Posts by Phil Koenig

Hacking internet backbones - it's easier than you think

@jake - re: access to hardware

Part 1:

Both BGP and MPLS messages are transmitted over the same public network backbone that internet packets are. Ergo: forge those control messages=control IP routing.

BGP is more exposed because it runs over TCP, while MPLS is reputedly a "layer 2.5" protocol. However, if you are able to tap into the fiber, you essentially have access down to the physical (layer 1) layer.

Here in Silly Valley, we were reminded a few days ago about just how exposed a carrier's infrastructure often is when someone severed 2 separate fiber rings in the San Jose area (one ATT, one Sprint), bringing down all sorts of communications for about 12 hours.

Part2:

After reading one of the referenced papers, 2 points stand out. A) They are discussing MPLS *VPNs* - which actually are running over layer 3. This implies that *physical* network access is not required, only access to the data stream. (various ways of achieving that)

B) The authors state certain background assumptions, including "Assumes attacker has access to traffic path (in core)". I note that this does not necessarily imply "access to physical hardware", only access to the "traffic path". Once again, there are ways to achieve this that do not require access to a physical router/etc.

Note that many of the vulnerabilities revolve around the use of MD5 for authentication (for BGP, over which some of these MPLS packets are traveling), which of course is now known to be crackable.

Verizon eyes future iPhones

You've got that bundling trend wrong

Actually the trend is AWAY from bundling hardware and services - Verizon announced this at least a year ago.

When everyone's network is running some variant of GSM or LTE, holding customers hostage on a network that is technically perfectly compatible with everyone else's is going to be a failed strategy - customers have wised-up to that game now.

Verizon is simply being pragmatic by moving to LTE - they are the last, largest CDMA carrier and the lack of device choice (HW vendors are loathe to commit resources to a technology that has ever-decreasing marketshare) has already had a substantial negative impact on Verizon. Best to just chin up, join the opposition and then tout your new-found religion of "open networks!!"...

Child porn suspect ordered to decrypt own hard drive

Miranda rights

I was under the impression that there had been a number of judicial setbacks to Miranda rights in recent years, although the SCOTUS did reaffirm Miranda in the Dickerson decision back in 2000.

Boeing chuffed with latest raygun-jumbo ground tests

747's are probably just the 1st gen test platform

...because 747's are plentiful and relatively cheap. I imagine that once the technology gets refined a bit, a more stealthy delivery vehicle will be used, along with (most likely) a more compact version of the machinery.

The Patriot missiles were a joke when they were initially deployed, but my understanding is that the current generation actually works fairly well.

FCC chief wants to throttle Comcast

Martin's faux "enforcement" is one-sided anyway

Martin's FCC never seems to find any time to tap the big telcos (ie ATT, Verizon) on the wrist in any way, but keeps finding excuses to go after the cable companies.

I'm no fan of Comcast by any means, but trying to assert that this sort of nonsense actually amounts to doing broadband users any real favors is laughable. The next lovely action by the FCC will be to give their blessing to the Sirius/XM merger, which is about as "pro-competitive" as pork fat is health-food.

Opera update fixes stability bugs

9.50 was rushed out, with some justification

I think 9.50 was rushed out at least partly because Opera wasn't too keen on Firefox stealing their thunder by once again stealing a feature Opera invented (address-bar history search), re-naming it, and in this case, potentially releasing it before the official Opera release.

The very short time between 9.50 and 9.51, along with the non-security-related bugfixes makes me think this. (FWIW, I've also noticed some deadlock issues with 9.5x, I hope they get fixed soon.)

I'm so tired of Firefox getting the credit for functionality that Opera invented (usually) years prior to it being appropriated by Firefox.

Lenovo throws arms and legs around SMBs

Lenovo's are better than I expected

I'm another old-time Thinkpad user and have recommend them to clients for years.

First of all, I doubt there's ever been a Thinkpad built outside Asia, at least for the last 10 years. Several years before Lenovo got involved, the top-of-the-range models were at least partly manufactured in Japan, but IBM was building most of them in China or Singapore long before Lenovo took over.

I'm not such a big fan of T60's either, but I think the T61 is decent. Early versions of the Windows software tools after the Lenovo transition could be a bit shaky as well, but a lot of that has been sorted out in recent versions. (ie System Update, Access Connections)

Free Wi-Fi still a goer in San Fran'

WiFi was never designed for this application

To be honest, I have never understood why people keep pushing to use WiFi for a task it was never designed for.

