IoT 開發筆記 - 關於歐盟 無線電設備指令 (Radio Equipment Directive, RED) RED-DA 對於聯網設備的資安自我檢查辦法

這兩年英國、新加坡、歐盟都有滿多資安相關的議題，例如英國 Product Security and Telecommunications Infrastructure (PSTI) 產品安全和電信基礎設施法案在 2024.04 生效，現在則幫忙公司處理歐盟 2025年夏天要推進的無線設備指令—委託法案 (Radio Equipment Directive – Delegated Act, 簡稱 RED-DA )

已知的粗略資訊：

• 商品若有聯網功能，需要依照 RED-DA 的要求自我檢驗一番，才能把商品賣進歐盟國家
• 尚未有中央單位負責檢驗，各大品牌找一些值得信任檢驗單位，請他們檢驗商品出檢驗報告，未來商品進歐盟時，被要求提供報告時，可以拿出來用

因此，產品負責人或銷售業務，其實要做的是趕緊找一間信任的資安檢驗公司，提出商品檢驗的需求，價格通常也不便宜，最重要檢驗的時程也不短，通常簽約繳件後也要數個月才會產出報告的，而報告其實是會高度依賴商品的使用情境跟品牌/廠牌，基本上代工廠不能公版做完一份就沒事，是品牌商也得依序產報告（找同一間資安公司，應當有些優惠吧？可以讓資安公司省去摸索商品，且相似的商品可以讓驗證機制加速）

總之，就會進行一些聯網設備(IoT)的處理，通常，資安公司也高度依賴產品公司的 IT 部門或負責研發的開發者提供的資訊。

為了加速檢驗報告的產生，公司可以先自行體檢：

• 使用 OpenVAS Scanner 等類似工具對聯網設備進行弱點掃描
• 請開發者整理產品用到了相關 libraries ，透過 CVE 資料庫進行查詢，若發現有漏洞就評估該怎樣更新
• 若像 WIFI AP 提供 http://192.168.1.1 登入後台使用，那至少必須改提供 https://192.168.1.1 自簽憑證方案

由於檢驗報告項目眾多，單純先列一下可以自我檢驗的部分，其他的部分，還是交給資安業者，讓專業的來吧

筆記一下，怎樣用 OpenVAS 來掃設備，當然，這是個 Docker 當道的時代，直接跑 Docker 即可，收工（誤），實測在 macOS 15 和 Windows 11 都可以正常運作的：

C:\Users\User>docker run -p 8443:443 --name openvas mikesplain/openvas

Unable to find image 'mikesplain/openvas:latest' locally

latest: Pulling from mikesplain/openvas

34667c7e4631: Pull complete

d18d76a881a4: Pull complete

119c7358fbfc: Pull complete

2aaf13f3eff0: Pull complete

67b182362ac2: Pull complete

c878d3d5e895: Pull complete

ec12cc49fe18: Pull complete

c4c454aeebef: Pull complete

27d3410150b2: Pull complete

e08d578dc278: Pull complete

44951337cd32: Pull complete

8c7fe885e62a: Pull complete

a4f833680e45: Pull complete

Digest: sha256:23c8412b5f9f370ba71e5cd3db36e6f2e269666cd8a3e3e7872f20f8063b2752

Status: Downloaded newer image for mikesplain/openvas:latest

Testing redis status...

Redis not yet ready...

Redis ready.

Checking for empty volume

Restarting services

 * Restarting openvas-scanner openvassd

   ...done.

 * Restarting openvas-manager openvasmd

   ...done.

 * Restarting openvas-gsa gsad

   ...done.

Reloading NVTs

Rebuilding NVT cache... done.

Checking setup

openvas-check-setup 2.3.3

  Test completeness and readiness of OpenVAS-9

  Please report us any non-detected problems and

  help us to improve this check routine:

  http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

  Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.

  Use the parameter --server to skip checks for client tools

  like GSD and OpenVAS-CLI.

Step 1: Checking OpenVAS Scanner ...

        OK: OpenVAS Scanner is present in version 5.1.3.

