Setting up a private Matrix server.

EDIT - 20200804 - Updated the Nginx stanzas because the newer versions of Certbot do all the work of setting up SSL/TLS support for you, including the most basic Nginx settings.  If you have them there you'll run into trouble unless you delete them or comment them out.  Also, Certbot centralizes all of the appropriate SSL configuration and hardening settings into a single includable file (/etc/letsencrypt/options-ssl-nginx.conf) for ease of maintenance.

A couple of years ago I spent some time trying to set up Matrix, a self-hosted instant messaging and chat system that works a little like Jabber, a …

Read more...

Generating passwords.

A fact of life in the twenty-first century are data breaches - some site or other gets pwned and tends to hundreds of gigabytes of data get stolen.  If you're lucky just the usernames and passwords for the service have been taken; if you're not, credit card and banking information has been exfiltrated.  Good times.

You've probably wondered why stolen passwords are dangerous.  There are a few reasons for this: The first is that people tend to re-use passwords on multiple sites or services.  Coupled with the fact that many online services use e-mail addresses as usernames, this means that all …

Read more...

DefCon 22 presentation notes

Behind the cut are the notes I took during DefCon 22, organized by name of presentation. Where appropriate I've linked to the precis of the talk. I make no guarantee that they make sense to anybody but me.

One Man Shop: Building an Effective Security Program All By Yourself - Medic

  • Integrate with environment
  • Continuous monitoring
  • People and Process -> Secure Network Architecture -> Secure Systems Design -> Continuous Monitoring -> External Validation -> Compliance
  • Compliance, per usual, means dick in the final analysis
  • Roughly five year plan w/ deliverables
  • Needs organizational supprt. Still answers to the Business.
  • Supports, !replaces Business
  • Security will not mature past …
Read more...

DefCon 22: The writeup.

The reason I've been quiet so much lately and letting my constructs handle posting things for me is because I was getting ready to attend DefCon 22, one of the largest hacker cons in the world. It's been quite a few years since I last attended DefCon (the last one was DefCon 9, back in 2001.ev) due to the fact that Vegas is, in point of fact, stupidly expensive and when you get right down to it I need to pay bills more than I need to fly to Las Vegas for most of a week. I'm also in …

Read more...

A random USB port in my hotel room.

When I was in DC a couple of weeks ago, I noticed that the lamps in my hotel room had USB ports in them, presumably for plugging in smart devices to recharge in the event that the traveler did not bring a power strip. Most hotels aren't known for offering a surplus of power outlets.

Seeing as how I was back in Washington, DC, called by some The City of Spies, I couldn't help but wonder how such a thing could be used offensively. Let's say I wanted to gig somebody's smartphone with some canned exploits and a malware package …

Read more...

Another possible solution to an NP-complete problem?

A couple of days ago a research team comprised of faculty at Nanyang Technological University in Singapore, the University of Southampton in the UK, and IQFR-CSIC in Madrid, Spain published a paper containing a creative solution to a problem known to be NP-complete, namely a version of the traveling salesman problem. The TSP, in summary, postulates a scenario in which you have an arbitrary number of towns spread over a large area and an arbitrary number of paths connecting them. What is the shortest possible path one can take in which the traveler visits each town only once and returns …

Read more...

A little forewarning is better than none at all.

Set a Google Alert on the phrase "we take security very seriously" and leaf through it every time you get hits. Often, if a popular website gets compromised, they'll post about it on their blog a couple of days before the e-mail announcement hits your inbox. It may not buy you a lot of time but two days is better than none at all.

You're upset about armed guards in schools?

For those of you who haven't been paying any attention to the news lately (and why should you? it's the holidays.) the president of the National Rifle Association gave a press conference yesterday about what he thought of the recent shootings in Sandy Hook. Predictably, half the Internet blew its buffers and the petitions and sarcastic remarks are flying like paper airplanes when the teacher's back is turned. Once, common sense was the first casualty of tragedy; in recent years common sense ran out of regenerations and was given a viking funeral (video contains spoilers for new season number six …

Read more...