With VSAP, Nuage Can Read Any SDN Underlay
A network visibility tool lets Nuage users peer into any underlay network.
NSA: ad hominem is stil a fallacy
An ad hominem attack is where, instead of refuting a person's arguments, you attack their character. It's a fallacy that enlightened people avoid. I point this out because of a The Intercept piece about how some of NSA's defenders have financial ties to the NSA. This is a fallacy.The first rule of NSA club is don't talk about NSA club. The intelligence community frequently publishes rules to this effect to all their employees, contractors, and anybody else under their thumb. They don't want their people talking about the NSA, even in defense. Their preferred defense is lobbying politicians privately in back rooms. They hate having things out in the public. Or, when they do want something public, they want to control the messaging (they are control freaks). They don't want their supporters muddying the waters with conflicting messaging, even if it is all positive. What they fear most is bad supporters, the type that does more harm than good. Inevitably, some defender of the NSA is going to say "ragheads must die", and that'll be the one thing attackers will cherry pick to smear the NSA's reputation.
Thus, you can tell how close somebody is to the NSA by Continue reading
Cisco Still Loves ASICs, as EZchip Discovers the Hard Way
A chipmaker's stock plunges as Cisco returns to ASICs on a key platform.
Some brief technical notes on Venom
Like you, I was displeased by the lack of details on the "Venom" vulnerability, so I thought I'd write up what little I found.The patch to the source code is here. Since the note references CVE-2015-3456, we know it's venom:
http://git.qemu.org/?p=qemu.git;a=commit;h=e907746266721f305d67bc0718795fedee2e824c
Looking up those terms, I find writeups, such as this one from RedHat:
https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/
It comes down to a typical heap/stack buffer overflow (depending), where the attacker can write large amounts of data past the end of a buffer. Since this is the kernel, there are no protections like NX or ASLR. To exploit this, you'd likely need some knowledge of the host operating system.
The details look straightforward, which means a PoC should arrive by tomorrow.
This is a hypervisor privilege escalation bug. To exploit this, you'd sign up with one of the zillions of VPS providers and get a Linux instance. You'd then, likely, replace the floppy driver in the Linux kernel with a custom driver that exploits this bug. You have root access to your own kernel, of course, which you are going to escalate to root access of the hypervisor.
People suggest adding an exploit to toolkits like Continue reading
5 Reasons Why You Should Attend DockerCon 2015
We have way more (and we’re sure you do too!), but here are our top five reasons to attend DockerCon 2015. 1. All-Star Lineup of Presenters We secured an all-star lineup featuring: Solomon Hykes, Founder and CTO of Docker Matthew Leventi, System Engineer … ContinuedVMware Says Customers Are Betting Big on NSX
A new twist on counting SDN customers: Who's really committed?
Docker Tutorial 9 – Docker Machine
This is a casual Docker tutorial series. We started out first with very simple sessions on how to install and use the docker run command. In future videos we will hit more advanced topics. This ninth video talks about Docker … ContinuedFeatured Video & White Paper: Cisco’s GBP to OpenStack
Cisco highlights its group-based policy (GBP) abstractions for OpenStack, a declarative policy model that simplifies application-oriented interfaces.
Public Key Authentication on Cisco IOS
Have you ever been in that situation that you needed to apply the same configuration quickly on multiple Cisco routers? If yes, youPublic Key Authentication on Cisco IOS
Have you ever been in that situation that you needed to apply the same configuration quickly on multiple Cisco routers? If yes, you probably wrote a script that connected to routers and sent appropriate IOS commands. One problem that you certainly had to solved was forcing your script to enter login credentials such as username and password. Moreover if you secure an access to privileged user mode of routers with an enable secret command you had to tell the script how to enter that password as well.
All the issues I have mentioned above can be easily solved with Expect scripting language. Expect sends commands via telnet or ssh session as the human would. However encapsulating IOS commands to syntax recognized by Expect language every time you need to change routers' configuration seems to be not very comfortable. That is why public key authentication for Cisco routers can be handy.
Public key authentication allows you to log in to your routers using RSA key instead of a password. But firstly key-pair - public and private key must be generated and a public key copied into a config file of the router. Then you can connect to the router with your private key. A private key is the key that should Continue reading
SDN: Integration over Manipulation
I’d like to briefly express a sentiment that I pondered after listening to another one of Ivan’s great podcasts, specifically regarding the true value of a software-defined network approach. The statement was made that ACLs are terrible representations of business policy. This is not inaccurate, but the fact remains that ACLs are currently the de facto representation of business policy on a network device. The “network team” gets a request from an application team to “fix the firewall”, and the policy that is applied to enable that application typically results in an ACL change.
If you’ve ever been in this situation, you likely realize this entire process probably takes some time. Either the application team doesn’t know what exactly needs to be changed, or the network team is too busy, or both. Clearly, there’s a problem. And more often than not, this discussion becomes all about the forwarding architecture.
Oh yes, with old-school ACLs we could only match on a few things - IP subnets, TCP ports, that's about it. But now with OpenFlow - we can match on **EtherType**!! We're saved!!
Don’t be misled - the value of an SDN architecture does not lie in the fact that we can do Continue reading
SDN: Integration over Manipulation
I’d like to briefly express a sentiment that I pondered after listening to another one of Ivan’s great podcasts, specifically regarding the true value of a software-defined network approach. The statement was made that ACLs are terrible representations of business policy. This is not inaccurate, but the fact remains that ACLs are currently the de facto representation of business policy on a network device. The “network team” gets a request from an application team to “fix the firewall”, and the policy that is applied to enable that application typically results in an ACL change.
If you’ve ever been in this situation, you likely realize this entire process probably takes some time. Either the application team doesn’t know what exactly needs to be changed, or the network team is too busy, or both. Clearly, there’s a problem. And more often than not, this discussion becomes all about the forwarding architecture.
Oh yes, with old-school ACLs we could only match on a few things – IP subnets, TCP ports, that’s about it. But now with OpenFlow – we can match on EtherType!! We’re saved!!
Don’t be misled – the value of an SDN architecture does not lie in the fact that we can do Continue reading