Have you ever wondered why we haven't found conclusive evidence of aliens yet? Well, this infographic hopes to shed some light on that question. Check it out!
[Mobile users: click the image to view]
[H/T Imgur]
May 2, 2017
May 1, 2017
I've replaced TrueCrypt with VeraCrypt on my VPS
7:00 AM
Paul B
So I went ahead and installed VeraCrypt on my VPS. The setup is almost identical to the TrueCrypt CLI version. After the install, I changed my mount scripts from:
According to VeraCrypt, you can convert an existing TrueCrypt volume by performing any of these functions, but you must select TrueCrypt mode to do it:
- Change Volume Password
- Set Header Key Derivation Algorithm
- Add/Remove key files
- Remove all key files
I haven't tried it yet, but changing the password and or key files to convert it to a VeraCrypt volume via the terminal version should be as simple as running the following on your original TrueCrypt volume while it's dismounted:
Not wanting to risk corrupting all of my emails, I think I will hold off on doing that until I'm ready to change my password again, and I'll make sure I have a good backup first! Still though, even if it doesn't work, at least I can mount that volume now with VeraCrypt!
Edit: I've verified that the above command does in fact work to change the password and upgrade your TrueCrypt volume to the new VeraCrypt format via the cli/terminal! If you were wondering how to upgrade a TrueCrypt voume to a VeraCrypt volume via command line, there you go!
Apr 29, 2017
Serious Alternative to Truecrypt: VeraCrypt
7:00 AM
Paul B
As many people know, TrueCrypt has been discontinued since 2014. The developers said that TrueCrypt had some unfixed security issues. In 2015 the Fraunhofer Institute for Secure Information Technology conducted an audit on the last stable release of TrueCrypt, and although they did find a number of bugs, they came to the conclusion that it is still secure when data is at rest.
That being said, since TrueCrypt is no longer being developed, if you are still using it you should move to something that is actively being developed. Now, there are lots of encryption solutions today. Most modern operating systems have some form of disk encryption built in now. Microsoft has BitLocker, Linux has LUKS. You get the idea right? What if you really liked the way TrueCrypt worked though? What if you liked that TrueCrypt was multi-platform? Then in my opinion, you only have one serious alternative.
That alternative is VeraCrypt! From their page:
Some cool things I like about VeraCrypt are that the layout is very similar to that of TrueCrypt, and I'm already used to that. Also VeraCrypt offers some other encryption algorithms that TrueCrypt did not. Those algorithms are Camellia and Kuznyechik.
They also have some other hash options.
I'll be honest, I am still using TrueCrypt on my VPS email server. I'm not terribly worried about it because it should still be able to protect my emails at rest if my VPS is shutdown to reset the root password without my permission. Still though, I'm making plans to migrate to a new VPS when Ubuntu 18.04 LTS comes out, and when that day comes I'm going to make the switch to VeraCrypt!
Do you still use TrueCrypt? Do you think you will make the change to VeraCrypt? Why or why not? Let us know in the comments!
That being said, since TrueCrypt is no longer being developed, if you are still using it you should move to something that is actively being developed. Now, there are lots of encryption solutions today. Most modern operating systems have some form of disk encryption built in now. Microsoft has BitLocker, Linux has LUKS. You get the idea right? What if you really liked the way TrueCrypt worked though? What if you liked that TrueCrypt was multi-platform? Then in my opinion, you only have one serious alternative.
That alternative is VeraCrypt! From their page:
VeraCrypt picks up from where TrueCrypt left and it adds enhanced security to the algorithms used for system and partitions encryption making it immune to new developments in brute-force attacks.
VeraCrypt also solves many vulnerabilities and security issues found in TrueCrypt. It can load TrueCrypt volume and it offers the possibility to convert TrueCrypt containers and non-system partitions to VeraCrypt format. This enhanced security adds some delay only to the opening of encrypted partitions without any performance impact to the application use phase.
This is acceptable to the legitimate owner but it makes it much more harder for an attacker to gain access to the encrypted data.Now, to be fair, there is another fork of TrueCrypt called CipherShed, but they only have a pre-compiled version for Windows. If you want to use it on Mac or Linux, you need to compile it yourself. Not to mention, they don't issue releases as frequently as VeraCrypt.
Some cool things I like about VeraCrypt are that the layout is very similar to that of TrueCrypt, and I'm already used to that. Also VeraCrypt offers some other encryption algorithms that TrueCrypt did not. Those algorithms are Camellia and Kuznyechik.
They also have some other hash options.
I'll be honest, I am still using TrueCrypt on my VPS email server. I'm not terribly worried about it because it should still be able to protect my emails at rest if my VPS is shutdown to reset the root password without my permission. Still though, I'm making plans to migrate to a new VPS when Ubuntu 18.04 LTS comes out, and when that day comes I'm going to make the switch to VeraCrypt!
