@TheTunnelix

Phishing Attack – Free Travel tickets with Emirates Airline

12/09/2018 tunnel1234 Add Comment

Today itself, a friend sent me a message about free travel ticket with Emirates airline through WhatsApp. On seeing the URL, I immediately doubt about the authenticity of such kind of strategy spammers are using to make money as well as to harvest data about you. Once you fill in the form, it will prompt you to share the information to 30 people on WhatsApp to get your ticket. Common, this does not make sense at all and I believe that the website should be reported and Emirates Airline to make an official announcement on its website about these scammers.

The message sent to me was in French. Since I’m well conversant in French, I could easily read and interpreted it. The message received is as follows:

“Pour le 33° Anniversaire, la compagnie aérienne *Emirates Airline* donne à tout le monde *2 billets d´avion gratuits*. Récupérez votre billets d´avion immédiatement. http://bit.ly/Emirates-airline”

The translation looks like this in English:

“For the 33rd Birthday, the aviation airline “Emirates Airline” is giving a free *2 air travel tickets. Get your airline tickets immediately. http://bit.ly/Emirates-airline”

If you observed carefully the real URL has been shortened on bit.ly. There is nothing wrong when using bit.ly which is a great tool for URL shortener. However, if you try to access the URL, you will be redirected on http://5ack.com/Emirate/ which is well known for attacks.

Let’s see what does the whois tool said about 5ack.com:

1.According to domaintools.com, the IP Address behind is 107.180.59.131

2. The IP Address 107.180.59.131 is well known for attacks and there is no real information as to who is behind this domain name.

3. Worst, the domain 5ack.com has a history of 55 counts of changed IP addresses.

4. On the following link https://chat.stackexchange.com/transcript/65945/2018/11/14/2 we can see someone has blacklisted the IP 107.180.59.131 who at that time was selling health supplement. Of course, it’s fake again.

Please don’t click on the link otherwise you might eat those baits and be a victim of Phishing attacks. I wonder how come those links ended in Mauritius which is probably due to French-speaking people here in Mauritius. Otherwise, several French-speaking countries in Africa is at risk. I wish someone from the security team of Emirates Airline read that blog and made an official announcement soon about those spammers hovering everywhere on the Internet. Let’s work together for a safe and secure Internet and keep on passing the message.

Category, Security, Uncategorized cybersecurity, security, Spams

IETF 103 hackathon remotely by cyberstorm.mu – Day 2 & 3

12/04/2018 tunnel1234 Add Comment

In case you missed Day-0 and Day-1 for the IETF 103 hackathon by the cyberstorm.mu team, feel free to have a look. I should admit that Day-2 was a more relaxed day for the SSH team compared to those working for the TLS 1.3 and HTTP 451 projects. Several PR’s sent for all the three tracks which are HTTP 451, SSH and TLS 1.3. It’s more about the testing.

It looks that we had enough time to discuss even more about our future move for the next IETF hackathon. All teams were ready with the patches and several Pull Requests sent. We seized the opportunity to discuss several aspects and experience during the hackathon. Overall, the IETF 103 hackathon went well for all the three tracks.

As regards for the NetSSH project which I worked there was a comment from Mzafekas on Github: “

@jmutkawoa thanks much for the PR. Since this is in some means a breaking change, this would be in the next major version.”

I’m glad that we will have the RC4 deprecated in the new version of NetSSH. We had our live presentation remotely from Mauritius during the IETF 103 hackathon live in Bangkok, Thailand. You can view the presentation here:

Prev1 of 1Next

IETF Hackathon Presentations
IETF Hackathons encourage developers to collaborate and develop utilities, ideas, sample code and solutions that show practical implementations of IETF standards. More than 200 participants have gathered in Bangkokl to make the Internet work better. Watch the presentations and awards (0900-1100 UTC) that recognize the work of the teams.

