This document discusses wireless security and protocols such as WEP, WPA, and 802.11i. It describes weaknesses in WEP such as vulnerabilities in the RC4 encryption algorithm that allow attacks like dictionary attacks. It introduces WPA as an improvement over WEP that uses stronger encryption keys, protocols like TKIP that change keys dynamically, and AES encryption in 802.11i as stronger alternatives. It also discusses authentication methods like 802.1X that distribute unique keys to each user to address issues with shared keys in WEP.
Pgp-Pretty Good Privacy is the open source freely available tool to encrypt your emails then you can very securely send mails to others over internet without fear of eavesdropping by cryptanalyst.
Pgp-Pretty Good Privacy is the open source freely available tool to encrypt your emails then you can very securely send mails to others over internet without fear of eavesdropping by cryptanalyst.
A talk given by Joseph Lorenzo Hall at the UCB TRUST Privacy workshop on 10/05/2006 that describes the tensions between institutional requirements and technical abilities of the TOR network, which severly limits TOR research on the UCB campus.
IPsec provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet. Examples of its use include:
Secure branch office connectivity over the Internet
Secure remote access over the Internet
Establishing extranet and intranet connectivity with partners
Enhancing electronic commerce security
it is a precise and well designed presentation regarding the topic "IP SPOOFING".It can be useful for any computer science student seeking a good topic for papre presentation.
Three new attacks are described. The first is a Denial of Service attack capable of halting all traffic for one minute by injecting only two frames. The second attack allows the injection of arbitrary many packets towards a client. It is shown that this can be used to perform a portscan on any TKIP-secured client. The third attack reset the internal state of the Michael algorithm, allowing an attack to append any (encrypted) TKIP packet with invalidating the MIC. This can be used to decrypt arbitrary packets sent towards the client.
Learning spark ch01 - Introduction to Data Analysis with Sparkphanleson
Learning spark ch01 - Introduction to Data Analysis with Spark
References to Spark Course
Course : Introduction to Big Data with Apache Spark : http://ouo.io/Mqc8L5
Course : Spark Fundamentals I : http://ouo.io/eiuoV
Course : Functional Programming Principles in Scala : http://ouo.io/rh4vv
A talk given by Joseph Lorenzo Hall at the UCB TRUST Privacy workshop on 10/05/2006 that describes the tensions between institutional requirements and technical abilities of the TOR network, which severly limits TOR research on the UCB campus.
IPsec provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet. Examples of its use include:
Secure branch office connectivity over the Internet
Secure remote access over the Internet
Establishing extranet and intranet connectivity with partners
Enhancing electronic commerce security
it is a precise and well designed presentation regarding the topic "IP SPOOFING".It can be useful for any computer science student seeking a good topic for papre presentation.
Three new attacks are described. The first is a Denial of Service attack capable of halting all traffic for one minute by injecting only two frames. The second attack allows the injection of arbitrary many packets towards a client. It is shown that this can be used to perform a portscan on any TKIP-secured client. The third attack reset the internal state of the Michael algorithm, allowing an attack to append any (encrypted) TKIP packet with invalidating the MIC. This can be used to decrypt arbitrary packets sent towards the client.
Learning spark ch01 - Introduction to Data Analysis with Sparkphanleson
Learning spark ch01 - Introduction to Data Analysis with Spark
References to Spark Course
Course : Introduction to Big Data with Apache Spark : http://ouo.io/Mqc8L5
Course : Spark Fundamentals I : http://ouo.io/eiuoV
Course : Functional Programming Principles in Scala : http://ouo.io/rh4vv
HBase In Action - Chapter 10 - Operationsphanleson
HBase In Action - Chapter 10: Operations
Learning HBase, Real-time Access to Your Big Data, Data Manipulation at Scale, Big Data, Text Mining, HBase, Deploying HBase
Learning spark ch04 - Working with Key/Value Pairsphanleson
Learning spark ch04 - Working with Key/Value Pairs
Course : Introduction to Big Data with Apache Spark : http://ouo.io/Mqc8L5
Course : Spark Fundamentals I : http://ouo.io/eiuoV
Course : Functional Programming Principles in Scala : http://ouo.io/rh4vv
A hibernate tutorial for beginners. It describe the hibernate concepts in a lucid manner and and test project(User application with database) to get hands on over the same.
This presentation describes the WEP issued in the original IEEE 802.11 and points out it's weakness and how can attacks be executed. Also, it summarizes the best practices to introduce security to the Wireless enviroment.
