EDIT: Crisis averted! The problem was with the modem and not the devices connecting to it. I'm not sure why the first person I called at the ISP couldn't help me. In reality, the second person I called also didn't help, but something magically started working after talking with them a second time and rebooting the modem about 5 more times, so it turns out I don't need a new WiFi router at this time. That said, I will take these suggestions to heart, as I may be buying one anyway as a backup for when this inevitably happens again.

TL;DR: I probably need a new wifi router and want one that isn't malware and will work even if the company I bought it from goes under or stops making it.

Long version:
So today my wifi stopped working. I use an Apple Airport Extreme (the tower one that has a Time Machine backup in it). I've had it for 5 or 10 years and it's worked fine during that time, other than replacing the hard drive it backs up to. My spouse and I were sitting on the couch after lunch surfing the web on our phones, when we suddenly couldn't reach anything. The router itself appears fine. We can connect to it and see other devices that are connected to it, but for some reason, it's no longer communicating with the cable modem via the WAN port. It still backs up the computers in our house, though. I have tested the cable that was connecting it to the cable modem, and it appears fine. I can connect my computer directly to the cable modem without issue using the same cable. So my guess is that the WAN port is hosed.

However, I'm suspicious that something else is going on for 2 reasons. #1, the cable company (Spectrum) made me replace my cable modem last week. I did that, got my Airport connected to it, and after a call to tech support got it up and running. It's been working for the past week. I suspect the modem may have updated or changed configuration without me knowing it and that's the real cause here. They sent me a Wifi router with the modem, but will charge me $5.00/month if I keep it. I'd rather own the hardware. #2, I have an older Airport Express that was working the last time I used it. I replaced it with the newer model about 5 years ago so I could do backups. It fails to work in the same way. It seems like the WAN port isn't communicating with the cable modem. So, if there's some way to verify that the WAN ports on my Airports are or aren't working, I'd be interested to hear about it.

I am able to connect a wired ethernet switch to the cable modem and all devices on the switch can see the Internet just fine. I tried connecting both Airports to the switch via their WAN ports while the switch was connected to the cable modem, but that did not work. (Or at least, I couldn't connect to the internet via either Airport.)

So, on the off-chance that both my Airports have a similar failure, I need to replace them. I have gotten suggestions from others, but have been pretty unhappy with them. I have the following requirements:

• Absolutely must not store any information about me in the cloud (for example as Ubiquiti apparently does)
• Absolutely must not rely on any sort of connection to the manufacturer to work properly and must not phone home without my permission
• Preferably not a poorly made device that will die in 3 years
• Must work properly and at full speed with Apple devices
• Must not require a phone app to configure
• Must have ~3 ethernet ports so I can hardwire in my TV devices (AppleTV, TiVo, etc.)

Things I don't need, but aren't a deal-breaker if it has it:

• The ability to configure every little setting. I prefer to set it and forget it.
• Mesh networking. My house is not huge, the cable modem is in the middle of the house and my single Airport base station has good coverage of the entire house.

If you know of any device like this, please share!

Friday Security Briefing

Hello there! I hope you're all looking forward to something this weekend. Today's briefing will cover a captivating tale of scheming against financial centers, woes of virtual networking, and the possibility of Russia behaving quite unnecessarily.

"Listen, or your tongue will make you deaf." ~ Unattributed proverb

Wall Street targeted by new Capital Call investment email scammers

The tactic of exploiting enterprise email systems remains a successful and active attack vector for bad actors. The emerging development is the use of "capital call" style scam, wherein scammers pretend to have investor or insurance business with the business.

"In an example shared by the researchers, the scam email attached a Capital Call Notice for US $970,357.00 to be deposited into a bank account under the fraudsters’ control."

"If the targeted investor was duped into wiring the funds, then it is likely that money would be quickly moved into other accounts and withdrawn by mules to prevent the payment from being returned to the victim."

The flexibility that cryptocurrencies provide to discreetly rearrange money may actually be disadvantageous for banks in certain situations.

Source: Tripwire, Wall Street targeted by new Capital Call investment email scammers

High severity Linux network security holes found, fixed

(CVE-2021-26708) Alexander Popov of London has discovered five security holes in the Linux kernel's virtual socket implementation. This is concerning, my personal use of virtual networking systems could be a lot more thought out. I do tend to keep my use of libvirt to a minimum but ideally I would be running my virtualization workstation on a separate box optimized for safe practices.

"These holes entered Linux when virtual socket multi-transport support was added. This networking transport facilitates communication between virtual machines (VM) and their host. It's commonly used by guest agents and hypervisor services that need a communications channel that is independent of the VM network configuration. As such, people who are running VMs on the cloud, which is pretty much everyone these days, are especially vulnerable."

