<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: issues]]></title>
    <link>http://securityratty.com/tag/issues</link>
    <description></description>
    <pubDate>Tue, 02 Sep 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Internet Exterior Routing Protocol Development: Problems, Issues, and Misconceptions (1997)]]></title>
      <link>http://securityratty.com/article/c6e367b56611f8f9c5c22be1d1dd9457</link>
      <guid>http://securityratty.com/article/c6e367b56611f8f9c5c22be1d1dd9457</guid>
      <description><![CDATA[In a follow up to a couple of recent posts on routing and why routing is not really CEP, kindly findmy1997 IEEEpaper, for historical reference and a bit of background information, on global Internet...]]></description>
      <content:encoded><![CDATA[<p style="text-align: left;">In a follow up to a couple of recent posts on routing and why routing is not really CEP, kindly find my 1997 IEEE paper, for historical reference and a bit of background information, on global Internet routing:</p>
<p style="text-align: center;"><a href="http://www.thecepblog.com/pdf/ieee-network-routing-bass.pdf" target="_blank"><img class="aligncenter" src="http://www.thecepblog.com/imgs/bass.ieee.network.1997.jpg" alt="" width="409" height="527" /></a></p>
]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 11:46:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/kindly findmy1997 ieeepaper">kindly findmy1997 ieeepaper</category>
      <category domain="http://securityratty.com/tag/global internet">global internet</category>
      <category domain="http://securityratty.com/tag/historical reference">historical reference</category>
      <category domain="http://securityratty.com/tag/recent posts">recent posts</category>
      <category domain="http://securityratty.com/tag/background information">background information</category>
      <category domain="http://securityratty.com/tag/couple">couple</category>
      <category domain="http://securityratty.com/tag/follow">follow</category>
      <category domain="http://securityratty.com/tag/bit">bit</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <source url="http://www.thecepblog.com/2008/09/05/internet-exterior-routing-protocol-development-problems-issues-and-misconceptions-1999/">Internet Exterior Routing Protocol Development: Problems, Issues, and Misconceptions (1997)</source>
    </item>
    <item>
      <title><![CDATA[Premature Update on Philadelphia Wi-Fi]]></title>
      <link>http://securityratty.com/article/95922e41bb691a60a525baab81a41942</link>
      <guid>http://securityratty.com/article/95922e41bb691a60a525baab81a41942</guid>
      <description><![CDATA[I'm not sure why this article was written, as there appears to be nothing particularly newsworthy in it: The News.com reporter Marguerite Reardon has covered muni-Fi for as long as I have, and after...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://news.cnet.com/8301-1035_3-10033386-94.html"><strong>I'm not sure why this article was written, as there appears to be nothing particularly newsworthy in it:</strong></a> The News.com reporter Marguerite Reardon has covered muni-Fi for as long as I have, and after reading this in-depth piece, I'm left wondering whether it was assigned far too early, and she was meeting an editorial desk requirement instead of feeling like the story was ready to "print." The article looks at Network Acquisition Corp. (NAC), the allegedly interim name for the group that's taken over Phila-Fi. </p>

<p>One source at the Knight Center for Digital Excellence notes, "The new network owners are supposed to have a much more sustainable business model." <em>Supposed to.</em> Later, "Network Acquisition Company, which acquired the network, hasn't talked publicly about the details of its new plan, but it has hinted that its strategy will differ from EarthLink's." <em>Hasn't talked publicly.</em> Then, "[NAC and Tropos] spokespeople said the companies would talk more about the network later this month when details of the new business plan are ready." Huh.</p>

<p>Reardon explains digital divide issues and looks into what Wireless Philadelphia has been up to, although doesn't note that delays in EarthLink's deployment and other factors have led to just a few hundred individuals that have been assisted by the non-profit; numbers may have changed, but that was as of a few months ago. Still, Wireless Philadelphia has apparently diversified its funding sources--Reardon cites 30 now.</p>

