Thursday, May 30, 2002

Help -- Problems with new TrackerPod

I just received my TrackerPod+Camera last week, and have a problem with the TrackerPod ceasing function intermittantly. The QuickCam Pro 3000 works great. (Odd that the standard Logitech base/stand was not included?)


I followed the directions to install the TrackerCam 3.01 software from CD and all the drivers to a Windows 2000 machine, start up the software, and it works, for about two minutes. Then the TrackerPod stops Tracking or moving at all, and every click on the movement buttons brings up a new IE window showing the flash demo -- VERY annoying, pops up several windows at once!


So I exit and re-run TrackerCam, and this time it reports an error at startup,a popup stating "TrackerPod not found!".


Reboot, and the cycle repeats, everything works for the first two minutes, then the 'pod stops functioning but the camera keeps going fine. Reboot again, and the pod doesn't work at all this time. Or sometimes it will work for a second (move slightly) then stop.


This is on a Toshiba Tecra laptop with two built-in USB ports, the TrackerPod and camera are the only devices connected to the two ports, using the supplied cable for the TrackerPod. When the 'pod stops working, both the built-in info page in the TrackerCam software and the system settings page show the second USB port as unused, nothing connected, 500ma used by the camera and 500ma available for additional USB hardware.


Lastly, I tried using a powered hub, thinking that the TrackerPod was drawing more than the rated 500ma. This works just a bit better, with the Trackerpod being able to pan/tilt a few degrees, then stop. But it does not resolve the problem.

Monday, May 20, 2002

Strange video noise with "Quickcam Pro USB" and TrackerCam 3.01?

We have a QuickCam Pro (older model), attached to an IBM Netfinity server
with built-in S3 video card.


The camera works in all modes including 640x480, with the software from
Logitech, and with third-party software from other vendors, with no "noise".
Under TrackerCam 3.0 or 3.01, the display always has "noise". The noise does
not appear in saved frames, only on the display.


If set to size "2" (176x144), there is a small white horizontal stripe on
right side of one of the first scan lines. At size 3 and above, there is
continuous video noise throughout the displayed image, primarily seen as two
fast-moving vertical stripes of video "noise", in the center and far-right
side of the displayed video window.


The PC is an IBM Netfinity with only the on-board S3 (Trio3D) video card.
Is this "noise" an expected effect of using the on-board video card in this
PC?

Thursday, May 16, 2002

Network Monitoring Tools

Realtime monitoring is a particularly difficult application to implement, many monitoring products themselves can have a detrimental effect on the systems being monitored. This is one reason that WAN monitoring instrumentation needs to be implemented by our team, to avoid disruption to the WAN/routers.

Our team currently uses a combination of HP Openview, VitalNet, and other software for our network "health" information and alerting. In other enterprises (Ameritech) I have previously used Concord (http://www.concord.com/) products to the same effect. All of these solutions provide useful statistics (but not mapping) and are limited their ability to detect and deal with dependencies.


There are applications which provide a map display such as Don envisions, some in real-time, these are generally among the more expensive products. I have been working on a limited open-source application (http://sourceforge.net/projects/netmap/) providing some of this functionality, and the graphing and display issues involved are just the tip of the iceberg.


There are several map-capable products that could be considered, I've heard good things about these three:

  • http://www.ipswitch.com/Products/WhatsUp/monitoring.html
  • http://www.lanware.net/NetworkManagment.asp
  • http://www.intermapper.com/



The most recent NWFusion buyers guide for Network Monitoring I can find (http://www.nwfusion.com/bg/netmon/netmon.jsp) was published in 1999, and is sorely out of date. They still list NetMetrix and other non-existent products, and there are probably many new products in this arena which are not included. Perhaps there are other, better, resources for locating vendors?

Monday, April 29, 2002

BBC: "Employees seen as computer saboteurs"

Ignoring the funny spelling, they have some good points.
Feel free to forward as you see fit.

