Who had a Florida earthquake on their 2026 BINGO card? I know I didn’t, but we had a bit of earth shaking yesterday just after 1400, as a 6.1 Richter earthquake struck off the coast of Cuba. I was working at the time and the doctor, who was sitting next to me, said “Was that an earthquake? Did you feel that? I even saw the water in your cup shaking.” I didn’t notice, but I was preoccupied at the time. Sure enough, it was.
Damage
I don’t know if it was related or not, but I returned home to find my closet system had fallen off the wall. It looks like one of the screws pulled out of the wall, and this caused a cascading failure of the other screws, which caused an entire wall of the system to fall to the ground. There was some damage to it, forcing me to order $500 worth of parts. I am going to reinstall a 3/4″ plywood backer board this time. That way, I can use more screws when I secure it to the wall. The parts won’t be here until next Monday, so I will spend the day today taking the old one apart and reclaiming any undamaged parts I can find.
Network Upgrades
The network hardware is installed. I setup a few VLANs, which allows me to split the home network into segments:
Infrastructure
IOT devices
Servers
Guests
Surveillance
Once that was done, I created rules that allow me to control traffic. As an example, the guest network can’t do anything but access the Internet and a printer. The cameras are in the surveillance network, and they can only contact the server that’s running the surveillance software. IOT devices can’t do anything but contact the Internet.
As time goes on, I will tighten up the rules to make things as secure as possible. For now, the system works and I have tested it to make sure the rules are operating as intended. Starting later this week, I will begin installing security cameras. There will be a post on that.
For those of you who are IT nerds, some of this stuff will seem basic- my apologies, I am still learning, and I assume that a good number of the people who read this blog are as well.
IoT devices are notoriously insecure because manufacturers frequently prioritize low costs and rapid production over robust security. These devices often suffer from weak default credentials, a lack of encryption, and limited hardware capacity for security software, making them easy targets for hackers to hijack and form botnets or even to spy on you and sell your information to others.
Using VLANs can help with that. A virtual network, or VLAN, allows you to maintain separate, distinct networks within your physical network. These virtual networks are like tiny virtual containers that cannot talk to or even see each other, but can be configured to communicate as much or as little information between each other as you desire. That’s where the security comes in.
By creating different ‘trust’ levels within your home network, you can create a system whereby those who are inside of your guest VLAN can only communicate with the Internet or your printer, but nothing else. This prevents a guest from snooping through your files, accessing your router controls, or other mistakes. Placing all of your IoT devices in another VLAN will keep them isolated from other parts of your network and allow you to control where and how much information they can send or receive. Trusted devices such as your cell phone or laptop can be configured to have no restrictions.
In short, it increases security by giving devices “need to know” access without giving them access to things they shouldn’t be accessing. That’s what this new system I am installing does. I setup a few different VLANs:
Trusted. Devices within this VLAN will have IP addresses ending in 20.xx
IoT devices. Devices within this VLAN will have IP addresses ending in 30.xx
Storage. Devices within this VLAN will have IP addresses ending in 40.xx
Guest. Devices within this VLAN will have IP addresses ending in 50.xx
Cameras. Devices within this VLAN will have IP addresses ending in 60.xx
Each IP range can then be assigned any number of permissions. For example, IP addresses ending in 50.xx are setup to only be able to access the Internet and a printer. Guests will therefore be allowed to print or surf the Internet, but that is all.
So that is the plan for our network security here at the Ocho. Will it stand up to determined hacking or the NSA peeping at my stuff? Of course not. Is it better and more robust than what I have had in the past? Certainly. Perhaps it will cause those devices and people with nefarious intent to look elsewhere for lower hanging fruit.
Now if you will excuse me, today is going to be a pleasant, breezy 84 degrees, so I am going to go mow the lawn.
I am not an IT expert by any stretch of the imagination. Still, I am doing OK with this server upgrade. Some of these concepts are new, some not so new. Still, I am doing alright with the upgrades. I spent the day installing some upgrades.
Mounting
I first tried to mount the cabinet, but it was designed for studs that are 16 inches on center, and my walls have 24 inch stud spacing. I cut me two 1×6″ Spruce boards 26 inches long. I drilled them for screws to attach to the studs, and also drilled 5/16 holes 16 inches apart, then I drilled a countersink centered on those holes. Those holes fit a 5/16 bolt and washer. I painted the boards to match the wall, then attached them to the studs with 4 #8x 3″ wood screws at each end of the board.
