Archive
Testdrive – Ubiquity UniFi AP – Enterprise Wi-Fi for SOHO
Ubiquity has produced a very nice range of Access points that are quite affordable for the home user. Sure you can get away with a consumer grade router that includes Wi-Fi but for those of us who are a little more concerned with security, have several devices and wish to use a multipronged deployment you need to consider a separate solution.
For just over 300.00 we Canadians can have three Ubiquity Access Points (model UAP) each capable of creating/extending Wi-Fi in your home up to a maximum radius of approx. 400ft. (YMMV – solid objects such as concrete, walls, etc. and electrical wiring can interfere and reduce your effective coverage area). Installation can be as simple as putting an AP on each floor in various sections of your home.
You can even add an outdoor AP (shown in our representation below) to your installation and extend the same unified wireless network into your backyard. 
UniFi APs allow you to have up to four networks (SSIDs) broadcasted from the same access points so you can create one for your phones, your kids, your guests – anything you wish. You can then use the power of the EdgeMax router product (additional cost as low as $150.00) to manage security, bandwidth and the Internet without any other products.
All you need is the 3 pack of wireless APs, an edgemax router and an internet connection and for under $500.00 you can have full speed wireless all over your home or office for up to 100 concurrent clients (YMMV).
But wait, there is more. When you install the software on a beefy PC (either dedicated or shared as your primary PC) you can have reporting (Insights)! Imagine monitoring your usage, usage for your kids, your guests and even those drive-by hackers who might be trying to break in and steal your bandwidth – long passphrases make good neighbours :-). You can setup alerts to send you emails whenever some device fails authentication or goes over a bandwidth cap.
The Unify controller uses Java so please be sure to install it and keep it up to date to avoid issues with your Java runtime. After you open the Controller application you will get a link like this.
Once the application has loaded you can click on the link inside the splash screen to open the management console (you can also launch it by typing https://localhost:8443/). I selected the existing AP I had and it indicated that there was an upgrade so I clicked on Upgrade to apply the newest firmware to my existing access point. This helps make it easy to keep them safe and secure.
The management controller software comes with it’s own hotspot feature so home office and small business can deploy this quickly and give guests a onetime Internet Voucher that can last a minimum of 8 hours and up to a user configurable period. This helps control access to Internet resources by reception or other staff and can help avoid reuse later once the office are closed. Personally I feel this is a great way to get access to network resources after visiting a site. Most home/companies seldom change passphrases on their own networks and rarely use guest networks.
I think this is a great medium range product line that can help most home owners and small business users deploy wireless safely and effectively without exposing their systems to hackers.
Own a new Chrysler – well a hacker could take control of you car while you are driving it!
The date is July 29 2015, imagine someone miles and miles away with a laptop, a cell phone and some malicious software. You are driving along with your kids on a summer vacation when suddenly you tune into a new radio station and all of a sudden you loose control of your vehicle and crash!
Does this sounds like a page from The Twilight Zone? Well it’s not – it’s real. Earlier this month Chrysler announced that it had a confirmed vulnerability for most of it’s cars and trucks since 2013 (almost 1.4 million vehicles) and was forced to issue a recall by the national highway traffic safety administration (NHTSA).
Click to access RCRIT-15V461-7681.pdf
I perused this document that was designed to help dealers fix this vulnerability and I am not exactly sure that most of us would be able to do this. You should keep in mind that flashing firmware can leave any device in a state that will not function.
For some of us who feel bold enough to try it there are instructions on how to do it yourself but if you are like me and would just take the time to get it done by the dealer just imagine for a moment that some mechanic at your dealership takes a USB drive that flashes one car and decides to use it over and over again. What if someone was smart enough to download a Trojan to your radio before you or someone like you gets around to taking your vehicle in to get the fix. If that mechanic reuses that USB drive your car could get hacked again and maybe this time it is even worse.
Security is something that we all take for granted. Gone are the days when the government could protect you from safety and health issues when it comes computers. We have too many devices now and in our haste to computerize everything, safety has fallen out of scope.
