Github and updating its ssh keys

Today I learned that the Microsoft-owned Github decided to update its RSA SSH host host key but did not explain its reasoning. Why would it go through all of this trouble? Usually when a company does that, it is their way to cover that they were hacked or were compromised in some other way. That is not what is written in their blog, so we will have to wait for this to unfold.

"What does that mean to companies and developers depending on that?" Well,

• If you created a SSH RSA keypair to authenticate against github -- so you can git push and git pull your repos without entering your password -- you probably wants to consider creating a new pair, deleting the old one, and using the new one. Ideally, this may also be an excuse to switch to an ECDSA-derived key such as ed25519 if you are able to. Sometimes this is hard because you may be dealing with a host that does not support that... not that have ever happened to me.
• If you have received the github RSA pub host key, which was added to your .ssh/known_hosts (if you are using Linux, OSX, and some UNIX variation) file, you will need to delete that entry and get github feed you a new one. Of course, you want to ensure you are getting the proper github key, not one from someone impersonating it.
• If you use Windows, well, let me get back at you on that later.

Now some developers will argue that relying on known_hosts has caused more failures of working software than preventing faked host access since SSH was originally written. Their proposed way to deal with that is to tell ssh not to check the validity of the host key. In Linux, OSX, and other UNIX versions that would mean to disable that in ~/.ssh/config. If you want to disable the Key checking to all ssh connections, you could do something like (the boldface lines are the most important parameters)

    Host *
           UserKnownHostsFile /dev/null
           StrictHostKeyChecking no
           LogLevel error

While I understand that the above is a clever way of stopping suck pesky keys from hampering your style, disabling security for the sake of convenience is never a good solution. The more time-consuming solution is to remove the offending keys in ~/.ssh/known_hosts so you can ensure you are getting the right key, not a key impersonating the site you want to connect to, which in this case is github.

Fun fact: given that I saw the following message, I think they are not only changing the RSA key:

Warning: the ECDSA host key for 'github.com' differs 
from the key for the IP address '140.82.121.3'

Splitting Kali VM's partitions, or why I do not like the default (Desktop) Linux partitioning scheme

WARNING:

1. Just because I am mentioning Debian/Ubuntu Linux in my rant, it does not mean the RedHat-derived distros are guilty free. In fact, I am looking at you, Fedora. The reason I am mentioning the Debian-derived distros are because
   • Kali is built on Debian.
   • I usually run an ubuntu derivative desktop Linux in my laptop.
   The principle of my rant still remains, and is really not as security- or privacy-oriented as the other blog posts.

2. This post will be a bit more technical than the usual, and will not take the time to explain certain things or this will become a book. There are other shows to watch.

Like many, I have Kali Linux installed in a virtual machine I use for things. Given the requirements in their install page, which said

On the higher end, if you opt to install the default Xfce4 desktop and the kali-linux-default metapackage, you should really aim for at least 2 GB of RAM and 20 GB of disk space.

I thought it was fine building a vm following those specs to run Kali. The memory I was not that concerned because adding more to a KVM vm guest is pretty easy (provided you have some to spare). But we are not talking about how to build a Kali vm guest; there are a lot of blogs and websites claiming to provide "everything you need to know about" how to do the deed, where the everything keyword means "we will rush through it but pretend we are experts." Am I being an arrogant bastard? Quite possibly, so let's jump to an example.

The problem

I am kinda of particular about the partition layout I use. In fact, let's take a quick look at my desktop (where I am typing this right now):

Device       Start       End   Sectors  Size Type
/dev/sda1     2048   2099199   2097152    1G Linux filesystem
/dev/sda2  2099200   3147775   1048576  512M EFI System
/dev/sda3  3147776 212862975 209715200  100G Linux LVM

Those whith sharp eye noticed I have made the partition for that FAT offspring, EFI, which is way larger than needed. Call me lazy. What you may not be aware is that this is a 1TB (in Subway sandwich math; it really is 931.53 (GiB) if we use powers of 2 just like C'Thulu intended us to do) drive. In other words, I did not create a partition that ranges the entire disk as I found to be the default in most Linux installations, specially desktops. You know, because everyone installs the OS such that to use the entire drive. Who would do anything else?