Welcome to the world of 'network security' which is an unavoidable term in cyber security. This white paper of Network security encompasses the most significant and predominantly used networking security concepts which are highly important for maintaining your network environment secure.
A presentation which on Wireless Network Security. It contains Introduction to wireless networking, security threats and risks, best practices on using wireless networks.
The Security Problem
Program Threats
System and Network Threats
Cryptography as a Security Tool
User Authentication
Implementing Security Defenses
Firewalling to Protect Systems and Networks
Computer-Security Classifications
An Example: Windows XP
Seminar Paper on Security Issues of 802.11b based on IEEE Whitepaper by Boland, H. and Mousavi, H., Carleton University, Ottawa, Ont., Canada, IEEE Canadian Conference on Electrical and Computer Engineering, 2-5 May 2004
HBase In Action - Chapter 04: HBase table designphanleson
HBase In Action - Chapter 04: HBase table design
Learning HBase, Real-time Access to Your Big Data, Data Manipulation at Scale, Big Data, Text Mining, HBase, Deploying HBase
Hbase in action - Chapter 09: Deploying HBasephanleson
Hbase in action - Chapter 09: Deploying HBase
Learning HBase, Real-time Access to Your Big Data, Data Manipulation at Scale, Big Data, Text Mining, HBase, Deploying HBase
Learning spark ch01 - Introduction to Data Analysis with Sparkphanleson
Learning spark ch01 - Introduction to Data Analysis with Spark
References to Spark Course
Course : Introduction to Big Data with Apache Spark : http://ouo.io/Mqc8L5
Course : Spark Fundamentals I : http://ouo.io/eiuoV
Course : Functional Programming Principles in Scala : http://ouo.io/rh4vv
Exploiting Artificial Intelligence for Empowering Researchers and Faculty, In...Dr. Vinod Kumar Kanvaria
Exploiting Artificial Intelligence for Empowering Researchers and Faculty,
International FDP on Fundamentals of Research in Social Sciences
at Integral University, Lucknow, 06.06.2024
By Dr. Vinod Kumar Kanvaria
Introduction to AI for Nonprofits with Tapp NetworkTechSoup
Dive into the world of AI! Experts Jon Hill and Tareq Monaur will guide you through AI's role in enhancing nonprofit websites and basic marketing strategies, making it easy to understand and apply.
A review of the growth of the Israel Genealogy Research Association Database Collection for the last 12 months. Our collection is now passed the 3 million mark and still growing. See which archives have contributed the most. See the different types of records we have, and which years have had records added. You can also see what we have for the future.
Model Attribute Check Company Auto PropertyCeline George
In Odoo, the multi-company feature allows you to manage multiple companies within a single Odoo database instance. Each company can have its own configurations while still sharing common resources such as products, customers, and suppliers.
2024.06.01 Introducing a competency framework for languag learning materials ...Sandy Millin
http://sandymillin.wordpress.com/iateflwebinar2024
Published classroom materials form the basis of syllabuses, drive teacher professional development, and have a potentially huge influence on learners, teachers and education systems. All teachers also create their own materials, whether a few sentences on a blackboard, a highly-structured fully-realised online course, or anything in between. Despite this, the knowledge and skills needed to create effective language learning materials are rarely part of teacher training, and are mostly learnt by trial and error.
Knowledge and skills frameworks, generally called competency frameworks, for ELT teachers, trainers and managers have existed for a few years now. However, until I created one for my MA dissertation, there wasn’t one drawing together what we need to know and do to be able to effectively produce language learning materials.
This webinar will introduce you to my framework, highlighting the key competencies I identified from my research. It will also show how anybody involved in language teaching (any language, not just English!), teacher training, managing schools or developing language learning materials can benefit from using the framework.
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...Levi Shapiro
Letter from the Congress of the United States regarding Anti-Semitism sent June 3rd to MIT President Sally Kornbluth, MIT Corp Chair, Mark Gorenberg
Dear Dr. Kornbluth and Mr. Gorenberg,
The US House of Representatives is deeply concerned by ongoing and pervasive acts of antisemitic
harassment and intimidation at the Massachusetts Institute of Technology (MIT). Failing to act decisively to ensure a safe learning environment for all students would be a grave dereliction of your responsibilities as President of MIT and Chair of the MIT Corporation.
This Congress will not stand idly by and allow an environment hostile to Jewish students to persist. The House believes that your institution is in violation of Title VI of the Civil Rights Act, and the inability or
unwillingness to rectify this violation through action requires accountability.
