Attackers are now abusing exposed LDAP servers to amplify DDoS attacks

Attackers are abusing yet another widely used protocol in order to amplify distributed denial-of-service attacks: the Lightweight Directory Access Protocol (LDAP), which is used for directory services on corporate networks.DDoS mitigation provider Corero Network Security has recently observed an attack against its customers that was reflected and amplified through Connectionless LDAP (CLDAP), a variant of LDAP that uses the User Datagram Protocol (UDP) for transport.DDoS reflection is the practice of sending requests using a spoofed source IP address to various servers on the Internet, which will then direct their responses to that address instead of the real sender. The spoofed IP address is that of the intended victim.To read this article in full or to leave a comment, please click here

Attackers are now abusing exposed LDAP servers to amplify DDoS attacks

Attackers are abusing yet another widely used protocol in order to amplify distributed denial-of-service attacks: the Lightweight Directory Access Protocol (LDAP), which is used for directory services on corporate networks.DDoS mitigation provider Corero Network Security has recently observed an attack against its customers that was reflected and amplified through Connectionless LDAP (CLDAP), a variant of LDAP that uses the User Datagram Protocol (UDP) for transport.DDoS reflection is the practice of sending requests using a spoofed source IP address to various servers on the Internet, which will then direct their responses to that address instead of the real sender. The spoofed IP address is that of the intended victim.To read this article in full or to leave a comment, please click here

What’s the one thing Amazon will not manufacture? Guns

Amazon Web Services CEO Andy Jassy made some bold claims about the cloud computing market during a Q&A with the Wall Street Journal this week and left open the possibility for Amazon to enter almost any new market, except for one.In response to a question about if there’s anything Amazon would not make, Jassy reportedly responded: “Manufacturing guns.”+MORE AT NETWORK WORLD: What's behind Amazon, Microsoft and Google's aggressive cloud expansions? Check out our interactive map to find out +To read this article in full or to leave a comment, please click here

FBI snags group that allegedly pinched 23,000 or $6.7 million worth of iPhones

The FBI today said it had arrested a group of men in connection with the theft of 23,000 Apple iPhones from a cargo area at the Miami International Airport in April.The stolen iPhones were worth approximately $6.7 million and the arrests of Yoan Perez, 33; Rodolfo Urra, 36; Misael Cabrera, 37; Rasiel Perez, 45; and Eloy Garcia, 42 were all made at the suspect’s residences throughout Miami Dade County, the FBI said. These subjects are in federal custody and are facing federal charges. Their initial appearances are expected to be in federal court in Miami.+More on Network World: US Senator wants to know why IoT security is so anemic+To read this article in full or to leave a comment, please click here

FBI snags group that allegedly pinched 23,000 or $6.7 million worth of iPhones

The FBI today said it had arrested a group of men in connection with the theft of 23,000 Apple iPhones from a cargo area at the Miami International Airport in April.The stolen iPhones were worth approximately $6.7 million and the arrests of Yoan Perez, 33; Rodolfo Urra, 36; Misael Cabrera, 37; Rasiel Perez, 45; and Eloy Garcia, 42 were all made at the suspect’s residences throughout Miami Dade County, the FBI said. These subjects are in federal custody and are facing federal charges. Their initial appearances are expected to be in federal court in Miami.+More on Network World: US Senator wants to know why IoT security is so anemic+To read this article in full or to leave a comment, please click here

The PDF format finally reaches 2.0 release

Twenty-three years after Adobe Systems introduced the Portable Document Format (PDF), the format is finally getting a significant makeover. The new release will be available some time next year. So, what can expect after all this time? PDF was designed as a way to make formatted documents, such as contracts, available as electronic images without requiring them to be printed. What started as merely a static image when introduced in 1993 has grown into an industry standard that is modifyable, so people can PDF-fill forms on their computers, and capable of being generated by a wide variety of applications.A BPI Network report called "Dealing With Document Deluge and Danger" (available as a PDF, of course) states some 2.5 trillion PDFs are generated every year, and about 90 percent of survey respondents describe themselves and their co-workers as "PDF-dependent." So, PDF has become integral in the lives of many people and businesses. To read this article in full or to leave a comment, please click here

ARM Carves Path to IoT Driven Cloud Business

Chip design firm ARM is getting into the cloud business. The company whose designs power almost all of the world’s cell phones, has steadily pushed its designs into new ventures, including servers, as we have covered extensively. But on Tuesday it branched into something completely different.

It is selling cloud services to help a new breed of customers such as appliance makers connect devices to the internet of things in a secure fashion. The ARM mbed cloud is now available for customers that want to create a connected device that is easier to secure, track and get online.

The …

ARM Carves Path to IoT Driven Cloud Business was written by Nicole Hemsoth at The Next Platform.

ARM Carves Path to IoT Driven Cloud Business

Chip design firm ARM is getting into the cloud business. The company whose designs power almost all of the world’s cell phones, has steadily pushed its designs into new ventures, including servers, as we have covered extensively. But on Tuesday it branched into something completely different.

It is selling cloud services to help a new breed of customers such as appliance makers connect devices to the internet of things in a secure fashion. The ARM mbed cloud is now available for customers that want to create a connected device that is easier to secure, track and get online.

The …

ARM Carves Path to IoT Driven Cloud Business was written by Nicole Hemsoth at The Next Platform.

Worth Reading: The hidden world of news cameras

Most professional photographers are familiar with the fact that their cameras embed a wealth of metadata hidden in the images they create in formats like EXIF, IPTC and XMP. This metadata typically records the camera, lens and flash settings used to create the photograph, reflecting whether the image is a close-up macro portrait or a distant zoom lens shot. Yet, the fields can also contain textual descriptions of the image written by the photographer, authorship information, subject keywords, GPS coordinates, the names of public figures and events depicted in the image and a myriad other pieces of information that allow the image to be easily cataloged and searched. —Forbes

LinkedInTwitterGoogle+Facebook

The post Worth Reading: The hidden world of news cameras appeared first on 'net work.