"Employees seen as computer saboteurs"
  • http://news.bbc.co.uk/hi/english/sci/tech/newsid_1946000/1946368.stm
  • http://slashdot.org/article.pl?sid=02/04/29/1231200&mode=thread&tid=172

Workers unfamiliar with computers or who blithely open files attached to e-mail could kick off virus outbreaks or inadvertently aid hackers trying to get access to an organisations internal network.
Customer service staff at call centres can also cause security headaches for companies if they are not trained to spot or deal with people who call and try to extract information about passwords and customer accounts

Wednesday, March 13, 2002

Traffic analysis with 'cflow' (NetFlow)

We would loke to look at Cisco's 'NetFlow' for collecting 'peak load traffic statistics from Cisco equipment. With appropriate software to generate 'executive reports' the information collected by enabling flow collection on core and edge WAN/LAN could prove valuable for collecting SLAs and for demonstrating actual utilization to support our budget allocations.

Enabling Netflow requires a substantial amount of RAM, and increases CPU utilization somewhat. Collection should not generate excessive traffic (flow data is sent as UDP packets). These assumptions need to be tested, we will have a test Cisco router for the SLB testing, I'd like to enable NetFlow on that test router initially.

It'd be great if we could get an eval of a vendor's "realtime status display" software.


Cisco Docs:
  • http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/netflsol/nfwhite.htm
  • http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/netflsol/nfenterp.htm

Commercial Products:
  • http://www.inmon.com/trafficserver.htm
  • http://www.netscout.com/

Software analysis tools:
  • http://www.caida.org/tools/measurement/cflowd/
  • http://rr.sans.org/software/netflow.php
  • ftp://ftp.net.ohio-state.edu/users/maf/cisco/
  • http://net.doit.wisc.edu/~plonka/FlowScan/

Wednesday, January 23, 2002

SNK-004 Calculator?

Have you made any progess on the SNK calculator for Palm that you mention on your web site?

http://www.cs.vu.nl/~leendert/pilot.html

I'm very interested in this project. There are some serious known issues with the X9.9 standard, so I'm hoping to find a framework into which I can plug a more secure challenge (alphanumeric) and crypto mechanism.

http://www.freeradius.org/radiusd/doc/rlm_x99_token

Monday, January 21, 2002

Congrats on the Interview, and Chicago's view of Bernie

Congrats to Neil on the Newspaper interview.

FYI, we know all the network security people in the Chicago area, and we have never before heard of Bernie. He was never anybody of note in the Chicago scene, and after this, he never will be.

Friday, January 11, 2002

Solaris login exploit seen in the wild

A little birdie just told me that the Solaris/Sparc exploit for the buffer overflow in /bin/login is 'in the wild'. I have also received a binary executable of the exploit.

Available now to 'black hats' is a remote exploit overflowing the TTYPROMPT variable. A local exploit should also be expected, allowing anybody who can execute code on an unpatched solaris host to become superuser.

Any internet-accessible Solaris host with port 23 open that has not already been patched should be assumed to have been compromised. Internal hosts are also at risk if not patched.

All of the outsourced hosts with which I am familiar (the ones we audited back in '99) either block telnet entirely, or reject telnet login attempts from arbitrary internet addresses via 'tcp wrappers'. This 'protection' is not an excuse not to apply the Sun patch.

Chicago Tribune Editorial on Spam and UCE

I found Don Wycliff's editorial this Thursday very interesting in view of our recent high-level discussions on unsolicited mail, in particular, HTML messages which automatically download and display pornographic images:

http://www.chicagotribune.com/news/columnists/chi-0201100043jan10.column

Don hits the nail on the head, stating "Newspapers, which must be as open to the public as possible, ought be loath to close themselves off in any way that can be avoided."

He also mentions the two-year-old Illinois anti-spam law. The act provides both legal remedies if the company suffers "actual damages" (I'd like to see the legal definition of this term), and also protection from liability for "action taken in good faith" to stop spam. The full text of the law (and lots of other good anti-spam info) can be found at this location:

http://law.spamcon.org/us-laws/states/il/ema-91-0244.shtml

Thursday, December 20, 2001

Operation In US History - Scores Israelis Held

This article was pulled from newsmax shortly after it was released.


