If We Care About the Internet, We Have to Be Willing to Do Our Part

Whether it’s playing dungeons and dragons over voice chat with my college friends hundreds of miles away, reading the latest movie reviews for summer blockbusters I’ll watch once they come out on video, or simply paying electrical bills, the Internet has become an important part of my life.

Yet, while I have come to rely on the Internet, I don’t always do what is best for it.

I don’t always patch my connected devices or applications, leaving them vulnerable to compromise and use in a botnet. I don’t look for security when buying an app or a device, let alone look at the privacy policies.

While I know I am hurting the overall security of the Internet, I find myself thinking, “I’m just one person, how much damage could I do?”

Unfortunately, according to one recent survey, there are a lot of people who act just like me. 

The results from the 2018 CIGI-Ipsos Global Survey on Internet Security and Trust* suggest that many users fail to make security a priority as they shop for Internet of Things (IoT) devices. (IoT refers to “scenarios where network connectivity and computing capability extends to objects, sensors and everyday items not normally considered computers, allowing these devices to generate, exchange and consume data with minimal human Continue reading

The Week in Internet News: Governments Shut Down Internet for School Testing

Couldn’t you just take their phones away? The government of Algeria told telecom carriers to shut down Internet service for several hours a day during high school testing season, according to several news reports. The government is trying to prevent the repeat of a situation in 2016, when exam questions were leaked online, reports Al Jazeera. The government of Iraq has taken similar action, the news agency says. It’s unclear how a short shutdown each day will prevent leaks.

Why IoT security is terrible: The headline is certainly catchy, but the IEEE Spectrum suggests that the Internet of things has some special security challenges including nation state hackers that are targeting the systems (although that’s true of other IT systems as well). Another of the six reasons: Many IoT systems, like your connected refrigerator, don’t have dedicated IT security workers looking out for them.

Score one for encryption: Using the encrypted WhatsApp, Syrian school girls banned from attending school in Islamic State-controlled territory, are taking pictures of school work and sharing it with each other, notes NakedSecurity, referencing a report on the BBC. “Education is everything, and it’s our weapon,” one of the girls says.

Not so fast, WhatsApp: Continue reading

The silver lining in the Intel CEO drama

I assume that by now you’ve heard the news that Intel CEO Brian Krzanich has stepped down for reportedly violating the company's strict policy against having relationships with employees. As CFO Bob Swan takes the reigns, the question of who will replace Krzanich is front and center.Several analysts I’ve spoken to even before this happened said they think Intel needs to look to the outside for its next CEO. In its 50-year history, the company has had only six CEOs, all of them insiders. Intel has a reputation as a tough place to work; nobody treads water at Intel. In the volatile Silicon Valley, I found Intel was a place where people either came and went fast or hung around forever. If you are cut out for its culture, expect to be promoted up the food chain rather quickly.To read this article in full, please click here

The silver lining in the Intel CEO drama

I assume that by now you’ve heard the news that Intel CEO Brian Krzanich has stepped down for reportedly violating the company's strict policy against having relationships with employees. As CFO Bob Swan takes the reigns, the question of who will replace Krzanich is front and center.Several analysts I’ve spoken to even before this happened said they think Intel needs to look to the outside for its next CEO. In its 50-year history, the company has had only six CEOs, all of them insiders. Intel has a reputation as a tough place to work; nobody treads water at Intel. In the volatile Silicon Valley, I found Intel was a place where people either came and went fast or hung around forever. If you are cut out for its culture, expect to be promoted up the food chain rather quickly.To read this article in full, please click here

The Art Of Supercomputing War

The shenanigans with the Top 500 rankings of the world’s most powerful supercomputers continues, but there are a bunch of real supercomputers that were added to the list for the June 2018 rankings, and we are thankful, as always, to gain the insight we can glean from the Top 500 on these new machines that are clearly used for HPC workloads. …

The Art Of Supercomputing War was written by Timothy Prickett Morgan at .

IBM ends China’s 5-year reign atop supercomputer rankings

There’s a shake-up – and a scandal – in the Top500 ranking of the world’s most powerful supercomputers.The U.S. has retaken first place in the Top500 list after five years of dominance by China. Computers built by IBM for the U.S. Department of Energy have pushed the previous two record-holders, both Chinese, into second and fourth place.[ Now see who's developing quantum computers.] But the previous fourth placeholder, Japan’s Gyoukou, is nowhere to be found, after one of its creators was arrested on suspicion of fraud.To read this article in full, please click here

IBM ends China’s 5-year reign atop supercomputer rankings

There’s a shake-up – and a scandal – in the Top500 ranking of the world’s most powerful supercomputers.The U.S. has retaken first place in the Top500 list after five years of dominance by China. Computers built by IBM for the U.S. Department of Energy have pushed the previous two record-holders, both Chinese, into second and fourth place.[ Now see who's developing quantum computers.] But the previous fourth placeholder, Japan’s Gyoukou, is nowhere to be found, after one of its creators was arrested on suspicion of fraud.To read this article in full, please click here

To distribute or not to distribute? Why licensing bugs matter

To distribute or not to distribute? Why licensing bugs matter Vendome et al., ICSE’18

Software licensing can quickly get quite complicated, with over 100 known open source licenses out there, and distributions often including components with a mix of licenses. Unsurprisingly, developers find it hard to determine appropriate licenses for their work, and to interpret the implications of including third-party software under different licenses.

