Blog on Shea Polansky

I Did Some Classic Router Hacking and Found Some Weird Stuff

Fri, 01 Jul 2022 00:00:00 +0000

A friend of mine got a new router/modem for his Verizon 5G home internet, and he noticed the installation tech visiting a hidden UI that wasn’t available to him. Naturally, we both thought that was unacceptable and set about hacking the router so we could see what secrets it held. We discovered something interesting: the single box contained two separate Linux systems, running a Frankenstein combination of OpenWRT and Android and communicating across a hidden virtual Ethernet link. We also got some CVEs, including a backdoor password generation system and some good ol’ unauthenticated command injection.

Hacking Keycloak to Support TouchID/FaceID Authentication

Tue, 12 Jan 2021 00:00:00 +0000

Keycloak is an open source identity broker that allows you to combine user credentials from different providers (such as Google OAuth, LDAP, GitLab, etc.) as well as locally-stored credentials into a single authentication provider that can integrate with downstream applications using either SAML2.0 or OpenID Connect. I use it in my home lab as a single sign on provider using local accounts (I gave a talk about my setup at BSides Orlando 2020, check it out if you’re interested!).

My 2020 Reading List

Fri, 27 Nov 2020 00:00:00 +0000

We’re getting to the end of the year and I thought I’d compile a list of books I read, referenced, perused, or reread this year, with my thoughts on them. Most of my reading for pleasure is fiction (specifically sci-fi or fantasy), but I do also read plenty of security-related or technical material. I’m going to split the list into fiction and nonfiction, and each section will be in no particular order.

eLearnSecurity Pen Test Professional (PTP) Review

Tue, 30 Jun 2020 00:00:00 +0000

Disclaimer: eLearnSecurity is a sponsor of the IoT Village, an ISE-run organization. I received the course and exam for free due to this relationship. eLearnSecurity had an opportunity to review the contents of this article before it was published but it nonetheless represents my genuine opinion.

This post first appeared on the ISE Blog

I recently took the eLearnSecurity Penetration Testing Professional (PTP) course and passed the associated eLearnSecurity Certified Professional Penetration Tester (eCPPTv2) exam. As a security professional I’m always on the lookout for new opportunities to improve my skillset and learn new techniques for attacking and defending networks, so I was excited to see what the course had to offer. I already have a few certifications including the Offensive Security Certified Professional (OSCP) and Expert (OSCE), so I have a pretty good background in the topics covered in the course, which include:

Hardening OpenVPN in 2020: Extra Credit

Fri, 26 Jun 2020 00:00:00 +0000

In my previous article, I laid out a framework for building a modern, hardened OpenVPN server/client configuration. At the end, I noted there were some additional hardening steps that would be nice to take for extra security. In particular:

Using an additional static TLS key in the initial TLS handshake to prevent denial-of-service attacks.
Storing keys in hardware cryptographic devices to prevent exfiltration.
Using multi-factor authentication with time-based one time passwords (TOTP, AKA Google Authenticator)
Closing the small security hole created because OpenVPN doesn’t by default check that client certificates match client usernames.
Instructing OpenVPN to apply additional exploit mitigation measures to itself after initialization.

Like the previous article, this will be slightly complicated by the fact that many installations of OpenVPN don’t use the community edition server directly, but wrap it in some other interface or appliance. It will likely be impossible to apply the latter two hardening steps in that case, and may also be impossible to perform the first or third depending on what options are exposed. If you use a wrapper or appliance and the security benefits of these additional configuration steps seem like something you want and the appliance doesn’t offer the options to do so, check with the support team for the product and see if they’re applying them already or if they can expose the relevant options in their interface.

Hardening and Configuring OpenVPN in 2020

Tue, 05 May 2020 00:00:00 +0000

This post originally appeared on the ISE Blog.

Since everyone is working from home for the foreseeable future, corporate IT departments are scrambling to bolster existing VPN solutions or deploy new ones as fast as possible. One of the most popular VPN solutions is OpenVPN, either used directly, or through appliances like the commercial OpenVPN Access Server or third-party VPN gateway products. Some third-party products are not quite upfront about being OpenVPN wrappers, so if you use an SSL VPN Gateway appliance, make sure to double-check the documentation to see if this guide applies to you.