<p>I think we're still coming off the doldrums of August.</p>]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 09:23:51 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network acquisition company">network acquisition company</category>
      <category domain="http://securityratty.com/tag/network acquisition corp">network acquisition corp</category>
      <category domain="http://securityratty.com/tag/network owners">network owners</category>
      <category domain="http://securityratty.com/tag/wireless philadelphia">wireless philadelphia</category>
      <category domain="http://securityratty.com/tag/sustainable business model">sustainable business model</category>
      <category domain="http://securityratty.com/tag/editorial desk requirement">editorial desk requirement</category>
      <category domain="http://securityratty.com/tag/plan">plan</category>
      <category domain="http://securityratty.com/tag/digital excellence notes">digital excellence notes</category>
      <source url="http://wifinetnews.com/archives/008431.html">Premature Update on Philadelphia Wi-Fi</source>
    </item>
    <item>
      <title><![CDATA[Libertarian Barr, EPIC outline privacy agenda]]></title>
      <link>http://securityratty.com/article/a4be2be7aa27c2a5a56dfe3c16bbcb52</link>
      <guid>http://securityratty.com/article/a4be2be7aa27c2a5a56dfe3c16bbcb52</guid>
      <description><![CDATA[The Democratic and Republican candidates for U.S. president aren't giving enough emphasis to privacy and civil rights issues, the Electronic Privacy Information Center (EPIC) and Bob Barr, the...]]></description>
      <content:encoded><![CDATA[The Democratic and Republican candidates for U.S. president aren't giving enough emphasis to privacy and civil rights issues, the Electronic Privacy Information Center (EPIC) and Bob Barr, the Libertarian candidate for president, said Friday.]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/civil rights issues">civil rights issues</category>
      <category domain="http://securityratty.com/tag/epic">epic</category>
      <category domain="http://securityratty.com/tag/libertarian">libertarian</category>
      <category domain="http://securityratty.com/tag/president">president</category>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/bob barr">bob barr</category>
      <category domain="http://securityratty.com/tag/democratic">democratic</category>
      <category domain="http://securityratty.com/tag/friday">friday</category>
      <category domain="http://securityratty.com/tag/emphasis">emphasis</category>
      <source url="http://www.networkworld.com/news/2008/090508-libertarian-barr-epic-outline-privacy.html?fsrc=rss-security">Libertarian Barr, EPIC outline privacy agenda</source>
    </item>
    <item>
      <title><![CDATA[Business In Thailand - Part 1: The Challenge]]></title>
      <link>http://securityratty.com/article/ea0ac16a8a09729fec092a6a2c0a7e21</link>
      <guid>http://securityratty.com/article/ea0ac16a8a09729fec092a6a2c0a7e21</guid>
      <description><![CDATA[Recently someone asked about business in Thailand.Here is my first post on this topic
First of all, I learned the Thai alphabet nearly 20 years ago, so I have have a pretty good foundation for the...]]></description>
      <content:encoded><![CDATA[<p>Recently someone asked about business in Thailand.  Here is my first post on this topic:</p>
<p>First of all, I learned the Thai alphabet nearly 20 years ago, so I have have a pretty good foundation for the Thai language.   I can read (slowly) and speak better than 99.99+ percent of all foreigners in Thailand; so, I thought it was time to redirect my career to a &#8220;new challenge&#8221; in the business climate of Thailand.   </p>
<p>This was no small decision.  Your career changes dramatically when you give up a successful consulting practice in the US and dive into business in a foreign land for a new challenge.  I can frankly tell you that often the challenge is sometimes overwhelming.    It is quite difficult as a foreigner to do business in Thailand.</p>
<p>First of all, it is not legal for foreigners to own land in Thailand.  Foreigners can &#8221;own&#8221; land using a variety of legal loopholes, proxy owners and shell companies; but all of this is risky and not advised.  Foreigners lose a lot of money coming to Thailand and attempting to buy land.  Some get lucky, but the entire process of foreigners buying and selling land is quite risky.</p>