Source: ZDNet, High severity Linux network security holes found, fixed

Ukraine: DDoS attacks on govt sites originated from Russia

Ukraine is proposing that information on the threat actors responsible for a DDoS on Ukrainian government websites originated from Russian domains.

However, they did not claim that the threat actors were affiliated with the Russian state.

I am curious about the motivations if this was sanctioned by Russia. Are they testing their capabilities against a softer target in order to learn from the European and American Cyber-Defense response? Perhaps this was a way for Russia to demonstrate it's competency at cyber warfare.

"The National Coordination Center for Cybersecurity (NCCC) at the NSDC states that these DDoS attacks have been massive and have targeted government websites in the defense and security sector."

Possible retaliation?

"Last week, news leaked that Ukrainian law enforcement, in cooperation with the US and French police, arrested alleged Egregor ransomware operation members.

Three days later, the Security Service of Ukraine (SBU) issued a press release about the Egregor arrests and seizing the ransomware group's equipment."

Source: Bleeping Computer, Ukraine: DDoS attacks on govt sites originated from Russia

I'm running out of time to finish the spend requirements on a credit card promotion. I was planning on buying a VR headset, but I realized there was something that would actually be much more useful; a new router.

The market for consumer routers has been really strange; We are on the sixth generation, yet it's super common for consumer routers to be two or three generations behind, especially the less expensive ones. So much of the stuff on the market only goes up to 802.11n, and half of the time the firmware they include is halfway broken or is missing important features.

So I'm looking for a router that is relatively future-proof. I want Wifi 6. I want something that won't be interrupted by the microwave. Open source firmware would be excellent, but not a requirement. I don't need mesh networking; my house is not that big. I do want it to be relatively inexpensive; I'd consider $300 to be a hard limit unless someone has a persuasive arguement to justify the cost.

I would also prefer to avoid Netgear. I have no idea how they stay in business with the mountains of problems I have had with their products and their horrible support. The last time I owned a Netgear product, I was forced to give them my email address to download the driver and they illegally added it to their marketing mailing list without my permission. I don't do business with people who betray me.

I have interactive firewalls like OpenSnitch running on most of my desktop OS's. I like to see what is going on with my machines' network connections to learn about networking, infosec, and to have have some peace of mind.

Example workflow:

1. Get a firewall notification of a new incoming connection to some process running on my machine
2. If no DNS entry exists and only the IP address is provided, then I google the IP
3. I find something like https://ipinfo.io/74.125.20.189
4. I make a decision as to whether allow/deny based on the ownership info which I found in step 3.

Aside from trusting the particular site presenting the ownership info, how reliable is this information regarding IP ownership?

For example, if an IP came back as "Google" could it really be a GCP instance running a command and control server?

Another example, I know that large corps own big blocks of IPv4, but they must lease these IP's out to whomever, right? I imagine there is some wild-west market for these with little accountability?

Are either of these scenarios realistic? If so, is my entire workflow for "do I trust this IP" pointless?

I'm sharing in case some of you are having a similar issue at work or at home, and to hear your opinion and/or similar stories!

I've been using Ubiquiti access points in my home for a few years now, and overall, they've worked very well. 3 APs giving near perfect 5GHz VHT80 coverage on DFS channels. LAN transfers are about 600-650mbit on laptops, which has proven to be plenty for wireless clients in my home. Keep in mind that this is a pretty basic setup... besides the APs, there's just the ISP provided GPON ONT which is also a typical all-in-one ISP solution (router, switch, AP, firewall, DHCP server...) with it's Wi-Fi turned off.

As I said, I was pretty happy with the results, however there was one feature that I could never get to work just right; roaming. You could be walking around the house watching a live stream and the stream would pause for 5-8 seconds until the roaming transition was over. Strangely, with VoIP calls, roaming would be about 3-5 seconds. Even enabling fast roaming features (which I believe is simply 802.11r) on the AP's controller would not give the results I was looking for. After days of tweaking TX power settings, channel selection and trying to implement Minimum RSSI (which I ended up not using), I finally gave up and resigned myself to the 4-6 seconds (oh, the humanity) of roaming time.

Fast forward to about two months ago and I added a new router to the setup (UBNT ER-4) and a switch (UBNT USW-24). Setup went smooth, already had some cat.6 cabling around the house, now it was time to actually use it. Had some fun setting up a guest Wi-Fi network on it's own VLAN, which was always a concern of mine; having "untrusted" devices connect to my network. The access points do client isolation on guest networks by default, but in my mind it wasn't enough as I have some file servers and time machines on the network.

