Apple devs: Don’t let Apple’s Xcode validation scare you

The Apple App Store has long enjoyed a sterling reputation for screening out malware. But last weekend, the company pulled apps infected with XcodeGhost malware from the Chinese Apple App Store -- infected apps that had apparently been created with a counterfeit version of Apple's Xcode IDE by unsuspecting developers.As a precaution, Apple emailed its developers on Tuesday, recommending that they validate their installed version of Xcode using a simple procedure to ensure it wasn't a hacked version. The email also contained a reminder to "always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software."To read this article in full or to leave a comment, please click here

Privacy group calls for a boycott of tech companies supporting CISA

Privacy advocates are stepping up their lobbying efforts against the controversial cyber threat information sharing bill currently in Congress after several tech giants indicated their support.Activist group Fight for the Future criticized Salesforce for supporting legislation which would "grant blanket immunity for American companies to participate in government mass surveillance programs like PRISM, without meaningfully addressing any of the fundamental cyber security problems we face in the U.S." Accordingly, Fight for the Future said it will abandon the Heroku cloud application platform within the next 90 days and encourages others to follow suit. The letter to Salesforce CEO Marc Benioff was posted on the site YouBetrayedUs.org.To read this article in full or to leave a comment, please click here

Cybersecurity hall of fame names inductees

Incoming class The National Cyber Security Hall of Fame has announced its recent class of inductees. In noting them we also highlight some of the past winners. The hall of fame recognizes the history and contributions of pioneers, innovators and educators who influenced the industry. The inductees are chosen by a board of advisers. Pictured from left to right are: Susan Landau, Steven Lipner, Cynthia Irvine, Ron Ross, and Jerry Saltzer is in front.To read this article in full or to leave a comment, please click here

An EIGRP Scaling Puzzle

This last week I received an email from a friend asking about scaling. The situation is this: a particular company has well over 100 EIGRP routers on a single L2 service from a provider. Will this scale? What’s more interesting than simply asking about scale, though, is to ask the “why” question — no matter […]

The post An EIGRP Scaling Puzzle appeared first on Packet Pushers.

DHCP Details You Didn’t Know

If you’ve been a networking engineer (or a sysadmin) for a few years, you must be pretty familiar with DHCP and might think you know everything there is to know about this venerable protocol. So did I… until I read the article by Chris Marget in which he answers two interesting questions:

  • How does the DHCP server (or relay) send DHCP offer to the client that doesn’t have an IP address (and doesn’t respond to ARP)?
  • How does the DHCP client receive the DHCP responses if it doesn’t have an IP address?
More details

Risky Business #384 — Mark Dowd talks AirDrop pwnage, XCode iOS scandal

We've got a great show for you this week. Mark Dowd drops by to talk about the recent spate of Trojaned iOS apps that made it into Apple's China App Store. We also talk to him about his awesome AirDrop bug. How did it work?

This week's sponsor segment is actually a real cracker. Context IS consultant David Klein tells us how he owned an entire cloud platform by enumerating some shitty 90s-style bugs in some third party libraries they were using. It's comedy gold. This cloud platform that uses security at a selling point. It's bad.

read more

Apple lists 25 apps impacted by XcodeGhost

Apple has identified 25 apps on its stores that had used a rogue version of its Xcode development tool, and advised users to update the affected apps to fix the issue on their devices.Figuring in the list are the WeChat app from Tencent and the Didi ride-hailing app, which had been identified earlier as affected. Other apps included in the list released by Apple on its China website include local chatting tool Encounter, the app for Baidu Music and China Unicorn's customer service app.To read this article in full or to leave a comment, please click here

Networking Field Day 10 – Arista

I finally had the chance to finish watching all of the Arista videos from Networking Field Day 10.  They did quite a few presentations and if you haven’t watched them yet I would recommend you do…

EOS Evolution and Quality

EOS SDK Demo

CloudVision Overview

7500 Series Architecture

Leaf SSU Demo

While the bulk of the videos talked about Arista platforms or features, Ken Duda’s presentation (EOS Evolution and Quality) really struck a chord with me.  Early in the presentation Ken summarizes the problem by saying “when the network ain’t working, ain’t nothing working”.  The software powering your network just has to work and it has to work consistently.  Ken then goes into where he thinks quality should come from breaking it into 3 pieces.

Culture – It’s obvious from Ken’s talk that Arista legitimately cares about software quality.  While I don’t think this is unique to Arista, I think it’s something they’ve fully embraced because they can.  Arista was born out of the commodity network era.  When you are working with commodity chips, the real differentiator becomes software.  This puts them at a unique position compared to other traditional vendors who Continue reading

Using Docker Machine with OpenStack

In this post, I’m going to show you how to use Docker Machine with OpenStack. This is something I’ve been interested in testing for a while, and now that I finally have my test lab back up and running, I was able to spend some time on this. I’ll spend some time later in the post covering my reasons for wanting to look at this, but I’ll start with the technical content of how it works.

