I will tell you about a time when I got really scared about how my data was being used. I was about to fly to Glasgow, Scotland from London’s Gatwick airport. My friend and I got delayed because of a lot of reasons I will not delve into here but because of that delay, we only had like 30 minutes to run from the train station to the airport, check-in our luggage, get the security check done, and board the flight. The task was impossible, and we thought we were doomed. We still wanted to give it a try and ran as if our lives depended on it. We had to scan our boarding passes, look into a camera and only then would the turnstiles open to let us through. We got till the security check but got held up there for a few minutes because I carried more than the allowed amount of body cream. That was the final nail in the coffin. We would never be able to make it on time. That is what happened. When we finally reached the gate where boarding happened, we were told by the staff that the gates closed 5 minutes ago and there is nothing they can do to reopen it as the flight was already taxiing. According to the protocol, if someone misses their flight, they will be escorted out of the airport. While we were being escorted out, we were talking to staff about how we were running like mad people with our luggage. That is when one of them revealed a very interesting detail. He said, “Yes we know. We saw you in the camera when you touched your boarding pass. We kept the gates…”. Wait, what!! I couldn’t concentrate after the first sentence and I remember the conversation ended with us getting very politely kicked out.

The cyber security enthusiast in me woke up. What did he mean? How can they know who I am by just looking at me? Where else does my data go? Who else knows who I am? These are a few questions that were running through my mind at that time. This data is relatively fine if it is with the right people. It helps in better service and better connectivity. But if, by any chance, this data falls in the hands of the hackers, then people like me are doomed. What if the hacker had the access to the cameras through which the staff member identified me? The hacker will be able to know my passport details, my residential address, my mobile number, my itinerary, and what not! The question that now arises is how good are the airport authorities in securing our data? Not very good according to this article. In other news, two airports in Vietnam faced cyber attacks in the July of 2016 (ref: link) and the client information was leaked in the process.

How about your likes on Facebook? It is no more just a digital expression of agreement or encouragement. It is data; data that can be collected and used to tailor your experience on Facebook. Or that is what Mark Zuckerberg claims.

What happened with Cambridge Analytica’s case is a very good example of how our simple likes and comments on social media can be used to fiddle with something as serious as a country’s elections (check this out). Not just in the US, but also in India, Cambridge Analytica was approached by Congress party to help them exploit the elections. Our data is being used to screw with our own present and future. Tell me how that is not scary and infuriating.

Even though both Cambridge Analytica and Facebook are both facing backlash because of the whole fiasco, with reports coming in that Twitter sold user’s data to CA as well (link), we don’t know how deep the rabbit hole is as of yet.

Thinking about all of this makes me wonder if these big organisations really care about our personal data. Makes me wonder if I really should be on Facebook or even on the internet for that matter. But since I can’t deactivate everything and go back to the stone age, the only thing I can do is manage my privacy and digital footprint better.

This article by Huffingtonpost UK can help you clean a little of your data from the Google. Don’t get freaked out by what all Google knows about you. This one by Wired helps you manage your privacy on Facebook better.

Hope this article of mine has helped wake a few of you up. The only advice that I can give to you is to read the Terms and Conditions of everything that you’re signing-up to and take control of your data.

Make sure nothing that shouldn’t go public, never does.

Good; now that I have your attention, please read the rest of the article!

Ever heard of Mlecchita Vikalpa? Or Arthashastra? No? How about Chakravyuh? Oh come on!

If you have heard about the Caesar’s cipher and not the aforementioned phenomena, then this article will try to shed some light on the Indian cryptographic history and the way in which the Indian scriptures have and will continue to have an impact on the cryptographic & cryptanalysis principles & methods.

The ancient world lived and breathed cryptography. The issue of privacy was as big of a concern then as it is now. There were secrets which had to be passed on to someone without the interference of any third-party. Be it war strategies, secret culinary recipes or some random gossip about the elites, all these had to be conveyed securely. People of the ancient ages used a lot of methods by which the communication was made secure (relatively). The Indians, the Greeks, the Romans, the Mesopotamians and every other ancient civilisation had their own way of encryption and decryption techniques which were different from the others. While ciphers like Caesar Cipher, Greek Scytale and others got popular, not many people talk about the Indian contribution to the concept of cryptography. Let’s ignore them no more!

