Securing Devices
AP Cybersecurity Topic 4 9:32 English narration · English + 中文 subtitles burned in
Chapters
Transcript
It is Monday morning in a busy hospital.
这是一家繁忙医院的周一早晨。
In under a minute, the screens in the ward, the pharmacy and the records office all change.
不到一分钟，病房、药房和档案室的屏幕全都变了。
Every file on them is locked, and a message demands money.
上面的每个文件都被锁住，还出现一条要钱的信息。
Nobody broke in.
没有人闯进来。
It began on one laptop that missed a software update.
这一切始于一台漏装了软件更新的笔记本电脑。
Welcome to Unit Four: securing devices.
欢迎来到第四单元：设备安全。
We will cover the malware that attacks devices, hashing and salt, password attacks, authentication, and how to protect and watch a device.
我们会讲攻击设备的恶意软件、散列与盐值、 密码攻击、身份验证，以及如何保护和监视一台设备。
Start with the word device: it means any computer at all.
先从"设备"这个词说起：它指的是任何一台计算机。
A server gives a service to other machines; a laptop or a phone belongs to one person.
服务器为其他机器提供服务； 笔记本电脑或手机属于某一个人。
An embedded computer sits inside a machine — cheap, slow, almost no storage.
嵌入式计算机装在机器内部——便宜、慢， 几乎没有存储空间。
The photo shows one: a fingerprint door lock.
照片上就是一个：指纹门锁。
Everyday things like it are the Internet of Things, I o T: water pumps, cars, washing machines.
这类日常物品就是物联网，I o T： 水泵、汽车、洗衣机。
Every one of them has the same few vulnerabilities, and the attacks follow them: unpatched software, weak passwords, unprotected B I O S or U E F I startup settings, and open ports.
它们被攻击的方式就那么几种：没打补丁的软件、弱口令、 没有保护的 B I O S 或 U E F I 启动设置，还有开放的端口。
And you rate the risk by what the device is worth: a hospital's unpatched email server is high risk, an employee's laptop with one unused open port is low.
风险高低要看这台设备本身有多重要：医院那台没打补丁的邮件服务器是高风险， 员工笔记本上一个没用的开放端口是低风险。
The main threat to every one of them is malware.
它们全都面临同一个主要威胁——恶意软件。
The exam gives a story and asks for the name: know each malware type by its defining trait, one trait each.
考试会给一个情境，然后问名称——每一类记住一个特征。
A virus needs a user to open a file.
病毒需要用户去打开文件。
A worm needs nobody; it spreads by itself.
蠕虫不需要任何人，它自己传播。
A trojan hides inside software that looks safe — a remote access trojan, R A T, hands the adversary remote control — and ransomware encrypts your files for money.
木马藏在看起来安全的软件里，而勒索软件加密你的文件来要钱。
Spyware quietly watches you; a keylogger records every key.
间谍软件悄悄监视你；键盘记录器记录每一个按键。
A logic bomb waits for one condition; a rootkit buries itself in the system.
逻辑炸弹等待某一个条件；Rootkit 深埋在系统里。
Name the trait, and the mark is yours.
说出那个特征，这一分就是你的。
Almost all malware is a file, so a scanner can hunt for it.
几乎所有恶意软件都是文件，所以扫描器可以去找它。
Fileless malware lives only in memory and abuses programs already trusted, so there is no file to find.
无文件恶意软件只存在于内存里， 并利用本来就受信任的程序，因此没有文件可找。
Attackers also use open doors: unpatched software, weak passwords, open ports.
攻击者也会走没关的门： 没打补丁的软件、弱密码、开放的端口。
An unpatched hospital email server is high risk; an unused port on a laptop is low.
一台没打补丁的医院邮件服务器是高风险； 笔记本上一个没在用的端口是低风险。
Now to passwords.
现在来讲密码。
A service must never keep your password as plain text; it uses a cryptographic hash function instead.
服务绝不能把你的密码以明文保存，而是使用密码散列函数。
Look at the picture.
看这张图。
Any input goes in on the left: a short word, a long sentence, a number.
任何输入都从左边进去：一个短词、一个长句子、一串数字。
Out on the right comes a fixed-length string called the hash.
右边出来的是一串固定长度的字符串，叫做散列值。
A hash is one-way and fixed-length: you cannot go backwards.
而且你无法反推回去。
Two more properties matter.
还有两个性质很重要。
A hash is repeatable: the same input always gives exactly the same output, which is how a login check works.
