<![CDATA[[SecurityRatty] tag: telecom]]> http://securityratty.com/tag/telecom Thu, 10 Jul 2008 10:18:03 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more]]> http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21 http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21

Synopsis:  Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Welcome to Blue Box: The VoIP Security Podcast #84, a 30-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

NOTE: Long-time listeners will note that the show notes above are in a less descriptive form than usual. After almost three years of using one wiki for preparing for our shows, Jonathan and I switched to using a new system and are still working out some of the details that will speed the input into show notes.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Mon, 20 Oct 2008 04:32:28 +0000 skype blue box news tools voipshield comments audio comments podcast skype messages Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more <![CDATA[EFF, ACLU slam carrier immunity law]]> http://securityratty.com/article/644527098fb8a2b3f5fb0e535ccabda4 http://securityratty.com/article/644527098fb8a2b3f5fb0e535ccabda4 Thu, 16 Oct 2008 20:00:00 +0000 illegal government surveillance law immunity telecom carriers suits thursday civil-rights EFF, ACLU slam carrier immunity law <![CDATA[Complex Event Processing An Emerging Paradigm in Business Intelligence, Security and Monitoring and Control]]> http://securityratty.com/article/85dd8ffe0f10a11626880b7de9e30386 http://securityratty.com/article/85dd8ffe0f10a11626880b7de9e30386 The following quote is from Complex Event Processing – An Emerging Paradigm in Business Intelligence, Security and Monitoring and Control by Evo Eftimov, iSec Consulting Ltd

“Complex Event Processing (CEP) is a technology which has been used for many years in the Aerospace and Defence Industry for Situational Awareness and Data Fusion modules in Command, Control, Communications, Computing and Intelligence Systems (aka C4I).

Currently CEP is being rediscovered as a foundation for new class of extremely effective Business Intelligence, Security and System/Network/SCADA Monitoring solutions in industries like Financial Services, Telecommunications, Oil and Gas, Manufacturing, Logistics etc. The increasing connectivity and processing power of the modern IT and Telecom technologies lead to increasing speed and volume of the dataflow available to the organisations. By using CEP solutions companies can gain competitive advantage by achieving real-time situational awareness and tapping the information value that is hidden within the streams of real-time event data that are coming from a variety of sources such as enterprise applications, financial transactions, sensor networks and supply chains.”

Unfortunately, the author does not cite references in the paper.

]]> Sun, 21 Sep 2008 01:59:21 +0000 complex event cep solutions companies cep situational awareness real-time situational awareness security solutions control business intelligence Complex Event Processing An Emerging Paradigm in Business Intelligence, Security and Monitoring and Control <![CDATA[Schneier Interview in Telecom Asia ]]> http://securityratty.com/article/678f5e8b17c449b243ba17ffc22ce983 http://securityratty.com/article/678f5e8b17c449b243ba17ffc22ce983 I was interviewed for Telecom Asia.

]]> Fri, 19 Sep 2008 09:55:11 +0000 telecom asia Schneier Interview in Telecom Asia <![CDATA[S&P Downgrades TIBCO to Sell On Financial Services Exposure]]> http://securityratty.com/article/401726b89f56c470f7b2b4c0e8f2d4f1 http://securityratty.com/article/401726b89f56c470f7b2b4c0e8f2d4f1 Standard & Poor’s analyst Zaineb Bokhari cut her rating on TIBCO Software (TIBX) to Sell from Hold. Bokhari referenced TIBCO’s relatively high exposure to financial services and telecom companies and dependence on large deals. Bokhari noted that TIBCO will report Aug 2008 quarter results on September 25. She estimates revenue of $154 million and an operating EPS of 6 cents. For the November 2008 fiscal year, she cut his sales forecast to $650 million from $663 million, with EPS dropping 2 cents to 34 cents. For FY ‘09, Bokhari drops another penny to 44 cents. Bokhari cuts her target price on TIBCO stock to $6.50, from $8.

]]> Thu, 18 Sep 2008 14:15:02 +0000 tibco bokhari bokhari drops bokhari cuts tibco software financial services cents bokhari noted million S&P Downgrades TIBCO to Sell On Financial Services Exposure <![CDATA[In-Flight VoIP Ban: Against FCC Rules? Highly Desirable?]]> http://securityratty.com/article/04edfe3e5a28bd63c48bc3f4ded28db4 http://securityratty.com/article/04edfe3e5a28bd63c48bc3f4ded28db4 Think-tank wonders whether banning in-flight VoIP constitutes a violation of FCC rules about blocking services: The Progress and Freedom Foundation's Barbara Espin uses the ban on in-flight VoIP by American Airlines (facilitated by provider Aircell) to make a broader argument about what she calls the FCC's "ad hoc approach to broadband network management issues." It's clever. American discloses that calling isn't allowed, and VoIP isn't even technically within the FAA or FCC's purview, as far as I can determine. The FAA could choose to regulate it as a safety issue. PFF generally tilts anti-regulation, and has as what it calls its "supporters" a broad area of multiple system cable operators and telecom firms, including Comcast, which was singled out and fined by the FCC for its undisclosed network disruption of P2P connections.

