Windows Trojan hacks into embedded devices to install Mirai

Attackers have started to use Windows and Android malware to hack into embedded devices, dispelling the widely held belief that if such devices are not directly exposed to the Internet they're less vulnerable.Researchers from Russian antivirus vendor Doctor Web have recently come across a Windows Trojan program that was designed to gain access to embedded devices using brute-force methods and to install the Mirai malware on them.Mirai is a malware program for Linux-based internet-of-things devices, such as routers, IP cameras, digital video recorders and others. It's used primarily to launch distributed denial-of-service (DDoS) attacks and spreads over Telnet by using factory device credentials.To read this article in full or to leave a comment, please click here

Windows Trojan hacks into embedded devices to install Mirai

Attackers have started to use Windows and Android malware to hack into embedded devices, dispelling the widely held belief that if such devices are not directly exposed to the Internet they're less vulnerable.Researchers from Russian antivirus vendor Doctor Web have recently come across a Windows Trojan program that was designed to gain access to embedded devices using brute-force methods and to install the Mirai malware on them.Mirai is a malware program for Linux-based internet-of-things devices, such as routers, IP cameras, digital video recorders and others. It's used primarily to launch distributed denial-of-service (DDoS) attacks and spreads over Telnet by using factory device credentials.To read this article in full or to leave a comment, please click here

Nokia Buys OSS Specialist Comptel for $370 Million

Both companies are based in Finland.

Nokia makes bid for Comptel to boost its software business

Network equipment vendor Nokia wants to buy a software company that helps customers make do with less hardware.The Finnish networking giant competes with the likes of Ericsson, Huawei Technologies, and Cisco Systems to sell networking equipment, software, and services to telecommunications operators and large enterprises.On Thursday, it offered to buy Finnish neighbor Comptel, which develops software to help network operators manage their networks and deliver additional services.Nokia said the deal, valuing Comptel at around €347 million (US$370 million) would help it toward its goal of building a standalone software business.The bid is a logical move, said Sylvain Fabre, a research director at Gartner: "The days of proprietary infrastructure from network equipment providers are numbered. Virtualized infrastructure will increasingly be procurable from alternative vendors, so focusing on software and applications for telecommunications functions is the way forward for any large vendor that seeks longevity."To read this article in full or to leave a comment, please click here

Nokia makes bid for Comptel to boost its software business

Network equipment vendor Nokia wants to buy a software company that helps customers make do with less hardware.The Finnish networking giant competes with the likes of Ericsson, Huawei Technologies, and Cisco Systems to sell networking equipment, software, and services to telecommunications operators and large enterprises.On Thursday, it offered to buy Finnish neighbor Comptel, which develops software to help network operators manage their networks and deliver additional services.Nokia said the deal, valuing Comptel at around €347 million (US$370 million) would help it toward its goal of building a standalone software business.The bid is a logical move, said Sylvain Fabre, a research director at Gartner: "The days of proprietary infrastructure from network equipment providers are numbered. Virtualized infrastructure will increasingly be procurable from alternative vendors, so focusing on software and applications for telecommunications functions is the way forward for any large vendor that seeks longevity."To read this article in full or to leave a comment, please click here

HCI’s Scale Out Architecture Can Stress the Network

Hyperconverged infrastructure requires IT organizations to consider a scale out architecture.

As third RSA Conference without ‘booth babes’ nears, no one seems to miss them

In March 2015, RSA Conference organizers made news by contractually insisting that vendors pitch their security wares without the help of “booth babes,” a first such ban for the technology industry.Next week’s RSAC in San Francisco will be the third without the babes, so I checked in with event staff to see if the policy had evolved at all and how it has been accepted by various stake-holders.  Here’s how the contract language read in 2015: All Expo staff are expected to dress in business and/or business casual attire. Exhibitors should ensure that the attire of al staff they deploy at their booth (whether the exhibitor’s direct employees or their contractors) be considered appropriate in a professional environment. Attire of an overly revealing or suggestive nature is not permitted. Examples of such attire may include but are not restricted to:To read this article in full or to leave a comment, please click here

As third RSA Conference without ‘booth babes’ nears, no one seems to miss them

In March 2015, RSA Conference organizers made news by contractually insisting that vendors pitch their security wares without the help of “booth babes,” a first such ban for the technology industry.Next week’s RSAC in San Francisco will be the third without the babes, so I checked in with event staff to see if the policy had evolved at all and how it has been accepted by various stake-holders.  Here’s how the contract language read in 2015: All Expo staff are expected to dress in business and/or business casual attire. Exhibitors should ensure that the attire of al staff they deploy at their booth (whether the exhibitor’s direct employees or their contractors) be considered appropriate in a professional environment. Attire of an overly revealing or suggestive nature is not permitted. Examples of such attire may include but are not restricted to:To read this article in full or to leave a comment, please click here

Making the Connections in Disparate Data

Enterprises are awash in data, and the number of sources of that data is only increasing. For some of the larger companies, data sources can rise into the thousands – from databases, files and tables to ERP and CRM programs – and the data itself can come in different formats, making it difficult to bring together and integrate into a unified pool. This can create a variety of challenges for businesses in everything from securing the data they have to analyzing it.