Re: the gentleman in the Mission District of SF who gets a flaky Meraki signal - I also live in SF, and these days in this part of the world, WiFi signals are everywhere. The last thing we need is yet another signal stomping on top of all the other AP's, that are already stomping on top of all the other AP's, that are...

There are 11 802.11b/g "channels" in the USA, of which only 3 are completely isolated from the rest, assuming no one uses any but those 3. (bad assumption)

Thus it's not uncommon to do a search and find literally 6-10 AP's all sitting on the same frequency, and upwards of 20-30 visible signals at a single location. In my apartment, I'm seriously considering switching to 802.11a, just to escape the 2.4Ghz RF ghetto..

World's first Blu-ray record pressing

Audiophilia

I'm actually one of those 'wackos' that feels that 44.1khz/16-bit digital is inadequate to provide the qualities I want in an audio recording. Given Britain's strong history of support for the audio industry, I would have expected more like-minded souls commenting here.

I'm a big fan of SACD, but with the rise of DVD and the iPod, the commercial prospects haven't been looking very good the last few years.

Which is why I had also been hoping that now that BD's become the new hi-def consumer video standard, Sony could do something with BluRay to revitalize the market for a next generation/hi-def audio format. It's just a pity to me that with all that storage/bandwidth available, the first independent effort squanders it by just putting a bunch of similiar copies on one disk.

Granted, there is no BD-approved way of encoding >192khz/24bit audio on BD, but why not make it part of the next revision of the BD standard? Goodness knows they've revised that standard enough times by now, and I doubt most TV-watchers will care that their £50 video player won't play 384khz/30-bit audio..

Web cam images undo MacBook thieves

Correction and why this is not so special

@Daniel B: RemoteDesktop terminates the current user session when it connects, so that is not going to help you much if you want to monitor someone else's session without them knowing.

The technology to accomplish this in a much more effective and automatic way than the way demonstrated with the Mac is not complex, it's just not commonly installed.

This will probably change pretty soon, for example what Lenovo is bundling with a lot of their new models:

http://static.tigerdirect.com/html/veriface.html

http://www.brightcove.tv/title.jsp?title=1445017879&channel=537061027

FCC chief claims power over network management

..and the telcos get a free pass

Kevin Martin's tenure at the FCC has been notable for giving the big telcos (like SBC/ATT and Verizon) almost anything they wanted, while taking regular jabs at the cable industry.

While it's true that Comcast got caught being surreptitious about "traffic management" that targeted BitTorrent in particular, the CEOs of SBC/ATT and Verizon made all sorts of public bluster about prioritizing internet traffic some time back and the FCC did little in response.

Yes, part of the FCC's approval of the SBC/ATT/Bellsouth merger was predicated on a limp-wristed agreement that for the next couple of years, "The New ATT" would have to play nice when it came to traffic prioritization, but there was nothing legislatively binding in that agreement and it was designed with a relatively short "sunset period".

More importantly, the sheer magnitude and audacity of the merger that gave rise to that "gentleman's agreement" was such a huge dream-come-true for Ed Whitacre and SBC (largely reconstituting a corporation that at the time that Judge Harold Greene finally succeeded in breaking up for antitrust violations in 1986 was the largest corporation in the world) that that pitiably toothless agreement was a trivial annoyance compared to the enormous market power that AT&T now wields. Worse, other regulatory giveaways (like giving exclusive control of new fiber infrastructure to the telcos in perpetuity) made up for these "phony concessions" many times over.

It would be nice if Kevin Martin spent a fraction of his PR bandwidth attending to the many market abuses of AT&T and its SBC progenitor (below-cost predatory practices for years in the ADSL market, for example) rather than acting like the only "evil doers" in the marketplace are in the cable industry.

Google cops to puppeting Great American Wireless Auction

ATT's 3G _is_ lagging

True, the iPhone does not have 3G data capability. (generally thought of, in GSM networks, to be HSDPA. The iPhone has EDGE instead.)

