Feuerfest

Photo by Pixabay: https://www.pexels.com/photo/an-opened-old-book-161366/

"No one writes down the real reason for infrastructure projects."

Through Mastodon (definitely the better Twitter 😛) I was made aware of the text "The Mystery of the Bloomfield Bridge" by Tyler Vigen.

This text starts humble. It's just someone asking why this particular Bridge was built in Bloomfield, Minnesota (US). As it seemed superfluous and simply not needed.

Spoiler: It was built 70 years ago primarily for children visiting a nearby school (which now seems to be long gone) and the church (still present).

But just when it seems that Tyler Vigen had consulted all sources. Spoke to anyone he could imagine and still had open questions. And, more importantly, was in need of a primary source backing up his theories and link his findings. He received the following tip:

"No one writes down the real reason for infrastructure projects."

What the woman who gave him this tip meant was: Projects (especially civil ones) have a political side which is seldom actively documented. As it was the case with this particular bridge project.

Curiously I first understood it in the following way:

Rarely anyone notes down the volatile Zeitgeist knowledge. The: "We are currently at this point of our journey. We came here because of A, B and C. Now we have the following problem with C. Hence we try D."

But it's this knowledge which enables me to provide better solutions and guidelines to my clients. Contextual wisdom is important.

"Can't you just talk with your client?"

Sure thing. And I do. After all I'm not tight-lipped.

Another aspect which I encounter regularly: There is a plaque at the bridge. Prominently declaring: "Federal Aid Project FAI 494-4-32 Minnesota 1959."
Ok, yeah.. That seems to be the project which built this bridge.
Apart from that? Well, just another cryptic abbreviation which we can use for our research.

Yeah.. And this is usually the time when I tell the story of this big IT company and it's KF1 test environment.

This company switched all its technical systems, all its processes to the UTF-8 character encoding after having used Latin1, also known as ISO-8859-1, for decades. But as UTF-8 provides support for characters from any alphabet & language it seemed only logical to use this. After all it made expanding into markets with other alphabets (like Cyrillic or Greek) easier.

Each and every process was built up a second time in this KF1 environment. Too big was the fear that a single not-migrated process could wreck havoc. Each process was tested end-to-end and all systems were switched during 3 weeks. Which left the company somewhat inoperable for this period.

Sometime during this project I asked: "Hey, out of curiosity what does KF1 mean? What does it stand for? Everyone just uses the abbreviation."

Nobody, not one single person knew it. Some said they did know it. Once. Years ago. After all this project was running for several years. And in all these years no one saw it necessary to note down the full wording of this abbreviation. Not in one single wiki page or document.

And now we are back to our bridge in Bloomfield, the plaque and our quote on top of this article.

Another sad aspect is: Each and every person which Tyler Vigen could have interviewed is dead.
An aspect which I do encounter often in a similar form:
"Oh, we don't know precisely why it was done this way. All colleagues who built this system are in different parts of the company now or have left it."
What do we learn from this? Just because something is as clear to you as glass. And you think it's absolutely obvious, self-explaining and everyone knows it anyway. - Then this is still not a valid reason to not document it.

After all archaeologists and historians can tell you a thing or two about this.

You don't know what I mean with this? Well..

Until today we just don't know what the Xylospongium (a sponge on a stick) was used for in Roman lavatories. (Yes, Wikipedia writes it was used to clean the butt. But (pun intended) this theory is old and doesn't match Roman hygiene customs - as there were only few per lavatory. Current consensus seems to be that it was used like a toilet brush.
But we can't say for sure. We simply don't know as we have no reliable primary sources.
Oh.. No. Wait, we do have some. They complain that the Xylospongium is often used in a wrong way - but WITHOUT describing how this misuse looks like. (Sounds familiar to you? 😂)

And now don't get me started on the roman dodecahedron.

Made by myself https://admin.brennt.net/bl-content/uploads/pages/44e0aefb15224b22617e9f62071dda3f/uuid.jpg

This is a rant about software.

Dear Software-Vendors,
when you write that your software expects an UUID. Then please make sure that YOU actually first understand what a UUID is. Or to be precise: How the syntax of an UUID looks like and what it tries to achieve (the semantic of a UUID so to speak).

