 All right, so welcome back to Computer Science E1. Tonight, we continue our conversation about security. We're going to do things a little differently since I have to leave partway through for an advising engagement over elsewhere at the university. So Dan's going to step up halfway through, if you'd like to plan your departures accordingly. Anyhow, any of you in the crowd, how did anyone go out and buy an iPad this weekend, which just shipped on Saturday? Oh, we do have one iPad. No? Are you reaching for your soda? OK. Any questions about the iPad? Why did you buy it? Oh, so it turns out Dan and I are the only two in this room right now who have ordered it. We didn't physically pick it up because both of us ordered the 3G model, which means that it supports the wireless cell phone network as opposed to just Wi-Fi. Why? So my answer is, ironically, pretty much the same as I gave before class started tonight because it exists. And so I can rationalize it though in a number of ways. So one, I actually think in all sincerity that computers like this one, computers like the PCs a lot of us have are far too complicated. And they've been far too complicated for years. And the user interface, a.k.a. UI on these things, has really been largely unchanged for the past 10, 15 years. You still have a little icon that represents your hard drive. You have a little icon that represents your trash can. You have all of these folders, like applications and utilities and library and documents and all of these details that normal people and even very technical people should not have to care about. And I actually think that in recent years, the iPhone has been a very compelling step in a much better direction. I hope that the iPad and things that follow it are actually further steps along the lines of simplicity. And that, in my mind, is the theme, is making things much simpler without actually sacrificing functionality. The fact that so many of us, honestly, have such stupid technical support-related issues on a given week or a given month is just completely unnecessary. And I think we're in a very sorry state of affairs, a very primitive state right now. And so if I now am allowed to rationalize the device more, I really just want to play and experience it. And also, for other purposes, really just for fun, is try to start developing some of my own applications for either the iPhone or the iPad. And that pushes me over the rationalization edge. But do I need it? Probably not. But I could say that about a lot of the toys I've touted in this class, like the sling player. Do I really need to watch TV at 30,000 feet? Probably not. Yeah. Really? So that's a good question. So for those playing along at home, you and a friend, I take it, went to the Apple Store. We're so close to getting it. But stop short of getting it, because you think you'll wait maybe for the second generation. And do I think the next will be better? So odds are, the next version will be better. It will have more things, maybe a camera, maybe other features that people are clamoring for. Is it necessary to wait? So I would say when the iPhone first came out, I actually tried it. And I signed up with AT&T during their 30-day money-back guarantee period. Or maybe it wasn't money-back guarantee, but you could at least get out of the contract within 30 days. And I did end up returning it within the 30 days, because I personally felt at the time that the first generation iPhone just wasn't ready for prime time. I felt it was a little slow, a little jerky. There were certain features that it lacked that my BlackBerry at the time had. And I didn't really want to take a step back in terms of some simple things. So case in point, and it really was the simple things. It took me more steps and more seconds to look up a friend's email address and send him or her an email than it did on my BlackBerry. And it was those very basic things that were more important to me than being able to touch it and pinch it and drag and all of this. But when the 3GS, which S stands for speed, the newest version came out, then I finally abandoned my BlackBerry and felt that for me personally, the technology had really hit its groove and gotten to the point where there were more pluses than minuses. Now with the iPad, I haven't used it yet, so we shall see. I suspect, though, given that Apple's now had several years' experience with the iPhone and given that the iPad is really just a, it seems fair, not having touched it, a larger incarnation of that technology, they probably got more things right with the first version. So I would maybe play you in the store or play with the friends or ask us in a couple of weeks, because realistically, you'll be waiting, if this matters, another year, year and a half, presumably, so it depends on where your rationalization threshold is. But it's a good question. And for us, though, I think for us especially, and me in particular, it really boils down to user interface. And these things are just nicer to use, easier to use. And I care less about features than I do about getting a few key things right. Any other questions about iPads or UIs or other such things? No? OK. So today, we continue our conversation about security. Some themes from last week will recur. But as before, please raise your hand with questions, especially if you've been wondering how some technological detail might actually affect you as a user or as a consumer, much like our conversation last week about banking. So today, we thought we'd begin with a look at the Uber security topic that of hacking and hackers. So you've probably heard this term before. But what does it mean? In your own current understanding, what is a hacker? What do you got? Yeah? OK. Oh, OK. OK, so to summarize, you would define a hacker as someone who creates their own solutions to problems for folks playing along at home that they have. And a cracker is someone whose intents are more malicious. They are presumably savvy with computers, but they try to circumvent serial number requirements, or they try to break into systems, servers, and whatnot, to gain unauthorized access. So that's actually technically, if there's any authority on these terms, the official definition. Hacker is not necessarily a pejorative. Hacker is someone who went to MIT, for instance, and who really knows their stuff with regard to computers or technology or anything along those lines. And so it's, in fact, a compliment to say, you are a hacker. A cracker, by contrast, is a far less frequently used term, and it's meant to be the pejorative side of things. A cracker is someone who tries to circumvent protections that are in place in servers and software, someone who tries to steal software via various means. The reality is that most people have never heard the word cracker in this particular context. I personally never use it in this context. And so the world has largely conflated the good and the bad with regard to hacking. So in fact, you would often say of computer science students here at the school, the really good ones, they're hackers. The ones down the street at MIT are hackers. But then there is this pejorative that most people assume, and it's a semantic argument in the end. So if you want to call them hackers, who really cares just so long as the context is clear. So a cracker or hacker is someone who tries, for instance, to download a copy of Adobe Photoshop on the internet. And programs like that often require that you type in a CD key or a serial number or something like that. Well, a hacker or cracker, I'm just going to start saying hacker for everyone tonight, is someone who might try to write software, write their own program, a cracking utility, if you will, that modifies the zeros and ones inside of that program, like Photoshop, to circumvent that screen that asks you for your serial number or for your registration key or whatnot. So we'll talk more about this in a few weeks when we look at programming and actually have you write, albeit with a graphical programming language, some of your own programs. But a computer program is just a sequence of steps. It's instructions to a computer that tell it what to do. So this is certainly an oversimplification. But when you double click on Microsoft Word, one of the first instructions inside the program that some employee at Microsoft wrote is open window. And then the next thing is display help instructions to the user or show find menu, show edit menu, and so forth. And then the program thereafter listens for keystrokes or mouse clicks from the user. So when the user actually hits command F or some similar keystroke, the program says, oh, if input from user equals command F, what do most programs do? Yeah, so it opens the find menu or the file menu. It depends on the program, but it responds in some way. So again, a computer program is just a sequence of steps that either is doing something that an employee somewhere else told the computer to do or it's an instruction that is happening in response to user input. So a typical program, if we just kind of represent it as a big piece of paper with instruction after instruction, in reality, these are really zeros and ones, and they're not in reality aligned as a rectangle, might have instruction one here like load program. And then instruction two might say, ask for serial number, often abbreviated s slash n. And then step three might be wait for input from the user, a mouse click, a keyboard shortcut. So this is a program that's been written by Microsoft or Adobe. This is the first set of instructions that are first executed after you've installed the program. So a hacker might, with enough savvy, realize, well, these sentences are not written as sentences, English sentences, as we'll discuss in future weeks. It's all zeros and ones. But the reality is that these zeros and ones, though to people like us, it might look pretty cryptic, pretty random, they actually follow patterns. So we talked about ASCII and Unicode very early in the semester, patterns of ones and zeros that represent numbers. And that represent letters. Well, larger patterns of zeros and ones actually represent entire instructions, like add and subtract and go to, instructions that tell very basically a computer what to do. So if a hacker kind of understands that language of zeros and ones, they can notice, well, somewhere in this program there's a pattern of zeros and ones that's asking the user for something called a serial number. And if the hacker can figure out where in memory, where on the hard disk, or where in RAM those zeros and ones are, if he or she are savvy enough, what they can essentially do is trick that program into skipping a given step. And there's many different ways of doing this. But if you've ever had a friend or if you yourself have ever downloaded a patch or a crack, so to speak, a piece of small software that's meant to disable such things as step two on other programs, really some smart, if ill-intentioned person out there has figured out where in the computer's program this instruction is. And they've also figured out how you can trick the program into jumping over that step and just skipping that process altogether. Alternatively, a hacker might have figured out the algorithm, the mathematical formula that the company is using to generate serial numbers or CD keys. So if you've installed a program recently, just describe what does the CD key to a serial number look like? Is it just one really long string of numbers or characters? What have you seen recently? Yeah, like four numbers or letters, then maybe a hyphen, then another four, and then a hyphen. Patterns like this. Now, they're not perfectly random. They usually follow a pattern of sorts, not an obvious pattern, but a pattern that's mathematically derived. And so the reason for this is that so you can install the software and the program itself can check, yes or no, is this serial number legitimate? Because essentially, the programmers of that software, the people who wrote it, have embedded inside of all of these instructions some zeros and ones whose purpose in life is to check the validity of that serial number or that CD key. In other words, it checks, is this sequence of four legitimate as per Adobe's formula? Is this next four sequence of digits consistent with their formula and so forth? Well, now, where is this story going? How else might a hacker effectively circumvent this requirement that you pay for and receive such a serial number? What could they figure out? Yeah, perfect. So if a hacker figures out, either because they're a disgruntled employee and they were told the formula, or if by trial and error or enough savvy an analysis of programs that they actually bought or downloaded can figure out what the formula is that these companies are using, they can just generate as many serial numbers or CD keys as they want. So in fact, if you've ever seen such a utility or downloaded it yourself, you'll often click a button, and then it will just keep giving you more and more serial numbers, one after the other. And they're often changing, and they look like random patterns, but they are in fact following a formula. So now the industry has started and has for years pushed back on this approach how? If you were the authors of software and you really didn't like how really smart people were figuring out what your formulas were, and