Postsecondary education is a unique opportunity for students to learn and have their ideas and beliefs challenged. However, universities receiving hundreds of millions of federal funds annually have denied
students that opportunity and have been hijacked to become venues for the promotion of terrorism, antisemitic harassment and intimidation, unlawful encampments, and in some cases, assaults and riots.
The House of Representatives will not countenance the use of federal funds to indoctrinate students into hateful, antisemitic, anti-American supporters of terrorism. Investigations into campus antisemitism by the Committee on Education and the Workforce and the Committee on Ways and Means have been expanded into a Congress-wide probe across all relevant jurisdictions to address this national crisis. The undersigned Committees will conduct oversight into the use of federal funds at MIT and its learning environment under authorities granted to each Committee.
• The Committee on Education and the Workforce has been investigating your institution since December 7, 2023. The Committee has broad jurisdiction over postsecondary education, including its compliance with Title VI of the Civil Rights Act, campus safety concerns over disruptions to the learning environment, and the awarding of federal student aid under the Higher Education Act.
• The Committee on Oversight and Accountability is investigating the sources of funding and other support flowing to groups espousing pro-Hamas propaganda and engaged in antisemitic harassment and intimidation of students. The Committee on Oversight and Accountability is the principal oversight committee of the US House of Representatives and has broad authority to investigate “any matter” at “any time” under House Rule X.
• The Committee on Ways and Means has been investigating several universities since November 15, 2023, when the Committee held a hearing entitled From Ivory Towers to Dark Corners: Investigating the Nexus Between Antisemitism, Tax-Exempt Universities, and Terror Financing. The Committee followed the hearing with letters to those institutions on January 10, 202
A workshop hosted by the South African Journal of Science aimed at postgraduate students and early career researchers with little or no experience in writing and publishing journal articles.
2. Wireless Security
Wireless offers additional challenges:
Physical media can easily be sniffed.
War Driving
Legal?
U.S. federal computer crime statute, Title 18 U.S.C. 1030,
Crime to knowingly access a computer used in interstate or
foreign communication "without authorization" and obtain any
information from the computer.
Crime to access a computer without authorization with "intent
to defraud" to obtain "anything of value."
But not if "the object of the fraud and the thing obtained
consists only of the use of the computer and the value of
such use is not more than $ 5,000 in any 1-year period."
3. Wireless Security
Wireless offers additional challenges:
Physical media can easily be sniffed.
Mobile computing needs to preserve
battery power.
Calculations cost more on a mobile platform.
Especially important for sensor networks
4. Wireless Security:
Attackers Perspective
Knowing the Threat
Targets of opportunity
Goal is
Internet access.
Easy pickings.
Targeted attacks
Targets assets valuable enough.
Internal attackers
Most Dangerous
Can open an unintentional security hole
6. IEEE 802.11
Wired Equivalent Privacy (WEP)
Protocol
Based on a shared secret k.
Distributed out of band.
Uses CRC for internal integrity protection.
Uses RC4 to encrypt network traffic.
8. WEP Protocol
Confidentiality
Original packet is first check-summed.
Checksum and data form the payload.
Transmitting device creates a 24-bit
random initialization vector IV.
IV and shared key are used to encrypt with
RC4
9. WEP Protocol
RC4
Generates a pseudo-random stream of
bytes (keystream)
Based on a secret internal state
Permutation S of all 256 possible bytes
Two index pointers
Plaintext is XORed with keystream
10. WEP Protocol
RC4
Key Scheduling Algorithm (KSA)
Initializes S based on a key
for i from 0 to 255
S[i] := i
j := 0
for i from 0 to 255
j := (j + S[i] + key[i mod keylength]) mod 256
swap(S[i],S[j])
11. WEP Protocol
RC4
Pseudo-Random Generation Algorithm
(PRGA)
Generates pseudo-random byte stream
i := 0
j := 0
while GeneratingOutput:
i := (i + 1) mod 256
j := (j + S[i]) mod 256
swap(S[i],S[j])
output S[(S[i] + S[j]) mod 256]
12. WEP Protocol
RC4
Known weaknesses
Keystream slightly biased
Fluhrer & McGrew attack can distinguish keystream
from random stream given a GB of input.
Fluhrer, Mantin, Shamir: statistics for output of the
first few bytes of output keystream are non-random,
leaking information about key.
13. WEP Protocol
Authentication
Station associating with access point
needs to authenticate itself.
Both exchange the type of authentication
that is accepted.
Open: Just identification between station and
AP
Shared Secret: Participants send nonces to
each other, encrypt the nonce using WEP (and
the shared secret key), and verify the other’s
response.
