Cyber100 July 9th

• Goal of the Group Project: The primary objective is for students to learn how to code in Python through the creation of a simple, functional game.

  • Examples of acceptable games include: Hangman, Tic-Tac-Toe, MadLibs, Dice Roller, Guess the Number, or a Text-based Adventure game.

  • The instructor emphasizes that the course is intended for "familiarization" and students should not feel intimidated by the coding requirement.

• Project Structure and Individual Accountability:

  • Collective Effort with Individual Output: While students work together in groups, each individual member is responsible for writing the code for their own unique game.

  • Collaboration vs. Delegation: Groups should help each other, but the instructor warns against allowing one person (who might program professionally) to do all the work. This prevents others from failing to develop necessary foundational skills for later courses.

  • Submission Requirements: When the final project is submitted, it must include a one-page write-up from each person detailing their experience, what they learned, and any challenges faced. The actual Python code must be pasted into the document so the instructor can copy, paste, and run it directly.

• Timeline and Milestones:

  • Group Contract: Due by the following week.

  • Rough Draft: Due in Week $3$, which marks approximately the halfway point of the course.

• Resources for Learning Python:

  • Course Tutorials: Videos are available on the class web page (created in $2017$).

  • LinkedIn Learning: Accessible for free to Penn State students. A prep course for the Security Plus exam found here would normally cost $1,500$ post-graduation.

  • Penn State Online Book Collection: Offers various tutorials on Python and other programming languages.

  • Night Lab: Can be used as a reference for project scope and complexity ideas, though students must produce original code rather than copying existing scripts.

Practical Applications of Python in Cybersecurity and Digital Forensics

• Efficiency and Automation: Python is the most widely used language in cybersecurity and makes a professional $10$ times more effective by automating repetitive tasks.

• Case Study: Digital Forensics (CYBER 440):

  • The Scenario: In the senior capstone course lead by Dr. Jacoby, Dr. Fusco, or the current instructor, students perform a "murder mystery" investigation on a database containing $200\,GB$ of data.

  • The Task: Students must sift through system logs, emails, and web traffic to identify a villain among several suspects who committed minor infractions.

  • Manual vs. Automated Analysis: Analyzing $200\,GB$ of data manually could require $80$-hour work weeks. Writing a small amount of Python code can automate this process, demonstrating the end-state utility of foundational programming skills.

• Tool Integration: Students will eventually learn to use tools such as Wire Shark, Snort, and Nessus. Being able to discuss these tools and specific group project experiences is vital for successful job interviews.

• Cybersecurity Career Diversity: The instructor notes that while programming is useful, one can have a successful career without being a coder. However, a basic understanding is necessary for managing programmers and ensuring code is documented effectively.

The Evolution of Secure Messaging and the Role of Ecosystems

• The Ecosystem Divide: Historically, messaging security was siloed. Messages sent within the Apple ecosystem were encrypted (blue bubbles), while cross-platform messages to Android users were unencrypted (green bubbles), creating a security risk.

• The WhatsApp Controversy:

  • WhatsApp was originally built as a highly secure, trustworthy application.

  • Meta Acquisition: Mark Zuckerberg and Meta bought WhatsApp, promising to maintain its privacy. However, the instructor alleges they removed many security/privacy features to monitor user data for targeted advertising.

• Signal: Created as a nonprofit by the original WhatsApp founders who used their $50$ million payout from Meta to rebuild a truly secure messaging platform that cannot be bought or compromised.

• Wicker (Military-Grade Messaging):

  • Developed for the Department of Defense (DOD) to replace Signal in professional military environments.

  • Security Features: Requires a CAC card (common access card), proxy card, and PIN for access. It displays the user's rank, picture, career specialty, and security classification.

  • Addressing Human Error: Wicker prevents users from accidentally adding unauthorized people (like reporters) to sensitive group chats, a vulnerability that exists in Signal due to anonymous usernames.

• RCS (Rich Communication Services):

  • As of last month, Apple and Android have begun adopting RCS in beta across major carriers (Verizon, Xfinity, T-Mobile, AT&T, Boost).

  • This technology allows for encrypted, secure cross-platform messaging, effectively ending the security compromise previously caused by "green bubble" interactions.

Personal Security, Privacy, and Human Tracking

• The "Nothing to Hide" Fallacy: The instructor challenges the idea that privacy is unnecessary for those with nothing to hide, noting that different demographics (especially females) face higher physical and digital threats.

• Location Sharing Risks:

  • Snap Map: Students often broadcast their precise location globally. The instructor shares an anecdote of his son at Disney World using Snap Map to coordinate with eight friends in real-time, which also inadvertently broadcasted the parent's location.

  • Bar Buddy App: An app designed for checking into bars and reviewing drinks. The instructor highlights the danger: publicly sharing which bar you are at and how many drinks (e.g., Margaritas) you have consumed makes you highly vulnerable to stalkers and traffickers.

• Physical Security Awareness for Trafficking Prevention:

  • Traffickers use signals such as a cloth tied to a car door handle, a $20$ bill on a windshield, or a grocery cart placed behind a tire to lure a person out of their vehicle.

  • Instructor Advice: Put phones away in parking lots, remain aware of surroundings, and if a situation feels unsafe, return to the store and ask for an escort.

• Privacy Persistence: Apps like Facebook often reset privacy settings to default during software patches, requiring users to repeatedly manually lock down their data.

Surveillance Valley: Gamification of Data Collection

• Historical Context: The U.S. government sought ways to track citizens' locations since before the Vietnam War but struggled for $50$ years.

• The Solutions via Big Tech:

  • Angry Birds: A game that successfully convinced millions of Americans to grant access to their photos, contacts, and location data under the guise of entertainment.

  • Pokemon Go: Used as a crowdsourced mapping tool. While Google spent significant money on $360$-degree camera cars, Pokemon Go incentivized users to go to unmapped areas (by placing rare Pokemon there) to map them via their phone cameras and GPS. The instructor observed soldiers mapping secure areas on military bases while playing the game.