Block Chain & Crypto-Currencies (CY-702 (B)) - Unit 2 Short Notes

Penetration Testing and Vulnerability Analysis

Ethical and Legal Considerations

• Impact on decision-making: Organizations must balance security benefits against legal risks (e.g., violations of CFAA, GDPR) and ethical boundaries (e.g., data privacy, system disruption).

  • Legal: Requires explicit written authorization; defines scope to avoid liability. Unauthorized testing is illegal.

  • Ethical: Minimize business impact, protect client data, practice responsible disclosure.

  [!TIP] Always secure a signed "Get Out of Jail Free" (GOJF) agreement before testing.

Reconnaissance and Information Gathering

• Purpose of DNS reconnaissance:

  • Map domain infrastructure (subdomains, MX records, zone transfers).

  • Identify attack surfaces (e.g., exposed admin panels, legacy systems).

  • Tools: dig, nslookup, dnsrecon.

• Importance of external presence gathering:

  • Public-facing assets (websites, APIs, cloud storage) are common initial vectors.

  • OSINT (Open-Source Intelligence) reveals employee names, tech stack, third-party integrations—critical for tailored attacks.

Target System Analysis

• Importance of architecture understanding:

  • Prevents unintended damage (e.g., crashing production systems).

  • Identifies specific vulnerabilities (e.g., framework version, custom modules).

  • Enables privilege escalation paths and lateral movement planning.

Penetration Testing Methodologies

• Network vs. Application Testing:

• Web Application Methodologies:

  • OWASP Testing Guide phases:

    1. Reconnaissance (spidering, content discovery).

    2. Configuration analysis (HTTP methods, headers).

    3. Authentication testing (credential stuffing, session fixation).

    4. Authorization testing (IDOR, privilege escalation).

    5. Data validation (SQLi, XSS, SSRF).

    6. Reporting (risk-rated findings).

• Wireless Penetration Testing:

  • Packet sniffing: Captures traffic to identify networks, crack WEP/WPA, analyze protocols (e.g., 802.11). Tools: Wireshark, Aircrack-ng.

  • Social engineering tactics:

    1. Evil twin attacks: Rogue AP mimicking legitimate network.

    2. Phishing for Wi-Fi credentials: Fake captive portals.

    3. Baiting: Leaving infected USB drives near target location.

• Cloud Security Considerations:

  • Shared responsibility model: Provider secures infrastructure; client secures data/configurations.

  • Key risks: Misconfigured storage (S3 buckets), insecure APIs, virtualization escapes, IAM policy flaws.

  • Testing requires cloud provider permissions and understanding of cloud-native controls (e.g., AWS Security Groups).

Common Vulnerabilities and Attacks

• SQL Injection Primary Risk:

  • Unauthorized database access → theft, modification, or deletion of sensitive data.

  • Potential for full system compromise via privilege escalation (e.g., xp_cmdshell in MSSQL).

  [!TIP] SQLi remains OWASP Top 1; always use parameterized queries/stored procedures.

• Social Engineering Attacks on Wireless:

  1. Rogue access points (evil twin) to intercept credentials.

  2. Phishing emails with links to fake Wi-Fi login pages.

  3. Pretexting (e.g., posing as IT support to obtain Wi-Fi passwords).

• Employee Training for Mitigation:

  • Regular security awareness programs (phishing simulations, policy workshops).

  • Fosters a security culture; employees become "human firewalls" against pretexting/baiting.

• HTTP Strict Transport Security (HSTS):

  • Forces browsers to use HTTPS only, preventing SSL stripping attacks.

  • Implemented via Strict-Transport-Security header with max-age and includeSubDomains.

  • Critical for protecting session cookies and sensitive data in transit.

Tools and Practices

• Vulnerability Scanning Tools:

  • Network: Nmap, Nessus, OpenVAS.

  • Web: Nikto, OWASP ZAP, Burp Suite (proxy).