therefore they were enabling users to register your software without paying for it, how just thinking in layman's terms, what could you do to push back on this threat? How could you address it as the owners of the software? OK, so could you employ encryption? How? Can you propose a specific use case here? OK. OK, so you could require a password from the user, and how do you check it? Because effectively now you're asking them for a kind of a password, a really long sequence of characters that we don't call it a password. We call it a serial number or CD key. But in theory, it's long enough that it's really hard to just guess a legitimate one. But you're on the right track, so an approach that's pretty clever. What else could we do here? OK, so if you realize, damn, we screwed up. We shipped a product that was too easily hacked. You could absolutely issue an update so that even though version 1.0 of your software might be vulnerable to theft in this way, at least if those bad guys want the newer versions, now they're going to have to jump through different hoops, higher hoops, if you will, to actually circumvent your newer smarter protection. Yeah? OK. OK, so an interesting idea, if I can summarize, is if you somehow make each version of the software somewhat distinct, and each version of the software can only be used given a specific serial number or CD key. So this is one possible approach. So in other words, you will essentially, instead of making 1,000 copies, shrink wrapping them, putting them on the shelves of some store shelves, you actually make 1,000 slightly different versions of the software, each of which has a special key that only unlocks it, so that now, at least, the same key won't unlock 999 other copies of the software. So might be a viable solution. Well, let's push back on that, though. What's a downside? So it is. It's a lot of work. The whole beauty of industry these days is economies of scale and mass production and being able to duplicate really rapidly the same thing again and again and again, because it's really cheap to do so. So this adds a cost. Now, maybe that's less than the cost of all of the theft that you're experiencing. So maybe there's a reasonable trade-off there, but it is one push back. And I would argue, too, there's one downside here. So even though there's 1,000 unique copies now and 1,000 keys, each of which is uniquely tied to a given shrink wrap box, if you will, what if I am just, I think I'm being a nice person, and I decide I am going to share my copy of the 1,000 copies with the world and distribute my CD key, it sounds like it just requires that one copy get out there with its serial number. And now all of the freeloaders out there can download that one illegally distributed copy. So there's ways to mitigate that, but that would be one push back in that, yes, you've raised the bar, but it only takes one person to mess things up for you again. So what happened? Yeah. OK, interesting. So you might have two pieces of information. We talked last week about the idea of two-factor authentication. This is a little different, because the two factors, in this case, two numbers, two serial numbers are sort of fundamentally the same idea. But I would push back on that, too, and say that, well, what if now both of those pieces of information get posted on some web page somewhere, or on some file sharing site? So still kind of the same problem. So what do a lot of programs do or require when you install them these days? There's a. Access to the internet. Yeah, so they require access to the internet. So here's one way that it's not perfect, but it's increasingly common. And even when you install Windows or a lot of Microsoft software these days, the software, so to speak, calls home, or dials home. It contacts microsoft.com or some similar server, and checks what? Why would it be advantageous to have your registration process talk to another server on the internet? Yeah, it could validate that maybe this code has never been used before. And so one of the steps involved in installing Windows these days is you have to quote unquote, activate it. Usually, you can actually install the software. Use it for 30 days, 60 days, but eventually this machine will start shutting down on you every five minutes. It will do very annoying things, the idea being, yes, it's hard for us to make our software perfectly unhackable, but we can at least annoy the heck out of the people trying to steal it. And this is kind of a reasonable trade-off. It's pretty much a useless operating system if it shuts down on you every five minutes if you haven't yet activated it. So Microsoft, for instance, could keep track of all of the serial numbers or CD keys that have already been used. And they know this because the software is designed to phone home, so to speak, to send the information to a server where it's logged. And they can then keep track now of which keys have and have not been used. In fact, one of the features of relatively newer Microsoft products is they also analyze your computer in some way. They look at what type of hardware you have. They look at what kind of software you have. And this is a bit of a known for simplification. They essentially analyze your hard drive in a supposedly non-privacy invading way. And then they also submit that information to microsoft.com so that they can allow you, the user, to reinstall the software on your same computer by making note in their server what computer first installed this software. And it wouldn't be sufficient just to use your IP address. It wouldn't be sufficient just to know your username, because different people could, as we've seen, have same user names. They could have the same IP addresses. And so they try to analyze the configuration of the computer. But there's a downside here that even people like I have run into. What's a downside of that approach where they remember that a key has been used and by which computer? Yeah. Yeah, I mean, what if you remove the graphics card you have and put in another one? What if you upgrade the hardware, change things around? Now supposedly, their algorithms, their process for fingerprinting the computer, if you will, is smart enough to tolerate some changes. But certainly people like me sometimes in one fell swoop just erase everything from our computers or reconfigure it entirely. And we've paid for that copy of Windows. And we've not installed it on any other computer. And therefore it is within our right to reinstall it. But we can't, because the software is saying it's already been used. So how does Microsoft mitigate things like this? And notice the pattern here. Every time we seem to make progress, there's then this gotcha. And this is kind of a theme in security in that the adversary, the bad guy, is always kind of going to be one step ahead of you, because you can try to mitigate these threats by raising the bar. But then you often end up annoying the user, as in this case. So what do they do in this case? Where now I can't even install my own software. What do they tell you to do? Yeah, so call customer service. Now this is an interesting one, because it's sort of a slew skated. It allows me to actually fix this problem. It's a little annoying. But it's a back door in which I can now get my software activated by calling a rep, explaining what the situation is, giving them my serial number and they'll presumably do something, type, type, type, and allow my serial number to be used again. And they probably hypothesize that people stealing software are unlikely to call up, give their name, and address, and phone number, and call back, and all of this, just to activate in the legal copy of software. Now with that said, odds are they're not really vetting who these people are. And if you call up with a sufficiently compelling story, they'll probably think, what bad guy would actually call up and ask for a serial number, which then is an invitation to actually be so witty. So even that, they probably figure is an acceptable loss or cost that most people won't do that. But again, it's kind of a cat and mouse game. And so what does this mean for us, the end users? Well, this is why you're often asked for these pieces of information. But software piracy, as it's called, theft of software, has really been around since the beginning of bits, because it is so darn easy for people to transmit bits. And as Dan will talk about a little later tonight, and we discussed briefly last week in our multimedia lecture, things like Napster and other such file sharing utilities really lowered the bar, even for non-technical people, making copies of bits without authorization or the legal right to do so. But that's the curious thing about zeros and ones. If anything is digital, it can be so, so easily copied. That's the nature of things digital. So any questions on software piracy or registration or hacking? Yeah. That's a good question. Has anyone ever made the freedom of speech argument that I can stream any pattern of zeros and ones that I want, and it should be protected as free speech? Probably. It's kind of a creative law and order type episode, to be honest. I suspect, though, there's sufficient precedent for copyright and for regulation of commerce and so forth that the line can probably be drawn pretty fairly. That spewing bits that just so happen to encode Photoshop version 7.0 is probably not your legal right, according to the Constitution. But that's actually an interesting case. They would definitely do that on law and order. Yeah. That's fair. Hackers are not always bad. Really, it's context sensitive. Depends on the context you're discussing the topic in. Other questions? Yeah. So that's a good question. And now it kind of devolves into a semantic argument. Was it hacking what I or people that I worked for did at the district attorney's office when we did forensic analyses of hard drives and related media? Kind of. I would say hacking. It really depends. I would not have said we maybe hacked around. We did lots of this. This is kind of hacking in a silly sense. There's really no formal definition there. Hackers, I think, though, is often associated with people who are just really good programmers or really good with computers. They know a lot. They don't just know one operating system. They know all sorts of things. But even that isn't a steadfast rule. So it kind of depends. And I don't think we could legitimately give you one definition. But you could make that argument, I would say. Yeah, sure, they're hackers. Other questions? All right, so what about systems that are getting compromised? So we just talked about software, which is just one aspect of computing. But all of us own computers that these days were probably increasingly paranoid that there are bad guys attacking our computers and actually getting into them, controlling our accounts, downloading software without our knowing, and even servers. There are thousands of web servers out there on the internet, all of which by design are meant to be publicly accessible. And this means there are constantly threats banging down at the doors of these servers, trying to get access to these systems. Now, first let's set up the question, why would you care about breaking into My Mac or your PC that's sitting at your office or at your home? What is the purpose of trying to gain access to your computer? And by that, I mean trying to log in as you without knowing your password, for instance. What's the point? OK, so to get information, if you have a determined adversary someone at work who's trying to discredit you or you just have an enemy who's trying to dig up dirt from your computer, you might have someone who's just targeting you and your system specifically to gain access to the skeletons in your closet, so to speak. Why else? OK, I mean that's sad, but unfortunately, it's just fun. It's there, let me see if I can get into it. And unfortunately, for years there was, and maybe still is, this mentality that it's kind of cool to try to get into systems. It's a test of your knowledge. And it feels very different, I would argue, even today to most people, to say walking through the square at night and trying to break down someone's storefront door, which feels very clearly a crossing of the line, ethically and legally. And yet, if I'm just sitting there on my computer, on my laptop, on my sofa, watching TV, and typing some commands, trying to hack into whitehouse.gov, there's a sufficient layer of removal there, a sufficient layer of abstraction, where I'm not really batting down their door physically. So how could this be so bad? I'm just playing around. But it really is the same thing. And certainly, prosecutors would equate the two these days. So still might be fun for some people. Yeah, so good. So a couple things there. So one, if you have a 200 gig hard drive, 500 gig hard drive, you just have some free storage space that someone might like to take advantage of. Probably not for storing their personal files, since that could get them really in trouble. But to store files, they want to distribute, whether it's wares, which incidentally is sort of the buzzword for illegally distributed or cracked software, wares, or pornography. One of the cases we had, it was a common case that the district attorney's office actually happened in the context of a university, where some of their kiosk computers, computers that