Short notes on tech 52/2020

Week 52, 2020

Code

Learning

Stop using Material Design text fields!
"But Google uses it!" — yeah, that’s not a good enough reason. (from Weekend Reading)

Collection of tips for note taking by Dr. Sam Ladner
"This is a great collection of tips for note taking. For user research, design reviews, board meetings, whatever". (from Weekend Reading)

Tools

EStimator 
"Calculate how much you can save by switching your website to modern JavaScript." (from Weekend Reading)

An Instant GraphQL API Using Google Sheets
"The takeaway is, skip the complicated and under-documented Google Sheets API, and use the Google Charts Visualization API instead." (from Weekend Reading)

Something different

The 'Japanese Bob Ross': How a 73-year-old artist took YouTube by storm
(from hackernewsletter)

Short notes on tech 51/2020

Week 51, 2020

Cloud

AWS launches new managed services: Announcing Amazon Managed Service for Grafana (in Preview) and Amazon Managed Service for Prometheus.

Monitoring & securing AWS with Microsoft
"Interesting approach, how to setup (advanced) monitoring of AWS with Azure Security Center (CSPM), Azure Defender (CWPP), Cloud App Security (CASB), and Azure Sentinel (SIEM)." (from Cloud Security Reading List)

Development

Can developer productivity be measured?
"Defining and measuring programmer productivity is one of the most difficult parts of an engineering manager or CTO’s job description. When everything you do is intangible, how should you measure it? Can it be measured at all?"

The CSS Mindset
"You need a certain mindset to write good CSS."

How to Make Your Code Reviewer Fall in Love with You
"Value your reviewer’s time". tl;dr; Start with these and read the article for more:

  • Review your own code first
  • Write a clear changelist description
  • Automate the easy stuff
  • Answer questions with the code itself
  • Narrowly scope changes
  • Separate functional and non-functional changes
  • Break up large changelists

Software

Chrome is bad
tl;dr; "Google Chrome installs Keystone on your computer, which makes your whole computer slow even when Chrome isn't running. Deleting Chrome and Keystone makes your computer way, way faster, all the time." Alternative facts about the issue from Hacker News.

Learning

The Modern JavaScript Tutorial
(from HackerNewsletter)

How I read books: setting up a new system
"Knowledge is much more valuable when we can act on it, and change our behavior."
tl;dr; Active learning / reading; Processing and reflecting; Repeating; Presenting; Taking action. (from HackerNewsletter)

Something different

The Donut King who went full circle - from rags to riches, twice
(from HackerNewsletter)

Short notes on tech 50/2020

Week 50, 2020

Cloud

Wait, Docker is deprecated in Kubernetes now? What do I do?
tl;dr; Use CRI runtimes instead: containerd or CRI-O.

Google Cloud: default container runtime to change to Containerd with GKE node version 1.19 and higher.
"As the Docker container runtime will be removed from the Kubernetes project in the future, GKE is beginning a migration to the Containerd runtime. Support for the Containerd image variants became Generally Available in GKE in September 2019." See: Using containerd images

A better Kubernetes, from the ground up
"What we would do differently if we built something new, from the ground up, with no regard for compatibility with Kubernetes?" (from Cloud Security Reading List)

DevOps

Travis CI is no longer providing CI minutes for open source projects
The move from Travis CI to other (more OSS friendly) Continues Integration services has been seen for some time and this will accelerate it. The popular choices are: GitHub Actions, Circle CI, Google Cloud Build, Drone CI.

AWS Lambda now supports container images as a packaging format
You can now package your functions as container images and use familiar container development tools to build Lambda applications. (from Cloud Security Reading List)

Monitor and secure your containers with new Container Threat Detection
Google announced the general availability of Container Threat Detection (a built-in service in Security Command Center Premium tier) to help monitor and secure container deployments in GCP. (from Cloud Security Reading List)

Programming

Advent of Code
Reminder that the Advent of Code is again here with programming puzzles.

