US101 - Maintenance

[U039b]

Description: We manufacture PiRogues to supply organizations, while taking care of its maintenance. We will include OS upgrades, improvement of the documentation and fixing bugs. Regarding Colander and Threatr, we maintain the public Colander server, upgrade dependencies, improve the documentation and fix bugs.

[CyrilBrulebois]

This month

While deploying officially supported Raspberry Pi 3 and Pi 4 devices, the outdatedness of the last PiRogue OS release became apparent. Since the historical tool used to turn Debian images for Raspberry Pi into PiRogue images was relicensed, it was replaced with another implementation.

After experimenting with the Raspberry Pi 5, the new tooling was extended to generate a different, experimental image to support it, alongside the official image supporting Pi 3 and Pi 4.

A new release arm64_v2.1.0 was published, catching up with Debian 12.6, supporting Pi 3 and Pi 4 officially, and Pi 5 experimentally and unofficially.

Next month

Support for the Raspberry Pi 5 requires some components outside the Debian and PiRogue ecosystems, which might make upgrades a little more complicated than usual. It would be best to perform test runs for scenarios that could be problematic, see if theoretical problems are likely to happen, making it possible to either avoid them entirely, or be ready to tackle them when they show up.

Challenges

Unfortunately, the Debian images for Raspberry Pi that are turned into PiRogue images are also outdated (compared to the updates in Debian 12). Until it's resolved on the Debian side, an independent image build has been set up, to ensure images are generated weekly.

[TontonSancho]

This month

The Colander API and the Colander Python client v1.0.4 now support querying Teams, creating Cases, and both querying and creating relationships between Entities. The Python client now supports the files *.metadata.json, generated by the pirogue-evidence-collector, to inject the metadata in the attributes of the collected artifact.

Regarding the distribution of the Debian packages we maintain, we have introduced an archive keyring which is the minimal collection of PGP keys. It provides the keys that are used when signing the release of the Debian packages we publish on our PPA.

Support for Raspberry Pi 5 was improved by merging the required packages in our repository and adjusting our image generation process accordingly. This means we're back to the original situation, just like in the case of Raspberry Pi 3 and Pi 4 images: users only need official Debian and PTS repositories (no more extra Raspberry OS repository).

Next month

No further work is planned regarding Raspberry Pi 5 support. We hope to have mainline and Debian support in the next major Debian release (Debian 13 “Trixie”, scheduled mid 2025), at which point the separate, experimental image for Raspberry Pi 5 can be retired.

We will continue the maintenance of all the Debian packages we maintain.

Challenges

We don't want to stay on the same version of linux-image-* packages merged from Raspberry OS repositories forever. So the deb-frido tool — used to automate Frida packaging — was extended to monitor packages we care about (in Debian and in Raspberry OS repositories), so that PTS developers are notified of package updates.

[U039b]

This month

We have improved the API of Threatr to support observability such as the status of the configuration or the size of its cache. The status of the Threatr service can be checked on the status page of Colander.

We have released the version v1.0.5 of the Python client for Colander to add a method to download the decrypted traffic of a PiRogue experiment.

We have started working on implementing a tool to convert PCAPNG files to HAR. The purpose is to make it possible to open the decrypted network traffic in the Network tab of the web browser developer tools.

We have published the version 16.5.2 of Frida.

Next month

We will continue the maintenance of all the tools and Debian packages we maintain.

Challenges

None.

[U039b]

This month

A new version v1.0.5 of pcapng-utils has been released. And the package is now available on:

• our PPA as a Debian package
• PyPi as a Python library

This new version supports 2 types of HAR enrichment:

• it adds the stacktrace associated with a network communication
• it replaces encrypted payloads with decrypted once

Find more details on GitHub.

We have improved the UX of the Investigate workspace of Colander, making its usage less confusing. A showstopper bug has been fixed in Colander as it was no longer possible to quickly create multiple entities at once. This bug was introduced when we reworked the Investigate workspace last month.

We have updated the Linux kernel for Raspberry Pi 5 to v1:6.6.51-1+rpt2.

Next month

We will continue the maintenance of all the tools and Debian packages we maintain.

Challenges

None.

[TontonSancho]

This month

We have improved the graph editor to address incompatibilities with browsers based on WebKit (e.g: Safari), this includes the fix of:

• a wrong font fallback in contextual action menu
• the contextual menu and the missing graph actions on Safari due to missing custom HTML element API implementation

We have improved the Colander documentation editor to prevent the loss of unsaved documentation changes when navigating between pages, prompting users to either save or discard their modifications.

Next month

We will continue the maintenance of the tools and the Debian packages we maintain.

Challenges

None.