you're supposed to be able to just go up to and check your email and so forth, were riddled with pornography. And the reason for this was not so much to impact the users of the computers, but it was because these were computers with plenty of disk space on really fast internet connections. What better place to serve up files and large files without having it traced back to you? So that's absolutely a candidate for a machine being compromised, because it's just free space and free bandwidth, so long as you can just get access to it and start putting those files there. Other motivations folks might have. Now let me toss one buzzword out there. We won't go into detail on this now, but have you ever heard this term, which has been around for a while and is increasingly discussed? Zombies or things called botnets. So related to this idea of just trying to gain access to space and to bandwidth is the CPU cycles themselves. In fact, years ago, when I was still a student, I remember there being a case where I think the FBI was trying to compel Harvard to disclose logs on its various servers because they were trying to track down, as I recall at the time, some hacker, some bad guy, who had somehow gained access to Harvard servers, who wasn't involved with, affiliated with Harvard, didn't live in Cambridge or anywhere nearby, but had somehow compromised via the internet one of Harvard servers and was essentially connecting from his computer to Harvard's computer from Harvard's computer to like another university or company and then another and another. If you've ever seen some choosy movie where, or 24, the TV show, where they draw all these lines between various countries saying, oh, I'm bouncing the signal between all these countries, that's essentially what this guy was supposedly doing. He wasn't doing it in real time as the movies would have you believe. But he was connected to this server, but from there was connected to this one and from there was connected to this one because it really just complicates the process of tracking this person down. Because now, to figure out where they've come from, you don't just run a command like Chloe does in 24. Rather, you have to subpoena the logs of this entity and subpoena the logs of this entity and this one. And there's no way this is all going to happen in real time. Which means it's a pretty good way of covering your tracks. Even though each individual person knows where you came from and where you went to per our discussion of logs and the like in past lectures, for the one person, like the authorities, to put that whole picture together and understand where you've been and where you're going, takes so much more effort. So gaining access to someone's computer just as a hopping point to then connect to another server that you've compromised is a great way to cover your tracks. Because it just raises the bar and makes more work for the feds than whomever trying to trace your steps. So that's quite common, too. And at the time, Harvard, as a matter of principle, was resisting the feds, for instance, tapping the network, as I recall, in the Science Center. And I don't know how it played out. But it was an interesting story, certainly, at the time, and certainly not common. You were hacked into Harvard. There's no Harvard server. Someone had hacked into Harvard's server. So you're the ITS content? It was not discussed, at least, with people like me at the time. But I believe they were simply using one of Harvard's servers and an account there on to cover their tracks as they then connected to some other server elsewhere. And you have to realize, too, even though that was one story that became publicly known, there are, I think, 40,000 FAS affiliates right now, faculty of arts and sciences, all of whom can or do have FAS accounts. And by this, I mean email addresses of the form at fas.harvard.edu. With those accounts, even though many of you might just use webmail or some equivalent service, you can actually, as Dan and I have done in classes before, with that account, you can gain access to what we call command line prompts, computer servers, and execute commands and do interesting things. So out of 40,000 people, some of whose passwords probably aren't that strong, some of whose passwords are probably on post-it notes in offices on this campus, you have to assume some percentage of the accounts of this university have already been compromised and are being used for nefarious purposes daily. And so you shouldn't think that hacking and compromise of servers is even all that rare. Just statistically, it's probably happened even within our own community here. And the number of computers that participate in what are called botnets is staggering. So a botnet, long story short, is a network of computers that you and I might own in our homes that are all running the same piece of software, a piece of spyware or malware, if you will, that's designed to talk to each other or talk to some central server so that a bad guy who wrote that program can tell 1,000 computers at once to go email the heck out of some account or some server and therefore deny it service or just hammer it so many times per second that it effectively cripples the site. So that's just one of the powers of botnets. Another popular one is just to have 1,000 client computers, people like us, send spam on their behalf because you can't shut down all 1,000 computers nearly as easily as you can shut down one spammer with one server. Other questions about hacking? All right, so that's personal computers. What about servers now? So there are thousands. There's millions of servers out there on the internet. Some of them are web servers. Some of them are mail servers. Some of them are instant messaging servers. All sorts of services exist as we've discussed early in the course. So this means they're on the internet. They're listening literally for traffic, for internet traffic. And their purpose in life is to respond to that traffic. So what does that mean? Well, it is not uncommon for web servers to have bugs in them. So a bug is a mistake in a computer program. It's as though a human who wrote this program here made a typographical error or a logical error that results in the computer or program sometimes behaving in an unintended manner. What does that mean for normal users? If you've ever had a program suddenly quit for no reason, that's probably a bug. It's a mistake. Someone screwed up. And the outcome of that happened to be that the computer, the program just quit. Worse, sometimes your whole computer might freeze or slow to a crawl or the whole thing just starts crashing or rebooting. Any number of things can happen. It just reduces to bugs. And when we sit down and have you program your own program in a few weeks time, you too will, by nature of the beast, make one or more bugs, one or more mistakes initially. And hopefully you'll catch them. But you'll certainly appreciate firsthand what we mean here. So people make mistakes. People write web servers. People write software. So web server software has mistakes. Now if we, the bad guys, now can figure out what those mistakes are, we can maybe take advantage of them. And that's sort of the theme in security, too. The goal of the adversary is really to find some weak part of your software or your server and take advantage of a poor decision or stupid mistake that you made. So one of the most common attacks is literally for a bad guy to sit down at a computer and write a program or, as I'll simulate here, just open a browser and do things like this. You know what? What happens if I visit this website and just type a ridiculously long URL? Now in theory, nothing. Maybe I'll get an error message. But hopefully doing something stupid like this will not crash computer science 1.net. But maybe it will. Because maybe the persons, whether it's Dan or me or the software we're using for the course's web server, maybe they just never anticipated that anyone would ever type a 1,000 character long URL. So we just didn't bother to think about how we would handle that situation. And there is the fundamental problem. Most security threats or most security compromises are the result of just a human not having realized what could happen if this unlikely event takes place. Now I hit Enter. And in the case of our server here, hopefully mine. OK, so this is actually good. This is a good error message. We've discussed these numbers before. 403 means forbidden. It means I don't have permission to access whatever it is I try to. Now that makes sense. Because odds are I shouldn't have permission to access anything called DJFAS, DJFAL. It's just nonsense. So this is good. But now if I try to go back to the web server's home page and hit Enter, suppose it just doesn't come back. Suppose literally if Dan and I walk across campus, look at the server, it's off suddenly. Or it's frozen, much like our personal computer sometimes. That's interesting. Because that to an adversary suggests, wow. Now this is fundamentally, well, this is arguably useless. It is not to my advantage just serving up illegal files or bouncing from server to server to crash someone's server. That really doesn't benefit me unless I just dislike David and Dan and just like crashing their course of server, which may be an objective. But if they're just trying to make use of the server, crashing it is not a good thing. But it does reveal a hint. It suggests there is some mistake in the server. There's some weakness. Now even though it didn't lead to fruitful ends right now, because now someone has to go reboot that server, maybe next time I'll be a little more careful. Maybe I'll try a shorter sequence and see if I can't find a sweet spot that tricks the web server into doing something that it's not meant to without it actually shutting down altogether. And this is literally what a lot of adversaries do to begin finding security holes, if you will, is they just quote unquote bang on a server. They send it really crazy request, really long request. If it's their own piece of software, they'll click menus in rapid succession or try to type really long strings of text into windows just to see what happens. Because as soon as something unpredictable happens, that means, hmm, maybe I can use this to my advantage. Now, how might they use this to their advantage? Well, it's hard to come up with an example, for instance, on the fly. It does certainly take some savvy. But suppose, similar in spirit to what we discussed last week, the adversary did something like this. Well, nonsense doesn't seem to get me anywhere. But what if I did something crazy, like a semicolon, which I generally no means stop this command, start new command. It's just kind of a convention in computers. And what if I do something like delete from database? So I'm not sure that has any meaning. And maybe on 99 out of 100 servers, it has no meaning. But what if the author of this website is stupid enough to take whatever the URL is and pass it to a program he or she has written? And what if that program does not check for dangerous keywords like delete and just passes them through the operating system who then executes them? Well, this is literally, it's a simple example. And this one in particular is not likely to do anything bad. But this is certainly the general idea, passing bogus but intentionally formed input into a program. And this is a URL. It's going to be passed to a web server, which is a program. So even though this is not a client-side program, it's still a program running server-side, taking input. Maybe this will trick the computer into doing something. And so almost always, what happens here is this. Not to make it sound too technical, but to dispel one buzzword that you might see in the press. If you've ever heard of, whether before or henceforth, a buffer overflow or overrun attack or exploit, what that means is this. We've talked in this course about hardware, specifically RAM. RAM is a type of memory. It's where programs and data live while your computer is running. When you write a program, you generally ask the operating system, you being the developer, the programmer. You ask it for a specific amount of memory. You say, give me enough space for, let's say, eight characters. Context, let's say maybe this is the password prompt for a program. Passwords have to be eight characters or fewer. So when I'm writing this password-checking program, I'm going to ask Windows or macOS, give me eight bytes because I need storage space in RAM for the user to type in their eight-character password. So this in RAM, this is our RAM, let's say, another big rectangle. And the eight bytes I ask the operating system for happen to be, let's say, here. So each of these little rectangles represents a byte, eight bits. And each of these can therefore hold an ASCII character, like someone's password. So the operating system has now given me these eight bytes. And they are mined, the programmers to control, to use, to read from, to write to, anything I want. But if I'm foolish and make mistakes, what if I ask the user for input, a blinking prompt where they type their password, or a URL that takes some form of input, what if I just assume that the user is going to behave and only give me eight or fewer characters? Maybe I am foolish. And if the user's password is actually a really long word, and I'm pretending now to write