408 karma · joined April 17, 2008
https://stackoverflow.com/questions/48100009/how-to-enable-e...
My wife has an old fitbit like app that tries to connect to China every 2 seconds. Papertrail is really useful to see patterns. I blocked outbound to every single country except for the country I live in (the embattled country of Binomo). Once I allowed the US and EU, it has been interesting to learn if a site is not US or EU.
These are the domains this week that were blocked leading me to allow a few more countries.
fromdual.com - Switzerland
mysqltuner.pl/scaleway.com - France
canary.tools - Ireland
rsyslog.com - Germany
Note here is a post from way back when I asked if anyone did what I wanted for my child.
I can't include the full url here because my posts don't show up. I assume because I posted about it too much or some vast right/left wing conspiracy against my startup :)
DnsLearning.org is looking to hire remote founder #3. We often work long hours on Saturday, but we have a lot of fun solving problems that involve DNS, Linux, MySQL, bootstrap, iOS, Android, etc.. Founder #2 is interviewing today with one of the big 5 tech companies which means we need another founder who can manage at least one of the following areas: PHP, iOS and Android. Git experience and Linux skills are important. We are also interested in a founder who can fully manage a professional Kickstarter/Indiegogo/Fundly launch.
DnsLearning was created to help parents who have young kids whose minds are beginning to be taken over by YouTube's deep neural network recommendation system. In other words, we are trying to restore some balance between how much time a young child spends watching minecraft videos vs the time spent on education sites like DuoLingo and Khan Academy.
Our tech works by setting a child's computer or tablet to use one of our DNSLearning servers. After 30 mins, the server will switch the device from "play mode" to "learn mode". In learn mode, entertainment sites are blocked. When the user earns a few points on one of our supported education sites, we will detect this and switch the device back to play mode. It only takes 3 or 4 mins for a child to earn enough points to get back to play mode.
Real marketing will begin once the apps are 100% ready. Currently we have 130 users that have signed up to use our app manually, using manual DNS config. Android and Apple apps are very close to being feature complete.
A few tech details about us:
There are always interesting PHP, C++, MySQL, iOS and Android problems to solve. For example, how do you uniquely identify different users coming from the same IP address in Android, iOS, or using a manual DNS setup? For manual DNS, our answer is to use a separate server for multiple users in the same house. If a customer has IPv6, we are able to assign a unique IP address to every customer. It is easy to assign hundreds of IP addresses to a single server. One of the problems we had to solve with IPv6 has to do with knowing, in our C++, what address the incoming UDP packet used to access the server. When we were working on this problem, the Linux kernel did not save this information. Last time I checked, Go still does not support this. Ngnix added similar support only a few months before we did.
We are looking for a hard working, passionate co-founder WHO BELIEVES LIKE WE DO, that parents deserve technology that is able to guide young minds away from junk grade online entertainment toward, at least for a few minutes, education sites that will help young minds to develop confidence and skills to hopefully provide a stronger knowledge foundation that is critical for their future.
support@dnslearning.org
whitelisting with modsecurity tutorial...
https://www.netnea.com/cms/apache-tutorial-6_embedding-modse...
Step 8: Writing simple whitelist rules "Using the rules described in Step 7, we were able to prevent access to a specific URL. We will now be using the opposite approach: We want to make sure that only one specific URL can be accessed. In addition, we will we only be accepting previously known POST parameters in a specified format. This is a very tight security technique which is also called positive security: It is no longer us trying to find known attacks in user submitted content, it is now the user who has to proof that his request meets all our criteria."
"Our example is a whitelist for a login with display of the form, submission of the credentials and the logout. We do not have the said login in place, but this does not stop us from defining the ruleset to protect this hypothetical service in our lab. And if you have a login or any other simple application you want to protect, you can take the code as a template and adopt as suitable."
SecRule REQUEST_FILENAME \ "@rx ^/login/(displayLogin|login|logout).do$" \ "id:10250,phase:1,pass,nolog,tag:'Login Whitelist',\ skipAfter:END_WHITELIST_URIBLOCK_login"
# If we land here, we are facing an unknown URI...
Troy, I think you have done a lot of good for infosec. Thank you. Here are my thoughts: You will be in a room full of lawyers. Examples that they understand are important. For example, (Full credit to @strandjs 2017 DerbyCon keynote) in the Crowdstrike v. NSS labs case, they sued to prevent "third parties to access or use the products" and prohibited "any competitive analysis on the product".
Sorry to get into the weeds here, but the TL/DR is the following.
- Delaware District court Judge Gregory Sleet's ruling supporting product performance assessments.
- Government funding to support projects like ModSecurity that contribute to US economic security.