Anyways, a few days after doing the setup I'm walking around the house with a livestream on my mobile and suddenly realize that it's not losing the connection. I try with a VoIP call and it worked flawlessly. I start walking around faster and still, the phone is roaming without an issue. I was very excited!

I'm thinking it must be the router that somehow solved the roaming issue. My first theory was that the DHCP server on the ER-4 was doing it's thing much faster than the ISP's device, allowing the wireless clients to actually roam faster. So I do a web search and I find some very relevant info. It was a thread on a forum and reddit thread with a sysadmin that was about to give up on the APs because of roaming issues. In both threads, there were replies about what switch were they using.

Apparently, some switches (Cisco and HP were mentioned), have a "MAC aging" interval setting which is way too high by default, or they simply have bugged firmware that doesn't allow the switch to "re-learn" the MAC address of a device on a different switch port. I assume that ISP provided "el-cheapo" gear has similar issues.

So, if you're having roaming issues with your wireless clients, check your switches!!!

Anyways, just wanted to share this story. Thank you for reading. :-)

For my particular use case I share my home PC with my spouse and since I'm the more tech-savvy of the two I'll need to occasionally remote in and help out with some random task. They know enough that the issue will usually be too complex to simply guide over the phone, so remote control it is.

I'm also trying to improve my personal efforts toward privacy and security. To that end I want to avoid closed-source services such as TeamViewer where a breach on their end could compromise my system.

The following is the current state of what I'm now using as I think others may benefit from this as well:

Setup

Web

I use a simple web form as my first authentication. It's just a username and password, but it does require a web host that supports server side code such as PHP. In my case I just created a blank page with nothing other than the form and when successful the page generates a 6 digit PIN and saves it to a text file in a private folder (so no one can simply navigate to it and get the PIN).

I went the text file route because my current hosting plan only allows 1 database and I didn't want to add yet another random table just for this 1 value.

Router

To connect to my home PC I needed to forward a port from my router. I'm going to use VNC as it lets me see what is currently shown on the monitor and work with someone already there so I forward port 5900 as VNC's default port. You can customize this if you want. Some routers allow you to SSH into their system and make changes that way so a step more secure would be to leave the port forward disabled and only enable it once a successful login from the web form is disabled. In my case I'll just leave the port forwarded all the time.

IP Address

To connect to my computer I need to know it's external IP address and for this I use FreeDNS from Afraid.org. My router has dynamic DNS support for them already included so it was easy to plug in my details to generate a URL which will always point to my home PC (well, as long as my router properly sends them my latest IP address). If your router doesn't support the dynamic DNS you choose many also allow either a download or the settings you would need to script your own to keep your IP address up to date with their service.

Signal

Signal is an end-to-end encrypted messenger which supports text, media, phone and video calls. There's also a nifty command line option on Github called Signal-cli which I'm using to provide my second form of authentication. I just downloaded the package, moved to my $PATH (in my case /usr/local/bin) and set it up as described on their README. In my case I have both a normal cell phone number and another number provided by Google Voice. I already use my normal cell phone number with Signal so for this project I used Signal-cli to register a new account using my Google Voice number.

VNC

My home PC runs Ubuntu 18.04 so I'm using x11vnc as my VNC server. Since I'm leaving my port forwarded all the time I most certainly do NOT want to leave VNC also running. That's too large a security risk for me. Instead I've written a short bash script that first checks the web form using curl and https (so it's encrypted) with its own login information to check if any PIN numbers have been saved. If a PIN is found the web server sends that back and then deletes the PIN text file. Meanwhile the bash script uses the PIN to start a VNC session with that PIN as the password and also sends my normal cell the PIN via Signal-cli so that I can login.

I have this script set to run every minute so I'm not waiting long after web login and I also have the x11vnc session set to timeout after a minute so I can quickly connect again should I mess something up. It's also important that x11vnc is set to auto exit after closing the session so that it's not left up for an attacker to attempt to abuse.

