1.
SECURITY
@MrRio #btsec

2.
DIRECTOR/FOUNDER AT

3.
jsPDF JAVASCRIPT PDF GENERATION LIBRARY

4.
SECURITY
IS EVERYONE’S
RESPONSIBILITY
@MrRio #btsec

5.
DEBOOKEE FOR MAC
@MrRio #btsec

6.
#btsec

7.
CRACKING A WIFI
PASSWORD IS EASY
@MrRio #btsec

8.
@MrRio #btsec

9.
HOW DO WE FIX THIS?!
@MrRio #btsec

10.
WEBSITE OWNERS – USE SSL
@MrRio #btsec

11.
WEBSITE USERS –
USE VPN
@MrRio #btsec

12.
WHAT IS CRYPTOGRAPHY?
@MrRio #btsec

13.
SENDING A
SECURE MESSAGE
#btsec
(OFFLINE DEMO EDITION)

14.
A CIPHER
IS A DIGITAL LOCK #btsec

15.
CAESAR CIPHER
USED IN WARS
AROUND 50BC
#btsec

16.
ABCDEFGHIJKLM
XYZABCDEFGHIJ
#btsec

17.
SHIFT CIPHER
SHIFT VALUE (KEY)
0
INPUT
I LOVE BT
OUTPUT
I LOVE BT
#btsec

18.
SHIFT CIPHER
SHIFT VALUE (KEY)
1
INPUT
I LOVE BT
OUTPUT
J MPWF CU
#btsec

19.
SHIFT CIPHER
SHIFT VALUE (KEY)
2
INPUT
I LOVE BT
OUTPUT
K NQXG DV
#btsec

20.
ONE-TIME PAD
KEY
1950396
INPUT
ILOVEBT
OUTPUT
JUTVHKZ
#btsec

21.
STREAM CIPHER
KEY (SEED)
7894
KEY STREAM (PRNG)
ILOVEBT
OUTPUT
JUTVHKZ
#btsec
1950396
INPUT

22.
HOW TO GET A
SHARED
SECRET
WITH THIS ONE WEIRD TRICK
#btsec

23.
STEFAN MARC
EVE
#btsec

24.
STEFAN MARC
EVE
#btsec

25.
STEFAN MARC
EVE
#btsec

26.
STEFAN MARC
EVE
#btsec

27.
STEFAN MARC
EVE
#btsec

28.
STEFAN MARC
EVE
#btsec

29.
STEFAN MARC
EVE
#btsec

30.
INSTEAD OF COLOURS
#btsec
WE USE PRIME NUMBERS

31.
EASY
(3^29) % 17 = 12
(3^??) % 17 = 12
HARD

32.
32,416,190,071

33.
TO FIX MITM
USE SSL
#btsec
(TLS)

34.
WITH SVG FILTERS
#btsec
HACKING SITES

35.
var lastTime = 0;!
function loop(time) {!
var delay = time – lastTime;!
var fps = 1000/delay;!
console.log(delay + ‘ ms’ + ‘ fps: ‘ + fps);!
updateAnimation();!
requestAnimationFrame(loop);!
lastTime = time;!
}!
requestAnimationFrame(loop);
#btsec
TIMING ATTACK

36.
#btsec
TIMING ATTACK
<filter id="threshold" color-interpolation-filters="sRGB">!
<feColorMatrix type="matrix" !
values="0.333 0.333 0.333 0 -.16!
0.333 0.333 0.333 0 -.16!
0.333 0.333 0.333 0 -.16!
0 0 0 0 1" />!
<feComponentTransfer>!
<feFuncR type="discrete" tableValues="1 0" />!
<feFuncG type="discrete" tableValues="1 0" />!
<feFuncB type="discrete" tableValues="1 0" />!
</feCompnentTransfer>!
</filter>!

37.
#btsec

38.
<iframe src=”view-source:http://example.com#line77”></iframe>!
#btsec
Source:
http://www.contextis.com/documents/2/Browser_Timing_Attacks.pdf

39.
X-FRAME-OPTIONS:
SAMEORIGIN

40.
DEMO 2
#btsec
The non-WiFi version

41.
#btsec

42.
YOU CAN STRIP SSL EASILY
#btsec

43.
lasers websockets
node.js
#btsec
I BUILT A SCARY APP
sslstrip arpspoof
(spelt the british way)
css3 3d transforms

44.
#btsec

45.
#btsec

46.
#btsec

47.
HTTP Strict Transport Security (HSTS)
Strict-Transport-Security: max-age=63072000
response.headers[‘Strict-Transport-Security’] =
‘max-age=63072000'
header(“Strict-Transport-Security: max-age=
63072000”);
#btsec

48.
RECAP
PROBLEM: HTTP Sucks
SOLUTION: Use SSL or a VPN! (TLS)
SOLUTION: Use X-FRAME-OPTIONS: SAMEORIGIN
#btsec
PROBLEM: IFRAMES suck
PROBLEM: SSL Sucks!
SOLUTION: Use HSTS headers

49.
THANK YOU!
ME MY COMPANY
@MrRio @parallax #btsec