1
00:00:00,000 --> 00:00:06,120
Next up we have how to prepare for internet privacy at college by Patrick

2
00:00:06,120 --> 00:00:10,060
McKenna. Alright guys we're moving really fast I was trying to present some

3
00:00:10,060 --> 00:00:13,280
videos today and they're gonna be a little tricky but we'll work it out. So

4
00:00:13,280 --> 00:00:19,700
how many guys have been hacked? Excellent you should feel proud of that fact. How

5
00:00:19,700 --> 00:00:25,740
many of you guys are thinking about going to college? College is a den of scum and

6
00:00:25,740 --> 00:00:29,380
villainy and you're gonna be on networks with lots of interesting people and

7
00:00:29,380 --> 00:00:32,760
there's gonna be lots of interesting opportunities for bad people and so

8
00:00:32,760 --> 00:00:36,440
today I want to share a few tips on how to avoid getting hacked at college.

9
00:00:36,860 --> 00:00:40,020
College is a cool place because it makes a lot of sense there's gonna be some

10
00:00:40,020 --> 00:00:44,500
interesting opportunities for social engineers but these rules apply outside

11
00:00:44,500 --> 00:00:47,520
of college as well so if you're not thinking about college yet don't feel

12
00:00:47,520 --> 00:00:51,700
bad these rules still apply. So I'm gonna talk about six things today

13
00:00:52,640 --> 00:00:56,740
software updates, sharing your computer with other people, avoiding social

14
00:00:56,740 --> 00:00:59,360
engineering, airing privacy on the web,

15
00:00:59,360 --> 00:01:04,440
passwords, and application safety. So we'll bust into a bad thing, we'll talk

16
00:01:04,440 --> 00:01:07,980
about how to avoid the bad thing, and I'm gonna show you what the bad thing looks

17
00:01:07,980 --> 00:01:12,360
like so you'll also get to learn about some of the tools that bad guys use for

18
00:01:12,360 --> 00:01:15,540
doing the reverse engineering and the tools that the good guys use to keep

19
00:01:15,540 --> 00:01:22,420
people safe. So we're gonna do real-world stuff here please do not do anything on

20
00:01:22,420 --> 00:01:26,540
someone else's computer. You can do it on your own computer, you can do it on

21
00:01:26,540 --> 00:01:29,160
your friends computers with permission, but you

22
00:01:29,360 --> 00:01:33,220
never do this at a high school network. You never do this at college networks and

23
00:01:33,890 --> 00:01:40,060
always always always just stay focused on your own machine. So the number one

24
00:01:40,060 --> 00:01:44,240
thing that you can do to stay secure on the internet is software updates.

25
00:01:44,680 --> 00:01:51,800
Does anyone know what a software update is? Old people do. Do any young people do?

26
00:01:52,280 --> 00:01:58,760
Yeah? So that comes in two forms. There are operating system updates, so that's

27
00:01:58,760 --> 00:01:58,980
when your

28
00:01:58,980 --> 00:02:02,780
your Android or your iOS phone says, hey, I got a new version. And then there are application

29
00:02:02,780 --> 00:02:08,980
updates. You need to do both. If you see that your phone says that there are updates available,

30
00:02:09,320 --> 00:02:15,020
that's a really good thing. That means that that vendor is working hard to get security fixes out

31
00:02:15,020 --> 00:02:20,160
into your hands. So software updates, if you do nothing else, this is the bare minimum. As soon

32
00:02:20,160 --> 00:02:25,620
as they're available, you apply them. And in fact, this week, there's a nasty iOS bug that came out.

33
00:02:25,620 --> 00:02:30,960
It's actually a Broadcom bug that you can have your phone get attacked without actually attaching

34
00:02:30,960 --> 00:02:35,900
to a Wi-Fi network. A software update came out earlier this week. If you apply that update,

35
00:02:36,100 --> 00:02:40,040
you would be in a much safer state at DEF CON. So software updates are super critical.

