September 10, 2019
Plantuml + Gitlab is risky
For a plantuml nice and simple diagrams text generation tool integration with the gitlab server setup, the plantuml server needs to be exposed to external network. Which is not good. Although some of security risks can be mitigated with running plantuml in docker but definitely not all (such as data exposure, DoS attacks) and mitigating them requires lots of careful manual tuning. Gitlab needs plantuml integration to host rendered images on its side. Maybe aa a plugin. I definitely want to investigate this.
Labels: devops, diagram, docker, git, gitlab, plantuml, security, uml, work process
September 8, 2019
On Facebook user data leaks
Some thoughts after recent Facebook user data leak.
I know no evidence of the following, so not stating it's true at all. Though in a light of user data usage restrictions and depersonalisation the real user data would definitely help those who buy ads on Facebook. To put it straight: leaks lead to rise of ad sales!
What I believe is true is that until companies like Facebook is punished really hard for user data leaks, the data leaks incidents will continue to happen.
I know no evidence of the following, so not stating it's true at all. Though in a light of user data usage restrictions and depersonalisation the real user data would definitely help those who buy ads on Facebook. To put it straight: leaks lead to rise of ad sales!
What I believe is true is that until companies like Facebook is punished really hard for user data leaks, the data leaks incidents will continue to happen.
Labels: ads, data leaks, facebook, security, user data
June 11, 2019
An "Ungoogled" Chromium: how to move from Chrome
In light of google disabling adblocking-related API parts for Chrome extensions and lots of other shit about Chrome I started to look for an alternative.
What I came into is "ungoogled chromium" which can be downloaded as many other chromium variants from here. Not sure on next step, can possibly compile it myself with importing latest patches or reverting patch related to API cut (I'm sure they'll make it impossible. though).
There're some challenges in process of moving to Chromium from Chrome, though. Copying profile is not enough ;)
What I came into is "ungoogled chromium" which can be downloaded as many other chromium variants from here. Not sure on next step, can possibly compile it myself with importing latest patches or reverting patch related to API cut (I'm sure they'll make it impossible. though).
There're some challenges in process of moving to Chromium from Chrome, though. Copying profile is not enough ;)
- If you want to move to Chromium smooth and save your opened tabs, the trick is to copy user profile while Chrome is opened (as Chromium resets some of settings while opening newly copied profile it starts with "Open with new tab" option effectively forgetting all your tabs
- In Chromium passwords cannot be imported. At all. Or saved. Until you delete "Login Data*" files (DB itself and -journal).
- Extensions cannot be set up from chrome store. Download process is manual using download URL below or here with pictures (if you don't mind some Japanese).
- Look through
https://clients2.google.com/service/update2/crx?response=redirect&prodversion=[PRODVERSION]&acceptformat=crx2,crx3&x=id%3D[EXTENSIONID]%26ucPS Speaking of privacy and adblock-related extensions, I'm using uBlock origin (gorhill's one) and Tampermonkey with some Medium-related scripts. Cannot imagine browsing without them - internet is just hell (from my point of view I can compare it with popups and blinking banners of 90s).
Labels: chrome, chromium, extensions, google, opensource, privacy, security, ublock
October 20, 2018
Example of bad security model and "We have noticed an unusual activity in your account."
It's always makes sense to spend money on security and especially on threat modelling. This can prevent lots of situations like the loss of users' personal data and account cracking.
Of course sometimes companies use any little reason to get more pieces of personal information, like the mobile phone number. For example, it makes absolutely no sense to ask for a phone number after "unusual account activity" has been already detected. Asking the one user who is logging in to provide his phone number (and possibly linking it to the account as 2FA or account recovery channel) actually is very bad idea in this situation! Because if attacker already has password on hand he can also link his phone number thus effectively preventing the account owner from logging into account forever.
Threat modelling can help understand such situations and prevent them.
