CNIT 120: Network Security

Summer 2018 Sam Bowne

Slides · Projects · Links · Home Page

New Scores

Archived Scores from WCIL May, 2018

Catalog Description

Knowledge and skills required for Network Administrators and Information Technology professionals to be aware of security vulnerabilities, to implement security measures, to analyze an existing network environment in consideration of known security threats or risks, to defend against attacks or viruses, and to ensure data privacy and integrity. Terminology and procedures for implementation and configuration of security, including access control, authorization, encryption, packet filters, firewalls, and Virtual Private Networks (VPNs).

Advisories: Students should have taken CNIT 106 or 106C or 201E, or equivalent familiarity with the fundamentals of networking.

Upon successful completion of this course, the student will be able to:

Define areas of security concern, discuss network security, and identify network risks.
Distinguish between and define internal and external threats to data and services.
Describe the vulnerabilities of various media (susceptibility to wiretaps or eavesdropping).
Secure access to resources on the network using passwords, permissions, and access control lists (ACLs).
Evaluate various anti-virus software programs, software firewalls, and hardware firewalls.
Define and identify types of firewalls, including Network Address Translation (NAT).
Discuss weaknesses of various operating systems and known and recommended fixes (patches).
Detect unauthorized attempts to access resources by monitoring (auditing).
Install and configure intrusion detection programs; analyze reports and recommend responses.
Provide solutions for known vulnerabilities in communications: email, remote access, file transfer, and electronic commerce.
Provide end-to-end security for the transmission of data between hosts on the network.
Describe vulnerabilities inherent in wireless technologies and present suggested solutions.

Student Learning Outcomes (measured to guide course improvements)

1. Define areas of security concern, discuss network security, and identify security risks
2. Evaluate various anti-virus software programs, and compare to software and hardware firewalls
3. Discuss weaknesses of various operating systems and known and recommended fixes (patches)

Lectures

1. Mastering Security Basics
2. Exploring Control Types and Methods
Ch 12: Cryptography · KEY · PDF (rev. 11-22-17)
The lectures linked above are in PowerPoint format.
If you do not have PowerPoint you can use
Open Office.

Projects

Fundamental Skills

S1: Preparing a Kali Virtual Machine (15 pts.)
S2: Essential Linux (15 pts.)
S3: Binary Games (Up to 35 pts.)

Attacks & Defenses

S4: Command Injection (15 pts.)
S4x: Command Injection Challenges (25 pts.)
S5: SQL Injection (20 pts.)
S6: Intro to Burp (15 pts.)
S7: SAML (15 pts.)

picoCTF
General CTF Prep

Additional Projects

S7: Defeating Client-Side Validation with Burp (15 pts.)
Project 4: Zed Attack Proxy (20 pts.)
Project 9: reCAPTCHA (15 pts.)
Project 9: MD5 Hash Collisions (15 pts.) (updated 2-17-16)

Other Slides
3. Understanding Basic Network Security 4. Securing Your Network 5. Securing Hosts and Data 6. Understanding Malware and Social Engineering 7. Identifying Advanced Attacks 8. Managing Risk 9. Preparing for Business Continuity 10. Understanding Cryptography 11. Exploring Operational Security
The lectures linked above are in PowerPoint format. If you do not have PowerPoint you can use Open Office, or get them in HTML form from Github (ty sonokamome).

