[SecurityRatty] tag: jonathan

Q&A: Views on Privacy and Identity Theft

Tue, 12 Aug 2008 08:15:12 +0000

Jonathan Moneymaker is VP of Operations at Anonymizer. He is a certified Project Management Professional and also holds a BS in Systems Engineering from the University of Southern California. In th...

iPhone Feature Discovered By Hacker Allows Apple To Remotely Disable Unwanted Apps

Mon, 11 Aug 2008 10:55:39 +0000

According to iPhone hacker Jonathan Zdziarski, Apple has prepared a blacklisting system which allows the company to remotely disable applications on any iPhone device. Apparently, the new 2.x firmware contains a URL which points to a page containing a list of “unauthorized” apps, a move which suggests that the device makes occasional contact with Apple’s [...]

Data breaches: Technology, process or management?

Mon, 28 Jul 2008 12:32:00 +0000

Being part of a technology company, one tends to think of solutions to data breaches as mainly to be solved by technology. Well, with a bit of process thrown in for good measure as well! Did not think much about the important role of management till now...

Just came across an interesting opinion by Jonathan Armstrong, a partner at Eversheds, a law firm. He contends that current best practices of management do not train executives how to respond to crisis - he talks about various types and data breaches is one amongst them.

I tend to agree to a point. However, I also think that it is the type of management and their core values that dictate how such a crisis be addressed. Is management concerned about the customer? Or is management just looking to save face? I can remember the Tylenol crisis and how well J&J handled it.

While I agree with Jonathan that the frequency of incidents have gone up and management needs to be trained better, I also believe if executives have the best interests of their constituents in mind, things will work out okay...

Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Tue, 15 Jul 2008 13:20:45 +0000

Synopsis: Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on April 17, 2008.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!

MANY thanks for all the offers of audio production assistance – getting it organized now

Ingate SIP Trunking webinar now available (and a note about participating in things like this)

VOIPSA blog site hacked

Voice of VOIPSA: Quarterly VoIP Vulnerabilities Summary

VoIPshield list of vulnerabilities

Cisco Advisory

Cisco Advisory about Disaster Recovery Framework

Voice of VOIPSA: VoIPshield announces discovery of over 100 vulnerabilities along with a YouTube video

Washington Post: Reach Out And Hack Someone

Voice of VOIPSA: GNUcitizen research discovery: Default key algorithm in Thomson and BT Home Hub routers

VoIP News: The Essential Guide to VoIP Security

Information Week: Securing VoIP with SecureLogix – includes YouTube video with Mark Collier

Voice of VOIPSA: VoIP and the International Space Station

Voice of VOIPSA: Xplico Network Forensic Analysis Tool

Voice of VOIPSA: Australians falling victim to foreign phone hackers

VoIP News Australia: How ACMA Plans to Regulate VoIP

Network World: Government agencies rejecting VoIP?

Linux Professional Institute to develop enterprise-level security exam

Net neutrality and Bell Canada

ZDNet: Attacks escalate on critical U.S. government networks: Will a Manhattan Project work?

Google XSS Attack (interesting as it shows the complexity of such attacks)

The Economist: Special Report: The New Nomadism

VoiceBiometrics – May 14-15, New York

IP Telephony University – June 23-24, Alexandria, VA

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

44:22 - End of show

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to blueboxpodcast@gmail.com. Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows. You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Tue, 15 Jul 2008 12:22:35 +0000

Synopsis: Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on April 17, 2008.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!

MANY thanks for all the offers of audio production assistance – getting it organized now

Ingate SIP Trunking webinar now available (and a note about participating in things like this)

VOIPSA blog site hacked

Voice of VOIPSA: Quarterly VoIP Vulnerabilities Summary

VoIPshield list of vulnerabilities

Cisco Advisory

Cisco Advisory about Disaster Recovery Framework

Voice of VOIPSA: VoIPshield announces discovery of over 100 vulnerabilities along with a YouTube video

Washington Post: Reach Out And Hack Someone

Voice of VOIPSA: GNUcitizen research discovery: Default key algorithm in Thomson and BT Home Hub routers

VoIP News: The Essential Guide to VoIP Security

Information Week: Securing VoIP with SecureLogix – includes YouTube video with Mark Collier

Voice of VOIPSA: VoIP and the International Space Station

Voice of VOIPSA: Xplico Network Forensic Analysis Tool

Voice of VOIPSA: Australians falling victim to foreign phone hackers

VoIP News Australia: How ACMA Plans to Regulate VoIP

Network World: Government agencies rejecting VoIP?

