

Talk By Mr. Dahliyusmanto (24 Feb 2011)

On the 24th February 2011 (Thursday) at Lecture Room 2 (N28), there was a talk who was organized by Prof. Dr. Abdul Hanan Bin Abdullah. The one who gave the talk was actually one of the Phd's student, that is Mr. Dahliyusmanto. He talked about 'Intrusion Detection System'.


Definitions

• Intrusion: any set of activities that attempt to compromise the integrity,confidentiality and availability of a resource.
• Example: 
• DoS: attempt to starve a host of resources needed to function correctly.
• Compromises: obtain privilege access to a host by known vulnerabilities.
• Intrusion Detection: the process of identifying and responding to intrusion activities.

Elements of ID

• Primary Assumptions:
• system activities are observable
• normal and intrusive activities have distinct evidence

Components of IDS

• From an algorithmic perspective :
• features - capture intrusion evidences
• models - piece evidences together
• From a system architecture perspective:
• various components - audit data processor, knowledge base, decision engine, alarm generation and responses.

IDS Classification

• Source
• Host-based : detect and examine malicious activity, optimize for monitoring individual hosts, monitor system network activity (e.g. file systems, log files, user actions), integrate the finding several host-based intrusion detection provide unified view of multiple.
• Network-based : deploying sensors at strategic locations (e.g. packet sniffing via tcpdump at routers), inspecting network traffic (watch for violations of protocols and unusual connection patterns), monitoring user activities (look into the data portions of the packets for malicious command sequences).

Detection Mechanisms

• Misuse Detection : it looks for attack signatures in the user's behavior, accuracy is more higher - normal @ intrusive, can't detect new attack.
• Anomaly Detection : it statically analysis user's current sessions, compares then to the profile describing user's normal behavior and report significant deviation to security officer, can detect new attacks.

Challenges of IDS's

• runtime limitations
• specification of detection signatures
• dependency on environment

Potential Solutions

• Data mining : example sequential mining and episode rules
• Machine Learning Techniques : supervised learning and unsupervised learning
• Co-simulation mechanism : integrating the misuse & anomaly techniques, applying a co-simulation mechanism

Talk By Mr. Satria Mandala (17 Feb 2011)

On the 17th February 2011 (Thursday) at Bistari 3 room (CICT), there was a talk who was organized by Prof. Dr. Abdul Hanan Bin Abdullah. The one who gave the talk was actually one of the Prof. Dr. Abdul Hanan Bin Abdullah Phd's student, that is Mr. Satria Mandala. He talked about 'Intrusion Detection Together with Critical Nodes Detection for Securing MANET'.


MANET is Mobile Ad-Hoc Network.
- Host movement frequent.
- Topology change frequent.
- No cellular infrastructure. Multi hop wireless links.
- Data must be routed via intermediate nodes


Security Issues:
- Classifications:
  --> External Attack VS Internal Attack
  --> Passive Attack VS Active Attack


Where is the attack start?
"The attack start from early stage of communication building, i.e. routing."


Example:
- Passive Attack --> jelly fish attack, worm hole attack
- Active Attack --> black hole attack


Routing Attack
- Modifications
- Worm hole attack (tunneling)
- Black hole attack
- DoS attack
- Invisible attack
- The Sybil attack
- Rushing attack
- Non-cooperation


Worm Hole Attack
- Colluding attackers uses "tunnels" between them to forward packets.
- Place the attackers in a very powerful position.
- The attackers take control of the route by claiming a shorter path.


Black Hole Attack
- Malicious node does falsification on the hop count (decrease hop count value) of RREP, as such the source of route discovery will justify that the malicious has shortest path towards the destination.


Security Solutions
- Monitoring using Intrusion Detection
- Encrypt Message Routing

Talk By Mr. Khalid (10 Feb 2011)

On Thursday (10th February 2011) at Bistari 3 room (CICT), there was a talk who was organized by Prof. Dr. Abdul Hanan Bin Abdullah. The one who gave the talk was actually one of the Prof. Dr. Abdul Hanan Bin Abdullah Phd's student. He is a Pakistani and he was actually talking about his experiences working in the network security field. He also talked about the remedy of the Information Security (IS). He was a vice president of a Research and Development (R&D) in his company in Pakistan. 


He also give a talk about VPN. Let's check out what it is about... ^__^


What is a virtual private network (VPN)?

A virtual private network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. A virtual private network can be contrasted with an expensive system of owned or leased lines that can only be used by one organization. The goal of a VPN is to provide the organization with the same capabilities, but at a much lower cost.

A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols such as the Layer Two Tunneling Protocol (L2TP). In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a "tunnel" that cannot be "entered" by data that is not properly encrypted. An additional level of security involves encrypting not only the data, but also the originating and receiving network addresses.

How VPN Work??

The world has changed a lot in the last couple of decades. Instead of simply dealing with local or regional concerns, many businesses now have to think about global markets and logistics. Many companies have facilities spread out across the country or around the world, and there is one thing that all of them need: A way to maintain fast, secure and reliable communications wherever their offices are.

Until fairly recently, this has meant the use of leased lines to maintain a wide area network (WAN). Leased lines, ranging from ISDN (integrated services digital network, 128 Kbps) to OC3(Optical Carrier-3, 155 Mbps) fiber, provided a company with a way to expand its private network beyond its immediate geographic area. A WAN had obvious advantages over a public network like the Internet when it came to reliability, performance and security. But maintaining a WAN, particularly when using leased lines, can become quite expensive and often rises in cost as the distance between the offices increases.

A typical VPN might have a main LAN at the corporate headquarters of a company, other LANs at remote offices or facilities and individual users connecting in.

As the popularity of the Internet grew, businesses turned to it as a means of extending their own networks. First came intranets, which are password-protected sites designed for use only by company employees. Now, many companies are creating their ownVPN (virtual private network) to accommodate the needs of remote employees and distant offices.

B­asically, a VPN is a private network that uses a public network (usually the Internet) to connect remote sites or users together. Instead of using a dedicated, real-world connection such as leased line, a VPN uses "virtual" connections routed through the Internet from the company's private network to the remote site or employee. In this article, you will gain a fundamental understanding of VPNs, and learn about basic VPN components, technologies, tunneling and security.

Virtual private networks help distant colleagues work together, much like dekstop sharing.