OSCP & OSCE in 2020: A Retrospective

Thu, 09 Apr 2020 00:00:00 +0000

I got my OSCE exam results today. I passed! 🎉

That means it’s time to do a retrospective/review blog post like everyone else I guess. Mine will be a little different than the usual ones though. This won’t be a study guide — there are plenty of those, and especially for the OSCE some of them are practically exam spoilers. Instead I’d like to talk about where I think the OSCP and OSCE courses and exams fit into today’s world.

Importing VMWare Fusion VMs on ESXi 6.5

Sat, 21 Mar 2020 00:00:00 +0000

I use a MacBook Pro for work, and naturally my job involves a good amount of VM usage. VMWare Fusion is supposed to have good integration with ESXi, allowing you to connect to servers, manage VMs remotely, and transfer them to/from them. I find that the remote management works pretty well, and downloading VMs works most of the time, but I couldn’t get uploading them to our ESXi 6.5 host to work; I would always get cryptic errors like Invalid configuration for device '0'. Even exporting the VM to an OVA file and importing it on the web interface wouldn’t work. One ticket with VMWare Support later and I finally have the correct import procedure:

A Better Windows 10+WSL SSH Experience

Tue, 03 Dec 2019 00:00:00 +0000

Windows 10 ships with two awesome features for users and developers who still work in Linux land. The first is the Windows Subsystem for Linux, which implements a subset of the Linux Kernel’s system calls to allow you to run native Linux userland utilities such as bash and friends, and ssh. Windows 10 also includes a native build of OpenSSH, which means you don’t even need to use WSL to SSH into your other machines! Unfortunately, neither option has any ssh-agent running by default, so if you have passphrase protected keys (which you should!), then you’ll need to enter the passphrase every time you want to use them. Let’s fix that!

Creating TPM-Backed Certificates on Windows

Mon, 02 Dec 2019 00:00:00 +0000

I’ve started experimenting with exposing some of my home lab services to the world without needing a VPN. Instead, I use Caddy (which is an excellent web server, and much easier to work with than Nginx) as a reverse proxy with TLS client certificates for authentication. Caddy’s built-in Let’s Encrypt functionality provides the server certificate, and my internal PKI provides the client certificates. I still want to have 2-factor authentication, though — a certificate is merely “something you have”, and I want to require “something you know,” too. Since all my PCs are recent enough to feature a TPM, I decided to store the keys on said TPM and configure it to require a password before allowing any authentication to take place. I was inspired by Microsoft Hello for Business — which is really cool and I can’t wait to work with it some day — but using the TPM directly is much lighter weight as no domain controller or Windows AD Domain is needed. The previous iteration of Microsoft’s “Passwordless Future,” TPM-backed virtual smart cards would be exactly what I want, except the docs come with a big ol’ deprecation warning. Instead, I found how to interact with the base TPM crypto provider to generate certificates.

PSA: Don’t Store 2FA Codes in Password Managers

Mon, 18 Mar 2019 00:00:00 +0000

This post originally appeared on blog.securityevaluators.com

Two-Factor Authentication (2FA, also known as Multi-Factor Authentication, or MFA) is all the rage these days, and for good reason. Accounts secured by 2FA are much, much harder to compromise than accounts using only a single factor — so much more so that you can — sometimes — get away with an easier to type and remember (and therefore weaker) password when using it. The most common ways of implementing the second factor are SMS and TOTP (Time-Based One Time Password). When SMS is used, the site sends you a short numerical code via SMS after you enter your password, and you type the code into the site to finish proving your identity. SMS is inconvenient (you have to have your phone on you), and more importantly, SMS is insecure and not recommended, so many sites are moving to TOTP codes instead, which involves using an app to generate codes yourself instead of the site sending them to you. There are a variety of apps that you can use to generate these codes, and some password managers do it too — but you have to be careful: your choice of app could weaken the security benefits provided by TOTP.

2FA: Not All Factors Are Created Equal

Thu, 28 Feb 2019 00:00:00 +0000

This post originally appeared on blog.securityevaluators.com

The security of a 2FA-protected account is much greater than the security of an account protected by only one factor — in theory. In practice, there is more nuance to it than that. For 2FA, you are trusting the server to enforce the 2FA and not be compromised by hackers or compelled by law enforcement to allow them access to your data; meanwhile a service can be configured to use your password in a way that protects even against hackers or law enforcement. Understanding this nuance requires a deeper understanding of how 2FA works and how it does (or doesn’t!) protect your accounts.