PostgREST
"PostgREST serves a fully RESTful API from any existing PostgreSQL database. It provides a cleaner, more standards-compliant, faster API than you are likely to write from scratch." (from hackernewsletter)

public-apis/public-apis
A collective list of free APIs for use in software and web development. (from Weekend Reading)

Learning

The UI & UX Tips Collection: Volume One
"Collection of my popular UI & UX tips from the past 12 months that can, with little effort, help improve both your designs, and the overall user experience." (from Weekend Reading)

Something different

Chess tactics explained
If you watched the The Queen's Gambit miniseries and got interested of playing it, the Chess tactics explained gets you started with more than just basic rules. (from hackernewsletter)

NoCode tools
"Discover the best tools to build software, no code required"

Short notes on tech 49/2020

Week 49, 2020

Development and Operations

Using SSL certificates from Let’s Encrypt in your Kubernetes Ingress via cert-manager
Walkthrough of the process of automating the issuance and renewal of certificates provided by Let's Encrypt for Kubernetes Ingress using the cert-manager add-on. (from cloudseclist.com)

Use Amazon EC2 Mac Instances to Build & Test macOS, iOS, ipadOS, tvOS, and watchOS Apps
"Powered by Mac mini hardware and the AWS Nitro System, you can use Amazon EC2 Mac instances to build, test, package, and sign Xcode applications for the Apple platform including macOS, iOS, iPadOS, tvOS, watchOS, and Safari." The downside of this is that "The instances are launched as EC2 Dedicated Hosts with a minimum tenancy of 24 hours" which is due Apple EULA and thus one CI build costs about $26. And what I read from HN the real viable option is still to use MacStadium.

Tools of the trade

cloudquery
"cloudquery transforms your cloud infrastructure into queryable SQL tables for easy monitoring, governance and security." (from cloudseclist.com)

k8s-security-policies
"Repository providing a security policies library that is used for securing Kubernetes clusters configurations. The security policies are created based on CIS Kubernetes benchmark and rules defined in Kubesec.io." (from cloudseclist.com)

alyssaxuu/screenity
"Screenity is a feature-packed screen and camera recorder for Chrome. Annotate your screen to give feedback, emphasize your clicks, edit your recording, and much more." (from Weekend Reading)

Miscellanous

Why Apple's replacement for Intel processors works really, really well
"They added Intel's memory-ordering to their CPU. When running translated x86 code, they switch the mode of the CPU to conform to Intel's memory ordering."

Short notes on tech 48/2020

Week 48, 2020

Tools of the Trade

Next.js 10
Built-in Image Component and Automatic Image Optimization, Internationalized Routing, Next.js Analytics, React 17 Support.

Node.js 15
Throw on unhandled rejections, pm 7 includes yarn.lock file support, peer dependencies are now installed by default, V8 8.6.

kachkaev/njt
"njt (npm jump to): a quick navigation tool for npm packages". This is super useful: njt react h brings the home page, njt graphql g takes you to GitHub, other jump points include changelog, source code, issues, and more.

Coding Fonts
A microsite that shows off fonts specifically designed for writing code.

Upptime
Open source uptime and status page system, powered entirely by GitHub Actions and Issues.

Gitlint
Git commit message linter (for Linux and Mac, experimental on Windows), that checks your commit messages for style.

Alternatives to JIRA which is moving to cloud only:
Asana
ClickUp
Linear
Redmine

Nova app from Panic
Native code editor for Mac.

Microsoft Clarity is out of beta
Tool for visualizing user experience. Click and scroll heatmaps, individual session replay, rage clicks metric, and more.

Apple

Does it ARM?
"Apps that are reported to support Apple Silicon"

Accessibility

Atkinson
New free and hyperlegible font published by the Braille institute.

Web

Apple now lets us integrate Face ID and Touch ID on the web
"Building it on top of the Web Authentication API. Imagine how this can improve the logging in experience for a good part of your user base."

Monthly notes 54

Working from home continues as COVID-19 still surges and if you yet haven't checked your video call capabilities, read the How to make video calls almost as good as face-to-face article. The remote working isn't going away as this year has shown that pendeling to offices every day isn't really needed.

Issue 54, 6.11.2020

"Nobody gets hacked"

Working from home

Companies plans for remote work going forward
Twitter thread by Chris Herd of what he learned by speaking to 1,000 companies over the last 6 months about their plans for remote work going forward. Office space going down; flexi-work; people working too hard; burnouts; asynchronous communication is difficult; invest to ergonomic working equipment; workers will be happier as a result of remote work; need tools to track output; documentation is the unspoken superpower of remote teams; coaching and facilitators are needed;