        OK: OpenVAS Scanner CA Certificate is present as .

...

接著就在本機開啟 https://localhost:8443/ 來運作：

添加一則 task (左上角的紫色 icon ) -> 指定設備的 IP -> 右下角有 Actions 記得按下 Play icon 

運行好一陣子後，就會看到一些報告了，像是幫你檢驗 Web server 的版本是否有漏洞、網頁上是否有需要更新的 js libraries，例如：

至於嵌入式系統內部的自我檢查，其實可以善用美國國家單位提供的服務： nvd.nist.gov/vuln/search

在那邊去輸入資訊查詢，像是 curl 啊，等等

當然，這邊純人工檢查極累 Orz 所以，也有 API 服務可以申請，就能夠批次詢問了，細節請參考：

nvd.nist.gov/developers/vulnerabilities

最後，把玩一下小工具：pypi.org/project/cve-vulnerability-scanner/

% NVD_API_KEY='XXXX-XXXX-XXXX-XXXX' cve-vulnerability-scanner -p zlib -v 1.2.13 -o /tmp/output.md ; cat /tmp/output.md 

Scanning zlib version 1.2.13

Loading cached data for zlib

Scan complete. Report generated in /tmp/output.md

# Security Vulnerability Report

Generated on: 2024-11-09 08:53:47

## zlib 1.2.13

### CVE-2023-45853

Severity: CRITICAL

CVSS Score: 9.8

Version Range: * to 1.3

Published: 2023-10-14T02:15:09.323

Last Modified: 2024-08-01T13:44:58.990

Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

### CVE-2023-48106

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T18:15:09.630

Last Modified: 2023-12-02T00:27:03.327

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.

### CVE-2023-48107

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T23:15:10.663

Last Modified: 2023-12-27T04:15:07.277

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.

### CVE-2023-6992

Severity: MEDIUM

CVSS Score: 5.5

Version Range: * to 2023-11-16

Published: 2024-01-04T12:15:23.690

Last Modified: 2024-01-10T01:14:35.027

Description: Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow.

A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software.

Patches: The issue has been patched in commit  8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

### CVE-2003-0107

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2003-03-07T05:00:00.000

Last Modified: 2022-06-22T16:40:46.327

Description: Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

### CVE-2004-0797

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2004-10-20T04:00:00.000

Last Modified: 2022-06-22T16:40:46.360

Description: The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).

### CVE-2005-2096

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-06T04:00:00.000

Last Modified: 2022-06-22T16:40:46.413

Description: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

### CVE-2005-1849

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-26T04:00:00.000

Last Modified: 2022-06-22T16:40:46.380

Description: inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to 2.015

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

這工具純把玩，困難之處就是做 version 和 library name 比對，這工具純示意，仍有非常大進步的空間，甚至該把這空間交給專業的資安公司就好，畢竟這是個分工的時代，且需要大量的人力檢視 Orz

[Linux] OpenSSL AES-128 加解密 @ macOS 13.2.1, OpenSSL 3.1.2 1 Aug 2023

總覺得我是不是以前也寫過這類筆記? 查了下快十年前 XD 用的是 openssl des3 

由於工作中太常接觸 AES-128 加解密了，想要筆記一下方便未來查詢，而透過 openssl command 也方便交叉驗證程式是否正確，這次就仿 openssl des3 筆記：

明文：

% cat /tmp/input.txt

Hello World

% md5 /tmp/input.txt

MD5 (/tmp/input.txt) = e59ff97941044f85df5297e1c302d260

% hexdump /tmp/input.txt 

0000000 6548 6c6c 206f 6f57 6c72 0a64          

000000c

產生加解密的 Key 值：

% dd if=/dev/urandom of=/tmp/password bs=1 count=32

32+0 records in

32+0 records out

32 bytes transferred in 0.000303 secs (105611 bytes/sec)