Labels: account, security, threat model
August 28, 2018
On SSH security
In case of need to temporary log in into SSH box from non-secure location (i.e. assuming keyboard wiretapping on Intel ME-enabled system) it's possible to use google auth as second-factor auth. It's also worth considering the worst scenario of man-in-the-middle and enable 2FA for a separate non-sudoer account.
April 13, 2017
Notes on Brave browser
Just a few notes for myself. Took a minute to look through Brave(.com) browser and stuck upon mention that it uses NaCl in Crypto. Why the hell to use NaCl? I get used to disable NaCl in Chrome when I could - until chrome:plugins control was removed. I just believe that crypto must be as close to CPU as possible, as native as possible (no JavaScript crypto code) and HW accelerated on CPU level. The lesser layers the safer it is, cause so no secret keys could be left in memory to be read by some other process.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
January 11, 2012
securely eraser for hdd
free utility:
http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml
http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml
April 18, 2011
thawte: strange security recommendations
Got mail from Thawte (company is their customer) with the following recommendations:
--
Our NEW, in-depth white paper, "Securing Your Private Keys as Best Practice for Code Signing Certificates," shows how to make your organization too difficult for cyber-criminals to target. Learn how to:
• Minimize access to source code
• Formalize processes with test and release signing
• Deploy a test root certificate and server
• Use cryptographic hardware devices
--
I always thought that open-sourcing and through testing makes system much more security attack-resistive. I have not yet read the document, but this annotation sounds some strange.
--
Our NEW, in-depth white paper, "Securing Your Private Keys as Best Practice for Code Signing Certificates," shows how to make your organization too difficult for cyber-criminals to target. Learn how to:
• Minimize access to source code
• Formalize processes with test and release signing
• Deploy a test root certificate and server
• Use cryptographic hardware devices
--
I always thought that open-sourcing and through testing makes system much more security attack-resistive. I have not yet read the document, but this annotation sounds some strange.
January 14, 2011
mysql config bind local replace script
AS IS! No guarantee.
-- bind-local-replace.sh
--
Usage:
and then manually check and then copy:
-- bind-local-replace.sh
#!/bin/bash
sed -e '/^bind[-]address*/ s/^/#/' | sed '/[[]mysql[]]/a \
bind-address=127.0.0.1
'
--
Usage:
./bind-local-replace.sh < /etc/my.cnf > /tmp/my.cnf
and then manually check and then copy:
cp /tmp/my.cnf /etc/my.cnf
Labels: administering, automatization, mysqld, script, security
September 3, 2010
mysqld security: listen to localhost only
add to /etc/my.cnf lines (in section [mysqld]):
[mysqld]
bind-address=127.0.0.1
June 24, 2010
VPN tunnel configuration
Using OpenVPN, OpenVPN GUI at client and also iptables on server-side for NAT.
client openvpn config (replace $SERVER_IP with actual real ip):
server NAT:
clear rules:
NAT enable (replace param $SERVER_.... with external ip):
server openvpn config:
also possible to compress traffic, but i did not yet tried it.
client openvpn config (replace $SERVER_IP with actual real ip):
remote $SERVER_IP
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret static.key
redirect-gateway
server NAT:
clear rules:
iptables -F; iptables -t nat -F; iptables -t mangle -F
NAT enable (replace param $SERVER_.... with external ip):
iptables -t nat -s 10.8.0.2 -A POSTROUTING -j SNAT --to $SERVER_EXTERNAL_URL
server openvpn config:
dev tun
ifconfig 10.8.0.1 10.8.0.2
route 10.8.0.0 255.255.255.0
secret static.key
push "redirect-gateway"
push "dhcp-option DNS 10.8.0.1"
also possible to compress traffic, but i did not yet tried it.
January 21, 2010
How to retrieve IMEI
Nokia
System.getProperty("phone.imei");
System.getProperty("com.nokia.IMEI");
Note ; Requires signed midlet. S60 3rd edition device does not requires signing for this to work.
