All right, everybody, get ready
because we are diving deep today
into the world of cryptanalytic attacks.
Ooh, cryptanalytic attacks.
Yeah, we're talking about how people try to break codes
and expose secrets.
So, kind of like digital lock picking.
Exactly, it's like cracking a save,
but instead of like lock picks and all that stuff,
it's all about math algorithms and...
A lot of cleverness.
Yeah, a lot of cleverness.
If you ever thought about like how someone might try
to read your secret messages...
Yeah, it's kind of scary when you think about it.
It is.
And to help us understand all of this,
we have some excerpts from an article
all about cryptanalytic attacks.
Okay.
By Krishna Kumar, Mahadevim.
That name rings a bell.
Well, he's kind of a big deal in cybersecurity
over 28 years of experience.
And he's written like a ton of books on the subject.
Wow, so this guy knows his stuff.
Yeah, 98 books to be exact.
98, wow.
So, the stuff he's saying in this article,
like it's probably stuff that's actually used
out there in the field.
Real world stuff.
Yeah, real world stuff.
So let's talk about the basics here.
We're talking about cryptanalytic attacks.
So basically trying to decrypt a secret message,
but without the key.
So it's like you're trying to open up a treasure chest
but you don't know the combination.
Right, you gotta figure out how to pick the lock.
Exactly.
And there are a lot of different ways to do this.
I bet.
Some of them are actually surprisingly straightforward.
Like this thing called the brute force method.
brute force, that sounds intense.
Yeah, it sounds kind of like an action movie or something, right?
Like breaking down a door.
It's kind of like a battering ram just ramming into it again
and again and fill it.
I'll see it gives.
Yeah.
So brute force is basically like you're trying every
single possible key combination until you get the right one.
Okay, so just like trying every number on a combination lock.
Yeah, exactly.
Like if your password is password 123,
which you should not be using that password.
Ever use that password.
Don't use that password.
A brute force attack would just be trying every single
combination of letters numbers symbols.
Until it hits password 123.
Until it lands on exactly that.
And the thing is computers, they can do this really,
really fast.
Yeah, they can try millions of combinations per second, right?
Millions billions.
They can try a ton of combinations per second.
What?
So it actually works, especially if you have like a really weak,
simple password.
If you have a really strong password that's really long and complicated,
then it could take a long time.
Then it takes much longer.
Yeah, maybe even like years or something.
Wow, to actually crack it.
So it's kind of like a numbers game.
The longer your password, the more secure it is.
Exactly.
The longer and the more random your password.
The better.
The more difficult it is to actually crack it.
Makes sense.
That's why it's always good to have a strong unique password
for each of your accounts.
Good advice.
All right, so we talked about brute force,
which is all about like power just trying every combination.
Right.
But what about something a little more subtle, a little more sneaky?
I like sneaky.
The article mentions Cypher text only attacks.
Cypher text only.
Yeah, what do you think that's all about?
Well, Cypher text, I think that's like the scrambled message, right?
Yeah, it's the encrypted message.
So maybe Cypher text only means you only have the scrambled message
and you don't have anything else to go on.
That's exactly what it is.
So imagine like you're trying to solve a jigsaw puzzle.
Oh.
But you don't have the picture to look at.
Ah, that's tough.
You just have all the pieces that are scrambled.
That sounds like a nightmare.
Yeah, that's what a Cypher text only attack is like.
So you're trying to decipher a secret message,
but you have no idea what it's even supposed to say.
Exactly.
So how do you even start?
Right.
Well, you'd have to look for any kind of patterns and any repetitions.
You're just going on, believe?
Yeah, maybe some kind of weird statistical stuff that's going on.
Any hints about the structure of the code.
Yeah.
But thankfully, with modern encryption, this kind of attack
is really, really hard to pull off.
Oh, that's good to know.
Yeah, modern encryption is pretty strong.
Even if you don't have the key.
So even without the key, the messages are still pretty safe.
Yeah, they are.
But let's move on to a different kind of attack.
This one is called a known plain text attack.
Known plain text.
So that means you know something about the original message.
Yeah, this time it's like you do have a piece of the puzzle.
OK, so you have the scrambled message, the Cypher text,
but you also have a part of the original message.
You got it.
So you might have like the encrypted message,
and maybe a little bit of the original message.
Like a clue.
Yeah, like a clue.
And that can give you a big advantage in figuring out
the whole thing.
Oh, I bet.
Like having a few pieces already in place in a jigsaw puzzle.
Exactly.
Give you a starting point.
It does.
And there's some really cool historical examples of this.
Oh, like what?
Remember the Enigma machine?