Linux Professional Institute to develop enterprise-level security exam

Net neutrality and Bell Canada

ZDNet: Attacks escalate on critical U.S. government networks: Will a Manhattan Project work?

Google XSS Attack (interesting as it shows the complexity of such attacks)

The Economist: Special Report: The New Nomadism

VoiceBiometrics – May 14-15, New York

IP Telephony University – June 23-24, Alexandria, VA

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

44:22 - End of show

Thank you for listening and please do let us know what you think of the show.

Blue Box SE#025 - An interview with Eric Hernaez about Solegy and the OpenSBC Project

Tue, 10 Jun 2008 18:53:28 +0000

Synopsis: Blue Box Special Edition #25: An interview with Eric Hernaez, CEO of Solegy, about the OpenSBC project

Welcome to Blue Box: The VoIP Security Podcast Special Edition #25, a 13-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

In this interview, I sat down with Eric Hernaez, CEO of Solegy, to talk about the OpenSBC Project and how it provides an open source implementation of a session border controller (SBC). We talked about how OpenSBC came about, who is using it, how scalable it is and where users can learn more. We also discussed Solegy, the company supporting the open source OpenSBC project and what they are doing. It was an enjoyable talk that really came about randomly when I met Eric near the press room at IT Expo in Los Angeles back in September 2007. We had been wanting to learn more about the OpenSBC project so I put my recorder on a table and we started talking.

More information about the OpenSBC project and other open source SIP-related projects can be found at opensourcesip.org.

Production assistance on this Special Edition was provided by Sergio Meinardi.

Thank you for listening and please do let us know what you think of the show.

Blue Box SE#025 - An interview with Eric Hernaez about Solegy and the OpenSBC Project

Tue, 10 Jun 2008 18:02:51 +0000

Synopsis: Blue Box Special Edition #25: An interview with Eric Hernaez, CEO of Solegy, about the OpenSBC project

Welcome to Blue Box: The VoIP Security Podcast Special Edition #25, a 13-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

More information about the OpenSBC project and other open source SIP-related projects can be found at opensourcesip.org.

Production assistance on this Special Edition was provided by Sergio Meinardi.

Thank you for listening and please do let us know what you think of the show.

Blue Box #79: Asterisk vulnerabilities, VoiceCon/VON coverage, eavesdropping, FBI, ZFone, P2P, VoIP security news and more

Mon, 09 Jun 2008 12:30:57 +0000

Synopsis: Blue Box #79: Asterisk vulnerabilities, VoiceCon/VON coverage, eavesdropping, FBI, ZFone, P2P, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #78, a 32-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 15MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on March 27, 2008. Yes, that was over two months ago... we know...

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!

MANY thanks for all the offers of audio production assistance

Dan met with Craig Bowser down at VoiceCon, also David Endler, Mark Collier, etc.

Jonathan met with Dean Elwood, Martyn Davies, etc.

Four Asterisk vulnerabilities

The Economist: Bugging The Cloud

Forbes: How to Make Your Phone Untappable

VoIP News: VoIP: Who Might Be Spying on Your Communications? (Hint – It’s Not Just the NSA

VoIP News: Listen Up: 17 Signs That You Are Being Wiretapped

eChannelLine: Businesses lagging in securing VoIP (also ComputerWeekly.com and news release )

eChannelLine: Ingate launches enhanced security for VoIP and SIP (also Enterprise VoIPPlanet )

Voice of VOIPSA: Hacking Zyxel Gateways

Voice of VOIPSA: Vishing Attacks

Voice of VOIPSA: FBI VoIP Surveillance Requirements Leaked (also in FierceVoIP and Slashdot )

Voice of VOIPSA: Hackers Send Thousands of Fake Calls to Deaf People

SnapVoIP: Unified Communications in Virtual Worlds to Solve ‘Tower of Babel’ for Intelligence Agencies

Israeli-made Cryptophone attracts world spy agencies pointing to product site

BlogInfoSec.com: Save The Whales (about a new form of phishing)

Network Computing: Your Data and the P2P Peril

NetQoS: VoIP Monitor 1.1 released

PC World: FaceTime Security Product Scans Skype’s Encrypted IM and news release

Sipera IPCS Solution for Teleworkers Rated ‘Avaya Compliant’

Extreme Networks Boosts Security for Converged Voice and Data Networks with New Tools

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

32:27 - End of show

Thank you for listening and please do let us know what you think of the show.