% md5 /tmp/password 

MD5 (/tmp/password) = 92eeb8e1bec70865650e1f96e5cd1819

% hexdump /tmp/password 

0000000 cf23 5006 70d0 bf1e 0e9e a70c 10f0 ecd6

0000010 dc01 e156 d818 bff2 2e3e f859 28c9 a91d

0000020

% hexdump -v -e '/1 "%02x"' -n 16 /tmp/password 

23cf0650d0701ebf9e0e0ca7f010d6ec

產生加解密的 IV 值（其實同 Key 值產生即可，目前改用另一招）：

% date | md5

5d6476c85eca3ec56fda4913f5578b83

使用 OpenSSL AES-128 加密：

% openssl enc -e -aes-128-cbc -in /tmp/input.txt -out /tmp/encrypt.txt -K 23cf0650d0701ebf9e0e0ca7f010d6ec -iv 5d6476c85eca3ec56fda4913f5578b83

% hexdump /tmp/encrypt.txt

0000000 c3d4 cb0a d845 182c 319e afdf b29c c484

0000010

使用 OpenSSL AES-128 解密：

% openssl enc -d -aes-128-cbc -in /tmp/encrypt.txt -out /tmp/output.txt -K 23cf0650d0701ebf9e0e0ca7f010d6ec -iv 5d6476c85eca3ec56fda4913f5578b83

% md5 /tmp/output.txt 

MD5 (/tmp/output.txt) = e59ff97941044f85df5297e1c302d260

% cat /tmp/output.txt 

Hello World

工作上很容易 Key 值是一個 32 bytes 的 binary 檔案，且不加入輸出至檔案的方式，可以立即看解密的內容，連續動作如下：

% openssl enc -d -aes-128-cbc -in /tmp/encrypt.txt -K $(hexdump -v -e '/1 "%02x"' -n 16 /tmp/password) -iv 5d6476c85eca3ec56fda4913f5578b83

Hello World

收工

[Linux] 升級 Red Hat Enterprise Server 的 OpenSSL, OpenSSH 服務 @ Red Hat Enterprise Linux Server release 5.3

這是一台滿舊的機器，大概 10 年前吧。同事想要 git clone 時，出現了失敗問題，追蹤一下是機器的 openssl 過舊，由於機器有他的任務在，不好意思亂更新系統資源，怕爆！所以採用 tarball 的安裝方式。

openssl 太舊時，連用 wget/curl 去下載 https 來源時都會失敗的，只好靠 http 或是 scp 搬東西進去。

$ lsb_release -a

Distributor ID: RedHatEnterpriseServer

Description: Red Hat Enterprise Linux Server release 5.3 (Tikanga)

Release: 5.3

Codename: Tikanga

$ openssl version

OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

只好挑個 /opt/tarball 安裝啦，沒想到要編譯 openssl 又會碰到 perl 版本不夠新：

$ wget http://www.cpan.org/src/5.0/perl-5.10.0.tar.gz

$ cd ~/perl-5.10.0

$ ./configure.gnu --prefix=/opt/tarball

$ make -j4 install

接著再安裝個 zlib ，採用 static 方式方便後續大家使用：

$ wget http://zlib.net/zlib-1.2.11.tar.gz

$ cd ~/zlib-1.2.11

$ ./configure --prefix=/opt/tarball --static

$ make install

編譯 openssl：

$ wget http://www.openssl.org/source/openssl-1.1.1k.tar.gz 

$ cd ~/openssl-OpenSSL_1_1_1k 

$ PATH=/opt/tarball/bin:$PATH ./config --prefix=/opt/tarball

$ make -j4 install

編譯 openssh 工具包：https://github.com/openssh/openssh-portable/releases

$ cd ~/openssh-portable-V_8_6_P1

$ autoreconf

$ LD_LIBRARY_PATH=/opt/tarball/lib:$LD_LIBRARY_PATH ./configure --prefix=/opt/tarball/ --with-ssl-dir=/opt/tarball

$ LD_LIBRARY_PATH=/opt/tarball/lib:$LD_LIBRARY_PATH make -j4 install

$ file /opt/tarball/bin/ssh

/opt/tarball/bin/ssh: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), for GNU/Linux 2.6.9, stripped

接著偷懶拉 code 方式：

$ GIT_SSH_COMMAND="LD_LIBRARY_PATH=/opt/tarball/lib:$LD_LIBRARY_PATH /opt/tarball/bin/ssh" git clone ...