Now I had two boards spanning the studs with 5/16″ bolts sticking out that matched the mounting holes on the cabinet that allowed me to bolt the cabinet to them.
If you look below the cabinet, you can see the old onQ panel this cabinet is replacing. Once all is done, I will remove it and drywall over the hole. Yeah, the reflections in the glass show the toilet paper and paper town reserves I keep on top of the laundry room cabinets.
Installing Equipment
I put a thermostat in the cabinet that will control the exhaust fan. Then I attached my devices to the racks:
12U Omada SG3218XP-M2 POE managed switch. This is the main switch for my network.
10U Keystone 24 pin patch panel. Ports1-5 are reserved for Infrastructure connections like modem, UPS, Moca, 6-15 are for POE devices like AP’s, 16-18 are for non powered devices, and 19 thru 24 are for cameras
9U is a SG2210XMP, currently an unused switch but I plan on having it be the switch for my future IP security cameras
8U, 7U, 6U are open.
5U is a shelf with a Moca unit, the modem, and a switch that cycles power to the gateway and modem in the event it cannot access the Internet
4U is a power distribution unit
3U and 2U are currently vacant, but will have a Synology RS1221+ as a storage drive and for future cameras
1U is a 500 watt UPS. I know it’s small for what I am powering, but I am only using it to bridge the second or two that it takes my Powerwalls to take over when grid power fails.
I got everything wired and labeled. The network is fully functional and stable, and the entire thing went as smoothly as I could have hoped. It took me longer to mount the cabinet on the wall than it did to get the network up and running. I now no longer have a home level network. This is bordering on prosumer level stuff.
You will note the empty slots for the second switch and the double drive server. Im waiting on parts for those. I will also neaten up the wires a bit.
Setting Up Virtual Networks
The last thing I did today was set up several VLANs:
Management, VLAN 10
VLAN 30 for IOT devices.
Servers, VLAN 40
Guest Network VLAN 50
Security Cameras, VLAN 60
To verify that it works, I logged in to the guest network SSID and was assigned an IP of 192.xx.50.x. I haven’t created rules yet, just wanted to make sure I did it correctly.
Moving Forward
Tomorrow, I will install the disk server, a Synology RS1221+. I don’t have disk drives for it yet, but that’s coming. Once that is installed, I will begin to place devices and clients into the various VLANs. Once that is sorted, I will begin assigning rules. One step at a time.
I am not planning on working on or installing cameras until the weather cools enough for me to get in the attic and run more Ethernet cables, so not until at least October or November.
Records, communication, and security are all important parts of prepping. A robust computer network can work of all of those things. We’ve talked about the other sections of the prepping pyramid, but haven’t spent a lot of time on how we can use information technology to strengthen the other sections of the pyramid.
I wasn’t happy with how crowded and sloppy the onQ panel that contains everything is. It looks like a bowl of spaghetti and even though I have the largest panel made, it’s still crowded.
I am using Ring Cameras for surveillance, but I am not happy with them, for reasons that will be covered in a future post.
I have a Terramaster NAS with four 4TB NvMe SSDs in it, but I can’t get those SSDs any more because they now cost 5 times more than they once did.
There is a second setup in the bedroom I use as an office. It has an Omada switch, and it runs my office equipment. The issue is the UPS there just died, and I want everything consolidated, so I am moving that into the main server.
So I have decided to make a few changes. We are keeping the Omada system, but I am making a few upgrades.
I am mounting a 12U server cabinet on the wall of the utility closet in the house. This will make things cleaner and easier to manage.
I will be putting an 8 bay HDD rack in the cabinet. It will be used as both a NDVR and as a NAS device.
Three rooms in the house are device dense: the living room, the master bedroom, and the office. I am going to clean up the architecture a bit to make things faster and more resilient.
So how are we doing this? Well, in the racks, there will be:
A rackmount UPS. I just need enough storage to ridge the second or two it takes my powerwalls to take over when the power fails.
Power distribution
An Omada controller
An Omada gateway
A 24 port keystone patch panel
An Omada 16 port managed POE switch
an 8 bay rackmount HDD rack.
A shelf where the modem will be, along with my current NAS (until the HDD rack is installed)
There will be 4 remaining U for future additions
Records
Records are important. Having copies of things like financial records, professional licenses, certifications, and other important documents will allow you to rebuild your life in the aftermath of a large disaster. Ask the residents whose lives were destroyed in Hurricane Katrina how important those records were in doing that. Having a robust set of electronic records with copies of every important document, all in a RAID, is a great step towards that goal. I am thinking of at least 12TB of RAID storage space for important files. I need it, because I scan every document, bill, and receipt that comes into this house.