This is a UUID: 550e8400-e29b-11d4-a716-446655440000

That is: EIGHT DASH FOUR DASH FOUR DASH FOUR DASH TWELVE.
Repeat after me: 8-4-4-4-12

All those numbers are represented by strings consisting of hexadecimal characters. Meaning each and every character can either be 0-9 or a-f (NOT a-z because that wouldn't be hexadecimal).
There is no "It has to be a 3 at the seventh position". No. All hexadecimal, all random. Well.. In UUID v4 at least. But for the sake of ranting I won't go into detail here.
You can accept upper and lowercase but that is not allowed to matter.
Similarly like upper-/lowercase in emailadresses doesn't matter.

If you request an UUID of: 9-3-4-4-12

AND/OR

expect the first character to be an upper or lowercase character

AND/OR

you accept characters from A to Z...

Then you should be ashamed and I have no words left for you.

If you then follow up with: "But it's for sEcUriTy! z0mg!" No. Just no. Stop that. Seriously.
That's just your carefully chosen incompatibility (to keep your users nicely tucked in your software ecosystem) and FUD (Fear, uncertainty and doubt). But nothing else.
Also you just broke every single tool out there which verifies and checks UUIDs. Which actually comes in very handy in.. Uhm.. Software-Security? Like you know.. Don't use the same UUID twice, etc. Or Code-Linting tools and the like - which are part of the OPERATIONAL security of your customers.
So please: Stop that BS. Seriously.

Please: Don't be that kind of software vendor. Thank you, please make sure to visit my TED-Talk. 😂

Don't get me wrong: You can make up your own unique identifier syntax. But then: DON'T call it UUID! That name is standardized world-wide with the OSF, IETF, ISO and probably many other important standardization organisations.
Instead: Feel free to create a new one of this lovingly VS3LA's (Vendor specific 3 letter acronyms) which every software vendors seems to like..
Then at least every IT person will know that we are talking about something different.

Photo by cottonbro studio: https://www.pexels.com/photo/man-observing-woman-through-doorway-8626372/

When Apple introduced the AirTag (see Wikipedia) it was primarily marketed as a "Find your device/stuff" product. Allowing you to locate the item to which the AirTag is attached, even when it's hundreds of meters (or kilometers) away. As long as there is some Apple device which receives the Bluetooth signal and forwards this to the Apple servers, you will have the location of the device. Of course, depending on time passed and location it can be inaccurate. But in our connected world it's likely that some device will pick up the signal again and you'll have up-to-date location information.

Additionally AirTags can produce a sound, so that you can get a audio hint on where the device is.

AirTags do have many useful cases. From tracking your stolen bike (if you hide some AirTag on/in it), to locating your lost luggage at an airport.. Even pets! Sure this is useful. But sadly.. The principle of dual usability is real and hence even in the beta phase Apple already rolled out a feature that allowed you to view all AirTags in your vicinity. As the potential for illegitimate usages was too high, to simply ignore it. After all.. Watch someone retrieving money at an ATM, occasionally bump into this person and put an AirTag into the jacked of that person. And then just follow and wait until this person is in some place where there are no cameras and/or eyewitnesses. Or think about the whole stalking and Online-Dating problem.

No, AirTags can be a security and privacy disaster. I'm sure many of you have read the story about Lilith Wittmann, who used an Apple AirTag to uncover an office of a secret german intelligence agency (article on appleinsider.com) or read the original german article, published by herself, here: Bundesservice Telekommunikation — enttarnt: Dieser Geheimdienst steckt dahinter.

Ok, so Apple has this feature included in iOS for it's phones/tablets, etc. - What about Android?

Good things first: Apple and Google recognized the threat and are working together towards an industry specification which aims to put an end to stalking via AirTag and similar devices. But, as this has just been announced in May 2023, it's still too early to have produced any meaningful results (sadly).

Apple press release: https://www.apple.com/newsroom/2023/05/apple-google-partner-on-an-industry-specification-to-address-unwanted-tracking/
Google blog post in their security blog: https://security.googleblog.com/2023/05/google-and-apple-lead-initiative-for.html 

Well, Android being the fragmented Android market it is, not every manufacturer has such an option included. I know that Google Pixel devices have such a feature. And I was told Samsung and OnePlus phones too. But there are many other Android versions around. And: What about custom ROMs? I use LineageOS on my OnePlus phone and wasn't able to find such a feature. That's why I searched for an app that does this for me, and was pleasantly surprised to find one.