We present a large-scale qualitative study aimed at characterizing licensing bugs, with the goal of understanding the types of licensing bugs developers face, their legal and technical implications, and how such bugs are fixed.

The result is a helpful catalogue of seven different categories of licensing bugs, with 21 sub-categories in total between them. Although the authors are not lawyers (as far as I can tell), it still constitutes a very useful list of things to think about. “Our proposed catalog can serve as a reference for developers and lawyers dealing with potential licensing issues.”

The catalogue is drawn from an open coding exercise based on a statistically significant sample of 1,200 discussions randomly selected from a population of 59,426 discussions across a collection of issue trackers and mailing lists. The mailing lists Continue reading

SMB version detection in masscan

My Internet-scale port scanner, masscan, supports "banner checking", grabbing basic information from a service after it connects to a port. It's less comprehensive than nmap's version and scripting checks, but it's better than just recording which ports are open.

I recently extended this banner checking to include SMB. It's a complicated protocol so requires a lot more work than just grabbing text banners like you see on FTP. Implementing this, I've found that nmap and smbclient often fail to get version information. They seem focused on getting the information from a standard location in SMBv1 packets, which gives a text string indicating version. There's another place you get get it, from the NTLMSSP pluggable authentication chunks, which gives version numbers in the form of major version, minor version. and build number. Sometimes the SMBv1 information is missing, either because newer Windows version disable SMBv1 by default (supporting only SMBv2) or because they've disabled null/anonymous sessions. They still give NTLMSSP version info, though.


For example, running masscan in my local bar, I get the following result:

Banner on port 445/tcp on 10.1.10.200: [smb] SMBv1  time=2018-06-24 22:18:13 TZ=+240  domain=SHIPBARBO version=6.1.7601 ntlm-ver=15 domain=SHIPBARBO name=SHIPBARBO domain-dns=SHIPBARBO Continue reading

Routing Security & IPv6 at NANOG 73 in Denver

We’ll be at NANOG 73 in Denver, CO, USA this week talking about routing security, MANRS, and IPv6.

The North American Network Operators Group (NANOG) is the professional association for Internet engineering, architecture and operations. Its core focus is on continuous improvement of the data transmission technologies, practices, and facilities that make the Internet function. NANOG meetings are among the largest in the region, bringing together top technologists on a wide range of topics.

Routing Security

On Tuesday, 26 June, at 1:30PM, Andrei Robachevsky will give a talk called, “Routing Is At Risk. Let’s Secure It Together.”

From the session abstract:

“Stolen cryptocurrency, hijacked traffic blocking access to whole countries, derailing vital Web resources for thousands of people. Routing used to fly under the radar. As long as incidents weren’t too bad, no one asked too many questions, and routing security never made it to the top of the to-do list. But these days, routing incidents are regularly making the news, executives are getting nervous, and engineers are under pressure to make sure their network isn’t next. The problem is, you cannot secure your own network entirely by yourself. But you can help secure the global routing system Continue reading

Build oVirt Reports Using Grafana

Grafana, The open platform for beautiful analytics and monitoring, recently added support for PostgreSQL.

It in now possible to connect Grafana to oVirt DWH, in order to visualize and monitor the oVirt environment.

Grafana dashboard example

Adding a Read-Only User to the History Database

You may want to add a read only user to connect the history database :

Note: In oVirt 4.2 we ship postgres 9.5 through the Software Collection.

  1. In order to run psql you will need to run:

    # su - postgres 
$ scl enable rh-postgresql95 -- psql ovirt_engine_history

  2. Create the user to be granted read-only access to the history database:

    ovirt_engine_history=# CREATE ROLE [user name] WITH LOGIN ENCRYPTED PASSWORD '[password]';

  3. Grant the newly created user permission to connect to the history database:

    ovirt_engine_history=# GRANT CONNECT ON DATABASE ovirt_engine_history TO [user name];

  4. Grant the newly created user usage of the public schema:

    ovirt_engine_history=# GRANT USAGE ON SCHEMA public TO [user name];

  5. Exit the database

    ovirt_engine_history=# \q

  6. Generate the rest of the permissions that will be granted to the newly created user and save them to a file:

    $ scl enable rh-postgresql95 -- psql -U postgres -c "SELECT 'GRANT SELECT ON ' || relname  Continue reading

Build oVirt Reports Using Grafana

Grafana, The open platform for beautiful analytics and monitoring, recently added support for PostgreSQL.

It in now possible to connect Grafana to oVirt DWH, in order to visualize and monitor the oVirt environment.