  • Database: SQLmap, NoSQLmap.

  [!TIP] Scanners produce false positives; manual verification is essential.

• Capture the Flag (CTF) Competitions:

  • Simulate real-world scenarios (e.g., exploiting a vulnerable web app, forensic analysis).

  • Develop practical skills in a controlled, legal environment; cover diverse domains (crypto, forensics, web).

Reporting and Case Studies

• Primary Objectives:

  1. Identify and document vulnerabilities.

  2. Assess business risk (confidentiality, integrity, availability impact).

  3. Provide actionable remediation steps.

  • Case study: https://www.rgpvonline.com:

    • Objectives: Secure student/parent data (PII), prevent unauthorized access to exam results, ensure PCI-DSS compliance for payment portals.

• Documentation and Stakeholder Engagement:

  • Report structure: Executive summary, technical details (proof-of-concept), risk rating (CVSS), remediation roadmap.

  • Engagement: Present findings to both technical teams and management; align fixes with business priorities; ensure buy-in for remediation budget/timeline.

Cryptography and Secure Communication

Cryptographic Algorithms

• RSA Algorithm for Secure Communication:

  Key Generation:

  1. Choose large primes $p$, $q$; compute $$\displaystyle n = p \times q $$, $$\displaystyle \phi(n) = (p-1)(q-1) $$.

  2. Select public exponent $e$ (typically 65537) where $$\displaystyle 1 < e < \phi(n) $$ and $$\displaystyle \gcd(e, \phi(n)) = 1 $$.

  3. Compute private exponent $d$: $$\displaystyle d \equiv e^{-1} \mod \phi(n) $$.

  Encryption: $$\displaystyle c = m^e \mod n $$

  Decryption: $$\displaystyle m = c^d \mod n $$

  \boxed{m = c^d \mod n}

  Used for key exchange (TLS) or digital signatures. Minimum key size: 2048 bits.

• Decryption Concepts:

  • Symmetric: Same key for encryption/decryption (AES, ChaCha20). Fast, used for bulk data.

  • Asymmetric: Public/private key pair (RSA, ECC). Slower, used for key exchange/signatures.

  • Key management: Secure storage (HSMs, key vaults), rotation policies.

Implementation and Auditing

• Cryptography Audit Report Elements:

  • Scope and objectives.

  • Algorithms/protocols used (e.g., AES-256, TLS 1.3).

  • Key management lifecycle (generation, storage, rotation, destruction).

  • Implementation flaws (e.g., weak RNG, side-channel vulnerabilities).

  • Compliance with standards (FIPS 140-2, NIST SP 800-57).

  • Risk assessment and remediation recommendations.

• Stakeholder Engagement:

  • Involve developers, security officers, compliance teams, and business units early.

  • Ensures cryptographic solutions align with business requirements (performance, usability) and regulatory mandates (GDPR, HIPAA).

  • Critical for adoption and sustainable security posture.

Multimedia Security and Forensics

Multimedia Fundamentals

• Discrete Cosine Transform (DCT):

  • Converts spatial pixel data to frequency domain.

  • High-frequency components (edges, details) are quantized heavily → lossy compression (JPEG, MPEG).

  • Lossy nature: Irreversible; repeated compression degrades quality (generation loss).

• Virtual Reality as Multimedia:

  • Immersive, interactive 3D environments combining graphics, audio, haptic feedback.

  • Applications: Gaming, training simulations, virtual tours. Requires high bandwidth/low latency.

• Interdisciplinary Industry Mergers:

  • Apple: Hardware (iPhone) + software (iOS) + media (Apple Music, iCloud).

  • Sony: Electronics (cameras) + entertainment (movies, music).

  • Microsoft: Software (Windows) + gaming (Xbox) + hardware (Surface).

Quality of Service (QoS) in Multimedia

• Importance of Resource Management:

  • Ensures smooth playback, low latency, minimal jitter.