How to make video calls almost as good as face-to-face
How much nicer video calls would feel if the problems with low-quality microphones and webcams, lag and such would be solved? The post summarizes what can be done by fiddling with gear and software. TL;DR; Get away from other people; Throw your wireless headset in the trash; Don’t mute; Get a better microphone; Listen to yourself; Improve your lighting; Use your real background; Don’t bother with webcams;

Docker and Kubernetes security

Dockerfile Security Best Practices
List of common security issues and how to avoid them. For every issue there's an Open Policy Agent (OPA) rule ready to be used to statically analyze your Dockerfiles with conftest. TL;DR; Do not store secrets in environment variables; Only use trusted base images; Do not use ‘latest’ tag for base image; Avoid curl bashing; Do not upgrade your system packages; Do not use ADD if possible; Do not root; Do not sudo;

Docker Threat Model

The Current State of Kubernetes Threat Modelling
"If you are planning on using Kubernetes in production, one of the key things to consider from a security perspective is your threat model."

Arsenal of Cloud Native (Security) Tools
Marco Lancini's curated list of tools he finds useful, alongside a quick “usage” guide for each one of them. i.a.: Docker Bench, kube-bench, kube-hunter, AWS Security Benchmark,

Something different

2020 UCI Cycling eSports World Champs heads to Zwift’s Watopia in December
"2020 UCI Cycling eSports World Championships are set to take place on virtual ride platform Zwift in their online Watopia environment. Garmin-Tacx will supply all of the connected trainer for with elite men and women to race each other virtually"

Prettifying AWS S3 Bucket public index list

Sometimes it's useful to have a index listing on a AWS S3 bucket. Here are some solutions to configure it with nice template. If having a public index list on a S3 Bucket is a good idea or not I'm not saying yay or nay.

First set the correct Bucket Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::tmfg-tiesaahistoria/*"
        }
    ]
}

Next set Permissions

Everyone, List objects Yes

Create a index.html

For the index.html you have couple of choices:

  1. Use the index.hml with modifications by Nolan Lawson (see also: Lawson's blog post and code)
  2. Use more up to date forked index.html
  3. Use original file by Francesco Pasqualini
  4. Use AWS S3 Bucket Browser

To use it, just upload the index.html file into the root of your public S3 bucket.

That’s it!

What software and hardware I use

There was a discussion in Koodiklinikka Slack about what software people use and that people have made "/uses" pages for that purpose. And inspired by Wes Bos /uses from "Syntax" Podcast here's my list.

Check my /uses page to see what software and hardware I use for full-stack development in JavaScript, Node.js, Java, Kotlin, GraphQL, PostgreSQL and more. The list excludes the tools from different customers like using GitLab, Rocket.Chat, etc.

For more choices check uses.tech.

Monthly Notes 52

Issue 52, 9.9.2020

Software development

Field Ops Guide
"The Field Ops Guide (by Futurice) is a booklet that makes it possible to survive a software development project. It's a distillation of years of wisdom gathered working in client projects."

Kubernetes

Threat matrix for Kubernetes
"While Kubernetes has many advantages, it also brings new security challenges that should be considered. Therefore, it is crucial to understand the various security risks that exist in containerized environments, and specifically in Kubernetes."

Docker

Faster Builds and Smaller Images Using BuildKit and Multistage Builds
"Multistage builds feature in Dockerfiles enables you to create smaller container images with better caching and smaller security footprint. In this blog post, I’ll show some more advanced patterns that go beyond copying files between a build and a runtime stage, allowing to get most out of the feature."

Tools

img
"Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder."

GraphQL Voyager
"Represent any GraphQL API as an interactive graph."

SQL diagrams

Something different

Cheating in eSports: How to cheat at virtual cycling

Notes from HelSec Virtual Meetup 1

This year has been challenging for meetups and gatherings but one good side of the restrictions was that remote work has become more acceptable and also meetups and conferences have invested to streaming and virtual participation which is great for people living in an area where there's no meetups.

In early May HelSec kept their first Virtual Meetup with great topics. Here's my short notes (finally four months later). The meetup was streamed via HelSec Twitch channel and the discussions were in HelSec Events Discord. The meetup recording is available from Twitch.

HelSec Virtual Meetup 2020-05-07

HelSec Virtual Meetup #1 (7.5.2020)

Fighting alert fatigue and visibility issues in SOC

Juuso Myllylä from OptimeSys talked about fighting alert fatigue in security operations center (stream from 41:41 onwards). The goal in the talk was to improve automated detection, introduce "detection logic killchain" framework he has worked on as his master's thesis and shift our minds from signature based detection and move towards intelligence based.

