We are for free and opensource software. We are presenting Mauritius worldwide in the IT sector. We are a Linux and Open source group which is going further and beyond. We believe in collaborative work and team spirit. We believed in running codes. We strived for excellence. We have contributed codes in several popular applications. We have worked on Internet-Drafts. We participate heavily in Hackathons.
Proudly designed by Chromiko, member of cyberstorm.mu
The team met at Flying Dodo, Bagatelle with a sip of Jack Daniel
The next step of cyberstorm.mu is championing several tracks for the IETF 103 hackathon remotely at Bangkok, Thailand. We have been welcomed by many people both from Mauritius and overseas, even from Silicon Valley, USA. No wonder, our past achievements is now a new step to reach today’s objectives – To focus heavily on research and development. Loganaden Velvindron from cyberstorm.mu mentioned on his Medium blog about the change cyberstorm.mu want to achieve: “The namecyberstorm.mu is an interesting one. It’s about change coming. Don’t get me wrong: I still love hacking. For me, hacking is about finding clever solutions to problems.” The youngest guy from the team is also going to participate in the IETF 103 hackathon.
The roadmap of cyberstorm.mu has already been plotted. We believe about us as a team moving in the right direction and showcase Mauritius worldwide. Feel free to join our cyberstorm.mu community Facebook group with a real profile’s name and you would be welcome. We are also present on Twitter and GitHub. Kindly note that all members of cyberstorm.mu have their official @cyberstorm.mu E-mail address. Otherwise, you can also contact us at [email protected]
The hackers.mu team has been participating in several IETF hackathons these recent years. For the IETF 102 hackathon, we focused tremendously on innovation: The goal to create two teams for the TLS 1.3 project, one for the Implementation team and the other is Interop. At the same time, getting hands on the HTTP 451 project. The IETF hackathon encourages developers to collaborate and develop utilities, ideas, sample code and solutions that show practical implementations of IETF standards. It is not a competition but a collaborative event.
For this IETF hackathon, myself and Loganaden Velvindron core members of hackers.mu team decided to lead the event. We searched a marvelous venue at Pointe aux Piments, a remote coastal area in the north-west of Mauritius which was very peaceful and can accommodate the whole team including first-timers of the IETF hackathon for three nights. As regards food, the best place is at Triolet, a village nearby which is famous for street foods including Pizza, Indian food, Grilled, Burgers and Brianis. We also chose that venue as it included a WiFi hotspot, several rooms, bathrooms and even a swimming pool.
On day 1, we all set up our lab environments and since most first-timers were in the TLS 1.3 Interoperability team, a plan was already designed. We knew since the beginning that there would be the logistic issues, so we brought spare laptops, screens, memory card, projector etc.. Logan explained the situation we had to deal with especially when it comes to interoperability to the first-timers. Then, they assigned themselves some tasks. At first, it was time-consuming to get started, but at the end of day1, I can feel how everyone was working as a team and looking in the same direction for the TLS 1.3. On the other hand, Veegish was getting hands-on HTTP 451. Whilst the Interoperability team was having fun, the implementation team, on the other hand, was yet another challenge: Improving source code for TLS 1.3 compat layer.
On day 2, everyone woke up early and went for a morning walk. Afterward, the team was back to coding and debugging. Whilst some were on the implementation and Interoperability tasks, Veegish already advanced on the HTTP 451 project. A debrief carried out by logan to understand where the team stands. We had to constantly evaluate ourselves so that we knew in which direction we are moving. At the end of the day, most of us were already in the pool for some chilling moments. I seized the opportunity to make a Time Lapse video with my iPhone 7+ 🙂
On day 3, the atmosphere was intense. The implementation team needs to make sure the code has been tested and it is running correctly. I was heavily involved in the PHP CURL library part. The testing part was very challenging. At some moment I was so tired and hopeless as the testing part was really complex. At the same time, others were trying to help each other. Kifah was also on some bash scripting for the interoperability part. He wanted to automate some tasks. Logan was also looking at his code and helping the others. Well, at the end of the day we were so happy to be able to accomplish what we had planned. Everyone looked so tired. The only option is to go back to the pool.