The one from World War II?
Yeah, the Germans used it in World War II.
I've heard of that.
And the allies, they were able to intercept some of the messages.
And sometimes they actually knew part of the original message
like weather reports.
Oh, so they knew what some of the messages were supposed to say.
They did.
And that actually helped them to crack the Enigma code.
Wow.
So known plain text attacks were used to help in the war.
That's what they say.
And that actually shortened the war.
And it probably saved a lot of lives.
That's amazing.
Yeah.
OK, let's move on to another type of attack.
OK.
This one is called frequency analysis.
Frequency analysis that sounds a little bit more technical.
It does.
And it actually has to do with the way that we use language.
OK, tell me more.
So in any language, certain letters,
they appear more often than others.
Right.
Like an English E is the most common letter.
Exactly.
E is a really common.
When you've got like T and A are pretty common, too.
And so if you're looking at a secret message, just scrambled message.
And you see like one symbol appearing way more than any other symbol.
You might guess that it stands for E.
Exactly.
It's like imagine an alien, right?
Intercepts a message from Earth.
OK.
And they see that the letter X is like the most common letter.
They might think X stands for E.
Right.
They might think, OK, it is weird earth language.
They use X for E.
That's pretty clever.
So by looking at how often different symbols appear,
you can start to crack the code.
Exactly.
You can start to guess what they substituted for what letter.
It's not foolproof, but it's a good starting point.
Yeah, it's a good starting point.
Not always going to work.
But for simpler codes, it can be really useful.
Awesome.
So we've got brute force, Cypher text, only, known plain text, and frequency analysis.
All right.
So we've got all of those.
But now let's talk about something a little bit more devious.
Chosen Cypher text attacks.
Ooh, chosen Cypher text.
Yeah, what do you think that means?
Well, chosen that makes it sound like the attacker is choosing something specific.
Yeah, they're getting involved somehow.
The Cypher text is the encrypted message, so maybe they're choosing a specific encrypted
message to a tap.
You're on the right track.
So basically what happens is the attacker tries to trick the recipient into decrypting
a message that they've modified in some way.
Oh, so they're tampering with the message before it gets decrypted.
Exactly.
They're tampering with it.
And by doing that, they're hoping that it'll leak some information about the key.
So it's like setting a trap for the decryption process.
Yeah, like a trap to see if you can get it to reveal some of its secrets.
Clever.
So chosen Cypher text attacks.
They really take advantage of this concept called maliability.
Maliability.
That's a new one.
So basically it's like how easy is it to manipulate an encryption system?
Oh, OK.
You can change the Cypher text a little bit.
Uh-huh.
And then see how the point text the decrypt a message changes.
You can start to figure out the key.
You can start to figure things out.
Yeah.
That's sneaky.
It is sneaky.
It's a very sneaky type of attack.
So we've got brute force, sneaky attacks.
What else is there?
Well, let's talk about something called implementation attacks.
Implementation attacks.
That sounds a little different.
It is a little different.
So with these attacks, you're not actually attacking the code itself.
OK.
You're attacking the systems that are running the code.
Oh, I see.
So like finding a weak spot in the way the encryption is set up.
Exactly.
So it's like a magic in a bank.
Right.
And you're trying to get in.
Yeah.
Into the vault directly, or you could look for like a side door, a side door, a weak spot
in the security system.
Like a broken window or something.
Yeah.
Exactly.
So implementation attacks are all about finding those kind of weaknesses.
So it's not about the strength of the encryption itself.
It's about how it's being used.
That's a great way to put it.
It's like, even if you have a really strong lock.
If the door is flimsy, if the door is flimsy, it doesn't really matter.
Makes sense.
Right.
You can just kick the door down.
The internet attacks are about finding those flimsy doors in the system.
Exactly.
Now get ready because this next one is really cool.
Side channel attacks.
What are those?
They're kind of like whispers like the machine is whispering secrets.
Whispering secrets.
How does that work?
So imagine you're like a safe cracker.
Right.
And you're trying to listen really carefully to the clicks of the tumblers as you're turning
the dial.
So figure out the combination.
Exactly.
You're not directly attacking the code.
You're trying to listen to what's happening during the process.
Like, Eve's dropping on the encryption process.
Exactly.
And you're looking for any little hints that might give away information about the key.
Oh, I see.
So like, if the encryption process takes a little bit longer for certain keys, that's
one example.
So you can actually pick up on things like electromagnetic commissions from a device.
Electromagnetic emissions.
Yeah.
Or you can look at variations in the power consumption.
So like how much electricity the device is using?
Exactly.
