9. Digital signatures
In this video, I’m going to be talking about digital signatures and what exactly is it and how do we do it? Okay, so first of all, you got to understand something about a digital signature. A digital signature is something that’s appended to a message that basically does three things. Number one, authenticate. Number two, non repudiation. And number three, integrity. A digital signature does not encrypt data. Okay? So if I have a message that I digitally sign and send to you, you’re going to know it came from me. I’ll be able to prove it came from me.
You’ll know, it was never modified, but the message is actually sending clear text. If you want to encrypt it, you can use other things like VPNs, IPsec, SSL, whatever. But a digital signal in its purest form does not encrypt information. It does not provide confidentiality. So it provides what? Authentication, non repudiation and integrity. So here’s what that means. If I take a message and I sign it and I send it to you, I am going to be able to prove it came from me.
Proven to you that’s authentication, you are going to be 100% sure it came from me. And I can’t deny it. That’s the non repudiation. So I can’t repudiate sending you that message. I can’t say I didn’t do it. And you’ll also be 100% sure it’s never modified. How do we do this? It’s done using two types of cryptographic algorithms. It’s done using Asymmetric and hashing. It uses asymmetric keys and a hashing algorithm in order to do this process. And a digital signature is really an encrypted hash. That’s all it is.
It’s basically an encrypted hash encrypted with the sender’s public key. Remember Andy and Mary? Do you guys remember me and Mary? Again. Here’s what I’m doing. I’m going to take a message and I’m going to sign it and send it to Mary. And then Mary’s going to verify it. Now, if you ever wanted to meet Andy, well, you’re about to meet Andy, because it wasn’t me or I’m Andrew. I don’t know who this is. Andy. Guys, it’s Meet Andy. So here’s Andy and here is Mary. So I want to take a message, and I’m going to sign it, and I’m going to send it to Mary.
Here’s how this works. I’m going to take a message and I’m going to hash it. Remember, when you hash things, you get to digest, right? So I’m just going to hash it if you guys remember how I did hash. And here’s the thing. I’m going to encrypt it with my private key. That’s where you’re going to get this non repudiation off, because who is the only person that’s my private key? Me. That’s the digital signature. So the digital signature is nothing more than an encrypted hash. That is all it is, and I’m going to put it on the document. And you got to remember, this is in plain text. It’s in clear text.
The document is in clear text. The signature is there in plain text, and I give it to Mary. So Mary receives the document with the signature on it. Now, Mary doesn’t trust me, right? Mary wants to do a verification to verify the signature. How did she do that? She has a few steps. So Mary then takes the document with the signature, and she decrypts it with my public key. Remember, it was my private key that created it. So she decrypts that signature. She’s going to get this red digest, which in theory should be the same as the red digested top, because remember, I encrypted that with my private key. So then she takes the document and she hashes it herself with the same hashing algorithm I use. So she gets this yellow one, and then she compares it against this red one.
Now, if it’s the same, if same, the document is authentic, and Andy did sign it and it was not modified. If it’s not the same, then it was modified. It didn’t come from me. So this is the process of signature generation and signature verification. So in the signature generation, all I’m doing is taking the document, I’m hashing it, I’m encrypting my private key, giving it to her. That’s the signature. She then takes my public key, she decrypts that signature, and she gets a hash. She then decrypts. She makes her own hash, compares it. If they match, she knows it came from me, and it was never modified. Remember, if those hashes are not matching, what happens? What that means? Either the data was modified or it was never, ever encrypted by me. So that’s not my document. So this is the concept of a digital signature. Now, do we use digital signature all the time? Oh, yes. When we get to this whole PKI certificate thing, you’ll see it. Now, I do want to mention something called the DSA. And I’ll show you this in a second here. But you’ll notice that if I go into the details here on a certificate, you’ll notice that the signature algorithm on these certificates is shot 256 and RSA. So we have this hash, an algorithm, and we have the RSA, right? So we have the Asymmetric and the hash, an algorithm combined. Now, the last thing I want to mention is something called a DSA, the digital signature algorithm, or the DSS. It comes from the DSS, the digital signature standard.
It’s like there has to be some kind of standards where if you sign a document, I’ll know what algorithms you used. So the DSA specifies that in order to do digital signatures, we should use RSA and shot 256, as we see on the certificate. There’s also another one called ECDSA, where they do shot 256 and the elliptic curve, or ECC. It’s called ECDSA. Okay, review this video again. All right, watch it again. Make sure you understand how the digital signature works. Make sure you understand that. It does authentication, it does non repudiation and integrity, and it does not do confidentiality.
10. Block Chain
In this video, I’m going to explain to you how blockchain works. Now, you guys have probably heard of blockchain, and blockchain is pretty popular with bitcoins. I’m not going to explain bitcoins, not in this video. It’s not related to your exam. But blockchain is. You hear this quite a lot. Now let me explain what blockchain is really quickly. It’s not a complex. If you watch my other videos on a hash, and it’s really simple to understand what exactly the blockchain. A blockchain does not provide confidentiality. A blockchain only provides integrity. Means whatever happens on a blockchain is public.
