Security

A friend of mine got a new router/modem for his Verizon 5G home internet, and he noticed the installation tech visiting a hidden UI that wasn’t available to him. Naturally, we both thought that was unacceptable and set about hacking the router so we could see what secrets it held. We discovered something interesting: the single box contained two separate Linux systems, running a Frankenstein combination of OpenWRT and Android and communicating across a hidden virtual Ethernet link. We also got some CVEs, including a backdoor password generation system and some good ol’ unauthenticated command injection. ...

Disclaimer: eLearnSecurity is a sponsor of the IoT Village, an ISE-run organization. I received the course and exam for free due to this relationship. eLearnSecurity had an opportunity to review the contents of this article before it was published but it nonetheless represents my genuine opinion. This post first appeared on the ISE Blog I recently took the eLearnSecurity Penetration Testing Professional (PTP) course and passed the associated eLearnSecurity Certified Professional Penetration Tester (eCPPTv2) exam. As a security professional I’m always on the lookout for new opportunities to improve my skillset and learn new techniques for attacking and defending networks, so I was excited to see what the course had to offer. I already have a few certifications including the Offensive Security Certified Professional (OSCP) and Expert (OSCE), so I have a pretty good background in the topics covered in the course, which include: ...

In my previous article, I laid out a framework for building a modern, hardened OpenVPN server/client configuration. At the end, I noted there were some additional hardening steps that would be nice to take for extra security. In particular: Using an additional static TLS key in the initial TLS handshake to prevent denial-of-service attacks. Storing keys in hardware cryptographic devices to prevent exfiltration. Using multi-factor authentication with time-based one time passwords (TOTP, AKA Google Authenticator) Closing the small security hole created because OpenVPN doesn’t by default check that client certificates match client usernames. Instructing OpenVPN to apply additional exploit mitigation measures to itself after initialization. Like the previous article, this will be slightly complicated by the fact that many installations of OpenVPN don’t use the community edition server directly, but wrap it in some other interface or appliance. It will likely be impossible to apply the latter two hardening steps in that case, and may also be impossible to perform the first or third depending on what options are exposed. If you use a wrapper or appliance and the security benefits of these additional configuration steps seem like something you want and the appliance doesn’t offer the options to do so, check with the support team for the product and see if they’re applying them already or if they can expose the relevant options in their interface. ...

This post originally appeared on the ISE Blog. Since everyone is working from home for the foreseeable future, corporate IT departments are scrambling to bolster existing VPN solutions or deploy new ones as fast as possible. One of the most popular VPN solutions is OpenVPN, either used directly, or through appliances like the commercial OpenVPN Access Server or third-party VPN gateway products. Some third-party products are not quite upfront about being OpenVPN wrappers, so if you use an SSL VPN Gateway appliance, make sure to double-check the documentation to see if this guide applies to you. ...

I got my OSCE exam results today. I passed! 🎉 That means it’s time to do a retrospective/review blog post like everyone else I guess. Mine will be a little different than the usual ones though. This won’t be a study guide — there are plenty of those, and especially for the OSCE some of them are practically exam spoilers. Instead I’d like to talk about where I think the OSCP and OSCE courses and exams fit into today’s world. ...

Windows 10 ships with two awesome features for users and developers who still work in Linux land. The first is the Windows Subsystem for Linux, which implements a subset of the Linux Kernel’s system calls to allow you to run native Linux userland utilities such as bash and friends, and ssh. Windows 10 also includes a native build of OpenSSH, which means you don’t even need to use WSL to SSH into your other machines! Unfortunately, neither option has any ssh-agent running by default, so if you have passphrase protected keys (which you should!), then you’ll need to enter the passphrase every time you want to use them. Let’s fix that! ...

I’ve started experimenting with exposing some of my home lab services to the world without needing a VPN. Instead, I use Caddy (which is an excellent web server, and much easier to work with than Nginx) as a reverse proxy with TLS client certificates for authentication. Caddy’s built-in Let’s Encrypt functionality provides the server certificate, and my internal PKI provides the client certificates. I still want to have 2-factor authentication, though — a certificate is merely “something you have”, and I want to require “something you know,” too. Since all my PCs are recent enough to feature a TPM, I decided to store the keys on said TPM and configure it to require a password before allowing any authentication to take place. I was inspired by Microsoft Hello for Business — which is really cool and I can’t wait to work with it some day — but using the TPM directly is much lighter weight as no domain controller or Windows AD Domain is needed. The previous iteration of Microsoft’s “Passwordless Future,” TPM-backed virtual smart cards would be exactly what I want, except the docs come with a big ol’ deprecation warning. Instead, I found how to interact with the base TPM crypto provider to generate certificates. ...

This post originally appeared on blog.securityevaluators.com Two-Factor Authentication (2FA, also known as Multi-Factor Authentication, or MFA) is all the rage these days, and for good reason. Accounts secured by 2FA are much, much harder to compromise than accounts using only a single factor — so much more so that you can — sometimes — get away with an easier to type and remember (and therefore weaker) password when using it. The most common ways of implementing the second factor are SMS and TOTP (Time-Based One Time Password). When SMS is used, the site sends you a short numerical code via SMS after you enter your password, and you type the code into the site to finish proving your identity. SMS is inconvenient (you have to have your phone on you), and more importantly, SMS is insecure and not recommended, so many sites are moving to TOTP codes instead, which involves using an app to generate codes yourself instead of the site sending them to you. There are a variety of apps that you can use to generate these codes, and some password managers do it too — but you have to be careful: your choice of app could weaken the security benefits provided by TOTP. ...

This post originally appeared on blog.securityevaluators.com The security of a 2FA-protected account is much greater than the security of an account protected by only one factor — in theory. In practice, there is more nuance to it than that. For 2FA, you are trusting the server to enforce the 2FA and not be compromised by hackers or compelled by law enforcement to allow them access to your data; meanwhile a service can be configured to use your password in a way that protects even against hackers or law enforcement. Understanding this nuance requires a deeper understanding of how 2FA works and how it does (or doesn’t!) protect your accounts. ...