T-Mobile caught in crossfire of injected ad war with Flash Networks

LAS VEGAS - An ongoing conflict between website owners and ad injectors who place unwanted ads on those websites has just flared up into full-blown war, with advertisers and carriers caught in the crossfire.Take, for example, T-Mobile, which is proudly named as a customer by Flash Networks, a company that brags about creating "new monetization opportunities" for mobile operators when it "inserts the most relevant engagement display into the selected webpages."This seems to have been a surprise to T-Mobile. Cynthia Lee, the company's senior digital media manager, adamantly denied that T-Mobile was using Flash Networks to inject ads into webpages it was serving up to mobile customers.To read this article in full or to leave a comment, please click here

Automating Intelligence: Discovering Recent PlugX Campaigns Programmatically

One of the hardest things to do when you are receiving malware that have “anonymized” (e.g. name-is-hash) names or general samples that lack any indication of the infection vector is to determine the origin of the file and its intended target. Even harder is when you do not receive telemetry data from products that contains information about infected machines. To that end, I have been working on automating ways to help ASERT better understand the context around samples so we can answer question about what may have been targeted, why it was targeted and when it was targeted. This post will use the PlugX malware as an example (PlugX is well known and has had its various iterations analyzed many times), due in part to its ongoing activity and will focus on  leveraging metadata from VirusTotal due to it being publicly accessible.

The How

Automation is king when processing malware and getting the configuration out of samples without analyst intervention is always ideal and we prefer to treat our various sandbox platforms as black boxes and extract what we can from them before doing our own normalization and post-processing tasks to collate all the information into our internal malware analysis system and Continue reading

China clamps down on exports of drones and supercomputers

China plans to limit exports of advanced drones and supercomputers for national security reasons.The new export controls on certain drone and high-performance computing technologies will come into effect Aug. 15, Chinese government regulators said Friday. Affected vendors will have to apply for a government permit to ship their technology outside China.The regulations target more advanced drones that can be flown for at least an hour, “beyond the natural sight of the operator” and function more as an unmanned aerial vehicles.Shenzhen-based DJI, a major Chinese builder of drones, seems confident the new export controls won’t disrupt its business.To read this article in full or to leave a comment, please click here

Sorriest technology companies of 2015

Sorry situationImage by ThinkstockDespite all the technology advances that have rolled out this year, it’s also been a sorry state of affairs among leading network and computing vendors, along with businesses that rely heavily on technology. Apple, Google, airlines and more have issued tech-related mea culpas in 2015…To read this article in full or to leave a comment, please click here

New products of the week 08.03.2015

New products of the weekOur roundup of intriguing new products. Read how to submit an entry to Network World's products of the week slideshow.Out-of-Band Dry Contact Management SwitchKey features: Remotely manage four dry DC contacts plus one AC outlet. Includes monitoring, alarm and logging functions to track temperatures, power outages and other conditions and events at remote equipment sites. More info.To read this article in full or to leave a comment, please click here

Nokia reaches deal to sell Here business to Audi, BMW Group and Daimler

Nokia has reached an agreement to sell its Here mapping and location services business to an automotive industry consortium consisting of Audi, BMW Group and Daimler, in a deal that gives the business an enterprise value of €2.8 billion (US$3.1 billion).The deal fits with the plans of the automakers to progressively introduce more Internet-based services and automation to assist drivers. Here is developing a location cloud that uses the data generated by vehicles, devices and infrastructure to deliver real-time, predictive and personalized location services, Nokia said in a statement Monday.The three automotive companies said they will each hold an equal stake in Here, but will take a hands-off approach to the business which will be run independently to serve the entire industry.To read this article in full or to leave a comment, please click here

Indian government orders ISPs to block 857 porn websites

The Indian government has ordered a large number of porn websites to be blocked, creating an uproar among users and civil rights groups in the country.The Department of Telecommunications has issued orders for the blocking of 857 websites serving pornography, said two persons familiar with the matter, who declined to be named.Section 69 (A) of India’s Information Technology Act allows the government to order blocking of public access to websites and other information through computer resources, though this section appears to be designed to be invoked when a threat is perceived to the sovereignty and integrity of India, security of the state, friendly relations with foreign states or public order.To read this article in full or to leave a comment, please click here

