I no longer update this blog, but I’m keeping these posts up for anyone who still finds them useful. Some of the information may be out of date.
Here you can find any useful bits of info I think might be useful to share, and a few rants about how to do security (and other things) properly. You can also browse posts by tag.
A friend of mine got a new router/modem for his Verizon 5G home internet, and he noticed the installation tech visiting a hidden UI that wasn’t available to him. Naturally, we both thought that was unacceptable and set about hacking the router so we could see what secrets it held. We discovered something interesting: the single box contained two separate Linux systems, running a Frankenstein combination of OpenWRT and Android and communicating across a hidden virtual Ethernet link. We also got some CVEs, including a backdoor password generation system and some good ol’ unauthenticated command injection. ...
Keycloak is an open source identity broker that allows you to combine user credentials from different providers (such as Google OAuth, LDAP, GitLab, etc.) as well as locally-stored credentials into a single authentication provider that can integrate with downstream applications using either SAML2.0 or OpenID Connect. I use it in my home lab as a single sign on provider using local accounts (I gave a talk about my setup at BSides Orlando 2020, check it out if you’re interested!). ...
We’re getting to the end of the year and I thought I’d compile a list of books I read, referenced, perused, or reread this year, with my thoughts on them. Most of my reading for pleasure is fiction (specifically sci-fi or fantasy), but I do also read plenty of security-related or technical material. I’m going to split the list into fiction and nonfiction, and each section will be in no particular order. ...
Disclaimer: eLearnSecurity is a sponsor of the IoT Village, an ISE-run organization. I received the course and exam for free due to this relationship. eLearnSecurity had an opportunity to review the contents of this article before it was published but it nonetheless represents my genuine opinion. This post first appeared on the ISE Blog I recently took the eLearnSecurity Penetration Testing Professional (PTP) course and passed the associated eLearnSecurity Certified Professional Penetration Tester (eCPPTv2) exam. As a security professional I’m always on the lookout for new opportunities to improve my skillset and learn new techniques for attacking and defending networks, so I was excited to see what the course had to offer. I already have a few certifications including the Offensive Security Certified Professional (OSCP) and Expert (OSCE), so I have a pretty good background in the topics covered in the course, which include: ...
In my previous article, I laid out a framework for building a modern, hardened OpenVPN server/client configuration. At the end, I noted there were some additional hardening steps that would be nice to take for extra security. In particular: Using an additional static TLS key in the initial TLS handshake to prevent denial-of-service attacks. Storing keys in hardware cryptographic devices to prevent exfiltration. Using multi-factor authentication with time-based one time passwords (TOTP, AKA Google Authenticator) Closing the small security hole created because OpenVPN doesn’t by default check that client certificates match client usernames. Instructing OpenVPN to apply additional exploit mitigation measures to itself after initialization. Like the previous article, this will be slightly complicated by the fact that many installations of OpenVPN don’t use the community edition server directly, but wrap it in some other interface or appliance. It will likely be impossible to apply the latter two hardening steps in that case, and may also be impossible to perform the first or third depending on what options are exposed. If you use a wrapper or appliance and the security benefits of these additional configuration steps seem like something you want and the appliance doesn’t offer the options to do so, check with the support team for the product and see if they’re applying them already or if they can expose the relevant options in their interface. ...
This post originally appeared on the ISE Blog. Since everyone is working from home for the foreseeable future, corporate IT departments are scrambling to bolster existing VPN solutions or deploy new ones as fast as possible. One of the most popular VPN solutions is OpenVPN, either used directly, or through appliances like the commercial OpenVPN Access Server or third-party VPN gateway products. Some third-party products are not quite upfront about being OpenVPN wrappers, so if you use an SSL VPN Gateway appliance, make sure to double-check the documentation to see if this guide applies to you. ...
I got my OSCE exam results today. I passed! 🎉 That means it’s time to do a retrospective/review blog post like everyone else I guess. Mine will be a little different than the usual ones though. This won’t be a study guide — there are plenty of those, and especially for the OSCE some of them are practically exam spoilers. Instead I’d like to talk about where I think the OSCP and OSCE courses and exams fit into today’s world. ...
I use a MacBook Pro for work, and naturally my job involves a good amount of VM usage. VMWare Fusion is supposed to have good integration with ESXi, allowing you to connect to servers, manage VMs remotely, and transfer them to/from them. I find that the remote management works pretty well, and downloading VMs works most of the time, but I couldn’t get uploading them to our ESXi 6.5 host to work; I would always get cryptic errors like Invalid configuration for device '0'. Even exporting the VM to an OVA file and importing it on the web interface wouldn’t work. One ticket with VMWare Support later and I finally have the correct import procedure: ...
Windows 10 ships with two awesome features for users and developers who still work in Linux land. The first is the Windows Subsystem for Linux, which implements a subset of the Linux Kernel’s system calls to allow you to run native Linux userland utilities such as bash and friends, and ssh. Windows 10 also includes a native build of OpenSSH, which means you don’t even need to use WSL to SSH into your other machines! Unfortunately, neither option has any ssh-agent running by default, so if you have passphrase protected keys (which you should!), then you’ll need to enter the passphrase every time you want to use them. Let’s fix that! ...
I’ve started experimenting with exposing some of my home lab services to the world without needing a VPN. Instead, I use Caddy (which is an excellent web server, and much easier to work with than Nginx) as a reverse proxy with TLS client certificates for authentication. Caddy’s built-in Let’s Encrypt functionality provides the server certificate, and my internal PKI provides the client certificates. I still want to have 2-factor authentication, though — a certificate is merely “something you have”, and I want to require “something you know,” too. Since all my PCs are recent enough to feature a TPM, I decided to store the keys on said TPM and configure it to require a password before allowing any authentication to take place. I was inspired by Microsoft Hello for Business — which is really cool and I can’t wait to work with it some day — but using the TPM directly is much lighter weight as no domain controller or Windows AD Domain is needed. The previous iteration of Microsoft’s “Passwordless Future,” TPM-backed virtual smart cards would be exactly what I want, except the docs come with a big ol’ deprecation warning. Instead, I found how to interact with the base TPM crypto provider to generate certificates. ...