All posts by Mindful tester

Communication

The burden of a script

I was speechless. I felt devastated. After 5 days I still could not use internet on my smartphone. I had not prepared myself for failure.

Day 1

With a lot of reassuring mails in my mailbox I assumed that switching mobile provider would be a piece of cake. My new SIM card seemed to work well except for the Internet. After several failed attempts I looked on the website. I could not find information to solve my problem.

I called the service desk. The agent was friendly and suggested several options.
“Cross test? Never heard of it.”
I had to use my SIM card in another phone. Good test idea though.

My request to set the access point was denied.
A lot of resets followed.
Another agent took over. Another set of instructions.
Another serie of failed internet connections.
My request to set the access point was denied again.

A new SIM card would arrive within two working days. Too bad it was Friday.

Day 5

My family reported that no SIM card was delivered on the second working day. So I did a courtesy call to the help desk.

My math was 1 day off. I try to explain my reasoning: you could have sent it on Monday, so I would receive on Tuesday. Helpdesk math is unbeatable.

Back to the internet. At least that was really wanted. My request to set an access point was denied again. I got a bit annoyed. But the agent was willing to browse through all settings. I kindly denied. Already two of his colleagues had failed.

Day 6

On this day my SIM card was in my mailbox. Great.

I switched the SIM cards. No internet. Moved the new SIM card out and in. No internet. Tried to turn the card around. No SIM card detected and no internet.

Then I lost track of all my attempts. I did a cross test with the new SIM card on the phone of my wife. Internet!

Switched back the SIM card to my phone. No internet. I had no words.

Day 8

My wife had noticed my gloominess. She let me go to a computer shop to fix my internet connection problem. In the shop I rattled off all tests I had done like a professional helpdesk agent. Of course some tests were repeated. My phone was still capable to connect with the internet, if I could use the SIM card of the computer shop guy forever. Bad idea.

Now comes the big surprise: he did configure an access point for me. While making remarks about the illogical structure of the web site of my mobile provider.
Alas still no internet.

I was advised to grab my car to go to the nearby shop of the mobile provider. Because I had already cycled halfway, I cycled a bit longer.

In the mobile provider shop I had a longer list of attempts to recite. The man listened to my story and repeated a few attempts. Just to be sure.

“My colleague is resetting the internet.”
“Is this not dangerous?” I asked.

Believe it or not: this man configured the right access point for internet. I was relieved and grateful.

Day 9

What is the lesson learned?

 Provide a good web site. This saves time and shipping costs. And this blog post, which might go viral.
 Test the SIM card before migration on all kinds of phones.
Reconstruction

No notes

I had no notes
No music came into my mind. Silence.
It was my turn.

I had no notes.
No melody, no bass line, and even no chords came into my mind.
The people in the room expected me to do something.

I had no notes. After I had looked in my subdirectories: no database scripts. No relevant test charters. Actually I was supposed to test, not to make music. Mind you.

Getting back on track

It was time for my first flashback. A week earlier I had to test the same application. The import function had not been implemented yet. So I used some code of the unit tests.

I told myself to write a short note in the knowledge management system. This hunt for the code should not be repeated every test session.

The first step was to open my IDE or Integrated Development Environment. This tool helps me to program, build, and use version control among other things.

It was simple to find the right repository: it was still in view as I left it.

Another flashback came in. I could not use the code and one of the devops replied that I did not use the latest version.

So after the flashback I did a pull request and got the last version of the code.

My purpose was to find code to fill the database. I went to the unit test. A unit test has several phases. First I focused on the setup and breakdown. I could easily copy the code to make a table and the code to throw the table away. There were more commands for the breakdown than expected, so I had a small chat with one of the devops.

The second step was to find a way to fill the table. No other database commands could be found in the file. I saw a method to put a record into a table, clicked on it and saw the code of the wanted database stuff.

Then I reformatted the code. Now I could make, fill, and destroy the table at my own convenience.

During the test session I opened a test charter for notetaking.

End of the track

Did I put my steps in the knowledge management system?
Nope.

Last flashback. I promise.
I was talking to a team member. He explained that he never bothered to make notes for these cases. Things changed continuously. His Best Friend was the IDE.

Secure things

Tweaking My Website Security

WordPress is frequently used for websites and therefore attractive to some unfriendly people. So I reconfigured my WordPress security plugin.
And the mails of failed logins started coming in. It was not me, so someone else wanted to use this web site.

A short history about my tooling

For me web site security is something to review on a regular basis. It all started with an article in a magazine.  I put some elementary stuff in place: limited number of log ins and removed the login from the web site.

Over the months I added extra stuff like SSL. It encrypts the traffic between the browser and my web site. In other words my user name and password are unreadable for interested bad guys
Troy Hunt mentioned SSL in his free web course with the haunting name: Hack Yourself First.  Cheers mate.
In case you missed it SSL can be obtained for free at Let’s Encrypt.

At a regular basis I updated the software for my web site. I thought I was quite good until I changed the settings.

A short note about security

Some people might complain about the default security settings of their web site settings. Believe me things can be improved. If you do not set the WordPress settings right, then the user name is shown instead of your writer’s name on the blog post. Luckily there are plugins. (As a Dutchman I could not ignore the free ones.)