System Flow

Once everything is setup and working this is what it's like for me to connect to my home PC:

1. Browse to my web form and login
2. Close web form and wait for Signal message
3. Launch VNC client
4. Connect via dynamic DNS address (saved to VNC client)
5. Enter PIN code
6. Close VNC when done

Code

Here's some snippets to help get you started

PHP for Web Form Processing

<?php
// Variables
$username = 'your_username';
$password = 'your_password_super_long_and_unique';
$filename = 'path_to_private_folder/vnc/pin.txt';

// Process the login form
if($action == 'Login'){
	$file = fopen($filename,'w');
	$passwd = rand(100000,999999);
	fwrite($file,$passwd);
	fclose($file);
	exit('Success');
}

// Process the bash script
if($action == 'bash'){
	if(file_exists($filename)){
		$file = fopen($filename,'r');
		$passwd = fread($file,filesize($filename));
		fclose($filename);
		unlink($filename);
		exit($passwd);
	} else {
		exit('No_PIN');
	}
}
?>

Bash for x11vnc and Signal-cli

# See if x11vnc access has been requested
status=$(curl -s -d "u=your_username&p=your_password_super_long_and_unique&a=bash" https://vnc_web_form.com)

# Exit if nothing has been requested
if [ "$status" = "No_PIN" ]; then
  # No PIN so exit; log the event if you want
  exit 0
fi

# Strip non-numeric characters
num="${status//[!0-9]/}"

# See if they still match (prevent error messages from triggering stuff)
if [ $status != $num ]; then
  # They don't match so probably not a PIN - exit; log it if you want
  exit 1
fi

# Validate pin number
num=$((num + 0))
if [ $num -lt 100000 ]; then
  # PIN wasn't 6 digits so something weird is going on - exit; log it if you want
  exit 1
fi
if [ $num -gt 999999 ]; then
  # Same as before
  exit 1
fi

# Everything is good; start up x11vnc
# Log event if you want

# Get the current IP address - while dynamic DNS is in place this serves as a backup
ip=$(dig +short +timeout=5 myip.opendns.com @resolver1.opendns.com)

# Send IP and password via Signal
# Note that phone number includes country code
# My bash is running as root so I run the command as my local user where I had registered Signal-cli
su -c "signal-cli -u +google_voice_number send -m '$num for $ip' +normal_cell_number" s3rvant

# Status was requested and variable is now the password
# this provides a 1 minute window to connect with 1-time password to control main display
# again run as local user
su -c "x11vnc -timeout 60 -display :0 -passwd $num" s3rvant

Final Thoughts

There are more secure ways to handle this. Some routers support VPN for the connect along with device certificates which are much stronger than a 6 digit PIN code. Dynamically opening and closing the router port as part of the bash script would also be a nice touch. For me this is enough security and is plenty convenient enough to quickly offer tech support (or nab some bash code for articles like this) on the fly.

I'm pretty happy with how Signal-cli has worked out and plan to use it again with my next project (home automation). I'll be sure to post again once I get that ball rolling.

One of the people in an IRC channel I frequent pointed out a site I've been building uses CDNs that are IPv4 only. I never realized this, I just assumed every major provider had deployed IPv6. Oh, how very wrong I was. A quick check of some major (to me) sites shows a shocking lack of IPv6, including:

• Bootstrap (stackpath.bootstrapcdn.com)
• Discord
• FontAwesome (use.fontawesome.com)
• GitHub/GitHub pages
• GitLab/GitLab pages (self-hosted supports IPv6, but officially hosted GitLab only supports IPv4 due to Azure limitations)
• jQuery, IF you use code.jquery.com (some tutorials use ajax.googleapis.com, which does have IPv6, but an unfortunate amount use code.jquery.com, including the getting started page for Bootstrap)
• Parts of Amazon/AWS (Amazon is IPv4 only, some of AWS is IPv4 only, including S3)
• Reddit
• Stack Overflow/Exchange/etc
• Twitter

An honorable mention goes to Angular's websites because the websites themselves are IPv4 only but the libraries are hosted on ajax.googleapis.com, which is IPv6 accessible. I checked npm, PyPI, RubyGems, and Tildes, and they all support IPv6.

I can understand why companies like Amazon have partial support (upgrading can be a PITA if you're a cloud service provider with uptime requirements), but then you have services like Discord (launched in 2015 with no obligation to maintain service) that only support IPv4. At the very least, I'd expect CDNs referenced by thousands (if not millions) of webpages to be on IPv6 by now.

Am I missing something? CDNs are pretty static, it's just a matter of choosing one that supports IPv6, you don't even need to update your application if you just change the DNS entries.

I've been wondering about this for a while whenever I'm on a metered connection or a capped one.

It'd be cool if I could use my vps to help save data in exchange for latency. Having it download and compress any compressible materials before serving them would be a godsend, but it sounds very edge case-y given how places like youtube deliver videos in bite size peices

Does something like this sound at all possible, or should I just assume it's too niché and look for other data saving ways?

Trying to get a sense on how the networking would go down?

If I had one public IP address and say 4 Docker containers on the host, how would the SSH connections work? Would I have to reserve ports for each container?