[MUSIC PLAYING]
DAVID MALAN: This is CS50 Live.
Now, you may recall just a few weeks ago GitLab,
a popular website for hosting people's sourcecode
suffered a bit of a error, whereby they deleted a whole lot of data
from their customers.
And it turns out just a few weeks later, did another company, DigitalOcean--
this one a cloud hosting provider, whereby you can host your websites
on them in the cloud--
also made a bit of a mistake.
Indeed, they reported this.
"On April 5th 2017 we began to receive alerts
that our public services were not functioning."
They went on to say, "within three minutes of the initial alerts
we discovered that our primary database had been deleted."
The root cause of this incident, they later said,
was, "an engineering driven configuration error."
they went on, "a process performing automated testing was misconfigured
using production credentials."
Now, for more on this, and to explain this failure let's
go to a CS50's own, Doug Lloyd.
DOUG LLOYD: An engineering driven configuration.
No.
Somebody screwed up.
Somebody typed the wrong thing.
And they screwed up.
Back to you, David.
DAVID MALAN: If you'd like to dive in deeper to this particular error,
head to this URL here.
Now, speaking of failures, also in the news of late was CloudFlare.
This time a cloud based company that provides content delivery network
services, or CDN services.
It turns out that this company, which many other websites use in order
to serve up their data, static data, in particular, HTML, and the like,
had a bit of a bug, whereby they were accidentally leaking some customer's
data in other customers websites.
In particular, in some cases, which, to be fair, were rare but common enough
that researchers at Google and beyond saw this,
if certain web pages had HTML like this where the tag was not
fully closed as there at right what would happen
is this, so-called buffer overflow, whereby data actually leaked out
of their servers to the wrong customers.
So for instance, if a customer was very deliberately pulling this music website
here they might actually see, maybe later in the website, or somewhere else
in its source code, text, or specifically HTTP headers,
and other data, belonging to other customers.
Now, who might those customers be?
Well, if I'm visiting this music based website,
I might actually be seeing data from other customers who
have accounts on Uber, or OkCupid, or FitBit, or others,
which is to say, even, if I don't have an OkCupid
account, or Fitbit, or an Uber account, I
might be seeing someone else's data who actually does.
So suffice it to say, this is bad.
But its origins could be traced to a very specific line of code.
In fact, in C, on the servers that CloudFlare were running,
were these lines here.
And notice the check of two pointers, P and PE for equality.
The result of which was this, because of that overflow error
it's possible that PE could sometimes be smaller than P. And so,
simply by checking only for equals equals
was the problem, ultimately resulting.
And so had the check been done using greater than or equal to,
instead of just equal equal to, jumping over the buffer end
would have been caught.
A simple fix, and a relatively simple problem, with massive implications
for customer's privacy.
Now, in other, even scarier, news is in Brazil,
whereby bank robbers actually hijacked and robbed
a bank that was using its website in order
to provide users with transactions, and support for adding online banking.
Unfortunately, they were not particularly secure.
And these bank robbers were able to digitally take over
their entire network.
For more on this particular attack let's turn
to see us CS50's own resident security expert, and only Jeopardy champion,
CS50's own Doug Lloyd.
DOUG LLOYD: Thanks David.
As you point out, this is, in fact, a modern form of bank robbery.
What happened in this case is that customers went to visit their bank
website, or what they thought was their bank website,
but actually were visiting perfectly duplicated clones created by hackers.
And what these hackers were able to do is to hack into the domain name system
to change where the customers thought they were going.
In fact, this attack was even so secure that the hackers were
able to secure SSL certificates, which create those green locks that we
see in our URL bars, and our browsers to indicate that a site is secure.
So the customers were visiting this bank website,
thought that they were accessing something secure,
and they would type in their banking credentials,
and complete the hacker's attack.
Now, to date, the bank in question has not even
been identified because those hackers were
able to change the domain name system records,
and the bank couldn't then even email their customers as a result.
DAVID MALAN: Now, Doug, you keep mentioning domain name system records.
