Risky Business #376 — Sniper rifles, bank safes and Android all pwned

This week we're checking in with Josh Drake of Zimperium. With exploitation of Stagefright via Josh's sweet, sweet exploit you'd think the mother of all worms is coming. Well, probably not. Later versions of Android are tricky to exploit, and the diversity of hardware in earlier versions means coming up with one exploit to rule them all isn't really feasible. We'll drill down into that with Josh in a little while.

read more

Obama rolls out initiative to boost US supercomputer capability

US President Barack Obama has signed an executive order setting up the National Strategic Computing Initiative that will adopt a coordinated strategy involving multiple government agencies, academia and the private sector for the development of high-performance computing systems.Adopting a “whole-of-government” approach, involving all departments and agencies with expertise and interests in HPC, one of the objectives of the NSCI will be to speed up the delivery of “a capable exascale computing system that integrates hardware and software capability to deliver approximately 100 times the performance of current 10 petaflop systems across a range of applications representing government needs.”To read this article in full or to leave a comment, please click here

The StageFright Vulnerability: Maybe the greatest Android vulnerability (so far)

Here’s a nightmare scenario: A simple smartphone exploit that doesn’t require the user to do anything other than receive a text message. If such a thing worries you (and, if you’re an IT manager, in a shop that allows BYOD, it should) then there’s bad news for you: Such an exploit exists for, it estimated, roughly 95% of Android smartphones which runs roughly 82% of the world’s estimated 1.91 billion smartphones.To read this article in full or to leave a comment, please click here

Samsung plots Galaxy S6 price cut, new phones to help business

Lackluster demand for its flagship Galaxy S6 smartphone and higher marketing costs led Samsung Electronics to another quarter of falling sales and profits in the April to June period.Net profit at the company was 5.75 trillion won (US$49 billion), down 8 percent on the same period a year earlier, while sales fell 7 percent to 48.5 trillion won, it said Wednesday. Both figures are in line with expectations published by Samsung earlier this month.In the key smartphone market, an area led by Samsung until recently, the popularity of Apple’s iPhone 6 and 6 Plus handsets and the rise of lower-cost phones from Chinese vendors squeezed Samsung at both the high and low end of the market.To read this article in full or to leave a comment, please click here

Facebook revenue surges 39 percent but costs also soar

Facebook has posted strong sales results for the second quarter, showing continued success in its advertising business, though its costs also rose sharply.Total revenue for the quarter ended June 30 was US$4.04 billion, Facebook reported Wednesday, up 39 percent from the same period last year and just over analysts’ estimates of $3.99 billion, as polled by Thomson Reuters.But the company made less money than it did a year earlier, with net income falling by nearly 10 percent to $719 million. Earnings per share declined from $0.30 to $0.25.To read this article in full or to leave a comment, please click here

Computer fires requiring a 911 call rare

Computer fires severe enough to prompt a 911 call are so unusual that when it does happen, local media sometimes makes note of it. That was the case in Arlington, Va., recently, when firefighters found a computer burning on the balcony of an apartment complex.According to the Arlington County Fire Dept., the resident of the apartment had built his own desktop computer. The computer wasn't in use, but was plugged in -- and the resident was in another room when it caught fire."He was alerted to the fire by the sound of the smoke alarm and then found smoke coming from his hard drive," said department Lt. Sarah-Maria Marchegiani.The resident carried the computer out to the balcony after it caught on fire, according to a local media report on Arlington Now.To read this article in full or to leave a comment, please click here

Americas are just 2 weeks away from running out of IPv4 addresses

John Curran, CEO of the American Registry for Internet Numbers (ARIN), told attendees at the Campus Technology conference in Boston on Wednesday that the IP address authority's pool of IPv4 addresses has dwindled to 90,000 and will be exhausted in about two weeks. "This is a pretty dramatic issue," says Curran, who founded ARIN in 1997 and was once CTO of Internet pioneer BBN. Curran’s revelation came during a talk during which he urged IT pros from educational institutions to upgrade their public facing websites to IPv6 as soon as possible. Not that the IPv4 address pool drying up will result in such websites being cut off from the Internet, but Curran did say moving to IPv6 will provide much more direct access to end users whose mobile and other devices increasingly have IPv6 rather than IPv4 addresses.To read this article in full or to leave a comment, please click here

Using BFD to Track WAN Status and Change HSRP Priority

It’s been five years since I started this blog! Time flies and a lot has happened since. Thanks for being along for the ride. What better way to celebrate than a blog post?

This post is going to be short and to the point.

Many of us run HSRP or VRRP. It is quite common to run it in a topology where you have dual routers and dual exits to the WAN and you don’t want to black hole your traffic.

