Entries by Raymond P. Burkholder

From Tools For Survivial:

Prevention—What You Can Do

• Distance yourself from or avoid people and crowds. If you must go out, stay at least six feet away from individuals.
• Wash your hands for at least 30 seconds using soap and water frequently, but especially after using the bathroom, before cooking, and after shopping, opening doors, touching elevator button and grocery carts.
• Don’t panic or buy into the hysteria. Stay vigilant and research. The info being disseminated in the beginning is usually wrong.
• Get vaccinated.
• Self-quarantine.
• Cover your mouth when you cough or sneeze—preferably into your arm or elbow, not your hand.
• Wash your sheets and pillowcases every few days in hot water.
• Germs can live on surfaces for days. Disinfect surfaces regularly with bleach. Wipe down your desk, door knobs, handles, light switches, and elevator buttons at the office regularly with cleaning wipes.
• Heed the warning. Pay attention to advisories and take precaution. It is better to be safe than sorry. Stay inside if you must—you and others can spread disease without feeling sick or showing symptoms.
• Do not go to the hospital unless it is an emergency. Medical resources will deplete. Hospitals and doctor’s offices are hot beds of sickness. If you can, take advantage of your insurance’s call in service if available.

• Coronavirus Tech Handbook - provides a space for technologists, civic organisations, public & private institutions, researchers and specialists of all kinds to collaborate on a rapid and sophisticated response to the coronavirus outbreak and subsequent impacts. It is a quickly evolving resource with thousands of active expert contributors.
• FireMountain - links for information
• Flight Info - The flights have been found to have a passenger confirmed to have COVID-19.
• HealthLinkBC - Coronavirus disease (COVID-19) also known as 2019-nCov, originated from Wuhan, China, but has spread to a number of countries including to Canada. The risk to British Columbians remains low.
• COVID-19 projects looking for volunteers - These projects were posted by the community. Volunteer yourself or create a new one.
• FluTrackers - tracking Infectious Diseases since 2006
• Coronavirus COVID-19 Global Cases by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins University (JHU)
• Johns Hopkins University (JHU) - better link to the map
• WorldOMeter - COVID-19 Coronavirus Outbreak
• The Prepared - If you’re worried about the SARS-COV-2 coronavirus outbreak or feel unprepared, this guide is for you. Experts explain what you should do to get ready, how to protect yourself, what researchers believe are the likely scenarios going forward, and the latest fact-checked news.
• Imperial College COVID-19 Response Team - Impact of non-pharmaceutical interventions (NPIs) to reduce COVID-19 mortality and healthcare demand - Here we present the results of epidemiological modelling which has informed policy making in the UK and other countries in recent weeks. In the absence of a COVID-19 vaccine, we assess the potential role of a number of public health measures –so-called non-pharmaceutical interventions (NPIs) – aimed at reducing contact rates in the population and thereby reducing transmission of the virus.
• Italian town's experiment leads to no new coronavirus cases in almost a week - Vò, a town of 3,300 just outside Venice, was part of an experiment that involved aggressive testing and quarantine measures. Every single resident was tested for coronavirus in late February when Northern Italy was first rocked by the outbreak, and three percent of inhabitants were found to be carrying the virus.
• TRSA - COVID-19 resources webpage for TRSA members in the linen, uniform and facility services industry.
• European Centre for Disease Prevention and Control - Preparedness planning is essential in order to respond effectively to outbreaks and epidemics. Sharing and aligning activities at European and international level in the area of public health emergency preparedness adds value to the efforts of single countries to strengthen their capacities and ensure coordinated and effective support when faced with cross-border health threats.
• Persistent Defenses Against the Wuhan Virus - by Howard Philip - Presented here for your consideration is a set of simple self-help measures you can implement to dramatically improve your chances of avoiding the deadly Wuhan virus, ranging from behavioral adjustments to the application of readily available materials and chemicals - real or fake?
• Federal Reserve Bank of New York - Coronavirus Resource Center - We have created this resource center where individuals, businesses, and non-profits can find out what’s available to them at the federal, state, and city level. This hub will be regularly updated to connect our communities with the necessary resources.
• GitHub repo for Wall Street Bets as they analyze the failures resulting from the virus.
• Genomic epidemiology of novel coronavirus - provides regular updates of virus evolution
• Coronavirus: Guidance for Better Mental Health - Self-care is vital, and it’s also important to try and reduce the stress for ourselves and others around us.