36
00:02:41,920 --> 00:02:46,720
Now, why is this important? It's because there are tools that are out there that allow hackers

37
00:02:46,720 --> 00:02:52,840
to scan for vulnerabilities. And many of these tools are easy to run by people who are script

38
00:02:52,840 --> 00:02:55,540
kiddies. And so here I've got an example of

39
00:02:55,540 --> 00:03:00,620
an open source tool called OpenVAS that you can download. There are VM images that you can use to

40
00:03:00,620 --> 00:03:06,560
experiment with. And you can grab an IP address, point the scanner at that IP address, and find

41
00:03:06,560 --> 00:03:10,680
all the ways that you could potentially attack that device from a networking perspective.

42
00:03:12,040 --> 00:03:16,740
So the cool thing here is, again, if you do software updates, when somebody runs this scan

43
00:03:16,740 --> 00:03:21,240
against your computer, they're not going to have all these cool new ways to get access to it.

44
00:03:23,560 --> 00:03:25,380
So another cool thing you're going to run into,

45
00:03:25,540 --> 00:03:29,620
in college, is you're going to have friends who are going to have some reason that they can't use

46
00:03:29,620 --> 00:03:33,160
their own computer. And they're going to want to say, hey, can I come over and borrow your

47
00:03:33,160 --> 00:03:40,040
computer for a few hours to work on my term paper? That's really a good thing. You're probably

48
00:03:40,040 --> 00:03:44,760
making friends. And it's good to have trust with your friends. But it's also important to recognize

49
00:03:44,760 --> 00:03:49,500
that you're giving them a lot of power. Your friends could accidentally install malicious

50
00:03:49,500 --> 00:03:54,360
software, or they could be less friendly than you think, and they could install spyware on

51
00:03:54,360 --> 00:03:54,860
your computer.

52
00:03:55,780 --> 00:04:00,840
So that's a bad thing. They could copy sensitive files off of your computer. And they could also

53
00:04:00,840 --> 00:04:05,000
go through your browser and go through your browser history, grab cookies from your logged

54
00:04:05,000 --> 00:04:10,380
in websites. And they can even do things like extract passwords from your browser if you save

55
00:04:10,380 --> 00:04:15,180
your passwords in your browser. I'm hoping to show you that in a second. We'll see how that works.

56
00:04:17,420 --> 00:04:21,580
So it's a bad thing to share your computer. It's also a good thing. But there are ways to

57
00:04:21,580 --> 00:04:25,120
mitigate the risks. The one thing you can do is create temporary

58
00:04:25,540 --> 00:04:30,680
guest accounts for your friends. You never let them log in on your own account. And the

59
00:04:30,680 --> 00:04:34,480
reason is because no matter how good you think you are about keeping private files

60
00:04:35,000 --> 00:04:39,500
out of reach of your friends, you're going to make a mistake. So create an isolated guest

61
00:04:39,500 --> 00:04:44,780
account where people can make mistakes and it doesn't affect you. Never, ever share

62
00:04:44,780 --> 00:04:51,000
your password. Never set up network file sharing. Someday you're probably going to take computer

63
00:04:51,000 --> 00:04:55,260
science classes and you will learn about this. And there are safe ways to do it, but

64
00:04:55,260 --> 00:05:00,660
everyone forgets that they turned on file sharing. So the best rule of thumb is don't use file

65
00:05:00,660 --> 00:05:04,780
sharing. Set up a separate server. Do something with a Raspberry Pi so you don't accidentally

66
00:05:04,780 --> 00:05:10,160
share your whole computer. And then, again, don't ever let them use their computer under your own

67
00:05:10,160 --> 00:05:18,020
account. Oh, and one other thing. I know a lot of kids are interested in, like, incognito mode or

68
00:05:18,020 --> 00:05:24,020
the private modes on the browsers. And how does that protect your privacy? And the thing is what it

69
00:05:25,540 --> 00:05:30,460
can do is it can make your cookies go away so that nobody knows what sites you previously logged into.

70
00:05:30,780 --> 00:05:36,860
But it's still not technically private. The web server knows that your IP address accessed

71
00:05:36,860 --> 00:05:43,460
that site at a time. They know what resources you accessed. Do not track is kind of an agreement.

72
00:05:43,880 --> 00:05:48,940
And not all websites have to honor the do not track rules. So it's a thing that kind

73
00:05:48,940 --> 00:05:53,980
of keeps your local account safe. But if you're using guest accounts, that's the thing to

74
00:05:53,980 --> 00:05:54,200
do.

