your exercise iLab 1+2 info event online Tell your friends! - PowerPoint PPT Presentation

The iLab Experience a blended learning hands-on course concept you set the focus Final Lecture Marc-Oliver Pahl, Jul 25, 2017 your exercise

iLab 1+2 info event online • Tell your friends! • https://www.net.in.tum.de/teaching/ws1718/ilab_information.html

your exercise 25.4. Kick Off, Mini Labs, IPv6 - part I 1 2-3 mini labs IPv6 2.5. IPv6 - part II, Mini Lab Lectures 2 9.5. MiniLabs, BGP 3 Your Exercise Mad Brainstorming 16.5. BGP 4 Advanced Wireless Playground YE Topic Presentation and Voting, Advanced WL 23.5. 5 Modern Cryptography 30.5. World-Wide-Web Security Holes 6 SEC 8.6. DIY1 - Smart Space HW 7 S2O 1 13.6. DIY2 - Smart Space SW 8 S2O 2 20.6. YE Didactics and Techniques 9 27.6. 10 YE 1st Lecture 4.7. 11 Giving good Feedback Your Exercise (11.7.) 12 summer term 2017 18.7. YE Review Presentation 13 25.7. YE Final Presentation, Wrap-Up 14 15

Introductory Lecture didactic concept | authoring tutorial | topic selection | assignment review teams ~2h * ~30-35h Team Prepares Exercise slides for talk | prelab | lab | slides | tutor support Internal Tests ~2h First Lecture Presentation Student Run presentation | feedback | quality alignment Revision ~20-25h Review Feedback review another team ~2h Received Feedback Pres. presentation | feedback | quality alignment Revising new lab ~20-25h updating learning material Somehow “Stable” Final Presentation ~2h how is it now | what did you change/ learn | your take home?

wikimedia: Biser Todorov I give you some tools and experience

Learn from each other…

Topic Brainstorming Result May 16, 2017

Topic Voting Event May 23, 2017

2017-07-04 First Lecture - What was good? What could be improved?

2017-07-04 Giving Feedback - What do you know about Feedback?

2017-07-04 Giving Feedback - What are your open Challenges?

2017-07-18 Review Reporting - What are your main Points for PreLab, Lab, and other aspects?

Expected Artefacts Deadline • your exercise X • Week -5: • 2 slide decks for your two • Prepare your 2x3 min talks topic presentations (each talks one topic!) 22.5. • Week -4: • • Plan the structure and content of your lab, prelab, and lecture. Creation of Lecture, PreLab, Lab 19.6. • Week 1: • • Lecture Preparation (most relevant concepts?) • Prelab Preparation (detailing the lecture content + tools + more) X • Slide deck lecture (2 talk!) • Practical Part Lab Preparation (no cooking recipe) 26.6. • Week 2+3: X • Ready PreLab, Lab • Work on your content. 11.7. • Week 4: X • Review report • Review other team • Get reviewed by other team X • Slide on review feedback & • Start improving based on the feedback peer grading planned improvements 18.7. • Week 5: X • Final lecture slides • Improve your exercise based on the feedback Revision X • Final PreLab, Lab, Peer Grade 25.7. • Week 6: • Finish your lab and the review reports. 30.7. Marc-Oliver Pahl 2017

The Peer Review You will grade your reviewed team. http://www.utahcompose.com/sites/utahwrite/files/peer%20review%20kids.jpg

you set the focus Your Final Lecture 15 (+1) Minutes The iLab Experience a blended learning hands-on course concept

You make it interesting… Flickr:nist6dh

Order of Presentations Team Topic 201 Email spoofing 202 War Rooms! 203 Hiding in plain sight

create your own exercise Armin Baur & Moritz Kellermann EMAIL SPOOFING MY BANK NEEDS MY PASSWORD 1

Motivation • Email Spoofing – My Bank needs my Password • Sender email address can be spoofed easily – People trust the sender address – Spam can be send on behalf of others • Messages can be manipulated 2

SMTP • Simple Mail Transfer Protocol ( SMTP ) • First RFC published August 1982 • Original design of SMTP has no facility to authenticate sender 3

SMTP MUA Mail User Agent MSA Mail Submission Agent MTA Mail Transmission Agent MDA Mail Delivery Agent 4

Email Header 5

Security Mechanisms • Sender Policy Framework ( SPF ) • DomainKeys Identifed Mail ( DKIM ) • Domain-based Message Authentication, Reporting and Conformance ( DMARC ) 6