Espin references Joe Sharkey's excellent column on in-flight calling in Sunday's New York Times: Sharkey, a veteran travel writer, who survived a mid-air collision over the Brazilian Amazon a few years ago, looks at varying attitudes about calls made during flights. He quotes Aircell's Jack Blumenstein saying what I've telling folks for months: Aircell has a lot of techniques to block VoIP calls already, and "as we identify new ways that people are trying to do voice calls on the airplane, we just kind of zero in and knock those off." Many geeks have assumed Aircell is a bunch of unsavvy folks who wouldn't be able to figure out how to disrupt their clever workarounds for making VoIP. (I keep noting that introducing jitter for suspicious data connections wouldn't disrupt legitimate applications, but would destroy VoIP call quality.)

]]> Tue, 16 Sep 2008 05:50:22 +0000 voip in-flight voip constitutes in-flight in-flight voip block voip calls fcc rules fcc voice calls calls In-Flight VoIP Ban: Against FCC Rules? Highly Desirable? <![CDATA[How carriers batten down the hatches for hurricanes]]> http://securityratty.com/article/5a6dad089e49c0e4a38a4daca3b27eac http://securityratty.com/article/5a6dad089e49c0e4a38a4daca3b27eac Wed, 03 Sep 2008 20:00:00 +0000 typical verizon commercial telecom carrier infrastructure natural disasters -style twister bases telcos network technicians wizard swept protect How carriers batten down the hatches for hurricanes <![CDATA[Summarizing Zero Day's Posts for July]]> http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d
Different audience provokes different approach for communicating a particular event. In case you aren't reading ZDNet's Zero Day, where I blog next to Ryan Naraine and Nathan McFeters - join us.

Also, consider subscribing yourself to my personal RSS feed, or Zero Day's main feed in order to read all the posts. Here's a quick summary of my posts for last month :

01. Blizzard introducing two-factor authentication for WoW gamers
02. Sony PlayStation's site SQL injected, redirecting to rogue security software
03. 300 Lithuanian sites hacked by Russian hackers
04. Antivirus vendor introducing virtual keyboard for secure Ebanking
05. Gmail, Yahoo and Hotmail's CAPTCHA broken by spammers
06. Storm Worm's Independence Day campaign
07. Approximately 800 vulnerabilities discovered in antivirus products
08. $1 Million prize offered for cracking an encryption algorithm
09. U.K's most spammed person receives 44,000 spam emails daily
10. Storm Worm says the U.S have invaded Iran
11. Gmail, PayPal and Ebay embrace DomainKeys to fight phishing emails
12. Verizon, Telecom Italia, and Brasil Telecom top the botnet charts in Q2 of 2008
13. XSS worm at Justin.tv infects 2,525 profiles
14. Remote code execution through Intel CPU bugs
15. Ringleader of cybercrime group to be offered a job as cybercrime fighter
16. Spam coming from free email providers increasing
17. Kaspersky's Malaysian site hacked by Turkish hacker
18. Georgia President's web site under DDoS attack from Russian hackers
19. 75% of online banking sites found vulnerable to security design flaws
20. McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position
21. Click fraud in 2nd quarter of 2008 more sophisticated, botnets to blame
22. How OpenDNS, PowerDNS and MaraDNS remained unaffected by the DNS cache poisoning vulnerability
23. DNS cache poisoning attacks exploited in the wild
24. The Neosploit cybercrime group abandons its web malware exploitation kit
25. OS fingerprinting Apple's iPhone 2.0 software - a "trivial joke"
26. HD Moore pwned with his own DNS exploit, vulnerable AT&T DNS servers to blame
]]> Fri, 08 Aug 2008 10:35:52 +0000 day software rogue security software spam emails daily cybercrime cybercrime fighter independence day campaign emails posts Summarizing Zero Day's Posts for July <![CDATA[Long Island Proposal Snags Again, on Poles]]> http://securityratty.com/article/479733758aebc5a0eefa89ed8a473de2 http://securityratty.com/article/479733758aebc5a0eefa89ed8a473de2 Long Island proposal still mired: The plan to put Wi-Fi up across two Long Island counties has seemed doomed to me from the start. The company that won the bid was untested, and its other in-deployment or in-proposal networks are off the table. Expertise aside, it needs tens of millions to build such a network, and financing for company-funded metro-scale projects is not available. The counties involved have pledged no purchases of services. And, perhaps the final stroke, the local utility says that E-Path doesn't meet the test of being a telecom and paying less than $10 per year for pole placement, but instead must pay the all-comer rate of $50 per year.