From the debian-boot mailing list:

 * pkgsel:
    - Ensure tasksel is installed, regardless of its priority.
    - Add preseedable pkgsel/run_tasksel debconf template, making it
      possible (by setting it to false) to skip tasksel entirely
      (installation and prompt), while still benefiting from other
      pkgsel features.
 * preseed:
    - Update auto-install/defaultroot, replacing buster with bullseye.

From a networking list serve:

Question:

Can anyone suggest tools, techniques and helpful contacts for backtracking spoofed packets? At the moment someone is forging TCP syns from my address block. I'm getting the syn/ack and icmp unreachable backscatter. Enough that my service provider briefly classified it a DDOS. I'd love to find the culprit.

Response:

It's not complete, but if you're receiving the ICMP net/port unreachable backscatter it should include a portion of the original packet. This might provide some insight into the TTL left on TCP the packet when it reached its destination which could provide a rough radius that you would need to look at. Also, if the TTL is constant it would support the idea that one or few hosts are spoofing your address block, but if the TTL varies widely it might indicate that many bots are spoofing your address block.

You might check looking glass tools or something like https://radar.qrator.net to see if someone is not only spoofing your address range, but has gone farther and has hijacked it.

The country code is not read from ACPI but from the EEPROM of the WiFi-card (0x0 "World Regulatory Domain" by default).

How to Build your Own Wireless Router (Part 3) - kernel requires code patch to enable 5GHz operations.

ath10k locks to regulatory domain US on ACPI platforms

• My Hard Drive Died - primary goal is to provide you with the data recovery knowledge and tools you need – whether it be our free videos and content, or our structured training (seated classes, distance learning or specialized).
• Resource Public Key Infrastructure (RPKI), the community-driven technology based on open standards that is aimed at making Internet routing more secure

Quite some ago, there was a discussion around [ovs-dev] Creating a libopenvswitch-dev package, back in 2016. Since then libraries have been updated for C++ inclusion, plus other improvements.

From somewhere, I don't have the reference, maybe my own blog, but since I have this in a note on my desktop, I'll include it here:

• Build a string formatted as the “ovs-ofctl” command would do, for example “table=1,cookie=0xdeadbeef,in_port=1,actions=resubmit(,2)”
• Pass this to parser_ofp_flow_mod_str(). The parser will magically parse the string in to a rich struct.
• Pass the struct to ofputil_encode_flow_mod(). This returns a struct with a serialized OpenFlow message buffer.
• Send this buffer on the wire either via a socket you manage yourself or let OpenVswitch do it for you.

From Phoronix - Linux 5.6 To Bring FQ-PIE Packet Scheduler To Help Fight Bufferbloat, there are some example configurations for using different buffering mechanisms (Implementing the Flow Queue PIE AQM in the Linux Kernel).

For wireless clients:

net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control = bbr

and fq_codel (codel) is better suited for router.

Another possibility:

I had pretty amazing results with cake. I prefer it over fq_codel and it is now part of main line since 4.19.

Cake - Common Applications Kept Enhanced

In the past the internet would just grind to a halt when the Apple devices started cloud syncing. They would totally swamp the outgoing bandwidth. Now nobody notices when an Apple device is syncing.

Open firmware for small routers for congestion management:

The OpenWrt issue with 4MB has to do with using newer kernels. For those devices, DD-WRT is a better bet (still on kernel 3.10).

Overheard on a mail delivery email list:

What we do is FAR from Binary.

Heck, sometimes it feels like the square root of -1 is involved somehow.

An extract from bug #949655 at bugs.debian.org:

I finally found on iPXE website[1] a link to detailed examples, including one[2] to boot pxelinux. It works perfectly with di-netboot-assistant:

#!ipxe
dhcp
set 210:string tftp://my_server/d-i/n-a/
chain ${210:string}pxelinux.0

For those who did not know (like me ), 210 is a standard DHCP option called "path prefix"[3].