<p>Foreigners can own condos, under certain conditions, but this results in  inflated prices for condos in Thailand that are traded in an artificial market place.   Condos that are up-to-par with condos in the US can easily cost more than condos in major cities in the US.  Hence, the cost of living is not as cheap as some might believe.</p>
<p>Business can best be described as &#8220;protectism&#8221; where the government has placed many barriers to entry to foreigners working in Thailand.     Every foreigner must have a work permit and these work permits are expensive and time consuming to maintain.   If you own a business you must pay high professional service fees for auditors to perform annual and semiannual audits even if your business has no income yet.   Firms in Thailand charge thousands of dollars for these &#8221;audits&#8221;.      </p>
<p>In addition, if you operate a business, you must have a place of business, so you are forced to lease office space.   Foreigners from the US must be paid a minimum of 50,000 Thai Baht per month, so the government will take 10 percent of that each month as their share of tax withholdings.   Therefore, to start a company, you will pay a lot of money in startup fees, permits, tax, leases, visas, etc.  The entire system is designed to secure money from you, even if you do not have a penny of incoming revenue.</p>
<p>Of course, generating incoming revenue can be quite difficult in a climate of protectionism.   In Thailand, it is easy when you are spending money.  When you are trying to generate income from Thailand, as a foreigner the challenge can seem overwhelming at times.   Many foreigners here give up because the barriers to business here are very high.</p>
<p>On top of all these challenges, which I have not described in detail, is the overall global business slowdown combined with a climate of political instability, which I am sure you have seen in the news.  </p>
<p>Most people I know say it is better to be a tourist here.   Being a tourist is completely different.  Money flows from you, so life in Thailand is fun and friendly, complimentary to the &#8220;Land of Smiles&#8221; you have heard about.     However, when you are working to have money flow the other direction, flow to you versus away from you, you don&#8217;t see the &#8220;Land of Smiles&#8221; as tourists experience.</p>
<p>Without getting into too many details, I can simply say that a foreigner doing business in Thailand experiences protectionism and, to a certain degree, discrimination, and sometimes I wonder if coming here for a &#8220;business challenge&#8221; was a good idea.    I was seeking a &#8220;new challenge&#8221; and I got more than I bargained for!</p>
<p>In a future post on business in Thailand I will discuss issues regarding how little value is placed in intellectual property in Thailand and how this adversely impacts professional services.    I will also touch on how this lack of regard for intellectual property impacts a consulting practice.   Also, I will touch on some cultural differences in how Thais appear to view teamwork, which is very different than in the US.</p>
<p> </p>
]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 10:16:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/challenge">challenge</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/thailand">thailand</category>
      <category domain="http://securityratty.com/tag/business challenge">business challenge</category>
      <category domain="http://securityratty.com/tag/global business slowdown">global business slowdown</category>
      <category domain="http://securityratty.com/tag/thailand chargethousands">thailand chargethousands</category>
      <category domain="http://securityratty.com/tag/foreigners">foreigners</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/money flows">money flows</category>
      <source url="http://www.thecepblog.com/2008/09/04/business-in-thailand-part-1-the-challenge/">Business In Thailand - Part 1: The Challenge</source>
    </item>
    <item>
      <title><![CDATA[Cryptosmith Blog]]></title>
      <link>http://securityratty.com/article/28ab882455f08fd37cc1fc0ba1780433</link>
      <guid>http://securityratty.com/article/28ab882455f08fd37cc1fc0ba1780433</guid>
      <description><![CDATA[Rick Smith has a blog called Cryptosmith . Rick has written extensively on authentication, crypto, and other pressing issues. A couple of his posts to point out

