12/01/1999joe lewis - xcert international inc. who’s peeking at your files? a guide to personal...
TRANSCRIPT
12/01/1999Joe Lewis - Xcert International Inc.
Who’s Peeking at Your Files?
A Guide to Personal Data Security
Some Possible Threats
• Email Interception
• Email Spoofing
• Web Data Interception
• Network & Volume Invasion
• Marketing Data / Spam & Junk Mail
• Viruses, Worms, Trojan Horses
• Password Cracking
More Possible Threats
• Mail bomb
• Denial of Service (DoS)
• Piracy of Intellectual Property
Email Interception
Methods• Script Monitor
– Running a script on a server that receives email traffic, monitoring emails for certain keywords or number patterns. (I.E. “bomb + president” or credit card number patterns)
• Account Emulation– Stealing someone’s user id and
password to gain access to their email account.
Defenses• Digital Certificates
– Digital certificates authenticate you as the sender and are extremely difficult to forge. Allows very strong encryption of email communications.
• PGP– “Pretty Good Privacy” allows
strong encryption of your text. Can be incorporated easily into any text oriented program.
Standard Encryption
• Text is encrypted and sent by the originator• Ciphertext is decrypted by recipient• Same key is used for encryption and decryption• If key is intercepted or deciphered, encryption becomes useless
– This is how WWII was won...
Strong Cryptography
• “There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. This book is about the latter.” -- Bruce Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C.
• 40 bit cryptography is considered weak. This can be intercepted and deciphered in seconds using today’s tools.
• By contrast, 128 bit cryptography is considered technically infeasable to crack. Most banks require a 128 bit browser for online banking.
Dual Key Cryptography
• Key pair is generated - public and private key.
• Public key is sent to server and exchanged with others
• Private key is guarded by the user
Dual Keys Continued
• Encrypted message is generated using recipients public key and your private key.
• Only the intended recipient with the corresponding private key will be able to decrypt.
• NSA hates this to be in the hands of the general public… but you have the right to privacy.
What is a Digital Certificate?
• Acts as a virtual signature
• Very hard to forge
• Can be used for encryption or authentication
• Resides in the Browser/Email Client/OS
• Free digital certificates are available
• PGP Freeware is available
(X.509)
What is PGP?
• Created by Phil Zimmerman– PGP is now a subsidiary of Network Associates
• Secures e-mail and files
• Based on “Public Key” Cryptography
• Users whom have never met can exchange encrypted documents.
• Freeware
How To Encrypt a Message (1)
This will describe how to encrypt a
message using Digital Certificates with Netscape Communicator.
• Obtain and install a certificate using the step by step instructions at the issuing website.
Clicking on the Security button in Netscape Communicator opens the Security Window below:
How To Encrypt a Message (2)
• Users must exchange “public keys”.
• Can be done via LDAP directory or email exchange.
An email that has a digital certificate attached will display this icon in Communicator. You can click on the icon to examine the cert. Certs emailed to you are automatically added to Communicator’s database.
You can search for certificates on public directories (LDAP) directly from within Communicator
How To Encrypt a Message (3)
• Once keys have been exchanged, address an email to the other party.
• Click on the Security button and select the option for encrypting message.
• That’s it!
Email Spoofing
• Happens when someone impersonates an email user, sending messages that appear to be from the victim’s email address.
• Spoofing can be prevented by using your Digital Certificate or PGP to “Digitally Sign” your email message.
• Even Certificates can be spoofed, although difficult. Check the “Certificate Fingerprint” of the message to be sure it’s authentic.
Certificate Fingerprint:E4:58:C8:8F:B5:90:4C:AC:AB:79:9C:6A:32:0C:3E:4E
Shopping Securely
• You should never input sensitive info such as Credit Card numbers into a non-secure website.
• Make sure website is certified by a trusted Certificate Authority (CA) List of default trusted CA’s in Communicator
How to Shop Securely
• When you enter a secure site, Communicator’s Security icon will change as shown:
• Click on the Security button to examine which CA asserts that this site is safe.
Note: Attempting to enter a secure site that is not signed by a valid or default CA will result in a cautionary error message.
Hacking In to Your Computer
• DSL and Cable internet access means round the clock connections of home and small business computers to the Internet.
• Greatly increases the chance of attack.
• Physical access is always a danger, too.
• Hackers can gain access to your personal files, Quicken data, etc.
Stopping Hackers
• Set up a personal/home firewall.
• Encrypt your sensitive files!!!– PGP, all platforms.– Mac OS 9 Built-In Encryption Feature
• Don’t give out your passwords to anyone!
• Use difficult passwords - not simple dictionary style words.
Password Strength
• Simple words out of a dictionary make bad passwords.
• Use mixed upper and lower case characters.
• Use non-alphanumeric characters such as:~!@#$%^&*()_+=-{}[]|\:;”’/?.>,<`
• Avoid sharing passwords, even with friends and family.
Password Strength Examples
• Using a simple passphrase such as “coffee” is simple to hack, takes about 40 minutes to break.
• Using random alphanumerics is significantly more difficult: A passphrase such as “bR1a9Az” takes about 22 years to crack.
• Using the full range of the keyboard with truly random characters is totally infeasible to crack. A passphrase like “,ThX1pD<V+” would take 3.8 x 10
8 years to crack.
Key Strength Comparison
• Most browsers ship with a default of 40 bit encryption capabilities.
• You must upgrade to a 128 bit encryption capable browser for most online banking.
Key Length (bits)
Individual Attacker Small Group
Academic Network
Large Company
Military Intelligence Agency
40 weeks days hours milliseconds microseconds
56 centuries decades years hours seconds
64 millenia centuries decades days minutes
80 infeasible infeasible infeasible centuries centuries
128 infeasible infeasible infeasible infeasible millennia
Strong Encryption Browsers
• Netscape Communicator is freely available for all platforms with 128 bit encryption capability and full features.
• 128 bit capable version of Microsoft Internet Explorer is available for Windows and Macintosh. (Mac version has limited features.)
• You may have to install additional plug ins to get 128 bit capabilities out of MSIE.
Viruses
• Computer viruses are 100% man made.
• Can be transmitted via email, disk, network, etc…
• Most are harmless experiments.
• Some are intended to wreak havoc on individuals and networks.
Virus Protection
• Get a virus protection package and install it on your computer.
• Check the vendor’s website for downloadable updates and alerts on new viruses.
• Don’t open email or attachments from unknown sources.
