So I did not “complete” my hat until very late Friday when i finally got it to announce its link status on its new set of 14 segment displays. It performed admirably all weekend. Thanks to Paul for safely transporting it to and from Vegas. I must also thank Stephen for his late night help on Wednesday. (tacos are not enough) Without his amazing soldering, i’d still be trying to figure out what i had done wrong. Here are some pictures from that night and the con to follow. . .
I’m back in Vegas for Defcon and it’s going swimmingly. so much so that i might get some actual swimming in.
Thanks to the late night help of Professor Franklin i have improved and redeployed the Defcam!
There are just so many privilege escalation fixes in the latest iOS 12.2 update. I finally removed the jailbreak from my primary device and updated. Privilege escalation is when an unprivileged or user process (like an app from the app store or even a web page*) gets root or even kernel authority. This is when bad turns to worse because it can do and see anything with any of the device’s data or sensors. Since even the big trusted apps have been caught tracking or stealing data, I simply couldn’t leave myself unprotected any longer.
I’ll still of course keep a development device jailbroken on 12.1.2 for all of the reasons. It was a wonderful experience, only slightly beta. I appreciate all the hard work by everyone in the scene. I think i am going hate seeing the home bar again the most.
* web pages are often sandboxed separately from the app itself. Some might argue that a webpage would first have to escape the sandbox before it could escalate privileges. this is true, but i would respond that sandbox escape is just another form of privilege escalation, only one level down. There are also over a dozen webkit fixes in this update.
I visited this idea months ago, but for anyone who implemented it, it has been a nightmare. Each subsequent Unifi controller update broke the https in new and exciting ways. After remaining a very squeaky wheel with Ubiquity support, they’ve pushed out a version that should permanently resolve the problems. They even made promises of native Let’s Encrypt support. All this will prove true of false with time, but for now i wanted to share my working procedure for Unifi controller version 5.9.32.
This solution required me to become more familiar with Java’s keytool then i would have otherwise. Unifi has a hardcoded keytool path and password, don’t change that (thanks Corey F @ubnt). i don’t think alias matter, but they must be consistent. I used mykey. We start by generating a key and a code signing request for our domain. For permissions reasons, we will want to do this as root. . .
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -keystore keystore -dname "CN=custom.domain.name" -storepass aircontrolenterprise
Now we export the csr file we will give to Let’s Encrypt.
keytool -certreq -alias mykey -keystore keystore -file custom.domain.name.csr -ext san=dns:custom.domain.name -storepass aircontrolenterprise
Now we run the interactive certbot script to prove the domain is actually yours before they hand out a cert. Follow the instructions you can use DNS or hosting a file to verify.
certbot certonly --manual --csr custom.domain.name.csr
Continue reading “Hosted Unifi controller with Let’s Encrypt SSL take 2!”
I met a pile of incredible people. Bought some amazing toys (for science), some i’ve even got working. Saw some talks and demos. Talked to some of my heroes and listened to even more. I saw Ladar Levison talk about epoxying your ports and adding thermite to your hard drives. I played with the ECU of a fake car! now i just have finish building the DarkNet Badge! enjoy my pictures. The hat data is still being analyzed. I’ll try to build something out of it eventually.
I have used MinuteKEY in the past to easily bypass DO NOT COPY keys. Today’s errand was more about a quick solution then a security bypass. I was just copying normal keys today. Here is what i learned. With MinuteKEY, you could only make batch copies of the same key. In fact, the MinuteKEY kiosk locked your key into the machine until all the copying is done. There were zero protections against DO NOT COPY keys. They do however print keys right there in a variety of styles and colors.
UPDATE: this is all outdated, go here.
I have been consolidating some of my sites onto a single hosted Unifi controller. Documentation was outdated so I am going to post some useful info here. My original plan was to setup a basic apache2 site, use certbot to generate my certificates and then install them into the Unifi controller. The first frustration is that you cannot simply install the certs you want into the unifi controller. second frustration, java. once you get over that, it’s super easy.
I had some issues with the initial migration. i ended up having to start over. handy command to remove unifi controller with all it’s configuration and data.
apt-get remove unifi --purge Just remember, you will need to reinstall Unifi after. It will be bran new and back to the wizard.
Getting started with SSL, I learned mostly from here. First create a CSR with unifi through command line…
java -jar lib/ace.jar new_cert <hostname> <company> <city> <state> <country>
this creates unifi_certificate.csr.der and unifi_certificate.csr.pem inside the data directory where you already are (/usr/lib/unifi/). Now we need to feed the CSR into certbot. Note that at this point, i already have apache2 installed with a very simple virutalhost and site setup with the domain i am creating a cert for. Here is the command to feed the CSR generated by Unifi into certbot to be certified:
certbot certonly --apache --csr /usr/lib/unifi/data/unifi_certificate.csr.der
Certbot will make sure that domain is yours (and your apache config is working) and then output a signed cert and a chain that is almost everything you need to install the certificate back into the Unifi controller. Still in /usr/lib/unifi/data/ 0000_cert.pem is my signed cert and 0001_chain.pem is my signed cert plus the intermediate certificate. what’s missing is Let’s Encrypt’s Root certificate to validate the intermediate certificate and thus complete the chain of trust.
Believe it or not, my home network actually used Radius authentication many years ago. Before I got a Nest (which still cannot connect to anything that isn’t open, WEP, or WPA/WPA2). At the time, I assumed the Nest app talked directly to the thermostat. Not true. It just needs internet to talk to it’s servers where it receives the commands and preferences from the app. Armed with that knowledge and recent revelations about the security of WPA2, I set to the task of reimplementing Radius on my network. First, I needed to asses which devices, like the Nest, would be unable to make the transition. Luckily, most of these devices don’t need anything more then internet access. One was moved to a hard line and the last attached to a Radius capable wireless bridge. I added a internet only wireless network for my embedded devices and moved my privileged network to Radius authentication. It was time to change my password anyway. Stay safe!
I just assumed that the problem was related to my recent SSL renewal. Turns out, Google security recently published Distrusting WoSign and StartCom Certificates and removed them from chrome. How did I miss this? It turns out that the SSL on my site has been broken on Chrome for some time. It must be that I have been using Brave recently as my daily browser. I moved this site to letsencrypt.org and it’s working fine for everyone now. I don’t even know how much time I waisted on this one. wow.
Please excuse all the errors while i try and figure out what I did wrong. Brave, Firefox, and Safari users unaffected.