CITM820 Assignment-2

ITM820 Assignment 2 (5%)
Submit your Answers to Assignments drop box before the deadline.

Part A: (10%)
Write a report (350 words excluding references) regarding the following topic:
What is the role of AI devices such as IoT in today’s business (e.g., healthcare, machine-to-
machine [M2M], business automation, smart city)? What security threats and challenges they
may create for society, organizations, and individuals?
PART B: Step-by-Step instruction to generate SHA & CRC checksum to check the
authenticity of files (20%)
Go to URL link: https://www.di-mgt.com.au/generate-file-checksums.html

Download digsum-1.0.1.zip file.
B1:
Step 1: Unzip the file digsum-1.0.1.zip
Step 2: Copy all .exe (e.g., sha1sum.exe, sha256sum.exe, md5sum.exe and crc32sum.exe) files to
C:\Windows directory (Note: you need to have administrative rights to do so)
Step 3: Open Command prompt: cmd

Step 4: Generate a text file such as: ipconfig > ip.txt
This command will send the output to a file called ip.txt
To see the content of ip.txt file: type ip.txt (note you can use also: more ip.txt)
Step 4: run the command:

sha1sum ip.txt
You will see a Hash code something like this:

C:\Users\f2shiraz>sha1sum ip.txt
fc6fc3e6301bcfa41b43dea13ee9d721834761cd *ip.txt
Prove your work by providing a screenshot.
Step 5: Test Sha256 on the same file:

Prove your work by providing a screenshot.
Step 6: Modify ip.txt by appending another command to the file (example)

C:\Users\f2shiraz> ping ryerson.ca >> ip.txt
Note: To append to exiting file you use >>
Now repeat Steps 4 & 5
Question: did the hash-1 & hash-256 codes change?
Prove your work!
B2: About CRC

A cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks
and storage devices to detect accidental changes to raw data. Blocks of data entering these
systems get a short check value attached, based on the remainder of a polynomial division of their
contents. On retrieval, the calculation is repeated and, in the event the check values do not match,
corrective action can be taken against data corruption. CRCs can be used for error correction.
CRCs are so called because the check (data verification) value is a redundancy (it expands the
message without adding information) and the algorithm is based on cyclic codes. CRCs are
popular because they are simple to implement in binary hardware, easy to analyze
mathematically, and particularly good at detecting common errors caused by noise in
transmission channels. Because the check value has a fixed length, the function that generates it
is considered as a hash function.
Now run CRC32sum: Example

C:\Users\f2shiraz> crc32sum ip.txt
6b15a814 *ip.txt
Modify the content of ip.txt and rum CRC32sum again

Example:
C:\Users\f2shiraz> ping google.ca >> ip.txt
C:\Users\f2shiraz> crc32sum ip.txt
0a1f928b *ip.txt
Did the CRC code changed?

Prove your work
Part C: HTTP Authentication (20%)

Please support your finding
Using Wireshark packet sniffer, let us try visiting a web site that is password-protected and
examine the sequence of HTTP message exchanged for such a site. The URL
http://gaia.cs.umass.edu/wireshark-labs/protected_pages/HTTP-wireshark-file5.html is
password protected. The username is “wireshark-students” (without the quotes), and the
password is “network” (again, without the quotes). So let’s access this “secure”
password-protected site. Do the following:
- Make sure your browser’s cache is cleared, as discussed above, and close down your browser.
Then, start up your browser
- Start up the Wireshark packet sniffer
- Enter the following URL into your browser
http://gaia.cs.umass.edu/wireshark-labs/protected_pages/HTTP-wireshark-file5.
html
Type the requested user name and password into the pop up box.
- Stop Wireshark packet capture, and enter “http” in the display-filter-specification
window, so that only captured HTTP messages will be displayed later in the
packet-listing window.
Now let’s examine the Wireshark output. You might want to first read up on HTTP
authentication by reviewing the easy-to-read material on “HTTP Access Authentication
Framework” at http://frontier.userland.com/stories/storyReader$2159
Answer the following questions:
1. What is the server’s response (status code and phrase) in response to the initial HTTP GET
message from your browser? Write your answer and provide a screenshot.
2. When your browser’s sends the HTTP GET message for the second time, what new field is
included in the HTTP GET message?
The username (wirehsark-students) and password (network) that you entered are encoded in the
string of characters (d2lyZXNoYXJrLXN0dWRlbnRzOm5ldHdvcms=) following the
“Authorization: Basic” header in the client’s HTTP GET message. While it may appear that your
username and password are encrypted, they are simply encoded in a format known as Base64
format. The username and password are not encrypted! To see this, go to
https://www.base64decode.org/ and enter the base64-encoded string
d2lyZXNoYXJrLXN0dWRlbnRz and press decode. Voila! You have translated from Base64
encoding to ASCII encoding, and thus should see your username! To view the password, enter
the remainder of the string Om5ldHdvcms= and press decode.
3. Show your findings through screen shots.
Conclusion:
Since anyone can download a tool like Wireshark and sniff packets (not just their own) passing
by their network adaptor, and anyone can translate from Base64 to ASCII (you just did it!), it
should be clear to you that simple passwords on WWW sites are not secure unless additional
measures are taken.

CITM820 Assignment-2

Uploaded by

Copyright:

Available Formats

CITM820 Assignment-2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CITM820 Assignment-2

Uploaded by

Copyright:

Available Formats

ITM820 Assignment 2 (5%)

Submit your Answers to Assignments drop box before the deadline.

Go to URL link: https://www.di-mgt.com.au/generate-file-checksums.html

Step 3: Open Command prompt: cmd

Step 4: run the command:

You will see a Hash code something like this:

Prove your work by providing a screenshot.

Step 5: Test Sha256 on the same file:

Step 6: Modify ip.txt by appending another command to the file (example)

B2: About CRC

Now run CRC32sum: Example

Modify the content of ip.txt and rum CRC32sum again

Did the CRC code changed?

Part C: HTTP Authentication (20%)

You might also like