In other news, yes, Kama-Sutra cipher is a thing (at least, was a thing). As a part of Kama-Sutra, women were recommended to know 64 arts like cooking, massage, dressing among others. Number 45 on that list was Mlecchita Vikalpa which was the art of secret writing. The women had to keep secret the details about their liaisons and they would do so using this simple yet effective encryption technique. More info about this cipher is given here. And this concept was as old as or even older than Caesar Cipher.

Arthashastra is a treatise on the statecraft, economy, war strategies and also espionage with the help of code-breaking. This text was formulated by Chanakya (a.k.a Kautilya) in the 4th century BC. He has been attributed as the first person to talk about cryptanalysis in Arthashastra. Many experts in India agree that Arthashastra is still very relevant in the modern world and recommend that it must be taught as a subject in management courses. This just goes to show that our ancestors were not only visionaries, but also more advanced with their thought process than we think they were.

Another example of the Indian ingenuity can be seen in the case of improvements to the RSA algorithm, the most famous public-key algorithm which is now used in many protocols like HTTPS, SSL, TLS etc. RSA has to deal with very complex calculations. This is because the prime numbers that are considered while encrypting and decrypting are minimum 100 to 150 decimal digits. Even though RSA algorithm has not been broken in its 30+ years of existence, the calculation complexity makes it inefficient sometimes. This is where Vedic mathematics can be used. Bhasker et al. in this paper show that using the concept of “Urdhva-tiryakbhyam”, which essentially means, vertical and crosswise manipulation, can reduce the calculation time drastically and increase the efficiency of the RSA algorithm. Considering the facelift RSA gets because of Vedic math, should it be implemented as an integral part of the security studies? Food for thought!

Even though RSA is still unbroken, with the advent of the concept of quantum computers, experts suggest that it will take only a few minutes for a quantum computer to break RSA. The development of quantum computers is still in its nascent stage, albeit. Niels Bohr and Erwin Schrödinger, the fathers of Quantum Physics, have attributed their success to Vedas and Upanishads. Niels Bohr has also famously been quoted saying “I go into the Upanishads to ask questions”. So does this mean Vedas have an answer to the development of Quantum Computers? Only time and research will tell.

I had an interesting thought about the interconnection between the basic principle of RSA and a wartime strategy of an Indian epic. RSA is based on a simple rule: make entry easy, exit difficult; make encryption easy, decryption difficult if you don’t have the required key. There is a war strategy in the Indian epic, Mahabharata, which is called Chakravyuh. This was formulated by a master of advanced military arts, including the divine weapons or Astras, called Dronacharya. Chakravyuh was based on the same tactic as RSA’s; make the enemy enter with relative ease but make the exit really difficult.

It may be argued that there will be a lot of examples for the same kind of tactic, but since this is a wartime strategy, I think looking more into the mathematics of Chakravyuh may help break RSA because, even a strategy as complex as Chakravyuh could have been broken if the math behind it was done right.

Hence, considering these examples, does this mean it is logical and also recommended that we go back in time and look into the issue of security with the eyes of our ancestors while using the advanced systems of our time in order to move forward technologically?

Should our strategy be to go back to go forward? Makes a lot of sense to me!

P.S.: I will write about the intricacies of various algorithms mentioned above in a different article. I hope I intrigued you enough to make you look out for my next article.

Thanks for reading.

Bob: Who’s there??

Eve: It’s me, Alice’s friend, Eve!

Now, what’s happening here? Why did Alice’s friend go to Bob’s house? Ok before we delve further into the topic at hand, let me first introduce you to the ‘actors’ here. Please encourage them with a big round of applause: Alice, Bob and Eve *applause*. These three are the most common names you will hear in the Security world. Alice and Bob are wife and husband. Alice trusts Bob and Bob trusts Alice. Alice works for the government and knows the location of the secret vault in which top secret documents are kept. Bob never asked Alice about her work secrets but that doesn’t mean he can’t. Since Alice trusts him, she might even tell him. Let’s say Alice does tell Bob a secret or two about what’s cooking in her office and also slipped in the secret location of the vault in a conversation. You might think in the real world people aren’t this dumb but let me assure you, they are (*cough*, Check this out , *cough*)!