it into other locations in RAM that I don't have access to, what's effectively happened here is if I don't check the length of the input the user is providing, if I don't cap them at eight characters, I might very easily, very understandably, but very foolishly, start adding those bytes into parts of RAM that I was not expressly given permission to touch. Now they still exist, because I have two gigs of RAM. I only ask for eight bytes. There's still two gigs minus eight bytes available for someone, but I haven't been given ownership of them. Now the danger arises here, and this is the moral of the story. The danger arises in this. RAM can store not only data, but also computer instructions like these, so not sentences, zeros and ones, but the next part of RAM here might very well, just by chance, be devoted to a sequence of steps that the computer is supposed to execute. So you can commingle data and instructions in this way. What you can also store in RAM too are addresses of other parts of RAM. So assume this is a bit of a simplification tonight, but what happens now is if I blindly let the user type in as many characters as she or she wants, and then I just keep writing those characters to RAM, what might I potentially be overwriting? So instructions. So the computer, after I've typed this password, might blindly, by design, try to execute this instruction here, which now is some weird ASCII characters, ngward. It's nonsense. It's no longer a pattern of zeros and ones that encodes an actual instruction. Now if I, the user, just type quote unquote a really long word, odds are the program is going to do nothing. It's going to crash, because ngward is not a malicious instruction. It's not even the dangerous word delete. But, and this is where adversaries get smart, if you know enough about programming and enough about CPUs and what patterns of zeros and ones are used to encode instructions, what the user, the bad guy, can literally do at the prompt or at your URL, is not even type in ASCII characters, but provide patterns of bits, bits in a row that happen to encode instructions, like the zeros and ones that encode the delete command, the zeros and ones that encode the log me in command, if you will. And so what you can do by providing a program or a server with more input, more characters or bytes than it expected, you can trick it into executing instructions that you yourself manually crafted in a very clever way. So in short, almost any time these days, and this is pretty fair, almost any time you hear of a server having been compromised in a technical, interesting way, not because the post-it note was left on the monitor or something stupid like that, to this day, this is still an incredibly common attack, because a lot of the languages in which these programs are written are things called C or C++, or there's a number of other languages, as we'll discuss in our programming lectures, that don't automatically check the length of user's inputs. And for years, and to date, it's really easy if unfortunate for humans to make mistakes with something as simple as this. So it's similar in spirit to what we called the SQL injection attack last week, but it's even lower level, because this kind of attack assumes some savvy with CPUs and 0s and 1s and what represents what. But it's still quite common. So that was a lot. Any questions? All right, so let's close. Let's now step away from humans and think about how some of these attacks are automated. So thus far, we keep talking about a bad guy and adversary. But what if the attacker is not even a person anymore, but rather a computer program itself? So we talked briefly about these last week. What is a virus in your own terms? What's a virus in the context of computing? Perfect. OK, so it's a malicious piece of software. By malicious, we mean it does bad things, why? Because someone had too much free time, or someone thought it would be neat to write this program. That's often what these threats boil down to is people, to put it simply, with too much free time, or with malicious intent. What can it do? Anything. And we've mentioned this last week. If you have the ability to write a program, you have the ability to write a program that reboots computers, that changes the wallpaper, that sends mass emails, that deletes files from hard drives, anything, especially if the target user has administrator access, which most of us have by convention and by default, which means a virus can do anything. But it's a virus, and this term is borrowed from the physiological world, in that viruses, by definition, in the computer world have to latch on to other files. So when you say your computer is infected with a virus, it was usually infected because you opened an attachment, like a .exe attachment, that had a virus inside of it. In other words, if this is a program, it can be infected with a virus if somehow, at the very bottom of the file, at the very end of the file, there happens to be a bunch of zeros and ones that some bad person wrote that collectively implement a virus. It attaches itself to existing files. So this is why you've been warned, by Dan specifically last week, don't open attachments from emails almost always. Certainly not if they promise any kind of animation or interaction like a .exe file would, because at the end of that file might be some zeros and ones, that the moment you double click that program, it gets loaded into memory, and the program itself might run fine. You might not notice anything until later you discover, wow, all of my mail has been compromised. I've been sending spam automatically and it benounced me. Anything can be going on in the background. Now a worm, by contrast, is kind of scarier, and it's more sophisticated, in that worms do not need hosts. They don't attach themselves to other files, and therefore, they don't require the naivete or stupidity of humans to trigger their infection of a computer. So a worm is a program that someone ran somewhere once, but whose purpose in life is just to run in the background, sort of unbeknownst to the user, and try to connect to other computers on the network, locally or on the internet. So they will do this by trying to open up a TCP-IP connection to random computers. They'll pick a random IP address these days, as we discussed. There's a lot of IP addresses in use, very few not in use. So the probability of picking a random IP address and actually reaching a real computer is crazy high. It is so likely that you will guess an actual IP address of a computer, so they just try random addresses. Or they try IP addresses very similar to yours, the idea being that the worm will spread more easily on your local network first, then maybe you take your laptop somewhere else and it will then continue to spread to other local networks thereafter. So worms are particularly scary in that they spread on their own without human intervention. So most of us, many of us, have antivirus software, right? What are some of the tools some of you might have purchased or installed? Norton AVG. Norton AVG is one. Malware bytes. Malware bytes. McAfee is another one. So two of the biggest commercial vendors are called McAfee virus scan and Norton antivirus. A popular free one, though increasingly annoying in terms of user interface, is called AVG. We tend in the course to recommend something called AVG free, mostly because it's pretty darn good. It's pretty darn free. But with that said, they've been adding lots of crufts to the user interface, such that it's much more complicated now than it used to be, so I'm not a huge fan anymore. But if you Google this, this is a free alternative. You don't really need to spend $50 or more for antivirus software. But for tonight's purposes, let's ask not the how much, but the why question. What do these programs do by design? What does it mean to be antivirus? How does that even work? OK, so they're designed to protect your computer from all sorts of threats. Viruses, worms, things called Trojan horses, which is very similar in spirit to these same kind of threats, does something without you knowing it. All our Trojan horses. How do they work? So you install McAfee, you install Norton, you install AVG, and then it runs in the background. What is it doing? So it's scanning your hard drive. So it's scanning for viruses. What does that mean? Well, it's literally scanning your Word documents, scanning your programs, and looking for patterns of zeros and ones that the world has realized represents a given virus or worm that someone somewhere implemented. So when you are downloading updates to your software, and you've probably noticed McAfee, Norton, all these things, they have to download updates once a day, once an hour. What are they doing? Well, humans working really hard at those companies, or these volunteer groups, have realized, oh, there's a new threat. Someone with too much free time last night released this new virus, this new worm, but we've identified it. We know what pattern of zeros and ones identify it. So the software that you've pre-installed downloads nightly on some schedule, what we call signatures. A signature is just some pattern that uniquely identifies with high probability, a threat, like a virus or worm. So humans are constantly teaching your software how to be smarter, how to be more vigilant. But there is a gotcha here, and yet another cat and mouse game. Why is this whole system fundamentally flawed? What's the gotcha here? Yeah? It's always one step behind. Right, we, the good guys, so to speak, are always one step behind, because all we have to do is go to sleep. The bad guy gets hard to work overnight, relights some new virus, writes some new worm, runs a few commands, and infects people on his network, or smarter, infects people in an internet cafe, or smarter, sends out a whole bunch of spam with the virus attached to it that people might then click. Well, all this time, the McAfee employees, the Sennorton employees, have been sleeping. So now they might work furiously in the morning to write the update for you to download, but that just takes time. And I'm being a little goofy here, saying they're sleeping. This could happen in the middle of the day. The reality is humans take time to respond. They're like, scientists need to analyze the code and decide, is this right? Is this wrong? It takes time. So there are these things called zero-day attacks. That's the buzzword here, which means a virus, or worm, or other piece of malicious software that attacks and spreads among computers and infects them before the world. The good guys have even had a chance to respond. And so here, too, we, the good guys, assuming we're all the good guys, are the ones who are perpetually at a disadvantage. And this is sort of the nature of the beast, a bad guy. And this is kind of one of these really neat ideas, if unfortunate. A bad guy to attack us only needs to find one weakness. We, by contrast, to ward off all these bad guys, need to patch all of our weaknesses. So that's really an imbalance between cat and mouse. When we need to fix everything, they need to just break one thing. Absolutely. Oh, is it possible to send a virus, or worm, or other threat via email without an attachment? Not really, because email, by definition, is a textual medium. It's when, so just ASCII characters and the like, it's really attachments where you get executable payload, so to speak. I'm sure you could contrive counter examples to this. But I think the simple, very reasonable answer is no. Viruses are generally spread through email because of attachments, not because of email itself. Yeah. Good question. And let's be precise, so maybe a picture is embedded in an email? OK, so at that point, it's semantics, but I wouldn't call it an attachment, even though it kind of is. That's probably an HTML-based email. HTML is a language we'll get to in our website discussion. In theory, yes. Even images can carry malicious payloads. There was a threat a while back, and I forget which browser, where you could actually infect a JPEG, an image. And if you open that image using a certain piece of, I think, Windows software, maybe it was Internet Explorer or some add-on program, it would infect your computer with something. I'm a little hazy on the details, but the short of it is yes. That is possible for an image to infect you, but less likely, I would say, since that hole was patched. Images should not contain executable code. But even things like PDFs are vulnerable. PDFs, thanks to Adobe, supports a programming language called JavaScript, which is useful because if any of you have ever gotten an interactive PDF, maybe from someone at work, a form that you need to fill out by tabbing to different fields, it's kind of increasingly common. That's done, that's implemented by a way of programming. And that means a little program is embedded in the PDF. In theory, if Adobe or other PDF viewer software make mistakes in their own programs, even that could be used to take over your computer, do bad things. Almost any time you support a programming language, you open yourself up to these threats. Macros, as Dan mentioned last week, macros and Excel documents and Word documents, those two created such a headache for people because it essentially means you can embed viruses in Word documents, in what should be data, but really are executable files. And so that too