We also decided to make some mini videoS to relate our experience during the hackathon. I uploaded the videos on YouTube. You can view it from the playlist below:
On day 4, we packed up to our destination. At that very moment in Montreal, the hackathon was still going on. I reached home at about 19:00 hrs Mauritius time. I was assigned a three minutes presentation for the hackathon carried out by the Mauritius team. It was already midnight. I was so tired. I knew that the presentation had to be carried out. Logan was constantly texting me to make sure that I did not fall asleep. You can view the presentation remotely live in Montreal Canada.
What did IETF hackers say about the IETF 102 hackathon?
“What I think was the most productive output during this time for me was pair-programming…”– Kifah
“I was very excited to be part of the Inter-operability team where I worked with OpenSSL, BoringSSL, WolfSSL, and tlslite using TLS1.3 protocols.”– Jagveer
“Making Internet Protocols great again during the IETF 102 hackathon” – Logan
“Finally after long hours of debugging he managed to test the protocol being used by NRPE locally”– Rahul
“Then… we finally got a Client Hello from Wireshark and made the PR”– Nigel
“At first I thought that it would only be working, working and working but besides of work we started creating bonds.” – Jeremie
“I got a lot of advice, support, and motivation to work with my team members and try to implement on a strategic basis and critical thinking the internet protocols and see their limit on a technical perspective.” – Avishai
“Once OpenSSL was installed, I then performed my first TLS 1.3 Handshake, Resumption, and 0-RTT but did run into difficulties with NSS.”– Chromico
“But while everyone is waiting, we are working. We have reached a deeper understanding of how it will affect our lives.”– Codarren
“IETF 102 was very fun and challenging experience in which I got to work on several opensource projects” – Muzaffar
“At first, I did encounter some issues like parsing JSON files, but I manage to work on those issues”– Veegish
We also had a follower on Twitter appreciating our effort and participation during the IETF 102 hackathon. Thanks, Dan York, senior manager at ISOC.
I’m happy that this hackathon was at the required level. It was a great initiative from the hackers.mu team. No major incidents occurred in our HQ at Pointe aux Piments. Everything that was planned went all and it’s worth investing yourself in this collaborative event.
Apart from the IETF hackathons, the hackers.mu team also focused on internal hackathon either remotely or on-site participation. Another remote hackathon was already in progress since Saturday the 16th of June 2018. It was named Operation JASK – Just a Single Keystroke. Announced publicly on Sunday the 17th of June 2018 after noticing that several Crypto currency mining tools were vulnerable to CVE-2018-12356. By the time, many members of the team were already mobilised even if it was a public holiday in Mauritius. The operation was named JASK – Just a Single Keystroke as the security issues is concerned with the hardening of a regular expression, in particular requiring [GNUPG:] to be at the beginning of a line (^\[GNUPG:\]). We had to fire a single keystroke at the right place to fix a single vulnerability.
Marcus Brinkmann, who is a free software activist explained “An issue was discovered in password-store.sh in pass in Simple Password Store 1.7 through 1.7.1. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extensions scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.”
However, simple the patch is, the attack aimed GnuPG signature verification process which is specific to pass the Simple Password Store. It can give the attacker access to passwords and remote code execution. On theRegister.co.uk – Pass gets a fail: Simple Password Store suffers GnuPG spoofing bug, Loganaden Velvindron core member of the hackers.mu explained “It’s hard to identify just how many downstream projects inherit a vulnerability like the one Brinkmann spotted, but the number of problem projects will likely be non-trivial because the GnuPG cryptography suite has applications beyond e-mail protection.”
Hackers.mu is now looking forward for other hackathons. We are also inviting everyone to meet us at Flying Dodo Bagatelle conference room for the Security Disclosure Process event. Feel free to RSVP on meetup.com and Facebook before attending.
