Recent content on Irresponsible Disclosure
VyOS is a free Linux-based distribution that can turn any regular computer or virtual machine into a fully-featured router. By combining existing open source software into a single image, and tying it together with a single configuration file, upgrade mechanism, and an automation API, it makes the job of network engineers and sysadmins easy. It’s been a few years since I last used it, after…
Setting up and maintaining access networks today requires double the effort due to the parallel coexistence of IPv6 and IPv4. Dual-stack has network engineers and sysadmins do twice the amount of work, so there must be a good reason for it, right? The answer is “probably not”! The IPv4 network is not really needed, with the exception of LANs with devices that do not support IPv6 after…
Getting a fiber Internet connection to your home is a big deal! It’s probably the last physical connection you’ll ever need, due to the virtually unlimited bandwidth, stability, performance, and attainable speeds. Having your ISP drop it off on the building entrance however is not enough. Wiring within a building is often needed, especially if you need to reach apartments, mechanical…
For TLS to be able to encrypt connections between two communicating devices, by far the most common authentication method is X.509 Certificates . They have been around for decades and have supported the move to an encrypted web. The job of certificates is to bind two things together: a cryptographic key and an identity. They serve as a document that tells us that, for example, the public key…
There are currently over 1,100 Internet Exchange Points around the world according to PeeringDB . These Internet infrastructure locations serve as a meeting point for networks all over the planet, allowing for cheap (or free!) exchange of low latency traffic. The idea is simple: if a lot of networks are in the same datacenter, why have them spend a fortune connecting to each other with direct…
Over the past few years I’ve been building a significant infrastructure that contains a network with great connectivity, state-of-the-art compute capabilities based on Kubernetes, and a lot of automation to keep it running. This serves as a great testbed to experiment with and implement all sorts of technologies, including a Zero Trust security model. That’s increasingly more popular…
Today I received an e-mail from a website I am using regarding a data breach that seems to have leaked the user database. The message was well written, and it prompted users to reset their passwords and enable 2FA. That’s great, right? In this post I’d like to argue that blindly moving to password resets and calls for 2FA isn’t necessarily the best first step for such situations.…
With the release of RouterOS 7.1, MikroTik added L3 HW Offload . But what is that? In order for a router to deliver packets correctly, for each one of them that arrives in one of its interfaces, it needs to look up at the destination IP address, and then determine what is the right port that it should go out of. In order to decide, it uses an internal table, the routing table. This contains the…
DISCLAIMER: I am currently working for Google. This post is published in my personal capacity, without using any knowledge I may have obtained from my employment with them. All the information provided here is coming from purely personal time and effort and does not represent the opinions or practices of my employer. In my previous blog post I described how I built my own ACME CA to issue workload…
DISCLAIMER: I am currently working for Google. This post is published in my personal capacity, without using any knowledge I may have obtained from my employment with them. All the information provided here is coming from purely personal time and effort and does not represent the opinions or practices of my employer. ACME, standardized in RFC8555 , provides for a way of automatically issuing…
DISCLAIMER: I am currently working for Google. This post is published in my personal capacity, without using any knowledge I may have obtained from my employment with them. All the information provided here is coming from purely personal time and effort and does not represent the opinions or practices of my employer. We use X.509 certificates everywhere today, many times a day, without knowing so.…
DISCLAIMER: I am currently working for Google. This post is published in my personal capacity, without using any knowledge I may have obtained from my employment with them. All the information provided here is coming from purely personal experience in dealing with this issue. There are probably infinitely many reasons why one might want to know the approximate location of a device based on its IP…
Thanks to Apple, a lot of modern printers and scanners today come with AirPrint and AirScan, which allows seamless operation of capable devices over the network, e.g. from an iPhone or a Mac. Linux even went ahead and added support for that and now users of this OS can finally print too :) However, due to how AirPrint works, it does not work across Layer 2 domains such as VLANs, or over IP-routed…
