Skip to content

v2.33.14 — Security Hardening, Activity Feed & TSCM Survey

Choose a tag to compare

View all tags
@smittix smittix released this 24 Sep 12:47
· 41 commits to main since this release
v2.33.14
3e7712f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Everything since v2.33.0 (2.33.1 to 2.33.14). Please read Before you upgrade: this release closes several security holes, and two of the fixes change behaviour.

Before you upgrade

  • Remote agents need an API key to push data. /controller/api/ingest now refuses an agent without one. Set a key on each agent in Settings, and in the agent's own controller_api_key configuration.
  • A password you did not choose must be changed. The shipped admin default is gone. With no INTERCEPT_ADMIN_PASSWORD set, first run generates a password, logs it and writes it to instance/.initial_password. An install still on a generated password or on admin is sent to /change-password at login.
  • 433 MHz sensor units default to Metric. To keep the old behaviour, choose "Native (as each device reports)" in the sensor panel.

Security

  • The /controller/* API required no authentication. Anyone who could reach the port could list agents (and their API keys) and register or remove agents. It now requires a login.
  • Agent API keys were returned to clients. GET /controller/agents responses carried every agent's key.
  • Agent push accepted unauthenticated data for agents registered without a key.
  • WebSocket endpoints (/ws/*, live RF and audio) skipped authentication.
  • Path traversal in /offline/check-asset. It could reveal whether a file existed, but not its contents.
  • Session hardening:
    • HttpOnly and SameSite cookies are set explicitly.
    • Secure cookies are used under TLS.
    • instance/secret.key is created with mode 0600.
    • Logout clears the whole session.

New

  • Activity feed (Intel > Activity). Sightings from every mode that reports them in one stream, newest first:
    • colour-coded by source;
    • filterable by source, time window or a single device;
    • pausable without losing anything.
  • Volume and retention for sightings:
    • A busy ADS-B feed is thinned so it can't flood the feed.
    • Sightings are kept 24 hours by default (INTERCEPT_OBSERVATION_RETENTION_HOURS, INTERCEPT_OBSERVATION_MAX_ROWS).
    • An API is included: GET /observations, plus /observations/stream and /observations/stats.
  • TSCM Survey workspace (Intel > TSCM Survey). One page walks a survey in order:
    1. the active baseline and its health;
    2. what the latest sweep shows that the baseline didn't;
    3. known devices;
    4. threats and findings;
    5. the report.
  • Named SDR devices with per-device settings (Settings > SDR):
    • A display name for each receiver.
    • PPM correction, default gain and bias-T, applied by every mode on every start, and by remote agents.
    • Requested in #269.
  • Notes and tags on any device. They are kept across restarts and shown wherever the device appears. A note doesn't mark a device known-good.
  • Copy buttons on ICAO, MMSI, MAC, BSSID and Meshtastic node identifiers.
  • Elapsed times ("14 s ago") in live lists, with the exact time on hover.
  • Empty lists say why they're empty: "rtl_433 running · 0 readings in 4 s", stopped, or the reason it failed to start, naming the missing tool or busy device.
  • Kill All Processes from every page, in the global and mobile nav.
  • 433 MHz unit selection: Metric, Imperial or Native.

Changed

  • Hidden tabs stop polling clocks, countdowns and status. On the main page in pager mode this cut 925 interval callbacks a minute to 101, and 39 requests a minute to 3. Data streams and recording are unaffected.
  • Install advice matches your platform. It no longer tells Linux users to use Homebrew.
  • TSCM client reports state measurements rather than labels. For example, "-48 dBm, observed for 80 minutes (40 sightings)" replaces "Strong (Confidence: High)". The unexplained risk score and HIGH/ELEVATED ratings are gone from the client report. The JSON and CSV annexes keep them for the practitioner.

Fixed

  • A TSCM sweep that detected nothing was reported as clear. It now reads INCONCLUSIVE and says why.
  • Other TSCM report fixes:
    • Every finding read "Minimal (Confidence: Low)".
    • The CSV annex listed every device as informational with score 0.
    • CSV cells could run as spreadsheet formulas.
    • Sweep times were shown in UTC as if local.
    • Reporting on an unfinished sweep failed.
  • Mode lifecycle. Every mode is now tested for start, stop, restart, a missing tool, a double start and garbage on the decoder's output. That found 11 bugs, including:
    • stopping Morse or OOK could hang;
    • a failed start left the SDR marked busy until restart;
    • one corrupt byte ended the receiver waterfall;
    • Meshtastic with no USB device reported itself running;
    • two Meshtastic serial ports could shut the server down.
  • Several modes reported a missing tool as a vague server error, or a failed start as success.
  • Kill All could stop partway.
  • rtlamr ignored PPM correction and couldn't connect. The correction was passed as rtl_tcp's port flag.
  • DSC call types were mislabelled. A routine call showed as DISTRESS and a real distress alert as INDIVIDUAL.
  • ADS-B aircraft from a remote agent never cleared from the map.
  • Meshtastic nodes sometimes appeared only after a reload.
  • ACARS crashed with Illegal instruction in the amd64 Docker image on CPUs without AVX-512.
  • Running the test suite no longer touches a real install's database or .initial_password (#288).

Full detail in CHANGELOG.md.

Assets 2
Loading