Or even like how long it takes to do certain calculations.
Wait.
So the time it takes to encrypt something can reveal the key.
It can.
It's pretty amazing.
That's mind blowing.
It's like if you have a processor and it's working a little bit harder on certain
calculations, you might take like a tiny bit longer.
Okay.
And if you can measure that time difference, you can figure out something about the
key.
Exactly.
It's like a tiny little fingerprint.
Wow.
That's crazy.
Yeah, isn't it?
So we've got a tax that are like brute force.
We've got sneaky attacks.
And now we've got these attacks that are like listening to whispers.
And now get ready for this one.
Fault injection.
That sounds a little dangerous.
It does sound a little dangerous.
It's like something a super villain would do.
Okay.
I'm intrigued.
So with fault injection, you're basically trying to make the system mess up.
Deliberately make it mess up.
On purpose.
Yeah.
Why would you do that?
Well, the idea is that if you can make the system malfunction.
It might accidentally leak some information.
Oh, so it's like shaking a vending machine, hoping some candy falls out.
That's a good analogy.
Yeah.
It's like you're trying to jam the gears of the machine and see if you can get it to
spit out something valuable.
Interesting.
So it's all about exploding errors.
Exactly.
Okay.
Now let's talk about a specific type of side channel attack.
Oh, okay.
This one is called a timing attack.
A timing attack.
So it has something to do with time.
It does.
So it's like measuring how long it takes for certain operations to happen.
Like how long it takes to encrypt or decrypt something.
Exactly.
And even the tiniest little variations in time, they can tell you something about the
key.
Wow.
That's incredible.
It's like imagine a safe, right?
And the lock is a little bit sticky.
Okay.
So it takes like a fraction of a second longer.
To open with certain combinations.
Yeah.
To open with certain combinations.
And if you're really good at listening to those tiny differences, you can figure out
the combination.
You might be able to crack the safe.
So that's kind of what a timing attack is like.
So it's all about precision timing.
It is very, very precise.
It's really cool.
All right.
Let's move on to a different type of attack.
This one is a little bit more like something out of a spy movie.
It's called a man in the middle attack.
Man in the middle.
So there's a middle man involved somehow.
Yeah, there's someone in the middle.
So basically imagine this.
You have two people trying to communicate.
Okay.
And then there's a third person, the attacker.
Right.
And then secretly put themselves in between those two people.
Oh, like intercepting the communication.
Exactly.
And they're intercepted the messages going back and forth.
So like a wiretap.
Yeah, kind of like a wiretap.
But they can actually do even more than just listen.
Really?
They can actually modify the messages.
Oh, wow.
Before they get to the other person.
So they can change what people are saying to each other.
They can.
And the people who are communicating, they have no idea this is happening.
That's terrifying.
Yeah.
So it's like being spied on and manipulated at the same time.
Exactly.
Okay.
Last but not least, let's talk about past the hash attacks.
Past the hash.
That sounds interesting.
So with this attack, it's all about stealing something called a hash.
A hash.
Yeah.
And a hash is basically like a scrambled version of your password.
Okay.
So instead of trying to steal your actual password.
They steal the scrambled.
They steal the scrambled version of the hash.
And what can they do with that?
The thing is, on a lot of systems, the hash is enough to gain access.
Oh, I see.
So they don't need the actual password, just the scrambled version.
Exactly.
So it's kind of like using a photocopy of someone's ID to get past security.
Yeah, to get past security.
You don't need the original.
You just need a copy that looks real enough.
That's clever.
It is clever.
But it's also pretty dangerous.
Yeah.
Because once they have the hash, they can potentially get into a lot of different systems.
Exactly.
And network and potentially access a lot of sensitive information.
Wow.
We've covered a lot of ground today.
We have.
We've gone from brute force to like these super subtle sneaky techniques.
It's amazing how many different ways there are to attack encrypted data.
It is.
And the world of cryptography.
It is constantly evolving.
Like a constant arms race.
Yeah.
The constant arms race between the attackers and the defenders.
And thankfully, the defenders are getting better all the time.
That's good to know.
Yeah.
They're developing new technologies.
They're strengthening the systems we have.
And they're always trying to stay one step ahead.
So they're so impressed regular folks.
There is absolutely.
The key is to be aware of the risks.
Take those simple precautions we talked about.
And you'll be much safer online.
I like that.
Knowledge is power.
Absolutely.
All right.
Well, that's it for today's Deep Dive Into the World of Crypt Analytica Tax.
Thanks for having me.
It's been a fascinating conversation.
And to our listeners, thank you for joining us.
We'll see you next time.
Until next time, stay safe out there.