Other Projects
Project 5: Mapping an Application with Burp (15 pts.) Project 6: Making a Linux Virtual Machine (15 pts.) (rev. 2-14-18) Project 7: Using Tripwire for Intrusion Detection (15 pts.) Project 10: Exploiting ECB-Encrypted Tokens with Burp (15 pts.) Project 11: SQL Injection 2 (10 pts.) Project 12: PHP Insecurities (10 pts.) Project 13: Automating Web Requests with Python (15 pts. + 30 Extra Credit) Project 14: Logic Flaws (15 pts. + 20 pts. Extra Credit) Project 15: XSS (15 pts.) Project 16: SAML (15 pts.) Project 3x: DNSCrypt on Windows (15 pts.) Project 4x: Encrypting Text in ECB and CBC Modes (15 pts.) Project 5x: Exploiting ECB Encryption (35 pts.) Project 6x: Protecting SSH with Fail2Ban (15 pts.) Project 7x: Protecting a Server with iptables and iptstate (10 pts.) (Updated 11-8-16) Project 8x: Exploit Hackazon (20 pts.) Project 9x: XSS Extra Credit (25 pts.) (Rev. 4-2-18) Proj 11x: Stealing Cookies with XSS (10 pts.) (New 4-23-18) Project 1: Firefox and NoScript (10 pts.) (rev. 9-11-14) Project 2: HijackThis (10 pts.) (rev. 1-28-16) Project 3: Sniffing Passwords with Wireshark (10 pts.) (rev. 1-30-14) Project 4: Port Scans and Windows Firewall (20 pts.) (rev. 8-21-12) DOC Project 5: WOT (Web of Trust) (10 pts.) (rev. 2-17-16) Project 6: Blocking Ads with the Hosts File (15 pts.) (rev. 1-26-15) Project 7: Hashes and Digital Signatures (15 pts.) (rev. 3-4-14) Project 12: Nessus (15 pts.) Project 13: Intro to Docker (15 pts.) Project 14: Gmail 2-Factor Authentication (10 pts.) Project 15: Snort (15 pts.) (Updated 10-1-15) Project 16: Encipher It (10 pts.) Project 17: Making a Linux HTTPS Server (10 pts.) (rev. 9-22-15) Project 18: Encrypting an Image in ECB and CBC Modes (15 pts.) (new 11-12-15) Project 2x: XSS with Google Gruyere (15 pts.) Project 3x: Privilege Escalation with Google Gruyere (10 pts.) Project 4x: Performing an HTTPS DoS Attack (10 pts.) Project 5x: CodeCademy Command Line Course (15 pts.) Project 6x: Bandit Wargame (up to 27 pts.) Project 11x: SQL Injection Challenges (Up to 30 pts.) Project 12x: SHA-3 (15 pts.)

Other Projects

Project 5: Mapping an Application with Burp (15 pts.)
Project 6: Making a Linux Virtual Machine (15 pts.) (rev. 2-14-18)
Project 7: Using Tripwire for Intrusion Detection (15 pts.)
Project 10: Exploiting ECB-Encrypted Tokens with Burp (15 pts.)
Project 11: SQL Injection 2 (10 pts.)
Project 12: PHP Insecurities (10 pts.)
Project 13: Automating Web Requests with Python (15 pts. + 30 Extra Credit)
Project 14: Logic Flaws (15 pts. + 20 pts. Extra Credit)
Project 15: XSS (15 pts.)
Project 16: SAML (15 pts.)
Project 3x: DNSCrypt on Windows (15 pts.)
Project 4x: Encrypting Text in ECB and CBC Modes (15 pts.)
Project 5x: Exploiting ECB Encryption (35 pts.)
Project 6x: Protecting SSH with Fail2Ban (15 pts.)
Project 7x: Protecting a Server with iptables and iptstate (10 pts.) (Updated 11-8-16)
Project 8x: Exploit Hackazon (20 pts.)
Project 9x: XSS Extra Credit (25 pts.) (Rev. 4-2-18)
Proj 11x: Stealing Cookies with XSS (10 pts.) (New 4-23-18)
Project 1: Firefox and NoScript (10 pts.) (rev. 9-11-14)
Project 2: HijackThis (10 pts.) (rev. 1-28-16)
Project 3: Sniffing Passwords with Wireshark (10 pts.) (rev. 1-30-14)
Project 4: Port Scans and Windows Firewall (20 pts.) (rev. 8-21-12) DOC
Project 5: WOT (Web of Trust) (10 pts.) (rev. 2-17-16)
Project 6: Blocking Ads with the Hosts File (15 pts.) (rev. 1-26-15)
Project 7: Hashes and Digital Signatures (15 pts.) (rev. 3-4-14)
Project 12: Nessus (15 pts.)
Project 13: Intro to Docker (15 pts.)
Project 14: Gmail 2-Factor Authentication (10 pts.)
Project 15: Snort (15 pts.) (Updated 10-1-15)
Project 16: Encipher It (10 pts.)
Project 17: Making a Linux HTTPS Server (10 pts.) (rev. 9-22-15)
Project 18: Encrypting an Image in ECB and CBC Modes (15 pts.) (new 11-12-15)
Project 2x: XSS with Google Gruyere (15 pts.)
Project 3x: Privilege Escalation with Google Gruyere (10 pts.)
Project 4x: Performing an HTTPS DoS Attack (10 pts.)
Project 5x: CodeCademy Command Line Course (15 pts.)
Project 6x: Bandit Wargame (up to 27 pts.)