DNS server attacks begin using BIND software flaw

Attackers have started exploiting a flaw in the most widely used software for the DNS (Domain Name System), which translates domain names into IP addresses.Last week, a patch was issued for the denial-of-service flaw, which affects all versions of BIND 9, open-source software originally developed by the University of California at Berkeley in the 1980s.The flaw can be exploited with a single packet, crashing both authoritative and recursive DNS servers. Security analysts predicted that attackers would quickly figure out how to exploit the flaw, which has now happened.“We can confirm that the attacks have begun,” wrote Daniel Cid, CTO and founder of the security company Sucuri. “DNS is one of the most critical parts of the Internet infrastructure, so having your DNS go down, it also means your email, HTTP and all other services will be unavailable.”To read this article in full or to leave a comment, please click here

Fake Apple iOS crash reports prove tricky to remove

Some Apple mobile users have been encountering a pop-up message that is particularly difficult to close.The message appears after a user has been redirected to a different domain, usually caused by viewing a malicious advertisement, wrote Jerome Segura, a senior security researcher with Malwarebytes.The message warns that a third-party application on the phone has caused the device to crash and includes a phone number where users can allegedly get their device fixed.Warnings such as this one are employed by technical support schemes, which convince people to call their support lines by falsely warning that their computers or devices have security or performance problems.To read this article in full or to leave a comment, please click here

Microsoft will NOT email you Windows 10, it’s ransomware

A few days ago, over 14 million machines had been upgraded to Windows 10, but millions of other people who used the “Get Windows 10” app are impatiently waiting for Microsoft to notify them that it is their turn to download Windows 10. The app says Microsoft is rolling out the free upgrade in waves; “Watch for your notification so that you can start your upgrade. Your notification to upgrade could come as soon as a few days or weeks.” That notification has become an exploitation opportunity for bad guys who are sending out fake Windows 10 upgrade emails along with supposedly zipped Windows 10 download attachments that ultimately install ransomware on victims’ PCs.To read this article in full or to leave a comment, please click here

Interview with CCDE/CCAr Program Manager Elaine Lopes

I am currently studying for the CCDE exam. Elaine Lopes is the program manager for the CCDE and CCAr certification. I’ve had the pleasure of interacting with her online and meeting her at Cisco Live as well. The CCDE is a great certification and I wanted you to get some insight into the program and ask about the future of the CCDE. A big thanks to Elaine and Cisco for agreeing to do the interview.

Daniel: Hi Elaine, and welcome. It was nice seeing you at Cisco Live! Can you please give a brief introduction of yourself to the readers?

Elaine: Hi, it was nice to see you, too! My name is Elaine Lopes and I’m the CCDE and CCAr Certification Program Manager. I’ve been with Cisco’s Learning@Cisco team since 1999, – I’m passionate about how people’s lives can change for the better through education and certification.

Daniel: Elaine, why did Cisco create an expert level design program? What kind of people should be looking at the CCDE?

Elaine: Cisco has very well established expert-level certifications for network engineers in various fields which assess configuration, implementation, troubleshooting and operations skills; however, these certifications were never aimed to assess design skills. Continue reading

Network Documentation Series: Port Mapping

In this post, I will be doing a brief commentary on creating and maintaining a physical port mapping spreadsheet. A port mapping spreadsheet is useful for keeping track of used/available ports on your network equipment, thoroughly documenting to which remote device each port connects, and generating configuration scripts to update port descriptions on the equipment. […]

The post Network Documentation Series: Port Mapping appeared first on Packet Pushers.

Citizens of Tech 012 – Biofuel Pyramid Cables

We start with a discussion of jail time. Jail. Time. And…147 MPH. Yeah. Eric tells the story. And then we hop into our show. Present Doomception: How modders got Doom to run inside of Doom http://arstechnica.com/gaming/2015/07/doomception-how-modders-got-doom-to-run-inside-of-doom/ Doom was open sourced in the 90’s. Folks have gone nuts porting it to all sorts of things. Now, […]

The post Citizens of Tech 012 – Biofuel Pyramid Cables appeared first on Packet Pushers.