Next you will notice there are 3 partitions:

• /dev/sda1, which is the /boot
• /dev/sda2, which is the already-mentioned EFI
• /dev/sda3, which is a LVM physical volume for everything else.

I like this format since it works for both MBR and GPT styles of partition tables: I can have 3 "primary" partitions in the older MBR style without breaking a sweat. Consistency is good. Now we can talk about the partition for everything else: since it is a lvm physical volume, I then split it up into separate partitions and assign them to some directories, namely (vg name changed to protect the innocent. However, I chose not to sanitize the name of the swap partition before posting it here)

LV       VG     Attr       LSize  Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
home     desktop -wi-ao---- 30.00g                                                    
root     desktop -wi-ao----  4.00g                                                    
swaphole desktop -wi-ao---- 10.00g                                                    
usr      desktop -wi-ao---- 11.00g                                                    
var      desktop -wi-ao----  6.00g

At this point in time someone on the back of the room will shout "Heresy! Separating partitions in their own filesystems is an outdated concept! You should use a single partition! On the top of that you are not using the entire volume group!" Hey, I said I was an arrogant bastard earlier on. Besides, this is my computer. Fear not, for the next paragraphs will justify the heresy claim even better.

For my kali vm guest, I started with a 20GB virtual disk based on the installation page's notes as mentioned above. At the time I decided to let it set the partition table the way it wanted, and here it is

Device     Boot    Start      End  Sectors  Size Id Type
/dev/vda1  *        2048 39942143 39940096   19G 83 Linux
/dev/vda2       39944190 41940991  1996802  975M  5 Extended
/dev/vda5       39944192 41940991  1996800  975M 82 Linux swap / Solaris

It created two primary partitions: one for the OS and one that is there just to create an extended partition to put the swap. Riddle me this: why in a 2-partition drive do we need to use the MBT extended partition? Are we close to running out of partitions that we need to reach for that gimmick? Before you answer, remember my 3-partition layout works fine with that style of partition table. Bottom line is the default installation created two partitions to do the job of a single way. Brilliant!

Let's get to where the fun really is: realistically 20GB for Kali is very limiting at best. If you start colleting a few (sizeable) pcaps or grab a binary file or two to inspect (temp files do add up), you may have maxed it out. That happened to me, combined with forgetting to periodically clean the package cache and getting some bits and bobs for metasploit. And all of this happened when I was on the clock.

Brilliant!

If we use the partition layout I like, I would then resize the drive and extend the PV and then the VG. problem solved. Not so here, thanks to that extended partition that is sitting right in the way. The best I could do was to increase the size of the drive as before, then add another partition at its end:

Device     Boot    Start      End  Sectors  Size Id Type
/dev/vda1  *        2048 39942143 39940096   19G 83 Linux
/dev/vda2       39944190 41940991  1996802  975M  5 Extended
/dev/vda3       41940992 62914559 20973568   10G 83 Linux
/dev/vda5       39944192 41940991  1996800  975M 82 Linux swap / Solaris

Since I did not use lvm on this setup, I would have to decide which directory to move to the new partition, which then leads us to the problem the default install wanted to avoid in the first place. And, we now have a drive whose partition table looks convoluted (the adjective I had in my mind was different, but I decided to find a more polite one) and hard to maintain. At this point the only logical thing to do is blow everything up and redo it with a larger disk.

Brilliant!

And this kind of shenaningans are not only limited to the Kali install; installing the OS in my latop has been even more frustrating, but I will save that to another post.

Is there a better way to solve this problem? Well, it requires some heretic maneuvers, which is why I like it.