Yeah.
But they're always trying to find a new way to outsmart the system.
And in this article, Christiani Kumar Mahadevyn, he does a really good job of not just talking
about what the different attacks are.
But he talks about like the mindset of the attackers.
Oh, interesting.
Like how do they think so?
They're important to know.
It is.
It's like you're learning to think like a criminal mastermind.
Right.
But for a good cause.
Exactly.
Because if you can understand how they think, then you can start to build better
defenses.
Look at chess game.
It is like a chess game.
You got to anticipate their moves.
Stay one step ahead.
Yeah.
Okay.
So we've talked about all these different ways that encryption can be attacked.
It's, it's a little scary to be honest.
It is a little scary.
It kind of makes you realize like how much we rely on encryption for everything these days.
Like all the time.
All the time.
We don't even think about it, right?
Yeah.
Like online banking, setting messages, chopping online, cloud storage.
It's all protected by these like complex codes that thankfully are being attacked by all
these methods.
It is a little unsettling.
It is unsettling.
But the good news is that encryption is getting stronger all the time.
That's good to hear.
Yeah.
So it's not all doom and gloom.
Right.
But that doesn't mean that we could just sit back and relax.
We still have to do our part.
We do.
So what can we do to protect ourselves?
Like, I'm not a cybersecurity expert.
Right.
What can like the average person do to make their data more secure?
It's a great question.
And there are actually a lot of simple things that anyone can do.
Okay.
Give us the insider tips.
Okay.
Well, first of all, just being aware of these attacks.
That's a huge step.
So just knowing that these things exist.
Exactly.
Because when you know about the risks, you're more likely to be careful.
It's like knowing the tricks a magician might use.
Right.
You're less likely to be fooled.
Yeah.
Okay.
So awareness is good.
But what else can we do?
Well, the most important thing is to use strong unique passwords for every single account.
Okay.
I've heard that before.
Yeah.
I know it's a pain to remember so many passwords.
It is.
But it's really important.
Is there anything that can help with that?
Yeah.
You can use a password manager.
A password manager.
Yeah.
It's a program that stores all your passwords securely.
Oh, that sounds helpful.
It is.
And it can even generate strong passwords for you.
Okay.
So strong unique passwords.
Check what else.
Another important thing is to enable two factor authentication whenever you can.
Two factor authentication.
What's that?
So basically, it adds an extra layer of security.
Okay.
By requiring you to enter a code from your phone or something like that, in addition to your
password.
Oh, so even if someone steals your password, they can't get in without that second factor.
So it's like having two locks on your door.
Exactly.
Makes it much harder to break in.
Right.
So that's another really important tip.
Okay.
Two factor authentication got it.
What else?
And be careful about fishing attacks.
Fishing attacks.
Those are the emails that look like they're from your bank.
Exactly.
They try to trick you into giving them your personal information.
Like your password or your credit card number.
I write so never click on links and suspicious email or open attachments from people you
don't know.
Yeah.
And if something seems fishy, you guys trust your gut.
Trust your gut exactly.
And if you're not sure, you can always contact the company directly.
Good advice.
Don't let those digital fishers get you.
That's right.
And one more thing.
Keep your software up to date.
Oh, yeah.
The updates.
You can be annoying.
They are.
But they often include important security fixes.
So those updates might actually be protecting me from an attack.
Exactly.
So don't ignore them.
All right.
Updates are important.
I'll try to remember that.
Anything else?
One last thing.
Be mindful of what you share online.
Oh, yeah.
Like on social media instead.
Yeah.
The more information you share.
Right.
The more valuable you are to attackers.
So think before you post.
Think before you post.
Think before you share.
Think before you click.
Good advice.
That's a good advice.
It's been really helpful.
I'm glad.
It's all about taking those small steps to protect yourself.
Yeah.
And it's not about being scared of technology.
It's just about being aware.
Exactly.
And remember, security isn't on going thing.
It's not just a one time thing.
You have to keep learning, keep adapting, and stay vigilant.
Like a leaky boat.
You got to keep bailing out the water.
That's a great analogy.
The more leaks you plug, the safer you'll be.
That makes sense.
Okay.
So we've talked about all these different ways to attack encryption.
But now I want to talk about something specific that Krishna Kumar Mahadev and mentions in
his article.
Okay.
What's that?
He mentioned something called NTLM.
NTLM.
Yeah.
Do you know what that is?
I've heard of it, but I'm not exactly sure what it is.
So NTLM stands for new technology land manager.
Okay.
It's basically an authentication protocol that's used in a lot of Windows networks.
Authentication protocol.