Project 11x: SQL Injection Challenges (Up to 30 pts.)
Project 12x: SHA-3 (15 pts.)

Links
Certification Preparation Security+ Study Guides, Practice Exams, Training Resources, and Forums Security+ Exam Changing 12-31-2011 to SY0-301 CompTIA Security SY0-301 Authorized Exam Cram (3rd Edition) ($16) CompTIA Security+ Certification: JK0-018 is the same as SY0-301 CompTIA CEUs (Continuing Education Requiements) Security Plus WAP Simulation Links for Chapter Lectures Ch 1a: Palin's Email Account Hacked Ch 1b: The MS-CHAP version 1 authentication protocol has been deprecated in Windows Vista Ch 1c: Divide and Conquer: Cracking MS-CHAPv2 with a 100 success rate Ch 2a: Defense Contractor Leaks Obama's Presidential Helicopter Plans to Iran Ch 2b: Get SID of user Ch 2c: Mac Ad: Vista Security - YouTube Ch 2d: Under Worm Assault, Military Bans Disks, USB Drives (from 2008) Ch 2e: IEEE 1667: USB device authentication Ch 2f: Set Local User Logon Hours in Windows XP Ch 2g: Configuring IP Access Lists - Cisco Systems Ch 2h: Pentagon destroys thousands of copies of Army officer's memoir Ch 2i: Google throws 'kill switch' on Android phones Ch 3a: An Illustrated Guide to the Kaminsky DNS Vulnerability Ch 3b: Download Splunk for free on your operating system Ch 3c: OSSIM, the Open Source SIEM Ch 4a: Using Nepenthes Honeypots to Detect Common Malware Ch 4b: MS honeypot research sheds light on brute-force hacks Ch 4c: Microsoft Proposes Personal Honeypots to Fend Off Hackers Ch 4d: New Metasploit 0-day exploit for IE Ch 4e: IE 0Day Demo Ch 4f: asleap - exploiting cisco leap Ch 4g: Reaver Cracking WPS in 19 Hours Ch 4h: Wi-Fi Protected Setup Ch 4i: Which ports to unblock for VPN traffic to pass-through? Ch 4j: Configuring Firewalls Ch 4k: NAT traversal - Wikipedia Ch 4l: Toward a Gigabit Wi-Fi Nirvana: 802.11ac and 802.11ad Ch 4m: Best 802.11ac routers - CNET Reviews Ch 4n: NSA Backdoor in Elliptic Curve random number algorithm Ch 4o: Certificate requirements when you use EAP-TLS or PEAP with EAP-TLS Ch 4p: Introducing Universal SSL from Cloudflare, using ECC Ch 4q: WiFi Pineapple Mark V Standard -- HakShop Ch 4r: Rogue Management in a Unified Wireless Network - Cisco Ch 4s: Free VPN Service - Hotspot Shield VPN Ch 4t: An Explosion of Data Breaches and PoS RAM Scrapers (2014) Ch 4u: Geotagging poses security risks Article The United States Army Ch 4v: Insurgents Used Cell Phone Geotags to Destroy AH-64s in Iraq Defense Tech Ch 5a: Restricted Groups: Security Configuration Editor Ch 5b: Federal Agencies Fail Health IT Security Audits (from 2011) Ch 5d: Come fly the insecure skies, a lesson in IT deployment at one of the largest US airports Ch 5e: Amazon Outage Hits Netflix, Heroku, Pinterest, Instagram (July, 2012) Ch 5f: Google Hack Attack Was Ultra Sophisticated, New Details Show Ch 6a: Microsoft disables AutoRun on Windows XPVista to prevent malware infections Ch 6b: Buckshot Yankee Ch 6c: LoveBug worm hit 10 years ago during a simpler time Ch 6d: Internet Security 2012 Virus - Removal Guide - Fixrogues Ch 6e: Think Apple's Got Your Back? 600K Trojan Virus Attacks Say Otherwise Ch 6f: Fannie Mae Logic Bomb Would Have Caused Weeklong Shutdown Ch 6g: Sony's 'rootkit' CDs Ch 6h: Barracuda Spam Firewall Ch 6i: Eric Schmidt: Google gets close to 'the creepy line' Ch 6j: HP Storage Hardware Harbors Secret Back Door Ch 6k: Linux kernel - Wikipedia Ch 6l: Hackers Target the Unemployed as Money Mules Ch 6m: Amazon.com: 3M Privacy Filter Ch 6o: Virus Coaxes Man to Turn Himself in for Child Pornography Ch 7a: Kerberos prevents MITM Ch 7b: Barclays: 97 percent of data breaches still due to SQL injection Ch 7c: G-Zapper - Removes Google Cookies Ch 8a: IP Address Locator - Enter an IP address to find its location Ch 8b: IP Address WHOIS Lookup Ch 8c: Extracting and Cracking Mac OS X Lion Password Hashes Ch 8d: Ubuntu's password management with SHA512 Ch 9a: HBGary Federal's