Cyber Security and Network Infrastructure Researcher Dates EmployedAug 2019 – Dec 2019 Employment Duration5 mos LocationNew London/Norwich, Connecticut Area • Conducted a 2019 audit of the college's security and infrastructure • Setup internal bug in order to access the network from the outside • Presented findings to the entire Computer Science department • Created a detailed report for the Chief information security officer of Connecticut College

1. Network Penetration Testing
Cameron Aaron
Software Engineer
John Schaeffer
Chief Information Security Officer (CISO)

2. Who am I?
Computer Science and Psychology Major w/minor in
Cognitive Science
Ammerman Student
Software Engineer @ Microsoft’s GitHub
Google Product Expert
Fun fact: I used to collect rocks from places I traveled

3. Network Penetration
Testing
● What
● Why

4. How
5 Phases
● Installation & configuration,
● Reconnaissance
● Threat Modeling
● Exploitation
● Resolution & recommendations

5. ● Hacky Mc Hack Face config
● Google Cloud server
● Scripting
Installation and
configuration phase

6. ● OS detection
● Fuzzing
● Packet sniffing and intrusion
detection
● Outside exposure
● Wifi network checks
Reconnaissance
phase

7. ● Establish scope
● Establish attack vectors
● Social Engineering?
Pre-engagement

8. ● Msfconsole payload gen
● The magical virustotal
● Wireshark
Threat Modeling
Phase/Vulnerability
Identification

9. ● Noop payloads
● The Z00 VM
Exploitation phase

10. Case Study: Camel
Card insecurity
● Insecure RFID technology
● Easily cloned from distances of
1 foot away
● Very easy to impersonate other
students

11. Mitigation
● Shielded card holders
● Encrypted cards such as mifare
desfire (Does not emit info until
both the scanner and reader
handshake)

12. RFID
● Hexadecimal broadcast (plain
text)
● Powered by receiver
● Receiver grants access by
group in database (BlackBoard)

14. Case Study:
Degreeworks
unencrypted traffic
● Degree works was served using
HTTP
● Traffic is able to be sniffed in
plain text

15. Mitigation
● Serve Degreeworks over
HTTPS

16. Reporting ● Writing of the report

17. Questions?