Threat detection pyramid

Threat detection framework based on design science research method:

  1. Identify: What is a threat? What kind of things make up a threat?
    1. Mitre's ATT&CK framework
    2. Mitre's ATT&CK: Design and philosophy
    3. Example: hijacked Azure AD account detection
    4. Tactic = initial access
  2. Detect: How we can detect a threat?
    1. Logs, logs, logs
    2. Technique detection is also valid
    3. Example technique: valid accounts or phishing
  3. Use Case: Search queries, log sources, etc.
    1. Convert your idea into a security information and event management (SIEM) search query
    2. Procedures: many APT (Advanced Persistent Threat) groups have used valid accounts as an entrypoint
  4. Demonstrate:
    1. Deploy the use case
  5. Evaluate: evaluate detection logic
    1. Analyze the SIEM logs once your SIEM use case has been deployed
    2. e.g. check Azure AD audit logs, eliminate non-related data
    3. Applies also to threat hunting
  6. Communicate: Document your detection logic in Sigma form
    1. Can be shared with others, try to be SIEM agnostic

iPhone BFU Acquisition and Analysis

The meetup continued with iPhone forensic from @1:19 by Timo Miettinen from Nixu. The presentation explained first how the iPhone iOS filesystem's two main partitions are protected: non-encrypted System and encrypted Data. Data partition is encrypted with burned-into-hardware UID key. The files have additionally 4 classes of Data Protection.

From forensics point of view access to data is protected with many layers: USB connectivity is restricted; Logical extraction is divided to iTunes backup + some media files, password protected backups contain more data, backup password can be reset but has deviations; Full file system extraction needs jailbraking the device; iCloud extraction (synced backup).

The case talked in the talk was a lost iPhone which was later returned by law enforcement. The question was: What was done with it while missing? Was it stolen or just inspected by friendly authorities? Phone was powered off and passcode was changed.

So they had BFU device in their hands for data extraction: device that has been powered off or rebooted and has never been subsequently unlocked. The amount of the data they can theoretically get is really limited.

In BFU the file encryption keys are wiped from the device RAM and only unencrypted class D protected files are available. Biometric authentication is not possible, USB restricted mode is enabled (need biometric authentication or passcode to activate data connections), lockdown records become useless (logical data acquisition impossible) and passcode recovery attack falls to BFU speeds.

Acquisition methods:

  • Utilizing exploits and jailbreaks:
    • checkm8: unpatchable bootrom exploit released by axi0mx on September 2019 which enables jailbreaks, activation lock bypass etc.
    • checkra1n: jailbreak released on November 2019 which utilizes the checkm8 exploit to run unsigned code on an iOS device. Doesn't always pass the USB restricted mode, depends on the combinations of hardware and software versions.
  • Open source and free tools:
    • libimobiledevices has collection of useful tools:
      • SSH over USB using iproxy
      • ideviceinfo gives iOS and HW versions
      • idevicecrashreport gets crash logs from the device
      • many more
    • ios_bfu_triage: extract avaible data
    • iTUnes if you don't have the BFU restriction
  • Commercial tools: Belkasoft Evidence Center, BlackBag Mobilyze, Cellebrite UFED / Physical Analyzer, Elcomsoft Phone Viewer, Magnet AXIOM, MSAB XRY, Oxygen Forensics Extractor

In their use case the checkra1n jailbreak didn't work and USB restricted mode was activated. Also some of the commercial tools enabled to extract some data but wasn't able to read the archive format the software created. They decided to the analysis manually which is a good idea even if the tools are working.

Some open source or free tools for analysis:

  • APOLLO (Apple Pattern of Life Lazy Output'er): parses pattern of life data from databases and properties into human readable format.
  • iOS sysdiagnose forensic scripts: parses iOS sysdiagnose logs.
  • iPhone Backup Analyzer: allows the user to browse the content of an iOS backup.
  • iLEAPP (iOS Logs, Events, And Preferences Parser)
  • iBackup Viewer: browse the content of an iOS backup and extract files.
  • ftree: crawl any directory and identify all files etc.
  • deserializer: converts from NSKeyedArchive to normal plist
  • For reading plists you can use: plutil -p <filename>
  • DB Browser for SQLite
  • Google's protobuf utilities (protoc)

When doing analysis you should look for plists, binary plists, plists in plists, blobs may contain binary plist files and SQLite databases (Shared Memory file .shm, write ahead log .wal). Some applications store data in protocol buffers (protobufs) in SQLite database blobs, plist files or just data files. Tools find most of the interesting data but you can make your own script to dump all text files, convert plist files to readable format, dumps data from every database, get all embedded binary plists from plist files and databases and convert them to readable format.