Aaron Barr Resigns After Anonymous Hack Scandal Ch 9b: Google's Disk Failure Experience Ch 9c: On the ground with AT&T's Network Disaster Recovery team Ch 9d: Google Throws Open Doors to Its Top-Secret Data Center Ch 9e: AVTECH - Recommended Data Center Temperature & Humidity Ch 9f: Compromising Electromagnetic Emanations of Keyboards Experiment 22 on Vimeo Ch 10a: Understanding sha-1 collision weakness Ch 10b: The cost of SHA-1 collisions reduced to 2^52 Ch 10c: No SHA-1 Collision? Yet SHA1 is broken? Ch 10d: SHA-3 Winner Chosen, But It May Be Years Before Keccak Has an Effect Ch 10e: Hashcalc download Ch 10f: FileAlyzer Ch 10g: RIPEMD - Wikipedia Ch 10h: How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases Ch 10i: LM hash - Wikipedia Ch 10j: Enabling NTLMv2 Authentication Ch 10k: How to enable NTLM 2 authentication (from Microsoft) Ch 10l: Network Security: LAN manager authentication level in the Registry Ch 10m: Cracking NTMLv2 (PPT slides from 2002) Ch 10n: Hash Generator--Calculates Correct NTLM Hashes Ch 10o: Block size (cryptography) - Wikipedia -- Why AES Uses 128-bit Blocks Ch 10p: Animation of AES encryption process Ch 10q: EFF Breaks DES by Brute Force (1999) Ch 10r: The RSA Hack: How They Did It - NYTimes.com (Apr. 2, 2011) Ch 10s: NIST Recommends 2048-bit RSA Keys now (see page 20) Ch 10t: First Steganographic Image in the Wild Ch 10u: spammimic - steganography in spam Ch 10v: Commercial quantum cryptography devices Ch 10w: Quantum cryptography devices cost $82,000 a pair Ch 10x: DigiNotar dies from certificate hack caper (from 2011) Ch 10x1: ComodoHacker's Pastebin Ch 10y: Chrome to stop checking Certificate Revocation List (CRL)? Ch 10z: An Illustrated Guide to Cryptographic Hashes Ch 10z1: IETF takes rifle off wall, grabs RC4 cipher's collar, goes behind shed (Dec. 1, 2014) Ch 10z2: SSL Pulse -- quality of encryption on Web sites Ch 10z3: Apple dumps SSL 3.0 for push notifications due to Poodle flaw (10-23-14) Ch 11a: PSExec Pass The Hash - Metasploit Unleashed Ch 11b: Computer Fraud Casebook: The Bytes that Bite: Joseph T. Wells Ch 11c: The Story Behind San Francisco's Rogue Network Admin Ch 11d: eDisclaimers Ch 11e: selective attention test - YouTube Ch 11f: Free, Live Streaming Web Cam Views from Around the World Other Links Proj 6 link: Download details: Microsoft Baseline Security Analyzer 2.1.1 (for IT Professionals) Metasploit Megaprimer 300 mins of video tute Different Types of Hashes and Salts Security Theater video with Bruce Schneier National Cyber League Fall Pilot Registration The National Cyber League (NCL): Where Cyber Security is a Passion The First Few Milliseconds of an HTTPS Connection -- EXCELLENT WALKTHROUGH Security Plus Performance Based Questions The Case of the Missing Digital Signatures Tab Didier Stevens 2013-12-08: Statement from French Government regarding the MitM certificates by their intermediate 2013-12-08: Google Explaining the French MITM Attack 2013-12-11: Safely and efficiently imaging a MacBook Air 2013-12-17: Hacker Ag3nt47 Hits Harvard, Stanford, MIT (from May) Free Mini Course - CompTIA Security Performance Based Exam Questions - InfoSec Institute 2014-01-04: Prison Locker Ransomware, an upcoming malware threat in 2014 Ch 6n: Trusted Platform Module contains an RSA key HacKid 1: Hacker Tells Story of Melbourne University Hack HacKid 2: How the feds took down the Dread Pirate Roberts Ars Technica Codebashing SQLi Tutorial DNSSEC Demo: Online Dig of IETF.ORG Updated CompTIA Security Exam--SY-301 expires Dec 31, 2014 Steganography Demo -- USEFUL FOR PROJECT New Unsorted Links Ch 10p: Animation of AES (fixed link 11-17-15) How Yahoo was forced to give data secretly to the NSA Prism project (from 2014) -- IMPORTANT PRECEDENT The Tricky Encryption That Could Stump Quantum Computers (from Sept., 2015) CNSA Suite and Quantum Computing FAQ (Jan. 2016) Old Links from Previous Textbook