• [1]extensive ipxe menu example
• [2]menu.ixpe file
• [3]bootp dhcp parameters

There is a tool called testssl.sh - a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more. Very extensive.

$ ./testssl.sh --starttls smtp myrelay.example.org:25
$ ./testssl.sh www.example.org

Or run some simpler tests:

$ openssl s_client -cipher 'DHE' -starttls smtp -crlf -connect myrelay.example.org:25

An older blog entry: SWAKS - Swiss Army Knife SMTP, the all-purpose SMTP transaction tester

2020/01/25 Send an email to

auth-results@verifier.port25.com

2020/01/25 Visit mail-tester.com for another flavour of email tester for spamminess.

• tuned is a profile-based system tuning tool that uses the udev device manager to monitor connected devices, and enables both static and dynamic tuning of system settings. Packages in Debian are 'tuned' and 'tuned-utils'.
• Using netstat and dropwatch to observe packet loss on Linux servers - uses the 'dropwatch' package (needs kernel symbols).
• Track a packet as it goes through the kernel (linux)

Courtesy of 3 quick ways to reduce your attack surface on Linux, a command to identify open ports and identify the associated application:

$ ss -tulnp --no-header | awk '{print($1, $5, $7)}'
udp 0.0.0.0:32770 users:(("vlc",pid=2786557,fd=39))
udp 0.0.0.0:32771 users:(("vlc",pid=2786557,fd=40))
udp 127.0.0.1:123
udp 0.0.0.0:123
udp 0.0.0.0:631
udp 0.0.0.0:37019
udp 0.0.0.0:5353
udp 0.0.0.0:39276 users:(("vlc",pid=2786557,fd=50))
udp 0.0.0.0:39277 users:(("vlc",pid=2786557,fd=51))
tcp 0.0.0.0:61209
tcp 127.0.0.1:25
tcp 127.0.0.1:5433
tcp 0.0.0.0:8794
tcp 127.0.0.1:3493
tcp 127.0.0.1:5101 users:(("ssh",pid=899751,fd=4))
tcp 127.0.0.1:5102 users:(("ssh",pid=2187130,fd=4))
tcp 127.0.0.1:5201 users:(("ssh",pid=2186389,fd=5))
tcp 127.0.0.1:5202 users:(("ssh",pid=2186389,fd=7))
tcp 0.0.0.0:22
tcp 127.0.0.1:631
tcp 127.0.0.1:5432
...

• Zeek s a powerful network analysis framework that is much different from the typical IDS you may know. (Zeek is the new name for the long-established Bro system. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Threat Hunting with Bro IDS
• BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. The repository contains 2443 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs.
• Stratosphere IPS for Linux is an intrusion prevention system that is based on behavioral detections and machine learning algorithms. Makes use of Zeek.
• Security Onion - Linux distro for intrusion detection, enterprise security monitoring, and log management
• SecTools.Org: Top 125 Network Security Tools - several years old for the newest releases (looks like 2016 is most recent). Doesn't have tools like Suricata.
• Argus s the first network flow system, developed by Carter Bullard in the early 1980's at Georgia Tech, and adopted for cyber security at Carnegie Mellon's Software Engineering Institute in the late 1980's. Network flow technology has become a critical part of modern cyber security and Argus is being used in some of the most important networks in the world. - last code around 2016 though. security links.

Papers:

• Botnet Detection and Prevention inSoftware Defined Networks (SDN) usingDNS Protocol in (IJCSIS) International Journal of Computer Science and Information Security,Vol. 17, No. 5, May 2019

• OpenWebRX -for listening to On-Line SDRs using a web browser. It is a web based server and interface for remotely accessing RTL-SDRs and SDRPlay's. Another link: Open Source SDR Web App for Everyone
• NYC Mesh - community-owned network for fast, affordable and fair access to the Internet - Most of the devices we use, such as a LiteBeam or NanoStation, are self-contained so they have an antenna, radio and ethernet router all in one.