The NextLevel Blog

A Virtual Private Network (VPN) secures your own device from other devices on the same local network.
This is done by encrypting all traffic which leaves your machine. After that, only a chosen trusted third party machine can decrypt the traffic again.
This machine will usually be hosted by either a service provider or eg. the IT department of your company.
In this post, I give you some thoughts about when to use a virtual private network and when you are probably better of not using one.

At work

The IT department of your employer might ask you to always use their own VPN solution when connecting with your work devices. They do so to ensure that devices in your own home network do not affect the company — eg. when you are working from home or are on travel.

At home

You might wonder if encrypted network traffic is something you need also for your private life.

If you are at home, I would advise to not use a VPN solution. Probably, this will only bring you disadvantages. For example, VPNs usually have a slower Internet connection, lower bandwidth, or even not functioning things like video streaming. Additionally, there is not much benefit for you. I assume here that you actually can and do trust your own local network at home. If that is not the case — for example your house is full of gadgets from shady market places — then, indeed, a VPN is a good thing to use. However, you should not use these gadgets in the first place.

The situation is different if you are on the go. In public places like train stations, airports, or your favorite coffee shop, you are essentially connecting to a local network which you do not have much control on. Be aware that almost anyone could connect to these networks — their physical presence presumed. Thus, they might be able to tamper with your network traffic, read it, modify it, or reroute it. In these cases, a VPN might save you a lot of worrying as it makes it impossible for locally connected people to harm you. They will only see encrypted bytes on the wire (or in the wifi) which is completely useless to them.

The recommendations differ based on who is setting which kind of trust in your local network. With the company VPN, it is your employer who is not trusting your local network at home. You on the go, instead, should not trust random networks you connect to. But at your own home, you are most likely better of not using a VPN.

Other reasons

Finally, there are further reasons which might require you getting a VPN. For example, it is a solution to circumvent geoblocking on video streaming sites when you are abroad. Maybe you have encountered this already: You are on vacation somewhere in the world and want to enjoy the next episode of your favorite season. However, your streaming service tells you it is only available in your home country. Here, a VPN may virtually transfer yourself back home — or even wherever you could want to be on the world — enabling you to enjoy the next episode.

If you are interested in getting your very own private VPN solution, contact us and we will be happy to help you out.

One first step when attackers try to tinker with your environment is often referred to as “enumeration”. As I am running multiple web services on my own servers, I am of course curious what all this open source software actually does. So let’s start with enumeration of your web servers.
Naturally, I can deep dive into their source code and evaluate their functionality. However, this post shall show you how to find information on your web servers without looking at the code through enumeration.

Port Scanning

Let’s start with a remote test. Currently I am at work and could only scan my home network from outside. Let’s do this.

Looking at my home network from outside, we see that there are several ports open. Let’s redo this detection and try to see wether nmap can get some more information on the services it listed. The -A flag tells nmap to try to detect the operating system, the versions of software used, to scan for (nmap-) known vulnerabilities and to perform a traceroute to estimate our server location. Also, this time I added the flag -T4 which basically tells nmap to use a faster template scheme. This speeds up the analysis but may be less successful in detecting everything.

Host is up (0.011s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE    VERSION
23/tcp   open  ssh        OpenSSH 8.3 (protocol 2.0)
53/tcp   open  domain?
443/tcp  open  ssl/http   nginx 1.18.0
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: nginx/1.18.0
|_http-title: Jitsi Meet
| ssl-cert: Subject: commonName=meet.yourhostname.or.ip
| Subject Alternative Name: DNS:meet.yourhostname.or.ip
| Not valid before: 2020-08-18T12:17:00
|_Not valid after:  2020-11-16T12:17:00
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|   h2
|_  http/1.1
| tls-nextprotoneg:
|   h2
|_  http/1.1
2000/tcp open  tcpwrapped
5060/tcp open  tcpwrapped
8008/tcp open  http
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.1 302 Found
|     Location: https://:8015/nice%20ports%2C/Tri%6Eity.txt%2ebak
|     Connection: close
|     X-Frame-Options: SAMEORIGIN
|     X-XSS-Protection: 1; mode=block
|     X-Content-Type-Options: nosniff
|     Content-Security-Policy: frame-ancestors
|   GenericLines, HTTPOptions, RTSPRequest, SIPOptions:
|     HTTP/1.1 302 Found
|     Location: https://:8015
|     Connection: close
|     X-Frame-Options: SAMEORIGIN
|     X-XSS-Protection: 1; mode=block
|     X-Content-Type-Options: nosniff
|     Content-Security-Policy: frame-ancestors
|   GetRequest:
|     HTTP/1.1 302 Found
|     Location: https://:8015/
|     Connection: close
|     X-Frame-Options: SAMEORIGIN
|     X-XSS-Protection: 1; mode=block
|     X-Content-Type-Options: nosniff
|_    Content-Security-Policy: frame-ancestors
|_http-title: Did not follow redirect to https://yourhostname.or.ip:8015/
|_https-redirect: ERROR: Script execution failed (use -d to debug)

