Weekend Reads 022522

To some degree, cyber AI suffers from the pressures exerted by the quest for never-ending sales growth.

The websites for several banks in Ukraine, the Ministry of Defense, and Armed Forces were hit with a distributed denial-of-service (DDoS) attack on Feb. 15.

Threat actors are using software and developer infrastructure, platforms, and providers as valuable entry points into governments, corporations, and critical infrastructure.

Cybercriminals and nation-state actors adapted to defenders’ tactics and became more efficient in 2021, with attackers relying more on data leaks combined with ransomware to extort increasing sums of money from companies — and in some cases using data leaks without encrypting data to force a company to pay, according to two analyses published this week.

Cloud and multi-cloud adoption has greatly increased the workload of already burdened IT teams. Of the 200 IT leaders surveyed, only about half of the respondents said that they are adequately staffed to manage the frequency of alerts they receive.

Imagine that you run an organization out of a building. Imagine that the landlord comes one day and says, “Oh I didn’t know you are a resident of country X or dealing with anybody from country X. I have to close Continue reading

Hedge 119: Product Marketing with Cathy Gadecki

Marketing is an underappreciated (and even demonized) part of the process in creating and managing networking products. Cathy Gadecki of Juniper joins Russ White and Tom Ammon on this episode of the Hedge to fill in the background and discuss the importance of marketing, and some of the odd corners where marketing impacts product development.

download

Controversial Reads 021921

The main purpose of algorithms, like digital programs and datacenters more broadly, is not to make money or influence thoughts, but to control people—in a direct and alien way hostile to our core beliefs and principles.

But as I testified to the Senate last week, you can basically reidentify anything. “Anonymity” is an abstraction.

Many people think that NoSQL databases are the “next big thing” in technology, and that we should write all of our core applications using them. However, NoSQL databases actually predate relational databases, and common relational databases were established to solve the problems that NoSQL brings.

One reason is that the most widely used methods of recycling more traditional batteries, like lead-acid batteries, don’t work well with Li batteries. The latter are typically larger, heavier, much more complex and even dangerous if taken apart wrong.

Apple has a rather complicated relationship with privacy, which it always points to as a differentiator with Google. But delivering on it is a different tale.

The problem is Web3 is not all that distributed, nor is it particularly equitable or transparent. It is highly centralized, despite being touted as a decentralized alternative to the web.

But rampant misinformation and days-long internet Continue reading

Weekend Reads 021821

A new DeadBolt ransomware group is encrypting QNAP NAS devices worldwide using what they claim is a zero-day vulnerability in the device’s software.

A simulated phishing attack against more than 82,000 workers found that emails with a personal impact resulted in more clicks and that technical teams — such as IT workers and DevOps teams — clicked just as often and reported suspected phishing attacks less often compared with nontechnical teams

Google on Tuesday announced that it is abandoning its controversial plans for replacing third-party cookies in favor of a new Privacy Sandbox proposal called Topics, which categorizes users’ browsing habits into approximately 350 topics.

NFTs continue to explode in popularity, reaching $25 billion in sales in 2021 as reported by Reuters. NFTs, or non-fungible tokens, are cryptoassets in which each token is unique.

The use in almost every aspect of human activity adds value to the need of UAS evolution, but it also increases security risks. Imagine what can happen when smart and cheap drones that anyone can easily purchase from a local hobby store become weapons at the hands of adversaries and cyber criminals.

Researchers have demonstrated a new type of fingerprinting technique that exploits a machine’s graphics Continue reading

Hedge 118: Integrating New Ideas with William Collins

When vendors build something new—or when you decide to go a different direction in your network—you have to figure out how to integrate these new things. Integration of this type often includes cultural, as well as technical, changes. William Collins joins Tom Ammon and Russ White to discuss his experience in integrating new technologies on Hedge 118.

Infrastructure Privacy Webinar

I’m teaching a three-hour webinar on privacy over at Safari Books on Friday. From the description there—

Privacy is important to every IT professional, including network engineers—but there is very little training oriented towards anyone other than privacy professionals. This training aims to provide a high-level overview of privacy and how privacy impacts network engineers. Information technology professionals are often perceived as “experts” on “all things IT,” and hence are bound to face questions about the importance of privacy, and how individual users can protect their privacy in more public settings.

Please join me for this—it’s a very important topic largely ignored in the infrastructure space.