散列是可重复的：同样的输入永远给出完全相同的输出， 登录校验正是靠这一点。
And change one character, and the output is completely different.
而只要改动一个字符，输出就完全不同。
These two passwords differ by one character, and their digests share nothing.
这两个密码只差一个字符，可是它们的散列值毫无共同之处。
The exam names three properties, so use its words.
考试点名了三个性质，所以要用它的词。
Collision resistant: hard to find two inputs with the same output.
抗碰撞：很难找到两个输入得到同一个输出。
Pre-image resistance: you cannot work back to the input.
抗原像：你无法反推回输入。
Repeatable: the same input always gives the same hash.
可重复：同样的输入永远给出同样的散列值。
Today's standard is the Secure Hash Algorithm family, S H A — S H A 256 and S H A 512.
今天的标准是安全散列算法家族，S H A。
Find an efficient collision attack, and the function is deprecated — as MD5 already is.
一旦找到高效的碰撞攻击，这个函数就会被弃用——M D 5 已经如此。
A service stores the hash, not the password.
服务保存的是散列值，不是密码。
When you log in, it hashes what you typed and compares.
你登录时，它把你输入的内容做散列再比对。
But two people with the same password would store the same hash — crack one, and you get the other free.
可是两个人如果用同一个密码，保存的散列值就会一样——破解一个，另一个白送。
The fix is salt: a few random bits, different for every user.
解决办法是盐值：几位随机比特，每个用户都不同。
Here one gets x seven and the other q two, so the two stored hashes look nothing alike.
这里一个人得到 x7， 另一个得到 q2，于是保存下来的两个散列值看起来毫无相似之处。
Attacks have names — the exam wants them.
攻击都有名字——考试要的就是名字。
Online guesses against the real login page.
在线攻击对着真实的登录页猜。
Offline has stolen the hash database and cracks it at home, skipping lockout.
离线攻击偷走了散列数据库，在自己家里破解，绕开了账户锁定。
Brute force tries every possible password; a dictionary attack tries common words first.
暴力破解尝试每一个可能的密码；字典攻击先试常见的词。
Spraying tries one password against many accounts.
密码喷洒用一个密码去试很多账户。
Credential stuffing reuses default logins.
撞库重复使用默认的登录信息。
A rainbow table lists hashes ready to look up.
彩虹表则是一张现成的散列对照表，直接查就行。
An administrator hardens accounts by configuring login settings.
管理员会配置登录设置。
Name each one, and say what it slows.
要说出每一项的名字，并说清它拖慢了什么。
Complexity asks for a character from each set.
复杂度要求每一类字符各出现一个。
Minimum length matters even more: each extra character multiplies the work.
最小长度更重要：每多一个字符， 破解的工作量就成倍增加。
Maximum age forces a change every ninety days.
最长有效期强制每九十天更换一次。
Password history blocks the last five to ten.
密码历史挡住最近的五到十个。
Lockout stops the account after three wrong tries.
锁定在三次输错之后停用账户。
But some standards now advise against forced expiry.
不过一些标准现在反对强制到期。
A password manager fixes the real problem.
密码管理器解决的才是真正的问题。
The proof you give that you are you is called a factor, and there are four kinds.
你用来证明"你就是你"的东西叫做因素，一共有四类。
Something you know: a password or a PIN. Something you have: a phone, a card, a token.
你知道的东西：密码或者 PIN 码。
Something you are: a biometric, a fingerprint or a face.
你拥有的东西：手机、卡片、令牌。
And somewhere you are: a location factor. Know, have, are, where.
你本身的特征：指纹或人脸。
Two or more different kinds is multifactor authentication, M F A — and it must be two different kinds, a fingerprint plus a password, never two passwords.
还有你所在的位置：位置因素。 用上两类或更多不同的因素，就是多因素身份验证。
Watch why the second kind matters.
看一看为什么第二类因素这么重要。
With only a password, the server cannot tell you from a thief who stole it — both get in.
只有密码时，服务器分不清你和偷走密码的人—— 两个都能进去。
Now add a code on your phone.
现在加上一个发到你手机上的验证码。
The password still leaks, but the attacker has no phone, so the login is blocked.
密码照样泄露了， 但攻击者没有你的手机，登录就被拦下。
Something you know, plus something you have.
你知道的东西，加上你拥有的东西。
How do we protect a device?
我们怎么保护一台设备？
Two families.
分两大类。
Managerial controls set the rules on paper: an acceptable use policy, a password policy, a software installation policy.