What are these, exactly?
DOUG LLOYD: So David, recall that the domain name system maps, commonly used
URLs that we would type into our browser bars to IP addresses.
And what the hackers were able to do here
was to convince the registrar of domain names
in Brazil to map the bank's legitimate domain
names to the hacker's IP addresses.
DAVID MALAN: Now, this all, Doug, sounds very sophisticated.
What can little customers like me do to protect our hard earned money
in banks like this?
DOUG LLOYD: That's a great question.
And I would recommend that everybody do what I do,
which is to put all of my money under my mattress.
DAVID MALAN: Thanks, Doug.
Well, now, here closer to home has been reports of fishing.
Indeed, all over campus here at Harvard are
posters like this encouraging people to report phishing,
the process whereby adversaries send you an email that might look legitimate,
but is really some form of spam, but that generally contains links,
or URLs to other websites that also look legitimate, but are,
in fact, copies of other websites, not unlike banks, whereby you can then
trick users into providing you with their usernames,
their passwords, thereby, ultimately taking over their account.
In fact, according to this very click-baity headline,
Everyone Is Falling For This Frighteningly Effective Gmail Scam.
Now, what is this?
And how is it plaguing campuses like ours?
Well, if you're a Gmail user you might recall
receiving e-mails that look like this.
And sometimes, of course, your e-mails contain attachments.
Now, Gmail draws your attention to the attachments
by providing with a very convenient downward facing icon
that when clicked allows you to download that PDF.
But what if an adversary, someone trying to deceive you,
has sent you, not an attachment, but simply an otherwise blank email that
contains an image embedded in it that looks, per this rectangle,
exactly like the rectangle that g-mail generates automatically
for actual attachments.
Moreover, what if this embedded image is really
a hyperlink to some other web page that then asks me for credentials,
like my Gmail username and password?
Now, normally this wouldn't be such a concern, because if a link like this
led to a web page on some foreign server where
I'm being tricked into typing in my credentials,
well, Harvard, or my internet service provider,
or ISP could simply block, ultimately, that website so that very few customers
actually fall for that trick.
Unfortunately, it turns out that the web supports
what are known as data URIs, whereby this particular attack was
linking not to a remote website, but to a URL that looks like this.
And notice, in particular, it starts with data colon
followed by a whole bunch of text.
Well, it turns out, you can embed in the URL bar
of a browser enough information, enough HTML, CSS, and even JavaScript,
to make the page that's displayed actually look like a Gmail log
in screen, like this one here.
And indeed, if you then type in unwittingly your username, and perhaps
even your password, and hit enter, that username and password
is sent to the bad guys website.
Not, to the actual Gmail.
Now, how does this work, and how do these URI's actually function?
Well, here's an example of an actual data URI.
And among the compelling uses of these things
is to embed images and other assets inside of web pages
without having to link the secondary files that then have to be loaded,
typically a bit more slowly.
Notice that too begins with data colon, specifying this is a data URI, or URL.
Then it specifies what the type of the file is that follows.
In this case, it's an image of type BMP, or bitmap.
And then it specifies how it's encoded, which in this case
is not binary, not decimal, not even hexadecimal, but base-64,
which is a base system that uses letters, both capital and lowercase, as
well as numbers, as well as a couple of other characters, to represent,
as text, what might otherwise just be zeros and ones, or binary.
Now, the characters that follow, while they
look like purely alphabetical, and syntactic characters
are actually the base-64 encoding of an image.
This image here.
Now, let's enhance.
And you might, indeed, see a familiar face.
That is literally the file that's embedded in that data.
And so with the bad guys did in this Gmail attack
is actually embed a functioning web page that was base-64 encoded, instead
of it being as simple as a simple happy Smiley face.
Now, thankfully, browsers like Chrome can help
us notice when websites are legitimate.
Here I'm at accounts.google.com, and it starts with HTTPS,
and Chrome is telling me, in green, that it's secure.