In their case they found out that the phone was reinstalled 12 hours after it was lost. Mobile banking, social media and instant messaging applications were installed. The device was used to communicate with several contacts and used around the city. The phone was stolen and reinstalled with intention to use it.

Still Fuzzing Faster (U Fool)

Joona Hoikkala talked about Web Fuzzing and using fuff tool for fuzzing directories, login, basic auth, virtual domain, content id:s and more. Follow the talk from the stream at 2:19:00 and the demo starts around @2:33:00. The slides are good starting point.

Kind of reverse but describes web fuzzing

You can use fuzzing with different input contents to target i.a. GET parameters (names, values or both), headers (Host, authentication, cookies, proxy headers) and POST data (form data, JSON, files). What to look for (matching)? Response codes, content (regexes) response sizes (bytes, # of words).

Resources: SecLists

Price of a digital identity

Laura Kankaala, from Robocorp and Team Whack fame talked about the price of a digital identity starting at 3:20:40. Data is central, security - privacy: how companies view data and how data sellers view data.

Digital identity:

  • What we are
  • What we have
  • What we produce

Laura also presented that ~90-99% of data collected is dark data which is collected but not really utilized. But we are just getting started. But it's good to remember that our data belongs to us. We give permission to collectors and controllers.

Do you know what's your data worth? Data is valuable and for example there are companies like doc.ai and datum which tries to monetize it so that also user gets part of it. But yet the data is used more for targeted ads, providing content just for us, increasing efficiency and creating better services. And of course every one remembers Cambridge Analytica and (trying) to affect electoral processes in the US.

The most valuable things being sold online are: credit cards, identity numbers, passports, credentials, phone numbers, home address. Passports are quite logical of value and e.g. France passport goes for $124, USA $115, Canada $103, UK $60 and so on, depending of the data included with it.

Kankaala talked about how the collecting of our data has sneak to our lives (e.g. social credit systems). Companies collect data and when our normal live becomes very tangled with our live online it becomes easier to monitor us, to see what we're up to and to moderate our behaviour. We need to be careful when we allow new type of access to our live, e.g. COVID-19 tracking.

Regulation, awareness and education is at least a patch to some of these issues. We are hackers and we should be the pathfinders and show people that it doesn't have to be that if something works the way it does today and although it works it doesn't mean it works right or ethically.

We are all vulnerable

Magnus Lundgren from Recorded Future told a tale of two databases, a panda and someone who was listening starting at 4:25:00.

There's a race of when vulnerability is found and assigned a CVE number until it's either patched or exploited. 12 517 CVEs were first published on NVD in 2016-2017 and it takes average 33 days until an initial assesment of the vulnerability is made available via NIST's NVD. For example Dirty Cow (CVE-2016-519) it took 21 days to initial release on NVD but it took only 8 days to create an exploit (Proof of Concept shared on Pastebin) for it and sold/shared on the deep and dark web.

A tale of two databases: NVD (NIST) and CNNVD (CNITSEC). In the Chinese CNNVD it takes on average only 13 days compared to 33 days on NVD for initial assesment. The difference comes from the detail that CNNCD is doing active collection while NVD is doing passive collection from vendors. But always it doesn't be that way like it was the case with some Android backdoor where it took 236 days from CNNVD and 60 days from NVD. It takes longer for CNNVD to publish high threat vulnerabilities than low threat ones and during the publication lag Chinese APT groups are exploiting those vulnerabilities.

When the Recorded Future published a blog post identifying 343 "outlier" CVEs (regarding the issue the of CNNVD lag) CNNVD backdated 338 of those CVEs. Someone was listening.

Conclusions:

  • Deep / Dark web monitoring of activity is crucial for a good patching cadence.
  • Magic can be done with threat intel data that has been organiced for analysis.
  • Chinese intersection is particularly vicious for foreign companies: Ministry of State Security (China) runs multiple threat actors e.g. APT3, runs CNNVD and cherry picks CNNVD vulnerabilities for targeting.

Resources: Inside Security Intelligence podcast