I tested this setup with the following components:

  • The client system was running OS X 10.9.5 with the Docker 1.8.2 client binary and Docker Machine 0.4.1.
  • The OpenStack cloud was running the Juno release on Ubuntu 14.04 LTS, KVM hypervisors, and VMware NSX for networking.

There are (at least) two approaches to using Docker Machine and OpenStack together:

  1. You can use Docker Machine’s generic driver to consume already-provisioned OpenStack instances. This is, in large part, very similar to what I covered here, but I’ll cover it in this post just for the sake of completeness.
  2. You can use Docker Machine’s openstack driver to automatically provision and configure new instances on an OpenStack cloud. This is the Continue reading

A Quick Reference to Adding New Storage with LVM

This post walks through the process of adding storage capacity to a Linux server using LVM. There’s nothing new, revolutionary, or cutting-edge about this post—honestly, it’s really more for my own reference than anything else. Adding logical volumes is something that I do so infrequently that it’s hard to remember all the commands, so I’m recording them here for when I need them next time.

First, list the physical disks in the system (all commands should be prefaced with sudo or run as a user with the appropriate permissions):

fdisk -l

This will help you identify which (new) disk needs to be added. In my examples, I’ll use /dev/sdb.

Start partitioning the new disk (replace /dev/sdb with the appropriate values for your system):

fdisk /dev/sdb

I’m assuming that this isn’t a boot drive and that whatever logical volumes you create will take up the entire disk. Once you get into fdisk, follow these steps:

  1. Enter n to create a new partition.
  2. Enter p to make this a primary partition.
  3. Enter 1 to make this the first partition on the disk.
  4. Press enter twice to accept default start and end cylinders (unless you know you need to change them).
  5. Enter Continue reading

Opengear Saves the Day from 35K Feet

On Tuesday, I was boarding a flight heading to the west coast and realized I had 3 switches powered down in the colo that I needed for a presentation and demo on Wednesday. Not a good feeling.

We have an IP enabled PDU that I usually connect to with no issues from the office and home office since we also have an SD-WAN deployed using Viptela. The only issue — there is not a way to VPN into the colo (yes, that’s my fault).

As it turns out, I had exposed the Opengear console server, that we used for all out of band access, to the Internet a few months prior. On a flight that I was only planning to do offline work, I was forced to purchase Wifi…from there, the fix was pretty simple.

I SSH’d into the Opengear console server, got access to the Juniper SRX perimeter FW, and then added a temporary NAT configuration that exposed the PDU to the Internet. I was able to now access the PDU directly from 35K feet in the air, get the devices powered up, and have some peace that they could be used in the demo. Sure, I could have Continue reading

Datiphy tracks what data is up to for security, auditing purposes

Datiphy, a service provider founded in Taiwan, has bundled its technology for sale as a software package to make inroads in the U.S. as a security/data auditing tool that detects and reports suspicious access to databases.The company has been selling its service in Asia-Pacific since 2011 but has decided to improve the user interface and give it natural-language search to make it more attractive in the U.S. where the large enterprises it seeks as customers want to have an on-premises platform, says Mike Hoffman, executive vice president of sales and marketing.Datiphy has also gotten a financial shot in the arm, pulling down $7 million from Highland Capital Partners in its first round of institutional funding that it will use in part to hire staff to pursue partnerships so data gathered by the platform can be shared with other security products.To read this article in full or to leave a comment, please click here

DerbyCon: Former BlueHat prize winner will bypass Control Flow Guard in Windows 10

Windows 10, and even Windows 8.1 Update 3, uses Control Flow Guard (CFG) to protect against memory-corruption attacks. Close to the end of last year, Microsoft said the CFG security feature could "detect attempts to hijack your code" and stop executing the code "before the hijacker can do damage to your data or PC."This summer at Black Hat, Yunhai Zhang showed how to "Bypass Control Flow Guard Comprehensively" (pdf). And at DerbyCon on Friday, Jared DeMott and Rafal Wojtczuk will present "Gadgets Zoo: Bypassing Control Flow Guard in Windows 10."To read this article in full or to leave a comment, please click here

Book Report: Future Crimes

Future Crimes by Marc Goodman details the dark side of technology, examining how new technologies are used and abused for criminal purposes.  In just under 400 pages, Goodman provides some basic historical background on computer security and then guides the reader through a cybercrime journey spanning consumer, industrial, medical, and various other technologies.Fair warning to prospective readers: the story isn’t pretty. The author starts with a wake-up call about data privacy and how a plethora of companies like Facebook, Google, and OkCupid, and the $150 billion dollar data broker industry regularly collect, sell, and abuse user data.  Future Crimes also explores the current derelict world of cyber peeping toms, bullies, revenge porn, and extortion. While these crimes are already rampant today, Goodman theorizes that things will get worse with the proliferation of surveillance cameras, geo-location services, RFID tags, and wireless networking technology. The point is crystal clear: each technology innovation increases the attack surface, and cybercriminals are only too happy to exploit these vulnerabilities for profit.To read this article in full or to leave a comment, please click here

1 … 3,310 3,311 3,312 3,313 3,314 … 3,841