Life anew with MacOS

Change is ubiquitous. And now I find myself with an opportunity to start to use MacOS. Okay. So I have a MacBook Air 13" which I won (yes, I know, I never win things) but I was never able to really use it as others in the household had an a more pressing need to use it.  Plus work provided a windoze box.

I started programming with Windoze 1.0. Now I am using Windoze 10 and I am honestly done with it. I will now try to always use MacOS (BSD with a funky screen manager) or Linux.

Honestly, 30 years is a good try. Its time for a change.

Ok, I have other linux boxes and have been using linux for a while. So its not like I am a noob at it. Plus I have been using various flavours of unix since 1985.

But my main in my face system has always been windows since that is what work always provided.

But now I am done. I returned my last windoze laptop to my former employer (now that is another story) and my new employer will provide a MacBook pro. Sorted.

What will follow are post converting my modern lifestyle to using most MacOS or Linux in my face.

Welcome to Canada, please set your watch back 50 Years

Don't get me wrong. I love my country and (most, I accept the rest) of its people. But I find we have quaint colonial notions and our future will be at risk. Our current Achilles Heel that will hinder our progress moving forward.

That Achilles Heel is our 19th Century electoral system.

Regardless of your political persuasion, you cannot debate the fact that when only 58% of eligible voters vote, and 60% of those people vote against a political party or leader, then that party should not have majority control of parliament. This just happened in Ontario.

This same system rules the provinces (I am not sure about the territories) and the federal electoral system.

I cannot square this circle with the fact that most parties elect a leader on a ranked ballot (one form of proportional representation) and yet the public is misrepresented with a first-past-the-post (FPTP) system.

This, in Ontario, means that 60% of our voices are not heard.

This flawed system will mean that the majority of people will become disgruntled and disengaged with our democracy and this is very dangerous. This will also affect all other services provided to residents, from health, to education.

For us to move forward as a people we must modernize our electoral system to a mechanism of proportional representation. Our future and success are at stake.

Docker, debian (ubuntu, kali etc)

1.  Add the GPG key for the official Docker repository to the system

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

2. Add the Docker repository to APT sources:

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

3. update the package database with the Docker packages from the newly added repo:

sudo apt-get update

4. Make sure you are about to install from the Docker repo instead of the default Ubuntu 16.04 repo

apt-cache policy docker-ce

5. Ensure the version table has all docker.com sources.

  Candidate: 17.12.1~ce-0~ubuntu
  Version table:
     17.12.1~ce-0~ubuntu 500
        500 https://download.docker.com/linux/ubuntu xenial/stable amd64 Packages
     17.12.0~ce-0~ubuntu 500

6. Install Docker

sudo apt-get install -y docker-ce

7. Check to ensure  Docker is running

sudo systemctl status docker

docker.service - Docker Application Container Engine
   Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2016-05-01 06:53:52 CDT; 1 weeks 3 days ago
     Docs: https://docs.docker.com

References:
1. https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-16-04

Muri, Mura, and Muda

Muri (むり), Mura(むら), and Muda(むだ) are terms I learned in Karate but can apply to everything in life.

むり Muri: Overdoing it. Risk of excessive effort or power.


むら Mura: Inconsistency. Risk of inconsistency of performance


むだ Muda: Pointlessness. Risk of wasted effort.

If I was to look at this from an Engineering point of view I would call it: Over-engineered, Buggy, and technical debt. As we gain experience in anything, being a physical skill, or a technical skill we must strive toward efficiency or economy of effort, movement, and energy expended. In that way, we can last longer, deliver more, and deliver better quality.

Win10 Host, Virtualbox, Kali Guest, and Virtualbox Guest Additions Foo REDUX

Here are some additional, perhaps easier notes when attempting to have a kali guest in virtualbox with a adjustable screen size. Note this is required whenever you do a new install or have a kernel upgrade.

sudo apt-get install virtualbox-guest-additions-iso
sudo apt-get install virtualbox-guest-utils
dpkg-reconfigure virtualbox-guest-dkms

Then reboot.