Citizens of Tech 012 – Biofuel Pyramid Cables

We start with a discussion of jail time. Jail. Time. And…147 MPH. Yeah. Eric tells the story. And then we hop into our show. Present Doomception: How modders got Doom to run inside of Doom http://arstechnica.com/gaming/2015/07/doomception-how-modders-got-doom-to-run-inside-of-doom/ Doom was open sourced in the 90’s. Folks have gone nuts porting it to all sorts of things. Now, […]

The post Citizens of Tech 012 – Biofuel Pyramid Cables appeared first on Packet Pushers.

Yahoo picks up fashion commerce site Polyvore

Marissa Mayer knows fashion, and she’s bringing more of it to Yahoo with her latest acquisition announced Friday.Yahoo has reached a deal to acquire Polyvore, an e-commerce site that lets you shop for “what’s trending in the style community,” Yahoo announced Friday. It hopes the deal will give it a place to sell more ads for retailers.The site lets users shop for clothing and accessories, but it also has a social networking component that lets users post collections of desired items, like they might on Pinterest. The majority of Polyvore’s users are women between the ages of 18 and 34, the company says.In its announcement, Yahoo cited advertising as a key driver of the deal. Yahoo will integrate Polyvore’s ads into Gemini, its native ads platform. Polyvore has more than 350 advertisers who are retailers, Yahoo said.To read this article in full or to leave a comment, please click here

FirePower management interface

While installing Cisco FirePOWER on 5545-X, I was following the "Install and Configure a FirePOWER Services Module on an ASA Platform" guide.

One of the steps was to configure an IP address to the FirePower management interface. However, nowhere in the document it was mentioned how would that interface connect to the outside world.

So I tired to google it, and it looks like no one was asking that question: How would an internal module connect to the outside world? Not a single blog post about it. It just worked for everyone, no questions asked!

After digging around I found this document: "Cisco ASA FirePOWER Module Quick Start Guide"

And there I have found my answers:
  1. For 5585-X, FirePOWER is installed on a dedicated slot with its own mgmt0 interface.
  2. For 5545-X, FirePOWER module (SRF) is using the 5545-X's management0/0 interface. Which means that we can not use that interface for managment and it must be dedicated to FirePOWER!
  3. For the rest, it will use the "inside" interface.
 I would have expected a command to allow me to set up a bridge between the SRF management interface and some ifname on the ASA. But no, it is hard wired! Why?

VLAN Bridging with FirePOWER

Although not immediately obvious, the FirePOWER Series 3 devices can do a form of IPS on a stick. This means that the capability described here should be available to the current appliance versions of the FirePOWER managed devices. The premise involves connecting broadcast domains (VLANs) to bring the managed device inline between the initiator and responder of a flow. Configuration is fairly straightforward but does have some caveats.

Caveats

  • Even though only a single port is required, a virtual switch must be configured (this cannot just be an inline pair)
  • BPDUs being bridged between VLANs are detected and will render the switchport(s) in an inconsistent state
  • The FirePOWER physical interface will not activate until it is also bound to a Virtual Switch

FirePOWER Bridge VLANsThe diagram shows two devices in the same VLAN (we will assume /24 for the configuration). The device on the top is in VLAN 100. The FirePOWER managed device bridges VLAN 100 to VLAN 101 and allows the two devices to communicate directly with one another. The connection to the FirePOWER device is a single 802.1q trunk.

Frames arriving on VLAN 100 will be processed and egress with a VLAN tag of 101. This configuration is similar to a Continue reading

Mt. Gox CEO Karpeles arrested by Japanese police

The CEO of failed Bitcoin exchange Mt.Gox was arrested in Japan early Saturday by police, according to several media reports.Mark Karpeles faces charges related to the loss of 650,000 bitcoins worth hundreds of millions of U.S. dollars when the Tokyo-based trading exchange collapsed in February 2014.Karpeles, a French citizen, is suspected of accessing the company’s computer systems and falsifying financial data, according Japan’s Kyodo News.Japanese broadcaster NHK showed video of a man that appeared to be Karpeles being led to a car by police in a residential district of Tokyo. The TV station said the footage was recorded around 6:40am Saturday, or Friday afternoon U.S. time.To read this article in full or to leave a comment, please click here

1 … 3,370 3,371 3,372 3,373 3,374 … 3,837