Models for Today's Security

The...]]></description>
      <content:encoded><![CDATA[<p>Rick Smith has a blog called <a href="http://www.cryptosmith.com/">Cryptosmith</a>. Rick has written extensively on authentication, crypto, and other pressing issues. A couple of his posts to point out</p><br /><div><a href="http://www.cryptosmith.com/archives/266">Models for Today&#39;s Security</a></div><br /><div><a href="http://www.cryptosmith.com/password-sanity">The Center for Password Sanity</a></div>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 07:43:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rick smith">rick smith</category>
      <category domain="http://securityratty.com/tag/rick">rick</category>
      <category domain="http://securityratty.com/tag/password sanity">password sanity</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <category domain="http://securityratty.com/tag/cryptosmith">cryptosmith</category>
      <category domain="http://securityratty.com/tag/models">models</category>
      <category domain="http://securityratty.com/tag/issues">issues</category>
      <category domain="http://securityratty.com/tag/authentication">authentication</category>
      <category domain="http://securityratty.com/tag/center">center</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/cryptosmith-blog.html">Cryptosmith Blog</source>
    </item>
    <item>
      <title><![CDATA[More on Why Routing is Not Complex Event Processing]]></title>
      <link>http://securityratty.com/article/b2a2132904db8b6f400e9dc6e9ba65b1</link>
      <guid>http://securityratty.com/article/b2a2132904db8b6f400e9dc6e9ba65b1</guid>
      <description><![CDATA[Interestingly, CEP is Not BPM, BAM, BRE, BRMS or SOA stimulated many great comments andthe rebuttal Smart Order Routing and CEP - Made for Each Other . James Taylor responded with Business rules,...]]></description>
      <content:encoded><![CDATA[<p>Interestingly, <a href="http://www.thecepblog.com/2008/08/27/cep-is-not-bpm-bam-bpm-brms-or-soa/">CEP is Not BPM, BAM, BRE, BRMS or SOA</a> stimulated many great comments and the rebuttal <a href="http://streambase.typepad.com/streambase_stream_process/2008/09/smart-order-routing-and-cep.html">Smart Order Routing and CEP - Made for Each Other</a>.  James Taylor responded with <a href="http://www.ebizq.net/blogs/decision_management/2008/08/business_rules_decisions_and_e.php">Business rules, decisions and events</a>.   I followed up with <a href="http://www.thecepblog.com/2008/09/03/cep-is-not-low-latency-messaging-eai-or-esb/">CEP is Not Low Latency Messaging, EAI or ESB</a> and James replied in turn with <a href="http://www.ebizq.net/blogs/decision_management/2008/09/still_more_on_event_processing.php" target="_blank">Still More on Event Processing</a>.  It&#8217;s great to see the blogosphere doing so well.  Continuing, I would like to discuss smart order routing (SOR) a bit more and why routing is not CEP.</p>
<p>First of all, let&#8217;s ground the discussion a bit by translating &#8220;smart order routing&#8221; to &#8220;rule-based message routing&#8221; since in this application &#8220;smart&#8221;  translates to &#8220;using rules&#8221; and &#8220;order&#8221; translates to &#8220;message&#8221;.    Basically, Mark (and other &#8220;new on the routing scene&#8221; stream processing players) argue that rule-based message routing is CEP.  I will argue that routing is not even close to CEP.  Here is why,</p>
<p>Let&#8217;s take a look at a router on the backbone of the global Internet.   A backbone router has very sophisticated software developed over many decades.   These routers run sophisticated, mature algorithms to determine how to route messages (packets) and use these algorithms to build complex routing tables. </p>
<p>In addition, these routers process messages (packets) from countless sources and route messages (packets) to countless destinations.  Using some of the terms in early posts (above), there is a great &#8220;confluence of events&#8221; processed by routers.    Futhermore, there are normally quite complex authentication, authorization and other security parameters managed in a router, all in real time.   Routers do much more, but I don&#8217;t want to get too deep into routing in this post.</p>
<p>My point is that, without any doubt, global Internet routers process very &#8220;cloudy&#8221; &#8220;confluence of events&#8221; with much more sophistication than order routing applications.    However, we do not call Internet routing &#8220;CEP&#8221;, regardless of how many connections are processed or how much sophisticated processing occurs.  The reason is because the &#8220;C&#8221; in &#8220;CEP&#8221; defines a complexity that is at a higher abstraction than messaging and routing.</p>
<p>If you study the literature on CEP, some of which I posted recently, CEP was envisioned to solve complex event processing problems &#8220;on top of the routing layer&#8221; because the routing layer is a mature technology layer.  We can route, pure and simple.  Of course, we are always seeking faster, more scaleable and more secure routing. </p>
<p>I admire some of the startups in the CEP/ESP/EP space for working hard to make money and for aggressively positioning their products and attempting to build market share.   However, issues surface when these same companies seem to believe they are the first companies to work in the event processing or message routing space and that they can define whatever they want as &#8220;complex event processing&#8221; as long as it benefits their sales targets.</p>
<p>There is no doubt that a router does much more sophisticated event processing than the new rule-based stream processing systems running continuous queries across streaming data.  There is no doubt that a router processes a complex &#8220;confluence of events&#8221;.   However, we don&#8217;t call routers &#8220;CEP&#8221;. </p>
<p>We do not call routers &#8220;CEP&#8221; because CEP is about a higher level of knowledge processing.  CEP was created to detect the &#8220;complex events&#8221; that happen above the mediation and routing layer.     The literature and original examples on CEP are quite clear on this.</p>
<p> </p>
]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 05:38:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/solve complex event">solve complex event</category>
      <category domain="http://securityratty.com/tag/upwith cep">upwith cep</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/cep defines">cep defines</category>
      <category domain="http://securityratty.com/tag/call routers cep">call routers cep</category>
      <category domain="http://securityratty.com/tag/call">call</category>
      <source url="http://www.thecepblog.com/2008/09/04/more-on-why-routing-is-not-complex-event-processing/">More on Why Routing is Not Complex Event Processing</source>
    </item>
    <item>
      <title><![CDATA[Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk]]></title>
      <link>http://securityratty.com/article/ceff3c168541790ec71113285297b6e6</link>
      <guid>http://securityratty.com/article/ceff3c168541790ec71113285297b6e6</guid>
      <description><![CDATA[Synopsis: Blue Box Special Edition #26: Astricon 2007 presentation - &quot;Hacking and Attacking VoIP Systems: What you need to worry about
Welcome to Blue Box: The VoIP Security Podcast Special Edition...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Synopsis:</strong>&nbsp; Blue Box Special Edition #26: Astricon 2007 presentation - &quot;Hacking and Attacking VoIP Systems: What you need to worry about&quot;</p><hr /><p>Welcome to <strong>Blue Box: The VoIP Security Podcast</strong> Special Edition #26, a 55-minute podcast&nbsp; from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.&nbsp; &nbsp; </p>