SPF CC BY-SA 2.5: openspf.org • Checks that incoming mail from a domain comes from a host authorized by that domain • Authorizes hosts by IP addresses via DNS – TXT Resource Record – SPF Resource Record (obsolete) source.tld TXT = "v=spf1 ip4:192.0.2.0/24 mx a –all" 7

Spoofing MTA ( Return-Path ) 8

SPF 9

DKIM • Cryptographic signing of outgoing email • Prevents email manipulation • Public key is published via DNS – TXT Resource Record unknown._domainkey. source.tld TXT = "DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeo/3jmZJii2wKBBpCiE 10

DMARC CC BY 3.0 : dmarc.org • Prevents spoofing of email addresses • Requests reports about spoofed email • Publishes the DKIM signing policy of a domain – TXT Resource Record _dmarc. source.tld TXT = "v=DMARC1; p=reject;" 11

Spoofing Sender Email ( From ) 12

DMARC/DKIM 13

Lab • Analysing email headers • Spoofing MTA host address • Spoofing email address • Configure SPF , DKIM and DMARC 14

Teaser Practical Part (DNS) Switch Eve (MTA) Alice Bob (MTA + (MTA + MDA) MDA) 15

Order of Presentations Team Topic 201 Email spoofing 202 War Rooms! 203 Hiding in plain sight

create your own Andreas Janiak and Donika Mirdita exercise WAR ROOMS! 1

What is War Rooms? Is inspired from the game over the wire, and was meant to learn and practice security concepts within a secure environment. The name was derived from the rooms = current pc and the battle against the system to win the victory file. http://overthewire.org 2

Motivation • Be comfortable working with the command line • Know how to debug and explore – Incomplete knowledge of networks – Handle unknown environments • Learn to use new tools • Improve skills with the old tools 3

Lecture Overview 1.IPv4/IPv6 Recap 2.Systemd-Networkd deamon 3.Linux tools 4.OverTheWire Demo 4

IPv4/IPv6 Recap Networks need to be able to interact with a variety of host configurations: • IPv4 and IPv6 compatibility • Dual Stack IPv4/IPv6 support • Gateway and Broadcast addresses • Routing for the Internet 5

Introduction to Systemd Linux service and system manager. • Runs as PID 1; starts the rest of the system • Enables control over daemons • Built-in daemons for logging and system configuration https://wiki.archlinux.org/index.php/systemd 6

Systemd Tools 1.Systemctl - manager for systemd 2.Journalctl - logging system 3.Systemd-networkd - network manager 4.Hostnamectl - system hostname manager 5.Services - Service Unit Configuration https://www.freedesktop.org/software/systemd/man/ 7

Linux tools • ssh, sshpass → secure shell • find → search data • grep → searches content • | → pipelines • nmap → network discovery and security tool 8

Over the wire demo Demo... 9

Teaser Practical Part 6 1 2 4 3 5 10

Order of Presentations Team Topic 201 Email spoofing 202 War Rooms! 203 Hiding in plain sight

https://www.youtube.com/watch?v=4vlu8ld68fc https://www.youtube.com/watch?v=4vIu8ld68fc

reate your own exercise Yoav Schneider Hiding in plain sight 2

Covert Channels  De%nition  How to encode and decode data  Examples  Detection and Prevention 3

Covert Channels „In computer security, a covert channel is a type of computer security attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy” https://en.wikipedia.org/wiki/Covert_channel 4

Scenario  Leak Data  Control computers in a botnet  Distribute Malware 5

„The Medium is the Message”  Protokol  Data  Timing  Physical  Fan speed  Blinking leds Marshall McLuhan, 1964 6 Source : https://en.wikipedia.org/wiki/File:Marshall_McLuhan.jpg

„The Medium is the Message”  Protokol  Data  Timing  Physical  Fan speed  Blinking leds Source : https://en.wikipedia.org/wiki/File:Marshall_McLuhan.jpg 7

„The Medium is the Message”  Protokol  Data  Timing  Physical  Fan speed  Blinking leds 8

„The Medium is the Message”  Protokol  Data  Timing  Physical  Fan speed  Blinking leds Source (left) : https://en.wikipedia.org/wiki/File:Benjamin_Franklin2_1895_Issue-1c.jpg Source (right): own work using: http://manytools.org/hacker-tools/steganography-encode-text-into-image/go 9

„The Medium is the Message”  Printer Watermarks Source : https://pixabay.com/p-161063/?no_redirect 10

„The Medium is the Message”  Protokol Source : https://en.wikipedia.org/wiki/Transmission_Control_Protocol 11

„The Medium is the Message”  Example: Send “0x12345678” using the source port 0x1234 Source : https://en.wikipedia.org/wiki/Transmission_Control_Protocol 12