Do you still use TrueCrypt? Do you think you will make the change to VeraCrypt? Why or why not? Let us know in the comments!
Apr 28, 2017
Now Virginia farm boys are trying to break into my email server?
7:00 AM
Paul B
One day after my post about Venafi setting off a host based intrusion detection alert on my email server, and me wondering if Venafi is a front for the NSA since they are stationed in Utah where the NSA's gigantic datacenter is; I get another interesting alert. This time from an IP address in Ashburn Virginia!
What is only 30 minutes away from Ashburn Virginia? Oh, just CIA Headquarters in Langley Virginia!
The alert I got was a little more aggressive than that from Venafi. This one was fired off as a "Possible attack on the ssh server (or version gathering)."
I get it. Just because Venafi is out of Utah, and the NSA is out of Utah doesn't make them both NSA. Also, just because this IP is out of Virginia, and the CIA are in Virginia doesn't mean that it's the CIA trying to hack my email. Still though, the timing of it is suspicious don't you think? One day after possibly outing a NSA front?
Just to be cautious I added firewall rules to block the following IP ranges from the ISP out of Virginia:
What is only 30 minutes away from Ashburn Virginia? Oh, just CIA Headquarters in Langley Virginia!
The alert I got was a little more aggressive than that from Venafi. This one was fired off as a "Possible attack on the ssh server (or version gathering)."
I get it. Just because Venafi is out of Utah, and the NSA is out of Utah doesn't make them both NSA. Also, just because this IP is out of Virginia, and the CIA are in Virginia doesn't mean that it's the CIA trying to hack my email. Still though, the timing of it is suspicious don't you think? One day after possibly outing a NSA front?
Just to be cautious I added firewall rules to block the following IP ranges from the ISP out of Virginia:
70.104.0.0/16Hopefully that will keep the Virginia farm boys from snooping in my email.
70.105.0.0/17
70.105.128.0/18
70.105.192.0/19
Apr 27, 2017
Who the hell is @Venafi, and why the hell are they trying to connect to my private email server?
7:00 AM
Paul B
I work in a company where cyber security is kind of a big deal, and one of the tools I use a lot is a host based intrusion detection system called OSSEC. Well, the other day I decided to also install OSSEC on my private email server to see what kind of threats and intrusion attempts are happening on a daily basis. Needless to say, things have been interesting.
One thing that caught my eye this morning though is an SSL error message that showed up in the Apache logs that said "rejecting client initiated renegotiation". See below:
Okay, a simple SSL error. So what? No harm no foul right? Well, there is something kind of strange with this one. The IP address in question is 208.93.152.147, and when I do an IP address WHOIS lookup I see it belongs to a company out of Utah called Venafi, Inc.
Their website says that they are in essence an SSL company, and Wikipedia describes them as a privately held cyber security company that develops software to secure and protect cryptographic keys and digital certificates. The problem is that I don't do business with them, so they really have no reason to be scoping out my private email server.
Another thing that made me wonder about this company is that this isn't the first time I've seen their IP addresses show up in intrusion detection alerts. I've also seen their IP addresses in alerts for some of my day job company's web servers as well, and we don't do business with Venafi either.
Maybe it's my conspiracy mind at play here, but you know who else has a big data center in Utah that is designed to hack and store data about everyone on the Internet? That's right, the NSA has a huge data center in Utah called the Intelligence Community Comprehensive National Cybersecurity Initiative Data Center.
Could Venafi be a front for the NSA? It makes me wonder...
Anyway, for now I am blocking the entire 208.93.152.0/22 range and I will continue to block ranges of suspicious IP's. There is no reason for Venafi to be connecting to my servers at all, even if they really are the NSA.
Have you seen these guys trying to connect to your systems? What are you doing about it? Do you do business with them? Is this something I shouldn't worry about? Let me know in the comments.
======
UPDATE: Venafi sent me the following tweet in reply to this post:
The link to their TrustNet Scanner talks about how they passively scan the certifications of every IP address on the internet to build a global certificate repository that they make available to the public. I suppose that's plausible... I'm still not convinced they aren't a front for the NSA though!
Update #2: Is the CIA now trying to break into my email server?
One thing that caught my eye this morning though is an SSL error message that showed up in the Apache logs that said "rejecting client initiated renegotiation". See below:
Okay, a simple SSL error. So what? No harm no foul right? Well, there is something kind of strange with this one. The IP address in question is 208.93.152.147, and when I do an IP address WHOIS lookup I see it belongs to a company out of Utah called Venafi, Inc.
Their website says that they are in essence an SSL company, and Wikipedia describes them as a privately held cyber security company that develops software to secure and protect cryptographic keys and digital certificates. The problem is that I don't do business with them, so they really have no reason to be scoping out my private email server.
Another thing that made me wonder about this company is that this isn't the first time I've seen their IP addresses show up in intrusion detection alerts. I've also seen their IP addresses in alerts for some of my day job company's web servers as well, and we don't do business with Venafi either.