References:

1. https://askubuntu.com/questions/452979/resolution-doesnt-change-when-resizing-virtualbox-window
2. https://askubuntu.com/questions/555264/ubuntu-server-terminal-doesnt-resize-screen-in-virtualbox?noredirect=1&lq=1

No Testing Required

"Our code craft is so good we do not require testing."

Have you ever heard such a load of crap? If you ever hear this in your software development organization don't walk away. Run!

This indicates a few problems:

1. Management. Has Failed. Full stop. Either management has taken leave of their senses or they do not care anymore and are looking for work elsewhere because the children they manage has worn them down.

2. Upper Management. Has also failed. They do not realize that the team will be producing shit and that only developer egos are driving the production. They need to fire people but they are too scared.

3. Education. Is allowing people to enter the workforce without the appropriate humility to solve problems.

So run. You will not be able to fix this problem as it has rotted the entire management chain. Eventually the product and probably the company will fail. Then, and only then will Karma be a bitch. But they will be able to blame others.

Win10 Host, Virtualbox, Kali Guest, and Virtualbox Guest Addition Foo

What a pain. I received a new disk from work and so I decided to reinstall virtualbox and guest additions and start a new Kali guest VM. A fresh start.

I add the guest additions so I can have an adjustable screen size for the VM. I am a visual learner so deal with it.

So when I install Virtualbox it asks if I want the updated guest additions and I say yes which causes it to install in c:\Program Files\Oracle\Virtualbox\VBoxGuestAdditions.iso.

My Kali virtual box needs two things at this point:

1. A cd-rom device enabled. So it can insert the guest additions into it from the Devices menu.
2. No images associated with that CD rom otherwise when you attempt to insert the guest additions it will error as busy.

Once your VM boots, and you select Devices->Insert Guest Additions CD image... you should see a VBOXADDITIONS... CD icon on your desktop.

But your quest has a few pitfalls remaining.

So crack open a bash terminal in Kali and change directory /media/cdrom.

Then attempt to run (as root) VBoxLinuxAdditions.run. It will fail with a you do not have permissions. The image has been mounted without the ability to run anything.

To fix this:

• cd /etc
• vi fstab
• change the line for /media/cdrom0 and replace "noauto" with exec

The line should now look like:

/dev/sr0        /media/cdrom0   udf,iso9660 user,exec     0       0

Then perform a:

umount /media/cdrom0
mount /media/cdrom0

You should now be able to run VBoxLinuxAdditions.run

However that in itself might fail with:

Building the main Guest Additions module ...fail!
(Look at /var/log/vboxadd-install.log to find out what went wrong)

The reason for this is that it is attempting to compile something and it does not have headers to compile with.

apt-get update

apt-get install linux-headers-`uname -r`

Then try again with VBoxLinuxAdditions.run

References:

1. https://forums.kali.org/showthread.php?18973-Issues-installing-VirtualBox-Guest-Additions
2. https://forums.virtualbox.org/viewtopic.php?f=3&t=58799

Google Site Verification with Wordpress

As with all sites that wish to be found praying to the google gods of horrible user interfaces is required. In that there are several meta tags that your site needs to cough up so that the google bot understands this is a site worthy of its consideration.

There is a list of tags as identified in [1] but this post if going to focus on getting the verification code and planting it in a Wordpress site so that it presents it.

First, the meta tag we want to use is google-site-verification. And as with all things Google finding out how to get one varies, is hard to find, and the documentation is contradictory and confusing. This post is a result of the usual Google misinformation so the next time I need this I can .... well....consult with myself. In this case I finally found that the link at [2] helped. And already having a google analytics account allowed me to generate the verification code.

Essentially I did this:

1. Go to Webmaster Central and click Add a site. Enter the URL of your site. https://www.google.com/webmasters/verification/home
2. Choose alternate methods tab.
3. Select HTML Tag

This generates a tag like this:
<meta name="google-site-verification" content="z0TcgvjhJgg3FArBc8j8CAKMMFRpcW6uFBebbHYKRoE" />

Next I installed a Wordpress plugin called "Meta Tag Manager" [3] and entered the tag information there.

Once this was live in my site and every page was providing the meta tag I could click verify in the Wemaster Central page.

