Portugal’s internet shows us a world without net neutrality, and it’s ugly

Portugal isn’t the only country allowing tiering of internet services. In Britain, the internet service provider Vodaphone charges about $33 a month for basic service but offers several “passes” allowing unlimited video or music streaming, social media usage, or chat, at additional tariffs of up to $9.30 per month.

Source: Portugal’s internet shows us a world without net neutrality, and it’s ugly – LA Times

Leaked NSA Malware Is Helping Hijack Computers Around the World

The U.S. software weapon would have allowed the spy agency’s hackers to break into potentially millions of Windows computers by exploiting a flaw in how certain versions of Windows implemented a network protocol commonly used to share files and to print.

Source: Leaked NSA Malware Is Helping Hijack Computers Around the World

From:  Security Update for Microsoft Windows SMB Server (4013389)

This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited these vulnerabilities could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

SpaceX plans to start launching high-speed internet satellites in 2019

SpaceX hopes to start testing its satellites before the end of this year and continuing through the early months of 2018. If that’s successful, the company plans to launch satellites in phases between 2019 and 2024, after which the system will be at full capacity.

Source: SpaceX plans to start launching high-speed internet satellites in 2019

Hundreds of Cisco switches vulnerable to flaw found in WikiLeaks files

An attacker can exploit the vulnerability by sending a malformed protocol-specific Telnet command while establishing a connection to the affected device, because of a flaw in how the protocol fails to properly process some commands.

Cisco said that there are “no workarounds” to address the vulnerability, but it said that disabling Telnet would “eliminate” some risks.

Source: Hundreds of Cisco switches vulnerable to flaw found in WikiLeaks files | ZDNet

SMTP over XXE − how to send emails using Java’s XML parser

The (presumably ancient) code has a bug, though: it does not verify the syntax of the user name. RFC 959 specifies that a username may consist of a sequence of any of the 128 ASCII characters except <CR> and <LF>. Guess what the JRE implementers forgot? Exactly − to check for the presence of <CR> or <LF>. This means that if we put %0D%0A anywhere in the user part of the URL (or the password part for that matter), we can terminate the USER (or PASS) command and inject a new command into the FTP session.

Source: SMTP over XXE − how to send emails using Java’s XML parser – shift or die

So, if we send a USER command to a mail server instead of a FTP server, it will answer with an error code (since USER is not a valid SMTP command), but let us continue with our session. Combined with the bug mentioned above, this allows us to send arbitrary SMTP commands, which allows us to send emails.

How IoT hackers turned a university’s network against itself

While this incident represents one of the first of its kind, the bad news is this form of attack is only going to become more common as more and more everyday items get connected to the internet, providing hackers with greater numbers of potential zombie devices.”

The reason behind it is the issue of default credentials for wireless devices. This is going to bring billions of devices into the fold by 2020, which is only three years away. Whenever it is, there’s going to be so many of these things used by people with very limited understanding of what they are,” says Dine.

Source: How IoT hackers turned a university’s network against itself | ZDNet

The network that IoT devices must use should be isolated and secured by a firewall.  This isn’t that difficult to do.

Krebs pinpoints the likely author of the Mirai botnet

The full story is admittedly lengthy, clocking in at over 8000 words, but worth the time to understand how botnet wranglers make money siccing their zombie device armies on unsuspecting targets. The sources that pointed Krebs to Anna Senpai’s identity were involved in using botnets on behalf of shadowy clients, unleashing them on security companies protecting lucrative Minecraft servers that host thousands of players. When their online gaming is obstructed — say, by repeated and annoying DDoS attacks — players leave, giving servers an incentive to jump ship to whichever security provider can ensure protection…in this case, providers that arranged for the botnet attacks in the first place.

Source: Krebs pinpoints the likely author of the Mirai botnet

Me Too! – You Had Me At EHLO…

First off, the original mail went to 13,000 users.  Assuming that 1,000 of those 13,000 users replied, that means that there are 1,000 replies being sent to those 13,000 users.  And it turns out that a number of these people had their email client set to request read receipts and delivery receipts.  Each read and delivery receipt causes ANOTHER email to be sent from the recipient back to the sender (all 13,000 recipients).  Assuming that 20% of the 1,000 users replying had read receipts or delivery receipts set, that meant that every one of the message that they sent caused another message to be sent for every one of the 13,000 recipients. So how many messages were sent?

Source: Me Too! – You Had Me At EHLO…

Yes, we can validate the Wikileaks emails

DKIM is a system designed to stop spam. It works by verifying the sender of the email. Moreover, as a side effect, it verifies that the email has not been altered.

Hillary’s team uses “hillaryclinton.com”, which as DKIM enabled. Thus, we can verify whether some of these emails are true.

Source: Errata Security: Yes, we can validate the Wikileaks emails

I was just listening to ABC News about this story. It repeated Democrat talking points that the WikiLeaks emails weren’t validated. That’s a lie. This email in particular has been validated. I just did it, and shown you how you can validate it, too.

How does iptables hashlimit module work?

Hashlimit is an iptables module that allows one to define rules that in effect will limit traffic speed (bytes / time unit) or frequency (connections / time unit) per target or origin ports / IPs. The inner workings of this module and / or how to make it work correctly remains a mystery for many.

Hashlimit is also close friends with the limit module, only much more powerful, capable of expressing rate limiting per source IP (for example) in a single rule.

Source: Stuff I do: How does iptables hashlimit module work?