The A-to-Z of CyberSecurity as a Kid Understands It May 28th, 2015 Reuben Paul 1
Agenda Introduction CyberSecurity Alphabets (A to Z) Demonstration Conclusion
Who am I? Reuben Abishai Paul Personal Twitter Handle @RAPst4r 9 years old Harmony School of Science, Austin 3
Prudent Games CEO Learn while they Play! 4
CyberSecurity Journey - Atlanta - Houston (ISC)2 Security Congress Hou.Sec.Con Kids CyberWorld Create A Safe & Secure good hackers? really kids make for Why Keynote - Sept 2014 October 2014 BSides - Austin Hack In The Box HaxPo - Amsterdam Security Cyber The A-to-Z of NG GroundZero InfoSec Summit - -Delhi Kentucky - CyberSecurity DerbyCon May 2015 March 2015 Developing r00t-kidz: Future of CyberSecurity of Babes Mouth From thethe InfoSec 2014 Sept2014 Debut -Nov
Other Fun Facts Americas Most Beautiful Baby (2007) Americas Youngest Shaolin Do KungFu Blackbelt (2013) DISTCO Contest Winner (2014, 2015) USA Gymnastics State Champion (Rings 2015) 6
Agenda Introduction CyberSecurity Alphabets (A to Z) Demonstration Conclusion
abc CyberSecurity Alphabets What are Alphabets? Security Concept Basic Building Blocks Kids Learn as Their Foundation Defensive Concept Offensive Concept
A Authentication Verifying Identity Are you really who you say you are? 1 How many factors do you see? Three Factors What you Know What you Have Who you Are 2 9
B Buffer Overflow Overflow of Memory Input Length > Buffer Size Return Address Overwritten Malicious Code Execution 1337 31 Robin St. Neverland, TX 10
C Cross Site Request Forgery (CRSF) Presents Guards invitation gives kid to an guard entry to pass get into Candy party. User Logs Into Website (Bank) Gets a Session Established The Hacker Sends a Phishing Email With Malicious Link (Code) Code Rides on Top of User Session Tricks kid with Does not ticket YEAH, Wants to use It s his have Entry ticket Time Candy! to Party get Ticket! candy for him Request is Forged 11
D Denial of Service (DoS) Software/System Unavailable Interruptions 12
E Encryption/Decryption Data Conversion Plain-text Cipher-text Algorithm Key Secret 13
F Fuzzing Security Testing Exploitable or Not Random (or) Pseduo- Random Test inputs (fuzz) 14
G Greybox Testing Security Testing Partial or Limited knowledge Blackbox Whitebox Greybox 15
H Hashing Input converted using a Algorithm Fixed Sized Hash Input Algorithm Irreversible Hash 16
I Injection Input is treated as a command No input validation Lego Mega Bloks 17
J Java Applet Attack Creates Malicious Java Applet User Prompted Run time permission granted when run 18
K Keylogging Disclosure atatcks Keystrokes Scanned Dumped Source: Us@Us 19
L Logic Bomb Malcode (or) Mallogic Certain Conditions or Time is met 20
M Man in the Middle (MITM) Impersonates Gateway/Router as Client Client as Router Communication goes through the hacker 21
N Non-Repudiation Repudiation == Deny Non-Repudiation == Cannot Deny Logging & Auditing 22
O One-Time Pad Protection Against Bruteforce Attacks Unique Value Used Once Before Expires 23
P Phishing Lure/Bait & Trick Reveal Information Social Engineering 24
Q Quarry (Targets) Companies Countries Children 25
R Rootkits What is a R00tK1t? Computer Program Remote Control of System Good vs. Bad 26
S Social Engineering What is Social Engineering? Trick Someone Get what you want Who are the Best Social Engineers? 27
T Tor What is Tor? or At least The Onion Router Use Tor Protect from Network Traffic Surveillance Browse Anonymously Location hidden 28
U UDP Flood Attack Guarantee? DoS Attack Lots of UDP Packets Network Congestion NAPSTER RAPSt4R 29
V Virus Computer Program Attaches to Host Harmful 30
W Whitehat Use Skills for Good Hackers With Ethics Skilled in Dark Arts (BlackHat) 31
X XSS (Cross-Site Scripting) Injected Code Executed as Script longhornskidsclub.com 32
Y You People Weakest Link Cyber Education is Key Next Generation - Kids 33
Z Zero-Day Vulnerability Ohday, -ve day The Power of Zero Defenders Unaware 0 = no value Attackers Advantage (X) 0 = One (Usually) Launched on Day That Software (Software) 0-day = Owned Came Out 34
Agenda Introduction Cybersecurity Alphabets (A to Z) Demonstration Conclusion
nuf said - Demonstration Let s BEEF up (XSS) Playing the HackCraft game
Agenda Introduction Cybersecurity Alphabets (A to Z) Demonstration Conclusion
CyberShaolin Teach Kids/Adults about Cyber Security Dangers & Defenses Get Involved Volunteer Donate http://www.cybershaolin.org/get-involved/ 38
Closing Thoughts Thank you Be Educated and Be Educators of CyberSecurity - especially to kids Contact Information reuben@prudentgames.com reuben@cybershaolin.org @prudentgames @RAPst4r @cybershaolin 39