Cybersecurity &
Digital Risk

Today you get to be the bad guy.

Most attacks don't break the lock.
They go around it.

Everything you build will be used in ways you didn't intend, by people who don't wish you well. That's not paranoia. It's a design discipline.

Somebody made
a phone call.

Attackers found an employee on LinkedIn, called the IT help desk pretending to be them, and asked for a login reset. Slot machines, room keys, and check-in went down across Las Vegas. MGM put the hit at about $100 million.

Nobody broke any encryption.

1. What are we building?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good job?

Adam Shostack. MGM's help desk was part of the system. Nobody asked question 2 about it.

Four emails.
Real or fake?

Talk with your pod for 20 seconds, then hands up. No reveals until all four.

• The display name vs. the address. "TCU IT Support" from a Gmail account
• Lookalike domains. rnicrosoft.com is r-n, not m
• The link vs. where it goes. Hover first; the corner of the screen tells the truth
• Manufactured urgency. "Closes in 24 hours" exists to stop you thinking

аррӏе.com

Every letter there is Cyrillic. A researcher registered it, and Chrome and Firefox displayed it as apple.com, pixel for pixel. Chrome fixed it in version 59.

Its real name is xn--80ak6aa92e.com. You can't always trust your eyes. A password manager won't autofill on a site it doesn't recognize.

A 17-year-old in Tampa
called Twitter's staff.

He pretended to be internal IT, got an employee's login, and reached an admin tool. Then Obama, Biden, Musk, and Gates all tweeted: send bitcoin, get double back. Three years in prison.

haveibeenpwned.com

Type your email. It lists every known breach your address was in.

xkcd.com/1286 · CC BY-NC 2.5

1. Your computer turns it into a hash: a fingerprint that can't be turned back
2. It sends only the first 5 characters
3. The site sends back every leaked hash that starts that way, about two thousand
4. Your computer finds the match on your own machine

The site never learns which one you were checking.

curl -s https://api.pwnedpasswords.com/range/5BAA6 | grep 1E4C9B93F3F0682250B6CF8331B7EE68FD8

52,372,427

• Use a password manager
• Never reuse a password
• Turn on two-factor

Everything so far attacked people.
Now let's attack code.

A real attack on a real website, running on my laptop. It's a practice site built to be broken.

admin'#

SELECT ... FROM credential
WHERE name='$input_uname' and Password='$hashed_pwd'

It builds a sentence by pasting in what you typed.

WHERE name='admin'#' and Password='...'

• My ' closed the quote early
• # means "the rest of this line is a comment"
• What ran: "give me the row named admin." No password check at all

The code couldn't tell data
from instructions.

I typed instructions into a box meant for data. That's the whole attack, and it has been the most famous bug on the web since 1998.

It's called SQL injection.

', salary='9999999

Every box that ends up in a SQL sentence is a door.

WHERE name = ? and Password = ?

The sentence goes to the database first, with blanks. The data goes separately. Nothing you type can become an instruction.

xkcd.com/327 · CC BY-NC 2.5

"Write a Python function that checks a username and password against a SQLite database."

Then read it. Find the line where the username goes into the SQL. Is it pasted into the string, or passed separately with a ?

Done early? Ask it: "Is this code vulnerable to SQL injection?" Does it fix the right line?

It writes fluent, confident code
that runs.

Your job is the part it can't do for you:
read it.

• Clubs: WiCS and CSS both run security events
• Jobs: security analyst, penetration tester, application security engineer, incident responder

Security is the job of thinking about
how everyone else's job gets abused.

Most attacks don't break the lock.

So think like the person going around it.