But I believe there were 2 primary reasons why this is. The "leaked" reason given by Apple and ATT is battery life. The equally (or more) important reason is most likely the simple fact that ATT HSDPA coverage is very spotty. This is an area where Verizon and Sprint have a big advantage over ATT right now in the USA - better 3G coverage. If the iPhone had HSDPA when it was released, Apple and ATT would have had a lot of unhappy customers who discovered that their spiffy new 3G capability wasn't available very many places.

Hopefully by the time they start marketing an HSDPA-capable iPhone, ATT will have made some progress in that area.

Lenovo intros skinny, low-weight ThinkPad

Spec comparison

I don't know what spec was read by the person who said the X300 weighs "significantly less than the Air", but according to Apple's website, the Macbook Air weighs 1.36 kg. ("Actual weight varies by configuration and manufacturing process")

Nonetheless, the X300 seems like a much more usable machine. Are we all aware that the Air has *no*ethernet*port*??? And a lot of other missing bits.

I will grant you, the Air is very pretty, but.. well, Paris H isn't too bad either if we limit ourselves to such parameters..

Sprint axes 4,000 jobs, closes 125 stores

Verizon is actually amazing right now

Among other carriers I've used, I gave up on Sprint years ago, and for the same reasons people seem to be complaining about them now - crappy customer service and poor signal penetration. They were also slapped with lawsuits over deceptive billing practices, etc. (I think I qualified for a 25 dollar "award" from one of the successful class-actions)

Anyway - Verizon service these days is amazing, I feel like I'm being treated like a king, to be honest. They're a little more expensive than the competition but given the infamously crappy service in the cellphone market I am more than willing to pay a couple bucks more a month to get reliable signal and good customer service.

Court junks $11m judgment against Spamhaus

@Morely Dotes, blacklists

Morely is very high profile in the "anti spammer" community, consider the source. (check usenet news.admin.net-abuse.email)

System administrators who block email from entire countries are living in a very small hermetically-sealed bubble. No legitimate ISP with a significant number of users can even dream of such nonsense.

Getting back to the real world, most ISPs and system admins that rely solely or primarily on blacklists for spam mitigation do so because it is SIMPLE and CHEAP. There are many highly accurate anti-spam systems out there, but they typically charge annual or monthly fees to use them. You get what you pay for.

That said, Spamhaus is indeed one of the most respectable of the "blacklist operators", and they make a point to target only the most well-known and egregious spammers, and focus on clearly documented spam sources.

Clearly the legal environment in the USA is weighted more towards the commercial interests than most places, which is why there was never a truly effective "anti-spam" legislation passed here - large corporations saw to that by lobbying against the most effective proposals. I haven't studied the e360 case myself, but wouldn't be surprised if it wouldn't have gained any traction anywhere else than the USA.

Novell won't pull a SCO

Microsoft and Unix Code

The code you're thinking of was actually BSD code, used in the IP stack.

That was for Windows 2000, and probably Windows 2000v2. (otherwise known as "Windows XP") I think Vista may have something different under the hood.

The BSD license is very well-loved by corporate organizations because they can use the code for pretty much anything they want, without having to contribute any of their changes back to anything. So it probably doesn't matter much that Windoze has BSD code in it, because the BSD crowd doesn't care about such things. (BSD was specifically created by University of California at Berkeley to get around AT&T Unix copyrights, so it is not legally encumbered in the way that "traditional" Unix variants are.)

Power outage knocks out major websites

365 Main does not use UPS's

365 Main does quite a bit of boasting on their website about their fancy electrical infrastructure, including a 35kv feed and in fact, no UPS's.

What they use is a device from a company called "Hitec" which is essentially a mechanical stored-energy device that has giant flywheels that are supposed to store energy long enough to switch over to the generator.

I have a client about a mile away from 365 Main and I got my first page about a power interruption at 1:46PM PDT. But perhaps what screwed-up these guys is that there was a whole slew of short interruptions of 1-2 minutes each. Subsequent pages show timestamps of 14:06, 14:08, 14:16 and 14:21.

Given that the flywheel will only keep things going for something like 5-10 seconds, you don't get much of a second chance if the diesel doesn't start up after the 2nd try. And with 5 power interruptions, that's potentially 5 times you get to test that in a row.

365 Main boasting about their electrical infrastructure:

http://www.365main.com/365_main_tour_2.html

HiTec's website:

http://www.hitecusa.com/