或是在環境變數添加好：

LD_LIBRARY_PATH=/opt/tarball/lib:$LD_LIBRARY_PATH 

PATH=/opt/tarball/bin:$PATH

搞定！

[Linux] Dropbox 缺少的 shared libraries @ Ubuntu 18.04 / dropbox-lnx.x86_64-94.4.384

最近更新 Ubuntu 18.04 的環境，順便重抓 Dropbox 來更新。

https://www.dropbox.com/zh_TW/install-linux
$ cd ~ && wget -O - "https://www.dropbox.com/download?plat=lnx.x86_64" | tar xzf -

一執行發現缺了不少 shared libraries ？很怪，印象中以前沒這樣過，順手筆記一下裝了哪些：

$ sudo apt install libxfixes3 libxdamage1 libglapi-mesa libxcb-glx0 libxcb-dri2-0 libxcb-dri3-0 libxcb-present0 libxcb-sync1 libxshmfence1 libxxf86vm1

[Linux] dev_appserver.py ERROR module.py:1652] The PHP runtime cannot be run with the "Memcache" PECL extension installed @ Ubuntu 16.04

在 Ubuntu server 上，首推 https://cloud.google.com/sdk/downloads#linux 安裝法，不要靠 apt 套件管理，不然會踩到很多麻煩：

$ curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-183.0.0-linux-x86_64.tar.gz | tar -xvf -
$ cd google-cloud-sdk
$ ./install.sh

裝完後，若是要運行 php-sdk 時，會踩到 php 環境問題，通常就是要指定 --php_executable_path 位置：

$ dev_appserver.py --enable_host_checking false --host 0.0.0.0 --port 8080  --php_executable_path /usr/bin/php-cgi5.6 app.yaml

只是執行時又會踩到缺套件等等的問題，裝到最後產生了 Memcache 套件問題，就要再把 Memcache 套件關閉即可：

$ php5.6 --ini
Configuration File (php.ini) Path: /etc/php/5.6/cli
Loaded Configuration File:         /etc/php/5.6/cli/php.ini
Scan for additional .ini files in: /etc/php/5.6/cli/conf.d
Additional .ini files parsed:      /etc/php/5.6/cli/conf.d/10-opcache.ini,
/etc/php/5.6/cli/conf.d/10-pdo.ini,
/etc/php/5.6/cli/conf.d/20-apcu.ini,
/etc/php/5.6/cli/conf.d/20-bcmath.ini,
/etc/php/5.6/cli/conf.d/20-calendar.ini,
/etc/php/5.6/cli/conf.d/20-ctype.ini,
/etc/php/5.6/cli/conf.d/20-exif.ini,
/etc/php/5.6/cli/conf.d/20-fileinfo.ini,
/etc/php/5.6/cli/conf.d/20-ftp.ini,
/etc/php/5.6/cli/conf.d/20-gettext.ini,
/etc/php/5.6/cli/conf.d/20-iconv.ini,
/etc/php/5.6/cli/conf.d/20-igbinary.ini,
/etc/php/5.6/cli/conf.d/20-json.ini,
/etc/php/5.6/cli/conf.d/20-memcache.ini,
/etc/php/5.6/cli/conf.d/20-msgpack.ini,
/etc/php/5.6/cli/conf.d/20-phar.ini,
/etc/php/5.6/cli/conf.d/20-posix.ini,
/etc/php/5.6/cli/conf.d/20-readline.ini,
/etc/php/5.6/cli/conf.d/20-shmop.ini,
/etc/php/5.6/cli/conf.d/20-sockets.ini,
/etc/php/5.6/cli/conf.d/20-sysvmsg.ini,
/etc/php/5.6/cli/conf.d/20-sysvsem.ini,
/etc/php/5.6/cli/conf.d/20-sysvshm.ini,
/etc/php/5.6/cli/conf.d/20-tokenizer.ini,
/etc/php/5.6/cli/conf.d/25-memcached.ini