AirGuard is even released for iOS and there it's also able to find trackers which Apples feature won't detect. So.. I guess this is a recommendation to install this app on iOS too.

Introducing AirGuard

AirGuard is an Android app, developed by the Secure Mobile Networking Lab (SEEMOO) which is part of the Technical University of Darmstadt - specifically their computer science department. You may have heard from them occasionally as they regularly find security vulnerabilities in Apple products and do a lot of research on Bluetooth and Bluetooth security. The neat point? AirGuard is OpenSource, it's code is being published on GitHub. This allows me to install the App using F-Droid (which only offers OpenSource apps).

The icing on the cake? It can not only track Apple AirTags, but Samsung SmartTags and Chipolo Tags too.

From here it's just a normal app installation. Allow the app to use Bluetooth, disable battery saving mechanisms (so it stays active while being executed in the background) and that's it.

As I own no AirTag or similar device I can't test it, but I will update this article when I was able to test this.

If you want to stay up-to-date with the development, there is a Twitter account for that: https://twitter.com/AirGuardAndroid

Photo by Pixabay: https://www.pexels.com/photo/black-android-smartphone-on-top-of-white-book-39584/

Too Long;Didn't Read (TL;DR):

You can omit the steps listed below. If your 2FA/OTP App allows to specify the secret key, type, algorithm and interval use the following settings for LinkedIn:

Type: TOTP
Number of digits: 6
Algorithm: SHA1
Interval: 30 seconds

Original article

I try to enable Two-Factor-Authentication, or 2FA in short, on any of my accounts that supports it. But: I dislike it, when the 2FA-Codes are sent via Mail or SMS. This is just too insecure as both can be intercepted. And personally I would go so far to say "SMS & Mail isn't a valid & secure second factor." As there are too many reports how scammers and phishers intercept SMS or mails. Yet many companies still default to this. LinkedIn too.

Therefore I wanted to switch to my Authenticator App of choice: FreeOTP - https://freeotp.github.io/
The source code is on GitHub: https://github.com/freeotp

It is completely OpenSource (sponsored by RedHat) and even available in the alternative Android App-Store F-Droid, which only offers Apps which can be build completely from source.

As naive as I am sometimes I thought it's just the following steps:

1. Enable 2FA in my LinkedIn profile
2. Provide password to authenticate
3. Scan the QR-Code in FreeOTP
4. Enter the generated code to verify it works
5. Generate & Save the backup keys in my password manager

But not so on LinkedIn. They don't display a QR-Code. Well.. To be precise. They did. Before Microsoft bought LinkedIn. After that this changed. Nowadays they only display you the so-called secret key (encoded in Base32) and that's it.
Then LinkedIn tells you to install the Microsoft Authenticator App, while mentioning, that you can, of course, use any other Authenticator App.

The problem? The described workflow on what to do with that key only works in the Microsoft Authenticator App.
Side-Note: Someone told me Google Authenticator should be able to use that code too. But I can't verify this.

LinkedIn gives you absolutely no additional technical information.

• No otpauth:// URL
• No information if TOTP or HOTP must be used
  • Well, to be fair, we can safely assume it's TOTP.
• Which algorithm must be used?
• What is the lifetime (interval) of the generated codes?

Nothing. But this is what I need with FreeOTP. I tried a few combinations, but had no luck.

So I resorted to the Linux command-line.

1. Enable 2FA in your account until the secret key is displayed
2. Install qrencode (or use one of the available Web-Generators for QR-Codes at your own risk)
   • Source Code is here: https://github.com/fukuchi/libqrencode but every major Linux distribution should have a package available
3. Build the following string: otpauth://totp/LinkedIn:MyAccount?secret=KEY-YOU-GOT-FROM-LINKEDIN
   • All in one line, no spaces at the end, no enter.
   • You can change "MyAccount" to something more meaningful like your mail address
   • Example: otpauth://totp/LinkedIn:JohnDoe@company.tld?secret=U4NGHXFW6C3CLHWLQEVCBDLM5FQMAQ7E
4. Paste that string into a textfile.
   • Again, no enter or spaces at the end
5. Execute: qrencode -r /path/to/file.txt -t png -o /path/to/image.png
   • This will generate a PNG-Image at the location specified by the -o parameter
   • -r is the input file containing the string
6. Display the QR-Code and scan it with FreeOTP
7. Verify the code works
8. Generate your backup keys and save them in your password manager
9. Profit!