HSRP-BFD1

One traditional way of achieving this is by tracking the interface that goes towards the WAN. There are a couple of drawbacks to this approach though:

  • You may not get link down on failure (connecting to switch)
  • You may experience an error that does not produce link down event

The next option is to use IP SLA that sends ICMP Echo towards the next-hop of the WAN or some destination further into the network. Ehanced Object Tracking (EOT) can then be used to create a track object that decrements the priority of the HSRP active router when the ICMP Echo probe fails. This works better but there are still some drawbacks to this approach:

Maliciously crafted MKV video files can be used to crash Android phones

A malicious application or Web page could be used to crash Android devices, in some cases persistently, due to a vulnerability in a multimedia processing component.The announcement, by security researchers from Trend Micro, comes days after other Android media processing flaws were revealed. Those flaws could allow attackers to compromise devices with a simple MMS message.The latest vulnerability is located in Android’s mediaserver component, more specifically in how this service handles files that use the Matroska video container (MKV), the Trend Micro researchers said in a blog post Wednesday.To read this article in full or to leave a comment, please click here

Microsoft’s new privacy policy and Windows 10 troubleshooter to stop automatic updates

It’s the big Windows 10 launch day and Microsoft has reserved a huge amount of bandwidth for the massive rollout, reportedly “up to 40Tb/s per second of capacity from all of the third-party CDNs combined.” If you haven’t done so yet, then you should review Microsoft’s new privacy and service agreements as well as the privacy dashboard to consider making changes to your settings for Windows and Cortana, as well as Microsoft services such as Office 365, Xbox Live, Groove Music, Office Online, OneDrive, Skype, Outlook.com and Bing Rewards.According to Horatio Gutierrez, Microsoft’s deputy general counsel, the company’s updated Privacy Statement and Services Agreement were guided by simplicity, transparency, and privacy. Gutierrez said consumers need “clear terms and policies that both respect individual privacy and don’t require a law degree to read.” The new Privacy Statement, which kicks into effect on August 1 – mere days after Windows 10 – is supposed to have “straightforward terms and policies that people can easily understand.” Yet since the new privacy policy is 22 pages long and the service agreement is 23 pages long, the European Digital Rights (EDRi) group said, “So much for clearly understandable Continue reading

Is SD-WAN Simply WAN Optimization Evolved? Not Exactly.

Consumers evaluating SD-WAN shouldn't think of it as a WAN optimization replacement, at least not exactly. These are different technologies, although it might be fair to think of SD-WAN as the successor to WAN optimization. SD-WAN and WAN optimization are compatible technologies, but not interdependent technologies.

The Correct Mask for a PE’s Loopback0

As I’ve written about previously (The Importance of BGP NEXT_HOP in L3VPNs), the BGP NEXT_HOP attribute is key to ensuring end to end connectivity in an MPLS L3VPN. In the other article, I examine the different forwarding behavior of the network based on which of the egress PE’s IP addresses is used as the NEXT_HOP. In this article I’ll look at the subnet mask that’s associated with the NEXT_HOP and the differences in forwarding behavior when the mask is configured to different values.

There is a lot of (mis-)information on the web stating that the PE’s loopback address — which, as I explain in the previous article, should always be used as the NEXT_HOP — must have a /32 mask. This is not exactly true. I think this is an example of some information that has been passed around incorrectly, and without proper context, and is now taken as a rule. I’ll explain more about this further on in the article.

Example Network

Here’s the example network:

MPLS_PE_Loopback_MaskNote that R2 and R7 are the PEs and they each have a /24 mask on their loopback0 interfaces. The PEs are peering via their loopbacks. OSPF is running between R2, Continue reading

Reaction: Testing to the Cut Score (Certifications)

Tom has an interesting post over at The Networking Nerd on one of my favorite areas of discussion — certifications. To give you a sense —

Perhaps raising the cut scores to more than 900 points isn’t the answer. Maybe instead more complex questions or more hands-on simulations are required to better test the knowledge of the candidates. These are better solutions that take time and research. They aren’t the false panacea of raising the passing score. The rising tide can’t be fixed by making the buoys float just a little higher.

I think the problem exam writers face is the defensibility problem. The problem of defensibility has been so strongly pushed into my head, from my years working on the CCDE and CCAr, that I tend to apply the problem to just about everything I do any longer. To state the problem, within the certification space, as succinctly as possible —

If someone sues me because they failed this exam, what evidence can I bring forward to prove this specific person should not have passed the exam.

It’s actually not as easy of a question to answer as it might appear. Why is your cut score set to x? Continue reading

1 … 3,373 3,374 3,375 3,376 3,377 … 3,836