homelab updates - security onion

I'm sorting through a few IDS issues but I've finally had enough downtime to build a SecurityOnion instance and I'm looking forward to learning more about Snort/Surricata, Bro. and Kibana on this.

I'd initially tried running it on a Udoo x86 SoC device that'd kickstarted but it was woefully underpowered to run everything I needed so I decided to start over.




Specs

Gigabyte Brixx 

I'm a big fan of small form factor PCs for labs because of the size and noise profile. They're lower powered so they make less noise but that's fine for a home lab.

• 16 Gigs (2x8Gigs) of Hynix SODIMM DDR3L
• 250 Gig SSD Samsung 860 Evo 
• USB3.0 Gigabit Ethernet interface for packet capture
• Netgear GS110TP 8 port gigabit switch providing SPAN interface. 

The only issue that I'm having is with secure boot causing Snort/Surricata to fail because the kernel module PF_RING isn't signed (more info). I will need to eventually disable this in the BIOS/UEFI menu.


Findings/next steps

1. I need to learn to use docker more
2. pipe security onion / bro/snort alerts to my Splunk instance.
3. IOT is really crap at managing SSL certs. A lot of devices like Canary and Roku's phone home to a location that does not have a correctly signed SSL/TLS cert. Just a subset below:

• CN=digdug.data.roku.com,O=Roku\, Inc.,L=Los Gatos,ST=California,C=US SSL certificate validation failed with (self signed certificate in certificate chain)
• CN=scribe.logs.roku.com,O=Roku\, Inc.,L=Los Gatos,ST=California,C=US SSL certificate validation failed with (unable to get local issuer certificate)
• CN=*.canaryis.com,OU=Server,O=Canary Connect\, Inc.,L=New York,ST=New York,C=US SSL certificate validation failed with (self signed certificate in certificate chain)
• CN=wdcp.microsoft.com,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US SSL certificate validation failed with (unable to get local issuer certificate)
• CN=configsvc.cs.roku.com,O=Roku Inc.,L=Los Gatos,ST=California,C=US SSL certificate validation failed with (self signed certificate in certificate chain)
• CN=*.delivery.mp.microsoft.com,OU=DSP,O=Microsoft,L=Redmond,ST=WA,C=US SSL certificate validation failed with (unable to get local issuer certificate)
• CN=fe2.update.microsoft.com,OU=DSP,O=Microsoft,L=Redmond,ST=WA,C=US SSL certificate validation failed with (unable to get local issuer certificate)

4. I really need to write up a post on the lab. 

my work travel EDC

There are two bits of tech that I make sure that's always in my work bag whether I'm running out to the coffee shop for a change of scenery or when I'm at traveling to the client site. This is beyond the standard cell phone, work laptop(s), and all that other stuff.

The first is a Belkin Power Strip + USB. I've added a short power cable because I've found that it always won't plug into the outlets in conference rooms. Conference rooms never have enough power outlets for laptops and cell phone chargers. The 2 2.1A USB ports are an added bonus so I don't need to carry the little USB chargers. There is a newer model that does 2.4 A USB ports.

Amazon Link - Power strip - $14.99
Amazon Link - Power adapter -  $16.99 for 10

Unless I need a personal laptop, I usually just travel with an iPad Mini with a keyboard. My last iPad Mini had a Logitech keyboard that only protected the screen but this time I opted for a Zagg one because this one would better protect the back and edges of the iPad. This iPad size is a better form factor for reading and handling e-mail. It's also great for watching content from whatever streaming service you have.  The keyboard is pretty good and responsive.

When this is combined with a dongle for Lightning -> HDMI, it makes watching movies in the hotel that much better.  The dongle is pricey, but trust me you'll thank me when you're otherwise stuck watching the content on a smaller screen or be stuck with the options at the hotel. It also does let you charge while using the dongle.

Amazon Link - Zagg Keyboard+ case  - $44.99
Amazon Link - Apple iPad 4 mini - $300
Amazon Link - Apple Lightning / HDMI dongle  $50

Other stuff I'm usually traveling with:

• Kindle Paperwhite (1st Generation) in a Timbuk2 case - Great battery life and screen quality. I've had it for ages and it's still  alive and kicking. 
• Anker or an Aukey powerbank - gotta keep those gadgets charged. 
• If my flight is 2+ hours, I usually travel with my Nura headphones. They've got great sound quality, isolation, and noise cancellation. 
• If it's a shorter flight, I usually just travel with my Anker bluetooth earbuds that I use in the gym too. 

living the best #consultantlife -a series

After spending 6+ months on the road traveling Monday - Thursday or Monday - Friday, I've been slowly tweaking my kit and how I do things to make things easier on the road.  So I'd like to share my tips and tricks, but I'd love to hear other people's.