Now, there are always people like Eve (short for eavesdropper who can also be an attacker) in our world who, for shady some reason, listen in to conversations and later, when the time is right, manipulate people into believing that he/she is someone whom they can trust. Now that you know who these actors are, let’s continue.

Why does Eve pose as Alice’s friend to Bob? Is Eve indeed Alice’s friend as she claims to be or is there something fishy here? Well this, my friends, is a case of Social Engineering attack. It, I think, is THE most potent attack in the security world which experts don’t have an answer to. Social Engineering is the art of playing with people’s trust by gaining it and later manipulating them into giving up some very secret information. OWASP does a really nice work in identifying the top 10 vulnerabilities that plague a web applications’ security but I think it forgot to include Social Engineering as one of them.

Social Engineering attacks have been a thing since ages. Remember how the Greeks invaded the city of Troy with the help of the Trojan Horse? Oh yeah, that was Social Engineering alright! The recent Ransomware virus was also spread through Social Engineering (Phishing). And it is here to stay. The technological world can advance at the rate of knots and the hardware and the software can be hardened against any kind of attacks. But it’s impractical to expect humans to be hack-proof. Every human is different and every human is susceptible to tricks in their own way. The only problem for the hacker is to find a way by which he/she can manipulate the victim into trusting them.

Eve can tell Bob how good friends she and Alice are. Bob and her can have an amazing conversation and Bob can eventually trust Eve. The secret sharing might not happen in the first meeting. Eve and Bob can meet without the knowledge of Alice. Eve can continue meeting Bob till the time the secret is revealed. After that, Eve can do whatever she wishes to do with that information. This is what espionage is all about.

Make no mistake, we Humans are amazing. We are the geniuses who haven’t understood our own potential yet. But let’s also acknowledge one fact about us Humans. We make mistakes; over and over again. We can make or break systems but it’s usually the latter we end up doing.

So how do we tackle this issue? We can’t stop having relations with people. Businesses thrive because of the relations companies make with each other. Nations become great because of how well they maintain relationships with the other nations. Each and every living organism on this planet is alive because of the relations it has with the other life forms. Hence, this gives rise to a paradox of sorts. And I haven’t seen many solved paradoxes.

So the best that we can do is to be aware of what we post on the social media, what we talk in public, what we share with our friends and partners and what our responsibilities are as an employee of a company. Awareness is the only prevention for this issue. Now that you are aware of the problems Social Engineering can get you into, please be safe and also make sure your friends and family are.

Would using robots to safeguard secrets help the cause? That discussion if for another day. Will the systems be ever secure and strong then? Well, a chain is only as strong as its weakest link!

Or are you that someone who notices how sleepy the security guard was when you saw her on your way to the bank? Are you also someone who notices how many exits the bank actually has? Do you notice how many guards are actually competent to protect you and others in the event of a robbery? Do you keep wondering about the number of flaws/vulnerabilities in the age-old software which the bank authorities use? Would you go and report any issues you notice in the bank to the concerned authorities?

If your answer is a resounding YES for the latter set of questions, ethical hacking is for you! Not everyone can be an ethical hacker. You have to have the knack for it. I think ethical hacking is for those who can think like a criminal but have the ethics to go and report the issues to people who can do something about them. Ethical hacking isn’t a technique; it is a lifestyle. If you, since your childhood, kept wondering about the flaws, be it minor or major, about any functioning system in your environment, then you have the skill set to be an ethical hacker and ethical hacking is your cup of tea!

You have a particular set of skills; skills that make you a nightmare for the black hat hackers. (Fist bump if you got the reference!)

Ethical hackers are the Sherlock Holmeses ( ) of the modern age. They observe things which are not usually caught by normal people’s gaze. They have a thing for detail and they are very meticulous when it comes to analysing. Why is this software behaving like this? Is it not supposed to be functioning in an other way? Why is there so much traffic today on our website? Is anyone sending us excessive requests to take down our system?

The people who have this kind of observational skills and who ask such questions are the ones who get hired by big-shot companies for Cyber Security related stuff because this kind of talent is rare.

If it doesn’t come to you naturally but you still have the desire to be an ethical hacker, then godspeed to you! Nothing can stop you. You are never too late to start learning the tricks of the trade. There are quite a few courses out there in the market which give you a launch pad in the field of security. Hard work does pay!

Start seeing the world with a different pair of goggles, and you will notice that there are chinks in everyone’s armour!