That’s what has to be called a public ledger, where you can view all blockchain transactions. So if you send me Bitcoins and I send you Bitcoins, and I buy this with a Bitcoin, as long as you know the coin address, you can basically see how many money was sent and received to it because it’s a public ledger. Let me explain to you guys what exactly is the blockchain before we get into it. It’s a very simple count. It takes a minute to learn it. First of all, let me just say this. People have complex this. I’ve seen people try to teach this and they make it so complex. Remember, if you remember how hashtag works, it’s basically based on a hash. And you can understand it’s a chain of transaction to the next, to the next. And a blockchain basically is a set of transactions.
And that’s all it is with hashes that’s linked to each other. So let me show you guys something. So let’s say you have a quote unquote blockchain. Now, it’s basically a ledger of transactions broken into blocks. And each blocks support a certain number of transactions. So let’s say each block has three transactions. So here’s what you’re going to do. You’re going to start with block number one. And in block number one, you’re going to say transaction number one. Transaction number two, transaction number three. Let’s say transaction number three. Number one, I bought a book for $10.
I bought a car for twenty k. I bought a TV for $1,000. All right? Now basically what they’re going to do is they’re going to take all the data in this block and they’re going to output a hash. Let’s call this h one. So remember how we had the shot 256, right? They’re basically going to hash that. And that’s the start of block one. Then block two now starts because we have three more transactions in this one here, I bought another book for $15. I bought a computer for $2,000. And number three, I bought a house for 100 kwh. Here’s what they do now is they take this hash and they put it into this. So it starts out with the hash one. So the hash itself is in that block. Then they hash the whole block. They hash these transactions with this hash to produce the H Two hash. Then they go to block three. And as you can imagine, this hash comes right back in here. Now you have the h three hash. Then you start doing the block. So let’s say I bought a computer for $1,000, I bought a laptop for $200, I bought some computer speakers for $20. And then they hash this.
Then you have the age, what is it? Not h two. Made a mistake there. Then I got the h three hash, right? Then this goes into another block, becomes h four, h three, this is block four. Just keeps on going and going and going. Now the reason why they’re doing this is that nothing can be modified. You remember how hashing works. Now the hash and algorithms that’s used in these things nowadays is sha 256 is the hash and algorithms that’s mostly used in blockchains. Now, the thing with a blockchain is nothing can ever be modified. The reason is because if somebody goes in here and change, let’s say they hacked the system and they say, well, he didn’t buy a computer for 2000, he bought it for 3000.
No, they can’t because then it will kill this hash. The hash will be completely modified and all blocks going forward would be dead. So in other words, it basically is unchangeable. Once it goes into the blockchain, it is done. It is there forever. There’s no way of changing those. Now, remember, it’s public information. Blockchains are public information. Notice term for your exam. It’s called a public ledger. So blockchain combinedchain. com. And we’re going to just go to the main site here and I’m just going to go to explore and notice how many transactions, 300,000 transactions. You can actually go here and see some transactions that are happening and we can actually see people’s bitcoins here. So here’s the hash of itself.
And notice somebody did the transaction with this hash for 140. It’s valid 140. This is their address, right? So this is a bitcoin, this is somebody’s Bitcoin’s address. So you can search the transaction and address or a block. So we can go in there and we can search it to this thing. This particular one has two transactions associated with it. Now, I’m going to go into this total Receive, total Sent, and it goes in there and it will tell you some things about this one, all right, when and wherever it was on the blockchain, it’ll tell you. So it’s all in a public ledger. Where is this using the world. It security. Your computer gets hacked. A lot of times. What they do with cryptocurrency is because it’s untraceable, it doesn’t have names or anything on it.
It’s all anonymous. Notice when you search this, you’re not going to find any names on it. So when they do ransomware nowadays, what they do is they say, hey, send me the money to this Bitcoin address. So just like I had here, they send you one to this Bitcoin address. And you can actually take the address and plug it into this blockchain. com Explorer. There’s a bunch of these other sites. You plug it in there and you can see how much people send this bad person money or how much Bitcoins will send. There interesting stuff there. Okay, so this is the concept of black, of a blockchain and a public ledger. Keep going.
11. Steganography
In this video, I’m going to be talking about stigganography. Now, stigonography is when you take a message and you place it into an audio file video or an image file, and basically it’s embedded in a message inside of another message. Now, stigonography is a very dangerous thing because basically people could be passing companies secret information or messages around right in front of the company’s face and they can’t detect it. So in this video, I’m going to show you how easy that is. And it’s really easy to do it if you have the right tools.