管理性控制在纸面上定规矩： 可接受使用政策、密码政策、软件安装政策。
Anti-malware keeps a database of signatures and quarantines any match.
反恶意软件保存一个特征库，把任何匹配的文件隔离。
Each patch closes a known hole first.
每一个补丁都先堵上一个已知的漏洞。
A host-based firewall guards one device and blocks ports it does not need.
主机防火墙只守护一台设备，并封掉它用不到的端口。
This is what anti-malware really looks like.
这就是反恶意软件真实的样子。
It has checked more than three thousand files against its signature database and found two matches.
它已经把三千多个文件和特征库比对了一遍， 找到两个匹配。
Those two are quarantined, then removed.
这两个先被隔离，然后被删除。
Notice the update button: the database has to be kept updated, because an old signature database misses new malware.
注意那个更新按钮：过时的特征库会漏掉新的恶意软件。
Protecting is not enough — detecting attacks on a device matters just as much.
光保护还不够——检测设备上的攻击同样重要。
Devices log logins, file changes and processes, and in those logs sits an indicator of compromise, an I o C.
设备会记录登录、文件改动和进程，而这些日志里藏着入侵指标（IoC）。
Host-based means an unexpected process or a changed setting.
基于主机的，指一个意外的进程或者一项被改动的设置。
File-based means a file whose hash matches known malware.
基于文件的，指某个文件的散列值与已知恶意软件相同。
Behaviour-based means many failed logins, or one at three in the morning.
基于行为的，指大量登录失败，或者凌晨三点的一次登录。
Choosing between methods means weighing performance — signature checking is light, which suits a weak device — against cost: endpoint detection and response, E D R, is stronger but expensive.
在这些方法之间做选择，就是在性能和成本之间权衡： 基于特征的检查很轻，适合性能弱的设备； 端点检测与响应（EDR）更强，但也更贵。
Here are three extracts from one morning's authentication log.
这是同一个早上认证日志里的三段摘录。
Pause the video and try them.
先暂停视频，自己试一试。
Ready?
好了吗？
The first line: one user, forty-seven wrong passwords in two minutes.
第一行：一个用户，两分钟内四十七次密码错误。
Many failures on one account is online guessing.
同一个账户上大量失败，就是在线猜测。
The second extract: forty-two users, one try each, from one address.
第二段：四十二个用户，各试一次，都来自同一个地址。
That is password spraying.
这就是密码喷洒。
The third extract: admin as both login and password, on six devices.
第三段：登录名 admin，密码也是 admin，在六台设备上试过。
That is credential stuffing.
这就是撞库。
And the trap: a fourth attack would show nothing, because it runs on the adversary's machine.
还有那个陷阱：第四种攻击什么都不会显示，因为它运行在对手的机器上。
Four marks students throw away.
四个学生常丢的分。
First, never write that a service stores the password. It stores the salted hash.
第一，绝不要写"服务保存密码"，它保存的是加盐后的散列值。
Second, match the log signature to the attack: one user guessing, many users from one address spraying.
第二，把日志特征和攻击对上号：一个用户是猜测，很多用户来自同一个地址是喷洒。
Third, offline attacks cannot be detected — the cracking happens on their own machine.
第三，离线攻击无法被检测到——破解发生在他们自己的机器上。
Fourth, multifactor authentication needs two different kinds of factor: a password plus a PIN is not multifactor.
第四，多因素身份验证需要两类不同的因素：密码加 PIN 码不算多因素。
Five things to take with you.
带走五件事。
First, name each malware type by its trait: a worm spreads itself, a virus needs a user.
第一，用特征给每一种恶意软件命名：蠕虫自己传播，病毒需要用户。
Second, a hash is one-way and fixed-length, and salt makes identical passwords hash differently — the service stores the salted hash, never the password.
第二，散列是单向、定长的，盐值让相同密码得到不同散列——服务保存的是加盐散列，不是密码。
Third, SHA-256 and SHA-512 are current; MD5 and SHA-1 are deprecated because collisions are cheap.
第三，SHA-256 和 SHA-512 是现行算法；MD5 和 SHA-1 已弃用，因为碰撞太便宜。
Fourth, match the log to the attack, and remember offline cracking cannot be detected.
第四，把日志对上攻击，并记住离线破解无法被检测到。
Fifth, multifactor needs two different kinds: know, have, are, or where — a password plus a PIN is not multifactor.
第五，多因素需要两类不同的因素：知、有、是、或在哪——密码加 PIN 不算多因素。