Links

Certification Preparation
Security+ Study Guides, Practice Exams, Training Resources, and Forums
Security+ Exam Changing 12-31-2011 to SY0-301
CompTIA Security SY0-301 Authorized Exam Cram (3rd Edition) ($16)
CompTIA Security+ Certification: JK0-018 is the same as SY0-301
CompTIA CEUs (Continuing Education Requiements)
Security Plus WAP Simulation

Links for Chapter Lectures

Ch 1a: Palin's Email Account Hacked
Ch 1b: The MS-CHAP version 1 authentication protocol has been deprecated in Windows Vista
Ch 1c: Divide and Conquer: Cracking MS-CHAPv2 with a 100 success rate

Ch 2a: Defense Contractor Leaks Obama's Presidential Helicopter Plans to Iran
Ch 2b: Get SID of user
Ch 2c: Mac Ad: Vista Security - YouTube
Ch 2d: Under Worm Assault, Military Bans Disks, USB Drives (from 2008)
Ch 2e: IEEE 1667: USB device authentication
Ch 2f: Set Local User Logon Hours in Windows XP
Ch 2g: Configuring IP Access Lists - Cisco Systems
Ch 2h: Pentagon destroys thousands of copies of Army officer's memoir
Ch 2i: Google throws 'kill switch' on Android phones

Ch 3a: An Illustrated Guide to the Kaminsky DNS Vulnerability
Ch 3b: Download Splunk for free on your operating system
Ch 3c: OSSIM, the Open Source SIEM

