Day-0 for the IETF 103 hackathon was really fun. We had two first-timers who worked pretty hard. It was really an intense moment on Day 1. Everyone was busy with their projects. I should admit it was pretty intense. Our first pull request was already merged by Muzaffar from the TLS 1.3 whereas kheshav had the testing part to complete for HTTP 451. I already send a pull request for SSH for the NetSSH Ruby library. We discussed a lot on implementation and testing part. Nathan, Jeremy, and Rahul also worked heavily on the TLS 1.3 implementation. For the IETF 103, we decide to skip the interoperability testing and focus more on implementation.
When it comes to goodies, WolfSSL congratulated us for a good job and sent us several goodies and other stuff.
However, on the SSH side, we have to deprecate RC4 in several projects such as NetSSH and JSCH, a JAVA library. On TLS 1.3, SNI added to Httperf, a TLS 1.3 library is still on progress on CSharp and LUA. We also have one module for Drupal and Django for HTTP 451.
We are for free and opensource software. We are presenting Mauritius worldwide in the IT sector. We are a Linux and Open source group which is going further and beyond. We believe in collaborative work and team spirit. We believed in running codes. We strived for excellence. We have contributed codes in several popular applications. We have worked on Internet-Drafts. We participate heavily in Hackathons.
The next step of cyberstorm.mu is championing several tracks for the IETF 103 hackathon remotely at Bangkok, Thailand. We have been welcomed by many people both from Mauritius and overseas, even from Silicon Valley, USA. No wonder, our past achievements is now a new step to reach today’s objectives – To focus heavily on research and development. Loganaden Velvindron from cyberstorm.mu mentioned on his Medium blog about the change cyberstorm.mu want to achieve: “The namecyberstorm.mu is an interesting one. It’s about change coming. Don’t get me wrong: I still love hacking. For me, hacking is about finding clever solutions to problems.” The youngest guy from the team is also going to participate in the IETF 103 hackathon.
I thank the guys of the National Computer Board who welcomed me, Logan and Codarren on their stand at the Infotech 2018. For those who are not acquainted with the Infotech event in Mauritius – “INFOTECH is the major annual Information and Communication Technology (ICT) event organized in Mauritius by the National Computer Board (NCB) in collaboration with the Ministry of Technology, Communication and Innovation. The aim is to create awareness on emerging technologies and provide business opportunities in the ICT sector.”
On reaching there, we met with Mr. Ismael and Mr. Riyaad and other staffs of the NCB, who provided us with a huge screen for our presentation and showcase of Linux, TLS1.3, DNS Security, IETF, Google Code-In and Google Summer of code events. I had the opportunity to meet several people including businessmen, students, and other geeks in the Mauritius IT industry.
Next, to the NCB stand, we had the CSE robotics club where I met with Chromiko who gave me some of his stickers. I still have some to share. Who wants one?
I also had the opportunity to shed some lights about Google search methodology and Computer networking with some students.
The Robotics club
Myself with the students
Codarren talking with some students
Logan and Aniket
They are Anup Kumar Khadoo, Shamutally Shahabudeen Mohammad Arfhaan, and Gowardun Madhav who are Computer Networking students at MITD. The following example was illustrated: Imagine you want to look for PDF books on Computer Networking. One of the technique to search more rapidly is by typing:
index of: computer networking (pdf|doc)
In case you want to ignore certain results; assume the word ‘wireless’, we can try this as search techniques on google search engine by typing:
index of: computer networking (pdf|doc) -wireless
We also had the opportunity to talk about computer networking topics such as Wireless Security, Subnetting, and others. Whilst returning home, I seized the opportunity to shoot this beautiful view.
If you think about the number of attacks on the rise in the world, statistics and figures would proved you all. For example, if you think about preventing attacks such as, Man-in-the-Middle attacks, guidance in implementing the right TLS Protocol, formerly called SSL is important. TLS is the security protocol that underlies the web. Passive attacks such as tapping – Monitoring of unencrypted communications, Encryption – Intercepting encrypted information flows, Scanning – Scanning ports connected on the Internet and Traffic analysis – building and processing of information from data analysis are surely on the rise. The RFC 7258 as described emphasised on pervasive monitoring mitigations where possible. Pervasive monitoring is also described as an attack and therefore it is an offence.
In 2017, we had so many cybersecurity disasters – Active attacks such as the Shadow Brokers which claimed to have breached the spy tools of the elite NSA-linked operation known as the Equation Group. We had also the WannaCry which netted almost 52 bitcoins, or about $130,000. The Wikileaks CIA Vault 7 which contains alleged spying operations and hacking tools. The cyberstorm.mu team, clearly reacted on this issue under the Operation Crypto Redemption and submitted several patches and encouraged many Open Source organizations to patch up those vulnerabilities. According to Africa News, only South Africa seem to be impacted. It can clearly be seen that the attackers know which country they are aiming during mass phishing.