The problem isn’t going to go away. The rise of mobile and cloud computing and the Internet of …

Making the Connections in Disparate Data was written by Nicole Hemsoth at The Next Platform.

Apple’s iPhone declines in China, and this year could be a struggle

Perhaps the next iPhone 8 will be Apple's next shot at achieving greatness in China.The current iPhones aren't helping Apple gain market share in China, according to Canalys. Markets like China and India are at the top of Apple's agenda to grow the iPhone business.China accounts for a third of worldwide smartphone shipments. Buyers in the market are leaning toward local brands like Huawei, Oppo, Vivo, and Xiaomi, which formed the top four smartphone vendors in China in 2016, according to Canalys.Apple was in the fifth spot, and Samsung doesn't figure in the top five.In 2016, Apple's phone shipments in China totaled 43.8 million units, a drop of 18.2 percent compared to 2015. It's not looking any better for Apple in 2017.To read this article in full or to leave a comment, please click here

Worth Reading: Security and the Internet of Things

Last year, on October 21, your digital video recorder ­- or at least a DVR like yours ­- knocked Twitter off the internet. Someone used your DVR, along with millions of insecure webcams, routers, and other connected devices, to launch an attack that started a chain reaction, resulting in Twitter, Reddit, Netflix, and many sites going off the internet. You probably didn’t realize that your DVR had that kind of power. But it does. —Schneier on Security

The post Worth Reading: Security and the Internet of Things appeared first on 'net work.

Python – Learning Python with Kirk Byers Python for Network Engineers

As you have seen lately on the blog I’ve been fiddling around in Python. One of the best resources out there to learn Python for Network Engineers is the free e-mail course by Kirk Byers. Kirk is a CCIE emeritus with extensive knowledge and experience of Python. He offers both free and paid courses over at his site. Kirk is very active in the community and the guy behind Netmiko and the IOS driver in NAPALM. He’s also an active member of the Network to Code Slack group. I recommend that you check out Kirk’s stuff!

I plan to go through all of his exercices and write about them on my blog. That will help me in my learning and hopefully it can help you as well. Kirk publishes the answers to the exercises at Github but my plan is to be a bit more verbose and explain the code. I plan to write my posts here and also put up my answers on Github to get some exposure to using Git. My code will likely not be elegant, the most effective or good looking but hopefully we can learn from each other as I put these posts up. I Continue reading

Cisco Umbrella cloud service shapes security for cloud, mobile resources

In these days of always-on, but zero trust enterprise applications, concerns over how to keep the bad guys out 24-7 is a huge IT challenge. In an attempt to address such anxieties Cisco today announced Umbrella, a secure, cloud-based gateway, based on technology from OpenDNS and other technologies it acquired such as CloudLock as well as existing Cisco security services that together ultimately promises to offer secure business access to resources even when users are not using the safety of a VPN.To read this article in full or to leave a comment, please click here

Cisco Umbrella cloud service shapes security for cloud, mobile resources

In these days of always-on, but zero trust enterprise applications, concerns over how to keep the bad guys out 24-7 is a huge IT challenge. In an attempt to address such anxieties Cisco today announced Umbrella, a secure, cloud-based gateway, based on technology from OpenDNS and other technologies it acquired such as CloudLock as well as existing Cisco security services that together ultimately promises to offer secure business access to resources even when users are not using the safety of a VPN.To read this article in full or to leave a comment, please click here

Intel’s Ticking Atom Bomb

It started somewhat innocently. Cisco released a field notice that there was an issue with some signal clocks on a range of their networking devices. This by itself was a huge issue. There had been rumblings about this issue for a few months. Some proactive replacement of affected devices to test things. Followed by panicked customer visits when the news broke on February 2nd. Cisco looked like they were about to get a black eye.

The big question that arose was whether or not this issue was specific to Cisco devices or if it was an issue that was much bigger. Some investigative work from enterprising folks like Tony Mattke (@tonhe) found that there was a spec document from Intel that listed a specific issue with the Intel Atom C2000 System on Chip (SoC) that caused it to fail to provide clock signal for onboard chips. The more digging that was done, the more dire this issue turned out to be.