is a good technical term here. To be executable means for instructions to be run one after another. Data is really not meant to be executed. It's just meant to be read and displayed. And that is not fundamentally worrisome. It's when things are executed that it is. And even yet, and Dan may have mentioned this, what's scarier still is you can buy, for instance, USB sticks these days online, or people have bought things like scanners or random piece of USB hardware that's made in some factory often abroad, and either by accident or by malicious intent. People are sometimes buying hardware products that they put into their computer, and then they get infected with a virus or worm because they double-click some file, or it's designed to just load into memory the moment you insert this USB device. Because again, someone in a factory was either annoyed one day and decided to infect the hardware, or maybe even more reasonably, was using an infected PC to copy the original software onto that USB stick for you, the customer, and they didn't even realize it was infected. So it's really hard to be vigilant these days. It's a scary world, but this, actually, perfect full circle here. So this is one of the reasons that I personally am actually increasingly a fan of things like the iPod and the iPad, which although it comes at an expense where you can do less with these devices because they're more locked down, if you will, you can't open random folders, install random software unless it's been approved by some entity, the upside, frankly, is that this QA process that exists in the form of the app store and the humans that oversee some of the software decreases, but does not eliminate the probability that people like us will experience technical support nightmares or infections on these devices. So that actually, I think, is a step in the right direction. Trade-off, but a good step. It's a good question. So what if your computer has product X, Y, or Z installed? Is that enough? Short answer is maybe. And the catch is that you might think that a good measure to take would be what the world calls defenses in depth, install multiple antivirus products on your computer under the hypothesis. Well, maybe something that Norton misses, McAfee will get. The problem is a lot of these tools don't play well nicely together because they don't want you running multiple products. They want you to just use their product. Or it's just hard, too, to have multiple programs simultaneously watching everything you do without them colliding once in a while. So the short answer is the best practice is probably buy one of these programs or download one of these free programs, but make sure you keep it up to date. But to be honest, the best takeaway overall is to put it in a silly way, to practice safe computing. Take some of what we've said this semester to heart. Don't open attachments, especially if it looks like it might have been sent from some bogus friend. Even if they say this is the cutest little animation you've ever seen, animations mean execution, which means, with the exception of animated GIFs aside, don't open those attachments. I, for instance, have not run antivirus software on my computers for years. And I've been fine. But because I tend to err on the side of paranoia and just not needing to see the stupid animation that my friend really wants me to see in an email. And I sit behind a firewall at home, a home router, and such. So you can take some fairly simple, obvious E1 taught measures and be pretty safe overall. But adding a layer like these programs is not a bad thing. All right, why don't we take a five minute break? I'll bid you adieu, but Dan's up next. See you next week. All right, hello, everyone. Welcome back. So after a yon-tastic first hour, I hope you will now be ready for some of the exciting stuff that we have in this last and final hour of security as related to computers. So if you have any security related questions, now is certainly the time, or rather now meaning the next hour or so, so that we can get them all out of the way before we start diving into some more really interesting security related topics. David mentioned earlier in the first hour that he likes the idea of the iPhone, the iPad, these sort of walled gardens, so to speak, devices that can contain applications, that can run applications, but the applications themselves are vetted. The operating system itself has an extra set of security so that one application can't touch another application, so on and so forth, and this is, I certainly agree. It's a very nice thing in terms of the security. Now there's a lot to be said regarding the freedom that we have with these particular devices. Well now these same restrictions then enhance and increase the security on this particular device might somehow impact the types of applications that we can run. Maybe we can't actually run some applications as in the case with the iPhone and the iPad. Maybe now we just can't run applications in the background, which is sort of an annoyance because maybe we want to be listening to some music from say Pandora or some other music website while we're doing something else on the phone and with the current restrictions that are imposed on these devices, that sort of thing is not possible. But, and like David would say, that's a bit of a white lie because it actually is possible. As with many things related to security, it's not a completely foolproof solution, these devices. There exists this community or this idea especially is related to iPhones and iPads called jailbreaking, which essentially allows a person or a group of people to unlock some of these restrictions on their devices and be able to do more to accomplish more with them. And I say, and I'm mentioning this, not to recommend that you go out and do this because as you can imagine, if you try to crack the security on a particular device, especially your own device, then that can impact security in other areas as well. Maybe some, maybe now that you've opened up this device to run some other applications than what Apple is providing to us on the App Store. Now maybe there will be some other problems that can come up as well. And in fact, there exists this idea of or this protocol. So just like we have to go off into a separate thread for a second, so just like we have HTTP, which is a protocol that allows us to contact web servers and retrieve HTML web pages back from them so that we can display and render web pages on our browsers, there exists another protocol on the internet, something that's called SSH. And SSH allows us to do something that's a little bit different than this. So rather than have a very nice web page or something like that we're very accustomed to, SSH is something that's much more arcane. It presents a terminal window with a blinking cursor and it allows you to type commands into a remote machine. And so for the typical user, this isn't a very useful protocol. In fact, many of you will go home and after a while you'll forget that the term SSH even exists. You may not ever refer to it or hear about it again, but it is very useful for a lot of people that work with computers, especially computers over the internet, on a regular basis. It's useful for people that want to be able to contact computers and perform commands, run commands on remote computers to administer them, to repair them, whatever you want. And it just provides a much easier way and a much faster way arguably than trying to do some sort of screen sharing software or something like that, which sends the entire screen of a server back to your computer. That's nice. It's really, it's all well and good, but it may not be the most efficient means, as you can imagine. It's just, you're sending all of these frames of data, all of this graphical data over the internet and as you can imagine, this would be sort of a slow process. And so using something like SSH, you would then be able to type in just textual commands and be able to run some commands on a remote computer. And so if we bring this thread back to this idea of jailbreaking, so the iPhone and the iPad specifically, they run basically a small version of OS X. It's just a minified, a very mobile version. You don't see it because it's underneath the hood, but both of these versions, so Mac OS X and the iPhone, have underneath the hood something called UNIX. And basically what this means is UNIX is very much a graphical, or not a graphical, but something that looks like this. You just have a text-based representation, a text command line, and you can type in commands here. So maybe I can find out what, what, let's see. Maybe I can find out what files I have on my hard drive, for example. You can just type in some arcane commands, or what you can do is you can then SSH into a remote machine to be able to perform these same commands. And so this is sort of a neat and a fundamental feature of being able to administer these machines and be able to administer servers, like David was talking about just in the previous hour, but because these phones, the iPhones and the iPads are actually have UNIX at its base level, that allows a jailbreaker, once this phone has been unlocked in this, and I mean unlocked in terms of the software, not unlocked in terms of whether you're running this on AT&T, you're running it on T-Mobile or some other service provider. Once you've unlocked the software on this phone, this implies that you can run an SSH server on it. And that further implies that you would then be able to SSH from your computer into your phone and run arcane commands on the phone over in the network. In fact, this is something that happens and very early jailbreaking many years ago when the iPhone first came out relied on people's knowledge of SSH to be able to do this, to be able to log into the phone and then it was sort of a really cool thing to be able to log into it and run the same command, run in this LS command to see all of the files that exist on a phone. And that's neat for somebody who's interested in seeing this level of detail with these devices, but it's not so good for the security of these devices. And so there's been this cat and mouse game of jailbreakers trying to unlock the software in the phone so that they can install whatever software they want so that they can run whatever commands they want on the phone itself versus Apple who've been trying to fix all of these problems. And a lot of these problems are this same sort of idea that David mentioned in the first hour, buffer overflows might are probably very well employed in the software for the iPhone that allows jailbreakers to issue some commands to the phone and bam all of a sudden you're able to unlock it so to speak and get around the security of the phone to be able to do this. And so this is all well and good for us if we're interested in doing this, but if you have SSH and you don't know what you're doing, so this is where the warning comes in in terms of jailbreaking your device. Now jailbreaking has almost become a somewhat common term. People want to do more with their devices than what Apple allows. And so they Google around and read message boards to see what's available and they find they stumble across this idea of jailbreaking. And so I would caution, I would warn against actually jailbreaking your device if you're not really sure what I've been talking about this entire time, what is SSH? Why is this such a big deal? Because you can imagine if there is an SSH server that's running on your phone that allows somebody like me to run a command like SSH and log into a phone remotely that that may not be a good thing. And indeed, usually when you have an SSH server it's password protected. So you can't just type in, oh I want to SSH into this random server and it's automatically going to let you in. No, it usually has a password. But what happens is that when a user jailbreaks their device and installs SSH, there's a default password installed on that device. And so now they have all of this neat extra ability by getting around the security. But what they've done is they've opened up SSH on their phone with a known password and unless they change it, people are now going to be able to run SSH against their phone and be able to log into the phone and run commands or basically do whatever they want on the phone with this SSH capability. And so this is a dangerous thing. And so jailbreaking is neat because you can do things on the device, on the iPhones and on the iPads, that you can't do otherwise, but it also comes with these dangers. So if you don't understand everything that's going on it's something to be careful. And this goes, I think this is true in general with computers. If you're not really sure what's going on, then proceed with caution. It usually is wise to take a step back and try to learn a little bit more about what exactly you are running or what exactly you were doing before you actually execute it to try to prevent a lot of problems down the road. And in fact, there is this simpler idea and we alluded to it several lectures ago, this idea of phishing. And so this is a somewhat simpler concept than jailbreaking and what happens here is someone will send us an email maybe directly or very intentionally or maybe just through some spam. They're just mass spamming out a whole bunch of people and phishing is what it sounds like. They're