Grafana dashboard example

Adding a Read-Only User to the History Database

You may want to add a read only user to connect the history database :

Note: In oVirt 4.2 we ship postgres 9.5 through the Software Collection.

  1. In order to run psql you will need to run:

    # su - postgres 
$ scl enable rh-postgresql95 -- psql ovirt_engine_history

  2. Create the user to be granted read-only access to the history database:

    ovirt_engine_history=# CREATE ROLE [user name] WITH LOGIN ENCRYPTED PASSWORD '[password]';

  3. Grant the newly created user permission to connect to the history database:

    ovirt_engine_history=# GRANT CONNECT ON DATABASE ovirt_engine_history TO [user name];

  4. Grant the newly created user usage of the public schema:

    ovirt_engine_history=# GRANT USAGE ON SCHEMA public TO [user name];

  5. Exit the database

    ovirt_engine_history=# \q

  6. Generate the rest of the permissions that will be granted to the newly created user and save them to a file:

    $ scl enable rh-postgresql95 -- psql -U postgres -c "SELECT 'GRANT SELECT ON ' || relname  Continue reading

Routing Loop, Failure by Design

I have spent some time studying the CCDE materials. One broken design example that has come up involves route reflector clients that don’t align with the physical topology. This article examines that example and some solutions to the problem.

To illustrate this example we have built the topology below. I used loopback addresses 1.1.1.1 through 6.6.6.6 (based on csr1000v-x). The router on the top is a eBGP neighbor with csr1000v-1 and csr1000v-2. The four routers forming a square in the center have an initial configuration of OSFP and BGP (iBGP as shown). Both Route Reflectors are peered with both clients.

Route Reflector Initial Configuration

//csr1000v-2 shown, csr1000v-3 similar

router ospf 1
router-id 2.2.2.2
passive-interface GigabitEthernet2
network 2.2.2.2 0.0.0.0 area 0
network 10.0.0.0 0.255.255.255 area 0

router bgp 64513
bgp router-id 2.2.2.2
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 64513
neighbor 3.3.3.3 update-source Loopback0
neighbor 4.4.4.4 remote-as 64513
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 route-reflector-client
neighbor 5.5.5.5 remote-as 64513
 Continue reading

Routing Loop, Failure by Design

I have spent some time studying the CCDE materials. One broken design example that has come up involves route reflector clients that don’t align with the physical topology. This article examines that example and some solutions to the problem.

To illustrate this example we have built the topology below. I used loopback addresses 1.1.1.1 through 6.6.6.6 (based on csr1000v-x). The router on the top is a eBGP neighbor with csr1000v-1 and csr1000v-2. The four routers forming a square in the center have an initial configuration of OSFP and BGP (iBGP as shown). Both Route Reflectors are peered with both clients.

Route Reflector Initial Configuration

//csr1000v-2 shown, csr1000v-3 similar

router ospf 1
router-id 2.2.2.2
passive-interface GigabitEthernet2
network 2.2.2.2 0.0.0.0 area 0
network 10.0.0.0 0.255.255.255 area 0

router bgp 64513
bgp router-id 2.2.2.2
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 64513
neighbor 3.3.3.3 update-source Loopback0
neighbor 4.4.4.4 remote-as 64513
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 route-reflector-client
neighbor 5.5.5.5 remote-as 64513
 Continue reading

Routing Loop, Failure by Design

I have spent some time studying the CCDE materials. One broken design example that has come up involves route reflector clients that don’t align with the physical topology. This article examines that example and some solutions to the problem.

To illustrate this example we have built the topology below. I used loopback addresses 1.1.1.1 through 6.6.6.6 (based on csr1000v-x). The router on the top is a eBGP neighbor with csr1000v-1 and csr1000v-2. The four routers forming a square in the center have an initial configuration of OSFP and BGP (iBGP as shown). Both Route Reflectors are peered with both clients.

Route Reflector Initial Configuration

//csr1000v-2 shown, csr1000v-3 similar

router ospf 1
router-id 2.2.2.2
passive-interface GigabitEthernet2
network 2.2.2.2 0.0.0.0 area 0
network 10.0.0.0 0.255.255.255 area 0

router bgp 64513
bgp router-id 2.2.2.2
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 64513
neighbor 3.3.3.3 update-source Loopback0
neighbor 4.4.4.4 remote-as 64513
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 route-reflector-client
neighbor 5.5.5.5 remote-as 64513
 Continue reading

BrandPost: Growing Reliance On Multi-Cloud Boosts Need For Smart Data

As the cloud computing market has soared, businesses have begun incorporating a mix of cloud services to meet their Digital Transformation (DX) objectives. Multi-cloud and hybrid cloud environments are fast becoming the option of choice. In fact, according to a recent Information Age article, 451 Research determined that the future of IT is multi-cloud and hybrid with 69 percent of survey respondents planning to incorporate some form of multi-cloud environment by 2019.To read this article in full, please click here

1 … 1,572 1,573 1,574 1,575 1,576 … 3,856