This is a critical distinction. Telecoms are covered under the Telecom Act of 1996 that requires non-discriminatory access to utility poles to avoid incumbent local exchange carriers (ILECs) and utilities from being gatekeepers that prevent competitive service from emerging. There are a series of tests in the law and local qualifications, too, that allow a firm to be a registered telecom. An FCC decision last year ruled that companies that mix telecom and unregulated information services on the same wires aren't disqualified from getting the Telecom Act deal, however.

But E-Path seems to meet none of the criteria except their desire to pay $10 instead of $50 per year per pole. Utility poles have held up many other municipal networks. We're not hearing more about them these days because such networks are now being built on a smaller scale for different purposes, where the number of nodes and their placement is rather different than networks built with the intent of providing indoor coverage.

Cablevision, by the way, qualifies as a telecom, this article states, which helps them in placing nodes for their planned $300m network across their coverage territory. They can also mount nodes in-line with their cable lines, using power from their cable plant on the lines already.

E-Path appears to have a variety of communication problems as well. The article notes, "Tortoretti said his Washington, D.C., attorneys disagree with LIPA's interpretation. But the attorney Tortoretti said represents E-Path, Charles Rohe, said he couldn't speak about the company or the dispute."

Later, E-Path's "chief executive said he hopes the county will help with his LIPA dispute." But an aide to the Suffolk County executive said, "That's not really our issue. That's out of our control."

Correspondent Craig Plunkett, quoted near the end, points out that if the counties were to change their minds and want to buy services on the network, the proposal would have to be rebid (appears as the sound-alike "rebuild" by accident in the online article at this moment).

]]> Mon, 28 Jul 2008 07:07:26 +0000 telecom act telecom act deal telecom proposal island proposal e-path networks represents e-path municipal networks Long Island Proposal Snags Again, on Poles <![CDATA[Help EFF Continue the Fight Against Warrantless Wiretapping!]]> http://securityratty.com/article/cb31e91ff88905f8510b8445973f2788 http://securityratty.com/article/cb31e91ff88905f8510b8445973f2788 Got this in a email this morning, makes me sad, maybe you can help,,, I feel as if my concerns are not being given adequate attention with my elected officials. Especially the ones I voted into office. Dear Friend of Freedom, In a move that I can only describe as cowardice, Congress just passed legislation meant to immunize telephone companies for their illegal, disloyal, and irresponsible behavior. EFF has been fighting against telecom immunity, and we need your help to bring the fight to the next level: http://secure.eff.org/wiretapping Two and a half years ago, EFF sued AT&T on behalf of its customers, seeking to hold the telecom giant responsible for its craven complicity in the White House’s illegal warrantless wiretapping program. Since then, the phone companies and their allies in Washington have spent tens of millions of dollars lobbying Congress to grant them retroactive immunity. They ran ridiculous fear-mongering attack ads against any politician who dared to oppose them. President Bush threatened to veto any bill that allowed EFF’s lawsuit to continue. Yesterday, Congress completely capitulated to the President’s threats and voted to let the telecoms off the hook. If the telecoms are not held accountable, the administration will remain unchecked in its warrantless wiretapping of innocent Americans. This must stop! We need your help to take the fight to the next level. We’re going to challenge Congress’s unconstitutional grant of immunity in our case against AT&T. We’re going to fight for a congressional repeal of immunity in the next Congress. And we’re going to file a new lawsuit against the government, challenging its warrantless surveillance practices, past, present and future. Now, more than ever, we need your support! http://secure.eff.org/wiretapping The fight for civil liberties would never have come this far without your help. We can’t give up now. Help EFF today! Sincerely, Shari – *~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~* Shari Steele Executive Director Electronic Frontier Foundation 454 Shotwell Street San Francisco CA 94110 http://www.eff.org/ Membership & donation queries: membership@eff.org All other queries: information@eff.org ]]> Thu, 10 Jul 2008 10:18:03 +0000 eff eff sued att fight warrantless immunity retroactive immunity congress congress completely att Help EFF Continue the Fight Against Warrantless Wiretapping!