The solution

By now we should accept we need to move at least one directory tree out of /dev/vda1 I decree it shall be /home, but where should we put it? I will not extend /dev/vda and add another partition there, so what if we create a second virtual drive? Some of the reasons:

• It moves a directory tree that can become quite large out of the root drive.
• Even if you did not use a LVM, which in this case I did not, you can still resize that drive and that partition, without much work.
• If you need to move files between your kali vm guest and the host, you can shoot the vm down and then mount this second disk. This way there is no programs -- malicious or not -- running in the vm gues and you do not need to create a (exploitable) network connection between the host and guest.
• If you decide to blow up you kali install, your work is preserved.
• You can handle /home to somebody else without worrying about compromising your kali passwords.

Enough talk. Here are the steps. I will try to make them as generic as I can but understand most of the time I not only use KVM but also do it from the command line, and on a Linux box. So, if you are doing this from a Mac or a Windows computer, the commands will differ from mine. I am also rushing through the permissions since I assume you know how to set them up so your disk image can be read by your vm. You have been warned.

1. Shut the vm guest down. Yes, I know how to add a drive to a running vm -- I do that all the time when I have to do forensics -- but it is much easier and safer if you do not need to upset the virtual machine.
2. Create the virtual drive you will use for /home. How big? Up to you. The one I created for my kali vm is 20GB (as close to real disk size units as I can). Remember to put it in a sane location, be it inside the directory where the other vm files are, a place such as /home/user/.local/share/libvirt/images/, or some other secure place. For this example I am using /export/vm.

   user@vmhost:~# VMNAME=kalinuts
   user@vmhost:~# qemu-img create -f qcow2 /export/vm/${VMNAME}.qcow2 20G
   Formatting '/export/vm/kalinuts.qcow2', fmt=qcow2 cluster_size=65536 
   extended_l2=off compression_type=zlib size=21474836480 lazy_refcounts=off 
   refcount_bits=16
   user@vmhost:~# 

   Most people will use qcow2 in KVM because its a sparse disk image (most may not be aware of that) and it is the default (duh!). If you use VirtualBox or VMWare or whatever, chances are the default disk format (vdi) will work fine; check if it can be resized to be sure. If not, find the virtual disk type that can.

   Remember we said it is a sparse disk image? Here is proof:

   user@vmhost:~# ls -lh /export/vm/kalinuts.qcow2 
   -rw-r--r-- 1 user user 193K Mar  2 09:51 /export/vm/kalinuts.qcow2
   user@vmhost:~# 

3. Format the drive. Note that I did not say partition it.

   user@vmhost:~# mkfs.ext4 /export/vm/kalinuts.qcow2 
   mke2fs 1.46.2 (28-Feb-2021)
   
   Filesystem too small for a journal
   Discarding device blocks: done                            
   Creating filesystem with 192 1k blocks and 24 inodes
   
   Allocating group tables: done                            
   Writing inode tables: done                            
   Writing superblocks and filesystem accounting information: done
   
   user@vmhost:~# 

4. Not needed step: I mounted it just to show I can mount the drive from the vm host side, since this is one of the claims I made ealier on.

   root@vmhost:~# mount /export/vm/kalinuts.qcow2 /mnt
   root@vmhost:~# df -h|grep /mnt
   /dev/loop0                            183K   14K  157K   9% /mnt
   root@vmhost:~# ls /mnt
   lost+found
   root@vmhost:~# 

   Don't forget to unmount it before going to the next step.

5. Now add the drive to your kali/whatever vm. If you have a GUI, click on things. For KVM, there is also a GUI and some command line ways. The bottom line is that you want something like this in your devices session (adjust path and target device names to fit your local setup):

   <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2' iommu='on'/>
      <source file='/export/vm/kalinuts.qcow2'/>
      <target dev='vdb' bus='virtio'/>
   </disk>

   When you save the config file, it will autofill the rest of the info such as where in the kali vm pci chain this disk will reside.