Another page will involve the setup for Google Analytics in my Wordpress site.




References:

1. Meta tags that Google understands, https://support.google.com/webmasters/answer/79812?hl=en
2. Verify site ownership on Google Search Console, https://support.google.com/analytics/answer/1142414?hl=en
3. Meta Tag Manager, https://en-ca.wordpress.org/plugins/meta-tag-manager/

Why Your Security Program Fails #1

You have a security group. They are passionate, trained, and competent. But security is still weak based on customer audits. Why?

Reason Number 1:

Your organization only performs security audits late in the quality cycle. Development neither engages nor listens to your security team because of a variety of reasons.

1. A culture of coddling developers so they feel elite, and therefore they know it all so they do not believe they require outside expertise.
2. Your Security team is in a quality group, and are therefore sneered at in North America.
3. Your Agile process has been broken to mean anything to anyone at any given time so therefore its missed as part of the agile cycle.
4.  Your hipster/hideous beard crowd is breaking things at the speed of Google because that's how code is made today.

Based on this any security issue may require a serious redesign. (Really?!, why can't our MongoDB cluster be exposed on the public internet?). Unless of course product managers can sweep it under some other rug.

Blame marketing. That normally works.

Has Your Company made this Traditional Mistake Managing a Security Team

So my background is development. I have been on both Red Team (attacking, pentesting, Threat/risk analysis) and Blue Team (design and implementation of security features, crypto etc). Yet for some reason the Red Team is typically in a quality group.

I can understand why to a point. But in a North American (NA) context where quality is a low priority (based on my experience) this approach is a failure.

Here is why I believe this:

1. In a NA context, there are little expectation of a quality group and are often ignored. They have no seat at the table.
2. Most security issues can be resolved and avoided during architecture. Unfortunately NA development does not engage (and in one of my experiences even purposely avoids a quality based security group) at this time so architectural mistakes are made and technical debt is incurred.
3. Threat models are inconsistent. Because of a low respect given to quality groups in a North American context development groups do not respect any group in a quality organization Therefore, they will not engage and ignore competent penetration testers in group within a quality group.

Fundamentally there is a lack of respect from development management and development members towards quality group members. I know, I have been in both. The different in a NA context is that management has low expectation for quality groups and often put under performing members  there. Development then as a whole has lower expectations and less respect for these organizations.

If you then have a group of well trained hackers in a quality group whose expertise crosses between these two divides then there is a problem. Your development organization will not respect or even listen to them and your product security as a whole suffers.

The bandaid solution is to move the red team group to the development management sphere but this avoids the elephant in the room, mainly the problem with how quality groups are managed and the expectations afforded them.

Throughout my career I have extended respect to all colleagues regardless of their position in the organizational structure. Development, Quality, and support.

However based on the unprofessional behavior of Developers towards colleagues in Quality I now have less respect for development teams. 

It is development who have the problem. And they are the ones that must fix it.

Burp Suite, Firefox, SSL, HSTS, and sec_error_unknown_issuer

If you are using Burp Suite Pro intercepting proxy you will know you have the following chain.

|Browser| <=>|burp|<=>|Target Website|

In an SSL environment burp will send its own self signed cert to your browser while behaving as the client to the target. 

But if the target website uses HSTS (HTTP Strict Transport Security) and you use Firefox as a client then you will have problems. What you will see is a sec_error_unknown_issuer error and no ability to add an exception.

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate. 

Ok, So we know the site is normal - in our case its an internal staging environment. We could use another browser but there is a way to work around this.

Originally I tried downloading the burp self-signed certificate and importing it into the Windoze certificate manager by double clicking the .crt file. However this did not result in any change, I still had the sec_error_unknown_issuer problem.

The solution here is to manually import the Burp certificate into Firefox by:

1. Firefox->Hamburger Menu at Top Right->Options->Advanced->Certificates->View Certificates
2. This will display a Certificate Manager dialog. Select Import and then select the Burp Certificate.

The Attitude Failure of an R&D Shop

So sometimes you overhear things. Sometimes you don't have to try to overhear things. And even sometimes these things are presented to you on a silver platter with a marching band.