We, as a society, need to demand that our governments legislate security into our products and cloud based services with legislative oversight, mandatory compliance and testing (remember when automotive insurance and seat belts were voluntary?) Until then, we are all left to fend for ourselves. Get ahead of the learning curve and educate yourself on how to avoid getting hacked. Think about safety when it comes to using the Internet and computers of any kind. After all we are now living in the future…
Drones not just for launching missles anymore?
Wow, it didn’t take long to discover that the US government could do more with those unarmed aerial vehicles than just bomb targets, why not hack them with malware too!
Boeing and Hacking Team want drones to deliver spyware
http://www.engadget.com/2015/07/18/boeing-and-hacking-team-spyware-drones/?ncid=rss_truncated
Going, going, gone – That all for Windows 2003 Server.
Well this past Tuesday marked a very special Tuesday and it appears to have passed without the sky falling (unlike last years Windows XP patch Tuesday). If you have had your head buried in the sand we may not have been aware but July 14 2015 was the very last day that Microsoft would be sending out patches for your Windows 2003 servers.
With the official death of all windows 5.X kernels you may be interested to know that there are still several hacks available to exploit these machines if you still find yourself needing to use them. If you must continue to use them you might want to inventory your traffic to/from these machines to be sure they are not actively being exploited.
Early last year Microsoft patched MS14-002 for a previously unknown bug that was actively being exploited in combination with an adobe vulnerabilitiy CVE-2013-3346. The bug exploited several routines in their kernel and without that patch – there would be millions of machines still vulnerable. HP has estimated that there were approx. 11 million of these systems in the market so unless you were not one of the companies that migrated to a newer version of Microsoft Server you are probably vulnerable to the next attack. Without paying Microsoft for extended support to get access to patches if/when they create them you could and will probably be attacked.
There is still a concern for businesses that are only using windows 2003 server on their inside network. It still represents a risk to your organization when an intruder is pivoting (connecting to multiple computers from one computer or device). You should also consider an insider attack whether it is willful or not. I always suggest to my clients that they do not discount an disgruntled employee from attacking their network but bringing your own device (BYOD) or Tablets/Smart phones can be used successfully to launch an attack once inside your network.
Consider this, you travel to a hotel on business and connect to the hotel W-Fi network. Free Wi-Fi has become a necessity for businesses and the infrastructure costs offer no revenue generation. The last thing a company can afford is to monitor/maintain those devices so they become an attack surface for hackers to exploit. Your wireless device silently becomes the victim of malware that is designed to search for computers. When you come back from your trip you pass right by security and connect to your home or business network. Its like smuggling your attacker right in the back door and giving them full access to your network.
Remember the top 20 controls and monitor your networks – you never know who might be lurking in the shadows…
Just when you thought your PC/Phone was safe…
Never before has the threat of malware been more prevalent and the breach at Italy’s HackingTeam helps make us all aware of this. I recently reviewed some of the analysis from this site ( http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hackingteams-rat/) regarding just how a company had created and sold malware to governments and corporations that was used to spy on all of our computer platforms and phones.
As security researchers we are able to conclude that there are organizations that create and maintain a complete suite of malware known as a RAT (remote access Trojan) that when installed on your windows/mac/Linux computer and/or your Android/Apple/Windows phone can do any one of the following;
- Can be installed on 32/64 bit platforms
- collect saved passwords from all applications
- collect conversations from messaging apps
- capture emails,contacts from mail programs
- record from your microphone, webcam
- save clipboard and key strokes
- forward all websites visitied
They have added some additional features that are really creepy;
- collect nearby WiFi information and harvest locations
- spread via SD cards and usb drives
- spread to Virtual Machine systems via VMware disk images
- evade over 26 different Antivirus programs
- BIOS persistence via UEFI infection
WOW – network security just got a whole lot harder! Seriously if you thought you were safe trolling the Internet from behind your $30 dollar router at home or because you always upgrade your smart phone every couple of years you are in need of a reality check. When users connect to any old free wifi they find in Hotels and restaurants and then connect to home/office networks they are targets for this kind of attack.