Prev1 of 1Next

IETF Hackathons encourage developers to collaborate and develop utilities, ideas, sample code and solutions that show practical implementations of IETF standards. More than 200 participants have gathered in Bangkok to make the Internet work better.

As usual, someone got an idea to do a mega splash in the pool with the slow-motion video which is pretty nice 🙂

Prev1 of 1Next

Flying the drone at the IETF 103 hackathon by cyberstorm.mu team
mega-splash 1
mega splash 2

Prev1 of 1Next

I’m glad that TheRegister also published an interesting article about RC4 deprecation. At cyberstorm.mu, we are also looking forward to the next IETF 104 hackathon which has been scheduled remotely at Prague, Czech.

MeetUps and Presentations cyberstorm.mu, hackathon, ietf, IETF103

IETF 103 hackathon remotely by cyberstorm.mu – Day 1

11/03/2018 tunnel1234 Add Comment

Day-0 for the IETF 103 hackathon was really fun. We had two first-timers who worked pretty hard. It was really an intense moment on Day 1. Everyone was busy with their projects. I should admit it was pretty intense. Our first pull request was already merged by Muzaffar from the TLS 1.3 whereas kheshav had the testing part to complete for HTTP 451. I already send a pull request for SSH for the NetSSH Ruby library. We discussed a lot on implementation and testing part. Nathan, Jeremy, and Rahul also worked heavily on the TLS 1.3 implementation. For the IETF 103, we decide to skip the interoperability testing and focus more on implementation.

IETF 103 DAY1

‹›×

Flickr Album Gallery Powered By: WP Frank

When it comes to goodies, WolfSSL congratulated us for a good job and sent us several goodies and other stuff.

However, on the SSH side, we have to deprecate RC4 in several projects such as NetSSH and JSCH, a JAVA library. On TLS 1.3, SNI added to Httperf, a TLS 1.3 library is still on progress on CSharp and LUA. We also have one module for Drupal and Django for HTTP 451.

MeetUps and Presentations cyberstorm.mu, hackathon, HTTP451, mauritius, SSH, TLS1.3

IETF 103 hackathon remotely by cyberstorm.mu – Day 0

11/03/2018 tunnel1234 Add Comment

Today is the first day for the IETF 103 remote hackathon in Mauritius. The cyberstorm.mu team is ready to lead and participate in all the three tracks as champions for the event. We have the TLS 1.3, SSH and HTTP 451. All the three tracks are lead by cyberstorm.mu as champions.

Members participating in the event are :

TLS 1.3 protocol

HTTP 451 protocol

SSH protocol

Our first timers for the IETF 103 hackathon is Kheshav Sewnundun, creator of XpressLiteCoin.com and Devops Engineer at Linkbynet Indian Ocean. We also have Diresh Soomirtee, Junior system administrator at Linkbynet Indian Ocean.

Prior before the hackathon, we did some shopping for the basic amenities. We reached at the quarter at a Mauritius Villas, a bungalow in Pointe Aux Piments at around 13:00 hrs. The network was set up with two different ISPs in case of breakdown, we can still be live during the hackathon.

We also celebrated Kifah’s birthday during the hackathon.

At cyberstorm.mu, it’s always the pool that brings more relaxing time. We are also in the Halloween week and some guys even brought their Halloween costumes and went swimming inside the pool.

Most of us already started working on our projects and some pull requests already sent. More testing on progress as well as creating of several patches. We even need to have a discussion on open source licensing to make sure that there are incompatibility issues between different licenses. We made a plan for the three tracks we are championing and it looks to start pretty fine.