AFRICA least hit by WANNACRY – Photo credits Africanews.com
But hey! If you give a thought about it. Did the attackers really aimed Africa? Why Africa was not really impacted? I highly doubt that there was a pervasive monitoring prior to the attack. It may also not be the case due to phishing as it depends who got trapped with the malware. Still phishing on large scale can be behind the intelligence of Pervasive monitoring! On the other hand, Checkpoint demonstrated how the risk is high in Africa with a map below displays the risk index globally (green – low risk, red- high risk risker, white – insufficient data), demonstrating the main risk areas around the world.
Several countries were listed as white due to insufficient data which could account to reliable data about the risk index in the African continent. Of course, it describe active attacks risks in the African continent. Attacks over countries are now evolving. What I mean is that there could be first a pervasive monitoring system which help attackers to move further towards their target for example: When to perform a mass phishing to get more money!
The fundamental of pervasive monitoring remain mostly about building profiles of a person. It is clear that many are vulnerable to these type of attacks due to presence on social media and social networks. A nation can be a target! Staffs from a particular company can be a target! But what is most sensible is when the data from pervasive monitoring has already been processed into meaningful information, attackers can sell those information which cost millions and may be billions of dollars.
Over the past decade, the billion people who live in Africa have experienced the fastest growth the continent has ever seen, and many of its countries (Nigeria, Ethiopia, Mozambique, Guinea) are among the fastest growing in the world. A growing body of evidence backs our view that as Africa’s population doubles to two billion over the next several decades, its GDP will increase from $2 trillion today to $29 trillion in today’s money by 2050. What has changed? Many governments have learnt from their mistakes and seen the positive reform examples not just in Asia, but more importantly in Africa itself, from Mauritius to Botswana and Cape Verde, and now Ghana to Rwanda. In most countries there has been no single reform miracle, like China’s in 1978 or India’s in 1991, but rather a series of small steps which taken together have been just as powerful. – cnn.com
Since Africa is on the edge of a rich economy boom, passive attacks will be on the rise probably from many other countries which will want to invest heavily. But where to invest? How much to invest? The information will be on sale probably from a cheap pervasive monitoring instead of an expensive survey!
We all knew that it is difficult to detect pervasive monitoring. However, I believe that data which had been processed from pervasive monitoring can still be analysed again to understand how it was used. For example: Pervasive data gathered during a previous election campaign comparison with a new election campaign. The dark web is not just being used by individuals. According to Corregedor, private organisations and governments are increasingly using it as a source of threat intelligence.With the threat of cybercrime comes the threat of cyberwarfare, and state-sponsored attacks on multinational corporations or other countries. South Africa, as with any other country, is equally at risk from this kind of threat, Corredegor says, because it is difficult to monitor the dark web for national threat intelligence. – mg.co.za
As first defence, it would be better to adopt TLS to prevent eavesdropping. The use of DNSSEC, SMTP Strict Transport Security and various other security protocols should be taken into consideration. Bear in mind that DNS tells all about you, from where you shop, what you shop online, what web pages you looked out and what you purchased! ISPs should enforced security protocols such as PKIs (Public Key Infrastructure), DANE (DNS Authentication of Named Entities) and DKIM (Domain Keys Infrastructure Mails). Improving internet infrastructure must progress before it is too late. Emails that are not digitally signed are also a good source of data to be processed anew. A simple example of dead.letters can be a source of getting gathering data on the internet.
According to The New York Times, the NSA is monitoring approximately 100,000 computers worldwide with spy software named Quantum. Quantum enables the NSA to conduct surveillance on those computers on the one hand, and can also create a digital highway for launching cyberattacks. A Proof of Concept explained by NetreseC how to detect “Quantum Insert” in the network environment.
One of the various reasons we don’t have much privacy in the online world is that people simply don’t realised the amount of information they leak daily. Worst is when companies leak information of staffs. To resolve such scenarios, since computer today are fast enough, norms to ensure that companies are implementing the use of tcpcrypt can be made mandatory.
This Sunday the 16th of April, I came across an interesting location in the North-East at Plaine Des Roches, Mauritius where electricity is produced through Wind Farms. The company is Quadran which has invested in this environmental friendly interesting project. Quadran is the global actor in renewable energy encompassing hydroelectricity, solar energy, wind energy and biogas. It has 130 collaborators from 13 agencies and subsidiaries in France metropolitan and Outre-mer including Reunion Island. – Quadran.
The electricity is produced by means of kinetic energy from the wind. The wind turns the blades, which spin a shaft connected to a generator which makes electricity. At some moment, when there is not enough wind, a fuel-powered engine will use switch on automatically for some seconds to run the turbine after which, the wind will take over to turn the blades.
I believe that Mauritius which is looking forward for a more eco-friendly island should invest more in these type of project. This project which involves 11 wind turbines with a power production of 9, 35 MW will satisfy the energy consumption of approximately 10,150 people.
However, side effects of wind turbines are not false. According to some source, there are also reports of negative effects on radio and television reception in wind farm communities. Potential solutions include predictive interference modeling as a component of site selection. A 2007 report by the U.S. National Research Council noted that noise produced by wind turbines is generally not a major concern for humans beyond a half-mile or so. Low-frequency vibration and its effects on humans are not well understood and sensitivity to such vibration resulting from wind-turbine noise is highly variable among humans. – www.nap.edu