Its time to start protecting ourselves from drive by downloads and casual surfing – get yourself a network condom and lets all practice safe Internet!
Tools for a Safer PC — Krebs on Security
I was getting ready to write a blog post about hardware refreshing when I came upon this article from Brian Krebs.
For anyone looking to review/replace their hardware you should please review his article below for some good tips. Get to know your own network before I do 😉
The death of RC4 – here comes armageddon…
The newest Java can cause some problems with your tools now that SSL is a thing of the past. Earlier this week some of the browser developers officially retired SSLv3 in favour of TLS and it has already started to cause issues. I recently upgraded to the newest Java this week only to find that my Cisco ASA interface no longer works. With Java 7 I had already added the website to the exception list in the security tab so my upgrade should have been relatively flawless as it has been throughout the 8 series of JRE. Unfortunately this was not the case…
I suspected that the self signed certificate that I created to manage the router through the Advanced Security Device Manager (ASDM) might be incompatible and as I reviewed it I see that it used SHA1 as the Signature algorithm. That should have only caused some issues if I was strictly using the browser to login but since I used the ASDM this was not the case…hmmm.
The problem was simpler than that – it seems that RC4-SHA1 was the only active algorithm being used for Configuration>Device Management>Advanced>SSL Settings on my router. Since the new Java update 1.8.51 no longer supports RC4 (Oracle and the rest of the community consider it to be weak and compromised since it can be brute forced now) you get an error when trying to connect to the ASDM if you are only using RC4. If I could add AES128-SHA1 to the list of algorithms used I would expect it to work but I cannot add it using the asdm (I got an error which is probably why I did not add it previously).
Adding the new algorithms must be done from the command line. Once I added a new cypher I was able to login again on my windows 8 machine after upgrading java. I hope this can help you resolve any issues you might have on other devices after upgrading your java runtime environment. I would encourage you to take this time to verify all of your existing web base https management portals. I suspect that we will all have a great deal of problems connecting to older systems. Its a good time to check if the vendor has a newer firmware that will support the changes (if the devices are still supported) and if not then it might be time to replace those old printers, Telco gateways, etc. Using an older device that only supports RC4 might represent risk to your organization if you have any shared username/passwords on those devices and the are breached.
Hack-in-the-Box alpha testing has begun
Recently we completed construction of the first of our devices that are being designed to help analyse network devices for vulnerabilities. Picture a small computer about the size of a smart phone that will sit quietly on your network and learn about all of the computer devices that are connected.
During its initial phase this device will analyse all of your traffic and identify what some of us don’t even know we have on our wired and wireless networks.
Phase two involves logging into a website to review the devices we have found and identified for you. Once categorized into OS type, function and IP address you can prioritize how to launch any passive scanning. We will monitor activity patterns and check for connections to known malicious sites or dangerous behaviour like scanning, etc.
Phase three involves active scanning which can include vulnerability assessment, break and fix testing and hardware/software analysis. We will assess your security posture as we verify passwords, configuration settings and information leakage. There are also a number of vulnerabilities associated with device firmware on items such as your routers. If you have a very strong control regimen when it comes to all your network devices (this includes routers, printers, wireless devices, smart phones, cameras, IP phones, VOIP providers, etc. then we probably won’t find anything…today. Lets run the test next week, next month when you add the new Cell phone or by the new computer or laptop.
If you are like most of us, keeping up with security is a full time job and most of us already have full time jobs. This is why it is about time that we had a computer that can do it for us.
Something to keep tabs on all of our ‘Internet of Things’ and keep us safe from the hackers on the Internet or next door to us in the coffee shop or the free Hotel/Restaurant WiFi. It’s about time we can be sure of just who gets to see our information by probing our electronics…are you?
Security Analyst - Jeff Soehner CISSP, GXPN,GPYC,GMOB,GCIH 