> Operation In US History -
> Scores Israelis Held
> By Charles R. Smith
> 12-20-1
> In the wake of the September 11 terrorist attack, the FBI has
> stumbled on the largest espionage ring ever discovered inside the
> United States. The U.S. Justice Department is now holding nearly 100
> Israeli citizens with direct ties to foreign military, criminal and
> intelligence services. The spy ring reportedly includes employees
> of two Israeli-owned companies that currently perform almost all the
> official wiretaps for U.S. local, state and federal law enforcement.
> The U.S. law enforcement wiretaps, authorized by the
> Communications Assistance for Law Enforcement Act (CALEA), appear to
> have been breached by organized crime units working inside Israel and
> the Israeli intelligence service, Mossad. Both Attorney General
> John Ashcroft and FBI Director Robert Mueller were warned on Oct. 18
> in a hand-delivered letter from local, state and federal law
> enforcement officials. The warning stated, "Law enforcement's current
> electronic surveillance capabilities are less effective today than
> they > were at the time CALEA was enacted." The spy ring enabled
> criminals to use reverse wiretaps against U.S. intelligence and law
> enforcement operations. The illegal monitoring may have resulted in
> the deaths of several informants and reportedly spoiled planned
> anti-drug raids on crime syndicates. Global Spy and Crime Network
> The penetration of the U.S. wiretap system has led to a giant spy
> hunt across the globe by American intelligence agencies. U.S.
> intelligence officials now suspect the spy ring shared and sold
> information to other nations. "Why do you think Putin so
> nonchalantly and with such great fanfare announced the shutdown of
> the Lourdes listening post in Cuba?" noted Douglas Brown, president
> of Multilingual Data Solutions Inc. and program director at the
> Nathan Hale Institute. "Besides the PR benefit right before his
> visit here, the Russians don't need it anymore. They've scraped
> together a cheaper, more effective monitoring system. Is the Israeli
> company an element of that system? I don't know," stated Brown.
> "With all the whining and crying about Echelon and Carnivore,
> critics, domestic and foreign, of U.S. electronic eavesdropping
> vastly overestimate our abilities to process and disseminat> e the
> stuff," noted Brown. "The critics also underestimated the
> incompetence and total ineptness of the people running our
> intelligence and law enforcement services during the Clinton-Gore
> years. One guy uses his home computer for storing top secret
> documents; another high-tech guru guy can't figure out how to save
> and retrieve his e-mail, and the guy in charge of everything is
> having phone sex over an open line with one of his employees," said
> Brown. "On the other hand, the Europeans, including the Russians,
> have been much more focused on the nuts and bolts of practical
> systems to process the information they scoop up. The stories linking
> German intelligence and the L scandal got very little play here but
> were widely noted in the European software community," said Brown.
> "Except for a few Germans and an occasional Pole, nobody can match
> the Russians in designing and developing algorithms. We may have some
> of the world's greatest programmers, but the Russians and Europeans
> do a better job of matching up linguists and area experts with their
> programmers," noted Brown. The discovery of a major spy ring
> inside the United States is straining the already tense relations
> with Israel. Although, Israel denied any involvement with the
> penetration of the U.S. wiretap system, the CIA and FBI are
> investigating the direct government ties to the former Israeli
> military and intelligence officials now being held by the Justice
> Department. Israeli Company Provides U.S. Wiretaps One
> company reported to be under investigation is Comverse Infosys, a
> subsidiary of an Israeli-run private telecommunications firm.
> Comverse provides almost all the wiretapping equipment and software
> for U.S. law enforcement. Custom computers and software made by
> Comverse are tied into the U.S. phone network in order to intercept,
> record and store wiretapped calls, and at the same time transmit them
> to investigators. The penetration of Comverse reportedly allowed
> criminals to wiretap law enforcement communications in reverse and
> foil authorized wiretaps with advance warning. One major drug bust
> operation planned by the Los Angeles police was foiled by what now
> appear to be reverse wiretaps placed on law enforcement phones by the
> criminal spy ring. Flawed laws Led to Compromise Several U.S.
> privacy and security advocates contend the fault actually lies in the
> CALEA legislation passed by Congress that allowed the spy ring to
> operate so effectively. Lisa Dean, vice president for technology
> policy at Free Congress Foundation, delivered a scathing critique of
> t> he breach of the U.S. law enforcement wiretap system. "We are
> exercising our 'I told you so' rights on this," said Dean. "From
> the beginning, both the political right and left warned Congress and
> the FBI that they were making a huge mistake by implementing CALEA.
> That it would jeopardize the security of private communications,
> whether it's between a mother and her son or between government
> officials. The statement just issued by law enforcement agencies has
> confirmed our worst fears," concluded Dean. "How many more 9/11s
> do we have to suffer?" asked Brad Jansen, deputy director for
> technology policy at the Free Congress Foundation. "The CALEA
> form of massive surveillance is a poor substitute for real law
> enforcement and intelligence work. It is an after-the-fact method of
> crime fighting. It is not designed to prevent crime. Massive
> wiretapping does not equal security. Instead, we have elected to
> jeopardize our national security in exchange for poor law
> enforcement," said Jansen. "For example, FINCEN monitoring of all
> money transactions did not detect al-Qaeda, nor did it find Mohamed
> Atta before he boarded his last flight. It was an ATM receipt left in
> his rental car that led the FBI to the bin Laden bank accounts,"
> noted Jansen. U.S. National Security Compromised "The CALEA
> approach is the same approach law enforcement has been pushing for a
> number of years. It's the same approach that was used to push
> Carnivore, Magic Lantern, FINCEN and ev> en the failed Clipper
> project. This approach leads to a compromise in national security and
> in personal security for the American public," said Jansen. "In
> addition, there is always government abuse of these kinds of
> systems," stated Jansen. "Law enforcement on all levels does a very
> poor job in policing itself. We need to hold our police and
> government officials to the highest standards." "This also hurts
> the U.S. economy when the whole world knows that our communication
> systems are not secure. We cannot compete with inferior products when
> other countries are exporting secure software and hardware. New
> Zealand, India and Chili already offer security products that
> actually provide real security," stated Jansen. "The current
> mentality of law enforcement is what failed to protect us from 9/11.
> CALEA wiretaps will not protect us from terror attacks in the future.
> The system does not provide better intelligence information. It
> actually leads to less security and more crime. We get the worst of
> both worlds," concluded Jansen. All Rights Reserved ©
> NewsMax.com