So it's how computers verify your identity.
Exactly.
It's like a digital handshake to make sure that you are who you say you are.
Right.
But here's the thing.
NTLM is known to have some weaknesses.
Oh no.
Especially when it comes to those past the hash attacks we talked about earlier.
Oh, so those attacks where they steal the hash of your password?
Yeah.
Those attacks are particularly effective against NTLM.
That's not good.
Yeah.
It's not ideal.
So a lot of security experts, they recommend moving away from NTLM if you can.
To something more secure.
Something that's less vulnerable to these attacks.
Like Kerberos, for example, is more modern protocol that's considered to be much more
secure.
Okay.
So it's a reminder that even the systems we rely on for security, they can have weaknesses.
They can.
Especially throughout data.
So it's really important to keep everything up to date and use the latest and greatest
security protocols whenever possible.
It's a never-ending process.
This whole security thing.
It is.
Like you said earlier, it's a journey.
It's a journey not a destination.
We have to keep learning, keep adapting, and stay vigilant.
Exactly.
And that's why conversations like this are so important.
Because the more we know.
The better prepared we are.
Yeah.
It's a constant back and forth like a game of cat and mouse.
And it feels like the more technology we have, the more complicated it gets.
Yeah.
It can feel that way.
The more places there are for these vulnerabilities to hide.
That's true, but complexity can also be a good thing when it comes to security.
Oh, how so.
Because if you have multiple layers of security, it makes it that much harder for attackers
to get through.
So it's not just about like building one really, really strong wall.
Right.
It's about having like layers.
Layers, yeah, like a vote and guard dogs and like the whole like the whole castle defense
is a multi-layered approach is always the best.
Yeah, like a medieval castle.
Yeah, like a castle.
You got the outer wall.
You got the inner key.
You got the hidden passageway.
A guard.
Like everywhere.
Exactly.
The obstacles you put in the way of an attacker are the better.
The less likely they are to actually succeed.
Right.
It's all about making it as difficult as possible for them.
That's a really good analogy.
I like to think of it visually.
Yeah.
Okay.
So we've talked about a lot of different stuff today.
We've talked about a lot of different ways to attack those digital castles.
Exactly.
A lot of different ways to attack encryption.
So if we want to keep our digital castles safe, what are like the key takeaways
here?
Well, I think the most important thing is strong, unique passwords.
Okay.
That's like, that's the foundation.
The foundation.
Yeah.
If you have weak passwords, it doesn't matter how strong your other defenses are.
Right.
It's like leaving the drawbridge to your castle wide open.
Exactly.
And what about two factor authentication?
That's another crucial one.
Yeah.
It's like having a night guarding the gate.
Making sure that only the right people get in.
Two factor authentication is important.
Very important.
And we can't forget about those fishing attacks.
Oh, yeah.
The sneaky emails and messages.
We got to be careful about those.
Similarly, they're like Trojan horses.
They look harmless, but they're not.
But they're dangerous.
So always be careful about what you click on.
Yeah.
Something seems off.
Trust your gut.
Trust your debt.
And if you're not sure, you can always contact the company directly to verify.
Okay.
So strong passwords, two factor authentication.
Watch out for fishing.
Anything else?
I think the biggest thing is just to be aware.
Yeah.
The more you know about the threats out there, the better prepared you'll be to defend
yourself.
You can feel a little overwhelming though, right?
It can, but it's important not to panic.
Yeah.
You don't have to be a cybersecurity expert to be safe online.
You got to take those simple steps.
Exactly.
And if you're ever unsure about something, don't be afraid to ask for help.
Oh, yeah.
Good point.
There are a lot of resources available.
Your IT department, security teams.
There are websites and forums dedicated to cybersecurity.
People who know what they're talking about.
Exactly.
So don't hesitate to reach out if you need guidance.
All right.
Well, I think that about wraps it up for today's Deep Dive.
We covered a lot of ground.
We did.
We talked about everything from brute force attacks to those really subtle side
channel attacks and everything in between and everything in between.
It's been a fascinating journey.
It has.
And thanks to Krishna Kumar, Makadev, and for writing that article that really helped us
to understand all this stuff.
Yeah.
He really knows his stuff.
He does.
And to our listeners, thanks for sticking with us through this Deep Dive into the world of
Crypt Analytica attacks.
We hope that you learn something new.
And that you feel empowered to take steps to protect your own data.
Absolutely.
Knowledge is power in the world of cybersecurity that knowledge is your best defense.
Stay curious.
Stay vigilant and stay safe out there.
And until next time, keep exploring, keep learning, and keep those digital
drawbridge's raised high.