trying to fish data from you. And it's not phishing with an F, it's phishing with a pH. And I don't know why it's just sort of silly, but it is that way. Whenever you see phishing with a pH, it's referring to this concept where somebody will send you an email from, say, and it'll look like it's from PayPal or it will look like it's from Facebook. They ask you to log in. You click on a link and it shows you a login page and you enter in your username and password and now what happens? Yeah, you've given up your username and password and are you actually sure that the server that you've contacted that is showing you this username and password field, are you actually sure that it's Facebook or PayPal that you're actually doing? And recall that we mentioned there's a way to get around this and that you can hover your mouse over a link in order to try to see the full URL of the website that you're about to click, that you're about to go to and enter your information. But this still seems somewhat risky because they, as you know, they're getting pretty good about trying to fool us in terms of what URL they're trying to send us to. They're trying to send us to, what did David do with that? No, it is not the only way they're able to find your username and password. It's just, it's sort of the easiest way because by sending out a mass email to millions of people or more, they can fool undoubtedly several people and then they are able to receive basically for free a variety of username and passwords that will be correct unless they happen to mis-type it in that instance. But there are other ways of doing it. There's the more direct, well, let's see, the more difficult but more direct route of trying to hack into, so to speak, a website's database that contains the full list of usernames and passwords and then just be able to retrieve all of that information in one fell swoop. There's other attacks there. So there's phishing, which relies basically on social engineering. It's a social engineering tactic where you're trusting that this email that you receive is actually from Facebook or is actually from PayPal. So you click on the link, you enter your information unwittingly. There's other attacks as well, something called man in the middle. So it's as if, let's say I put my username and my password in an envelope and I give it to a person. So going back to this router demonstration that we had, I put all of my information in some packets and some envelopes and I passed it from one router to another. Man in the middle is basically what if one of those routers decides or not on its own, but maybe that router is instead a malicious person decides to peep into all of the packets that exist. They're able to intercept all of the packets before they go along and find out what exactly is being sent. Obviously there's ways around each of these problems, but there is more than just one way of retrieving login information from a website for a specific person. And so back to this idea of phishing, I recall that domains can frequently be fooled or can frequently be altered to look like something else. So www.facebook.badguy.com for example is an example of a subdomain. So Facebook is not the actual domain but it's just the subdomain of badguy. And so this request then is routed to badguy servers even though it looks like it is coming from Facebook. And so this is something to watch out for. Even if you look at the URL and you just quickly scan that URL and find, okay, I see it has the word Facebook in it, you're not necessarily completely safe still. You have to be sure to read the entire domain and understand what that domain is referring to before you click on that link. And in fact, what's an even better way to get around this problem entirely? Yeah, manually type in the URL, exactly. So that's a much better way. So rather than just clicking on a link, you can manually type in the URL and do this. And frequently with banks, if you receive some important notice from banks that says, oh, I need your account information, something like that, and you go to their website manually, you manually type it in and go to their website and you still find, and you don't find any information on it, frequently what you can do is just call their customer service. And frankly, if they have no idea what you're talking about, then it's pretty safe to assume that you're about to be a victim of a phishing attack and it's something that you'll want to try to avoid, certainly in the future. And so with phishing, they can try to get more than just username and password out of you. They might try all sorts of things like bank account numbers, just whatever they think you'll be willing to provide to them. You might be trying to fish for, so to speak. And so we talked briefly about this idea of a man in the middle. So what if we actually went to this website, Facebook.com. So it's a legitimate website. And we talked about this idea of being able to inspect packets, to actually look at packets. So maybe one thing a malicious person might do is if I'm on a Wi-Fi network, for example, they'd be able to inspect all of the packets that are being sent through the air. Another thing they could do is just plug in directly between two routers and see if, I mean, that's going to be difficult, obviously, but maybe if they're able to do it, they can inspect all of the packets here. But how can we make sure that our largen information is safe in this case? We've talked about this several times. It's not really a trick question. Yeah, HTTPS, so we want to ensure that we have a secure connection from us to Facebook.com or to our bank website or what have you. But how does HTTPS actually work? What is it behind the scenes that allows this to work? How are we sure that the data that we are sending to Facebook doesn't get intercepted and somehow modified or read in the middle? Well, there exists this idea of cryptography. And just to give you an idea of a very, very basic cryptographic scenario here, let's say that I have the word hello. And so what are some of the ways that we can actually encode this word to be something else as if we were trying to send it securely? Any ideas? I'm sorry? With numbers. With numbers, but how? What do you mean with numbers? Where it is in the alphabet. Okay, so let's take that a step further. So let's say that we're just going to do like a simple substitution. So now we could convert this to numbers, but then that might be somewhat easy to get to come back to. But let's say that we decided to just shift all of these values. So if we have the letter E, for example, and I'll just write out part of the alphabet, what if instead of E, we moved one place over and we did this for the entire word? Well, it would be now I, F, and P. And this is not really all that secure, but it is a way that you can now change the word hello into some sort of encoded thing. And this brings back this idea of having like a secret decoder ring where maybe you were able to figure out what this word is if you know the secret code. If you have the secret key, so to speak, you can twist the little dial on the ring and find out, okay, well, I means H, F means E, so on and so forth. Well, what if we went a little bit further and we instead did this word, U, R, Y, Y, B. Now what we've done is actually shifted it 13 characters away, but why 13? Yeah, it's the alphabet. So it's as far away from this letter that it can possibly be, right? So this sounds even better. It's like, wow, now we're really making this look kind of crazy, but still, it's not that hard to figure out, right? If you understand that, well, they're shifting the letters. You only have to try 26 different variations to find out which one this word actually encodes. So this is actually called rot 13 or rotate 13. And it's actually a pretty fun way of just encrypting, very, very lightly, some information that you have. It would be stupid for you to do anything that you actually want security to encode it with rot 13. It's more of just sort of a fun thing, like a puzzle that somebody might have to figure out or something similar, but as you can tell, there's really no security with this. If you're aware that you're rotating this and this is more specifically called, or it's more generally called a Caesar Cypher, which allows basically the substitution of some letters with other letters, it's just not a very good way of encoding or encrypting this information. And so there's, after this idea, there was another idea that, well, okay, maybe a way that we can make this a bit stronger is to rather than rotate a letter by 13 away from its current one, maybe we can use just more than one, more than one rotation to figure this out. So what I mean by that is not rotate it 13 and then rotate it 13 again, because what would that do? Yeah, it turns it back. So that's not going to help us at all. But maybe let's say that we had a word like key. And so now what this allows us to do, let's just say that we have this key, this word that's called key. And so what we would want to do is figure out the numbers that this represents. So if A is, say, zero, B is one, C is two, D is three, so on and so forth, we can imagine that this key represents some numbers, right? So I should have done this before, but what would the key be in numbers in this case? Anybody can do this quickly? Because I certainly can't. No? Well, we can figure this out somewhat quickly by, here, let's figure it. Let's do a good way of doing this, would be to bring up an ASCII table. All right, so let's look at our ASCII table. So if A is zero, then that means that we just have to take from this decimal representation, just take that number and subtract 65 from it, and then we would be able to figure out the number. So K is number 75, subtract 65, that means it's 10, followed by E, which is going to be four, followed by Y, which is going to be 24, right? Because it has to be, right, 24, yeah, because it's zero index, so that should be right. 24, yes, okay. So now we have a key that looks like this, 10, four, and 24. So now what we can do is say, okay, I will apply the key to this entire word. So now I will rotate the letter H 10 times. So, okay, I go from H to I to J to K to L, M, N, O, P, Q, R. So now it is going to be the letter R, oops. Now for the letter E, I have to encode that by rotating it four times. So it goes from E to F to G to H to I. So now it is I, and so on and so forth. So this is now a little bit stronger because now you have to have a multi-number key in order to rotate this back. So you have to take R, subtract it by 10. You have to take I and subtract it by four. You have to take the next letter, subtract it by 24 in order to find out what the original code actually represented. So this will be a little bit harder to crack. And this is called, this method is called the visionaire. Vision, maybe visionaire, I don't know. I'm Mexican, I'm not French, I have no idea. So that's a bit stronger of a way that we can encrypt this string, that we can encrypt this word. Now modern cryptography is a bit more complicated than even this. So rather than using a key that's a length of a word, it uses a key, and again it doesn't necessarily have to be using like a visionaire cipher, but it could be using something else entirely, but it takes a very, very, very long key. I'm talking about many, many bits, maybe a thousand bits long of a number, or a thousand bytes even long of a number to try to figure out what key that this was encoded with to be able to decode it, to unencode it, and proceed with the decryption. And so there exists this idea of public and private key encryption. You might have heard of some of these things, and this is certainly a neat way that we have, or smarter people, have come up with encoding certain things. And you can imagine an analogy like this. Let's say that we have an envelope, it's like those packets that I passed around before, and I wanted to be sure that when I received this envelope from say Facebook.com or from my bank website or what have you, that it was actually from Facebook.com or actually from my banking website. So a way that we could do that in terms of an envelope would be to use one of those old fashioned wax seals, so they could actually seal the envelope. And then if the seal was broken, then we would know that, oh, somebody peered into this envelope, somebody peered into this packet. There's no way that I'm going to trust this information now because it could have been modified, it could have been read, what have you. So there exists this idea now of modern cryptography where there's these keys, and there's two different keys generally, private key and a public key. And it's the same sort of idea. Somebody somewhere generates a private key, and this is a key that's private only to them. And this key can be anything, it could be, but it's generally going to be very, very long, very, very large number that's very difficult to guess. And what they will do is they will take that packet and encrypt it with this private key. So now it's as if they've stamped this wax stamp on this envelope. So now they're guaranteeing, they're showing that this envelope is from me. Now they release their public key, and this key is public, and there's a mathematical relationship between the two. So you can imagine that right now, the big thing that you might have heard of is these prime