C. Alonso_Seguridad Informática: Digital Latches for your Digital Life_Semanainformatica.com 2014

Valencia 2014 – Chema Alonso

Chema Alonso @chemaalonso

[email protected] http://www.elladodelmal.com


Incidentes de Seguridad


Dumps de identidades


BYOM (Bring Your Own Malware)


El enemigo a las puertas


Superficie de exposición

•  Los servicios están activos 24 x 7 x 365

•  Solo usamos nuestras identidades un breve espacio de tiempo

•  Las cuentas deberían poder apagarse


Passwords+OTP

SMS TOKEN 8762134


2FA “classics”

•  Usuario necesita introducir un código •  Despliege de SMS •  Matriz de coordenadas es estática •  Hardware tokens son caros •  Usuario necesita introducir un código •  Usuario no le gusta introducir un código


A la gente le gusta dormir la siesta (con el mando de la tele)


Patentes


KISS (Keep It Spanish, Stupid)


At the airport Anna has just started a new job and she is on a business trip. As usual, she checks the weather, prepares her suitcase and defines her online security levels using Latch.


Taking a cab To make her trip easier she decides to pay everything using a service, on her way to the office at the destination point she switches service on, so she can pay the taxi fare. Once done she switches her account off, minimizing the exposure to improper usage.


An alert of the service used! Fortunately her account was blocked by Latch, as Anna easily requested using the app. Alas, in the stopover someone tried to hack her service account. The attack was under control and no misuse was ever fulfilled.


¿Cómo proteger una identidad?


“Latch” de una cuenta

Latch Server

1.-‐ Generate pairing code

2.-‐ Temporary Pariring token

My Site User Se>ngs: Login: XXXX Pass: YYYY

Latch:

4.-‐AppID+Temp pairing Token

5.-‐ OK+Unique Latch

6.-‐ID Latch appears in app

ULatch


Login en una Web

Latch Server

Latch app Latch1: OFF Latch2:ON Latch3:OTP Latch4:OFF

….

My Bank Users DB: Login: XXXX Pass: YYYY

Latch: Latch1

Login Page:

Login:AAAA Pass:BBBB

1.-‐ Client sends Login/password

2.-‐ Web checks CredenXals with Its users DB

3.-‐ asks about Latch1 status

4.-‐ Latch 1 is OFF

5.-‐ Login Error

6.-‐ Someone try to get Access to Latch 1 id.

2.-‐ Check user/pass


Login en una web


Vamos a “Latchear”…


Hacer login con OTP

Latch Server

Latch app Latch1: OFF Latch2:ON Latch3:OTP Latch4:OFF

….

My Bank Users DB: Login: XXXX Pass: YYYY

Latch: Latch1

Login Page:

Login:AAAA Pass:BBBB

1.-‐ Client sends Login/password

2.-‐ Web checks CredenXals with Its users DB

3.-‐ asks about Latch1 status

5.-‐ Latch 1 is ON(OTP)

6.-‐ OTP?

7.-‐ Use this (OTP).

4.-‐ Latch Server Generates OTP

8.-‐ User introduces OTP

2.-‐ Check user/pass


Hacer login con OTP


Control Parental

User Pass

Login: User Pass: Pass Latch: Latch


User1 Pass1

User2 Pass2

Login: User2 Pass: Pass2 Latch: Latch2

Login: User1 Pass: Pass1 Latch: Latch1

Verificación de 4 ojos


2 keys activation

User1 Pass1

User2 Pass2

Asset Latch: Latch1 Latch: Latch 2


Operaciones latcheadas

Latch Server

Latch app Latch1: ON Op1:OFF Op2:ON OP3:OTP

Latch 2: OFF ….

My Bank Login: XXXX Pass: YYYY

Latch: Latch1 Int_Trnas: Op1

Online Banking

Send Money: 1231124343

1.-‐ Client orders InternaXonal TransacXons

3.-‐ asks Latch1:Op1 status

4.-‐ Latch 1:Op1 is OFF

5.-‐ Denied

6.-‐ Someone try to do a Latch 1:Op1 OperaXon


User Pass

Login: User Pass: Pass

Latch: Latch Op1:Unlock Op2: OTP

Supervision

Why?

Answer

OTP


Latch Users Developers Corporates

Control all digital idenXXes in one single point. ON/OFF.

Integrate Plugins and develop soluXons with SDKs to adapt

Latch technology to their needs

SDKs: PHP, Java, .NET, C, Ruby, Python & WebService API

Plugins:

WordPress, PrestaShop, RedMine, Cpanel, Moodle, OpenVPN, SSH, Drupal, DotNetNuke, Joomla!, …

-‐  Deploy 2FAuth -‐  Opt-‐in/mandatory -‐  Detect idenXty theg -‐  Granularity -‐  Reduce Fraud -‐  Parental Control -‐  4 Eyes verificaXon

Tools -‐  Control Dashboard -‐  Usage StaXsXcs -‐  Internal appliance (beta)

!


Monitoring Switch

•  With one latch –  As many granularity as needed –  Two status –  OTP –  User confs

•  Schedulle •  AutoLock

•  Possible to re-act at status If Lock then {} Else {} Goto fail; Goto fail:


Latching SSH


Windows pGina

hip://unstableequilibrium.com/2014/02/07/using-‐pgina-‐and-‐latch-‐to-‐protect-‐your-‐windows-‐login/


SCCAID


Triggering actions at events


Latch Event Monitor


Coming Soon

•  Physical World •  Biometry •  AD Plugins •  New Plugins – Open Exchange – PHP MyAdmin – Django? – LDAP Bridge – Etc…


Latch DashBoard


Sobre Latch •  Privacidad: – AppIDs conoce los UniqueLatches pero no los

UserLatches. – Latch Server conoce Latchets y AppID, pero

no los usuarios/passwords •  Robustez: – Si el servidor de Latch es comprometido la

seguridad del sitio protegido sigue intacta. – No se guarda ningún dato sensible en Latch

Server.


Developer Area


Apps disponibles

En desarrollo: •  Firefox OS •  Blackberry


¿Preguntas?

•  Chema Alonso •  @chemaalonso •  [email protected] •  http://www.elladodelmal.com •  http://www.elevenpaths.com •  https://latch.elevenpahts.com

C. Alonso_Seguridad Informática: Digital Latches for your Digital Life_Semanainformatica.com 2014

Technology

Transcript of C. Alonso_Seguridad Informática: Digital Latches for your Digital Life_Semanainformatica.com 2014