代写INFO3616、代做Python语言程序

日期：2024-08-28 08:55

The University of Sydney

School of Computer Science

Senior Lecturer - Security

INFO3616/CSEC3616/CSEC5616 — S2 2024

Assignment - 1

This is an individual assignment.

This assignment worths 10% of the final marks of the course.

Submit your final report as a PDF and codes as a zip file in Canvas.

You should explain any details of how to run your code in report.

Final Report and Code: Due by Week 5, Sunday the 1st of September, 2024 11:59 PM

*** IMPORTANT ***: In your answer sheet DO NOT repeat the questions. Simply include

the question number and your answer only. If you include question text in your answer sheet,

your TurnItIn score will be high and there will be additional checks. This will cause a delay in

releasing your marks. We will also impose a penalty of 10% of the total marks.

1 Security Goals (20 marks)

Analyse the following real-world IT-related incidents and data breaches where specific security goals

were compromised. For each scenario, identify the compromised security goal (e.g., Confidentiality,

Data/Message Integrity, Authenticity, Authorisation, Accountability, Non-repudiation, Deniability,

Availability, Privacy) and explain how the incident compromised that goal.

You will have to do your research by referring to various news articles and incident reports to

understand what happened in each incident. We have given some sample links to get you started but

feel free to investigate more and understand what happened in each incident. Most of the questions

will have more than one correct answer, depending on how you look at them. We will accept them if

your explanation is correct and related to the incident.

Provide clear and concise explanations for each scenario, as shown in the example.

Example 1 - CrowdStrike Falcon update failure 2024 - Link

Compromised Security goal: Availability

Explanation: Windows machines with the CrowdStrike Falcon Sensor installed went into

the boot loop with BSOD (Blue Screen of Death), making them unusable and compromising

availability.

1

Example 2 - Optus data breach 2022 - Link

Compromised Security goal: Confidentially

Explanation: Personal information of the Optus customers, such as driver’s licence number,

passport number, and address, was harvested by an attacker using an unauthenticated API

endpoint. Optus was in breach of keeping their customer’s data confidential. Here, arguments

can be made for security goals such as authorisation and privacy - but they are secondary to

confidentiality.

2 marks for each. 1 mark for correctly naming the security goal and one mark for the

explanation.

i Twitter account hijacking, 2020, Link.

ii Struxnet, 2010, Link.

iii Medicare and Pharmaceutical Benefits Scheme (PBS) data released by the Australian Department

of Health, 2016, Link 1, Link 2.

iv SolarWinds Supply Chain Attack, 2020, Link.

v Attack on Dyn DNS Provider, 2016 Link.

vi Poly Network Hack, 2021, Link 1, Link 2.

vii Silk Road Takedown, 2013, Link 1, Link 2.

viii Colonial Pipeline Cyberattack, 2021, Link.

ix Ashley Madison Breach, 2015, Link.

x Unisuper Google Could Incident, 2024, Link 1, Link 2, Link 3.

2 Social Engineering (20 marks)

ZenithTech, a prominent financial services firm, has been experiencing a surge in activity due to the

launch of a new investment platform. During this time, Sarah, an operations manager, receives a call

from someone claiming to be Chris, a representative from their external auditing firm. Shortly after,

she also receives an email supposedly from the company’s internal audit department.

Chris: "Hello Sarah, I’m Chris from your external audit firm. We’re conducting a quick review

of the new investment platform’s security protocols. Could you provide the access logs and system

architecture diagrams?”

Sarah: "I wasn’t aware of this audit. Shouldn’t this request come through our IT security team?”

Chris: "I understand your concern, Sarah. Due to the urgency of this review, we’ve been asked to

directly contact key personnel. I’ve already spoken to Michael from your internal audit team, and he’ll

send you an email confirming my request.”

2

Email:

Subject: Verification of External Auditor Request

Dear Sarah,

This is to verify that Chris is an authorized member of our external audit firm and is requesting

the necessary information for a security review. Please assist him with the requested documents.

Best regards,

Michael Johnson - Internal Audit Department

Later, Sarah discusses this situation with her colleague, James.

Sarah: "James, I got a call from an external auditor named Chris and an email from Michael

confirming it. But something doesn’t feel right. What do you think?”

James: "That’s odd. Did you verify the email’s authenticity? Maybe it’s best to check with Michael

directly.”

i Identify and describe two cognitive biases the attacker is attempting to exploit. (6 marks)

ii What additional indicators should Sarah look for to recognize this as a potential vishing attack?