Back to blogging after some days, I still recalled the moments in Dakar, Senegal for the Africa Internet Summit. By the time, so many days already elapsed, many have already blogged about the event and more pictures raining on the social media. Our camera, tripod and laptops were all ready. In case, you have missed Day 0 and Day 1, feel free to click on the links.
On day 2, myself with Logan and Serge made a brief introduction of the Network Time Protocol. Serge explained about the TCPDump and Wireshark tools that we can use to understand NTP traffic. We also made some demo about the NTP packets exchange between the client and the server. The algorithm behind was made clear, brief and concise as without which the hacking part would be difficult. Participants chose their projects for the hackathon. Some registered themselves for the Network Programmability track and the Intelligent Transportation Systems Projects. At the end of the day 2 we were already convinced about the hackathon would be a success. Myself, Logan and Charles decided to have a beer at a nearby restaurant.
Day 3 was the moment where everyone looked forward to hack into the code. The team spirit was here. Everyone was helping each other in their ‘parcours’. For the NTP hackathon, more and more participants start joining the team. Additional chairs and tables were needed. The best idea was to form into groups and this is where things change for the good. Patches start raining. Several tests were also carried out to confirm the code was running.
At the end of the hackathon, each group went to present their project and achievements. Their presentation slides can be viewed on the AIS wiki.
Some interesting links:
More information about the NTP hackathon is already uploaded on the AIS wiki.
The meeting statistics and report can be viewed here.
There is also a blog coverage by Charles from CISCO.
Dawit Bekele speech at the African Internet Summit 2019.
On the last day of the hackathon, Logan, Charles and myself made a video on the hackathon.
More and more pictures:
A big thank to the organisers and sponsors for doing a great job. Also congratulations to the participants for stepping ahead in the hackathon. Looking forward to see you soon in the growth and security of Internet in Africa.
On day 1, I woke up early in the morning and went outside for a morning walk. Everyone in Senegal says Bonjour to each other, irrespective of being a stranger. The people of Dakar seem very polite and relaxed in nature. Whilst walking on the coastal road of Novotel, I admired the beauty of several massive Baobab trees.
Baobab tree coastal road of Novotel
Back at the hotel, the breakfast was delicious with lots of fruits and cakes accompanied with juice. By the time, breakfast was over, it was already 0800 AM. I took a Panoramic view from the back of Novotel.
Panorama picture coastal road of Novotel
I had to get ready as I needed to travel from Novotel hotel to Radisson Blu where the hackathon preparation was going on. I met with Serge-Parfait GOMA instructor at the Hackathon together with Loganaden Velvindron from Afrinic. On Day 1, there were about 15 participants who already registered themselves. We had to prepare for the Hackathon as it needed to be carried out both in English and French.
From Left to Right : Logan, Nitin and Serge
Preparing for the Hackathon demands lots of time and trying to cover the maximum: from the basics until when the code need to be hacked. The project chosen was the NTP client. I created both slides in English and French.
Whilst I was preparing for the slides, Serge was busy setting up the Pidgin channel. We also tested the livestream. I brought a tripod for my Iphone 7 as it’s so easy for live YouTube video broadcast. We also checked out the hackathon room and carried out several tests. We were happy to be assisted by the guys from ISOC who were always there to help. We reviewed the code anew and discussed a little about the RFCs and Internet Drafts for that specific hackathon.
Time for dinner where I met fellows from Afrinic such as Duksh Koonjoobeeharry from Atlassian User group of Mauritius and Afrinic, Tamon Mookoom from Afrinic – That guy is an IPv6 ninja, Charles Eckel from CISCO who was also leading the hackathon on the network programmability track. I also met other persons from the ISOC team and Nishal Goburdhan a FreeBSD evangelist who gave me a FreeBSD sticker.
Panorama view at the cocktail event
By the time, dinner was over, it was already late. I went to meet the ISOC and Afrinic guys who were still working hard to set up the hackathon room. I took a cab and headed directly to Novotel hotel.
