OED tools: Chocolatey
The problem Install software on Windows and keep it updated is a boring and repetitive task. Linux and BSD/OSX users can install software from packages and keep it updated with a simple apt-get update;apt-get upgrade command. Wouldn’t it be great to have the same feature on Windows? The automation Chocolatey is a package manager for […]Moving Up The Stack
Today, IT is all about the applications. But for many administrators and engineers, moving up the stack comes with some anxiety.
Figure 1:
Lenovo Thinkpad T420: Another excellent, inexpensive Linux laptop
For the past three years, I have been using a Lenovo Thinkpad T400 as my main platform for researching open-source network simulators and emulators. The T400 is an excellent, inexpensive computer that, even today, offers excellent value.
But, I need a computer that supports high-resolution external monitors so it must have a DisplayPort output. I also want to expand the number of VMs I can run concurrently with adequate performance so I need a processor that supports HyperThreading. I want to switch to the Ubuntu Linux distribution and the Ubuntu Unity desktop environment needs just a bit more processing power to run smoothly.
I recently purchased a used Lenovo Thinkpad T420 laptop, which offers everything I want and more. It is a five-year old product but it offers all the ports and performance I need. Because it is well past its depreciation curve, anyone can purchase a used T420 for a very low price. Read on to learn more about the Lenovo Thinkpad T420, another excellent and inexpensive Linux platform.
The Lenovo Thinkpad T420
The Lenovo Thinkpad T420 is a business-class notebook produced in 2011 that was leased in large volumes by companies for use by their employees. Now, Continue reading
Channel Bonding In WiFi And Radio Frequency Physics
Using larger channels improves WLAN capacity, but the laws of RF physics can pose challenges when putting channel bonding into practice.
Cisco Leads, But HP Nipping At Its Heels
Cisco maintains its lead in several enterprise infrastructure markets, but Hewlett Packard Enterprise is challenging its dominance, according to new research.
Cisco Leads, But HP Nipping At Its Heels
Cisco maintains its lead in several enterprise infrastructure markets, but Hewlett Packard Enterprise is challenging its dominance, according to new research.Uncovering the Seven Pointed Dagger
The full report “Uncovering the Seven Pointed Dagger: Discovery of the Trochilus RAT and Other Targeted Threats” can be downloaded here.
Threat actors with strategic interest in the affairs of other governments and civil society organizations have been launching targeted exploitation campaigns for years. Typically, these campaigns leverage spear phishing as the delivery vector and often include malicious attachments designed to bypass typical detection controls. In other cases, spear phish directs users to websites that would otherwise be trusted but actually have been compromised by threat actors seeking greater access to fulfill their actions and objectives.
In late 2015, ASERT began investigations into a Strategic Web Compromise (aka “Watering Hole”) involving websites operated by the government of Myanmar and associated with recent elections. All indicators suggest that the compromises were performed by an actor group known to collaborators at Cisco’s Talos Group as “Group 27”. These initial findings – focused around the PlugX malware – were released by ASERT in a report called “Defending the White Elephant.” Analysis of PlugX malware configuration suggested that Special Economic Zones (SEZs) in Myanmar were of interest.
Following the trail of emergent threat activity, ASERT has discovered a new Remote Access Trojan (RAT) in use Continue reading
Uncovering the Seven Pointed Dagger
The full report “Uncovering the Seven Pointed Dagger: Discovery of the Trochilus RAT and Other Targeted Threats” can be downloaded here. Threat actors with strategic interest in the affairs of other governments and civil society organizations have been launching targeted exploitation campaigns for years. Typically, these campaigns leverage spear phishing as the delivery vector and often […]NZ IPv6 & DNSSEC Update
A year ago I published a table of New Zealand ISP IPv6 support. At the time support was fairly poor. I’m pleased to report that things have gotten better over the last year. There has also been a very pleasing uptick in DNSSEC support.
IPv6 Changes
The big movers here are Trustpower & Orcon, who have both enabled IPv6 by default for their users. So now we have the two largest ISPs still only offering IPv4, but all of the next tier of ISPs are offering IPv6. New Zealand has a flexible ISP market, and almost all consumers can change provider quickly & easily. This means that IPv6 is effectively available for all who want it.
New Zealand IPv6 Availability – Click image to see APNIC data
The numbers are still small, but we can see a move upwards towards the end of the year when Orcon & Trustpower enabled IPv6. Many legacy home routers have IPv6 disabled, but as these get replaced/reconfigured, I expect to see a steady increase in IPv6 uptake across those ISPs.
The two market leaders – Spark & Vodafone still only offer broken promises. In 2014 Vodafone implied it was not far away: “I can Continue reading
The Sad State of Enterprise Networking
John wrote an optimistic comment to my fashionable designs rant:
Nobody in their right mind does "fashionable" things when dealing with infrastructures that are required to be solid, dependable and robust.
Unfortunately many enterprises aren’t that prudent – the last Expert Express engagement I had in 2015 was yet another customer who lost two major data centers due to a bridging loop spilling over a stretched VLAN infrastructure.
Read more ...BASH Script for Dictionary Attack Against SSH Server
Although they are several dictionary password attack tools available for Linux such as Hydra, Ncrack, I have decided to practice BASH scripting and write a script getsshpass.sh that can perform dictionary attack against SSH server. The script reads usernames and passwords from dictionaries (the one for usernames and the one for passwords) and uses them one-by-one during its login attempt to remote SSH server. Once correct username and password are found, the script save them to the file result.txt and displays them on the desktop. Then it exits.
The script can be started either in a serial mode that opens only single SSH session to SSH server or in a parallel mode which allows multipe SSH sessions to be opened at the same time. Below are parameters of the script.
Picture 1 - Script Parameters
All parameters are self-explanatory. If a parameter -l is not entered the script is started in a default serial mode. In case of parallel mode is used (-l parameter) it is recommended to use -l parameter together with -n parameter. The -n parameter slows down generating SSH sessions by inserting fixed number of seconds before a new SSH session is generated. This helps the attack to be successful. According to my findings during Continue reading
How many penalty points does a BGP route get for each flap, when Route Dampening is enabled ?
How many penalty points does a BGP route get for each flap, when Route Dampening is enabled ?
Think of the answer before reading the post...