About a month ago, for technical reasons, I was no longer able to use COSMOTE’s CPE in a landline connection with a traditional telephone. I could either spend time and money in the middle of a pandemic, to have contractors visit and route some cables, or, I could take the opportunity and do something I’ve been hearing about recently, which is to switch the service to VoIP, and…
In the early days, when the Internet was just beginning, back in 1981, radio amateurs were allocated, by what is now known as IANA , an IPv4 block for usage and experimentation by all members of this hobby, internationally. This block was 44.0.0.0/8, which is a huge amount of address space by today’s standards, but effectively the only allocation size back then. This network was mainly used…
It is currently 2021, and cryptocurrencies have scored an all-time high in terms of price, more than doubling the previous event that happened in 2017. For the record, a Bitcoin (BTC) went for over 51,000 EUR. Even large companies like Tesla are buying large volumes . So during this time, I was wondering if cryptocurrency theft is also on the rise, because of the increased returns of performing…
Last year (three days ago), I visited 36C3 , the 36th Annual CCC event, held in Leipzig, Germany. This is an event with thousands of attendees, that gather together to attend talks, hack things, create tools, showcase new projects, etc. It is an amazing event, that I simply can’t recommend enough. During this event, the C3NOC , under the trademark CCC Internetmanufaktur™, provides an amazing…
On October of 2019, I attended RIPE79 in Rotterdam, which was a very good experience. I had a chance to meet new people, talk to people I already knew, exchange ideas, and discuss various topics. It’s a very good event, and Ι recommend it, if you can attend. During one of the conversations I had there, ironically with another guy from Crete, Vasileios Kotronis , we discussed about how some…
Welcome to the academic part of this website. Here you can find my academic profile, as well as a list of my peer-reviewed publications, including all the files, in PDF format. My profile on Google Scholar is this . And here’s DBLP . My current academic affiliation is Undergraduate Student, at the Computer Science Department , of the University of Crete . List of Publications A First Look…
If you’d like to contact me, apart from the various social options available in the menu, you can use the following e-mail addresses, which are the preferred methods of communication: Preferred daknob@daknob.net Gmail daknob.mac@gmail.com ProtonMail daknob@pm.me
RPKI , or Resource Public Key Infrastructure, is a way to cryptographically produce and sign messages that bind a particular IP prefix with an originating Autonomous System. It essentially contains the information “ 192.0.2.0/24 up to /24 can originate in BGP from AS64500 ”. Or, “ 2001:db8::/32 up to /48 can originate in BGP from AS64500 ”. These messages, after they are…
In the past few days, a lot of people started complaining about Let’s Encrypt and how it has issued TLS Certificates for PayPal . Various posts like this were written to complain about that, and some people even went as far as writing blog posts for Let’s Encrypt to stop issuing certificates with the word “PayPal” . Apparently, a lot of people agree with this. That last…
The Internet, like almost anything invented by humans, has been used to conduct malicious acts. This can be something not really important like comment spam, all the way to very important cases that are usually investigated by law enforcement like private information and user data theft. While running a Tor Exit Node, I had the chance to witness a lot of that stuff. This, unfortunately,…
Having a firewall is something that’s necessary, in my opinion, for every server. Not only for those with a Public IP Address, for any server. Not only for IPv4, for any IP version. Running a firewall and managing it adds overhead to the server administration and most people either ignore it, or use their provider’s firewall. Amazon and Google have done a great work in pushing people…
In the past few days, a study was released detailing some attacks against the Tor Network . These attacks made it into the news because one could compromise Tor Users’ anonymity by examining the DNS queries from exit nodes. The argument made by the researchers is that while HTTP traffic may be encrypted, DNS traffic is sent in plaintext, and can usually traverse more networks, before it…
The Tor Project is a non-profit organization in the United States that created Tor, The Onion Router, a free software that creates an open network of volunteers which helps people anonymize their traffic by routing it through three or more other computers before it reaches its final destination. Tor got its name from the encryption that happens during the relaying of the information. Every time a…
Earlier this summer, I have participated in the organization of a Capture the Flag competition in Aristotle University of Thessaloniki for students of the Computer Science / Informatics Department . It was co-organized by me, Spyridon Rafail Panagiotopoulos , and Kostas Mpenos , and supervised by Dr. Konstantinos Draziotis . Organizing a Capture the Flag competition is not easy, especially in our…
