Enphase IQ Gateway

Getting the Enphase IQ Gateway to function is painful. Ultimately, I needed to have a technician come out and assist me in getting this connected to wifi. 

Guide to connecting Enphase IQ Gateway

According to Enphase documentation the IQ Gateway supports the following. 

• 802.11b/g/n (2.4 GHz, 5 GHz)
• 10 m (32.8 ft)
• There is an optional ethernet jack for hardwired installations.

Issues with the following

• mixed 2.4 GHz/5 GHz networks
• wifi 6
• advanced settings such as band steering

What works

-Setup an IoT compatible network

-On the Verizon CR1000A it is fairly simple

-On ubiquiti there is an Enhanced IoT wifi mode that is enabled via a checkbox in the wifi settings.

-Reboot the wifi access point

Once this is performed you may still have issues

-Enphase IQ Gateway requires a strong wifi signal. One of the gateways would not pickup the wifi signal from the Enlighten app despite my phone getting reception. At this point, I called a technician who was able to get this to function.

Cloning software

When cloning hard drives especially to upgrade the storage of a device. I found that using an older version of Macrium Reflect to be very useful.

References 

https://www.reddit.com/r/pchelp/comments/1b3xknx/any_truly_free_disk_cloning_software/

ScreenConnect launch parameters

I have found the referenced Anomali article and DFIR report very helpful when identifying ScreenConnect launch parameters. I haven't figured out what r and i does.

• e as session type, can be Support, Meeting, Access .
• y as process type, can be Guest or Host .
• h as the URI to the relay service’s URI.
• p as the relay service’s port.
• s as a globally unique identifier for client identification.
• k as the encoded encryption key, used for identity verification.
• t as the optional session name.

References:

https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies

Windows Package Manager (winget) it's amazing

Those coming from Linux have long used package managers, such as apt or rpm to install software. Package managers are great because you can install software from a trusted repository and simplifies the task of upgrading software to newer versions. 

For the longest time those on Windows did not have a built in OS package manager and have long relied 3rd party software such as Chocolatey or Ninite. In 2020, Microsoft released winget to help solve the problem of installing, upgrading, and removing 3rd party software on Windows.

Winget is great and hopefully will see more widespread adoption of this tool. I have also noticed that software installed through winget tends to not have PUP, or obnoxious add-ons. 

The Trust in Zero Trust

Opinions expressed are solely my own and do not express the views or opinions of my employer

Hafnium/UNC2452 used novel techniques that abused and took advantage of the adoption to cloud technologies without understanding the full implications and architecture.

Microsoft has made a push in recent years to Office 365 and as a result many organizations now have hybrid cloud environments, whether they know it or not.

How is this relevant to Zero-Trust? 

The spate of attacks has revealed weaknesses and tactics that pen-testers and adversaries can exploit against a hybrid cloud or zero trust environment. In a Zero trust environment there is still trust relationship between the Identity provider and Service provider. By attacking the cryptography protections in this trust relationship, UNC2452 was able to launch sophisticated attacks that often went undetected. Tokens generated by the Identity provider are trusted by the service provider. UNC2452 by forging tokens was able to abuse this trust relationship to bypass controls normally enforced when accessing Services. Through forged tokens they were able to short circuit the normal authentication piece by directly authenticating to the Service provide via tokens bypassing the Identity provider.

Great what does this mean? 

For defenders, it is important to get good AAA telemetry. This means getting good logging from your Identity provider, and Service provider. Logs to track authentication, authorization, and auditing. This is a lot easier said than done. 

Implementing zero trust can provide gains to an organization by lowering the overall risk by "reducing or removing implicit trust in networked systems by addressing network identity, endpoint health, and data flows." (NIST) However, it can also mean introducing a single point of failure. An attacker that can compromise the identity manager can gain access to multiple resources. If the identity provider is based in the cloud, how much trust do you place in them? What if your cloud identity provider was breached, what are the impacts to your organization? While I believe many cloud providers provide better patching and maintenance than organizations, the risk is non-zero.

References:

https://csrc.nist.gov/News/2022/planning-for-a-zero-trust-architecture-white-paper

Non-compete clauses

Recently the FTC has proposed a ban on most non-compete clauses. This is a great idea, if this ban gets enacted the US stands to benefits in multiple ways including, increased worker mobility, increased innovation, increased growth, and increased market competition.

Silicon Valley

The lack of enforcement of non-complete causes in California is one of the factors that have helped to create a vibrant technology sector in that state. Non-compete clauses are a method for employers to reduce the competition by making it hard to poach and recruit talent. Without non-competes start-ups in California are able to grow and thrive in the shadow of giant technology companies because they are able to better execute on their roadmaps and strategy. Organizations such as Zoom have been able to thrive in California by identifying a need in the market not met by larger technology companies. Large technology companies have been sued by the Federal government for illegally preventing employees from getting offers from competing firms. For example, Steve Jobs was sued by the Feds for a gentlemen's agreement with one of the founders at Google to stop the organization from poaching talent away from Apple.

Abuses of Non-complete clauses

Non-compete clauses have also been abused by employees by using overly broad language that prevents employees from leaving the firm, or going to the competition. For example, in healthcare non-complete clauses often will dictate a geographical radius. In dense metropolitans, such as New York or LA, a non-complete clause of 25 miles means you'll essentially need to find another job in another city. 25 miles can mean a 2 hour commuting radius in large crowded cities with traffic.

Non-complete clauses are un-American

Non-complete clauses go against the ideas of America. The US should be a nation that encourages competition, entrepreneurship, free markets, and the ability for employees to freely move if they find better opportunities elsewhere. The rise of non-complete clauses is allowing for many larger well-resourced organizations to reduce competition and continue their rent-seeking behavior. The continuation of this will reduce the economic growth of the country, and the limit opportunities of employees. 

References: 

https://money.cnn.com/2014/08/11/technology/silicon-valley-poaching-case/

Experience taking SANS SEC560 Network Penetration Testing and Ethical Hacking

 This is the first time I have taken an online SANS course. For motivated students, online learning can be just as effective as in-person courses. 

Overall, I enjoyed taking SEC560, the material was current and relevant to my job. Although I work blue team, there is a lot of value that could be gained by taking a pen testing course. There is tremendous overlap between the course material and the TTP's used by ransomware attackers. These include the following techniques I have read or observed attackers using. I particularly enjoyed the emphasis on targeting the NTDS.dit file. 

- Password attacks (password spraying, brute-force)

- NTDS.dit

- Domain attacks

    - Domain enumeration (bloodhound) 

    - Kerberos attacks (kerbroasting) 

Improvements to the course

I thought that the labs could have been more comprehensive. I would have enjoyed a bonus section that included more advanced topics in the course, including attacks against the domain such as kerbroasting, silver ticket, golden ticket attacks, AS-REP roasting, and AD CS attacks.

Remnux and VirtualBox Window Sizes

When importing the Remnux ova into VirtualBox you may notice that the window sizes are inappropriate in order to fix this you will need to install the VBox Guest additions.

In order to do this. Add an optical drive in VBox to the virtual machine. Then in the menu insert Vbox guest additions and install the software. 

Then you will need to follow the instructions on the website.

sudo mount /dev/sr0 /mnt/cdrom sudo /mnt/cdrom/VBoxLinuxAdditions.*

The TSP a magical unicorn

Thrift Savings Plan (TSP) is the defined contribution plan offered to Federal employees. It is very similar but slightly different to the 401(k) offered to non-federal employees. (The TSP is technically not a 401(k) since it was created under a different law)

What makes the TSP a magical unicorn

1. Ability to roll funds into TSP even after leaving Federal service. 401k plans usually only allow participants to roll funds in while they are active participants. The TSP is different because it allows participants to roll 401(k) and traditional IRA funds in after leaving the federal service. (TSP does not take Roth IRA rollovers) 
2. G fund. "Participants who invest in the G Fund are rewarded with a long-term rate on what is essentially a short-term security." In other words a free lunch, long-term rate with only short-term risk. Unlike the typical bond fund offered in 401k plans, the Federal Government is assuming much of the interest rate risk. 
3. TSP is considered part of the FERS pension plan. In New York State, public pension withdrawals such as TSP are exempt from taxes up to $20,000. It may be beneficial to contribute to a traditional plan since contributions are not taxed by the state and withdrawals might not be taxed on the way out. 
4. Extremely low fees in all funds including Target Date Funds. Funds charge approximately 4 basis points or 0.043%. This is partly because expenses are covered by those who leave the Federal service before their 1% agency automatic contributions vest. 

Cons of the TSP plan 

1. Decisions are made slowly. So modern features and changes to private sector plans slowly make their way into the TSP. 
2. Politics. Members of congress occasionally interfere with the TSP. However, the TSP board does a good job at fulfilling their fiduciary duty to participants.

Note: I am not an attorney or financial professional. So you may want to consult counsel or a financial professional for your specific circumstances. 

Experience taking SANS FOR508

FOR508 Advanced Incident Response and Threat Hunting

This is a review for a course I took back in 2018 so the materials may have changed since I took the class. The course is good for individuals that are involved in incident response and threat hunting within Windows environments. I have found many of the topics of discussion useful for those that regularly use EDR and/or memory analysis (ie volatility) in their daily roles. The course was centered around intrusions into Windows infrastructure. Those that are desire to learn more about Linux / Mac forensics would learn the fundamentals but many of the exercises won't apply.

The course structure starts by going into topics that are most useful and applicable then going into events that are rarer and more indicative of an advanced adversary such as timestomping, kernel device drivers, and attacks on the mbr.


Topics covered by FOR508

• Windows event IDs

• Volatility events
• Malware characteristics 
• Majority of malware is unsigned 

• Suspicious Processes
• legit svchost is launched by service
• system32 directory should be signed by microsoft

• Programs making unusual connections

Sonos speaker Incorrect wifi password

When setting up a Sonos One it kept displaying "Incorrect wifi password" despite having the correct password.

After reading through forums, I finally found out the issue. It turns out Sonos does not work with 802.11n on 2.4 Ghz. Sonos will only work with 802.11 b/g. So I had to change my wifi settings to allow for 802.11 b/g. Sure enough once the wifi settings change it worked!

SIEM, Splunk, ELK and ulimits

Logging software including Splunk and ELK typically require resources in excess of typical Unix system defaults set in ulimits.conf (user limits). These Unix system defaults are designed to prevent a program from taking over the resources of a server. However, in the case of SIEM software you want it to maximize the resources on the system for performance.

A proper Splunk install will require customizing and changing ulimits so the Splunk daemon can have open file handles in excess of the system defaults.

In a distributed Splunk environment, the easiest way to check your ulimits is by utilizing the Health Check in the Monitoring Console.




If the Monitoring Console comes back with a finding on improper ulimits. Please see the following reference guide by Elastic on setting proper ulimits.

https://www.elastic.co/guide/en/elasticsearch/reference/master/setting-system-settings.html#ulimit

ulimits can be adjusted in the following places in 

- /etc/security/limits.conf 

- /etc/init.d/functions

In Ubuntu you also need to uncomment (please see elastic documentation for further details)

# session    required   pam_limits.so

You will need to restart the Splunk daemon under the user that you modified the ulimits. If the modified ulimits were set in the limits.conf for the Splunk user and the init.d scripts were modified for the Splunk user, then you will need to switch into the Splunk user with sudo and restart Splunk.
(If you restart as root but the higher ulimits were set for another user then the ulimits for Splunk user will not get picked up)

References:
https://www.elastic.co/guide/en/elasticsearch/reference/master/setting-system-settings.html#ulimit
http://www.georgestarcher.com/splunk-ulimits-and-you/
https://www.splunk.com/blog/2011/11/21/whats-your-ulimit.html

Preparing for the AWS SysOps Exam 2019

Introduction

I had held the AWS Associate Architect Certification and wanted to continue to test my learning by pursuing the AWS SysOps Certificate. I found the SysOps exam to be the harder than the Associate Architect exam.

Overview of Exam

The exam is 130 minutes, 65 questions.

Exam Preparation

It took me roughly 6 months to prepare for the certification. A majority of this time spent was reading through the AWS Certified SysOps Administrator Official Study Guide. The book is slightly dated since it came out in 2017, but roughly ~80% of the material is still relevant. The most helpful sections in the book are the practice questions that come at the end of each chapter.

https://www.amazon.com/Certified-SysOps-Administrator-Official-Study/dp/1119377420

The exam guide on the website is helpful in understanding the overall format and weighting of each section.
https://d1.awsstatic.com/training-and-certification/docs-sysops-associate/AWS_Certified_SysOps_Associate-Exam_Guide_EN_1.4.pdf

The sample questions provided by Amazon are helpful in getting a feel for the test. Furthermore, you can pay $20 to get a mock exam that will get a good feel of the exam interface along with more sample questions. Prior to taking the mock exam, I recommend getting pencil and paper because unfortunately you are only given a final score without feedback.