- Whitelisting (that works) is the future.
Today's security vendor marketing seems to have a free pass to lie. Thankfully, on 2017-02-13, Judge Gregory Sleet of the Delaware District court ruled against Crowdstrike writing "The consumer review fairness act of 2016 underscores the public's interest in performance assessments. The new law voids provisions of form contracts that restrict a party to that contract from conducting a performance assessment of or other similar analysis of..." "The court finds the public has a very real interest in the dissemination of information regarding products in the marketplace." It goes on to say if NSS's data is inaccurate, Crowdstrike could publicly rebut that data with evidence and the public would benefit from the exchange helping inform the public if they should trust future NSS reports. He concludes "the public interest weighs strongly in favor of denying Crowdstrike's motion." https://www.csoonline.com/a...
Security is hard. I have been researching the Apache Struts2 exploits that Equifax was hit by. Assume another vulnerability like this exists right now. It could be Struts or some other web framework. Webshells used in the Struts hack are really hard to stop for many reasons. As far as I understand, if ModSecurity's open source web application firewall was installed and properly configured (not a simple task), the CRS (core rule set) would have prevented the Apache Struts2 exploit from working. Open source projects that make major contributions to protect United States national and economic security should receive more support and funding.
As a recognition for the contribution of all open source, Richard Stallman and Linus Torvalds should be recommended to receive the Presidential Medal of Freedom.
ModSecurity works by looking for known malicious patterns and blocks them. I hope one day we can get web application firewalls to work well using a whitelist setup. Instead of trusting everything and blocking things that look bad, on highly sensitive systems like Equifax, I hope to see a way to trust nothing and allow traffic that is known good. For example..
import re
def findWords(string1):
return re.findall(r"\b[^\d\W]+\b",string1)
data = f.read()
data = data.upper()
answer = findWords(data)
for a in answer:
print(a)
$ python3 words.py | sort | uniq -c | sort -n
The next step is to create a modSecurity rule that uses the same regex "\b[^\d\W]+\b" to only allow REQUESTS that contain words that are on an approved list using the @pmf parameter file as in this following example. Note I just started looking into this, so I will leave the rest as an exercise for the reader :)
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf windows-powershell-commands.dat
See github owasp-modsecurity-crs/rules/REQUEST-932-Application-ATTACK-RCE
https://twitter.com/DnsLearningOrg/status/919058340168306688
Referenced time line.. https://dnslearning.org/img/myTimeline.html
With regards to device hopping, try getting a spare router and setting it up then changing the Wifi password so kids only have access to the single router. Some routers will also enforce DNS packets (so even if they modify the DNS in their phone or tablet it will not work)
I agree we are not a replacement for parenting in general. We are a tool. We think parents want to be better at managing this but don't have the tools to do it. Even the best solutions available we could find require setting strict schedules or constantly being pestered to turn a site on or off.
Also we provide the ability to modify how long they get access for. It defaults to 30 minutes right now, but I would suggest setting it higher if you think they will put up a fight. What I have seen (even with myself) is virtually any amount of time limit will eventually invoke the "Why am I watching this?" effect since you value the time more if you work for it.
With regards to phones we have an Android app right now and are in the process of finishing our iOS app. Both platforms support installing an app that requires flashing the phone back to stock to disable it. We have tested this on both platforms but not yet enabled it since it complicates things and we are still getting what we have working. Also our apps are a VPN itself, and you cannot have multiple VPNs enabled on either platform. While we currently only use our Layer 2 control in the VPN to enforce DNS settings in the future we can do a lot more.
"...education sites are competing with very powerful algorithms that are designed to keep users watching video after video. If youtube starts encouraging users to do a few Khan Academy problems before watching the next video, I will consider our project, DnsLearning.org, a total success"
If you pay attention to malware analysis you will see raw IP addresses and random domains are very common in malware. I think corps should enable their outbound firewalls. Problem now is whitelisting each IP is way too much work.
My tests show a C++ DNS proxy can be used to whitelist IP addresses to ipset hash in iptables just before the DNS proxy responds to client. Raw IPs are now blocked and firewall outbound is coupled to your trusted DNS provider.
This would massively reduce attack surface to domains your org regularly uses. Not resolving new / young domains is important here.
At this point we can blame DNS and the firewall!
If notifications are enabled, they will know when points are earned on education sites. Parents can easily figure out what's going on and react to it.
This is one reason why squid has a bump splice feature. Look for the SNI in Wireshark then config squid to let Netflix packets go through untouched. I am not aware of any other way to get Netflix and Snapchat to work in a MITM network. My experience is that you have to create a exception and not intercept. Not 100% sure. YMMV.