$ sudo vim /etc/php/5.6/cli/conf.d/20-memcache.ini
; uncomment the next line to enable the module
;extension=memcache.so

$ sudo vim /etc/php/5.6/cli/conf.d/25-memcached.ini
; priority=25
;extension=memcached.so


[Linux] 查看 Process STDOUT @ Ubuntu 14.04

有一台 server 某個服務一直會掛掉，由於什麼資訊都沒有，就想到有沒有可以偷窺別人程式的 stdout 的方式，接著就出現了 strace - trace system calls and signals  啦 :P

用法：

$ sudo strace -p ProcessID -s OutputStringLength -e write

其中 OutputStringLength 預設是 32 bytes ，所以不知道對方會噴什麼，就填大一點的數字就好。

如此一來，就可以觀察 crash process 最後到底吐了什麼出來。唯一比較難搞的是有些服務掛了會重啟，要不斷追蹤其 pid 再執行上述的指令。

[Linux] 系統時區設定與檢查 @ Ubuntu 14.04

習慣在 AWS EC2/RDS 採用 UTC +0 的時區，然後在自家 VMware ESXi server 架設機器沒留意(忘記是選了台北時區還是從台灣下載 Ubuntu ISO 的差別)，導致開發與正式站的時區不同 :P 筆記一下驗證與處理方法。

查看系統現況時間
$ date

查看系統時區資訊
$ cat /etc/timezone
Asia/Taipei

設定時區: None of the above -> UTC
$ sudo dpkg-reconfigure tzdata

將相關服務都重啟，像是 Web server 有用到 PHP-FPM 就要重啟動，這樣 PHP 環境才會拿到正確的時間

[Linux] Python Fabric - 在 SSH 架構上，進行服務部署 @ Ubuntu 14.04

強者同事又獻技 fab 指令，從官網簡介：

Fabric is a Python (2.5-2.7) library and command-line tool for streamlining the use of SSH for application deployment or systems administration tasks.

原來如此！我還活在播接時代再把玩 bash script XDD 其實之前也有試過一些同時發 ssh remote command 的工具，但悲劇收場後，就沒再用了，現在就在來吸收這套吧！

$ sudo apt-get install fabric
$ fab
Fatal error: Couldn't find any fabfiles!

Remember that -f can be used to specify fabfile path, and use -h for help.

Aborting.

是的， fab 指令會尋找當前目錄下的 fabfile.py：

$ vim fabfile.py
def hello(what):
print 'hello ' + str(what)


$ fab hello:world
hello world

Done.

非常簡潔明瞭，反正 fab 後面接的字串就是個 fabfile.py 裡定義的函數，冒號後面就是給進去的參數。接著要寫一些遠端部署指令就是寫個 function 定義一些想傳的參數，接著就愉快地寫 python 就好！可以省去用一堆 ssh target_host "remote_command" 的方式了！

$ vim fabfile.py
from fabric.api import run, task, execute, runs_once
from fabric.colors import green, magenta
import fabric.api as api

@task(default=True)
def heartbeat():
        _info("hearbeat")
run("date")

def _info(message):
        print green(message + " on %s" % api.env.host_string)

def _warn(message):
        print magenta(message + " on %s" % api.env.host_string)
$ fab
hearbeat on None
No hosts found. Please specify (single) host string for connection: localhost
[localhost] run: date
[localhost] Login password for 'user':
[localhost] out: Fri Oct 30 12:51:51 UTC 2015
[localhost] out:


Done.
Disconnecting from localhost... done.

$ fab -H localhost
[localhost] Executing task 'heartbeat'
hearbeat on localhost
[localhost] run: date
[localhost] Login password for 'user':
[localhost] out: Fri Oct 30 12:53:09 UTC 2015
[localhost] out:


Done.
Disconnecting from localhost... done.

接下來，就可以想想一連串的行為了！