NSA: ad hominem is stil a fallacy

An ad hominem attack is where, instead of refuting a person's arguments, you attack their character. It's a fallacy that enlightened people avoid. I point this out because of a The Intercept piece about how some of NSA's defenders have financial ties to the NSA. This is a fallacy.


The first rule of NSA club is don't talk about NSA club. The intelligence community frequently publishes rules to this effect to all their employees, contractors, and anybody else under their thumb. They don't want their people talking about the NSA, even in defense. Their preferred defense is lobbying politicians privately in back rooms. They hate having things out in the public. Or, when they do want something public, they want to control the messaging (they are control freaks). They don't want their supporters muddying the waters with conflicting messaging, even if it is all positive. What they fear most is bad supporters, the type that does more harm than good. Inevitably, some defender of the NSA is going to say "ragheads must die", and that'll be the one thing attackers will cherry pick to smear the NSA's reputation.

Thus, you can tell how close somebody is to the NSA by Continue reading

HP’s PC group cranks up design, gaming efforts ahead of spin-off

HP’s PC group doesn’t want to be a “screwdriver” PC maker making look-alike laptops and desktops, and it is focusing heavily on design and new innovations as it prepares for a spin-off into a separate company.The company is focusing on cutting the plastic and adding metal and new colors to the chassis of its laptops and desktops. HP also is expanding its hardware options for consumers, businesses and gamers, and focusing on a future when virtual reality will be an important part of the computing experience.PC makers need to update the devices because customers are paying more attention to how devices look and function, said Mike Nash, vice president for consumer PC and solutions at HP’s Printing and Personal Systems Group.To read this article in full or to leave a comment, please click here

How China’s smartphone market is evolving

The Chinese mobile market has long been described as the ultimate prize for smartphone handset makers and app developers. China has the most people, income is rising, and the population has an insatiable appetite for mobile technology.That's all true, except when the facts don't quite support the narrative.For example, the conventional wisdom holds that most Chinese mobile consumers are interested in inexpensive phones from upstart manufacturers like Xiaomi, Huawei, and ZTE. And that's true, up to a point. According to IDC's latest Mobile Phone Tracker, many of those brands are trying to move up into the mid- and high-end segments.To read this article in full or to leave a comment, please click here

Some brief technical notes on Venom

Like you, I was displeased by the lack of details on the "Venom" vulnerability, so I thought I'd write up what little I found.

The patch to the source code is here. Since the note references CVE-2015-3456, we know it's venom:
http://git.qemu.org/?p=qemu.git;a=commit;h=e907746266721f305d67bc0718795fedee2e824c

Looking up those terms, I find writeups, such as this one from RedHat:
https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

It comes down to a typical heap/stack buffer overflow (depending), where the attacker can write large amounts of data past the end of a buffer. Since this is the kernel, there are no protections like NX or ASLR. To exploit this, you'd likely need some knowledge of the host operating system.

The details look straightforward, which means a PoC should arrive by tomorrow.

This is a hypervisor privilege escalation bug. To exploit this, you'd sign up with one of the zillions of VPS providers and get a Linux instance. You'd then, likely, replace the floppy driver in the Linux kernel with a custom driver that exploits this bug. You have root access to your own kernel, of course, which you are going to escalate to root access of the hypervisor.

People suggest adding an exploit to toolkits like Continue reading

Critical VM escape vulnerability impacts business systems, data centers

A critical vulnerability in code used by several virtualization platforms can put business information stored in data centers at risk of compromise.The flaw, dubbed Venom but tracked as CVE-2015-3456, can allow an attacker to break out from the confines of a virtual machine (VM) and execute code on the host system.This security boundary is critical in protecting the confidentiality of data in data centers, where virtualization is extensively used to allow different tenants to run servers on the same physical hardware.The flaw is located in the virtual Floppy Disk Controller (FDC) code from the QEMU open source machine emulator and virtualizer. The code is also used by the Xen, KVM and other virtualization platforms.To read this article in full or to leave a comment, please click here

Nuage visualizes the SDN

Nuage Networks this week released an application designed to better integrate physical and virtual networks.The company’s Virtualized Services Assurance Platform (VSAP) correlates the operation of virtual overlays and physical underlays in software defined networks on behalf of applications and workloads. Nuage says it employs standard protocols to achieve this instead of proprietary approaches offered by its SDN competitors that require specific hardware.+MORE ON NETWORK WORLD: Alcatel-Lucent SDN company puts pedal to bare metal+To read this article in full or to leave a comment, please click here

Nuage visualizes the SDN

Nuage Networks this week released an application designed to better integrate physical and virtual networks.The company’s Virtualized Services Assurance Platform (VSAP) correlates the operation of virtual overlays and physical underlays in software defined networks on behalf of applications and workloads. Nuage says it employs standard protocols to achieve this instead of proprietary approaches offered by its SDN competitors that require specific hardware.+MORE ON NETWORK WORLD: Alcatel-Lucent SDN company puts pedal to bare metal+To read this article in full or to leave a comment, please click here