This time some things changed. While in the simple portscan in the beginning, nmap guessed port 23 would be hosting a telnet service, this time it shows us, there is a OpenSSH server with version 8.3 although you would normally expect it on port 22. Second, port 53 seems to host a dns service. Also, nmap detected that port 443 is actually hosting a webserver running TLS and also that there is Jitsi Meet running on it. For ports 2000 and 5060, we still do not know what’s that. Finally, port 8008 has another webserver on it, however we do not have further information on it.

Banner Grabbing

In fact, all of this is correct. But how did nmap get information on the changed port of ssh? The answer here is banner grabbing. That’s the same process that also shodan.io uses.
In short, you open a TCP socket to the port and start receiving bytes from it. I have quickly scripted this in python to demonstrate.

#!/usr/bin/env python3
import socket
import argparse

def main(args):
    addr = (args.host, args.port) 
    s = socket.socket()
    s.connect(addr)
    print(s.recv(1024).decode("utf-8"))

if __name__ == '__main__':
    prs = argparse.ArgumentParser("Banner grabbing in python")
    prs.add_argument("--host", type=str, required=True)
    prs.add_argument("--port", type=int, required=True)
    args = prs.parse_args()
    main(args)

If I run this against the skewed service, we get the same information also nmap got.

So, the remaining question is what changes if we have local access to a server and want to check for available services. Long answer short, not much. I scanned my machine with nmap localhost -A also locally and found some more services which are only published locally or in the internal network. I hope this enables you to get started with nmap and trying to find out, what’s actually on your network. By the way you can also scan a whole network with the CIDR notation like

nmap 192.168.178.1/24

Before your start with happy network scanning, please keep in mind that you should only do this on your own machines and networks.

This post shall give you an overview of methods to assess the cybersecurity risks of your products or services. We will go through the development of risk analysis and try to understand why every part is there and what you need it for.
Before we start, please be aware, this will not give you a one fits all approach or will cover the complete research from this field. Rather the goal is to make you understand what it takes to assess your IT security risks as well as prepare you to conduct basic risk assessments in the fastest and easiest way possible. So let’s directly jump in.

In the following Sections, I introduce and give examples for different approaches on how to get an overview of possible IT security threats to your systems.

Directly assessing risks

Throughout this post we will use and come back to one very specific use case. This will serve us as an example to better understand the single steps.

A developer uses his own laptop running the Ubuntu operating system to develop a web application for a company.
For this, he uses Visual Studio Code as a development environment and a mariadb database (SQL database) as part of his backend. The web application itself uses HTML, CSS, and JS on the frontend and PHP on the backend. For testing and the later deployment he uses an apache web server. Finally, the developer already knows about IT security and employs only secured connections using TLS1.2 and server-side certificates.

Web development use case

For a direct risk assessment, we could now try and start to come up with possible problems. Just by looking at the example description several problems come to mind:

• A public exposure of the database may allow for unallowed data access.
• A misconfigured web server may leak (confidential) data.
• If the web application gets input from an end user to build up database queries, there is a risk of SQL injections.
• etc.

After establishing that list, we can now rate the associated risk with each threat, e.g. on a scale from low to high.

This approach has a quite obvious problem. Because you can only come up with an extensive list of possible risks if you bring a lot of experience. Therefore, the risk analyst must have already a feeling on what might go wrong given this setup. This method, hence, can only be useful as a first guess in a very brief discussion of the overall system. For other settings, a more methodological approach is needed.

Asset-based assessment

As first step, many risk assessment methods consider the establishment of a list of assets which are worth protecting.
In our example from above such a list could be:

• the developed code of the web application (may be intellectual property)
• the private keys of the web server (during development and production use)
• data stored in the database
• data stored on the web server (machine)

STRIDE

Given this list, we could now think about possible threats to these assets. The probably most common tool to do so is STRIDE developed by Microsoft. STRIDE stands for

• Spoofing
• Tampering
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege

With this information, we can start out our first basic method. Let’s put the assets in a formatted table.

ID	Name	Description
A1	Code	Developed code of the web application
A2	DKey	Private key of the web server (development)
A3	PKey	Private key of the web server (production)
A4	DB	Data stored in the database
A5	WS	Data stored on the web server (machine)

Threats

For each of these assets, we can now evaluate whether the STRIDE threats apply. Let’s do this.