[U039b]

This month

Thanks to a report by the Qurium team, we've been able to confirm and fix an issue regarding interface detection in pirogue-admin package, which shows up when performing the autodetection at install-time, when the bonding module is loaded. The issue resulted in selecting bonding_masters as the isolated network interface.
Because bonding_masters is a file, not a directory, it lacks a uevent and defaults to DevType.ETHERNET, causing the issue. While excluding this name is possible, other similar entries might exist, making a comprehensive list difficult to maintain. Therefore, we propose requiring a type entry in each net_dir (regardless of whether it's a symlink or directory, as type filtering is complex), as documented in Documentation/ABI/testing/sysfs-class-net.

The version 2.0.6 of the package pirogue-admin fixes this issue.

Next month

We will continue the maintenance of the tools and the Debian packages we maintain.

Challenges

None.

[TontonSancho]

This month

A new visual concept has been introduced to improve the readability of sidebar menus when users navigate through submenus and categories. This rework introduces the pin to sidebar principle, allowing users to pin and unpin subgraphs. If user feedback is positive, it will be generalized to other types of entities and menus.

The graph editor has been improved in terms of user experience. The focused entity from the entity list sidepane is now highlighted and better centered in the current visible viewport.

Next month

Following the Interoperability roadmap, the Vue3 HAR analyzer will be integrated into Colander. Additionally, Vue2 components will be migrated and re-packaged for Vue3.

Challenges

None.

[U039b]

This month

The migration of Vue3 components is progressing smoothly. To support more modern component development, a new build workflow has been implemented. Additionally, the Colander front-end engine now declares a new components registry that can be queried globally by any widgets.

Minor low-level asynchronous processing in Colander has been improved.

Next month

The HAR analyzer build workflow will be updated to conform to the Vue3 composition model and subsequently added to the Colander component registry.

[TontonSancho]

This month

Security

The security audit has revealed a security issue affects PiRogue when the IP address of its external network changes. In fact, PiRogue's network configuration system struggles with adapting to network changes, particularly when DHCP IP reassignment or network reconfiguration occurs. This limitation stems from a static configuration design, where hardcoded IP addresses and dependencies on the initial network topology prevent dynamic adjustments. As a result, any network change can trigger cascading service failures, impacting multiple critical components. Security controls may stop functioning, the traffic monitoring dashboard can become inaccessible, and system monitoring capabilities may be compromised, making recovery difficult. These failures lead to a broader operational impact, including security boundary breaches, disruptions in traffic monitoring, service availability issues, and gaps in security oversight.

This security issue has been fixed and a new version of pirogue-admin Debian package has been released (version 2.0.7) to include this security patch. We’ve implemented network configuration monitoring based on kernel events to detect changes and automatically reconfigure the PiRogue.

To address security vulnerabilities introduced by some dependencies of Colander, we've updated Django framework to version 4.2.20 and Python runtime Docker image to version 3.12.

Improvements

We've discovered that the implementation of FileField in Django when used with S3 storage could lead to storage space starvation. We've patched the file management internals to ensure stored files can be overwritten instead of being duplicated.

Minor flaws in the user interface layout have been identified and resolved. In certain edge cases, unnecessary scroll horizontal bars were appearing at the workspace level.

While the whole Colander front-end is progressively migrated to a modern framework like Vue3, a significant amount of rework has been done of the build system workflow. This allows us to proceed to a huge code base cleanup. Finally, the HAR analyzer project has been patched to accommodate Colander integration and reworked to be used has a generic library by any Vue3 projects.

Next month

HAR analyzer will be published to NPM registry. We will continue cleaning up and modernizing the Colander front-end build workflow.

Challenges

None.

[TontonSancho]

This month

Security

The Vulnerability 2.4 impacting PiRogue has been fixed and released in the package pirogue-external-exposure version 2.0.4. The dashboard is now accessible in HTTPS only, 2 cookbooks detail how to verify and trust the self-signed certificate:

• Trust PiRogue self-signed certificate
• Verify PiRogue self-signed certificate

The Vulnerability 2.3 impacting PiRogue OS has been fixed and released in the PiRogue OS image version arm64_2.3.0. Now, upon their first login to PiRogue, the user is requested to change their password.

Improvements

The HAR Analyzer has been published on npmjs.org and is available to anyone who wants to integrate it in their projects. This component is already integrated in the Colander artifact preview pages.

With the integration of Mandolin, artifacts stored in Colander are automatically analyzed with Apache Tika. This analysis extracts artifact metadata like the geolocation information stored in a picture and the content of documents or images by leveraging OCR if necessary.

Next Month

We will continue the maintenance of the tools, Debian packages we maintain and Colander ecosystem.