Security
One or two of the HDD bays will be reserved for surveillance hard drives. I am looking at 20TB or more of storage space for the camera system. Once the weather gets cooler, I am planning on running Ethernet cables in the attic for a PTZ camera, two outdoor wide view cameras, a doorbell camera, and one or two covering other areas of the property, all in 4k. So, a total of 5-6 cameras that will record 24/7. That takes up more storage space than my documents and files.
That’s the hardware. I will also have it organized into several VLANs for network security. There will be a VLAN for:
One for infrastructure. This will allow APs to be on their own VLAN, as well as controllers and those sorts of things.
IOT devices, so I can limit how much they will spy on the rest of the house. They will only access each other and the Internet.
Entertainment devices like televisions and SONOS speakers. Internet only
A Guest VLAN that will only have access to a printer and the Internet
Then phones belonging to my wife and I that will have full access.
I will decide more on rules later, but that is the idea in my head for now.
Implementation
First step is to get all of the hardware installed and move the network that already exists into the server cabinet. Then I will setup VLANs. After that, we will install the HDD rack and move the NAS files there. I have another HDD based NAS that I can use as a backup file server.
Here is a continuation of my research on gun safes. I finally heard back from another company, Steelwater Gun Safes. This is what they had to say in response to my question about backdoor passwords:
Steelwater Gun Safes digital locks do not have a bypass code due to the bypass key lock. There is no need for a bypass code as the bypass key will allow access if the keypad fails or if the codes have been lost or forgotten. If a key is needed, the original purchaser on file must send us proper identification before a key can be purchased from us.
Their safes are much cheaper than the Champion that I was looking at in my earlier post, but since they are claiming that there is no back door, I will recommend them as a cheaper alternative for those who are looking for a new safe. From their literature, it looks to be a better product than the other safes in the midlevel price range ($2k-5k). The 42 inch safe costs around $3700. I will stress that I don’t have one, but it does look promising and the company says the right things.
I talked to a safe guy today. He suggested an even cheaper alternative: you can change the lock. Your choices are to buy a new lock, or you can simply swap locks with another person who has a safe with a compatible lock. As long as the backdoor that your safe company may have installed is particular to YOUR safe, and not every similar lock, it’s a cheap alternative. Or you can purchase a mechanical lock and do it that way. A new mechanical lock costs in the neighborhood of $140.
Disclaimer: I don’t advertise, and receive nothing for my reviews or articles. I have no relationship with any products, companies, or vendors that I review here, other than being a customer. If I ever *DO* have a financial interest, I will disclose it. Otherwise, I pay what you would pay. No discounts or other incentives here. I only post these things because I think that my readers would be interested.
Francis Porretto over there at Liberty’s Torch (I read them every day, don’t you?) asks a great question about the security of checks versus the security of credit cards. Since I do stories on information security, I thought it would make a good topic for a post here. Let me start by saying that I ran this by my wife, who actually teaches banking and finance, which was the topic of her Masters degree. She’s way smarter than I am on this topic. Here is our take:
Check Security
Those numbers that are on the bottom of your check are the routing and account numbers that tell the check processing companies (called the automated clearing house, or ACH) where to go in order to get paid. When a scammer has your bank account and routing numbers, they could set up bill payments for services you’re not using or transfer money out of your bank account. Getting those numbers is easy, because they are printed right there on your check, and most companies store that information on their computers, you know- the same computers that keep having data breaches. Scammers can create fake checks using your numbers and then use those fake checks to pay for purchases — or simply cash them. Know, too, that with technology scammers could digitally scan the check (called a “demand draft”) and deposit the amount into their bank account. Many banks now allow you to deposit a picture of a check. How and why does this happen?
It used to be that physical, paper checks had to be exchanged in order for banks to get paid. Shipping paper checks all over the country was costing them quite a bit of money, so they lobbied the government for a solution. Enter the Check Clearing for the 21st Century Act (Check 21 Act), which became effective on October 28, 2004. The Check 21 Act authorizes a new negotiable instrument called a “substitute check,” which is a reproduction of an original check, is the legal equivalent of an original check. In other words, all someone must do is have those numbers on the bottom of your check, and they now have access to your money. There is no way to password protect your account from this sort of scam, because Check 21 doesn’t mandate that the banks secure you from this sort of scam. Some banks will for PR reasons, but they mostly do not. It’s expensive to monitor fraud, and there is no real financial incentive for banks to do so with this sort of scam.