Blue Box #79: Asterisk vulnerabilities, VoiceCon/VON coverage, eavesdropping, FBI, ZFone, P2P, VoIP security news and more

Mon, 09 Jun 2008 11:30:58 +0000

Synopsis: Blue Box #79: Asterisk vulnerabilities, VoiceCon/VON coverage, eavesdropping, FBI, ZFone, P2P, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #78, a 32-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 15MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on March 27, 2008. Yes, that was over two months ago... we know...

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!

MANY thanks for all the offers of audio production assistance

Dan met with Craig Bowser down at VoiceCon, also David Endler, Mark Collier, etc.

Jonathan met with Dean Elwood, Martyn Davies, etc.

Four Asterisk vulnerabilities

The Economist: Bugging The Cloud

Forbes: How to Make Your Phone Untappable

VoIP News: VoIP: Who Might Be Spying on Your Communications? (Hint – It’s Not Just the NSA

VoIP News: Listen Up: 17 Signs That You Are Being Wiretapped

eChannelLine: Businesses lagging in securing VoIP (also ComputerWeekly.com and news release )

eChannelLine: Ingate launches enhanced security for VoIP and SIP (also Enterprise VoIPPlanet )

Voice of VOIPSA: Hacking Zyxel Gateways

Voice of VOIPSA: Vishing Attacks

Voice of VOIPSA: FBI VoIP Surveillance Requirements Leaked (also in FierceVoIP and Slashdot )

Voice of VOIPSA: Hackers Send Thousands of Fake Calls to Deaf People

SnapVoIP: Unified Communications in Virtual Worlds to Solve ‘Tower of Babel’ for Intelligence Agencies

Israeli-made Cryptophone attracts world spy agencies pointing to product site

BlogInfoSec.com: Save The Whales (about a new form of phishing)

Network Computing: Your Data and the P2P Peril

NetQoS: VoIP Monitor 1.1 released

PC World: FaceTime Security Product Scans Skype’s Encrypted IM and news release

Sipera IPCS Solution for Teleworkers Rated ‘Avaya Compliant’

Extreme Networks Boosts Security for Converged Voice and Data Networks with New Tools

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

32:27 - End of show

Thank you for listening and please do let us know what you think of the show.

So now everyone is an IT GRC vendor

Sun, 01 Jun 2008 17:35:00 +0000

As a marketeer for a technology company, you work really hard to tease out the key points of differentiation and attempt to coin a segment that defines your being. IT-GRC (short for Information Technology Governance, Risk & Compliance) is a term that started gaining momentum about a year ago. At that time Gartner, Forrester, EMA and other research analyst firms started using it to describe exactly what Securityworks does. Next thing you know customers are achieving tangible results from these solutions and the press begins writing articles about it.

Then, along comes tangential segments that do 20-30% of what we do...now all of a sudden they are "IT-GRC" vendors since it's the new "hot" term.

Well, after all that hard work I have to simply say I love the candid article from Alex Handy over at Systems Management News. A couple quotes that say it perfectly...

When Jonathan Penn, research director at Forrester, walked around April's RSA conference, he was appalled by what he saw. “The vendors are destroying what's a very useful approach by claiming for themselves. If you're not an ITGRC vendor, just shut up,” said Penn.

“ITGRC is an incredibly valuable approach to security,” said Penn. “What I like about it is it's a good way to structure what IT does. But it's much more a practice than a product. The tools that manage things at a high level, those are the ITGRC products.”

We completely agree. No single product can encompass IT-GRC. Our product is a good foundation but what's so very important is the people, process and technology that mold around our product. This includes the integration points with other security products into a unified view of your overall security program, not those product calling themselves IT-GRC.