Dr. Candace Walkington, Assistant Professor of Mathematics Education Southern Methodist University

Transcription

1 5-E Classroom STEM Activity: ETHICAL HACKING: HOW LONG DOES IT TAKE TO BREAK YOUR PASSWORD? Dr. Candace Walkington, Assistant Professor of Mathematics Education Southern Methodist University

2 CYBER SECURITY // HOW TO PROTECT YOURSELF FROM HACKERS DON T BE A VICTIM! Are you taking the STEM Type quiz? HOW TO PROTECT YOURSELF FROM HACKERS HACKERS ARE BECOMING MORE ADVANCED AND EVERYONE IS AT RISK. BY STEPHANIE PETIT Ever get an from a friend with a weird link? Or saw a friend start posting strange tweets? They probably got hacked and it can happen to you, too. Here s how to protect yourself from these hackers. STEM JOBS // LATE FALL 04 // STEMJOBS.COM

3 USE DIFFERENT PASSWORDS Most people use one or two passwords for all of their accounts, but that makes it easy for hackers if one password is revealed, they suddenly have access to your , bank account, social media accounts and more. It may be a little harder to remember different passwords for different accounts, but it s also harder to hack. It also doesn t hurt to change your passwords every few months. MAKE PASSWORDS LONG AND COMPLEX ABC or password isn t going to cut it. Use upper and lower case letters, numbers and symbols in your passwords so that they aren t guessed easily. The length of your password is also important. Hackers use programs that sort through combinations of letters and numbers at lightning speed. Longer passwords mean more work for hacking software and hackers generally want quick results. USE AND UPDATE ANTIVIRUS SOFTWARE There are many good antivirus programs out there that protect you from 95 percent of the danger that s out there. A free one is Microsoft Security Essentials. It provides protection from spyware, malware and viruses. BE CAREFUL WHERE YOU CLICK Never open an if you don t know the sender especially not attachments. Be suspicious if a friend appears to have sent you an with no subject line, a subject line that only says RE or FW or is uncharacteristically vague or brief like Hey. It may be a good idea to call them and ask if they sent the . Also, don t click links that promise prizes or free things like movies it s tempting, and that s why hackers use them, but they re not legit. It s sad that these people are using their computer skills in all the wrong ways you can actually get paid to hack. Jobs for ethical hackers are increasing because businesses and government-related organizations want to ensure their networks, applications and computer systems are strong enough to prevent theft and fraud. It pays well, too! In your first years as an ethical hacker, you can earn anywhere from $50,000 to $00,000 per year depending on the company that hires you, your IT experience and education. With several years of professional experience, you could command $0,000 or more per year. And the big bonus no risk of jail time like those not-so-ethical hackers. Potential ethical hackers should start by earning a A+ Certification and getting experience in a tech support position. After some experience and additional certification such as Network+ or CCNA, move up to a network support or admin role and then to network engineer after a few years. Earn security certifications and eventually work toward the Certified Ethical Hacker (CEH) certification offered by the International Council of Electronic Commerce Consultants. Along with these skills and certifications, you ll need a strong work ethic, good problem-solving skills and the ability to say motivated. Even with your skills, remember to never intrude anyone s network without their permission not even your ex-boyfriend or girlfriend. STEMJOBS.COM // LATE FALL 04 // STEM JOBS

4 ETHICAL HACKING: HOW LONG DOES IT TAKE TO BREAK YOUR PASSWORD? Here are some ideas for how high school teachers could use this story as a launching point for integrated STEM learning. Our activities follow the 5-E Learning Cycle Model, and the activity below is intended to last three to four one-hour class periods (although portions of the activity could be used in shorter time periods). Part : Engage 4 Ask students: What do you think the most common passwords that people use are? Why is it a bad idea to use a really common password? Why is it a bad idea to use the same password for multiple websites? Show students the 5 most common passwords on the following site: cbsnews.com/news/the-5-most-common-passwords-of-0. Have students read the STEM Jobs SM article How to Protect Yourself from Hackers. Ask students if they ve ever had to create a password for a website that had particular requirements for the password (e.g., has to have a certain number of characters, has to have symbols, etc.). What are the pros and cons of a website requiring a complicated password? Ask students: What mathematical concepts could we use to figure out how difficult a password is to break? For instance, how could we figure out how much harder it is to break a six-character password compared to a seven-character password? Students should hopefully discuss probability and permutations here. Part : Explore Show students the following scenario on a worksheet or on the projector: You are being interviewed for a job as an ethical hacker, and as part of your interview you have to break into a secure website in a limited time period. You have the choice of four websites you can try to hack. Which website would you choose? A. A website that requires a password consisting of seven characters which must be numbers and lowercase letters. B. A website that requires a password consisting of six characters that must be uppercase letters, lowercase letters, numbers and the symbols above the numerical keys on a typical keyboard. C. A website that requires a seven-character password of upper and lowercase letters and numbers, but where no character can be repeated. D. A website that requires a 0-character password of upper and lowercase letters and numbers, where no character can be repeated and the order of the characters does not matter (i.e., if the password was set as , the system would also accept as correct). Work in groups and be ready to provide a mathematical argument for why your choice is the best one. Have students discuss with partners and make an initial prediction about which of the four options they feel would be easiest to hack, then have a class discussion where students give their prediction and their reasoning for choosing that option. Have students work in groups to use the mathematical concepts of combination and permutation to figure out which of the four websites would be the best choice (note: students will need a calculator capable of handling large numbers). STEMjobs.com Ethical Hacking: How Long Does It Take to Break Your Password?

5 Part : Explain 4 See a review of combinations and permutations here if needed: mathsisfun.com/combinatorics/combinations-permutations.html. Have each student group give their choice and discuss the mathematical reasoning they used to provide evidence that their choice was the best one. Project student work on the overhead and discuss concepts of combinations and permutations, and how the formulas change when repetition is allowed or not allowed. Have students revisit their predictions and rate how well their intuition about the best option matched their actual calculations. If their prediction was far off, have them come up with an explanation why. Engage students in a discussion of what password requirements they typically see on sites they go to, and what other security procedures sites use, other than having particular requirements for passwords (e.g., use SiteKeys, track if you re logging on from a different device, have security questions, ask you to enter characters from a picture). Part 4: Elaborate 4 Ask students: How many password tries do you think hacking software can make every second? Have students read the following article: zdnet.com/article/cheap-gpus-are-rendering-strong-passwords-useless. Tell students: The article we just read says that a CPU (Central Processing Unit) can make 9.8 million password guesses per second. On a GPU (Graphics Processing Unit), however, the rate is. billion passwords per second. In their groups, have students respond to the following prompt: For the CPU and for the GPU, on average, how long would it take you to guess the password that you chose for your ethical hacking interview? (See Explore phase above.) What is the range of times it would take to guess the password? Extension: If your hacking software guessed the words in the English dictionary first, and the password was a word in the dictionary, how long would it take to crack the password? Part 5: Evaluate Have students work on the following problems individually in their math journals: You re designing a new social media website, and you want to balance password security with the users being able to easily access the site. What security measures would you put in place with respect to users logging in? Use mathematical reasoning to support your response. You re designing a new banking website, and you want to balance password security with the users being able to easily access the site. What security measures would you put in place with respect to users logging in? Use mathematical reasoning to support your response. Standards: CCSS.Math.Content.HSS.CP.B.9. Use permutations and combinations to compute probabilities of compound events and solve problems. CCSS.Math.Practice.MP. Construct viable arguments and critique the reasoning of others. STEMjobs.com Ethical Hacking: How Long Does It Take to Break Your Password?

6 STEMjobs.com