What I’m going to do in this video is I’m going to show you guys how I’m going to take a message font and embed it into a picture of my lovely dog named Ginger. You guys are about to meet Ginger, the best little dog in the world. So let’s take a look at my dog and the concept of stigonography. Now, we’re going to have to download a tool called Open Stigma, which I’ll show you how to get. But I’ve already downloaded it. And when you install this, you’re going to have to install the Java runtime environment. So make sure you install that also. And it should work pretty easily. Let’s take a look here. I use my Windows ten VM for this.
So we’re going to say download. You could just google. Open Stigma is the domain. So opensego. com you go there. You download this. You just go to download. Here’s the program itself. You’ll see me use it in a minute. We’re going to go to download. And the latest version, as of right after this video is the version 0. 7. 4. You just download this. I downloaded the executable version, and I’ll have it installed. So there’s two things we’re going to need. We’re going to need a file with the message. So I have a text file right here. I call it, hello, my secret message.
It says, add to this from Andrew. And I have a picture of my dog. So here is Ginger, my little dog. And we’re basically going to put now I want you to analyze this picture, not because the dog is so cute. I’m talking about to see if there’s any imperfections. Right. So you notice anything weird? Nothing, right? It should be a pretty simple image because when I embed this message into this image, it shouldn’t alter the image at any point. So I’m going to close this out, and I’m going to open this tool here. So you install it. Just open up your runbox type open signal.
And here it is. So it’s installed, and I haven’t done anything to it. I just double click, and I installed it. So the message file, we’re going to go ahead and select the message file. Here’s a message file on my desktop, and I’m going to select the image of itself, which is on my desktop. Oops, you know what? I think I have the wrong image file there’s some documents from desktop. Here we go. My message files from my desktop. Here I have my image files on my desktop. Also the dog image. And we’re going to output, we’re going to create a brand new image. Remember, we’re embedding that text file into this image. We’re going to create, let’s say Dog with an M. So we know, hey, this one has a message in it and we’re going to open that. And the good thing here is you can actually put a password on it. So if anybody ever figured out you did steganography and they wanted they’ll have to know your password. So just put a password on there, call password. And I’m just going to click Hide image and watch how easy this is. So that’s it. It’s done. And it basically made an image for me. Here is a BMP image of this is the actual image that has so I’m going to pull these up side by side. Here is the picture with the image and we’re going to open the other one. This is the picture without the image. Now see if you see a difference. So it should look exactly the same. So what it is, is that they’re using what they call LSB’s least significant bits in the images. Also to find white spaces in the images and they basically put the message in there. Now, from a human eyes you can’t tell I don’t want to analyze these images though because sometimes different things changes about especially the size. And if you were to hash these images, you’ll be able to tell that one of them is different than the other. So the images look exactly the same.
So if I was to close this out, let’s take a look at some of the difference between the image. So this is the Message image and the regular one. So let’s take a look at the sizes. So in this particular one, the image is 1212-112-4512 size on that one, notice it got drastically bigger. First of all, it’s a BMP, so it’s a different image of itself. It’s a different format that it’s formatted into. It’s a bigger format than just a JPEG. But you can see it is a very much of a different size image.
Not just because of the form, but even if you reduce this thing to a JPEG, it will change the size. So the size first of all, you know the size is going to be different. And since the bits are different now, if you were to hash the images, remember we talked about hashin, if you were to use hash in algorithms, the hashes wouldn’t match on them. Okay, so I am going to make a new folder and we’re going to call this one the M. Actually it’s called it Message. So what I want to do now is I want to show you how I’m going to use the steganography tool to take the message out of the image. So let’s say you send the image to someone and they want the message out of the image. How do you do it now? So we’re going to open back that tool. We’re going to go to extract.
I’m going to select my file, the dog Mimage, the output file. We’re going to put it into that message folder, and we’ll say open. We got to put that password in and we’re going to see extract. Okay, so it should have taken out the message from there. Let’s open this folder. Let’s see if it’s there. There you go. There’s our message file. This message file should be the same as this. Yes. And that is the same message. Okay, so this is frigidography this is really dangerous for organizations. Here’s why. You can have employees within an organization. Looks like they’re just sharing images amongst themselves. Or they may imagine an employee coming to an organization, take a picture, a group picture or a selfie text with a selfie image with a set of employees, and they just email it to themselves.
So you, as the security administrator, you just see somebody emailing a picture to themselves, right? No big deal. No big deal. They just email a picture to their personal email. But what you don’t know is that they embedded a whole lot of the company secret data into that image and they just stole the image. They just stole your data right in front of your face. Steganography is a pretty dangerous thing, but we do have some different utilities. DLP software, data loss prevention software can help to detect this. Also, if you suspect it, you can check, you have to find the original image. And there are other different kinds of stig analysis tools that can help detect this. You can also limit or just block and email gateways what people can email out. So you don’t want to email images. Okay, but you know what, I also want to remind you that there are different tools out there that does allow you to do steganography and audio files. Ah, it does allow you to do audio files, image full image files. Also like MP4 s and MP3 s, so on. All right, pretty scary stuff. Go check this pretty this tool out. Have some fun using it. See you in the next one.