Ch 4a: Using Nepenthes Honeypots to Detect Common Malware
Ch 4b: MS honeypot research sheds light on brute-force hacks
Ch 4c: Microsoft Proposes Personal Honeypots to Fend Off Hackers
Ch 4d: New Metasploit 0-day exploit for IE
Ch 4e: IE 0Day Demo
Ch 4f: asleap - exploiting cisco leap
Ch 4g: Reaver Cracking WPS in 19 Hours
Ch 4h: Wi-Fi Protected Setup
Ch 4i: Which ports to unblock for VPN traffic to pass-through?
Ch 4j: Configuring Firewalls
Ch 4k: NAT traversal - Wikipedia
Ch 4l: Toward a Gigabit Wi-Fi Nirvana: 802.11ac and 802.11ad
Ch 4m: Best 802.11ac routers - CNET Reviews
Ch 4n: NSA Backdoor in Elliptic Curve random number algorithm
Ch 4o: Certificate requirements when you use EAP-TLS or PEAP with EAP-TLS
Ch 4p: Introducing Universal SSL from Cloudflare, using ECC
Ch 4q: WiFi Pineapple Mark V Standard -- HakShop
Ch 4r: Rogue Management in a Unified Wireless Network - Cisco
Ch 4s: Free VPN Service - Hotspot Shield VPN
Ch 4t: An Explosion of Data Breaches and PoS RAM Scrapers (2014)
Ch 4u: Geotagging poses security risks Article The United States Army
Ch 4v: Insurgents Used Cell Phone Geotags to Destroy AH-64s in Iraq Defense Tech

Ch 5a: Restricted Groups: Security Configuration Editor
Ch 5b: Federal Agencies Fail Health IT Security Audits (from 2011)
Ch 5d: Come fly the insecure skies, a lesson in IT deployment at one of the largest US airports
Ch 5e: Amazon Outage Hits Netflix, Heroku, Pinterest, Instagram (July, 2012)
Ch 5f: Google Hack Attack Was Ultra Sophisticated, New Details Show

Ch 6a: Microsoft disables AutoRun on Windows XPVista to prevent malware infections
Ch 6b: Buckshot Yankee
Ch 6c: LoveBug worm hit 10 years ago during a simpler time
Ch 6d: Internet Security 2012 Virus - Removal Guide - Fixrogues
Ch 6e: Think Apple's Got Your Back? 600K Trojan Virus Attacks Say Otherwise
Ch 6f: Fannie Mae Logic Bomb Would Have Caused Weeklong Shutdown
Ch 6g: Sony's 'rootkit' CDs
Ch 6h: Barracuda Spam Firewall
Ch 6i: Eric Schmidt: Google gets close to 'the creepy line'
Ch 6j: HP Storage Hardware Harbors Secret Back Door
Ch 6k: Linux kernel - Wikipedia
Ch 6l: Hackers Target the Unemployed as Money Mules
Ch 6m: Amazon.com: 3M Privacy Filter
Ch 6o: Virus Coaxes Man to Turn Himself in for Child Pornography

Ch 7a: Kerberos prevents MITM
Ch 7b: Barclays: 97 percent of data breaches still due to SQL injection
Ch 7c: G-Zapper - Removes Google Cookies

Ch 8a: IP Address Locator - Enter an IP address to find its location
Ch 8b: IP Address WHOIS Lookup
Ch 8c: Extracting and Cracking Mac OS X Lion Password Hashes
Ch 8d: Ubuntu's password management with SHA512

Ch 9a: HBGary Federal's Aaron Barr Resigns After Anonymous Hack Scandal
Ch 9b: Google's Disk Failure Experience
Ch 9c: On the ground with AT&T's Network Disaster Recovery team
Ch 9d: Google Throws Open Doors to Its Top-Secret Data Center
Ch 9e: AVTECH - Recommended Data Center Temperature & Humidity
Ch 9f: Compromising Electromagnetic Emanations of Keyboards Experiment 22 on Vimeo