I'll break it into the following topics:
1. Gear
2. Travel
3. Food and Drink
4. Fitness
5. Misc

Favorite Security podcasts

As I posted a few months ago I listen to a bunch of podcasts. Here are the security/privacy podcasts I listen to:

1. Sans Internet Storm Daily Networking- It's a short daily update of security issues. It's more focused on vulnerabilities and major hacks. 
2. Twiet-this week in enterprise tech. I find it more focused from a topic perspective. It does go into other topics being an enterprise tech podcast however it's very clear and concise in describing issues and trends. The presenters are people in industry, SEs, or tech journalists so they share interesting perspectives. 
3. Enterprise Security Weekly-I started listening to this recently and I've found it to be pretty good and informative.
4. Intercept-This covers privacy topics and was co-founded by Glenn Greenwald, who is best known as the journalist that Edward Snowden contacted. 
5. Cigital Silver Bullet-Haven't listened to this in a while.
6. Down the Security Rabbit Hole-Haven't listened to this in a while.
7. CERT's Podcast Series: Series for Business Leaders- Haven't listened to this in a while.
8. Decrypted
9. Secureabit
10. Security Now - I find this one to be too long and veers off topic. 

25 favorite podcasts

1. WTF
2. 538
3. All Songs Considered
4. Sound Opinions 
5. DTR from Gimlet
6. a16z
7. 50 Things that made the Modern Economy
8. Tell Me something I don't know
9. The way I heard it with Mike Rowe
10. The Ezra Klein Show
11. Planet Money
12. Sans Internet storm center
13. Food Chain
14. The Moth
15. Radio Lab
16. This American Life
17. This is only a test
18. The Axe File with David Axelrod
19. The Tim Feriss show
20. Radio Lab presents more perfect
21. Freakonomics
22. Wait Wait don't tell me
23. Curious City 
24. How I built this
25. Wired spoken editions

#trypod recommendations

This post started as a list of recommendations but then I realized how many podcasts I listen to Below is a partial list of my subscribed list. I got part way through and realized that I don't listen to all of these regularly. So I'll start posting about my favorites with a short blurb why I like them.

1. Accidental Tech Podcast
2. The Vergecast
3. Harry Potter Podcast- last update 2011
4. Fidelity Investment Insights
5. Tiny Desk Concerts
6. Indivisible
7. 5 on 45
8. Dear Sugar
9. In the dark
10. Vice
11. Pop Culture Happy Hour
12. Intercepted Jeremy Scahill
13. Enterprise Security Weekly (audio)

Finsix Dart- a product review

I recently picked up a Finsix Dart from Massdrop because I've got 3 laptops and travel a bit for work and pleasure. I remember seeing the IndieGoGo campaign but I missed out on it.  Seeing it was at a decent price at Massdrop, I picked it up.  Bottomline there are some pluses and minuses but check their website to see your if your laptop is compatible.

Pros

• One of the things Finsix says is the charger as small. It really is small. It's the size of a USB cigarette light power adapter.
• It has a USB port on it. I'm really surprised more laptop power bricks don't have one. It makes it easy to charge a phone or battery pack. It is a 2v USB port so it'll charge at the same speed as an iPhone or iPad charger. 
• It's really easy to use, after all it's a laptop power brick so it better be easy to use. 

Con

• It's not able to power one of my laptops that has a power draw of > 65w. This was my primary reason for the purchase. 

Con(but not for me)

• Doesn't work with Apple products. 

Fakenews blocking in ublock origin

I decided to put together a uBlock Origin block list for fakenews sites. I found a few listings on GitHub for host files to do this but nothing in uBlock Origin so I decided to make another repo with some of the host files as a starting point. Feel free to share/add some other fakenews sites.

https://github.com/femaven/fakenews-ublockorigin/blob/master/ruleset

On Moving from industry to consulting

As some of you know, I moved from industry to consulting within the security space just over a year ago. My focus has been and will continue to be Data Protection. Most of what I've done has been design and implementation but will move towards strategy. I'm also getting my feet wet with Security Analytics, hence the sudden interest in Splunk.

