Worth Reading: Distrusting Symantic Certificates

At the end of July, the Chrome team and the PKI community converged upon a plan to reduce, and ultimately remove, trust in Symantec’s infrastructure in order to uphold users’ security and privacy when browsing the web. This plan, arrived at after significant debate on the blink-dev forum, would allow reasonable time for a transition to new, independently-operated Managed Partner Infrastructure while Symantec modernizes and redesigns its infrastructure to adhere to industry standards. This post reiterates this plan and includes a timeline detailing when site operators may need to obtain new certificates. —Devon O’Brien, Ryan Sleevi, Andrew Whalley @ Google Security

The post Worth Reading: Distrusting Symantic Certificates appeared first on rule 11 reader.

Hanging Bridge

The post Hanging Bridge appeared first on rule 11 reader.

Worth Reading: BlueBorne

Bluetooth is ubiquitous, commonly connecting accessories like headsets and keyboards, but is also used throughout the brave new Internet of Things (IoT) world. An attacker exploiting these BlueBorne vulnerabilities can mount a man-in-the-middle attack, or even take control of a device without the user even noticing it. The vulnerabilities were discovered by a security company called Armis earlier this year. Researchers reached out to the companies responsible for vulnerable implementations that lead to the coordinated disclosure (and patches) on September 12. —Andrei Robachevsky @ The Internet Society

The post Worth Reading: BlueBorne appeared first on rule 11 reader.

Worth Reading: Why you shouldn’t use your face to unlock your phone

Today Apple announced its new FaceID technology. It’s a new way to unlock your phone through facial recognition. All you have to do is look at your phone and it will recognize you and unlock itself. At time of writing, nobody outside of Apple has tested the security of FaceID. So this article is about the security of facial recognition, and other forms of biometric identification in general.Historically, biometric identification has been insecure. … If you value the security of your data — your email, social media accounts, family photos, the history of every place you’ve ever been with your phone — then I recommend against using biometric identification. Instead, use a passcode to unlock your phone. —Quincy Larson @ Free Code Camp

The post Worth Reading: Why you shouldn’t use your face to unlock your phone appeared first on rule 11 reader.

On the ‘net: Fragmentation and IPv6

Does this mean we ban all filtering of traffic on the public Internet, imposing the end-to-end rule in earnest, leaving all security to the end hosts? This does seem to be the flavor of the original IPv6 discussions around stateful packet filters. This does not, however, seem like the most realistic option available; the stronger defense is not a single perfect wall, but rather a series of less than perfect walls. Defense in depth will beat a single firewall every time. Another alternative is to accept another bit of reality we often forget in the network engineering world: abstractions leak. The end-to-end principle describes a perfectly abstracted system capable of carrying traffic from one host to another, and a perfectly abstracted set of hosts between which traffic is being carried.

The full post can be read over at the ECI blog.

The post On the ‘net: Fragmentation and IPv6 appeared first on rule 11 reader.

Worth Reading: Hacking through subaudible commands

Chinese researchers have discovered a terrifying vulnerability in voice assistants from Apple, Google, Amazon, Microsoft, Samsung, and Huawei. It affects every iPhone and Macbook running Siri, any Galaxy phone, any PC running Windows 10, and even Amazon’s Alexa assistant. Using a technique called the DolphinAttack, a team from Zhejiang University translated typical vocal commands into ultrasonic frequencies that are too high for the human ear to hear, but perfectly decipherable by the microphones and software powering our always-on voice assistants. This relatively simple translation process lets them take control of gadgets with just a few words uttered in frequencies none of us can hear. —Mark Wilson @ CO.DESIGN

The post Worth Reading: Hacking through subaudible commands appeared first on rule 11 reader.

