DevinCook.net

So a while back I wrote about browsing more securely using OpenVPN and just for posterity I suppose I should mention my post about using Tor to browse anonymously. I also wanted to talk about another way to accomplish about the same level of secure-browsingness as that, except it's much simpler to set up. OpenVPN allows you to tunnel all your traffic to another computer somewhere on the internet, over a potentially hostile network. It's great and can be set up so it's super easy to use (or even have it always connect automatically) and that's cool, but it can be a pain to set up. You can also tunnel traffic using the glorious SSH protocol that I'm sure everyone is familiar with (no hard feelings if you aren't, you will be after reading this post).

SSH is awesome, and it has been around for a fairly long time. It's secure and pretty easy to use. Basically you just run ssh user@host and you get a nice remote shell. You can set SSH up so that you can authenticate with keys (generally much more secure than passwords), and it does all kinds of good stuff like keeping track of what key a specific server was using the last time you connected to it (to alert you to potential man-in-the-middle attacks). If you have a server somewhere online with SSH installed on it, however, you may not realize that you can also forward your traffic through it. How sweet is that? It's easy, too. Just run this magical command from a terminal:

ssh -N -D <port> <user>@<host>

The -N flag basically tells it you don't want to start a shell, and the -D option specifies that you want to set up a dynamic proxy. That just means a SOCKS proxy. It will allow you to proxy a whole bunch of different protocols through it. You just have to set up your browser to use it.

I'm currently using Chrome, and apparently it uses your system's proxy settings. This image is of the Debian proxy config GUI. If you're using Firefox, the last time I checked it had an internal proxy configuration that looked pretty similar to this image. Whatever port you specify in your ssh -D command is what you need to put in the "port" box of course.

Once you have both those steps done, you should be able to navigate to your favorite external IP identification site and see the IP address of whatever host you connected to via SSH. Neat.

The same security caveats that I mentioned in the OpenVPN post still apply, so make sure to review those before using it on a truly hostile network or one where you believe you might be monitored. Just replace "VPN" with "SSH".

1 comment

A few weeks ago I saw an interesting post on slashdot about the steps someone had taken to harden their laptop. Upon reading the summary on slashdot I made a mental note to read the article later. I expected to find some parts of his setup insufficient, but it turned out to be pretty comprehensive. There are plenty of hardening guides out there, but this blog entry did a really awesome job explaining the specific attack vectors he was trying to counter including:

• Simple Theft
• Evil Maid
• Coldboot
• DMA Attacks (like via firewire)
• Browser Attacks
• Using untrusted networks

He used some really cool things like TRESOR, OpenVPN, and the OpenPGP card. The only thing I would have done additionally is look into using something like SELinux or AppArmor. Also, all the newer hardware with TPM stuff is really interesting. I'd like to look into that.

Anyway, I just thought it was a good read and wanted to share it.

0 comments

Whew, a lot has happened since I last posted. I got married, honeymooned in Hawaii, took a trip to San Diego for a research project, then went to Las Vegas for defcon. I figured I should do a quick write-up. Defcon was at the Rio this year, and they brought back defcon tv, so we were actually able to watch several talks in the comfort of our hotel room. It worked out really well for those 10 am talks that are hard to get up for. I stayed at the Rio this year (didn't stay at the Riviera last year), and that was a pretty fun experience. I'm glad I did it, but I'm not sure that I'll do it again next year. Anyway, here are the highlights.

The Talks

We saw a pretty good Skytalk to kick things off. It was Pyr0 and Tuna talking about their QR-code PoC. There are two main attack vectors with QR-codes. You can try to attack the software actually doing the QR-code reading (many different pieces of software), or you can embed a link in the QR-code and try to attack the users' web browsers (mostly like two browsers, and we know that they're all full of holes). Some QR-code readers don't even ask if you want to open the link; they just do it. Another interesting tidbit they found was that their highest number of clicks was coming from the codes they put up in bathroom stalls. Heh. They also talked about the various methods of sticking the codes in places (vinyl codes + industrial adhesive ftw), and some about the legality (littering at the worst, not damaging property - although the person who tries to remove it might). Overall the talk was good, and we may try to play with some QR-code stuff in the future in the lab. I've long thought about doing it.

There were a couple good panels, and Aaron Barr (of HBGary Federal) was supposed to be on one of them but had to back out at the last minute due to some legal stuff. There were some good points made about vulnerability metrics in the other panel I saw. There was one douchey guy on that panel, but I don't remember who he was so I guess I can't call him out. He was on the right. He needed to chill out. The chick from Microsoft that was on the panel was actually pretty good. I was impressed.

I missed most of the talk on "bit-squatting" but a friend that works in the lab with me saw it and explained it, and it sounded awesome. Basically, cosmic rays corrupt data all the time. Supposedly it's like the second largest cause of data corruption behind bad hardware. If single bits are flipped in DNS requests, you could end up getting a DNS response for a domain that you didn't request. It's like typo-squatting, but instead of relying on users to screw up while typing the domain, it just happens out of the blue. So basically, once you register a domain that is only one bit different from another domain (say, facebook.com), you start getting some small percentage of their traffic. It's that easy. There are several things you can do to exploit this. You could set up a phishing site and grab their login credentials (account compromise). You could steal their cookies (information leakage, account compromise). You could target an ad server, and serve up your own ads ($$$). Unless the user is using SSL, there would be no visible signs that anything is wrong. Pretty neat, huh? The best hacks are the ones that make you think "It's so simple! Why didn't I think of that?!" That was the same feeling I got after sitting through the hole 196 talk.

I did go to some other talks that were good, but they're all starting to blur together now. I guess I waited too long to do the write-up. I'll try to be better about it next year...

The Parties

Compared to last year, there didn't seem to be as many good parties. I didn't manage to score an invite to anything super exclusive this time around. There wasn't a ninja party due to Barkode's illness. There were a few fun parties, but I definitely saw fewer open bars this time around. That's probably for the best though as I drank too much on Thursday night and ended up paying for it all day Friday and not drinking very much for the rest of the weekend. Most people get better at drinking responsibly as they get older, but apparently I get worse. I'll advise you that while drinking 151 may seem like a great idea at the time, it almost never is. I'm still waiting for that video of hacker karaoke to surface... I DON'T KNOW WHO YOU ARE, BUT I SAW YOU RECORDING. Actually, if anyone does find this video, you should definitely let me know about it because it's probably hilarious. It was the last song of the night and almost everyone in the room was singing Bohemian Rhapsody together.

Of course, I did meet a bunch of awesome people and had some great thought-provoking conversations. Plus I got to hang out with several of the people I met last year as well. All in all, it was a great time, but I guess I was a little spoiled by how amazing last year was.

Antics

I do feel like I have to at least mention how crazy things were staying at the hotel the conference was in. For most of our stay there the hotel phone in our room didn't work. I'm not sure how they were knocked offline but we definitely couldn't place any calls for like 3 or 4 days. I didn't see it myself, but apparently someone figured out that the lights in the conference rooms are controlled wirelessly. There were a few talks that were interrupted by the lights going crazy in the room. I suspect they'll probably be fixing that by next year.

For some reason, there were a bunch of people using the ATMs at the Rio (even people with defcon badges!). I didn't personally see any card skimmers on the ATMs, but I thought everyone knew that it probably wasn't a safe practice. Oh well, watch your bank statements I guess! I'm also pretty sure someone hacked the elevators. They weren't stopping on the way down. If you wanted to go down, you had to hit the up button, and ride to the top first. It was pretty strange, and we waited on them for like 15 minutes after leaving a room party before figuring it out. Awesome.

0 comments