Sony-Ericsson
System.getProperty("com.sonyericsson.imei");
Note ; might not work on all model.
Motorola
System.getProperty("IMEI");
System.getProperty("com.motorola.IMEI");
Samsung
System.getProperty("com.samsung.imei");
Siemens
System.getProperty("com.siemens.imei");
(from mobilepit.com)
System.getProperty("phone.imei");
System.getProperty("com.nokia.IMEI");
Note ; Requires signed midlet. S60 3rd edition device does not requires signing for this to work.
Sony-Ericsson
System.getProperty("com.sonyericsson.imei");
Note ; might not work on all model.
Motorola
System.getProperty("IMEI");
System.getProperty("com.motorola.IMEI");
Samsung
System.getProperty("com.samsung.imei");
Siemens
System.getProperty("com.siemens.imei");
(from mobilepit.com)
May 27, 2009
Major java (Un)Security in Ubuntu/Macos
Ubuntu maintainers impress me one more with their 'i dont care' attitude to security o their system. The first was the debian-specific change to packege openssl that lead to ALL SSL and TLS communications and SSH key generation actually unencrypted.
Now they keep the both versions of sun's 5 and 6 java in stable repository (packages sun-java5 and sun-java6)one minor release BEFORE fixing of major vulnerability (CVE-2008-5353: calendar deserialization). The sun fixed this back in Dec 2008 already (soon after bug was found). And of course they have released stable packages of Java both JDK and JRE.
Hey, Ubuntu repository maintainers, why don't you update sun java packages in repo? Why do you leave unprotecked all those who trust you?
To those Ubuntu users who care about security when surfing in browser, I advice you update java manually using sun'site (Downloads section): http://java.sun.com site AND don't forget to REMOVE ubuntu's packages before, using for example Synaptics. Just search for java and remove everything about Java then reinstall JRE/JDK using Sun site.
PS Vulnerable Java releases are: Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier. To see version just type java -version in terminal console.
PPS Macos users are ALL vulnerable to this, because Apple maintains Java branch for their Macos by themselves and have not yet released update OR patch (!!!). Unfortunately, it seems that security is not priority of Apple.
PS Apple has fixed it. Please update your macs ASAP.
Now they keep the both versions of sun's 5 and 6 java in stable repository (packages sun-java5 and sun-java6)one minor release BEFORE fixing of major vulnerability (CVE-2008-5353: calendar deserialization). The sun fixed this back in Dec 2008 already (soon after bug was found). And of course they have released stable packages of Java both JDK and JRE.
Hey, Ubuntu repository maintainers, why don't you update sun java packages in repo? Why do you leave unprotecked all those who trust you?
To those Ubuntu users who care about security when surfing in browser, I advice you update java manually using sun'site (Downloads section): http://java.sun.com site AND don't forget to REMOVE ubuntu's packages before, using for example Synaptics. Just search for java and remove everything about Java then reinstall JRE/JDK using Sun site.
PS Vulnerable Java releases are: Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier. To see version just type java -version in terminal console.
PPS Macos users are ALL vulnerable to this, because Apple maintains Java branch for their Macos by themselves and have not yet released update OR patch (!!!). Unfortunately, it seems that security is not priority of Apple.
PS Apple has fixed it. Please update your macs ASAP.
Labels: bug, CVE-2008-5353, java, macos, security, ubuntu, vulnerability
March 5, 2009
Privacy: Google and 3rd party cookies
Discovered several days ago that in order to use GMail Google requires that the 3rd party cookies is enabled in browser! As often said, it hurts the online provacy, but why does google require this? The answer is very simple: to track you by its adsense/doubleclick engines! They can track your path in web only if you enable the 3rd party cookies.
What to do to save your privacy?
1) Use different browsers for web browsing and working in GMail (i.e. Opera for browsing/Firefox for GMail)
2) Use "Enable 3rd party Cookies" setting for all these sites: gmail.com, google.com, google.*/, *.google.*. (You can do this in Opera AFAIK). The default setting for Cookies should be "Accept cookies only from site I visit" (=no 3rd party cookies).
