Weekly Summary

Week 1

Lecture

• date: 14/10/24
• massive increases in cyber-attacks in last 2-3 years. who is carrying out the attacks? how to find out? Is AI responsible for the increase?
• Intro & infos:
  • Lernziele:
  • Organisational:
    • website
    • all informations/materials on moodle.
• ransomware (check out the wiki article)
• Information security vs IT-Security: former is a subset of the latter. IT-Security is information security in the realm of electronic information.
• General 3 goals of Information security - CIA:
  • Confidentiality
  • Integrity
  • Availability
• Castle analogy. Thick walls can protect, what about the gates? How to determine who belongs to the castle, who doesn’t? Increasing security measures can directly cause new vulnerabilities.

Tutorium

• date: 15/10/24
• organisatory infos:
  • 6 Assignment sheets, 50% for the exam.
  • tutorials on heico.

Week 2

Lecture

• date: 21/10/24
• how effective is security by obscurity? (not at all) in fact, open protocols and algorithms enhance security
• ISO/OSI Reference modell.
  • Physical layer: not part of the lecture
  • data link layer
  • network layer
  • transport layer
  • session layer
  • presentation layer
  • application layer
    • smtp(insecure), ftp, http
• Protocols
  • ARP: ARP-spoofing, ARP-poisoning (MITM: Man in the Middle)

Tutorium

• date: 22/10/24
• SANS penetration testing
• Schwachstelle/Weakness: Any error oder weakness that violates the CIA principles.
  • e.g:
• Bedrohung/Threat: Actor, that takes advantage of a weakness
• Risiko/Risk: Damage, that can occur due to a weakness.
• Exploit: The actual code or the actual process that takes advantage of the weakness.
• Penetration Test:
  • Scope: IP adress space
  • Recon (Reconessence) \(\rightarrow\) Scanning & initial access space \(\rightarrow\) Exploitation \(\rightarrow\) Post-exploitation
  • nmap:
    • TCP:
      • Syn-pakete
        1. open
        2. closed
        3. filtered
        4. filtered
  • masscan:

Week 3

Lecture

• date: 28/10/24
  Crytpographic methods
  
• basic definitions of cryptology, cryptography encryption, decryption, signing data
• Classification of cryptographic algorithms:
  • crypotgraphic hash-functions
  • symmetric cryptographic algorithms
  • asymmetric cryptographic algorithms
• Cryptogrpahic check values.
  • Difference to Information/Coding theory: Coding theory random errors
    
• cyrptographic hash functions:
  • compression
  • ease of computation
  • …
  • md5, sha-1, sha-2 families

Tutorium

• date: 29/10/24 lecture review:
  
• MAC is used for authentication:
  • MAC(K, msg) = Sha256(k || msg)
• ct = Enc(k, pt) ct == cypher-text. pt == plain-text.
• Even more securer: ct = Enc(MAC || Enc(pt, K))
• strong collision resistence implies weak collision resistency.
• x’ collides with x iff h(x) = h(x’).

Week 4

Lecture

• date: 04/11/24
  lecture review:
  
• MDC (Modification Detection Code) (Integrity)
• MAC (Message Authentification Code) (authenticity)
  • MAC is a cryptographic checksum.
• Birthday paradox - relation to hashing.
• SHA
• Passwords
  • shouldn’t be plain text
  • Salt & Pepper (?)
• Brute-froce attack
  • hydra

Tutorium

• date: 05/11/24
• websites cryptography / cryptoanalhysis challenges:
  • cryptohack
  • cryptopals
  • juiceshop
  • hackthebox
  • ctftime.org

Week 5

• date:

Week 6

• date:

Week 7

• date:

Week 8

• date:

Week 9

• date:

Week 10

• date:

Week 11

• date:

Week 12

• date:

Week 13

• date:

Week 14

• date:

Week 15

• date: