What do Dash Cam's have to do with Information Security?

I always tell my family and friends to purchase a dash cam for their vehicles. Because you never know. But what does this have to do with Information Security? 

Quite a lot. 

Having a dash cam can help reconstruct what happened right before and after an accident. Often in accidents and investigations there will be conflicting reports between witnesses. People's memories are often hazy or get distorted as they are recalled more often and as more time passes by. 

In information security, I am advocate of having strong Network Security Monitoring infrastructure in place so that when an incident occurs there is data available that can be used to reconstruct the events. One of the worst feelings in information security is realizing that data is simply not there to answer the critical questions. 

So if you drive, go out there and get a dash cam. They run roughly $100-$200 and can be purchased at an electronics retailer or online. 

Geeking out on wireless

Is anyone else excited about Unifi Mesh???

I was browsing around the Unifi site while troubleshooting an issue and just noticed Unifi is releasing a new line of products. It looks like Christmas came early. 

The jury is still out on the performance of the new products. 

This new line of products are indoor/outdoor access points specifically designed for plug and play mesh technology. Which means no more annoying wireless adoption then setting up the uplink in the controller. *In theory it should be easier. 

What will be interesting is the Mesh Pro ( UAP-AC-M-PRO) because the specs indicate this access point will be a beast. It has 3x3 MIMO on both bands.  

https://unifi-mesh.ubnt.com/

As easy as 1..2..3 well almost anyways

Easy Unifi setup

It has come to my attention that there is an easy way to setup Unifi Access Points. Take your unadopted wireless access point and plug it into the local network. (Won't work if Access Point already adopted to controller)

Install the Unifi app which is available on Android or iOS. Have the app in non-controller mode. You should be able to see the access point and set it up all through your phone!!!! 

This is only for basic setup. More advanced configurations will need to have the controller installed. But this easy setup is enough to create an SSID and password which is enough for the average consumer. 

Wireless Uplink Issues, not worth the effort.

Wireless Issues: Solution just abandon wireless uplink on UAP devices. 

I recently spent the weekend troubleshooting my slow wireless and dropouts. It appears that for my home setup the wireless uplink was a terrible idea. Although, I many more "bars" of wireless with uplink, I found that it also resulted in significantly degraded performance vs. a standalone access point. Roughly 1/10th the speed.

This brings to my next point, wireless access points should not be used as repeaters unless designed for that specific purpose. 

- At best it results in 1/2 the speed due to the uplink. 

- If the access point has one radio, that will be used for both receiving and transmitting. 

The following link best describes why the approach of repeaters, bridgers, uplinkers often fails.
https://community.spiceworks.com/topic/988492-why-don-t-wi-fi-repeaters-work-very-well-ok-why-do-they-suck

Hosting file to pull via wget

Occasionally, I may need to host a file that I will need to pull from Linux via wget.

This short tutorial will detail how to upload a file to Dropbox and share a link in such a way that can be retrieved via wget.

The first step is to upload the file onto https://www.dropbox.com.

Subsequent step will involve sharing a link that will be available to the internet.

1. First select the Share button



2. Once uploaded select the Copy link
 

3. Change the end of the download link to have dl=1 rather than dl=0
 

Once this is done, this link can now be used to download files via wget.

This can be useful to pull binaries such as Splunk add-ons.

Mergers & Acquisitions (M&A) Data Security Due Diligence

I recently read a New York Times article called "The Chinese Hackers in the Back Office" and one paragraph especially troubled me.

"Not all companies heed the warning. A security consultant for one victim, who spoke on the condition of anonymity because of nondisclosure agreements, said that his client chose not to act on a tip from Area 1 last year out of concern that a scandal over a successful online attack against the company would jeopardize its recent acquisition. It figured its acquirer would not have been thrilled to learn that the start-up’s proprietary technology was now in Chinese hacker’s hands." - NYTimes

This is one area where information security does not get enough attention. When a larger company purchases a smaller company or organization. How much due diligence is taken to ensure that the acquisition target hasn't been already been compromised? What steps are taken to ensure that the intellectual property of the acquisition target is secure and not already in the hands of the adversary? It maybe worth the while to hire a 3rd party to audit and hunt the network to ensure that there isn't APT already in the network. 

There are implications when the acquisition target is discovered to be compromised. Does this impact the valuation? It likely does. This will also impact integration efforts. Some M&A's assume cost savings that result from the merger. Do some of those savings come from IT consolidation efforts? Depending on the extent of the compromise, you may never be able to integrate the network into your corporate environment. Depending on the capabilities of the attackers it can takes years to expunge them from the network. Or in extreme cases the existing infrastructure will need to be destroyed and built from the ground up. 

One of the reasons why I believe this doesn't get enough attention is hinted in the article. Much of this is not in the public domain. For every breach disclosure there are likely other parties that either a) don't know they have been breached b) keeping it secret.

These opinions are my own and not those of my employer. 

My wifi setup

My personal wifi setup involves using one access point connected to the back of the router provided by the ISP, with an additional access point that serves as a repeater for better coverage.

For my wireless access points, I wanted to select equipment that was close to enterprise grade that will not burn a hole in my pocket. I am looking at you Cisco Aironet. I ultimately decided with an access point from Ubiquity.

• Reputation for stability
• Affordable cost
• Good reviews 

I specifically went with the Unifi AP-AC-LR Access Point. I personally think this AP is one of the best values for a 802.11ac wireless access point. For the average consumer, the Apple Airport Extreme is a good choice.

Installation Procedure

Getting the Unifi controller to properly install and recognize the unprovisioned access points was quite the challenge. I initially tried installing the software in Windows with no success. For those installing on Windows made sure that the Windows Firewall is either off or set to allow the controller software to communicate inbound and outbound. 

I decided to install the controller on Ubuntu 14.04 and it worked! 

During the initial setup you will need to choose a name for your network and password. In addition, you will need to adopt the access point into your network.

To setup the access point that will serve as the repeater you will need to connect the device to the same layer 2 network, aka the same switch. Once you do that, adopt the AP into your network. Then disconnect the device from the switch. After a few minutes the AP will display isolated in the controller then go into settings and configure the Wireless Uplink settings to the Access Point you want it to uplink to. After this is done, both Access Points should be blue.

To setup the wireless uplink, I found the following blog entry to be helpful.

http://www.tongfamily.com/2014/05/wireless-uplink-unifi-ap/

Note: There are some versions of the Ubiquity controller that will require you to manually set the Access Points to the same channel.