What is a good way to demonstrate the insecurity of common bad practices?

Question

A friend of mine teaches a "Basic IT Security" class at a .edu and asked what demonstrations he can do, live, to show why certain practices are bad.

Currently, we have cobbled together a Firesheep demo, which is impressive, but it's becoming unreliable as the browser ages (it only works on Firefox 3.6.x) and as more websites handle their cookies properly.

Can anyone suggest a good demonstration of why doing X is bad? The more "impressive" to a lay-person, the better

So far some ideas have been:

1. Use wireshark to sniff a password/email that has been insecurely transmitted
2. Show how a phish works from the attackers point of view
3. Perform a dictionary/brute force attack against a weak password
4. Pull the (unencrypted) HDD from a laptop and get some files off it

So far we don't think any of these are terribly impressive, from the point of view of a bored Joe Ordinary. Appreciate any suggestions!

Answer 1

Slightly change the content of the website accessed over a HTTP connection. Change some text, or maybe replace or rotate all the pictures for 180 degrees :) Perhaps do this on prominent politician's website or blog. Make it look like he said something which he in fact didn't.

Answer 2

So I am currently a student and have taught in a Security Club I have for a few years. Every year we start from square one and I end up teaching the same things over again. Here is some of the things I cover.

The Club is a "Cyber Defense Club" but we have found it extremely important to teach the offensive side. We usually cover these.

I also try to go over why they work...

• ARP Poisoning (Cain)
• DNS Spoofing (Cain)
• Password Cracking (John)
• Buffer Overflows (C)
• Metasploit Framework (...)
• Port Scanning, Banner Grabbing, and Vulnerability Scanning (nmap, nessus)
• The importance of Changing Default Passwords (I use xampp and let them try to change all the default passwords. Not many people have found them all)
• Firewalls (Windows, IPTables, Cisco ASA)
• System Hardening (Disabling unnecessary Services, etc.)
• Incident Response (I teach this for our Cyber Defense Competitions. It isn't very practical in the real world)
• HoneyPots (HoneyD)
• Physical Security

This is just starters what you can teach.

Applied to your question you can do a lot:

• Why Not Patching is Bad (Metasploit)
• Why Using LMHash is bad
• Why Not Changing Default Passwords is bad
• Why Using strcpy, etc. is bad.
• Why leaving unnecessary services open is bad.
• Why Not having a firewall is bad.
• Why Not Having Logs is bad.
• (MORE) Why Storing unhashed passwords is bad.
• Why no physical security is bad.
• (MORE) Why Not following the OWASP Top 10 is Bad.

Intro Courses are the most fun because if the professor makes it great....they are really really great and can hook the whole class. I hope I was helpful :D

edit: I just read that your course is aimed at end users. My list was for Students who want to learn Security. Still hope you can use some of it.

Answer 3

Why not use a simple SQL Injection with Havij to show how simple it is to get info?

Answer 4

To demonstrate some bad practices and the security vulnerabilities associated with them it's best to get your hands dirty.

I suggest launching some attacks on a Virtual Machine running DVL, on the same machine you can setup a copy of DVWA where you can involve the students in these attacks and later dissect them and possibly show ways of preventing them. DVWA is especially good when it comes to that, it can be easily configured to certain levels of exploitability.

Answer 5

Man in the middle?

Show them browsing to a URL, then change the DNS so you go to an evil version at the same URL. Then do it again with https so you can show the warnings.

Gawker-style attack?

Show them you logging onto a silly gossip blog with a simple password and a complex one. Get the hashes somehow (maybe via a SQL injection without explaining it much, to emphasise that some sites have poor protection). Crack the hashes live and get the simple passwords (but show how the stronger ones resist). Then point out the username was [email protected] and log onto that mail account with that password, to emphasise the risks of password reuse.

In general, try and fake up Web sites that look like something they might use, to ground it in reality. (where you can't safely use a real service, that is.)