My experiences are different from most I've met in security consulting. It's been a refreshing change from me and I'm definitely not regretting it. In fact, I wish I'd done it sooner.

-Most folks I've met are road warriors that travel nearly 75 %. I'm between 25-50% tops.
-I'm working a ton less. I was averaging 50-60 before I left my last company. Now I'm at a pretty consistent 40 hour week. Huzzah for work-life balance.
-My last company had a pretty nuanced view towards remote work which is bonkers while at a global firm and having calls consistently with other corners of the globe. With a little planning, I'm able to work anywhere I've got an internet connection.
- I get to work on all kinds of projects and engagements so I'm developing more professionally. My last year and change at my last company I was in a rut where I wasn't growing.

#consultantlife

Github repo for comments blocking

I just put together my uBlock Origin blocklist into a GitHub Repo. Check it out:here.

Comments section blocking

We all know that the comments sections are teh suck. Here are a few rules to block comments sections on a bunch of sites. I might this into a github repo in the future so y'all can contribute to it.

automated speedtest using centos and IFTTT

Several months ago, I saw a Make tutorial on how run speedtest.net on a Raspberry Pi every hour and record it to Google Drive using IFTTT. I had to tweak it a bit to run on CentOS and added some basic metrics.

Home lab upgrades + current config

Host

NUC model NUC6i5SYH

NUC memory 32 gig crucial DDR4

NUC drive old SSD

BIOS vers SYSKLi35.86A.0051.2016.0804.1114

Vmware version ESXi-6.0.0-20160302001-standard (VMware, Inc.)

9/21 Added swap to local storage (SSD)

This replaces my AMD based ESXi host that wouldn't run anything newer than 5.1 because of NIC driver support and the NUC is a ton smaller and fanless.

Splunk instance

Splunk 6.4.2 build 00f5bb3fa822

Receiving logs from Windows machines, Router, NAS, and ESXi.

I'm using it to do some cool dashboards. Maybe I'll write some posts on it in the future. I'll be updating it soon, when I get a free moment.

Router

TP-Link TL-WDR4300 v1

Running OpenWrt Chaos Calmer 15.05 / LuCI (git-15.248.30277-3836b45)

NAS

1.8 TB iSCSI LUN

Synology DS1812+

the season of cold brew coffee

Now that it's finally warming up, I've been experimenting with my cold press coffee maker that I got from Amazon.  I got the 600 mL Hario Mizudashi coffee maker on sale a few months ago and I've been using it when I don't want to make a doppio.

To make a batch use
6 scoops of ground beans
400ml cold water
and let it set in the fridge overnight.

To serve I use put two square ice cubes in a tall glass and pour in some cold brew with room for a splash of milk. I've tried adding some spices like cinnamon and that tastes pretty good.

Soylent 1.5 experiences

I've been using Soylent 1.5 pretty regularly for a while. There was a 2 week period where I was using it exclusively, mostly out of laziness. It's certainly better than reaching for a candy bar if I can't get away for lunch but the taste is pretty bland.

Here's what I've tried so far:

Recovery drink (post workout)

• 1 scoop vanilla Muscle Milk
• 1 scoop Soylent 1.5
• (optional) 2 scoops Fruit Punch BCAA from Optimum Nutrition
• 1.5 cups water in a blender bottle.

Fruit & Berry shake

• 1/2 cup frozen fruits/berry
• 2 scoop Soylent 1.5
• 1.5 cups water in a blender bottle.
• Toss it all in the blender and pour and drink through out the day.

Peanut butter shake

• 2 tablespoons powdered peanut powder
• 2 scoop Soylent 1.5
• 1.5 cups water in a blender bottle.
• Toss it all in the blender and pour and drink through out the day.

Espresso shake

• lungo (long pour) on espresso
• 2 scoop Soylent 1.5
• 1.5 cups water in a blender bottle.
• Toss it all in the blender and pour and drink through out the day.

A few months with the Cogito watch

I've had the Cogito Classic watch for about a month. There are definitely some things I like and dislike. The net of it is that I wouldn't buy it again. Actually I just sold mine on Ebay.com and bought a Pebble Time. I've been much happier with that buy.

Like

• Notifications
• Analog clock
• The color
• It's water resistant

Don't like

• App is flaky
• Form factor- it's large and clunky
• battery life - there are no warnings it just stops.