Take care!
PS Do you believe in "Don't be evil" anymore?
What to do to save your privacy?
1) Use different browsers for web browsing and working in GMail (i.e. Opera for browsing/Firefox for GMail)
2) Use "Enable 3rd party Cookies" setting for all these sites: gmail.com, google.com, google.*/, *.google.*. (You can do this in Opera AFAIK). The default setting for Cookies should be "Accept cookies only from site I visit" (=no 3rd party cookies).
Take care!
PS Do you believe in "Don't be evil" anymore?
January 22, 2009
Solaris trojan
Сегодня обнаружил трояна в недавно поставленной солярке (!). Причем, rootkithunter его не обнаруживает. попал при инсталляции через telnetd (-f...), маскировался под lpsched (WANUK.A). Этого-то нашел, но хбз, что там еще залезло через ту дырку.
Там дело в том, что солярку ставили со старого дистриба (11/06), а потом обновлениями добивали до последнего стабильного. telnetd админ отрубил почти сразу, но эта вот дрянь успела пролезть. В общем, с админом сегодня переставили систему с форматированием винта. Кстати, Sun очень рулит со своими консолями, когда можно даже в BIOS удаленно заходить (!), чтобы например выбирать бутовое устройство - там в CD засунут дистриб солярки как-раз, с которого и ставили. Короче, как-будто тачка не на хостинге, а рядом :)
В общем, товарищи, проверяйте свои системы тщательнее! Желательно снимать снимки md5 всех файликов в /etc и хотя бы основных бинарных утилиток (/bin, /usr/bin, /usr/sbin и так далее. См ранний пост про IDS).
Там дело в том, что солярку ставили со старого дистриба (11/06), а потом обновлениями добивали до последнего стабильного. telnetd админ отрубил почти сразу, но эта вот дрянь успела пролезть. В общем, с админом сегодня переставили систему с форматированием винта. Кстати, Sun очень рулит со своими консолями, когда можно даже в BIOS удаленно заходить (!), чтобы например выбирать бутовое устройство - там в CD засунут дистриб солярки как-раз, с которого и ставили. Короче, как-будто тачка не на хостинге, а рядом :)
В общем, товарищи, проверяйте свои системы тщательнее! Желательно снимать снимки md5 всех файликов в /etc и хотя бы основных бинарных утилиток (/bin, /usr/bin, /usr/sbin и так далее. См ранний пост про IDS).
Labels: intrusion, security, solaris, telnet, telnetd, trojan, virus
January 11, 2009
Intrusion detection system
For: linux, solaris. See details for more info.
Price:
Free. Send me a letter to get it (below).
Note:
No obligations. AS-IS. Yse for your own risk. Author grants you NO warranties. Author is NOT responsible for ANY damage when using of this program.
Details:
Checks md5 sums for /bin, /sbin, /etc, /usr/bin, /usr/sbin with saved ones and raises an alert (./alert.sh, you put any action you need in it) in case of any change.
Usage:
* makesnapshot.sh - calculates and saves checksums of files.
* check.sh - checks for change.
Jan 2009
Shamil Gumirov
[ shamil mobileheroes com ]
Price:
Free. Send me a letter to get it (below).
Note:
No obligations. AS-IS. Yse for your own risk. Author grants you NO warranties. Author is NOT responsible for ANY damage when using of this program.
Details:
Checks md5 sums for /bin, /sbin, /etc, /usr/bin, /usr/sbin with saved ones and raises an alert (./alert.sh, you put any action you need in it) in case of any change.
Usage:
* makesnapshot.sh - calculates and saves checksums of files.
* check.sh - checks for change.
Jan 2009
Shamil Gumirov
[ shamil mobileheroes com ]
Labels: antivirus, ids, intrusion detection, security