So a thief gets ahold of your checking and routing numbers, what next? The only defense is closing your bank account and getting another one. That’s a inconvenience, for sure. The bank may or may not be able to reverse the fraudulent transactions, but don’t count on it. Check 21 doesn’t say that they have to. While it doesn’t happen often, when scammers get those numbers, you frequently lose everything, and there is nothing that the bank can do. One charity I found fell victim to this and lost over $10,000.
Credit Card Security
Credit cards have a bit more legal protection. The law here is called the Fair Credit Billing Act, which requires creditors to give consumers 60 days to challenge certain disputed charges over $50 such as wrong amounts, inaccurate statements, undelivered or unacceptable goods, and transactions by unauthorized users. Also, the Act limits liability of consumers for transactions by unauthorized users to $50. Since this law forces banks to absorb losses for fraudulent charges over $50, banks have a financial incentive to monitor for fraud, and they do. In fact, if you report fraud, most banks don’t even worry about the $50.
Note that this law only applies to credit cards, not debit cards. Debit cards are treated the same as checks from the perspective of the law. I don’t EVER use my debit cards to pay for anything. I use them at bank owned ATMs only, and I keep my debit cards locked in the safe most of the time.
I myself have had my credit card numbers compromised on a few occasions. The last time was over two years ago, when someone was using my Barclay’s card to make unauthorized charges. The bank was telling me that the charges were legit because IMO, they didn’t want to eat the cost. The $845 that was stolen from me wasn’t worth the cost to hire a lawyer, but luckily the bank finally saw it my way and reversed the charges. I no longer use that card because Barclays was too difficult to deal with in the matter. I shouldn’t have to fight that hard to get a bank to follow the law.
Still, it was easier to switch credit cards than it would be to get a new checking account.
Conclusion
All forms of payment are vulnerable to electronic fraud, even though it’s relatively rare. You have more legal protections, and banks have a more robust fraud detection plan, when you use credit cards than when you use checks. Whenever possible, use credit cards to do business online. In fact, I have a couple of cashback cards that give me great benefits. One that I have gives me 5% cashback on all Amazon purchases, and another gives me 2% cashback on all purchases. I pay for everything with them, and pay them off at the end of each month. Stay disciplined and don’t spend more in a month than you can pay, and it’s a great way to give yourself a 2% raise and keep your money secure.
Update: Intel’s security issue was also found on AMD’s Inception, where a newfound security hole affects all Ryzen and Epyc processors. See the linked article for the most up to date details. This looks huge. It’s a guarantee that every person reading this is somehow affected. It’s a hardware level problem, so there is no real fix.
There are many people who say that they don’t trust some version of online business, whether it be passwords, password wallets, or some other version of encryption security. They claim that by keeping their passwords on paper, that this is a higher level of security than storing it on their computer. They are right, and they are wrong. The answer to this lies in the way that encryption works. I am greatly simplifying this, so it will be a bit easier to understand.
All digital encryption works using the same basic principles. Digital encryption is simply a very complex math problem where there is a formula that permits only one answer to a problem posed by the number that is put into it, the password. The output that results from the password being run through the algorithm is called the hash. There can only be one hash for each password. Password hashing is typical on the server side when the server operators don’t need to know the plaintext password, they just need to demonstrate that the user knows the plaintext.
A common hash function is Message-digest algorithm 5 (MD5), which takes a message of any length as input and converts it to an output of a fixed 128-bit hash value length to be used for authenticating the original message. Here are a few examples of what a hash looks like:
When you enter your password into a website, it is converted into a hash. If the hash matches the one that is on file, the website grants you access.
Small changes matter a lot – Take a look at examples 1 and 2. Just one digit has been shifted, from an “o” to a “0.” This is a very small change, and yet the second output is unrecognizable from the first.
The output length never changes – The input in example 3 is considerably longer than the other examples, yet it produces an output of the same length (32 characters). You could input an entire book into the md5() hash function and you would still get a 32-character string as the output.
Repeatable – An input will always give the same output when hashed using the same function. If this weren’t the case, they would just be generating a random output, which would be useless for passwords. (I included the same function in example 1 as example 4 just to see if you were paying attention.)