Worth Reading: Docbook

Computers were first invented to do math, and they do it really well. But it didn’t take long for users to repurpose their futuristic calculators into fancy, dynamic typewriters. Now human-readable text drives computing, so it’s important to choose the right format for the text you write. DocBook is an XML schema. XML is an extensible markup language a lot like HTML. It’s truly ubiquitous, but you may know it by RSS or Atom, the Open Document formats of LibreOffice and Apache OpenOffice, Inkscape and the SVG file format, and much more. In fact, it’s safe to say that if you own a computer or mobile device, there’s XML on it. —Seth Kenlon @ Opensource

The post Worth Reading: Docbook appeared first on rule 11 reader.

Reaction: Networks are not cars or cell phones

The network engineering world has long emphasized the longevity of the hardware we buy; I have sat through many vendor presentations where the salesman says “this feature set makes our product future proof! You can buy with confidence knowing this product will not need to be replaced for another ten years…” Over at the Networking Nerd, Tom has an article posted supporting this view of networking equipment, entitled Network Longevity: Think Car, not iPhone.

It seems, to me, that these concepts of longevity have the entire situation precisely backwards. These ideas of “car length longevity” and “future proof hardware” are looking at the network from the perspective of an appliance, rather than from the perspective as a set of services. Let me put this in a little bit of context by considering two specific examples.

In terms of cars, I have owned four in the last 31 years. I owned a Jeep Wrangler for 13 years, a second Jeep Wrangler for 8 years, and a third Jeep Wrangler for 9 years. I have recently switched to a Jeep Cherokee, which I’ve just about reached my first year driving.

What if I bought network equipment like I buy cars? What sort Continue reading

Worth Reading: WeChat spying revelations

It has long been known that due to WeChat keeping its servers inside China, the lack of legal protection of privacy data, and the control over companies by police, that WeChat data is not safe, and can, without protection, be accessed by police or other state actors more or less at will. This has naturally made people shy away from using WeChat for any more serious or political discussions. More and more court cases of people being prosecuted simply based on private chat messages to friends have further illustration this. At the same time, at the time of the Occupy Central movement in Hong Kong, it was shown that a ‘Trojan’ virus was being employed to surveil users remotely. —Safeguard Defenders @ China Change

The post Worth Reading: WeChat spying revelations appeared first on rule 11 reader.

Worth Reading: Hyperconvergence and silos

Hyperconverged infrastructure (HCI) promises benefits in several dimensions: streamlining deployments across compute, storage and networking; scaling linearly as needs grow; and unifying and simplifying management. When examining prospective HCI solutions, it’s important to ensure this set of promises is fulfilled, but more importantly that checking those boxes with HCI doesn’t create new IT silos. A careful examination of what causes these silos makes it much easier to identify a solution that blends seamlessly into your architecture and chips away at IT silos, while at the same time ushering in the simplicity and ease that HCI promises. —Kaustubh Das @ The Data Center Journal

The post Worth Reading: Hyperconvergence and silos appeared first on rule 11 reader.

History of Networking: BGP Churn with Daniel Walton

On this edition of the History of Networking at the Network Collective, we discuss the history of BGP churn and Add Paths with Daniel Walton of Cumulus Networks. The original post on the Network Collective can be seen here.

The post History of Networking: BGP Churn with Daniel Walton appeared first on rule 11 reader.

Worth Reading: Why Net Neutrality can’t be implemented

Suppose for a moment that you are the victim of a wicked ISP that engages in disallowed “throttling” under a “neutral” regime for Internet access. You like to access streaming media from a particular “over the top” service provider. By coincidence, the performance of your favoured application drops at the same time your ISP launches a rival content service of its own. You then complain to the regulator, who investigates. She finds that your ISP did indeed change their traffic management settings right at the point that the “throttling” began. A swathe of routes, including the one to your preferred “over the top” application, have been given a different packet scheduling and routing treatment. It seems like an open-and-shut case of “throttling” resulting in a disallowed “neutrality violation”. Or is it? —Martin Geddes @ CircleID

The post Worth Reading: Why Net Neutrality can’t be implemented appeared first on rule 11 reader.