I spent some time yesterday trying to make an EdgeMAX device, namely the EdgeRouter X SFP work in an OTE ADSL connection. Setting it up is very easy, however I found IPv6 a little bit trickier to implement properly, therefore I am writing this as a documentation (for future {generations, reference}). This tutorial is simple and works on all EdgeMAX Devices like the EdgeRouter X , EdgeRouter Lite ,…
eBay is one of the largest e-commerce websites available, especially to people in countries without Amazon . It does not sell its products directly, but instead relies on its users, therefore making an important distinction between sellers and buyers. Technically speaking there is not any restriction, which means a buyer can sell an item, and, of course, a seller can buy something, however usually…
In my previous post I spent one week without access to non-HTTPS websites. It was difficult, but I managed it. It was a challenge to determine how much of the web is HTTPS yet. It went well, mostly thanks to CloudFlare , but got me thinking about HTTPS again. See, one of the three benefits of using this, more secure, protocol is authenticity. When a website has a valid certificate, there’s a…
As an engineer, I am genuinely interested in challenges. Not necessarily the problem-solving challenges that we can face daily as a profession, but others forms as well. This is why I decided to challenge myself in a computer security related way. For some of my daily Internet browsing, I make use of Google Chrome, and I have the HTTPS Everywhere extension installed. What this browser extension…
Every two years my phone contract expires. This is the maximum duration of a phone contract for an individual so I have to spend some time on updating it every now and then. The problem is that every time there are new offers and usually your old plan is not available. So you have to find a new one. After looking at the new plan catalogue of my carrier, I figured that for the same specs (talk…
The Tor Project is a famous network with an anonymizing alternative routing protocol called T he O nion R outing Protocol. The way it works is several people run Tor nodes around the world and your traffic is being routed through at least three of them, before reaching its destination. Its intended use is to avoid censorship in countries like China, with the Great Firewall, and in general provide…
Movie and TV Show Piracy has been going on for years. There are many websites that offer movie streaming online for free, as well as many torrent sites that provide you with links to download and watch anything. However, even pirates want simplicity and friendly user interfaces from time to time. This is where Popcorn Time comes to play. It provides an easy-to-use, Netflix-style UI for people to…
Nowadays, with all the website hacks the user credentials leaked, a password manager is one of the most valuable assets. It allows you to use a different, ridiculously long and completely random string as a password for every website you visit. That way, even if a website is actually hacked, and the hackers retrieve the password hashes, it would take them billions of times the age of the universe…
Technology has a deep impact in most people’s lives today. We all use the Internet when possible and we seem to do almost all we can online. We pay bills, we buy food and goods, etc. One of the things we don’t do yet is vote electronically for critical elections, like Government / Presidential Elections or a Referendum. In the traditional voting process, millions of euros are invested…
Nowadays, the web is moving towards making HTTPS mandatory across all websites. Initiatives like Let’s Encrypt that offer dead-simple https installation, or Root CAs like StartSSL that offer unlimited free certificates or even browsers like Google Chrome that already started deprecating HTTP all contribute into going towards this direction. Many of us think this is the correct way. An…
Just like a good System Administrator, I set on one day to replace the current certificate for the main site that’s used for HTTPS. I issue a new CSR, I send it to the Certificate Authority, I get the Signed Certificate, Revoke the old one and after a total of 5-10 minutes I have the web server serving the new certificate to all connecting clients. Of course, I need to verify that I do…
Today I happened to visit a store that had the front desk, and a designated area in the back that was only accessible to employees. It had a nice big lock that only opened after successful RFID Authentication. It seemed like a system that may not be trivial to bypass unless you get a card cloner, get the card content and hope it’s not dynamic, and in general it seemed secure.
Introduction In my Department at the University Of Crete we have a set of computers where you can login using ssh(1) and access all your files, write code, run programs, and in general perform all tasks you may need without having to install linux on remove Windows from your computer. For “Security” reasons, these computers are behind two stripped, chrooted “Gates”. You…