Samy Kamkar hacks IoT security camera to show exploitable dangers to enterprise

ForeScout Technologies released an “IoT Enterprise Risk Report” (pdf) which identified seven IoT devices that can be hacked in as little as three minutes: IP-connected security systems, smart HVACs and energy meters, VoIP phones, connected printers, video conferencing systems, smart light bulbs and smart refrigerators. Although the hack might only take a few minutes to pull off, it might take weeks to find and fix.Other “key findings” of the report include: Should any of these devices become infected, hackers can plant backdoors to create and launch an automated IoT botnet DDoS attack. Cybercriminals can leverage jamming or spoofing techniques to hack smart enterprise security systems, enabling them to control motion sensors, locks and surveillance equipment. With VoIP phones, exploiting configuration settings to evade authentication can open opportunities for snooping and recording of calls. Via connected HVAC systems and energy meters, hackers can force critical rooms (e.g. server rooms) to overheat critical infrastructure and ultimately cause physical damage. Potential scenarios for after an IoT device is hacked include using compromised smart video conferencing systems for spying via camera and microphone, disabling security cameras to allow physical break-ins, snooping on calls via VoIP phones and snagging private company Continue reading

Samy Kamkar hacks IoT security camera to show exploitable dangers to enterprise

ForeScout Technologies released an “IoT Enterprise Risk Report” (pdf) which identified seven IoT devices that can be hacked in as little as three minutes: IP-connected security systems, smart HVACs and energy meters, VoIP phones, connected printers, video conferencing systems, smart light bulbs and smart refrigerators. Although the hack might only take a few minutes to pull off, it might take weeks to find and fix.Other “key findings” of the report include: Should any of these devices become infected, hackers can plant backdoors to create and launch an automated IoT botnet DDoS attack. Cybercriminals can leverage jamming or spoofing techniques to hack smart enterprise security systems, enabling them to control motion sensors, locks and surveillance equipment. With VoIP phones, exploiting configuration settings to evade authentication can open opportunities for snooping and recording of calls. Via connected HVAC systems and energy meters, hackers can force critical rooms (e.g. server rooms) to overheat critical infrastructure and ultimately cause physical damage. Potential scenarios for after an IoT device is hacked include using compromised smart video conferencing systems for spying via camera and microphone, disabling security cameras to allow physical break-ins, snooping on calls via VoIP phones and snagging private company Continue reading

Cybersecurity Isn’t Always a “Boardroom Issue”

We’ve all heard or read the rhetoric that “cybersecurity has become a boardroom issue.”  I certainly agree that we are trending in this direction but is this true today or nothing more than marketing hype?ESG recently published a new research report in collaboration with the Information Systems Security Association (ISSA) titled, The State of Cyber Security Professional Careers, to ask a number of questions and truly capture the voice of cybersecurity professionals. As part of this project, cybersecurity professionals were asked if their CISO’s (or similar role) participation with executive management (i.e. CEO, board of directors, etc.) was at an adequate level.  Just over (56%) half answered “yes,” but 16% thought the level of CISO participation with executive management should increase somewhat while another 12% believe that the CISO’s level of participation with executive management should increase significantly.  The remaining 16% responded, “don’t know” (note: I am an ESG employee).   To read this article in full or to leave a comment, please click here

Cybersecurity Isn’t Always a “Boardroom Issue”

We’ve all heard or read the rhetoric that “cybersecurity has become a boardroom issue.”  I certainly agree that we are trending in this direction but is this true today or nothing more than marketing hype?ESG recently published a new research report in collaboration with the Information Systems Security Association (ISSA) titled, The State of Cyber Security Professional Careers, to ask a number of questions and truly capture the voice of cybersecurity professionals. As part of this project, cybersecurity professionals were asked if their CISO’s (or similar role) participation with executive management (i.e. CEO, board of directors, etc.) was at an adequate level.  Just over (56%) half answered “yes,” but 16% thought the level of CISO participation with executive management should increase somewhat while another 12% believe that the CISO’s level of participation with executive management should increase significantly.  The remaining 16% responded, “don’t know” (note: I am an ESG employee).   To read this article in full or to leave a comment, please click here

Issuing Junos Commands Using Ansible raw Module

If you want to issue something quick on a lot of devices, you don’t need to write a whole Ansible playbook to do that.  In fact you don’t really need the Junos module installed.

Ansible expects there to be Python on the managed device.  As you can read in this PacketPushers blog, it pushes the module out to the device and tries to execute it there.  Junos is going to get on-box Python at some point, but right now that’s roadmap (or SOPD if you must).

Suppose you want to find out what version of software you have on a your lab device, here’s a quick way to do that.

$ ansible 192.168.30.20 -m raw -a "show version" -u username -k
SSH password:
192.168.30.20 | SUCCESS | rc=0 >>
fpc0:
--------------------------------------------------------------------
Model: ex2200-24t-4g
JUNOS Base OS boot [12.3R12.4]
JUNOS Base OS Software Suite [12.3R12.4]
JUNOS Kernel Software Suite [12.3R12.4]
JUNOS Crypto Software Suite [12.3R12.4]
JUNOS Online Documentation [12.3R12.4]
JUNOS Enterprise Software Suite [12.3R12.4]
JUNOS Packet Forwarding Engine Enterprise Software Suite [12.3R12.4]
JUNOS Routing Software Suite [12.3R12.4]
JUNOS Web Management  Continue reading
1 … 2,588 2,589 2,590 2,591 2,592 … 3,860