One Default Password Might Have Fueled the Mirai IoT Botnet
And guess what: You can't change it.
AWS and AT&T Partner to Combine Cloud with Networking
If you can’t beat ‘em, join ‘em.
Juniper Takes Software Security Down to the Switch
Next-gen security arrives under the ‘SDSN’ moniker.
Using DNS Names in Firewall Rulesets
My friend Matthias Luft sent me an interesting tweet a while ago:
@ioshints What’s your take on firewall rule sets & IP addresses vs. hostnames?
— Matthias Luft (@uchi_mata) August 16, 2016
All I could say in 160 characters was “it depends”. Here’s a longer answer.
Read more ...What the Yahoo NSA might’ve looked for
The vague story about Yahoo searching emails for the NSA was cleared up today with various stories from other outlets [1]. It seems clear a FISA court order was used to compel Yahoo to search all their customer's email for a pattern (or patterns). But there's an important detail still missing: what specifically were they searching for? In this post, I give an example.The NYTimes article explains the search thusly:
Investigators had learned that agents of the foreign terrorist organization were communicating using Yahoo’s email service and with a method that involved a “highly unique” identifier or signature, but the investigators did not know which specific email accounts those agents were using, the officials said.What they are likely referring it is software like "Mujahideen Secrets", which terrorists have been using for about a decade to encrypt messages. It includes a unique fingerprint/signature that can easily be searched for, as shown below.
In the screenshot below, I use this software to type in a secret message:
I then hit the "encrypt" button, and get the following, a chunk of random looking text:
This software encrypts, but does not send/receive messages. You have to do that manually yourself. Continue reading
The Yahoo-email-search story is garbage
Joseph Menn (Reuters) is reporting that Yahoo! searched emails for the NSA. The details of the story are so mangled that it's impossible to say what's actually going on.The first paragraph says this:
Yahoo Inc last year secretly built a custom software program to search all of its customers' incoming emailsThe second paragraph says this:
The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accountsWell? Which is it? Did they "search incoming emails" or did they "scan mail accounts"? Whether we are dealing with emails in transmit, or stored on the servers, is a BFD (Big Fucking Detail) that you can't gloss over and confuse in a story like this. Whether searches are done indiscriminately across all emails, or only for specific accounts, is another BFD.
The third paragraph seems to resolve this, but it doesn't:
Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to an intelligence agency's request by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.Who are these "some surveillance experts"? Why is the Continue reading
Palo Alto Networks Thinks It Can Grow Just Fine Without Acquisitions
30% annual growth is the long-term target.
Someone Released the Code That Turns IoT Devices into Evil Bots
IoT devices could set the stage for 'epic DDoS wars.'
Microsoft Azure Making Its Presence Known in Europe
The company spent $3 billion to expand its cloud services to Europe.
Optimizing Data Center TCO with SDN and Server-Based Networking
OVS is a critical component of SDN deployments.
No, Trump’s losses doesn’t allow tax avoidance
The New York Times is reporting that Tump lost nearly a billion dollars in 1995, and this would enable tax avoidance for 18 years. No, it doesn't allow "avoidance". This is not how taxes work.Let's do a little story problem:
- You invest in a broad basket of stocks for $100,000
- You later sell them for $110,000
- Capital gains rate on this is 20%
- How much taxes do you owe?
Obviously, since you gained $10,000 net, and tax rate is 20%, you then owe $2,000 in taxes.
But this is only because losses offset gains. All the stocks in your basket didn't go up 10%. Some went up more, some actually lost money. It's not unusual that the losing stocks might go down $50,000, while the gainers go up $60,000, thus giving you the 10% net return, if you are investing in high-risk/high-reward stocks.
What if instead we change the tax code to only count the winners, ignoring the losing stocks. Now, instead of owing taxes on $10,000, you owe taxes on $60,000. At 20% tax rate, this comes out to $12,000 in taxes -- which is actually more than you earned on your investments.
Taxing only investments that Continue reading
Cloud Misunderstandings: What You Can and Can’t See
It is time to see through the false sense of security offered by typical deployments.
Some technical notes on the PlayPen case
In March of 2015, the FBI took control of a Tor onion childporn website ("PlayPen"), then used an 0day exploit to upload malware to visitors's computers, to identify them. There is some controversy over the warrant they used, and government mass hacking in general. However, much of the discussion misses some technical details, which I thought I'd discuss here.IP address
In a post on the case, Orin Kerr claims:
retrieving IP addresses is clearly a search
He is wrong, at least, in the general case. Uploading malware to gather other things (hostname, username, MAC address) is clearly a search. But discovering the IP address is a different thing.
Today's homes contain many devices behind a single router. The home has only one public IP address, that of the router. All the other devices have local IP addresses. The router then does network address translation (NAT) in order to convert outgoing traffic to all use the public IP address.
The FBI sought the public IP address of the NAT/router, not the local IP address of the perp's computer. The malware ("NIT") didn't search the computer for the IP address. Instead the NIT generated network traffic, destined to the FBI's computers. Continue reading
Beware: Attribution & Politics
tl;dr - Digital location data can be inherently wrong and it can be spoofed. Blindly assuming that it is accurate can make an ass out of you on twitter and when regulating drones.
Filtering through various campaign and debate analysis on social media, a tweet caught my eye. The message itself was not the concern and the underlying image has since been determined to be fake. Rather, I was stopped by the140 character tweet's absolute certainty that internet user location data is infallible. The author presented a data map as proof without question, caveat, or other investigation. Boom, mic drop - attribution!
According to the tweeting pundit, "Russian trollbots" are behind the #TrumpWon hashtag trending on Twitter.
Aqua Scores $9M Series A Led by Microsoft
Aqua will be involved in Microsoft initiatives while staying true to its roots.
Fortinet Introduces Partner Program to Integrate Its Security Fabric
These security companies will now be able to have FortiSIEM run alongside their own existing security products.
Telefónica Picks Juniper to Deliver Network Security
A step toward reviving Juniper's security revenues.
Yahoo Data Breach Was Likely Perpetrated at One Point of Failure
'They stole the grand piano while the family was home.’
Cisco & IBM Both Evaluate the Security Company Imperva
Imperva’s stock has shot up 22%.
East-West Encryption: The Next Security Frontier?
VMware says it is looking at East-West encryption inside the data center, adding another layer of security to the SDDC.