Providers and Privacy at NANOG 84

I’m speaking (in person) at NANOG84 on providers and privacy—

Privacy is a hot topic, but there’s little information for the networking professional in this area. This presentation will provide a quick overview and thoughts on the area of privacy aimed at transit provider operations personnel, including packet processing and logging. Note this presentation does not constitute legal advice, but rather just presents general concepts and thoughts from the perspective of a network engineer in an area of interest.

Hedge 117: Mike Bushong and the Product Process

Continuing our series on how vendors build networking products, Mike Bushong joins this episode of the Hedge to discuss the overall process, the importance of the product manager, and the importance of managing and selling change. Join Tom Ammon, Eyvonne, and Russ White as we discuss how vendors build products.

download

DC Fabric Intelligence Panel at DCD

On the 10th of February (next week) I’m participating in a panel discussing—

A networking strategy involving disaggregation deployment, overlay network virtualization, automation, and visibility can remedy the complexities with better utilization and performance and ultimately enable network slicing and self-healing abilities. Cloudification of the network is here, but how far do we need to go, and what is the impact on the hardware?

You can find more information about joining here.

Why Privacy?

I’ve kicked off a series over at Packet Pushers on the ; the first installment is up now.

What does privacy have to do with running a network? Quite a bit. For instance, maintaining privacy is one of the most important reasons to take security seriously—the privacy of confidential company information and the privacy of individual network users.

There’s a chapter in my new book on the topic, as well.

Weekend Reads 012822

DigiTimes reports that processor prices are set to increase “substantially” in 2022 due to a boost in foundry costs. Specifically, processors based on the sub-7nm process nodes are expected to be more expensive moving forward.

For the past four months, Apple’s iOS and iPadOS devices and Safari browser have violated one of the Internet’s most sacrosanct security policies. The violation results from a bug that leaks user identities and browsing activity in real time.

Although the advisory discussed above is specific to Russian threat actors, the lessons learned and approaches to preparedness, detection, and prevention are generically applicable to a wide range of threats for both IT and OT.

An active espionage campaign has been attributed to the threat actor known as Molerats that abuses legitimate cloud services like Google Drive and Dropbox to host malware payloads and for command-and-control and the exfiltration of data from targets across the Middle East.

HTTPS serves as a critical infrastructure for web security, protecting the privacy and integrity of communications between networks. An important aspect of the extension is the authentication process, which is powered by Web PKI via digital certificates that are issued by Certificate Authorities (CAs).

Their intention is to expand Continue reading

Hedge 116: Schofield’s Laws of Computing

Jack Schofield, a prolific journalist covering computers and computing, developed three “laws” across his thirty years of reporting that have come to be known as Schofield’s Laws of Computing. What are these laws, and how do they apply to the modern computing landscape—especially for the network engineer? Join Tom Ammon and Russ White as they discuss Schofield’s Laws of Computing.

download

Weekend Reads 012222

When you’re out and about, and especially when you’re traveling, you might find yourself feeling quite a bit of anxiety when logging into public Wi-Fi.

There are a lot of resources out there on Twitter, Reddit, and YouTube about this epic vulnerability. I wanted to create this post to summarize the main things I learned, ways to test it as pentester, and the mitigation controls that help prevent the exploitation of this vulnerability.

A Romanian vulnerability researcher has discovered more than 70 flaws in combinations of cloud applications and content delivery networks (CDNs) that could be used to poison the CDN caches and result in denial-of-service (DoS) attacks on the applications.

As we look ahead into 2022, the datacenter compute landscape is considerably richer than it was a decade ago.

In a perfectly regulated industry, both the industry and the public should be miffed at regulators for not fully supporting their issues.

One could argue that the last few years have highlighted some of the most pressing semiconductor industry issues but there are challenges on the horizon well beyond current supply chain and silicon manufacturing bottlenecks.

In light of recent incidents that impacted both information technology (IT) and operational technology Continue reading

Hedge 115: Mat Duggan and DevOps

Devops is the new normal—but, far too often, operations folks (like network engineers) are expected to become full-on developers, and developers are expected to understand operations in ways they never had to before. Mat Duggan joins Tom Ammon and Russ White to discuss why operations is not development IT

download

Unintended Dystopia

I’ve recently finished my 16th book (according to Goodreads, at any rate). This one is a little different than my normal fare—it’s essentially an expanded and revised version of the dissertation. Rather than being about technology proper, this latest is an examination of the history and philosophy of the superset of social media, which I’ve dubbed neurodigital media.