6. Boot the kali vm and verify it can see the drive. I use dmesg or either fdisk -l or parted -l to see if it was mounted.
7. While in the kali vm, become root user so you stop messing with /home
8. Mount the new drive somewhere such as /mnt
9. Move the contents from /home to /mnt. Remember: if this does not work you still have the files so you can move them back. Also, we are doing all this work to move all the junk in /home off the boot disk.
10. Unmont the new drive from /mnt and configure the /etc/fstab so it will mount on /home (bolt line in the /etc/fstab file shown below)

    # /etc/fstab: static file system information.
    #
    # Use 'blkid' to print the universally unique identifier for a
    # device; this may be used with UUID= as a more robust way to name devices
    # that works even if disks are added and removed. See fstab(5).
    #
    # systemd generates mount units based on this file, see systemd.mount(5).
    # Please run 'systemctl daemon-reload' after making changes here.
    #
    #                
    # / was on /dev/vda1 during installation
    UUID=iisaw-something-under-my-armpit /               ext4    errors=remount-ro 0       1
    # swap was on /dev/vda5 during installation
    UUID=do-you-like-vogon-poetry none            swap    sw              0       0
    /dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
    /dev/vdb        /home           ext4    defaults        0       2
    

11. Reboot it and verify it is using the new drive. If not, correct the issue.
12. Get a cold beer.

What about resizing the drive?

1. Shut the vm down again.
2. Resize the drive, maybe adding another 10G

   qemu-img resize /export/vm/kalinuts.qcow2 +10G

3. Boot the vm.
4. From inside the vm, resize the partition. Since I used ext4, I can do

   resize2fs /dev/vdb

5. Enjoy the larger /home.

Fun fact: I normally use raw drives, but most of the steps are the same; I just need to have a different <drive></drive> definition.

Rehoming some phishes

Quick notice: I will be moving my phishing posts to a new location, phishphillet.com. In fact, if you go there you will find some of the old posts I had here and a few new ones; it is a work in progress!

Officially the reasons are

• It is (hopefully) easier to find my phishing posts; they are all in their own domain.
• People looking for phishing adventures will not have to wade through the other blog posts.
• I can then ask for people to send me their phishing emails. This is very important since phishers do not seem to like me.

Now the main reason is because I am considering moving this very blog to another location and am trying not only hosting options out but also software. Testing things is nice, but "testing" as a production environment can show weanesses I was not aware of.

I will document and post later the (mis)adventures on setting that up in case it may be useful to others. For now on, if you want some phishing, go to phishphillet.com.

Help the Diana Initiative

We interrupt our normal shenanigans for a serious post. For those who have not heard of them, first of all do not confuse it with NATO's Defence Innovation Accelerator for the North Atlantic (DIANA), which was created (and appropriated the name) in 2021. The Real Diana Initiative is a 501(c)(3) non-profit organization was founded in 2016 and runs a security conference focused on women, diversity, and inclusion in Las Vegas (for reference, DEFCON 31 takes place on Aug 10-13 2023, BSidesLV 8-9 2023, and the Diana Initiative on August 7, 2023). So, if you play your cards right you will have a full week of nothing but security and privacy talks!

Here are some videos from last year's conference:

And now the bad news, which with your help can become but an example of the community rising to the occasion: recently all the gear they use in their event was stolen including their Weller soldering irons which are used in their workshops, and now they need help. If you can donate gear, little pieces of green paper, or become a sponsor, do contact them either through their website or Twitter account. They are already considering canning their CTF; let's see if that is that is the worst thing they will have to sacrifice.

Reason I am making this post is to ask those who read my blog to see if they can help in any way. If you can, thank you! If you cannot, just pass the word to others.

Fired from your IT/Security job? Come to the dark web! We have cookies.

Your boss just asked you for a meeting. You walk into his office and realize HR is sitting there too; this is The Meeting. The company you have been working at needs to improve its quarter earnings, and you have just joined the thousands of unemployed IT and Security/Privacy professionals. I personally know people in that group. What to do? You have to find something else and quick: you have bills to pay and need to put food on your family's table. You will look anywhere for a job.