14. WEP has no key management
Everyone allowed to have access to a
wireless network has the same key.
Anyone with the key can read ALL
traffic.
15. WEP: RC4
RC4 uses the key and the IV to produce
a stream of pseudo-random bytes.
Calculates cipher text from plaintext by
XORing the pseudo-random stream
with the plain-text.
17. WEP: Attacks on RC4
Dictionary Attack
Build database:
224
different IVs
Build a database of 224
streams of MTU bytes
(2,312 B) for each different IV.
Takes < 40 GB storage.
XOR two entries with the same IV.
Result are the two plaintexts XORed.
Natural language text has enough redundancy
to decrypt the XOR of two text streams.
18. WEP: Attacks on RC4
Dictionary Attack
Many packages can be completely or
partially guessed.
XORing guessed plaintext and captured
cipher gives pseudo-random byte stream
for a given IV.
Some implementations reset IVs poorly.
This simplifies dictionary attacks.
19. WEP: Attacks on RC4
Injection Attack
Attacker creates packets on the wireless
connection.
Attacker XORs plaintext and cipher.
Builds Pseudo-Random Stream database
indexed by IV.
20. RC4
Fluhrer, Mantin, Shamir Attack
First few bits of several thousand
messages reveals key.
Based on an analysis of the RC4 code.
Originally kept secret, but later leaked on the
internet.
21. RC4
Fluhrer, Mantin, Shamir Attack
Key Scheduling Algorithm
Sets up RC4 state array S
S is a permutation of 0, 1, … 255
Output generator uses S to create a
pseudo-random sequence.
First byte of output is given by
S[S[1]+S[S[1]]].
First byte depends on
{S[1], S[S[1], S[S[1]+S[S[1]]}
22. RC4
Fluhrer, Mantin, Shamir Attack
Key Scheduling Algorithm
First byte of plain text package is part of the SNAP header
0xAA for IP and ARP packages
0xFF or 0xE0 for IPX
Guessing the first byte is trivial
Some IVs are vulnerable: “resolved”
(KeyByte+3, 0xFF, *)
Plus some more
Easy to test whether an IV is vulnerable.
Search for vulnerable IVs.
They leak key bytes probabilistically.
Large number of packets does it.
23. RC4
Fluhrer, Mantin, Shamir Attack
Optimization needs about 5,000,000 to
1,000,000 packages.
Counter-measures:
Change key frequently.
Change IV counters to avoid bad IVs.
24. WEP Message Modification
WEP uses CRC code to ascertain integrity of
messages.
CRC code is linear:
CRC(x ⊕ y) = CRC(x) ⊕ CRC(y).
Attacker knows plaintext M and desired modification
∆ for target plaintext M’ = M ⊕ ∆.
Attacker want to substitute X = P⊕(M,CRC(M)) for
P⊕(M’,CRC(M’)).
Attacker sends
X⊕(∆,CRC(∆)) = P⊕(M,CRC(M)) ⊕(∆,CRC(∆))
= P⊕(M’,CRC(M’))
26. Wireless Security
Casual user, low yield traffic
WEP is good enough.
Enterprise, Commercial
Combine WEP with higher order security
SSH
VPN
IPSec
27. WPA
Created by WiFi Alliance
Certification started April 2003
Uses 802.1X authentication server
Distributed different keys to each user.
Can also be used in “pre-shared key”
(PSK) mode
Every user uses the same passphrase.
Called WPA Personal
29. WPA
Protocol changes over WEP
CRC is replaced by “Michael” MIC.
MIC now includes a frame counter, preventing replay
attacks.
Payload bit flipping is now impossible.
Data encryption still uses RC4, but now
Prevents key recovery attacks on WEP by using
128b Key
48b Initialization vector
Temporal Key Integrity Protocol (TKIP) changes key
dynamically.
30. TKIP
Temporal Key Integrity Protocol
Ensures that every data packet has its own
encryption key.
31. 802.11i
Uses AES instead of RC4.
Subset published as WPA2
Uses 802.1X authentication
32. Protocol Layers
WEP
Privacy only.
Very elementary security.
WPA
Temporal Key Exchange Protocol
Fixes WEP that scrambles keys between packages and adds a secure
message check.
AES: Advanced Encryption Standard
802.11i
Military grade encryption, replaces DES
802.1X
General purpose and extensible framework for authentication users
and generating / distributing keys.
Simple Secure Network (SSN)
Recipe for authentication based on 802.1X