  • Managed resources: Bandwidth, CPU, memory, buffer space, battery (mobile devices).

• Factors Affecting QoS:

  • Network: Bandwidth, packet loss, jitter, latency.

  • Codec: Compression efficiency, computational complexity.

  • Device: CPU/GPU capabilities, screen resolution.

  • Server: Load balancing, CDN proximity.

• OS Layers for Hardware Resource Management:

  • Kernel: Direct hardware access, scheduling (e.g., Linux kernel).

  • Device drivers: Abstract hardware specifics (e.g., GPU driver).

  • System libraries: Provide APIs for applications (e.g., DirectX, OpenGL).

  [!TIP] Real-time OS (RTOS) prioritizes multimedia tasks to meet deadlines.

Security Attacks and Protection

• Active vs. Passive Attacks:

  | Type | Action | Multimedia Example | |----------------|-------------------------------------|-----------------------------------------| | Active | Modify, inject, disrupt data | Replay attack on video stream, DoS | | Passive | Monitor/eavesdrop | Sniffing unencrypted VoIP, traffic analysis |

• Multimedia Authentication:

  • Importance: Verifies integrity and source; combats deepfakes, tampering.

  • Mechanisms:

    • Digital watermarks (visible/invisible).

    • Digital signatures (hash + asymmetric encryption).

    • Blockchain-based timestamps (e.g., for video evidence).

Watermarking Techniques

• Visible vs. Invisible:

  • Visible: Overlaid logo/text; deters theft but may degrade aesthetics.

  • Invisible: Embedded in data (frequency domain); used for tracing, copyright proof.

• Scenario-Based Decisions:

Digital Forensics for Multimedia

• Digital Evidence Extraction Process:

  1. Identification: Recognize potential evidence (files, logs).

  2. Preservation: Create forensic image (bit-by-bit copy); compute hash (SHA-256) for integrity.

  3. Analysis: Use tools (EnCase, FTK, Wireshark, ExifTool) to extract metadata, recover deleted data.

  4. Documentation: Record all steps, tools, timestamps (chain of custody).

  5. Presentation: Court-ready reports with expert testimony.

• Metadata Significance:

  • Authentication: EXIF data (camera model, GPS, timestamps) can verify origin.

  • Analysis: Reveal editing history (software fingerprints), geolocation, device IDs.

  [!TIP] Metadata is easily altered; always cross-verify with file hash and content analysis.

• Printer and Scanner Forensics:

  • Role: Unique artifacts (e.g., printer banding, toner distribution, scanner sensor noise) can identify specific devices.

  • Case Study: Investigating a forged document—compare print patterns to known printer models to link to suspect's office printer.

• Audio Recording Authentication:

  • Methods:

    • Spectral analysis: Check for inconsistencies in frequency bands.

    • Background noise profiling: Match ambient noise to location/time.

    • Metadata verification: Creation date, device ID (if unaltered).

    • Chain of custody: Document handling from seizure to analysis.

  • Legal context: Requires expert witness to explain techniques and certainty level (Daubert standard).

• Need for Computer Forensics:

  • Investigate cybercrimes (data breaches, fraud).

  • Recover deleted/encrypted data.

  • Attribute attacks to threat actors.

  • Support litigation/discovery (e.g., e-discovery).

• Protocols in Multimedia Forensics:

  • Follow ISO/IEC 27037 for evidence identification/collection.

  • Use write-blockers to prevent alteration.

  • Maintain chain of custody logs.

  • Hash verification (SHA-256) at every step.

• Multimedia Content Forensics:

  • Detects manipulation (deepfakes, edited images/videos).

  • Techniques:

    • Error Level Analysis (ELA): Identifies areas with different compression levels.

    • JPEG ghosts: Artifacts from multiple saves.

    • Sensor pattern noise: Unique to camera sensors (like a fingerprint).

    • Consistency checks: Lighting, shadows, reflections.