numbers. It's very, very difficult to have one very large number and then factor it out into all of the prime numbers. It uses that sort of idea where it's just very difficult to find prime numbers and a very, very large number to generate both a private and a public key. So they're related, but it's difficult to guess when you have a public key what the private key was. So in other words, this public key is given out to everybody. Everybody who wants it can request the public key. And only with the public key can you decrypt the data that was encrypted with the private key. And so in this way, are you guaranteeing that, okay, if I am using this public key that I got in the past from Facebook.com or my bank and I try to open up one of these envelopes, one of these packets of information from Facebook or from my bank and it opens successfully that I know that it's been encrypted with the private key and that guarantees a couple of things. First, that it hasn't been messed with by somebody else. Well, that's again a bit of a white lie, it's possible still, but it tells us at least very, very strongly that okay, this package, this little piece of information came from the person that holds this private key. So this means that Facebook that I'm reasonably sure that this packet came from Facebook or came from my banking website. And the other thing that it guarantees is that it wasn't messed with. If it wasn't opened, if it came from them, then nobody else who decrypts this private key with the public key, they can't re-encrypt it because they don't have the public key. It's one way, so to speak. So you can really only encrypt something with the private key and only that public key will decrypt that. You can't do the other way around, it's not a two-way street. So somebody that is right in the middle of my computer between Facebook and or rather between my computer and Facebook and tries to intercept these packets between Facebook and myself, let's say they open it and they're able to, at least from Facebook side, they're able to see, okay, well, I see that Facebook is sending them some information about the login. They're not able to change that information. They're not able to change the webpage that is represented by that. And so that guarantees that this is a, well, it's a much safer way of doing it. But if the private key does get out into the public, into the open and anybody can use it to encrypt this information, this whole thing just sort of falls apart. It's really not going to be useful unless the private key is kept private. Is there a question? With a private, they don't, okay, they don't have our private key. We don't have a private key necessarily when communicating with Facebook, but what's happening is that they are, when we try to go to a website, they will package up their website using a private key and then we can decrypt it with a public key. Well, there's a variety of encryption schemes here. And one of the things that they could do is they could, for example, they could encrypt a key for a different type of encryption. Now, when we receive that key from them, then we use that key to encrypt our own data when we send it to them. So it's really that this is very much one way. This is not a two-way encryption, really, because in order for that to happen, you would have to have your own private key encrypt your data and then they would have to have your public key and then in order to decrypt the data that comes from you. That makes sense. So this is really meant only as a one-way encryption. It's really not a two-way. Now, this is called public key authentication. This is important for a variety of things, but there exists another type of encryption as well. It's called private key. And this is a lot easier to conceptualize because there's only one key, this private key, and only the people that have this private key can encrypt or decrypt whatever it is, an envelope or a piece of information or what have you. Very much like this Vigenere Cypher, there was this key that we called key in this case and anybody who has this key would be able to encode our text or decode our text because they would know what that key was. And so with this idea, we can then just, we can send for example, let's say that we wanted a private key. So let's say that we want to be able to communicate securely with another person. Something you can do is encrypt a private key so we can encrypt this key using public key authentication, send that over to somebody else. They can decrypt that. Then they would have the key. And that guarantees that only you and them have this key that it's not modified and then you would then be able to send back and forth information that's been encrypted with that key. So this is a way that we're able to at least more, a little bit more securely send data from one person to another and be sure that that data has not been tampered with. So another way to think of this is to take an analogy of a physical key. So let's say that we had a box and we wanted to make sure that somebody else is able to open this box, but only, we only want that one person to be able to open this box. What can we do? How can we make sure that only one person can open this box? Any ideas? Yes. Put a lock on it and give them the key. Put a lock on it and give them the key. But what if, okay, but how do you do, how do you do that? Like what if they are somewhere else in the world and you need to, are you gonna send them both the key and the box? How is this going to work? So okay, a combination lock, it's the same problem though, right, because you still have to give them the key, so to speak, which in this case is the combination. So you can imagine that we could have say, and this is, it can get a little bit convoluted, but you could put two padlocks on this box, right? And so one padlock, you have the key to one padlock and then you are able to send them a key to the other padlock and then only when you're sure that one padlock has been removed, can the other key be sent and unlocked and it's just, it can be a bit of a mess, right? And so, but this is an interesting way of doing it. It's just making sure that you have a padlock, you give them a key via some method that is locked up on its own terms and then they will be able to open up this chest or this package that contains this encrypted information and use that key to figure out what has been, what is inside. Okay, the takeaway from this is that there are, there's two major ways of encoding information. There's this public key authentication which uses the private key and public key where the private key is used to encode information and only the public key can be used to decode that information and then there's this private key authentication or rather this private key encryption which allows us to take a key and that same key is used to encode and decode some information. That's really the important thing here and that's basically how modern cryptography works is we have these two concepts and through a combination of them are we able to achieve all of the security that we currently have. But as you can imagine, there is, using public key authentication is wonderful for companies with big budgets and they're able to hire somebody that knows what they're doing, be able to generate these keys and be able to run this stuff automatically. But let's say that you are running a server at home. So in this case, recall last week David was mentioning or two weeks ago, I think David mentioned this idea of a sling box, just being able to watch some TV from afar. What though can you do to make sure that when you're contacting this sling box that you are not opening yourself up to a variety of attacks. Because imagine this is a server and many servers do have vulnerabilities like David mentioned before. But let's say somebody else figured out that, okay, David is running a sling box at home, let's say they're somehow able to figure out his IP address maybe by analyzing his emails, for example. Just as an example of where you might be able to get an IP address or just finding it out through some other means, maybe through some web logs or what have you. I mean an IP address is not necessarily private. Somebody can pretty easily figure out that information. Now they can try to figure out what port the sling box operates on, contact the sling box, maybe be able to connect for themselves. This is going to be a problem, right? How can we be sure that services that we're running on our home network behind a router are actually protected by certain things. And not necessarily even by using the sort of encryption, what sort of tactics can we use to make sure that we can protect what's going on in our home network from the outside world, from people that don't have access to our devices, that we don't want to have access to our devices. Any ideas? So one term you might be familiar with is a firewall. So one of the things we want to definitely employ is a firewall so that even though David has a sling box and he's making that public to other people, there might be other services as well that he's running that he doesn't necessarily want accessible to the outside world. And by having a firewall, he's protecting those services, he's protecting his network from the outside world by disallowing those people from connecting to that specific service or to some service that he might be running inside of his home. Now another thing that he can do, and this is not, I mean, this might be just one way of many that you would do this is if you were running a server like a sling box server, maybe you were running a maybe even a website, not for public consumption, but just for yourself. Maybe you just have a small website that you want to access while you're on the road to be able to show off your work that you have at home, for example, and you don't want to spend the expense of doing this. Rather than making available that website on the typical port, Port 80, which is where many people would try to do this, you could configure your router to change the port number to the outside world. So here this Port 80 represents the protocol as we know HTTP, which means that if I try to contact a server that's running an HTTP server on Port 80, then I can connect to that server and be able to retrieve a website just like we have here on the screen. But what if I don't want to make it obvious that I'm doing this? It is possible to change ports. You can change it to be something different. So another typical one is 8080 and you might make it to be something different altogether. And this you could argue is only security through obscurity and you would certainly be right, but this does allow you some protection in that it's not necessarily obvious to the outside user if you're running a service, what port number that is being run on. So they have to search all of the port numbers available to try to figure out which one this is actually operating. And so this is probably a pretty good way of masking some of the services that you're running at home. So maybe you have, for example, this idea of screen sharing. So maybe you want to access your desktop screen from the road. And those usually run off of certain ports as well, but if somebody tries to contact those ports, they'll know pretty immediately that this port probably represents some screen sharing software. And so then they can maybe try to figure out what sort of software that is, take advantage of any exploits or any vulnerabilities that that software has, then all of a sudden they will have access to your computer. So you can set your router to change this port to be something else entirely and try to then mask where or what sort of services you are running. Now it is still possible, even though the port has changed, to figure out what type of service it is, but it's usually at this point you're raising the bar. You're making it a little bit more difficult for somebody to figure out what sort of services you're running, and they'll probably just avoid it altogether. Because when somebody's looking for an exploit, typically what happens is that they search a lot of IP addresses at known ports. So they might just try port 22, for example, which is that SSH port. They might just try a whole bunch of IP addresses at port 22 and see who allows them to connect. And then when as soon as they've made a connection, they know, oh, look, now this person's running an SSH server, maybe I can guess the username and password of a user on that system and be able to gain access to it. Or maybe I can send some malformed code just like David showed before with this really long string of data and crash the SSH system and try to gain access that way. So there's a variety of ways here as well that you would want to protect yourself from doing this. Any questions on this stuff so far? So there's, all right, so we have this idea of cryptography, of modern day encryption where we can actually take a string or we can take some text and encrypt it using a key. And so we have private keys which is shared between everybody to encrypt and decrypt. We have this public key authentication which has basically a one-way encryption that allows somebody to encrypt something and only that public key will be able to decrypt it. And then this separate idea altogether where we can then protect services behind our home network just by doing some