What about the dark web?

You would not be the first or the last. The truth is APT groups also need staff like any other business. The image of the lone hacker with no social skills and skin problems sitting on a dark room wearing a hoodie while being illumintated only by the glow of the laptop screen belongs to Hollyweird. ChatGPT notwithstanding, good malware does not write itself. Someone needs to be by the phone on the better phishing campaigns. Large scale attacks need monitoring, and attack servers do need to be patched. According to Kapersky, developers are in high demand in the dark web, and that has been the trend since COVID lockdowns:

How safe are such jobs? Like everyone else, it depends. Some are scams, others are worse than that (think being kidnapped in the middle of the night either by your new employees or the FBI/NSA/Girl Scouts). After all, many of these jobs are sketchy at best; they legality depends on which nation is sponsoring the operation and which on the receiving end. But, there are organizations who treat this as a business, so they have a vested interested in having happy and productive employees who are eager to improve their software and services to levels they never thought possible. Some developers adn attack specialists are being offered $20K a month for their services; that is FAANG salary right there.

What about the company that fired you? Maybe after passing bonuses around for cuting costs, they bought the amazing cybersecurity software I mentioned in an earlier post to replace their staff. What could possibly go wrong?

The Amazing Cybersecurity Tool That Will Make You 10 Years Younger!

If you expect this post to be intelligent or thought-provoking, you may want to skip it.

Have you shopped around for some kind of tool to monitor your traffic and/or logs, adjust your firewall in response to an event such as good old exfiltration, or ensure your security and privacy policies are up to date? Or you just go to a trade show booth and ask a few questions. And you then make the mistake to leave your contact info, which then leads to and endless river emails and calls and brochures saying how their amazing product will drop ransomware dead, eliminate any and all phishing emails, patch your ssh to a release that is 2 years in the future, and all of that while shrinking the ozone layer and bringing the dodo bird back to life? Well, I decided it was time to make my own.

Ok, the software who features my code announces is vapourware, thankfully. But I thought it was time to have fun with the algamation of buzzwords salesreps call product descriptions. With my amazing tool you too can spew garbage like "Our disruptive tool implements a passwordless methodology enabling you to amplify the positive impact of the ROI of your verticals by using our continuous monitoring interface," which I do not know whether it promises things it does not deliver (vapurware?) because, to be quite honest, I do not think it really means anything. But, it sure sounds impressive for a someone of a business lean. So, if you need a laugh, give it a try. Or contribute with more buzzwords.

Repo link: https://github.com/raubvogel/cyberSecurityTool

Incidentally, this is related to a proper post I am trying to finish.

TransUnion data breaches, GDPR, CCPA, BIPA, and Ramirez

TransUnion LLC, one of the three major credit reporting companies in the United States, also has branches in every continent but Antartica. It is said that just in the U.S. the personal information and credit histories of some 200 million consumers is stored in their servers; I have not been able to find veritable information regarding consumers located outside the US.

Some of you may remember that TransUnion recently suffered a data breach (I will be using the GDPR definition of personal data breach which is "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed").

"How recently," comes the voice from the back of the room, "which one are you talking about?"

Good question; it is hard to keep track of them. Let's go over a few of them and later see what we can learn from them.

The Events

1. In 2005 -- a long time ago (in dog years) -- TransUnion lost a laptop containing personal data from more than 3600 US consumers. The Chicago-based company offered up to one year of free credit reports to the affected customers. At the time -- one must remember these were pre GDPR/CCPA/BIPA times -- some of the main questions raised were
   • Were credentials to access the TransUnion databases and other systems also exposed?
   • TransUnion chose to report the data breach. At the time there was no real requirement to do so: the California Senate Bill 1386 of 2002, one of the first security breach notification laws, specified a criteria corporations should use to determine whether they were required to report the incident: if they answered "yes" to every single one of the following questions, they must report the breach:
     1. Does their data include "personal information" as defined by the statute?
     2. Does that "personal information" relate to a California resident?
     3. Was the "personal information" unencrypted?
     4. Was there a "breach of the security" of the data as defined by the statute?
     5. Was the "personal information" acquired, or is reasonably believed to have been acquired, by an unauthorized person?
     The late Alan Paller, director of the SANS Institute at the time, warned this test provided a legal loophole for companies not to report data breaches since all 5 conditions have to be satisfied before a report is required.