Some documentation regarding the otpauth:// URL, it's syntax and the parameters you can use is available in the old Google Authenticator repository on GitHub: https://github.com/google/google-authenticator/wiki/Key-Uri-Format
(Google Authenticator once was OpenSource too, but sadly isn't any more.)

And while at it, I created the corresponding GitHub Issue for the FreeOTP project #360 [Feature-Request] Allow adding of entries by just specifying label & secret to properly take care of this nuisance. ;-)

Lessons learned

FreeOTP assumes the algorithm of SHA1 and an interval of 30 when these parameters are not part of the otpauth-URL. Choosing these works out of the box and I can omit the QR-Code step this way.

Photo by Tima Miroshnichenko: https://www.pexels.com/photo/close-up-view-of-system-hacking-in-a-monitor-5380664/

This was a question which came up recently and while I could have given the answer based on my experience where these two strings commonly occur, I never really researched the initial origin.

Turns out rc has quite a heritage. Quoting from the Indiana Universities Knowledge Base:

runcom (as in .cshrc or /etc/rc)

The rc command derives from the runcom facility from the MIT CTSS system, ca. 1965. From Brian Kernighan and Dennis Ritchie, as told to Vicki Brown:

"There was a facility that would execute a bunch of commands stored in a file; it was called runcom for "run commands", and the file began to be called "a runcom". rc in Unix is a fossil from that usage."

Note: The name of the shell from the Plan 9 operating system is also rc.

And then I learned about the Plan 9 OS of which I've never heard before: https://en.wikipedia.org/wiki/Plan_9_from_Bell_Labs

For .d there is not a real distinctive answer. It seems the common consensus is that it originated from /etc/rc?.d as to have a directory for runcoms and to distinguish it from a normal daemon configuration file - as these are typically stored under /etc. And/or to prevent naming-problems, as files & folders can't share the same name under Unix/Linux the .d as indicator for a directory was added.

And from there this mechanism was used for other daemons as well. What seems to have started as /etc/rc1.d, /etc/rc2.d, etc. as a way to separate runcoms to be executed on different runlevels, became commonly used today for the configuration of daemons/services.

Today a something.d directory holds configurations files for the something daemon. The advantage is that you are able to split your configuration in different files. Making it, for example, easier to deploy only certain files to certain hosts via your configuration management tool of choice (Puppet, Ansible, Chef, etc.). Additionally it's easier to spot configuration errors in a relatively small than in one big "contains it all"-file.

Photo by Monstera: https://www.pexels.com/photo/woman-holding-book-with-blank-pages-6373293/

When creating links in TinyMCE the link-plugin is configured to open links in the current window. As this is the default setting. However I don't like this and changed it every time. And when you change something every single time, you should just make it your new default.

Luckily TinyMCE has good documentation about every plugin. So we learn about the default_link_target parameter we can utilize to achieve exactly this.

We open the bludit-folder/bl-plugins/tinymce/plugin.php file and search for tinymce.init. Then we add the default_link_target: '_blank' parameter at the end of the list. Don't forget to add a semicolon behind the formerly last parameter.

In the end it looks like this:

        tinymce.init({
                selector: "#jseditor",
                auto_focus: "jseditor",
                element_format : "html",
                entity_encoding : "raw",
                skin: "oxide",
                schema: "html5",
                statusbar: false,
                menubar:false,
                branding: false,
                browser_spellcheck: true,
                pagebreak_separator: PAGE_BREAK,
                paste_as_text: true,
                remove_script_host: false,
                convert_urls: true,
                relative_urls: false,
                valid_elements: "*[*]",
                cache_suffix: "?version=$version",
                $document_base_url
                plugins: ["$plugins"],
                toolbar1: "$toolbar1",
                toolbar2: "$toolbar2",
                language: "$lang",
                content_css: "$content_css",
                codesample_languages: [$codesampleConfig],
                default_link_target: '_blank'
        });

And now generated links will per-default open in a new window.