Knowing that hashes are the same length regardless of the password you choose, you might be tempted to pick a short, memorable password. In fact, you should do the opposite. The password you choose is critical for keeping your data secure. Why is that?
MD5 isn’t the only hashing algorithm. There are others, like the SHA-2 hash code family, one widely used today, with algorithms that are longer and harder to break. The names of SHA-2 algorithms are connected to length, so SHA-224 represents 224 bits in length. The same format works for SHA-256, SHA-384 and SHA-512. The more bits in the hash, the more complex and difficult it is to break, and the longer an input password that can be used.
If a website is hacked, cybercriminals don’t get access to your password. Instead, they just get access to the encrypted hash created by your password. It’s impossible to reverse a hash function, so trying millions of combinations to try and produce the same hash (a brute-force attack) is the way that hackers have been attacking passwords.
So that’s what they do. They breach a website because they want the hashes. Banks, Home Depot, Amazon, all of the breaches that you hear of where passwords are compromised, that’s what they are after. That’s what happened to LastPass, as well. They got the password wallets, which included the hashes for the master passwords.
Once a cybercriminal obtains password hashes from a website, the real process of password hacking begins. This process happens offline, on the cybercriminal’s computer. Cybercriminals put combinations of characters into a hashing function until a hash that matches yours is created.
Because the functions themselves are well known, password cybercriminals can easily calculate hashes for known words and other commonly chosen combinations. Then they scan for known hashes using commercially available cracking tools. These dictionaries go far beyond simple words. They include prefixes, suffixes, the practice of changing letters for numbers (e.g. 1 instead of l), and much more. This means weak passwords can be broken very quickly. Humans suck at random. That’s why human created passwords are garbage.
A long password is better, because it takes more to guess a long password than a short one. A random one is better, because this foils dictionary attacks. Not reusing passwords is a way to keep a hash found on one website from being matched with others.
69% of people admit to sharing some passwords with others
71% of people admit to using common passwords like p@ssw0rd, their pets’ names, or children’s birthdays
72% of people admit to reusing the same password on 4 or more accounts
56% of people claim that they would not use passwords at all if they could
The average user has 25 online accounts but uses just 6.5 passwords to protect them
So why does all of this matter? If you write your passwords on a piece of paper and then burn the paper, no one will ever get the passwords, but the hackers don’t care. They want the hash so they can brute force your passwords. It doesn’t matter if YOU use electronic password storage, because any company that you do business with does, but in the form of hashes. Using a password notebook like this one keeps the password out of electronics, but that doesn’t secure the hash.
They are so fast, that number-only passwords are useless. Even if you choose a good combination of letters, numbers, and special characters, passwords of eleven characters or less will be brute forced before a company even notifies the public of the breach. A series of leaks over the past few years containing 100 million passwords have given hackers dictionaries of passwords from people in different walks of life. The ever-growing list of leaked passwords allows programmers to write rules that make cracking algorithms faster and more accurate; password attacks have become cut-and-paste exercises that even script kiddies can perform with ease.
That’s why I was so pissed at LastPass for not disclosing the breach for months. How long is your password, what does it consist of, and how would it fare if the black hats had the hash to play with for 3 or 4 months? What if the black hat uses more than one computer?
That’s why, for now, I recommend that you use a randomly generated password comprised of numerals, special characters, uppercase, and lowercase letters, and your password should be no fewer than 17 characters long. Do not use words, even with common misspellings. Dictionary attacks live on words like p@ssw0rD123.
Diceware has a flaw in that it is susceptible to dictionary attacks. There are only 7,776 words in the diceware word list. Using that list to generate 4 words results in 3.6 quadrillion possible word combinations. That’s a lot for a human to guess, but a trivial exercise for a computer making a few billion guesses per second. If no other randomness is inserted, a 4 word password generated by diceware would be cracked in less than 3 hours. There was a time when diceware was a good idea, but increases in computing technology have made it useless.
That same technology makes other schemes just as useless: fingerprints, facial recognition, and others. A strong, random password and a hardware key are currently the only secure methods for identifying valid, authorized users.
There are new hashing algorithms that complicate the process of cracking, like SHA512, Bcrypt, or PBKDF2. The complexity of the math involved limits the speed of those cracking computers to less than a 10,000 guesses per second, which greatly increases security. However, it costs money for a business to stay current with this kind of technology, and many companies just aren’t willing to spend the cash. That means it is up to YOU to keep your password long and complicated.
Don’t be complacent. There was a time when an 8 character password was nearly impervious to attack.