Bucket list races

This is the bucket list of races that I've built up so far.

• Bay to Breakers-Running with not just California crazies but the creme of the crop from SF. 
• Mt Hood to Coast-a downhill course. Party on the coast, totally the way to go. 
• Reno Tahoe Relay-Amazing views. Couple it with a vacation. 
• New York Marathon - Marathon Major
• Big Sur Marathon-The race is supposed to be hilly but the views are supposed to be amazing. 
• Escape from Alcatraz-this is a tri that's pretty unique. You start off in the Bay and do a swim-run bike run
• London Marathon Marathon Major
• Tokyo Marathon- Marathon Major. Couple it with a vacation. 
• Bolder Boulder-Heard great things from a friend that worked at the race
• Pune Marathon-Just to say I ran a marathon in India. Would be afraid of being run over or drinking in water, or stepping in cow shit. 
• Athens Marathon-The Original. Enuf said. 
• Steamboat Classic 15k-Hilly and typically humid race in Peoria, IL. 

Lab building

I finally got my lab built out to a functional level with:

• an iSCSI LUN providing storage on a Synology NAS
• an ESXi host running on an old desktop providing compute 
• CentOS guest running splunk
• Log data sources going to splunk
• openWRT router including Snort
• ESXi logs
• Synology NAS

Stay tuned for a more detailed blog post and another including future plans for it. 

Outdoor climbing at Devil's Lake

It's been a busy month with tri training, switching jobs, and getting more into rock climbing but we dipped our toe into getting ready for outdoor climbing this weekend at Devil's Lake (Baraboo, WI). This place was about 2-3 hours outside the NW Chicago Suburbs and camped at a private lot near the state park.It was also my first time camping, though this was more like car camping. At night, we played Exploding Kittens and the NSFW deck for that game for the first time. I think that game would have been more fun with more light because part of the fun of the game is the artwork and what's written on the cards.

It was stupid hot but it did cool down at night and during the class when it decided to sprinkle for 10 minutes. A few friends and I took a class on building anchors. We learned the basics to set anchors and tie knots. I've got names of knots and hitches like European Death Knot (EDK), Double Overhand, Speed-Bowline Knot, and my favorite the Alpine Butterfly floating around in my head. Since we had some extra time, the instructor set an anchor at the top of the rock and let us climb.  It's really different climbing outdoors versus climbing indoors (duh!). Most notably, no smearing on the rock. The other is noticeable when it's hot; chalk really doesn't help with the sweat.  The rock is really smooth too. It's strange not having to look for colored holds to move up, you just have to find holds you think you can get to move up.

Before leaving, we did find a really cool diner out there called the Broadway Diner. It's worth checking out. For the carnivores out there, my friends said the hash was really good.

ragnar race report

A few weeks ago I ran Ragnar from Madison to Chicago. This wasn't my first time doing a relay race but it was my first one at this kinda distance.

A little background
Ragnar puts together relay races all over the country in the 200 mile range. You go from exchange point to exchange point in a van and drop off your runner. We had 12 runners and 2 vans. The course was pretty well marked.

I ran with a team where I knew only half of the people, in the other van. I took leg 1, and had a 12:30 start time. My leg had something like 15.5 total miles. I turned too early. I only added .6 of a mile but no big deal. Running at night in a forest preserve was really cool. That was my leg with the fast pace.Once I finished my last leg, I was open to eat and drink whatever I wanted. I savored a Snickers ice cream bar that I bought at a gas station. I think if I could have slept better, I would have run my last leg faster.

Would I do it again?

Hell yes!

By the end of it, we were pretty grumpy by being sleep deprived and surviving on essentially junk food. We all swore that we wouldn't do it again and would write to the race directors to tell them that they fucked up. After getting some good sleep, I was in a better mood about it.

Things I'd wished the race organizers had done differently

• More water/aid stations
• Numbering based on start wave, so we could tell if we were beating out people from earlier waves. River to River does this so we use that to help understand how we're doing relative to everyone else. 
• The post race meal sucked. The pasta while good, had no protein and was a snack sized portion. 
• The vendors/partners were taking down their booths during the van exchanges areas even while teams were going through. There shoulda been food to buy or something. 

Lessons learned

• Plan who is bringing what for each van
• bring more pictures
• bring music
• bring eye shades, and a light blanket, and foamies to make it easier to sleep
• More ice
• Line up volunteers earlier otherwise you have to pay $120 / volunteer