   So TransUnion is very popular this month, this time in due to a larger issue than possibly being used to send phishign emails.

2. During the Summer of 2019, the personal data of some 37000 Canadians being held in TransUnion servers were compromised. Note that the Canadian Digital Privacy Act, which ammended PIPEDA and provided mandatory breach notification requirements, had become law 4 years earlier. Also, GDPR and CCPA had already become law.
3. On March 12, 2022 ITWeb broke the story of a data breach, which caused TransUnion to admit that attackers had indeed stole 28 million credit records. At first it was believed that more than 3 million South Africans and businesses such as Mazda, Westbank, and Gumtree were affected. The Brazilian group who claims responsibility for this act, "N4ughtysecTU," state it gained access due to a poorly secured (password "Password") TransUnion SFTP server. TransUnion later stated that more than 5 million consumers were actually affected and once again offered a period of free credit reports to the affected customers.
   
4. On November 7, 2022 it reported to the Massachusetts Attorney General about a data breach that could involve 200 million files profiling nearly every credit-active consumer in the United States. On the same day, TransUnion also sent out data breach letters to all individuals whose information it believes was compromised. As this is still developing, the true impact is yet to be learned.

OK, I will stop here. If they had another data breach between Nov 7 2022 and the time this was published, it should not affect the point of this article.

The Outcomes

According to GDPR Recital 75, a personal data adverse effects to a person (individual) include loss of control over their personal data, limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, and loss of confidentiality of personal data protected by professional secrecy. So, if TranUnion was an European company or people living in the European Economical Area (EEA) were affected by this personal data breach, as the data controller it would have to submit the Personal Data Breach Notification to the Supervisory Authority should be done within 72 hours unless there is no risk to the freedom and rights of a data subject. In this case, they better be reporting. The next step would be to inform all those who were possibly affected about what happened, what are the consequences to their customers, and what TransUnion is doing about it. Of course, those affected should be expected to file complains with their regional Supervisory Authorities (Art 77).

In The United States things are a bit different. U.S. Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez stated that only those that can show concrete harm have standing to seek damages against private defendants. How will victims of a personal data breach prove their personal information was stolen and disclosed by negligence of the company holding this data, and as a result a violation of American consumer protection and privacy laws such as California Consumer Privacy Act (CCPA) and the Illinois Biometric Information Privacy Act (BIPA)? Compare that with GDPR already mentioned article 77 and recital 141, which requires only the data subject (i.e. the victim in this case) considers that his or her rights are infringed or "supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject."

With that said, it is possible that will change. Given that the US government and the European Union are currently actively working together to establish a new EU-US data flow deal (PrivacyShield 2?), one must wonder how they will balance this Supreme Court decision with GDPR. Which one will have precedence?

Fun Facts

• I started this article mentioning the phishing campaign they were possibly being used to launch. What if that is related to this data breach? I mean, if your attack has been successful and you are already in the final (Actions on Objective) stage of the cyber kill chain and taking your time to hoover the victim's data, why not see what else you can do while there to pass time?
• In addition to its main line of business, it also offer services to help companies "protect and restore consumer confidence" after a data breach (they do not list an office address there). In fact, they title themselves as the "One-Stop-Shop Incident Response Solution."
• I made those round images representing the 3 regulations mentioned here because I did not have an interesting image to put in this article. They turned out nice, so expect me to make more and use them in future posts. You have been warned!