I also recommend going through the free training provided. The video is only 90 minutes but covers a lot of ground and goes through some additional sample questions.
https://www.aws.training/learningobject/video?id=27486

Guidelines

Day of the exam
Make sure you get plenty of rest and remember to bring the proper ID.
Protip: You can use the keys 1, 2, 3, 4, 5 to select the appropriate answer then Tab and Enter to submit.

Topics to study for the SysOps exam

Domain 1: Monitoring and Reporting 22%
Cost explorer

AWS Budgets allows to set alerts once you approach or exceed budget

Personal Health Dashboard
Cloudwatch metrics (What are the 6 metrics?)
Cloudwatch metrics, total error rate used to troubleshoot 4xx and 5xx.

How to monitor for memory usage within an EC2 (Hint: Requires a custom metric)

Domain 2: High Availability 8%
Difference between Read Replica vs Multi-AZ in RDS

Domain 3: Deployment and Provisioning 14%
Stack Policy's - Assign a stack policy to prevent updates to stack resources.
Stack changes
Enable termination protection to prevent users from deleting the stack from the AWS CloudFormation console or AWS Command Line Interface (AWS CLI).
https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-accidental-updates/
- Set the DeletionPolicy attribute to prevent the deletion of an individual resource at the stack level.

Domain 4: Storage and Data Management 12%
AWS EBS Elastic Volumes can expand a volume

Bucket policies
Elastic File Shares, EFS can be Multi-AZ

Elastic cache 

AWS Auora
S3
- principal can be a user or role
- Origin Access Identity

Domain 5: Security and Compliance 18%
KMS events recorded by cloudtrail
AWS Config - typically used for governance
AWS WAF
AWS Identity and Access Management (IAM) policies to restrict the ability of users to delete or update a stack and its resources.

VPC Endpoints Communicating with AWS services outside VPC without going over internet. 

Domain 6: Networking 14%
Direct connect

Internet Gateways
NAT Gateway
Egress Only Internet Gateway
Customer Gateway 

Vpc route
Dual Stack mode
Customer Gateway - If behind NAT must use publically routable IP address

Domain 7: Automation and Optimization
AWS Cache Hit Ratio - Only forward required cookies, headers, queryStep up auto scale

Autoscaling
- Troubleshooting
- Scaling
- Does autoscale work across regions or only within a region? 

Experiences moving away from SMS based 2nd factor authentication

NIST Special Publication 800-63B was released 2017.

Why 2fa using SMS is good enough for most people. Default settings in security are extremely important since a majority of users do not change these settings. For many sites, the default is to allow users access using the standard username and password. Users need to opt in order to get their 2fa enabled.

The NIST publication recommends moving away from SMS based 2 factor authentication.
- SMS text messages can be intercepted
- Users can be susceptible to SMS based phishing

The recommendation is for the implementation of OTP based hardware/software tokens that are based on asymmetric cryptography. While it is still possible for an attacker to get the codes they are now reduced to either an attack
- compromise the second factor
- phish the second factor from the user
- physical access

Based on my personal experiences, before implementing software tokens and moving away from SMS based 2fa make sure you have a backup plan for when you lost those tokens.

A couple months ago I had lost my phone and as a result, I lost all software tokens from my device. As a result, I was nearly locked out from some of my accounts.

Getting LTE in China, phone incompatible with TD-LTE

While traveling in China, I noticed that I was only getting edge. I ran the following steps in order to get LTE.

1. Choose Cellular Networks

2. Choose Network operators

3. Search Networks and choose China Unicom


My mobile phone didn't support TD-LTE, as I result I needed to force my phone to choose China Unicom instead of China Mobile. China Unicom supports FDD-LTE while China Mobile only supports TD-LTE. My phone choose China Mobile automatically.


*Credit to reddit where I found the solution

Recovering from a search head cluster where some members have broken kvstore

The following is some pseudocode / ansible for fixing your search head cluster when you have bad kvstores or orphaned members.