I thought about the default security and try to explain to you. If I buy a house, it has standard locks. If I want to keep the baddies out, I have to use the keys.
There are no special keys and locks involved. In case I need them I have to change them.
My new house has no vault or armed guards. If I need them, then I have to change something.

Shorten my list of security mails

So I had changed something and security mails came into my mail box. I noticed that there were mails with wrong user names and passwords. Not good.

After a few days I expected them to stop. You know: “Oops wrong web site. Sorry for that.” But the flow of failed login attempts did not stop. So I had to change something. Again.

I remembered a firewall in one of my WordPress plugins, so I had my first taste of a firewall. Dry, not shaken.
I had IP addresses of the sources of attack. Courtesy service of one of my WordPress iplugins.
An IP address consists of 4 numbers separated by a dot (.) like the invalid 345 345.345 345.

So I put the most offending IP addresses on the black list.

Three strikes and you are out.

The brute force attacks continued. The following combinations were used:

table with failed login attempts

The  user name is in the heading and the password is  shown in the first column. More details about this teaser will be added in the appendix.

My action did not change the flow. I used the asterix. 345 345.345.*. All people coming from IP addresses starting with 345.345.345 got blocked.

Wrong zone. Offsite. Stop the game.

It looked like I had put oil on fire. My normal mails were somewhere between the security mails.

I also noticed that black listed IP addresses still passed through. So there were apperently some smart guys pick locking the door of my web site. I’ll add some words to this assumption  at the end.

It was time for harsh measures. I was so focused on the mails, that I skipped my notetaking. In my logs other URLs were mentioned.  I clicked on one containing wp-admin and noticed that I saw my login page.
I changed a name somewhere and the security mails did not come in any more. Phew.

Brief briefing about red teaming

My list of WordPress plugins would be quite interesting for the people who really want to block out the intruders. The main reason I do not list them is red teaming. This military term is like give my plan to the red team, who will misuse this knowledge to my full disadvantage. Did you notice that “full” sounds like “fool”?

My steps for red teaming of my web site:

  1. Install the web site with all plugins.
  2. Configure the web site and the plugins.
  3. Look at www.cvedetails.com for any bugs.
  4. Misuse the listed CVE or Common Vulnearbilites  and Exposures.
  5. Go to the subdirectories and look for strange files.
  6. Look whether those files are accessible from the outside.

This reads like the plot of a bad B movie. But it works.

A short note about security

Some people might complain about their default website settings. Believe me things can be improved. If you do not set the WordPress settings right, then the user name is shown instead of your writer’s name on the blog post. Luckily there are plugin.

I thought about the default security and try to explain it to you. If I buy a house, it has standard locks. If I want to keep the baddies out, I have to use the keys.
There are no special keys and locks involved. In case I need them I have to change them.
My new house has no vault or armed guards. If I need them, then I have to change something.

Had a short glance

The days after the intentional reduction of my mail I had another look to my log files. My login page was requested several thousands times in a month. And I can assure you that I was not blogging so much.

There were other pages or URLs which led to my login page. So a check on the hits on my login page would give me the wrong impression of safety. There are people who do not like to use numbers or metrics. Some numbers can be really useful when pondered upon.

Somehow I had not paid attention. Too much focus on blogging. Obviously.

An article of Santosh Tuppad was quite helpful to increase the security. Thanks mate.

I even noticed that wp-content was open. So any pictures of draft blog posts could be viewed before publication. I even discovered a CSS file of a WordPress security plugin, which I could access without logging in. It was like finding a business card of a security team at the doorstep.

Wait a moment.

Let’s turn this into a multiple choice question.
What is the reaction of thieves on the business card?
A. Let’s skip this house.
B. I know how these guys operate. Piece of cake.
C. Look at the big bird and the shield of armor. That is pretty neat. We need 500 of those cards.

Definitely something for an action movie.

Some tips:

  • Read the reviews of the WordPress plugins.
  • Install WordPress plugins from the official site.
  • Write down, what works.
    Some plugins do not mix. This might be the cause of the strange behaviour of my firewall.
  • Make an offline copy of the website before tweaking.
  • Tweak the website security several times a year.
  • Go to your web site on a regular basis and install the updates.
  • Keep on an eye on Social Media.
    Troy and Santosh are great sources.
  • Basically, explore your web site security.

Appendix A bit of data crunching

For my first real life forensic investigation I wanted to use the gathered data. As in Data the Gathering. In order to process my e-mails I used baregrep, vim, Javascript, CSS, HTML.

People had attempted to break in my web site. I expected a concentrated set of failed attempts like
expected heat map

When I looked to the patterns I noticed this:
observed heat map
This is an example of a Blink Test. Lots of info processed in milliseconds and still getting useful info.

Facts:

  • Combinations were entered once.
  • Combinations where user name was the same as the password were frequently used.
  • The same for combination with user name equal to admin

Conclusions:

  • There is a high chance that a group tried to break in. There is a moderate chance that there were more groups which used different lists.
  • A popular user name is admin. See the first column.
  • Single words are favourite, followed by words and numbers.
  • Some user names and passwords were linked to my blog.
  • My blog posts are read.