As a result of this attack, and others like it, has Google also
added functionality to Chrome so that if a user accidentally, or even knowingly
visits a data URI, that begins with data colon,
now are users informed, a little more clearly, in gray,
that this website is not secure.
And now it-- actually, wait, this just in.
I'm hearing from CS50's own Doug Lloyd that there's actually
a hacking attack in progress.
For more on this, let's go to our live feed of the hack in progress.
[MUSIC PLAYING]
And now, of course, no discussion of security of late
would be complete without mention of our own CIA,
or Central Intelligence Agency.
Indeed, it was recently revealed by Wikileaks.org
that the CIA has been taking advantage for some time of bugs in software
in order to wage attacks against owners of the hardware
running that software, including popular devices like Android phones, iPhones,
TVs, and more.
And in Vault 7 in particular did Wikileaks reveal the CIA hacking tools.
Specifically referring to such initiatives by the CIA,
seemingly adorable initiatives like, Wrecking Crew, Crunchy Lime Skies,
Elder Piggy, Anger Quake, or McNugget, which indeed sound delightful.
But when you actually read about what these code names mean they actually
refer to a systematic process for identifying bugs in software,
and therefore, potential exploits, writing
software that take advantage of those bugs, so as, to effectively,
hack into people's software and/or hardware.
And potentially affected are familiar tools like Skype, our own WiFi
networks, PDFs, anti-virus software.
In addition to popular devices like the very phones in our pocket.
But, all too close to home, frankly was the fact
that Samsung TVs seem to be the result, or the victim,
of some of these very exploits.
In fact, adorably, Weeping Angel was the code name
for a project that took advantage of bugs
in Samsung TV'S own software, Smart TVs software, in order
to turn on, without customers, apparently knowing,
those devices microphones so that you could theoretically listen in
on conversations, and even record them, even while giving
the appearance that the TV is off.
So the user thinks the TV is off, and he or she is talking.
But meanwhile, that TV is actually listening.
Now, you may recall it wasn't all that long ago
that the CS50 itself blew the lid off of another problem with Samsung Smart TVs,
whereby at the time, though they claimed and thought
they were actually encrypting such data, because these microphones are
present so that you can talk to your TV, and issue VoiceBase commands,
will recall that data was not actually being encrypted.
Now, what is a Smart TV in the first place?
Well, at the end of the day, our TVs are no longer just televisions.
They are actually full fledged computers with hardware and software within.
And indeed, if you have such a Smart TV, whether it's
Samsung, or something else, you may very well have icons like these on your TV,
much like a tablet, or a phone.
And that's because you can install software on TVs today.
But if you can install software you can surely install accidentally
buggy software, or unknowingly exploitative software,
that's actually doing something it's not supposed to do.
But even scarier is when our hardware has things like these things here.
Cameras and microphones that are supposed
to be used for good and not evil.
As this man here is talking to his TV and using Skype
by talking into his remote control.
That in fact is meant to be a feature.
But when these things can be turned on without our control,
and when they can be turned on even when we think they are off,
therein lies the threat and the scare.
Now, how do you know if you are among those that were affected?
And indeed, if you are suspicious that the CIA is spying on you,
how can you confirm as much?
Well, if your Samsung TV was manufactured in 2011 or 2012
this particular attack is germane.
However, to be fair, the attack requires that the CIA tiptoe into your home,
presumably, plug-in a USB stick with the software,
in order to take advantage of this bug.
But if that too is a threat, consider that the software
your smart TV must be running for this attack to work
is either version 1011, 1012, 1016.
And there have been newer versions since.
But the biggest help, perhaps, is if when you think your TV is off you
actually still see a blue LED light on in the back.
It might actually be listening, and god forbid, watching you.
For more on this particular attack and others, you can take a look at this URL
here.
That's it.
For CS50 Live, thank you so much to CS50's own Ian, and Andrew, Marinda,
Ramone, Skulli, Dan, Arturo, Christian, and of course, CS50's own, Doug Lloyd.
This was CS50.
[WATER SPLASHING]
[BIRD SQUAWKING]