Establishing your virtual presence on the cheap

I was excited to see what Double Robotics has accomplished with their telepresence robot, especially when one showed up on an episode of The Good Wife. Double Robotics’ device (see http://www.doublerobotics.com/) is making it possible for teleworkers to have their “doubles” moving around the office, chatting with staff, and attending meetings. The devices works like an iPad on a Segway, though the stand/roller part of the setup is much lighter and slimmer than a Segway, so it’s more like an iPad on a rolling stick. But the movement is controlled remotely and the person controlling it has a sense from their screen of moving around the office and interacting with the staff because their “double” really is.To read this article in full or to leave a comment, please click here

Public Key Authentication on Cisco IOS

Have you ever been in that situation that you needed to apply the same configuration quickly on multiple Cisco routers? If yes, you probably wrote a script that connected to routers and sent appropriate IOS commands. One problem that you certainly had to solved was forcing your script to enter login credentials such as username and password. Moreover if you secure an access to privileged user mode of routers with an enable secret command you had to tell the script how to enter that password as well.

All the issues I have mentioned above can be easily solved with Expect scripting language. Expect sends commands via telnet or ssh session as the human would. However encapsulating IOS commands to syntax recognized by Expect language every time you need to change routers' configuration seems to be not very comfortable. That is why public key authentication for Cisco routers can be handy.

Public key authentication allows you to log in to your routers using  RSA key instead of a password. But firstly  key-pair - public and private key must be generated and a public key copied into a config file of  the router. Then you can connect to the router with your  private key. A private key is the key that should Continue reading

How much you really need to worry about SSD reliability

The word is out: Your SSD won’t retain your data forever when you unplug it. Yup, you’ll never be able to go on vacation again without toting your SSD along. It’s incapable of surviving for two weeks without you, poor thing.I kid, of course.Not archival, but not pathetic The truth is, yes, under disastrously unfortunate environmental conditions (we’re talking Biblical), your SSD could lose data retention just a few days after it’s pulled from your PC. It could also lose it immediately if you pulverized it with a sledgehammer or threw it in a vat of sulphuric acid—almost-as-likely scenarios. To the point: I’ve re-tasked SSDs after a couple of years of sitting on the shelf, and annoyingly—I still had to secure-erase them to get rid of the old data.To read this article in full or to leave a comment, please click here

SDN: Integration over Manipulation

I’d like to briefly express a sentiment that I pondered after listening to another one of Ivan’s great podcasts, specifically regarding the true value of a software-defined network approach. The statement was made that ACLs are terrible representations of business policy. This is not inaccurate, but the fact remains that ACLs are currently the de facto representation of business policy on a network device. The “network team” gets a request from an application team to “fix the firewall”, and the policy that is applied to enable that application typically results in an ACL change.

If you’ve ever been in this situation, you likely realize this entire process probably takes some time. Either the application team doesn’t know what exactly needs to be changed, or the network team is too busy, or both. Clearly, there’s a problem. And more often than not, this discussion becomes all about the forwarding architecture.

Oh yes, with old-school ACLs we could only match on a few things - IP subnets, TCP ports, that's about it. But now with OpenFlow - we can match on **EtherType**!! We're saved!!

Don’t be misled - the value of an SDN architecture does not lie in the fact that we can do Continue reading

SDN: Integration over Manipulation

I’d like to briefly express a sentiment that I pondered after listening to another one of Ivan’s great podcasts, specifically regarding the true value of a software-defined network approach. The statement was made that ACLs are terrible representations of business policy. This is not inaccurate, but the fact remains that ACLs are currently the de facto representation of business policy on a network device. The “network team” gets a request from an application team to “fix the firewall”, and the policy that is applied to enable that application typically results in an ACL change.

If you’ve ever been in this situation, you likely realize this entire process probably takes some time. Either the application team doesn’t know what exactly needs to be changed, or the network team is too busy, or both. Clearly, there’s a problem. And more often than not, this discussion becomes all about the forwarding architecture.

Oh yes, with old-school ACLs we could only match on a few things – IP subnets, TCP ports, that’s about it. But now with OpenFlow – we can match on EtherType!! We’re saved!!

Don’t be misled – the value of an SDN architecture does not lie in the fact that we can do Continue reading

SDN Terminology from Layered Models

Even though we don’t build networks with OSI products, we still use terms from the OSI model. What terms will we end up using for SDN, once the dust settles?

The previous post introduced one document that attempts to define terms and architecture, and today’s post introduces another: the ITU-T Y.3300 document. But how do these documents fit in with our fast-changing networking landscape – and what words should we use? Today’s post looks at the Y.3300 doc, and explores a few of the terms.

Other posts in this series:

 

Big Picture First: ITU-T Y-Series

Most of us don’t have a reason to read docs from standards bodies unless we’re looking for a particular standard or fact. But as long as we’re talking about one doc from the ITU-T Y-series, it’s worth a minute to set the context of what these documents are.

First off, the topic area for the Y-series is broad, but it’s all networking! The title for the ITU-T’s Y-series of documents spells out the big items:

Global information infrastructure, Internet protocol aspects and next-generation networks

Great, so the topic is global network, IP, including next-generation networks. It’s networking! Continue reading

1 … 3,457 3,458 3,459 3,460 3,461 … 3,809