Ch 10a: Understanding sha-1 collision weakness
Ch 10b: The cost of SHA-1 collisions reduced to 2^52
Ch 10c: No SHA-1 Collision? Yet SHA1 is broken?
Ch 10d: SHA-3 Winner Chosen, But It May Be Years Before Keccak Has an Effect
Ch 10e: Hashcalc download
Ch 10f: FileAlyzer
Ch 10g: RIPEMD - Wikipedia
Ch 10h: How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases
Ch 10i: LM hash - Wikipedia
Ch 10j: Enabling NTLMv2 Authentication
Ch 10k: How to enable NTLM 2 authentication (from Microsoft)
Ch 10l: Network Security: LAN manager authentication level in the Registry
Ch 10m: Cracking NTMLv2 (PPT slides from 2002)
Ch 10n: Hash Generator--Calculates Correct NTLM Hashes
Ch 10o: Block size (cryptography) - Wikipedia -- Why AES Uses 128-bit Blocks
Ch 10p: Animation of AES encryption process
Ch 10q: EFF Breaks DES by Brute Force (1999)
Ch 10r: The RSA Hack: How They Did It - NYTimes.com (Apr. 2, 2011)
Ch 10s: NIST Recommends 2048-bit RSA Keys now (see page 20)
Ch 10t: First Steganographic Image in the Wild
Ch 10u: spammimic - steganography in spam
Ch 10v: Commercial quantum cryptography devices
Ch 10w: Quantum cryptography devices cost $82,000 a pair
Ch 10x: DigiNotar dies from certificate hack caper (from 2011)
Ch 10x1: ComodoHacker's Pastebin
Ch 10y: Chrome to stop checking Certificate Revocation List (CRL)?
Ch 10z: An Illustrated Guide to Cryptographic Hashes
Ch 10z1: IETF takes rifle off wall, grabs RC4 cipher's collar, goes behind shed (Dec. 1, 2014)
Ch 10z2: SSL Pulse -- quality of encryption on Web sites
Ch 10z3: Apple dumps SSL 3.0 for push notifications due to Poodle flaw (10-23-14)

Ch 11a: PSExec Pass The Hash - Metasploit Unleashed
Ch 11b: Computer Fraud Casebook: The Bytes that Bite: Joseph T. Wells
Ch 11c: The Story Behind San Francisco's Rogue Network Admin
Ch 11d: eDisclaimers
Ch 11e: selective attention test - YouTube
Ch 11f: Free, Live Streaming Web Cam Views from Around the World

Other Links
Proj 6 link: Download details: Microsoft Baseline Security Analyzer 2.1.1 (for IT Professionals)
Metasploit Megaprimer 300 mins of video tute
Different Types of Hashes and Salts
Security Theater video with Bruce Schneier
National Cyber League Fall Pilot Registration
The National Cyber League (NCL): Where Cyber Security is a Passion
The First Few Milliseconds of an HTTPS Connection -- EXCELLENT WALKTHROUGH
Security Plus Performance Based Questions
The Case of the Missing Digital Signatures Tab Didier Stevens
2013-12-08: Statement from French Government regarding the MitM certificates by their intermediate
2013-12-08: Google Explaining the French MITM Attack
2013-12-11: Safely and efficiently imaging a MacBook Air
2013-12-17: Hacker Ag3nt47 Hits Harvard, Stanford, MIT (from May)
Free Mini Course - CompTIA Security Performance Based Exam Questions - InfoSec Institute
2014-01-04: Prison Locker Ransomware, an upcoming malware threat in 2014
Ch 6n: Trusted Platform Module contains an RSA key
HacKid 1: Hacker Tells Story of Melbourne University Hack
HacKid 2: How the feds took down the Dread Pirate Roberts Ars Technica
Codebashing SQLi Tutorial
DNSSEC Demo: Online Dig of IETF.ORG
Updated CompTIA Security Exam--SY-301 expires Dec 31, 2014
Steganography Demo -- USEFUL FOR PROJECT

New Unsorted Links
Ch 10p: Animation of AES (fixed link 11-17-15)
How Yahoo was forced to give data secretly to the NSA Prism project (from 2014) -- IMPORTANT PRECEDENT
The Tricky Encryption That Could Stump Quantum Computers (from Sept., 2015)
CNSA Suite and Quantum Computing FAQ (Jan. 2016)

Old Links from Previous Textbook

Back to Top

Last Updated: 5-21-18