By this time, it’s already late here. I really need some sleep to start day 1 for the IETF 103 hackathon 🙂

MeetUps and Presentations cyberstorm.mu, hackathon, ietf

Operation KSK-ROLL by cyberstorm.mu – KSK Rollover Explained

10/17/2018 tunnel1234 Add Comment

The last cyberstorm.mu event was on OpenSource licensing with Dr. Till Jaeger at Flying Dodo, Bagatelle Mall Mauritius. We discussed several issues concerning cybersecurity laws, trademarks, OpenSource licensing issues etc.. Dr. Till Jaeger appreciated the meetup and encouraged us to evangelize more on OpenSource. The event was organized by Loganaden Velvindron member of cyberstorm.mu.

Dr. Till Jaeger and logan with a surprise gift. — Dr. Till Jaeger brought a surprise gift to Logan 🙂

I should say that we were already planning about our next event, hence, a hackathon on Operation KSK-ROLL by the cyberstorm.mu team which was pretty easy, important and successful. Dr. Till Jaeger congratulate us for creating the cyberstorm.mu team. Several pull requests sent to many repositories to encourage developers to adopt the new key.

What is Operation KSK-ROLL?

At cyberstorm.mu all Non-IETF hackathons are usually given a name. This time for the KSK rollover hackathon we have chosen 'Operation KSK-Roll'. Operation KSK-ROLL has been started to make sure that software is up-to-date with the new KSK key.

What is the KSK rollover?

The DNS KSK Rollover happened on 11 October at 11:00 UTC. Rolling the KSK means generating a new key cryptographic key pair (public and private key).

What are those keys?

The public key is distributed to those who operate valid DNS resolvers such as ISPs, network administrators, system integrators etc.. whilst, the private key is kept secret.

If its secret, why do we need to generate another secret key?

For security purpose, the secret key is generated anew and this ensures that DNS resolvers have a more robust security layer on top of the DNS AKA: DNSSEC

What are DNS resolvers?

All websites, example tunnelix.com which is a domain name is behind an IP Address. For your browser to be able to resolve the website, a DNS resolver which is located at several parts of the world will identify the IP with the domain name. Consequently, this will render the website on your browser.

What is DNSSEC?

As mentioned previously, DNSSEC (DNS Security) is a layer added by ICANN to ensure by means of cryptographic keys to ensure an online protection from the provider of the root domain name to your browser.

How will you know if a website is DNSSEC signed?

There is a tool by VeriSign lab which provides DNSSEC Analyzer. You can enter the name of the domain, say tunnelix.com which will analyze the domain show you the public key and the chain from the . (dot), com and tunnelix.com.

Is there another way to verify it?

Yes, you can use the nslookup or dig tool to check it. In the case of the dig tool here is a screenshot.

What is the logic behind the DIG command?

Some years back (the Year 2015), I explained the anatomy of the dig command. You can view more details about the blog post called "Anatomy of a simple dig result".

What is the role of the KSK?

The KSK private key is used to generate a digital signature for the ZSK. In fact, the KSK public key is stored in the DNS to be used for authenticating the ZSK. So, the KSK is a key to sign another key for the ZSK. That is why it is called the "Key Signing Key".

So, what is the ZSK?

The ZSK (Zone Signing Key) is another private-public key pair which is used to generate a digital signature known as RRSIG ( Resource Record Signature). The RRSIG in itself is a digital signature for each RRSET (Resource Record Sets) in a zone. In fact, the ZSK is stored in the domain name system to authenticate the RRset.

What are RRsets?

RRsets (Resource Record sets) is a group of records DNS Record Set (RRsets) with the same record type, for example, all DNS A records are one RRset.

My contributions for KSK ROLL

Please follow me on my Github account. One of the repositories is Nagval which is a plugin to check the validity of one of more DNSSEC domains.

For more information about DNSSEC, ZSK, PSK etc, I would advise to check out Cloudflare which provided a good source of information.

Cyberstorm.mu continue to go beyond and further with innovations and more ideas to protect and secure the Internet. We believe that though we are a small team will be able to recruit more people who are strongly interested in developing their skills to strive for excellence.

I also wish to seize this opportunity to thanks Manuv Panchoo for designing the logo of tunnelix.com