<p><a href="http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3" rel="enclosure">Download the show here</a> (MP3, 6MB) or <a href="http://feeds.feedburner.com/BlueBox">subscribe to the RSS feed</a> to download the show automatically.&nbsp; </p>

<p>You may also listen to this podcast right now:</p> 

<p><object width="200" height="20" type="application/x-shockwave-flash" data="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3"><param name="movie" value="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3&amp;bgcolor=#FFFFFF" /></object> </p> 

<p><strong>Show Content:</strong></p> 
<p>A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about &quot;Hacking and Attacking VoIP Systems: What You Need To Worry About&quot; My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk.&nbsp; Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (<a href="http://www.astricon.net/">Astricon</a>, for those who don't know, is an annual developer conference for those who work with the <a href="http://www.asterisk.org/">Asterisk open source telephony platform</a>. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)
</p>

<p>The slides for this talk <a href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know/">are available from Slideshare</a>:
</p>



<div id="__ss_178451" style="width: 425px; text-align: left;"><a title="Hacking and Attacking VoIP Systems - What You Need To Know" href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know?src=embed" style="margin: 12px 0pt 3px; font-family: Helvetica,Arial,Sans-serif; font-style: normal; font-variant: normal; font-weight: normal; font-size: 14px; line-height: normal; font-size-adjust: none; font-stretch: normal; -x-system-font: none; display: block; text-decoration: underline;">Hacking and Attacking VoIP Systems - What You Need To Know</a><object width="425" height="355" style="margin: 0px;"><param value="http://static.slideshare.net/swf/ssplayer2.swf?doc=hacking-and-attacking-voip-systems-what-you-need-to-know-119595215763603-5&amp;stripped_title=hacking-and-attacking-voip-systems-what-you-need-to-know" name="movie" /><param value="true" name="allowFullScreen" /><param value="always" name="allowScriptAccess" /><embed width="425" height="355" allowfullscreen="true" allowscriptaccess="always" type="application/x-shockwave-flash" src="http://static.slideshare.net/swf/ssplayer2.swf?doc=hacking-and-attacking-voip-systems-what-you-need-to-know-119595215763603-5&amp;stripped_title=hacking-and-attacking-voip-systems-what-you-need-to-know"></embed></object><div style="font-size: 11px; font-family: tahoma,arial; height: 26px; padding-top: 2px;">View SlideShare <a title="View Hacking and Attacking VoIP Systems - What You Need To Know on SlideShare" href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know?src=embed" style="text-decoration: underline;">presentation</a> or <a href="http://www.slideshare.net/upload?src=embed" style="text-decoration: underline;">Upload</a> your own. (tags: <a href="http://slideshare.net/tag/voip" style="text-decoration: underline;">voip</a> <a href="http://slideshare.net/tag/voipsecurity" style="text-decoration: underline;">voipsecurity</a>)</div></div>
<p><em>(And yes, at some point I'll sync the audio with the slides.)</em>
</p>

<p>Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him!&nbsp; Kudos to Michael for getting it to sound as good as it does.