75
00:05:54,980 --> 00:06:01,740
Incognito mode is not really an effective privacy strategy. So I'm going to post my slides

76
00:06:01,740 --> 00:06:05,840
online later because obviously these URLs are crazy. But if you don't know how to create guest

77
00:06:05,840 --> 00:06:10,680
accounts in Windows or Mac OSX, there are great instructions online from Microsoft and Apple on

78
00:06:10,680 --> 00:06:17,620
how to do that. Okay. So I want to show extracting a password from an existing browser session.

79
00:06:17,900 --> 00:06:21,340
We'll see how this works. This might not work. Okay. So it's not going to work. But what I'm going

80
00:06:21,340 --> 00:06:24,180
to tell you is you can use a browser. You can use a browser. You can use a browser. You can use a

81
00:06:24,180 --> 00:06:30,480
Chrome DevTools to go into a website that has the password stored in it. And you can use DevTools

82
00:06:30,480 --> 00:06:36,280
to change a div type of a password input field. That's the thing that makes the stars to a text

83
00:06:36,280 --> 00:06:42,020
input field. And so immediately when you go back into the browser, you're going to see the password

84
00:06:42,020 --> 00:06:47,000
that whoever logged in or stored their password, what they used. And so this is just like one

85
00:06:47,000 --> 00:06:51,780
example of a way a credential can get taken off of a device. There are some other interesting ways

86
00:06:51,780 --> 00:06:52,160
as well.

87
00:06:54,180 --> 00:06:57,340
So another thing I want you to think about is you're going to get to go to college

88
00:06:57,340 --> 00:07:01,360
and you're going to have an orientation experience and people are going to do all this cool ice

89
00:07:01,360 --> 00:07:07,720
breaking. And what's interesting is for a social engineer that's a crazy opportunity. So social

90
00:07:07,720 --> 00:07:13,440
engineers, they manipulate people into persuading them into giving up sensitive information. And so

91
00:07:13,440 --> 00:07:17,900
on your first day at college, when people are trying to make new friends, they're going to have

92
00:07:17,900 --> 00:07:24,160
these group sessions where people ask you questions like, where did you grow up, what kind of

93
00:07:24,180 --> 00:07:28,980
kind of music do you like? Do you have any pets? Is there a favorite book or a movie? And I'm sure

94
00:07:28,980 --> 00:07:33,580
you guys probably already share that kind of information with your friends anyways. But as you

95
00:07:33,580 --> 00:07:39,100
get older and you start creating accounts on websites and banking sites, you're going to be

96
00:07:39,100 --> 00:07:43,620
asked password reset questions. And all of the types of questions that are going to be coming

97
00:07:43,620 --> 00:07:49,020
around in college orientation are going to get populated here. And so the secret here is you

98
00:07:49,020 --> 00:07:54,940
don't use password reset questions like this. This is from Yahoo and what's cool about Yahoo is

99
00:07:54,940 --> 00:08:00,300
they have the opportunity to type your own question in here. So when we craft that question,

100
00:08:00,520 --> 00:08:06,380
it should make no sense to anyone but you. No one should be able to reverse engineer what

101
00:08:06,380 --> 00:08:10,720
question or what the answer was to your question. Not all websites use this, so you're going to

102
00:08:10,720 --> 00:08:16,840
have to use some other strategies as well. Another thing is watch your e-mail. If you are

103
00:08:16,840 --> 00:08:19,000
seeing password reset e-mails, unexplored, you're going to want to make sure that you're

104
00:08:19,000 --> 00:08:21,320
checking your e-mail. If you're checking your e-mail unexpectedly, don't do anything with

105
00:08:21,320 --> 00:08:25,660
those. That might be a phishing e-mail, but it also might be telling you that one of your

106
00:08:25,660 --> 00:08:30,880
hacker friends is bumping your account and they're trying to see whether or not they can get

107
00:08:30,880 --> 00:08:35,700
access to your account. So password resets, they're not necessarily bad, but if you aren't

108
00:08:35,700 --> 00:08:41,000
expecting them, delete them, ignore them, and move on. You might even consider changing your

109
00:08:41,000 --> 00:08:48,480
account on the existing application. You should know about hovering over links to validate

110
00:08:49,000 --> 00:08:53,540
that a link actually goes to a given address. So in this example, you know, we've got free

111
00:08:53,540 --> 00:08:58,540
Rolex watches.com in the browser, but if you actually hover over, it's going to go to PC world.