Tuesday, March 13, 2001

ICANN Registrar costs.

An initial examination of the cost of becoming a domain registrar for .com, .net, and .org domains comes to $11,000 in non-recurring charges, plus $5,000 per year to ICANN, and an unspecified quarterly fee for each domain registered.

There are specific reporting requirements that would require additional time and effort to stay current with the database and payments, but not more than is currently involved in paying Network Solutions.



Details:
http://www.icann.org/registrars/accreditation-financials.htm

There is a $1,000 non-refundable application fee to apply for registrar status, and a one-time $10,000 NSI software license fee, required for access to the SRS system.

For each year there is a $5,000 'annual accreditation fee', plus unspecified fees per domain payable to ICANN and NSI. This should not exceed $9/domain/year.


Tribune would need to operate a public HTTP and WHOIS server providing registration details on all domains handled by the registrar. There is no minimum or maximum fee set for registration. This obligation may be subcontracted.


http://www.icann.org/registrars/accreditation-application.htm
The registrar application asks for information on the size of the company and a list of all operational domain names under which the company does business.

http://www.icann.org/nsi/icann-raa-04nov99.htm
The ICANN contract includes a clause regarding 'prohibitions on warehousing of or speculation in domain names by registrars'. Further details on the ICANN site make it clear that this covers the holding of domain names for the purpose of resale, and is _not_ a restriction on registering domains for our own use.