Tick, Tick, Tick

Clock signaling is very important in modern electronics. It ensures that all the chips on the board are using the correct timing to process electronic impulses. If the clock signal starts drifting, you start Continue reading

30% off Microsoft Foldable Keyboard for iOS, Android, and Windows devices – Deal Alert

This folding keyboard from Microsoft pairs with any combination of 2 iPads, iPhones, Android, Windows tablets, and Windows Phones. It features a water repellent keyset and fabric to protect against accidents. Unfold to turn on, and fold to turn off. Pairs quickly and reliably with Bluetooth 4.0 technology. Its built-in rechargeable battery lasts up to 3 months on a single charge. It currently averages 4 out of 5 stars on Amazon (read reviews) from nearly 200 reviewers, and its list price of $100 is currently reduced to $70. See the discounted Microsoft keyboard now on Amazon.To read this article in full or to leave a comment, please click here

Review: Arlo Pro cameras offer true flexibility for home security

Netgear’s Arlo brand of home security, network-connected cameras continues to improve, defeating every real or perceived criticism about the devices with an upgrade or improvement. Want to place in an area where there’s no network cable? Bam! Wi-Fi connection. Need to place in an area where there’s no power outlet? Bam! Battery powered! Don’t like replacing batteries? Bam! Rechargeable batteries and a quick-charge battery adapter.The latest version of this system is the Arlo Pro – it’s the most flexible camera system I’ve come across so far. After a few weeks of testing, I’ve determined that anyone who has a problem with this system (or think that it can’t do something) is just a cynical old crank.To read this article in full or to leave a comment, please click here

Review: Arlo Pro cameras offer true flexibility for home security

Netgear’s Arlo brand of home security, network-connected cameras continues to improve, defeating every real or perceived criticism about the devices with an upgrade or improvement. Want to place in an area where there’s no network cable? Bam! Wi-Fi connection. Need to place in an area where there’s no power outlet? Bam! Battery powered! Don’t like replacing batteries? Bam! Rechargeable batteries and a quick-charge battery adapter.The latest version of this system is the Arlo Pro – it’s the most flexible camera system I’ve come across so far. After a few weeks of testing, I’ve determined that anyone who has a problem with this system (or think that it can’t do something) is just a cynical old crank.To read this article in full or to leave a comment, please click here

Introducing Docker Secrets Management

Containers are changing how we view apps and infrastructure. Whether the code inside containers is big or small, container architecture introduces a change to how that code behaves with hardware – it fundamentally abstracts it from the infrastructure. Docker believes that there are three key components to container security and together they result in inherently safer apps.

A critical element of building safer apps is having a secure way of communicating with other apps and systems, something that often requires credentials, tokens, passwords and other types of confidential information—usually referred to as application secrets. We are excited to introduce Docker Secrets, a container native solution that strengthens the Trusted Delivery component of container security by integrating secret distribution directly into the container platform.

With containers, applications are now dynamic and portable across multiple environments. This  made existing secrets distribution solutions inadequate because they were largely designed for static environments. Unfortunately, this led to an increase in mismanagement of application secrets, making it common to find insecure, home-grown solutions, such as embedding secrets into version control systems like GitHub, or other equally bad—bolted on point solutions as an afterthought.

Introducing Docker Secrets Management

We fundamentally believe that apps are safer if Continue reading

Introducing Docker Datacenter on 1.13 with Secrets, Security Scanning, Content Cache and more

It’s another exciting day with a new release of Docker Datacenter (DDC) on 1.13. This release includes loads of new features around app services, security, image distribution and usability.  

Check out the upcoming webinar on Feb 16th for a demo of all the latest features.

Let’s dig into some of the new features:

Integrated Secrets Management

This release of Docker Datacenter includes integrated support for secrets management from development all the way to production.

This feature allows users to store confidential data (e.g. passwords, certificates) securely on the cluster and inject these secrets to a service. Developers can reference the secrets needed by different services in the familiar Compose file format and handoff to IT for deployment in production. Check out the blog post on Docker secrets management for more details on implementation. DDC integrates secrets and adds several enterprise-grade enhancements, including lifecycle management and deployment of secrets in the UI, label-based granular access control for enhanced security, and auditing users’ access to secrets via syslog.

Image Security Scanning and Vulnerability Monitoring

Another element of delivering safer apps is around the ability to ensure trusted delivery of the code that makes up that app. In addition to Continue reading