</p>

<p>Comments, suggestions and feedback are welcome either as replies to this post&nbsp; or via e-mail to <a href="mailto:blueboxpodcast@gmail.com">blueboxpodcast@gmail.com</a>.&nbsp; Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.&nbsp; You may also call the listener comment line at either +1-415-830-5439 or via SIP to '<a href="sip:bluebox@voipuser.org">bluebox@voipuser.org</a>' to leave a comment there.&nbsp; </p> <p>Thank you for listening and please do let us know what you think of the show. </p></div>
]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 15:54:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/astricon">astricon</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/slideshare">slideshare</category>
      <category domain="http://securityratty.com/tag/voip systems">voip systems</category>
      <category domain="http://securityratty.com/tag/audio comments">audio comments</category>
      <category domain="http://securityratty.com/tag/audio">audio</category>
      <category domain="http://securityratty.com/tag/specific security issues">specific security issues</category>
      <category domain="http://securityratty.com/tag/listener comment line">listener comment line</category>
      <source url="http://www.blueboxpodcast.com/2008/09/blue-box-se026.html">Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk</source>
    </item>
    <item>
      <title><![CDATA[Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk]]></title>
      <link>http://securityratty.com/article/f2bb50144dae112aaea9593bf1748c51</link>
      <guid>http://securityratty.com/article/f2bb50144dae112aaea9593bf1748c51</guid>
      <description><![CDATA[Synopsis: Blue Box Special Edition #26: Astricon 2007 presentation - &quot;Hacking and Attacking VoIP Systems: What you need to worry about
Welcome to Blue Box: The VoIP Security Podcast Special Edition...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Synopsis:</strong>&nbsp; Blue Box Special Edition #26: Astricon 2007 presentation - &quot;Hacking and Attacking VoIP Systems: What you need to worry about&quot;</p><hr /><p>Welcome to <strong>Blue Box: The VoIP Security Podcast</strong> Special Edition #26, a 55-minute podcast&nbsp; from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.&nbsp; &nbsp; </p>

<p><a href="http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3" rel="enclosure">Download the show here</a> (MP3, 6MB) or <a href="http://feeds.feedburner.com/BlueBox">subscribe to the RSS feed</a> to download the show automatically.&nbsp; </p>

<p>You may also listen to this podcast right now:</p> 

<p><object width="200" height="20" type="application/x-shockwave-flash" data="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3"><param name="movie" value="http://www.blueboxpodcast.com/dewplayer.swf?son=http://media.libsyn.com/media/lodestar/BBP-SE026-Astricon2007-VoIPSecurity.mp3&amp;bgcolor=#FFFFFF" /></object> </p> 

<p><strong>Show Content:</strong></p> 
<p>A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about &quot;Hacking and Attacking VoIP Systems: What You Need To Worry About&quot; My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk.&nbsp; Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (<a href="http://www.astricon.net/">Astricon</a>, for those who don't know, is an annual developer conference for those who work with the <a href="http://www.asterisk.org/">Asterisk open source telephony platform</a>. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)
</p>

<p>The slides for this talk <a href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know/">are available from Slideshare</a>:
</p>



<div id="__ss_178451" style="width: 425px; text-align: left;"><a title="Hacking and Attacking VoIP Systems - What You Need To Know" href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know?src=embed" style="margin: 12px 0pt 3px; font-family: Helvetica,Arial,Sans-serif; font-style: normal; font-variant: normal; font-weight: normal; font-size: 14px; line-height: normal; font-size-adjust: none; font-stretch: normal; -x-system-font: none; display: block; text-decoration: underline;">Hacking and Attacking VoIP Systems - What You Need To Know</a><object width="425" height="355" style="margin: 0px;"><param value="http://static.slideshare.net/swf/ssplayer2.swf?doc=hacking-and-attacking-voip-systems-what-you-need-to-know-119595215763603-5&amp;stripped_title=hacking-and-attacking-voip-systems-what-you-need-to-know" name="movie" /><param value="true" name="allowFullScreen" /><param value="always" name="allowScriptAccess" /><embed width="425" height="355" allowfullscreen="true" allowscriptaccess="always" type="application/x-shockwave-flash" src="http://static.slideshare.net/swf/ssplayer2.swf?doc=hacking-and-attacking-voip-systems-what-you-need-to-know-119595215763603-5&amp;stripped_title=hacking-and-attacking-voip-systems-what-you-need-to-know"></embed></object><div style="font-size: 11px; font-family: tahoma,arial; height: 26px; padding-top: 2px;">View SlideShare <a title="View Hacking and Attacking VoIP Systems - What You Need To Know on SlideShare" href="http://www.slideshare.net/danyork/hacking-and-attacking-voip-systems-what-you-need-to-know?src=embed" style="text-decoration: underline;">presentation</a> or <a href="http://www.slideshare.net/upload?src=embed" style="text-decoration: underline;">Upload</a> your own. (tags: <a href="http://slideshare.net/tag/voip" style="text-decoration: underline;">voip</a> <a href="http://slideshare.net/tag/voipsecurity" style="text-decoration: underline;">voipsecurity</a>)</div></div>
<p><em>(And yes, at some point I'll sync the audio with the slides.)</em>
</p>

<p>Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him!&nbsp; Kudos to Michael for getting it to sound as good as it does.