Worth Reading: Signposts on the roadmap to 10TB/sec

The world of Ethernet switching and routing used to be more predictable than just about any other part of the datacenter, but for the past decade the old adage – ten times the bandwidth for three times the cost – has not held. While 100 Gb/sec Ethernet was launched in 2010 and saw a fair amount of uptake amongst telecom suppliers for their backbones, the hyperscalers decided, quite correctly, that 100 Gb/sec Ethernet was too expensive and opted for 40 Gb/sec instead. —Timothy Prickett Morgan @ The Next Platform

The post Worth Reading: Signposts on the roadmap to 10TB/sec appeared first on rule 11 reader.

What Kind of Design?

In this short video I work through two kinds of design, or two different ways of designing a network. Which kind of designer are you? Do you see one as better than the other? Which would you prefer to do, are you right now?

The post What Kind of Design? appeared first on rule 11 reader.

Worth Reading: Why you should have a CAA DNS record

This Friday, all certificate authorities will have to honor a Domain Name System (DNS) record that allows HTTPS website owners to restrict who can issue SSL certificates for their domain names. It’s a long-needed defense against the issuance of fraudulent certificates, a security risk that domain owners had few protections for until now. The Problem: There are tens of certificate authorities (CAs) trusted in browsers and operating systems and any one of them can theoretically issue a valid SSL certificate for any website on the internet. Furthermore, many of these certificate authorities have subordinate CAs and resellers that are operated by separate organizations and which can also issue SSL certificates to end users. —Lucian Constantin @ The New Stack

The post Worth Reading: Why you should have a CAA DNS record appeared first on rule 11 reader.

Worth Reading: Work life balance

Miserable at work? You’re not alone. More than half of U.S. employees were not engaged at work between 2010 and 2012 according to Gallup’s recent State of the American Workplace report, which collected data from more than 195,000 employees. Many of those who were not engaged wanted a reason to be, such as the company showing them how to perform their best. —Alessandra Malito @ MarketWatch

The post Worth Reading: Work life balance appeared first on rule 11 reader.

Fish Fountain

The post Fish Fountain appeared first on rule 11 reader.

Worth Reading: Hunting AdwindRAT

An increasing number of malware families employ SSL/TLS encryption in order to evade detection by Network Intrusion Detection Systems (NIDS). In this blog post I’m gonna have a look at Adwind, which is a cross-platform Remote Access Trojan (RAT) that has been using SSL to conceal it’s traffic for several years. AdwindRAT typically connects SSL sessions to seemingly random TCP ports on the C2 servers. Hence, a heuristic that could potentially be used to hunt for Adwind RAT malware is to look for SSL traffic going to TCP ports that normally don’t use SSL. However, relying on ONLY that heuristic would generate way too many false positives. —Erik Hjelmvik @ Netrecsec

The post Worth Reading: Hunting AdwindRAT appeared first on rule 11 reader.

Worth Reading: How blockchain really works

A distributed database that is used to maintain a continuously growing list of records, called blocks. That sounds nice, but how does it work? To illustrate a blockchain, we will use an open source command-line interface called Blockchain CLI. If you haven’t already, install Node.js. —Sean Han @ Free Code Camp

The post Worth Reading: How blockchain really works appeared first on rule 11 reader.

Worth Reading: Planning for cloud’s limitations

Protecting data from losses requires a well-planned data-management strategy. Many strategic plans include using cloud services, but IT and other departments must understand the cloud’s strengths and limitations when it comes to protection. The benefits of the cloud include inexpensive storage costs, instant scale, high availability and the elimination of on-premises hardware infrastructure. Used properly, the cloud is essential for many firms that simply couldn’t offer their service through any other platform. Despite these advantages, the cloud has limitations, and firms should build their plans around their understanding of these limitations. —David Zimmerman @ the Data Center Journal

The post Worth Reading: Planning for cloud’s limitations appeared first on rule 11 reader.