Research and create a writeup of a security incident, security
vulnerability, or other similar probelm according to an assigned topic. The
hand-in format requirements are slightly different for this assignment, so
please pay close attention! Most students should expect spend in the range of
30 minutes to 2 hours on this assignment, with longer times mostly because you
find the topic interesting enough to be worth exploring in depth.
- Compute a random number based on your name modulo 50 using Wolfram Alpha.
This is your topic number
- Use this formula with your name instead of the instructor name:
((hash["PhilipKOOPMAN"] modulo 50)+1)
- Hint: click this link,
https://www.wolframalpha.com/input/?i=%28%28hash%5B%22PhilipKOOPMAN%22%5D+modulo+50%29%2B1%29
change to be your name, then press "enter" Look at the
"Result" to get a number.
- This is intended to generate a pseudo-random number in the range: [1..50]
(the first 50 items in the list below). It is intentional that the rest of the
list is excluded in this homework.
The writeup except for any references/citations must cover the following
items and fit onto ONE wide-format (16:9 aspect ratio) slide:
- Story number and name from the list (e.g., "#3 US
Colonial Pipeline attack (2021)") as the slide title
- Summary of the security issue with an illustration
(e.g., from news or analysis article)/ A couple bullet points are fine if you
are cramped on space. What's the headline here? A clipped news story headline
and a paragraph or two of news or other text is fine if it gets the job done.
You've seen this done many times in our class lectures by now. Just put enough
there that you can remember what the story is when called upon.
- Security requirement: what security requirement does the security
problem violate for this system? (Is it keeping information secret? Keeping the
system available to the user? Privacy? Something else?)
- Threat: Who attacked the system, and what was the motivation of the
attacker (extortion, fame, military, something else)?
- Vulnerability: How did the system get attacked? Was it a technical
vulnerability or did they trick users into giving up passwords (social
engineering), or something else?
- Mitigation: How was the problem mitigated (or how could it be
mitigated?)
- Cost: what was the cost, number of systems affected, or other
consequence of the attack overall?
- Put your name and Andrew ID somewhere at the bottom of the slide so we can
keep them straight. ALSO, put the NUMBER of the security topic in the
slide header or text box at the top of the slide so we can organize
presentations by topic number.
You should plan to present your topic in about 1-2 MINUTES in class. Yes,
that's pretty quick, but it will let us get through all the topics in a single
class meeting. This means that you should rehearse giving your
presentation, which should follow the outline given above for slide contents.
If you want to have written notes to work from that's perfectly fine.
If desired you can have a second slide with more detailed references and any
additional notes. However, only the FIRST slide will be shown in class.
Everything you want to show in class MUST fit on that one slide! All students
will be presenting this homework in class, and you'll only be able to talk to
your one primary slide.
The hand-in format MUST be an Adobe Acrobat (.pdf) format as a
SLIDE IMAGE (not a microsoft word style document; not
powerpoint). "Slide image" means 16x9 aspect ratio with large fonts
legible in the classroom when projected full screen. Ideally just the one
single slide. An optional second slide can be included. This means no separate
name slide, no multi-slide substantive presentations, and no animations. It
MUST be in Acrobat so that the instructor can put all the presentations into a
single file before class to avoid wasting time opening a new file for each
presentation. Make sure that the acrobat file is cropped so that the image
substantially fills the entire page. (If it has large margins around the slide,
nobody will be able to read it when on the screen). For example, the acrobat
format of the the web version of course slides for this course is what we're
after. Be sure to embed fontsso it displays properly.
Topics: Select the topic corresponding to your attendance number. If
your attendance number is higher than the highest topic number, do appropriate
modular arithmetic to wrap around down to a defined topic number.