</p>

<p>Comments, suggestions and feedback are welcome either as replies to this post&nbsp; or via e-mail to <a href="mailto:blueboxpodcast@gmail.com">blueboxpodcast@gmail.com</a>.&nbsp; Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.&nbsp; You may also call the listener comment line at either +1-415-830-5439 or via SIP to '<a href="sip:bluebox@voipuser.org">bluebox@voipuser.org</a>' to leave a comment there.&nbsp; </p> <p>Thank you for listening and please do let us know what you think of the show. </p></div>

<p><a href="http://feeds.feedburner.com/~a/BlueBox?a=ro8CGS"><img src="http://feeds.feedburner.com/~a/BlueBox?i=ro8CGS" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/BlueBox?a=lF8MaL"><img src="http://feeds.feedburner.com/~f/BlueBox?i=lF8MaL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BlueBox?a=d2zQmL"><img src="http://feeds.feedburner.com/~f/BlueBox?i=d2zQmL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BlueBox?a=h8U0ZL"><img src="http://feeds.feedburner.com/~f/BlueBox?i=h8U0ZL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BlueBox?a=8B82bL"><img src="http://feeds.feedburner.com/~f/BlueBox?i=8B82bL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BlueBox?a=keFvsl"><img src="http://feeds.feedburner.com/~f/BlueBox?i=keFvsl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BlueBox?a=WSWkOL"><img src="http://feeds.feedburner.com/~f/BlueBox?i=WSWkOL" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/BlueBox/~4/382765294" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 14:54:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/astricon">astricon</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/slideshare">slideshare</category>
      <category domain="http://securityratty.com/tag/voip systems">voip systems</category>
      <category domain="http://securityratty.com/tag/audio comments">audio comments</category>
      <category domain="http://securityratty.com/tag/audio">audio</category>
      <category domain="http://securityratty.com/tag/specific security issues">specific security issues</category>
      <category domain="http://securityratty.com/tag/listener comment line">listener comment line</category>
      <source url="http://feeds.feedburner.com/~r/BlueBox/~3/382765294/blue-box-se026.html">Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk</source>
    </item>
    <item>
      <title><![CDATA[Is an incorrectly implemented security program better than a non-existent one ?]]></title>
      <link>http://securityratty.com/article/5893399324f415d7cb19e54c1340401b</link>
      <guid>http://securityratty.com/article/5893399324f415d7cb19e54c1340401b</guid>
      <description><![CDATA[Think carefully before you answer that one. A large majority of you would be inclined to give a resounding 'yes' - but I really want you to think carefully on this one. Think long term. Think about...]]></description>
      <content:encoded><![CDATA[Think carefully before you answer that one. A large majority of you would be inclined to give a resounding 'yes' - but I really want you to think <em>carefully </em>on this one. Think long term. Think about implementation hurdles, think about project documentation.<br /><br />The answer to this IMHO is a big "DEPENDS". <br /><br />To explain:<br /><br />Imagine you're working in a company that has no security controls in place - and is in desperate need of getting a security program impemented. They hire a new CISO to make sure their physical and logical controls are in place, network and applications are secured appropriately and their incident management and forensics capabilities are upto date. At this point the CISO clearly  knows that he needs to create and implement a number of programs and hires a bunch of people to perform and manage a series of tasks. Till this point, things are going smoothly. Everyone understands the need, and is working towards meeting a common goal. The program is not in place yet, but people know and understand the urgency need to act immediately. The CISO's risk radar has a list of projects ranked by priority and everone begins to tackle them. <br /><br />Now consider the scenario when certain security programs are not done right - say, a few of the high risk  applications are not considered in the initial risk matrix or there are certain business units that have been granted an 'exception'to the process that is being put in place, with the most common excuses of:<br /><br />1. This is a pilot<br />2. We will get to this in the next phase<br />3. The group has a number of high profile clients who don't want it implemented right now<br />4. &ltplug your own excuse here&gt<br /><br />Well - initially, everyone is completely aware that they have more issues to remediate and and have honest intentions to fix that too, once the pilot and<br />PoC is well established and in place. But then things change. Leaders change. Managers change. People's roles change. What doesn't, is the documentation regarding the project. But documents usually tend to highlight what the project <em>does</em>, not what it <em>doesn't do</em>. Nobody seems to remember there are additional tasks that need to get completed. People take a quick look at documents detailing what was done in the program and begin to assume that it is well established, completely ignoring the fact that a very important Phase 2 still needs to be in place. A false sense of security is now well in place... and life goes on. <br /><br />Till you get hacked. <br /><br />..and then a forensics team attempts to determine the cause. A new CISO comes in, reviews the existing program, decides it is too complex and structureless and decides to do away with it entirely and create a new security program.. and the cycle continues.<br /><br />The moral of the story: When you have no security program - be very careful while diligently working to get one in place<br /><br />But when you have a partial one, be extremely careful and don't leave any loose ends while getting it completely and correctly put in place.<br /><br /><br />On a lighter note - here's an email I received from a school I was doing some courses from ..<br /><a href="http://4.bp.blogspot.com/_XTqu2iQGpYM/SL8CCfFxwwI/AAAAAAAAAq8/dQfN6tdLU-M/s1600-h/blog1.JPG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;" src="http://4.bp.blogspot.com/_XTqu2iQGpYM/SL8CCfFxwwI/AAAAAAAAAq8/dQfN6tdLU-M/s400/blog1.JPG" border="0" alt=""id="BLOGGER_PHOTO_ID_5241910733011272450" /></a><br />Beautiful !! Here is your PIN (username). But we will not give you your password over email. I was sooo impressed when I got that! - Could it be that schools and universities are finally waking up and trying to understand security ? No more SSNs as IDs ? No more default 'password' passwords ?  This was great. I followed the procedure outlined to receive a new password - it asked for my name, DOB and email.. and then .. I receive this:<br /><br /><a href="http://2.bp.blogspot.com/_XTqu2iQGpYM/SL7-9CTJaKI/AAAAAAAAAq0/ZY9Q0SqaxkU/s1600-h/blog2.JPG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;" src="http://2.bp.blogspot.com/_XTqu2iQGpYM/SL7-9CTJaKI/AAAAAAAAAq0/ZY9Q0SqaxkU/s400/blog2.JPG" border="0" alt=""id="BLOGGER_PHOTO_ID_5241907340848490658" /></a><br /><br /><br />For those who cannot see the image:<br /><br /><br />the email says:<br /><br />blah blah blah blah blah blah..<br />your PIN: <my PIN><br />your password: password1234<br /><br />blah blah blah blah blah blah]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 12:02:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security program">security program</category>
      <category domain="http://securityratty.com/tag/program">program</category>
      <category domain="http://securityratty.com/tag/security controls">security controls</category>
      <category domain="http://securityratty.com/tag/change">change</category>
      <category domain="http://securityratty.com/tag/leaders change">leaders change</category>
      <category domain="http://securityratty.com/tag/programs">programs</category>
      <category domain="http://securityratty.com/tag/security programs">security programs</category>
      <category domain="http://securityratty.com/tag/roles change">roles change</category>
      <source url="http://securitycoin.blogspot.com/2008/09/is-incorrectly-implemented-security.html">Is an incorrectly implemented security program better than a non-existent one ?</source>
    </item>
    <item>
      <title><![CDATA[Early security issues tarnish Google's Chrome]]></title>
      <link>http://securityratty.com/article/166e66e7741fa7e8bd10cfb10008983e</link>
      <guid>http://securityratty.com/article/166e66e7741fa7e8bd10cfb10008983e</guid>
      <description><![CDATA[Security researchers have reported finding vulnerabilities in Google's new Web browser a day after it was released in...]]></description>
      <content:encoded><![CDATA[Security researchers have reported finding vulnerabilities in Google's new Web browser a day after it was released in beta.]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/web browser">web browser</category>
      <category domain="http://securityratty.com/tag/security researchers">security researchers</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <category domain="http://securityratty.com/tag/beta">beta</category>
      <category domain="http://securityratty.com/tag/day">day</category>
      <source url="http://www.networkworld.com/news/2008/090308-early-security-issues-tarnish-googles.html?fsrc=rss-security">Early security issues tarnish Google's Chrome</source>
    </item>
  </channel>
</rss>