This is one of those times as shared by a friend who works somewhere.

So an R&D group is managed from out of town. So there are regular visitors from out of town to see what is happening in that outpost of R&D. These visitors attend meetings and (fanfare) ask questions.

When one of those visitors leave the room a local senior/lead developer states (or rather it falls out of their mouth) for the benefit of the remainder of the local people in the room:

I don't like these visitors showing up, attending meetings, and asking questions when they don't know what's going on.

So there are few points I would like to address regarding this kinds of statement:

1. You do not own the product that you are working on. They do. Get use to questions from them. Or leave.
2. These people sign your paycheque. Get use to answering questions from them. Or leave.
3. You work for R&D. It's not the other way around. Get use to it. Or leave.
4. Perhaps, since they lead R&D,they need to  ask questions so they know what is going on. Get use to it. Or leave.
5. The reason they are asking questions is because you are not communicating with them. So perhaps you need to communicate so they do know "what is going on"? Suck it up buttercup.
6. Perhaps you are so confused and scattered that you yourself do not know what is going on.

Fundamentally this shows an R&D team with a very poor attitude. The question is not who I would fire first but when I would stop.

When You Realize that your development Geniuses are really Asses

So you have a development team. Yes. They are smart. But perhaps not as smart as you think. Regardless they swagger and talk. Controlling your projects and plotting down a path of doom.

But what are the signs that they have gone too far.

Could it be when:

1. They complain of out of town managers (you know, the  ones from head office) arriving and appearing at meetings and asking questions when they don't know anything about how your destroying the projects?
2. They claim they can rely only on unit tests?
3. Perhaps its when they think they can stovepipe code straight to production without a system level test in a staging environment?

If its any of these it probably already too late for you. Controlling their incompetent urges now that the arrogance is out of the bag will just mean they will leave to go destroy another project.

Or perhaps that would not be so bad after all.

Has Your Company made this Traditional Mistake Managing a Team

What traditional mistake is this? Search through your history,  you know its there....just lurking below the surface. Ah. There it is.

The Myth of the Genius Software Developer.

Sometimes it goes beyond myth, to adulation, subservience, and worship. Managers, the incompetent ones, prostrate themselves to the genius software developer thus leading them and their project down the path of doom.

Managers become lackeys.  Sorting the technical laundry too scared that all those eggs that they put in that one basket will fall. Scared that they would loose their genius.

Losers.

All of them.

The Crisis in the Software Industry

To be fair I have not seen this at any one company. I have seen it at every company I have worked for. And as a software developer with 20+ years experience I can also say, in my more immature days, I was guilty of the same sin.

What is that problem that I observe?

Just the arrogant self absorbed know-it-all behavior of  software development shops. Sure, some may be nice people. Some even care.

However I have a slightly different perspective. I have this perspective because I have been within development teams and outside development teams. I was known as the software developer/architect that talked to QC. Talked to support. The response I received from these teams that this was rare behavior.

My observations of development teams are as follows:

1. Do not consult, even if others outside development may have more experience on the technical issues they are working on.
2. Get easily impressed by "cool" technology. Nay, they are a slave to it.
3. Only address problems in how that cool technology can solve it.
4. Are easily impressed by technology that they think the "cool" kids are using.
5. Cannot address the core problem or use case. Unless it is in terms of that cool technology.
6. Cannot address problems with humility and respect. Are treated like unicorns and as such behave like unicorns.
7. Some even have a know-it-all behavior to the point of absurdity - such as the time a colleague announced that HE was a breast feed expert. (His wife was expecting and he read a book on it).

The end result of these issues is a product that has security (amongst other) flaws. By design. Combined with a FISI (F*ck it ship it) management methodology you can understand why shipped or cloud based software is garbage that customers end up becoming the quality testers.

Logging and the haproxy docker container

So you have configured and built and/or run your configuration file in the haproxy image as per https://hub.docker.com/_/haproxy/.

To repeat the steps are :

1. Create a haproxy.cfg file in a local directory
2. Create a Dockerfile in same directory containing

FROM haproxy:1.5
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

3. Build image with  above docker file using

docker build -t myhaproxy .