- GPS spoofing (many years; pick an example)
- Point of Sale malware (many years; pick an example; often abbreviated
"POS")
- Rivian secret diagnostic menu (2022)
- US Colonial Pipeline attack (2021)
- ADT security cameras in Texas (2021)
- SCRIPT SRC=HTTPS :/ / MJT . XSS . HT LTD (2021)
- GE radiology devices default password (2020)
- Intel CPU firmware update secret key (2020)
- Ultraloq door lock (2020)
- Consumer Reports video doorbells (2020) (OK to pick one or give a general
summary)
- Temi Robots (2020)
- ATM Jackpotting (Diebold Nixdorf PRocash 2050xe) (2020)
- Dongguan Diqee 360 robotic vacuum (2020)
- Minuteman III Maze ransomware (2020)
- TCAS spoofing (2020)
- Philips Hue smart lightbulbs (2020)
- August smart lock pro (2020)
- Medtronic carelink (2020)
- Apex Legends at PDX airport (2020)
- Ring camera ransomware (2019,2020)
- Voice deepfake CEO scam (2019)
- 600,000 gps trackers (2019)
- ZipaMicro Z-Wave smart hub (2019)
- Blue Link remote car accessory control (2019)
- Medtronic insulin pumps (2019)
- Ford F-150 key fob (2019)
- iTrack/ProTrack GPS tracking (2019)
- Texas tornado siren (2019)
- Xiaomi M365 scooter (2019)
- Miura M010 Reader (2018)
- Strava fitness app/military (2018)
- Triton malware/Schneider Triconex attack (2018)
- Amazon Key technology (2018)
- Aldi store credit card skimmers (2018)
- TSMC chip fab shutdown (2018)
- Diqee robot vacuum (2018)
- Satcom passwords on commercial shipping (PTP) (2018)
- Tapplock (2018)
- VingCard electronic locks (2018)
- BMW Security report (Keen Secuirty) (2018)
- Volkswagen Harman MIB attack (2018)
- Pet trackers (Kaspersky) (2018)
- POS Terminal card hacks (Kaspersky) (2018)
- I-SIG traffic lights (2018)
- CalAmp/vehicles (2018)
- Fish Tank thermometer/casino hack (2018)
- Fender guitar amp (2018)
- Dell EMC VMAX (2018)
- Hanwha SmartCam (2018)
- Orangeworm/healthcare equipment (2018)
- Prilex ATM malware (2018)
- Aadhaar (2018)
- UK School CCTV (2018)
- MicroLogix PLCs (2018)
- Philips imaging software (2018)
- Gas pump fraud / Russia (2018)
- iPhone unlocking by FBI (2017/2018)
- Hospital smart pens (2017)
- UK school heating controls (2017)
- Lexmark Printer misconfigured (2017)
- AMAG keyless entry locks (2017)
- Furby (2017)
- Vaultek VT20i handgun safe (2017)
- Oneplus phones (2017)
- Mercedes relay box (keyless entry) (2017)
- LogicLocker (2017)
- Alex the casino hacker (2017)
- Romantik Seehotel ransomware (2017)
- LG SmartThinQ (2017)
- Mantistek GK2 (2017)
- NHS WannaCry (2017)
- Ethereum Parity Wallet (2017)
- Brickerbot (2017)
- Samsung TV (2017)
- Vizeo ACR (2017)
- Boeing 757 (2017)
- Uber breach cover-up (2017)
- Cloudpets Teddy Bear (2017)
- Circle with Disney (2017)
- Smiths Medical syringe infusion pump (2017)
- Fitbit (2017)
- LockState smart locks (2017)
- Hikvision cameras (2017)
- Subaru key fob (2017)
- Intel management engine (2017)
- Equifax (2017)
- AdUps (2016)
- Voting machine hack (Andrew Appel) (2016)
- Frantic Locker on smart TVs(2016)
- MUNI fare system (2016)
- Mirai attack (2016)
- Lappeenranta attack (2016)
- Owlet baby monitor (2016)
- Levin SQL injection (2016)
- Hello Barbie doll (2015)
- VTech hack (2015)
- Progressive Snapshot dongle (2015)
- Samsung smart fridge hack (2015)
- Martel body cams (2015)
- XCodeGhost (2015)
- Nest thermostat (2014)
- Trendnet Webcam (2013)
- Satis toilet (2013)
- Mifare classic (2008)
- Keeloq (2007)
- Siberian gas pipeline explosion (1982)
Hint, you should find it easy to find material if you enter the phrase for
the topic and add one or more of the words: {hack, attack, vulnerability} to
start your search for references. As always, Wikipedia might be an OK starting
point but we'd like to see you take your material from a primary reference if
at all possible. News stories and reputable on-line reporting sources are OK
and often the only real source, but use the most credible source you can find
with a few minutes of searching. Using multiple sources is fine if
appropriately cited. If you want to use a second slide JUST for sources that's
OK, but keep the presentation itself to a single slide.
RUBRIC:
- MUST BE IN ACROBAT FORMAT. This is a 100% hard
requirement.
- One slide with
- Topic # and topic name at top of slide
- Summary bullets
- Illustration/picture/photo/etc.
- Security requirement violated
- Threat
- Vulnerability
- Mitigation
- Cost
- References (OK for this to be on second slide if needed)
- Format per HW #1. Page size and font size requirements are strictly
required!
Supplemental Reading:
Selected Additional items (there are plenty more not on the list, also see
examples in course slides):
If you get stuck, many entries in the list are part of the IoT Hall of
Shame. There are WAY too many stories there for us to hit them all. Which is a
problem...https://codecurmudgeon.com/wp/iot-hall-shame/