Fair warning, some readers might find this book a little … controversial.

From the back of the book—

Social media, shopping experiences, and mapping programs might not seem like they have much in common, but they are all built on neurodigital media. What is neurodigital media? It lives at the intersection of the Californian Ideology, the digital computing revolution, network ecosystems, the nudge, and a naturalistic view of the person. The Californian Ideology holds individuals should be reshaped, naturalism says individuals may be reshaped, and digital computing provides the tools, through network ecosystems theory and the nudge, that can reshape individuals. This book explores the history and impact of neurodigital media in the lives of everyday users.

Hedge 114: Hardware Hacking 101 with Federico Lucifredi

Hardware hacking isn’t a topic most network engineers are familiar with—but we always used to say that if I can get access to the console of a router, I can eventually get into the box. The same is largely true of all kinds of computing hardware, including laptops, compute nodes connected to a data center fabric, and, again, routers and switches. In this episode of the Hedge, Federico Lucifredi joins Tom Ammon and Russ White to discuss the many options hardware hackers have today.

download

How the Internet Really Works Part 2

I’m a little late in posting this, but I thought I’d put it out here anyway. Tomorrow I’m teaching through a three-hour webinar, How the Internet Really Works part 2. From the session description—

This training will provide short reviews of many of these systems and a deeper look at the many tools network engineers can use to discover the information they need to navigate through the DNS and routing systems on the global Internet. This training will be arranged as a set of case studies posing a problem, and then working through tools available to gather the information needed to understand the problem.

You can register here.

Hedge 113: The PLM with Jeff Jakab

Over the last few episodes of the Hedge, we’ve been talking to folks involved in bringing network products to market. In this episode, Tom Ammon and Russ White talk to Jeff Jakab about the role of the Product Line Manager in helping bring new networking products to life. Join us to understand the roles various people play in the vendor side of the world—both so you can understand the range of roles network engineers can play at a vendor, and so you can better understand how products are designed, developed, and deployed.

download

Quality is (too often) the missing ingredient

Software Eats the World?

I’m told software is going to eat the world very soon now. Everything already is, or will be, software based. To some folks, this sounds completely wonderful, but—leaving aside the privacy issues—I still see an elephant in the room with this vision of the future.

Quality.

Let me give you some recent examples.

First, ceiling fans. Modern ceiling fans, in case you didn’t know, don’t rely on the wall switch and pull chains. Instead, they rely on remote controls. This is brilliant—you can dim the light, change the speed of the fan, etc., from a remote control. No unsightly chains hanging from the ceiling.

Well, it’s brilliant so long as it works. I’ve replaced three of the four ceiling fans in my house. Two of the remote controls have somehow attached themselves to two of the three fans. It’s impossible to control one of the fans without also controlling the other. They sometimes get into this entertaining mode where turning one fan off turns the other one on.

For the third one—the one hanging from a 13-foot ceiling—the remote control sometimes operates one of the other fans, and sometimes the fan its supposed to operate. Continue reading

Weekend Reads 121721

Unfortunately, when engineers are entrusted with the task of delivering smooth video streaming to our users, we face numerous challenges from ‘last-mile’ wireless connections.

Exploit code has been released for a serious code-execution vulnerability in Log4j, an open source logging utility that’s used in countless apps, including those used by large enterprise organizations, several websites reported last Thursday.

The Tuesday outage at an Amazon Web Services data center affected services from several collaboration software vendors, highlighting how reliant companies have become on cloud providers for a variety of workplace tools.

Amazon.com Inc.’s ubiquitous cloud-computing network, the spine for a lot of digital communications and transactions across the U.S., went dark for several hours on Tuesday.

This is the hoarder’s mentality. “I can’t use this right now, but maybe I will some other time.”

More than 35,000 Java packages, amounting to over 8% of the Maven Central repository (the most significant Java package repository), have been impacted by the recently disclosed log4j vulnerabilities

So much for a quiet holiday season: CVE-2021-44228 (aka Log4Shell) may well be the most impactful vulnerability we’ve seen in years.

Cybersecurity researchers have demonstrated a new attack technique that makes it possible Continue reading