112
00:08:58,820 --> 00:09:06,200
And this is a common thing for phishers to be using. So be careful about your password reset

113
00:09:06,200 --> 00:09:13,260
questions. Does everyone know what two factor authentication is? Yes, yes, yes. Yes. So make

114
00:09:13,260 --> 00:09:18,960
sure your e-mail, your social network accounts, those that support it, set up two factor

115
00:09:19,000 --> 00:09:29,260
authentication, either with SMS or with an independent mobile app. Yeah. Two factor

116
00:09:29,260 --> 00:09:35,080
authentication is when you log into a site, you submit your username and your password, and

117
00:09:35,080 --> 00:09:40,880
then it sends a second message to you in an independent channel to validate that someone

118
00:09:40,880 --> 00:09:46,560
didn't steal your password. So if I know your phone number, if you log into my website, you

119
00:09:46,560 --> 00:09:48,980
submit your password, I know you might be you. So if I know your phone number, if you log into my

120
00:09:49,000 --> 00:09:52,520
website, I know you might be you. But I'm going to send a text message to your phone under the

121
00:09:52,520 --> 00:09:56,500
theory that no one stole your phone, and it's going to have a number in it, and then you're

122
00:09:56,500 --> 00:10:01,480
going to enter that number into the web field, and that's the second factor. This is the second

123
00:10:01,480 --> 00:10:07,980
proof of your identity. It's not foolproof, but it is the basic thing you should do for all e-mail

124
00:10:07,980 --> 00:10:15,940
and social networks. Okay. So the next thing is, you know, a college network is going to have

125
00:10:15,940 --> 00:10:18,980
lots of computer science students on it, and they can scan the network, and they can scan the

126
00:10:19,000 --> 00:10:23,560
internet, and they might even be able to intercept traffic. So the big thing is, you want to know

127
00:10:23,560 --> 00:10:33,060
how to troubleshoot or validate HTTPSs in play. So the big thing is, you should know how to look at

128
00:10:33,060 --> 00:10:39,860
the browser bar and identify bad SSL. So there's a website, badSSL.com, that shows you all of the

129
00:10:39,860 --> 00:10:45,920
different types of TLS certificate errors, so you can go and see a bunch of them. Is this first site

130
00:10:47,900 --> 00:10:48,980
secure? Why is it secure? I don't know. I don't know. I don't know. I don't know. I don't know. I don't

131
00:10:48,980 --> 00:10:56,200
know. I don't know. I don't know. Why is it secure? Because why? Because it says secure.

132
00:10:56,420 --> 00:11:03,540
Right. Trustworthy internet. It's secure because the browser does a cert exchange and validates a

133
00:11:03,540 --> 00:11:10,680
cert. This green icon in Mozilla Firefox, that is engineered to never show up unless the cert is

134
00:11:10,680 --> 00:11:17,760
properly validated. What's funny is that there's other HTTPS site here, mixed.badSSL, no green icon.

135
00:11:17,760 --> 00:11:23,160
Clearly using HTTPS. But what's happening is that there's some unencrypted content on that

136
00:11:23,160 --> 00:11:29,180
website. So always know how to check the browser bar and look for the green lock. If you don't do

137
00:11:29,180 --> 00:11:38,200
that... If you don't do that... So here we have a web form, and obviously no HTTPS, no green lock.

138
00:11:38,440 --> 00:11:45,240
And it's asking for a password. So in this scenario, someone who is on the network running a tool

139
00:11:45,240 --> 00:11:47,740
called Wireshark is able to intercept that permission because that significa you signed up to the

140
00:11:47,740 --> 00:11:56,180
traffic. My videos aren't playing but in a Wireshark session it's two packets. It's very easy

141
00:11:56,180 --> 00:12:01,140
to see the password that was submitted when I hit submit. And in this case my password is my

142
00:12:01,140 --> 00:12:06,980
password with a zero. Super trivial. You guys can do this on your own computers right now if

143
00:12:06,980 --> 00:12:11,720
you set up an unencrypted website. So it's super easy to extract secrets from unencrypted

144
00:12:11,720 --> 00:12:20,840
session. So we always look for the green lock in TLS. So you're not always responsible for a

145
00:12:20,840 --> 00:12:24,980
stolen password. You can do everything right and a website can still get compromised and your

146
00:12:24,980 --> 00:12:31,180
account can get hacked. So plan for the fact that your passwords will get stolen. Make sure that

147
00:12:31,180 --> 00:12:37,300
you never, ever reuse a password on a different site. Don't create your own personal algorithm for

148
00:12:37,300 --> 00:12:41,700
Patrick.facebookpassword. Patrick.gmailpassword. Patrick.gmailpassword. Patrick.gmailpassword.

