Steve's {C}yber {S}ecurity {B}log

Borrowing IPv6 subnets to circumvent ISP silliness ⛓️‍💥

Fri, 19 Sep 2025 00:00:00 +0000

I recently revisited deploying IPv6 on my home network, having previously been frustrated by my ISP only giving me a single /64 prefix. That remains the case, but I was determined to find some creative ways of dealing with the situation. The solution turned out to involve an Amazon Web Services VPC and a pull-request to the OPNsense project.

Enabling SecureBoot on ARM EC2 instances in AWS

Thu, 04 Jan 2024 00:00:00 +0000

SecureBoot is a way to ensure the integrity of a system by configuring it to only boot if the images (programs) being loaded are signed by an authorized source. This is true of physical machines, but also of virtual machines, and by extension, cloud instances. However, I recently discovered that in AWS, an AMI of the popular Ubuntu operating system, when running on arm64 instance types such as t4g.nano, didn’t have SecureBoot enabled. So I sought to fix that, and discovered that while it is quite simple to do, it’s not very obvious. Here’s a tutorial and some explanation that will probably be useful for x64_64 and arm64 systems alike, but was written purely based on my own use case, so adapt and test as necessary and report back what you find!

GPG: My go-to example for teaching cryptography all-in-one 📧🔐

Wed, 19 Apr 2023 00:00:00 +0000

As I write this piece, I’m preparing for the graduation of some of the first Bachelor of Cybersecurity students from James Cook University Singapore, which means it’s approaching two years since I joined and started teaching Cybersecurity. So now seems like a good time to reflect on some recurring tools and techniques that I’ve found useful so far. This post will focus on one: GNU Privacy Guard (GPG).

Unsurprisingly, cryptography comes up a lot in a course about cybersecurity, so no matter what subjects I’m teaching, there’s often a reason to introduce, or reiterate, some essential concepts. The big three that come up are symmetric/asymmetric encryption, signatures and public key infrastructure (PKI).

Password managers are still a good thing. Here's why...

Tue, 10 Jan 2023 00:00:00 +0000

Imagine, if you will, that dreaded day when you read in the news that the password manager you use has suffered a cyberattack and user data may have been obtained. Imagine feeling some sense of reassurance that the breach isn’t as bad as first thought, only to learn some time later that actually, it was worse than it was initially made out to be. Or, don’t imagine at all, because it happened. Is it game over for password managers? I sincerely hope not.

Research in brief: Stealing fingerprints with smart locks 🔓

Wed, 31 Aug 2022 00:00:00 +0000

In August, I attended the IEEE iThings 2022 conference to present a paper titled “IoT Droplocks: Wireless Fingerprint Theft Using Hacked Smart Padlocks”. If you have access to the IEEE Xplore library you can view the published version. I’ve made an arXiv preprint available as well. If you want a shorter, simpler version, read on below.

The real reason why you shouldn't share OTP codes

Tue, 28 Jun 2022 00:00:00 +0000

One-Time Passwords, or OTPs are a widely used authentication factor in many online services, big and small. When I’m not ranting about them, I actually think they’re pretty good. So, today is not another attack on OTP or multi-factor authentication, but instead, an effort to educate people about how they work and what we need to do to ensure we stay safe. There are some misconceptions out there, so let’s try to correct them.

Do we want software supply chain security or not? ⛓👩🏽‍💻🔥

Wed, 25 May 2022 00:00:00 +0000

The world is built on other people’s code, and that’s a good thing. But sometimes, other people’s code goes wrong, leading to problems and solutions that we’re not entirely in control of. When things go wrong, our trust in the software supply chain goes down, yet we still depend on it. The community is abuzz with discussions about securing the software supply chain. It’s time for me to give my take on it, and I’m putting one-liner install scripts in my crosshair 🎯.

In detail: SCRAM with channel binding

Fri, 06 May 2022 00:00:00 +0000

In January, I asked whether TLS channel binding with strong authentication was the solution to defend against MITM or proxy style phishing attacks. The answer was “yes, but also no”. I will look beyond SCRAM soon, but first I want to fulfil a promise to go into more detail about how SCRAM works, especially with channel binding.

My smart TV remote broke, so I took it apart 📺🛠

Fri, 25 Mar 2022 00:00:00 +0000

This is a story of frustration, confusion and so far no happy ending. It’s a chance for me to wax lyrical about some of the problems I see with modern “smart” consumer devices, but also, give a bit of insight into how things are put together. Let’s start, as many stories do, at the beginning…

Nine things I hate about Multi-Factor Authentication

Wed, 16 Feb 2022 00:00:00 +0000

Multi-factor authentication (MFA) is a critical part of our defence of information systems, but it is far from perfect. I’ve made a list of list of things I dislike about it, not because I think that MFA needs to go away, but because if we can solve some of these gripes, MFA becomes even more powerful.

What is MFA?

When I talk about MFA, I mean the authentication methods that tend to be used in addition to your username/password. Your password is “something you know”, whereas your fingerprint is “something you have”, and a token generation (physical or app-based), is “something you have”. By combining these somethings, authentication is stronger, because the likelihood of an attacker being able to compromise two (or more) of these simultaneously, without being noticed, is much lower.

Channel Binding: Should you be using it?

Tue, 25 Jan 2022 00:00:00 +0000

Authentication and in particular passwords are the bugbear of many cybersecurity professionals. For all the encryption, firewalls, IDS and other defences we put in place, if authentication doesn’t do its job properly, or a user’s credentials get stolen, a compromise is very likely.

In the future, we might embrace password-less authentication, relying instead on biometrics, tokens and smart devices in various combinations. Indeed, some platforms do this already, but not all. Password’s aren’t going to disappear any time soon.

VPNs Considered Harmful

Sat, 20 Feb 2021 00:00:00 +0000

The Virtual Private Network, or VPN, has become a familiar term amongst Internet users in recent years. Yet, the secure tunnelling technology has been around much longer. So, why is it popular now, why should this be considered harmful, and what do we do about it?

Take the global Google Trends for the terms VPN, SSL and TLS, pictured below. Comparatively few people seem to care about SSL and TLS, but VPN sees growing interest, with repeated spikes. But what does this mean for VPN?

Meep Meep! A story of certificate (un)verification 🔏📜🔍❌

Sun, 04 Oct 2020 00:00:00 +0000

This article discusses the lack of certificate checking done by ACMEv2 clients, as well as the lack of provision in the ACMEv2 protocol specification to encourage any checking. This article explores the implications of this, and demonstrate why we should probably being doing some additional checks in our ACMEv2 clients.

The project is called “Meep Meep”, because that’s the sound a roadrunner makes. The author couldn’t think of a cleverer name for something related to ACME. There’s already a Go client library called meepmeep, last worked on in 2018, proving that all ideas are derivative.