4. Check that your image with your configuration is in your image list using

docker images

5. Run your docker image....

docker run -d --name my-running-haproxy my-haproxy

Note that you could also mount the volume with the configuration.

But once its running how do you know what the problem is if something goes wrong? How do you access the logs?

Haproxy logs to syslog, so we would need to build our own version of haproxy with a underlying system with syslog configuration changes.

Or we could do this:


1. Change the configuration in haproxy.cfg to log to /dev/log and rebuild your image.

global

log /dev/log local2

2. When we run our haproxy run with -v /dev/log:/dev/log like this:

docker run -d --name my-running-haproxy -v /dev/log:/dev/log my-haproxy

3. See what is happening in your "host" syslog (/var/log/syslog)

References:
1. https://hub.docker.com/_/haproxy/
2. https://github.com/dockerfile/haproxy/issues/3

TightVNC Client, SSH, TightVNC Server

I have to make some notes on this before I forget. This post attempts to be that note.

Perhaps you have a Virtual Private Server (VPS) or just a server out there somewhere in the ether. You want to share or view a remote desktop, but you want a secure tunnel for those bits to travel down. In this scenario your server is a linux (some variant, lets not start a religious war about it) and you installed tightvncserver. In addition you have SSH running. On your client, lets say windows, you have putty and tightvncserver.

For those with OCD here is a recap:

Server:
1. TightVNCServer.
2. SSH

Client:
3. Putty
4. TightVNC Viewer.

The only note I will make about tightvncserver is that you should have it only listen on loopback (127.0.0.1) since this typically is not a service you want exposed. We use '-nolisten tcp' to ensure we do not allow external tcp connections outside of our SSH tunnel.

In /etc/init.d/tightvncserver you would have a start line such as:

su $USER -c '/usr/bin/tightvncserver -nolisten tcp -localhost :1'

On the client follow the instructions at: http://www.penguintutor.com/linux/tightvnc

In a nutshell, you: 

1. In Putty create a session  with a hostname (or IP) and port of the SSH service running on your remote linux box.
2. Select Connection->SSH->Tunnels and enter source port 5901 and destination of localhost:5901
3. Back to session selection in the left pane and type a name for saved sessions and click save.
4. Then Click open for the session and a SSH window to your target should open where you can login.
5. Once logged in there is now a tunnel in place.
6. Run TightVNCViewer and connect to 'localhost:1' 

The End of Democracy in Canada

Prime Minister Harper,

Like you I was born and raised in this country. My Father, a veteran, who volunteered to serve his country overseas, taught me the importance of democracy and to stand up to bullies and tyranny who refuse to allow the difference of opinions in a public forum. He felt it so important that he volunteered to fight against it leaving the comfort of home and family and travelling overseas into the unknown.

Whether you understand it or not, you are taking our country down a very dangerous path. Treating those who believe in protecting some of the last unmolested parts of our wilderness against those who would risk it for commercial profit as criminals and security threats will turn us into a police state. This is important as your government has weakened oversight and protections against large scale destruction of environment and property.

If we do this then what other "thought crimes" will be added to the list? Will it be arguing against cartel bank fees? Will it be disagreeing with new government policy? Will it be voting for a different party other than the one governing? Will it be posting this blog entry?

We may be at the beginning, but you do not know where it will end.

My Father has since passed away and sadly in a way I am glad he has. I would hate for him to learn that the risk he took to defend our democracy has been thrown away by this legislation.

Paying for Skills

Recently I had a lengthy phone interview with a hiring manager from a major telecommunications player. It was an excellent phone conversation on the technical aspects, on the work, and on the team. I was quite interested in the team and the work which pertained to penetration testing and ethical hacking.

That was until I learned how much they paid. For this highly skilled technical team the pay was insulting.

What has happened to IT salaries in Canada? Has the Temporary Foreign Slavery program enabled successful and profitable corporations to decrease IT salaries across Canada by staffing IT positions with falsely skilled labour (by falsely I mean labour that do not have the skills that they advertise usually brought into the country on the pretense that they could not find locally skilled individuals)?

