Today is the first of the year and 2018 is the first year that has started with genuine excitement for me. 2017 was a great year full of professional and personal development and I look forward to achieving everything that I set out to for 2018. When the previous year began I was thinking about goals that I would like to achieve and for the most part I was able to do them as documented on this blog of mine. The CSA+ I was able to get and I have been able to continue to increase my skills with a lab environment that will be replicated in my home office in the coming weeks.
2018 brings the following goals (tentative):
- Continue to develop and read into philosophy as well as increase physical fitness
- Refinance my home in an attempt to reduce overhead and free up money to go into solar power
- Focus on making time for the things that matter
- Continue to develop self hosted data analysis
- Pursue an additional certificate or two perhaps dealing in virtualization, Windows Server and/or Linux
- iPod Video 5.5G DIY Refurbish – Post half written, waiting on replacement body shipping from CN
- Garage is getting renovated, built bookshelf.
- Grey-scaling cell phone to reduce use if not necessary – Source
- Trying to spend less time on Youtube
John Maus- Hey Moon
Kanye West – Welcome To Heartbreak ft. Kid Cudi
Previously, an idea was established for the “Daily” category but realistically it isn’t feasible to produce something daily that warrants reading. This segment is basically what the title implies, a weekly rundown of things that were of particular interest to yours truly. Continue reading “Weekly Rundown – Week 48 2017”
Last episode on lab work I fixed networking issues, this can be found here.
This is what my “completed” lab looks like that I do testing with at work, the network can be interpreted pretty easily but if I remember I am going to include a network diagram of sorts for this as some might find it interesting.
Another identical piece of hardware to this has come home with me and I plan on getting it up and running very similar to this in my home setting. This includes running ESXi v6.5 and the 13 virtual machines back up and running. The names of the virtual machines indicate their purpose and it is pretty clear what each of them does from this alone. I am going to try and make this project into a blog post that will be easy to follow for anyone interested in any of the same things. The way that the lab is designed is an All-In-One styled design complete with with networking practice, Offensive/Defensive network and computer security as well as some other additional testing present. Pfsense runs the backbone of the network and the whole thing was based off of the AVATAR Project by @da_667 . Pfsense is what makes it possible for all of the network simulation that allow this system to run and without it wouldn’t be able to handle anything nearly as robust as it is serving now.
The interesting parts of this will be seeing how much of it I can automate through scripting and .ovf files and I will try and keep a general timeline of how long it takes to get back up and running. In the next write up I will catalog what changes I made to this design and how I plan on using it to learn more in the security and systems engineering fields.
This is a little bit of an offshoot from my normal posts and rather is an idea for a program of sorts that would be a quantification of how time is spent at a computer for better or for worse. This would help identify patterns and provide a single page overview of how a day at a computer was spent. This could be expanded to multiple devices as well as integration with mobile devices that would provide a wide range of telemetry. These devices could be fitness trackers, Smart phones (with integration into people you may have spoken to, places that you could have gone, and potentially even exercise that was carried out. The idea behind this being that you wouldn’t have to turn anything on but you would have a skeleton of what you had done in that given day. Google collects location data, programs like WhatPulse tracks keystrokes and can also do network usage+application usage, Fitness trackers offer daily summaries that show what you have done in a given day. This posits the question of, well why do we need something different than the solutions already offered? Because this data is yours but it isn’t in your possession. The idea behind this being that the software would be FOSS and give full control over the data as well as the programs to the power of the user.
The beauty of this project would be that it would all be self hosted and could have both local integration and VPS integration with exactly however many modules a person could choose to integrate providing a dashboard or a high level overview of what occurred in a given day. This data is good and useful but the patterns that could be analyzed in combination with changes of habits or general mood tracking / journal keeping could be monumental in achieving goals. The data would be presented in a format that was easy to expand at a whim to see the technical details but also general enough so that it would be nice to look at. Integration with the goal achieving piece could be implementing something like the 5 minute journal alongside this data.
This top level overview offers little insight on how this would happen technically and to be frank my rudimentary understanding of C++, Python and Bash may not make this something that is feasible but the idea behind it is still interesting and ultimately worth exploring. Ideally this application would work on both Windows and GNU/Linux with Android integration planned on the mobile device side. Ideally the data would be aggregated from available open source tools and the front-end or dashboard would be the piece that would need to be developed.
The HOT new trend is to name the vulnerability that was found with a cool catchy name (CVE’s just don’t cut it anymore), this one holds the name “KRACK”. Other notable vulnerabilities that were named other than this one being Heartbleed, Badlock and ImageTragick.
The embargo on this vulnerability broke at 6AM EST, 10/16/2017 and the following eruption and hype up this this point was very interesting. The technicality of this attack lies in the 4 way handshake in authentication with WPA2 and the mechanism is described much better than I would be able to describe in the sources listed at the bottom.
The implications and proposed fixes here are what are interesting. In the paper countermeasures are listed as mitigation of the key installation attacks and changing the way the Pairwise Transient Keys (PTK) is negotiated. The questioning of the 802.11 standards ambiguity continues in part 6.6 of Discussion as well as the way proofs work theoretically and in practice and whether or not these differ. Finally the fact that nonce recuse is present in GCMP and not CCMP and can be mitigated by the use of a nonce misuse-resistant encryption scheme would reduce the total impact. This is all the information from the paper however, I stumbled upon a Github Repo that is a bit dated at the time of writing that addresses other inherent security flaws that are how WPA2 networks were previously compromised in what is called “Call for WPA3 – what’s wrong with WPA2 security and how to fix it”.
Wireless communication isn’t going away and I believe that rolling the call for WPA3 in the form of a restructure of how WPA works as well as questioning the way the 802.11 standard is built are overall beneficial in making wireless networking as secure as possible. The other interesting takeaway is the idea that the way that the general gap between the way things work theoretically or from a design perspective vs actually in a environment is something that academia and practitioners will not soon get away from.
Bleeping Computer Article