Maybe it's my conspiracy mind at play here, but you know who else has a big data center in Utah that is designed to hack and store data about everyone on the Internet? That's right, the NSA has a huge data center in Utah called the Intelligence Community Comprehensive National Cybersecurity Initiative Data Center.
Could Venafi be a front for the NSA? It makes me wonder...
Anyway, for now I am blocking the entire 208.93.152.0/22 range and I will continue to block ranges of suspicious IP's. There is no reason for Venafi to be connecting to my servers at all, even if they really are the NSA.
Have you seen these guys trying to connect to your systems? What are you doing about it? Do you do business with them? Is this something I shouldn't worry about? Let me know in the comments.
======
UPDATE: Venafi sent me the following tweet in reply to this post:
@bpowmedia Thanks for your tweet, please follow this link for more information on our TrustNet Scanning https://t.co/OcUh63qPLT— Venafi (@Venafi) April 27, 2017
The link to their TrustNet Scanner talks about how they passively scan the certifications of every IP address on the internet to build a global certificate repository that they make available to the public. I suppose that's plausible... I'm still not convinced they aren't a front for the NSA though!
Update #2: Is the CIA now trying to break into my email server?
Apr 26, 2017
Super cheap cell phone for my soon-to-be teenage daughter
7:00 AM
Paul B
 |
| My Daughter and Her New Phone |
When I was a teenager, my parents didn't buy me a cell phone. Granted, cell phones were way more expensive in the 90's, but that's not the point. I did have a pager (Remember pagers?!?), but I bought that with my own money!
My daughter has been wanting a smartphone, and she actually came up with a brilliant plan on her own! She decided that she would earn some cold hard cash by mowing my lawn and doing chores around the house, then she would go out and buy a pre-paid Verizon Samsung Galaxy J1 for $45!
Normally Verizon makes you sign up for a pre-paid account that is billed monthly at $40 per month or more. Instead of doing that though, she said she would use a free app for text and calling over WiFi!
The app we opted to use is TalkaTone which gives you a free phone number and lets you have unlimited text and calling in the US and Canada! It's available for both Android and iOS too!
Some things to consider if you decide to do this setup for your kids:
- The pre-paid cell phone wants you to go through an activation process when you power it on. You can actually skip this process. The activation app will pop up occasionally to bug you about activation, but you can ignore it.
- Your child will only be able to make and received calls/text where WiFi is available. Keep in mind that many restaurants like McDonalds have free WiFi. Encourage your kids to connect to these free hotspots so they can call you if they need to.
With this setup it only cost my daughter a measly $45, and there is no monthly fee for me to take care of! Win win if you ask me!
Do you use a similar setup for your kids? Let me know in the comments.
Apr 24, 2017
Mindless Investing Made Easy
7:00 AM
Paul B
Have you ever seen Superman III where Richard Pryor's character came up with a computer program to rip off the company he worked for by rounding up company transactions to the nearest penny and sticking those fractions of cents in a bank account? They did the same thing in Office Space. Well, imagine doing something similar to that for yourself, but with your own money. Sounds weird? Well stay with me, it will all make sense!
I discovered an app that in essence does this for you, but instead of fractions of a penny, it's fractions of a dollar. Once you sign up, this app rounds up transactions on every purchase you make to the nearest dollar and takes that difference and invests it in a diversified portfolio! You don't even have to think about it!
Still not making sense? Let me give you an example. Let's say you go to the grocery store, and buy $123.48 worth of groceries with your debit card. This app will then round that up to $124.00, and take that $0.52 and invest it in the stock market for you! After a while, that money can add up to thousands of dollars, and you don't even have to think about it!
This app is called Acorns, and here is a video that can explain it better than I can:
If you've been looking for a way to get into the stock market, but didn't know where to start, then you might give Acorns a try. It's ridiculously easy to setup, and you don't have to be a finance major to figure it out. Best of all, it's automated and you don't have to think about it!
Do you use Acorns? Do you like it? What do you like about it? Let us know in the comments!
I discovered an app that in essence does this for you, but instead of fractions of a penny, it's fractions of a dollar. Once you sign up, this app rounds up transactions on every purchase you make to the nearest dollar and takes that difference and invests it in a diversified portfolio! You don't even have to think about it!
Still not making sense? Let me give you an example. Let's say you go to the grocery store, and buy $123.48 worth of groceries with your debit card. This app will then round that up to $124.00, and take that $0.52 and invest it in the stock market for you! After a while, that money can add up to thousands of dollars, and you don't even have to think about it!
This app is called Acorns, and here is a video that can explain it better than I can:
If you've been looking for a way to get into the stock market, but didn't know where to start, then you might give Acorns a try. It's ridiculously easy to setup, and you don't have to be a finance major to figure it out. Best of all, it's automated and you don't have to think about it!
Do you use Acorns? Do you like it? What do you like about it? Let us know in the comments!