The job we discussed would return me to a salary base I made 13 years ago.

What made this situation all the more absurd and insulting was the fact that the hiring manager spent 15 minutes of that interview waxing on about how successful that company is, how much money they were making on their various product lines. Then they close by offering garbage wages.

The final cherry on top was the statement of holiday where the number included statutory holidays.

Really? I mean REALLY?!

How do companies expect to attract, and more importantly, retain qualified skilled individuals especially security professionals?

Lubuntu, VNC, and SSH

This is a post for remembering. Not that it will be memorable but because I want to remember it. I now have a VPS, and never having played with these things in the past I need to remember what I did to access it. 

Initially I have SSH. So I can access the command line, so I am starting with bear skins and stone knives. What I want to to access a remote desktop securely. This probably means VNC/Vino/other(?) over SSH or SSL.

What are my choices. A "recent" post in the thread at [4] seems to give me the following choices.

• X/Windows nominal forwarding
• VNC
• RDP
• NX

The end result of this post was that you run VNC over SSH. The box already has a SSH server running so then its just a matter of tunneling to the VNC server. And making sure nobody else can use the VNC server. I may change my mind later but for now its VNC/SSH.

1. Is VNC installed on this machine?

dpkg --get-selections | grep vnc

Nope.

2. Is there even a desktop installed?
Ok, I assumed when I said Lubuntu I would get a desktop but no, they installed LTS. DOh!

lsb_release -aNo LSB modules are available.
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

3. Lets install a desktop, otherwise there is little point in this.

sudo apt-get install lubuntu-desktop 
sudi apt-get install lxde

This will take a while.

2. Install VNC server.


apt-get install tightvncserver

3. Create a startup script for tightvncserver
Create a file called tightvncserver in /etc/init.d. Ensure its owned by root and has the right privs using:

chmod 0755 tightvncserver

I downloaded a version from

http://www.penguintutor.com/otherfiles/tightvncserver-init.txt 

and modified it.

Here is a copy of my script.

#!/bin/sh
### BEGIN INIT INFO
# Provides:          tightvncserver
# Required-Start:    $local_fs
# Required-Stop:     $local_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/stop tightvncserver
### END INIT INFO

# More details see:
# http://www.penguintutor.com/linux/tightvnc

### Customize this entry
# Set the USER variable to the name of the user to start tightvncserver under
# This should not be root!!!
export USER=''
### End customization required

eval cd ~$USER

case "$1" in
  start)
# -localhost forces tightvncserver to listen on loopback only, this is for SSH tunnel usage.
    su $USER -c '/usr/bin/tightvncserver -localhost :1'
    echo "Starting TightVNC server for $USER "
    ;;
  stop)
    pkill Xtightvnc
    echo "Tightvncserver stopped"
    ;;
  *)
    echo "Usage: /etc/init.d/tightvncserver {start|stop}"
    exit 1
    ;;
esac
exit 0
You can test the script using start and stop commands. We add the script to the default runlevels using:

sudo update-rc.d tightvncserver defaults 

Notice that in the script I have it listening only on localhost. This is important since I do not want VNC listening on an external port addressable from the Internet. Instead  I will create a SSH tunnel to connect to it from whatever client I will be connecting from.

Setting up the tunnel with putty is a case of setting the tunnels section for the remote and your localhost. In addition I set the normal session parameters for target IP for the server running ssh and the port its listening on. Once I connect with Putty the tunnel is open.




Then I can connect to the server with my tightvncclient using localhost:5901

References:
1. Installing a lightweight LXDE+VNC desktop environment on your Ubuntu/Debian VPS, http://www.vandorp.biz/2012/01/installing-a-lightweight-lxdevnc-desktop-environment-on-your-ubuntudebian-vps/#.VKmmO2MkTzc
2. Setting up an SSH tunnel with PuTTY, http://realprogrammers.com/how_to/set_up_an_ssh_tunnel_with_putty.html
3. Remote GUI access to a Linux computer using Tightvnc, http://www.penguintutor.com/linux/tightvnc
4. Lubuntu/Remote Desktop Problems, http://ubuntuforums.org/showthread.php?t=2231787