smart things by changing around some of the ports, some of the well-known ports that somebody might typically search for. Now I do want to switch gears a little bit and talk about DRM. So this idea of digital rights management which David alluded to before, and this is a way, this is a method of security that companies try to protect their own copyrighted materials. So you might be most familiar with DRM from what? So you hear DRM, what do you typically think of? Music, right, so especially the iTunes music store, for example, a couple of years ago was primarily protected by DRM. And what this means is that you would purchase a song, you would download this song and it would be encrypted in some way, probably using something like a public-private key encryption so that only you were allowed to decrypt the song and listen to it. And further, it was more than just you that was restricted to listening to the song, it was you using some specific software. So it required some software that is known to work with this specific type of DRM. You can imagine that this would cause some sorts, some all sorts of headaches, so, oops. So imagine that we have a device like the iPod which can allow, which allows us to play these DRM protected songs, but only when purchased through iTunes. But what if we had some other device, maybe a phone that isn't an iPhone or maybe we have some other MP3 player, we download some songs from iTunes, we try to put these songs on our device and we try to listen to them and we can't because the software doesn't allow this to happen. And so DRM is, or digital rights media or something silly like that. Again, it's one of those acronyms that you just have to know, but you don't really have to, you have to know what it is, but it really isn't that important what it stands for. Digital rights management is what it stands for if you really want to know. It restricts people and it restricts the access of specific things like music or videos to specific people and those people can really only use specific pieces of software to get around it. And there's a variety of examples of DRM like iTunes. Luckily now, most if not all of the iTunes music stores now DRM free, which means that you can now put these songs, you can download these songs and put them on any device that is able to play the AAC file. I don't think it's, it's not a typical AAMP3 file. Apple has that AAC file format for their music. So now you can, you can do this, but what is DRM supposed to restrict? Like what is the whole point of all of this complexity of encrypting a song and making it so that only the user with a specific piece of software is able to do, what's the whole point of this? Right, so not to download for free. And I heard more general, maybe better explanation is money. They want to make sure that if, if somebody else wants this song, they also have to purchase this song. And so it's great for many of us to that DRM is, that there's, that the iTunes music stores now DRM free doesn't, because we're not necessarily prone to sharing all of our music with the outside world, but maybe we want to just use it on a variety of devices. Maybe we just want to allow one of our friends to play that song on their own iPod or what have you. It just, there's a variety of legitimate uses for songs or for other DRM protected media that just are not allowed with this, this digital rights, this digital rights management. But you might be fooled into thinking, okay, well now that the iTunes music store is no longer has DRM that I'm okay, that I'm safe to do these things. Well, not so fast because what they do now, and this is sort of a specific example, but very much serves as a warning for those of you that are interested in sort of this illegal file sharing, realize that as soon as you buy an iTunes song, they embed your username, your iTunes username within the music file. You don't see it. It's not something that's played back, it's invisible to you, but they're able to find out if you look at the information for that song. For example, it actually shows you who purchased that song, and so it's a way of tracing back who actually purchased the song, and so if there's a million copies of a song that, and it has your name on it, now they sort of know who to go against, or at least they have a stronger case to try to figure out who actually purchased and is then sharing this music. So just because things are DRM free, doesn't mean that we are capable now of doing all of these illegal things. And in fact, it's a good idea not to, of course, it's just be mindful of what you are doing and make sure that you are sticking to the legality of each of these devices, yes. Yes, right, so that's the whole point, is that DRM in my mind, and despite this whole idea of the legality of it and being very careful with distributing this content, it's almost, and pretty much in every single case that I am aware of, it's possible to get around DRM. It's possible to get around this encryption in some form or another. So for example, in iTunes, one of the easiest ways to get around this was just to burn a CD with that song on it, and then now that CD, of course, does not have DRM. So now you can just give that CD to whomever you want and they will be able to listen to that song and then maybe even re-rip that CD into their own DRM free MP3 file or DRM free AAC file, what have you. And so that sort of gets around the whole idea of DRM itself. And so, I mean, there's more examples of this as well. So DVDs have, for a long time, been encrypted with something called CSS. And so they figured, oh, okay, now people are not going to be able to take the digital movie off of a DVD and share it across the internet. Well, it was cracked within a couple of years by this really brilliant guy, I think, out in Sweden or Norway, one of those countries. And he actually cracked this huge encryption scheme and so now it's very easy, very possible, despite these encryption schemes to rip so-called rip a DVD onto your computer and perform all of these things. And similarly, let's see, there's some other ones like Blu-ray as well. So that is one where they had an even harder encryption scheme. They said, oh, okay, people are never going to be able to crack this. Well, guess what, they did. And it's really silly to find all of these DRM protected songs and movies because people really want to get around them. They will. It's not, I mean, the nature of the beast. Computers are what they are. It's very easy to be able to copy ones and zeros. What they're trying to prevent you from doing is that same sort of fundamental idea, is that they're trying to prevent you from copying these ones and zeros that make up this file. And it's sort of silly to combat against that because there's just so many ways of accomplishing the same task on a computer that it's just going to be sort of fruitless after a while. And in fact, Sony, Sony BMG Records came up with this idea that they would try to DRM protect some of their music CDs. And what they did was they installed on the CD itself. It was a music CD that would play in a music player, but they had a small bit of code written on the CD itself that when you installed it into your computer and you tried to listen to it, it silently, without you knowing, installed some software on your Windows-based computer, and it would then restrict what you could do with the music that was on that CD. You could no longer rip that music into an MP3 and put it on your iPod, for example. You could only listen to it. I think, I'm not sure if this was true, but they had the capability of restricting how many times you were capable of listening to that specific CD. And this sort of brings together a whole bunch of security problems. Like, okay, this is a really fine line between software and sort of like malware. They're intentionally, and almost depending on how you look at it, maliciously installing this software that's altering how you expect your computer to behave. And this actually, they had a big problem with this. There were several class action suits against them for this. They tried to release, because of consumer backlash, they tried to release some additional software that would remove this so-called root kit from your computer and allow your CD player to operate normally again. And in fact, the first two times that they issued out a fix failed themselves, so it was just this huge thing. And the irony is that it really didn't save them from anything, because it was still possible to put this CD in a Mac or in a Linux machine or even in a Windows machine. And so long as you held down the shift key, that software was not installed, you could still copy all of the data off of it. So they just, they went through all of this trouble and for years they had this tarnished reputation. They were absolutely slammed in the press for this, for this horrible thing that they did and perhaps rightly so, because this is not a cool thing to do, but it's so easily circumvented that it sort of brings up the point, like why bother? What's the point of them doing all of this if they just want to, if it's just so easy to go against this DRM anyway? So there's other DRM, there's other examples of DRM as well. TV broadcasts also have some DRM associated with them. It's not that they're necessarily encrypted, though some of them are, specifically some cable or now many cable channels, especially here in the Boston, Cambridge area. But even the free broadcast that you can get over the air, even though it's very fancy HD picture, which actually surprises a lot of people, but it's actually really neat. You can just plug in an antenna to your fancy new huge HDTV and get a couple of HD channels, which is pretty neat. But even these broadcasted shows have something that's called, or they can have something that's called a copy protection flag. And so this is sort of the bane of many TVO users is that this flag, if software decides to listen to this flag, they will not allow the show to be copied from one device to another. So let's say that you set your TVO to record a specific show, you happen to have another TVO in the house somewhere. And TVO has this technology that allows you to send a show from one TVO to another. So, and this is a very reasonable thing, right? Because you can record a TV show in one room, then you maybe want to watch it in a different room. This is not an unusual request, I would think. And, but if this copy protection flag is enabled, it prevents the copying of that file from one TVO to another. And it just, again, is sort of silly. But again, it's just a flag. Like it's not, it's not stopping anybody from really finding out the raw bits from this file still being able to copy this data. There are some DVRs, so to speak, that don't pay attention to this flag and they will allow you to copy this show from one device to another. And it just sort of raises into question this whole idea of DRM. And so, like many things with security, well, no, DRM is sort of a silly security, I think. I'm not sure that it will be, well, I hope that we won't see much more of it much longer, even though many corporations and companies seem hell bent on using it no matter what, even though it's so easily circumvented. But with all of these ideas of security, and as you've seen in this lecture and in the previous lecture, you can see that it's easy to circumvent security, not only maliciously, intentionally, but even accidentally. Maybe you make a mistake. You accidentally open an attachment and this is a virus and it decides to delete all of the files on your computer. So security is a big important thing. And so I'm going to end today recommending heavily, heavily, heavily that you back up. And not just back up on a dinky little external drive that you have connected to your computer all the time. No, no, no. I'm talking about if you have important documents, you back them up and you disconnect it from your computer completely because that is the only way that you're going to guarantee that if you download some malicious software that doesn't delete everything on every attached hard drive because imagine how devastating that would be. Oh, I backed up all of my stuff, but it's deleted my backup. It's sort of silly. So don't just back up onto an external hard drive. You might rotate. You might have two hard drives, one that is disconnected, one that is connected and then every week or so you just swap them or something like that. Just some sort of scheme that will protect you. And I guarantee you will have a problem at some point and don't be one of those people that starts backing up after the problem has already happened because that's not what's going to save you. Start doing it now. And trust me, I will save my rant for another day, but I have like four or five backups and I've found that sometimes even that is not enough. So back up your stuff, please. Yeah, well, better than a floppy disk, you might email them to yourself like where documents are relatively small. You might email them to yourself. You might use like a USB thumb drive. You might have some space online, some private space online that you can just upload them to the cloud, so to speak. Just put them there and just save them and just disconnect all of these devices from your computer before then. Until then, but until next week, that's it for security and we will see you then.