- name: Restart splunk
  command: "sudo -H -u splunk /opt/splunk/bin/splunk restart"

- name: back up folders
  command: "cp -Rp {{ splunk_home }} {{ splunk_backup }}"

- name: Stop splunk
  command: {{ splunk_home }}/bin/splunk stop

- name: splunk clean raft
  command: "{{ splunk_home }}/bin/splunk clean raft --answer-yes -auth admin:changeme"

- name: clean kvstore clustering
  command: "{{ splunk_home }}/bin/splunk clean kvstore --cluster --answer-yes -auth admin:changeme"

- name: start search head with search head with good kvstore
  command: {{ splunk_home }}/bin/splunk start
  when: "good_search_head"

- name: bootstrap shc with good_search_head
  command: "{{ splunk_home }}/bin/splunk bootstrap shcluster-captain -servers_list "https://<member_ip>:8089" -auth admin:changeme"
  when: "good_search_head"

- name: verify status
  command: "{{ splunk_home }}/bin/splunk show shcluster-status -auth admin:changeme"
  when: "good_search_head"

- name: Stop splunk
  command: {{ splunk_home }}/bin/splunk stop

- name: splunk clean raft on good_search_head
  command: "{{ splunk_home }}/bin/splunk clean raft --answer-yes -auth admin:changeme"
  when: "good_search_head"

- name: start all search heads in cluster
  command: {{ splunk_home }}/bin/splunk start

- name: bootstrap shc with good_search_head

  command: "{{ splunk_home }}/bin/splunk bootstrap shcluster-captain -servers_list "https://<member_ip>:8089,https://<member_ip>:8089,https://<member_ip>:8089,https://<member_ip>:8089" -auth admin:changeme"

References:
https://answers.splunk.com/answers/482209/why-is-the-kv-store-status-is-showing-as-starting.html
*note splunk clean raft is a better way to clear it

Using ansible to make API requests to Splunk

I used the following format to make a REST API call against Splunk using Ansible.

- name: REST API call to Encrypt passwords
  uri:
    url: https://localhost:8089/servicesNS/nobody/{{ item.app_directory }}/storage/passwords
    user: admin
    password: changeme
    method: POST
    body:
      app_username:
      app_password: "{{ item.app_password }}"
      app_realm: (optional)
    body_format: form-urlencoded

Note: form-urlencoded is only supported on later versions of ansible.

References:
http://www.georgestarcher.com/splunk-stored-encrypted-credentials/

Experience taking GREM certification

My experience taking the GREM certification

Tips and tricks

The GREM certification is one of the harder certifications that I have attempted.

There wasn't too much assembly in the exam. There are certain patterns in assembly that you should recall and identify quickly. Since this is a timed exam you could easily run out of time attempting to slowly work out the assembly code.

Study your javascript

Create an index
@hacks4pancakes has written an excellent blog post on this topic.
https://tisiphone.net/2015/08/18/giac-testing/

Study, learn, and attempt to understand the material.

Credit Freezes

When freezing your credit file remember to place it at the following places.

Major three credit bureaus

- Experian
- Equifax
- Transunion

In addition, the following places
- Innovis
- Sage Stream

References:

https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/

Rewriting indexes.conf for volume based definitions

At some point when you move from a one tiered storage to a two tiered storage in Splunk where hot/warm buckets are on fast storage (SSD), and cold on slow storage (HDD), you may need to rewrite your indexes.conf

Rewriting your indexes.conf is a fairly easy exercise, but can go disastrously wrong. Just remember that thawed storage can not reference volumes. So double check that the same data locations are still referenced. I also recommend that you rework the Splunk internal indexes ie _internal, _telemetry to reference volumes.

When rewriting your indexes.conf. I recommend placing the index cluster into maintenance mode to prevent buckets from moving in the event there is a bug in your conf file. Then monitor your index cluster for unusual activity once the modified indexes.conf file is deployed. Anomalous activity can include the number of tasks / fixup tasks increasing drastically. In our situation, we saw the number of tasks go beyond 10,000 tasks.

If you see the following, likely something has gone wrong.

- Data may not be searchable temporarily
- Search factor may not be met
- Replication factor may not be met
- High number of fixups to meet search and replication factor

In my situation, somehow at the OS level, our symlink mapped to a different location with our new indexes.conf. Resulting in a high number of fixups and Splunk not seeing the data.