Security Cameras

Some Back Ground:

Perhaps it was because of my time spent as a life guard watching people but I love watching people, and watching them in awkward situations, and watching what they do when they think no one is looking. Anyway this has lead to a love of watching surveillance videos as well as a paranoia about security (not like I have much worth taking).

The situation:
At work there has been some vandalism...

So we did some reconnaissance via some home made security cameras.

What I did:

ManyThing app

https://manything.com/

It was a quick and easy set up plus the first camera is free! For the convenience I think this is totally worth the prices they have as well.

The camera is blank in the picture due to it being offline. If I remember I will upload another one later with it on.

Are there other ways to do this? Absolutely I have seen many ways of doing this, but this was fairly easy and suited my needs perfectly.

Also due to getting ready for a little one I have recently done the same thing as a way to create a wireless monitor for our kid!

**I need to start adding pictures these get boring if they are just texts....

Cisco ASA VPN Quick Notes

I thought I would do a quick notes section on some of the Cisco VPNs and problems I have seen.

If you use a base set of commands or if you use the wizard almost always the problem is on the other end but its nice to have proof.

Some thing I recommend is to not allow a VPN connection to even be set up until they fill out a form for your end that includes all the details. I will make a basic one and upload it in another post, as well as the basic CLI commands to create one if you aren't using the wizard as it is useful info to have around.

Here are a few commands that will help you debug the tunnel.

Check Phase 1 Tunnel ASA# show crypto isakmp sa detail | b [peer IP add]  Check Phase 2 Tunnel ASA# show crypto ipsec sa peer [peer IP add]  Display the PSK ASA# more system:running-config | b tunnel-group [peer IP add]  Display Uptime, etc. ASA# sh vpn-sessiondb detail l2l | b [peer IP add] ASA# show vpn-sessiondb detail l2l filter name <peer_address>  

Re-establish VPN Connection ASA# clear ipsec sa peer <remote-peer-IP>

Github

So I have uploaded some of my more useful things on github.

They can be found here.

The most useful pieces are probably the scripts. I am working on making some of my scripts more generic friendly as they are specific for work for some instances.

and because I like images (and this page is rather plain), here is one of octokitty (github mascot):

New computer!!

So I recently got a new computer, an Alienware Alpha. It is a nice little machine but I could not for the life of me get the controller to work in games. I found out that it was because I set it up as a PC first. Turns out the alpha ui driver for the controller takes precedence. To solve this I simple uninstalled the alpha ui. It was better than doing a factory restore after I had downloaded most my games. I am finding that it runs great though.

VPN Connection

So there are different types of VPNs specifically I am talking about the ones I have made using Cisco with IPsec I believe.

For Windows I use Shrew Soft:
This gives you lots of options, most of which I haven't used because of how I have done my Cisco configs it hasn't been necessary.



For Linux I use vpnc:
First you need to install vpnc
sudo yum install vpnc
Then you need to change the contents of /etc/vpnc/default.conf to:
IPSec gateway the.external.ip.address
IPSec ID CiscoGroupPolicy
IPSec secret ItIs@Secret
Xauth username YOURUSERNAME
Xauth password YOURPASSWORD
IPSEC target network network.ip.scheme.0/24
or
If you put the config information in /etc/vpnc/filename.conf and use "sudo vpnc filename" to connect to the vpn instead.

Replacing YOURUSERNAME and YOURPASSWORD with your own username and password.

After you have done that, just run sudo vpnc to start up the vpn. To disconnect from the vpn, just run sudo pkill vpnc or vpnc-disconnect

It appears that I have found a fix for the "No internet access" issue. Simply create a file with these contents and run the following commands:

(i will work on formatting this correctly so it looks like code and not just a bunch of lines)
diff -aur vpnc-0.5.3.svn527.old/vpnc-script vpnc-0.5.3.svn527.new/vpnc-script
--- vpnc-0.5.3.svn527.old/vpnc-script 2013-08-16 15:30:17.422036172 -0600
+++ vpnc-0.5.3.svn527.new/vpnc-script 2013-08-16 15:31:20.228503547 -0600
@@ -227,7 +227,7 @@

  set_default_route() {
  $IPROUTE route | grep '^default' | fix_ip_get_output > "$DEFAULT_ROUTE_FILE"
- $IPROUTE route replace default dev "$TUNDEV"
+# $IPROUTE route replace default dev "$TUNDEV"
  $IPROUTE route flush cache
  }

This should finish with the just the message of "patching file vpnc-script" on success. It may also say something along the lines of "Hunk #1 succeeded at 131 with fuzz 1 (offset -96 lines).". If it doesn't, something went wrong (or the patch file needs updating).
cd /etc/vpnc/
sudo patch -Np1 -i /path/to/the/patch/file/you/downloaded.patch

I also have installed shrewsoft from source.
-This has been the guide I have followed.

You can also use ShrewSoft via the command line.

Tunnelling
ssh -f searchadmin@10.30.30.23 -L 8080:10.30.30.1:443 -N

Then go to 127.0.0.1:8080

Recently I've been having to install Shrew Soft on my Linux machines as well which has been a pain. The reason for this appears to be some change Cisco made. I'm looking into a way to fix it but basically it causes so much network traffic when I connect via vpnc it doesn't allow anyone else online.

Honey Pots (heffalumps and woozles)

Heffalumps and woozles love honey. So how do we prevent them from getting ours?

So the first time I heard this term was last week. Which means I still have a lot to learn. First lets answer a few questions:

Q. What is a honey pot?
A. Simply put a honey pot is a server that looks too good to pass up for a hacker, and lets you know the network has been compromised amongst other things.

Q. Why use a honey pot?
A. Uses for a honey pot will vary from understanding the attack methods used by hackers, to a base start for an IDS (intrusion detection system) or IPS (intrusion prevention system).

Q. How do I set one up?
A. Well there are Many ways to do this. The simplest is downloading a Virtual Appliance that has a lot of the tools already installed. That can be found here. HoneyDrive has its benefits and fails just as all such services do. I am still looking into other options as HoneyDrive is the first and only one I have played with at the moment, but it has some sweet looking graphs with kippo already set up.

It also has a "Playlog" that you can playback and see everything a user typed once they got in.

So I got this set up and played with it a bit and found a few issues off the bat.

1) An updated ssh version won't recognize kippo due it it requiring stronger keys.
2) Some errors it throws back will let me detect that its not actually an ssh client.

In the mean time I will continue looking for a better option. I am also hoping to find one that will automatically send me an email once someone connects to it (which this might I just only spent a day going through its tools).

Penetration Testing

So in the last two months (December and January) I have had the opportunity to do a bit of penetration testing for work. This has renewed my interest in cryptography once again. So the first thing I did was just basic Kali Linux penetration tests.

Kali Linux is simply Linux with a bunch of free penetration tools pre-installed. The hard part is learning to utilize each tool and understanding what it is doing. Basically it allows you to run known exploits.

Recently an exploit has come to fruition called the CVE-2016-0728, has been found. While not as bad as some it is still fairly dangerous as anyone with shell access can get root access. I got to test and make sure we were secure against it. When you are pen-testing and you fail that's a good feeling. Especially when you are dealing with sensitive data.