Asset	Threat	Description	Realistic?
A1	S	Spoofing of code	How would you spoof this? — not really…
A1	T	Tampering with code	Could be possible with a manipulated compiler, operating system or development IDE.
A1	R	Repudiation of the code	As the code in our example is not signed or anything comparable by the developer — yes.
A1	I	Information disclosure of the code	A manipulated IDE might upload (parts of) the code to untrusted repositories.
A1	D	Denial of service of the code	This would assume that there is no backup of the development code. With current versioning systems most of the times being used, this is rather unlikely.
A1	E	Elevation of privilege of the code	Well, that does not make sense.
A2	S	Spoofing of the DKey	You cannot spoof the private key. It’s unique and a different key would not match the server certificate.
A2	T	Tampering with DKey	A manipulated private key would not work.
A2	R	Repudiation of DKey	Makes no sense.
A2	I	Information Disclosure of DKey	Yes, then all development tests could potentially run against a wrong test server.
A2	D	Denial of Service of DKey	This might only delay testing of the web application. Not dramatic.
A2	E	Elevation of Privilege of DKey	Makes no sense.

With this list of threats we can now once again rate the risk associated with each threat qualitatively on a scale. Like in the previous example, we still need to assess this with our experts’ knowledge.

Cumbersome threat lists

Well, ok. I cheated a bit. After only two assets I got exhausted with writing up the threats. When reading through them, you might have noticed a lot of them actually do not really make sense. This is because some of the threats, like Elevation of Privilege of a private key, simply do not make sense. So, if we want to get through this faster we need a better filtering on where to apply which of these threats. I must notice, a lot of people also use violated security goals instead of STRIDE. Then, we would have

• violation of confidentiality (information disclosure)
• violation of integrity (tampering)
• and violation of availability (denial of service)

Meaningful threats

While the list of possible threats is then reduced to half the size, for larger systems this still does not solve the problem of a long list to go through.
In order to filter this list even more let’s think about when the different proposed threats are actually relevant.
Spoofing happens during data transmission. Either the sender or the receiver could be spoofed.
Tampering applies to data in transit, data stored at locations, as well as to functions or processes. Here, a function or a process shall be the logical unit which utilizes and possibly transforms data at any location.
Repudiation can happen if data has changed or was transmitted.
In these two cases, also information leakage may occur.
Denial of Service applies to data transmission and functions or processes.
Finally, elevation of privileges does not apply to the system under evaluation but rather to the attacker. It describes an entity carrying out an activity which it was not authorized to. This either requires tampering or spoofing with the system or an authorized user-action combination which becomes unauthorized under certain not modeled constraints.

Goal-based assessments

Before we continue with the next method I want to mention another approach to identify threats to your system which is quite similar to the previous asset-based assessment.
Attack trees are an already long-known method to analyze the steps an attacker must perform to reach a goal. In our example we can define different goals of an attacker, e.g. implementing a backdoor in the web application. So let’s think about how he can achieve this.

Ok… I admit. Once again I cheated and do not provide the full attack tree but only an excerpt so that you get the idea. Except for the topmost branches from the and node all edges indicate alternatives. To implement the backdoor the attacker needs to get access to the code and have some backdoor code available. All other possible steps have several alternatives to reach these to sub-goals. Compared to the asset-based assessment method, this approach yields a much more fine-grained analysis of the system and potentially shows you already the easiest way for an attacker to break your system.
However, it answers a slightly different question. An attack tree explains how an attacker might reach his goal but not what his goal might be. For the identification of possible goals an asset-based assessment is way more suitable. But attack trees are then a perfect companion for your asset-based assessment if you want to better understand how your assets might be attacked, which controls you may introduce and how hard an attack actually is.

Model-based assessments

So, in the previous sections we explored that for a better mapping of threats we can rely on basic assumptions about the STRIDE threats and refine our system model to data exchanges, stored data, senders, receivers, and functions and processes.

With these refinements, our model now looks a bit more detailed.

ID	Entity	Description
E1	VS Code	Development Environment
E2	Webserver	Apache
E3	DB	MariaDB
E4	User	End-user of web application
E5	Developer	Developer of the web application

ID	Data	Description	Stored at
D1	DKey	Private key of the web server (development)	E1
D2	PKey	Private key of the web server (production)	E2
D3	DB	Data stored in the database	E3
D4	WS	Data stored on the webserver	E2
D5	Code	Developed code of the web application	E1, E2
D6	Website	Website evolving from code and DB content
D7	Input	User input to website	E2