List and explain two red flags. (4 marks)

iii As a security manager, what steps would you implement at ZenithTech to prevent such vishing

attempts? Provide two recommendations. (4 marks)

iv If Sarah had shared the sensitive information, what immediate actions should ZenithTech take to

mitigate potential risks? Explain three steps. (6 marks)

3 Social Engineering in Practice (20 marks)

You are a given a Twitter profile of a fictitious person.

https://x.com/frankgraphicsGP

Your task is to conduct some reconnaissance on the profile and guess the password used by this

subject to zip a file. Write a Python program that takes keyword list as the input create a list of

possible word combinations that may be used by this subject as a password.

For example, if you find possible keywords to be “blue”, “car”, the Python program should be able

to generate a list like and programmatically try to unzip the given file by entering generated passwords.

blue

car

blueblue

bluecar

carblue

carcar

3

Hint: The correct password contains lower case letters and digits. The length of the password is less

than 20 characters.

Include any details of how to run your code and the contents of the unzipped file in the PDF report

and submit your code in the code submission link given in Canvas.

4 Access Control (20 marks)

a) Definitions

i Explain: is authentication a necessary ingredient for authorisation? Give an example that proves

your argument. (2 marks)

ii It is conventional wisdom that passwords to encrypt a hard drive should be longer than passwords

for online login to websites. Explain why. (2 marks)

iii Explain what a Security Policy Model is. 1-2 sentences are enough. (2 marks)

iv Access control is often categorised into two general forms (which we called two ends of a spectrum).

What are they, and how are they different from each other? (2 marks)

v Modern CPUs have support for access control. Explain two key ideas of the common x86

architecture. (2 marks)

b) Security Policy Models

Figure 1 shows a mapping between users and clearances, and between required clearances and objects.

The clearance level increases as Basic, Confidential, Secret, Top Secret, and Ultimate Secret. Only

these mappings are defined; no other rule sets exist.

Explain if the the following statements are right or wrong, and say why.

i “In a Bell LaPadula model, Bob can read the file battle_plans.txt.” (2 marks)

ii “In a Biba model, Bob can read the file mars_habitat_plan.txt.” (2 marks)

iii “In a Bell LaPadula model, Alice can enlist the help of Elise to obtain the content of the

mars_habitat_plan.txt.” (2 marks)

iv “In a Bell LaPadula model, Alice can write to all the files as she wishes.” (2 marks)

v “In a Biba model, Elise can write to all the files as she wishes.” (2 marks)

4

ClearanceUser

BasicAlice

ConfidentialBob

SecretCharlie

Top SecretDavid

Ultimate SecretElise

Required ClearanceObject

Confidentialweekly_threat_report.txt

Ultimate Secretmars_habitat_plan.txt

Basicnext_week_press_brief.txt

Top Secretbattle_plans.txt

Figure 1: Access Tables

5 Linux Access Control (20 marks)

Below questions are associated with the provided Azure VM.

a) Basic Access Control

Below questions can be answers by Linux One liners. Provide the answer to each question and

include the command you used. Make sure that you include the command as letters/characters

(than screenshots/images), so that the markers can copy/paste command and check whether it is

working.

i What is the User ID (UID) of the user gimly. (1 mark)

ii What is the Group ID (GID) of the group hobbits. (1 mark)

iii Find which group the user legolas belongs to. (1 mark)

iv Find all the users in the group humans. (1 mark)

v Does the user frodo have sudo access? There are multiple ways to do this. Answers requiring

more than one command is also accepted. (1 mark)

b) File Permissions

For i-iii, use the linux find command with correct options and make sure that you command do not

generate any permission denied messages or other error messages. Include the commands you used in

your answer.

i Find all the files owned by user legolas. (1 mark)

ii Find all the files associated with the group elves. (1 mark)

iii Find all the files owned by user gimly. (1 mark)

iv In ii) you will find a file owned by legolas and having the group as elves. Is the next statement

is true about the file. “arwen can write to the file”. Explain your answer. (2 marks)

v In iii) you will find a file owned by gimly and having the group as dwarves. Is the next statement

is true about the file. “isildur can write to the file”. Explain your answer. (2 marks)

c) SUID Bit

5

i Find all the files own by root and having the group as humans. Similar to above your command

must not generate any permission denied messages or other error messages. (2 marks)

ii The search in i) will return two files. Explain the difference in permission strings of these two files.

(3 marks)

iii Explain and demonstrate how the permission setting in one of the files can create a security

vulnerability. (Hint: You will have to run the files and use the whoami command.) (3 marks)