149
00:12:41,720 --> 00:12:47,900
Use password management tools to generate random passwords and set them up to sync to your mobile

150
00:12:47,900 --> 00:12:52,920
device so you always have access to them. A cool site, you can submit your e-mail address to

151
00:12:52,920 --> 00:12:59,440
haveibeenpwned or not.com to see whether or not any sites have lost your account information.

152
00:13:02,480 --> 00:13:08,200
This is cool. So when I was about your guys' age I started reading IETF RFCs to try to

153
00:13:08,200 --> 00:13:11,700
understand how the internet works. So again I'll share these links later. If you're interested in

154
00:13:11,720 --> 00:13:16,320
this is super advanced reading but it's never too soon to start reading the

155
00:13:16,320 --> 00:13:22,560
specs that actually define how the internet works. Another cool thing you

156
00:13:22,560 --> 00:13:25,540
can do is actually check certs but because my videos aren't working that's

157
00:13:25,540 --> 00:13:30,960
not going to show so you can troubleshoot why you see a red lock

158
00:13:30,960 --> 00:13:38,260
even when you go to an HTTPS site if you know how to check certificates. Okay so

159
00:13:38,260 --> 00:13:44,740
second to last is mobile safety so apps that's the big topic. Jailbreaking or

160
00:13:44,740 --> 00:13:48,800
rooting your phone breaks all of your security and privacy assumptions so

161
00:13:48,800 --> 00:13:52,440
while that's a powerful tool and you can learn interesting things just understand

162
00:13:52,440 --> 00:13:58,700
that you are damaging your security when you do that. In the Android world you can

163
00:13:58,700 --> 00:14:02,680
install applications outside of the Play Store using unknown sources. It allows

164
00:14:02,680 --> 00:14:06,460
you to download apps from the browser. Some of you may have used that to find

165
00:14:06,460 --> 00:14:07,260
pirated games.

166
00:14:08,260 --> 00:14:11,120
This is always dangerous. This is the way that people get malware in the

167
00:14:11,120 --> 00:14:16,620
Android ecosystem so be very wary about using unknown sources. Pay

168
00:14:16,620 --> 00:14:19,340
attention to your app permissions so it's going to say I'm going to use the

169
00:14:19,340 --> 00:14:22,060
microphone, I'm going to use the camera. If you're not comfortable with that

170
00:14:22,060 --> 00:14:28,080
don't install the app. One thing I know a lot of kids like snapchat you know

171
00:14:28,080 --> 00:14:31,740
these pictures they will eventually expire. If you send an expiring picture

172
00:14:31,740 --> 00:14:38,200
to a jailbroken phone they can break how the the photo expiration works. So

173
00:14:38,260 --> 00:14:43,360
I don't think that using expiring photo sharing apps is ever a good idea. Those

174
00:14:43,360 --> 00:14:48,600
those photos will never stay private and yeah so and the problem is again you'll

175
00:14:48,600 --> 00:14:51,320
never know if you're sending something to someone with a jailbroken phone.

176
00:14:53,520 --> 00:14:57,940
Okay so that's basically it. So the six rules here keep your software up to date

177
00:14:57,940 --> 00:15:02,760
OS and applications. Don't share access to your computer except for using a

178
00:15:02,760 --> 00:15:08,140
guest account. Be careful about social engineering. Always check for SSL. Don't

179
00:15:08,140 --> 00:15:12,780
reuse passwords ever and think twice about which apps you trust. If you're

180
00:15:12,780 --> 00:15:18,220
interested I will share a link to my presentation on Twitter later. This is my

181
00:15:18,220 --> 00:15:21,500
contact information. I hope this was helpful. Thanks everybody have a great

182
00:15:21,500 --> 00:15:21,840
Roots.