Practical Online Security (Spring 2017)

Learn how to secure your online life through practical, everyday measures, updated to include Signal as a baseline recommendation.

Transcript

1. PRACTICAL ONLINE SECURITY MYTHS AND DEFENSES
2. WHO AM I? Ky-Cuong L. Huynh 4th year Computer Science, UCLA ACM Hack Director of UCLA CTF Director of Hack School Team Sublime Text + Vim
3. MY BACKGROUND Director of UCLA Capture the Flag CS 136 — Computer Security IT Staff at the UCLA Lab School Web of Trust (WOT) volunteer PhishTank volunteer
4. ASK ME ANYTHING, ANYTIME.
5. OUT OF SCOPE } { Hosts file HTTPS Everywhere PGP email TorBrowser Router configuration Tails FileVault SecureDrop uBlock Spokeo ProtonMail OTR chat Qubes OS Little Snitch Docker
6. THE MYTHS “I’LL SHOW YOU THE DARK SIDE.” — KYLO REN
7. COMMON MYTHS
8. COMMON MYTHS ▸ “No one cares about my computer.”
9. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.”
10. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.” ▸ “Who would go through the effort of targeting me?”
11. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.” ▸ “Who would go through the effort of targeting me?” ▸ “It would be obvious if my computer were compromised.”
12. THE REALITY
13. THE REALITY ▸ Attacks are easily automated
14. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more
15. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers
16. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc.
17. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc. ▸ Many of you will become valuable targets
18. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc. ▸ Many of you will become valuable targets ▸ Executives, engineers, sysadmins, and more
19. VIDEO: SOCIAL ENGINEERING
20. THREAT LANDSCAPE “KNOW YOUR ENEMY.” — SUN TZU
23. SCAREWARE, SPYWARE, RANSOMWARE
28. SCAREWARE, SPYWARE, RANSOMWARE
29. SCAREWARE, SPYWARE, RANSOMWARE
30. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
33. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
34. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
35. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE HUMAN ATTACKER
36. THE THREATS
37. THE THREATS ▸ Strong defense against:
38. THE THREATS ▸ Strong defense against: ▸ Automated attacks
39. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering
40. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking
41. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against:
42. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against: ▸ NSA/FBI/CIA/…
43. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against: ▸ NSA/FBI/CIA/… ▸ Industrial espionage
44. THE ASSETS
45. THE ASSETS ▸ Online accounts
46. THE ASSETS ▸ Online accounts ▸ Identity & personal safety
47. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources
48. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime
49. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data
50. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data ▸ Hands off!
51. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data ▸ Hands off! ▸ Always available to us
52. THE DEFENSES “SOMEBODY HAS TO SAVE OUR SKINS!” — PRINCESS LEIA ORGANA
53. DEFENSE #1 KNOWLEDGE IS POWER
54. VIDEO: TOYDARIAN
55. DEMO: WEB PHISHING
57. CERTIFICATE MISMATCH
59. HXXP://SALTLAKECITYCHIROPRACTOR.NET/WELLSFARGO.COM/WELLSFARGO- ONLINE.SERVER/VERIFY_INFORMATION/INDEX.HTML
60. BASE URL MISMATCH
63. REAL CITIBANK SITE
65. INCORRECT FORMATTING
67. URLEX.ORG
69. DEFENSE #2 UPDATE, UPDATE, UPDATE, UPDATE!
70. “SAFETY ENGINEERING [IS]…PROGRAMMING MURPHY’S COMPUTER…SECURITY ENGINEERING INVOLVES PROGRAMMING SATAN'S COMPUTER.” Bruce Schneier
71. DEFENSE #3 MULTI-FACTOR AUTHENTICATION
72. AUTHENTICATION FACTORS
73. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW
74. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy”
75. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE
76. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password
77. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey
78. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey ▸ SOMETHING YOU ARE
79. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey ▸ SOMETHING YOU ARE ▸ Fingerprint, iris scan, voice
80. DEMO: AUTHY & YUBIKEY
81. DEFENSE #4 BACK-UP EVERYTHING
82. “THERE ARE TWO KINDS OF COMPUTER USERS: THOSE WHO HAVE SUFFERED A CATASTROPHIC DISK FAILURE—AND THOSE WHO WILL.” Computing proverb
83. “THIS WEAPON IS YOUR LIFE!”— OBI-WAN KENOBI
85. DEFENSE #5 USE A PASSWORD MANAGER
87. X
88. VIDEO: LASTPASS
89. CTF TALK: PROF. REIHER ON DDOS THURSDAY, MAY 18, 6-8 PM ROLFE 3126
90. MAY 21, 12-9 PM, CARNESALE PALISADES
91. DEFENSE #6 ENCRYPT YOUR COMMUNICATIONS
92. SIGNAL
93. SIGNAL FEATURES
94. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls
95. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages
96. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages ▸ Register with just your phone number
97. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages ▸ Register with just your phone number ▸ Message your current contacts
98. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages ▸ Register with just your phone number ▸ Message your current contacts ▸ Reviewed, tested, and endorsed by experts
99. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages ▸ Register with just your phone number ▸ Message your current contacts ▸ Reviewed, tested, and endorsed by experts ▸ Described as unreadable communications by leaked NSA docs
100. SIGNAL FEATURES ▸ Encrypted messages, voice, and video calls ▸ Disappearing Messages ▸ Register with just your phone number ▸ Message your current contacts ▸ Reviewed, tested, and endorsed by experts ▸ Described as unreadable communications by leaked NSA docs ▸ But they can still bypass via targeted malware
101. HANDOUT: HTTPS://KYCODE.ME/ PRACTICAL-ONLINE-SECURITY/
102. SUMMARY 1. Street smarts 2. Up-to-date software 3. MFA authentication 4. Back-up everything 5. Password manager 6. Use Signal