ID	Data Flow	Sender	Receiver	Data
F1	Developer → VS Code: Code	E5	E1	D5
F2	VS Code → Webserver: Code	E1	E2	D5
F3	Webserver → User: Website	E2	E4	D6
F4	User → Webserver: Input	E4	E2	D7
F5	Webserver → DB: Input	E2	E3	D7

ID	Description	Location	Input	Result
G1	Private key generation (development)	E1		D1
G2	Private key generation (production)	E2		D2
G3	Website generation	E2	D3, D5	D6
G4	User input ingestion	E3	D7	D3
G5	Development	E5		D5

Advantages

While writing up these tables does not take any effort away compared to the asset-based method, it will serve us quite a bit when rating the risks. First of all, we get a way more detailed picture of the system under evaluation and effectively enable others to understand our reasoning about whether and where one of the STRIDE threats applies. Second, we eliminate many of the previous meaningless threats which did not make sense. And most important, our threats automatically become more granular what makes them easier to asses. If you think about it: it does make a difference — concerning a threat’s likelihood — whether you try to manipulate (tampering) the developed web application code (D5) while it is at rest on VS code (E1) compared to when it is transferred to the web server (F2).

Disadvantages

On the other hand, this model-based assessment requires some efforts in advance to construct the needed system model. However, from my experience I strongly suggest you go this route. Often it is this very step which already shows developers and stakeholders their weaknesses. Especially in big companies it is more often the system complexity which introduces IT security threats instead of missing knowledge.

Until now, we covered a lot of state-of-the-art methods. In the next part of this new series we will touch upon more technical details of the approaches and develop a template for assessments.

As a scientist my usual workday can be divided in three, sometimes 4 essential steps:

1. Reading a lot of information
2. Looking out of the window ⇒ that is, thinking
3. Writing down new results
4. And finally sometimes, implementing proof-of-concepts

As is evident from this list, at least one third up to half of my work, therefore, is made up by writing either reports or code. To improve the efficiency of this task, I started thinking about our standard keyboard layout. QWERTY (or QWERTZ for the Germans) was invented to prevent neighbouring letter arms in your typewriter from getting tangled up with each other. You may notice that optimizing for this goal may not result in an optimal setup for typing.
But, stop, let us think about that. We do not actually use typewriters anymore. And our main goal for optimization, thus, changed. Hence, there were several attempts of enhancing typing efficiency in different languages. With the beginning of 2017, I started to use the German layout variant neo. It is similar but not equal to the more general DVORAK. 

The idea of these layouts is to reorganize the letters in a way, that the most common and often used keys lie closer to each other and reside on the home row. The home row is the one your fingers will rest on anyway, when using proper 10-finger typing.
By adopting to such a different keyboard layout, you, thus, gain the advantage of having to move your fingers much less. Some people who converted to these layouts claim that it helps them remove strain on hands and fingers. Others suggest that by having your fingers move less they are able to type faster. 

Looking at the first layer of keys in the neo layout in the image above, you see all the vowels residing on the left side of the home row. In German, there only rarely are two vowels following each other. Hence, it makes sense putting them closer together. After practicing this layout now for one and half a year let me put down the pros and cons. 

Pro	Con
– less movement in your hands – starting fresh may eliminate bad habits – maybe increased typing speed – shoulder surfing for your passwords is way harder	– you need to maintain some proficiency in qwerty/z – high effort until you reach the same typing level again – you probably need to configure the machine you are working on first

Finally, for me the benefits definitely outweigh the drawbacks. I typically only work on my own machines where I have full control over the keyboard layout used. While it took me only two to three months to learn the layout, I needed an additional year to reach my previous typing speed. However, when you start out fresh you get the chance to learn typewriting from scratch allowing to eliminate all your bad habits on the fly. This was a big deal for me as the new layout entirely forces you to type blindly.

After 1.5 years, I still enjoy the calamity when typing prose as it now feels much more like almost flowing out of my hands. For me, this really is a boost in typing real estate — if there is such a thing. 

The real benefit of neo comes for me with the fourth layer. These are the symbols you type in combination with the right ALT key or the one next to the left SHIFT key.
With this layer you get access to movements with the arrow keys, page up/down and home and end keys. Especially when working on mobile computers which often lack these keys, this makes editing longer texts way more efficient. For all those experimental scientists the availability of a virtual numpad in this layer is also great.
However, I only use it if I really have a lot of numbers to enter. For the occassional entry of a few numbers I still prefer the normal number row.

On the third layer, you find most of the symbols you need for programming as well as special things like @ and different hyphens.
While it might seem cumbersome to have things like / or { only accessible with pressing two keys at once, it is fine for me as the needed movement of the fingers is small enough.
In addition, it is great having access to a dash -, the n-dash –, and the m-dash —. If you do not know the difference, I encourage you to look it up. Good texts shall have the right symbols.