- NANOG - lists.nanog.org

Mozilla Implements TLD Whitelist for Firefox in Response to IDN Homogr aphs Spoofing
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

Not sure if anyone has seen this, or not... Via CircleID: [snip] Mozilla Foundation has announced changes to Firefox concerning Internationalized Domain Names (IDN) to deal with homograph spoofing attacks. According to the organization, "Mozilla Foundation products now only display IDNs in a whitelist of TLDs, which have policies stating what characters are permitted, and procedures for making sure that no homographic domains are registered to two different entities." [snip] http://www.circleid.com/article/1148_0_1_0_C/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

RE: Cisco IOS Exploit Cover Up
by Hank Nussbacher 28 Jul '05

28 Jul '05

At 12:22 AM 28-07-05 -0400, Hannigan, Martin wrote: > > ..and of course: > > > > "Cisco Denies Router Vulnerability Claims" > > > > [snip] > > >Of course. That's how a broken vuln system works. :-) > >The major flaw is that the vendor decides who gets to know >about a vulnerability. Or 3com: http://www.networkworld.com/news/2005/072505-3com.html -Hank

1 0

RE: Cisco IOS Exploit Cover Up
by Hannigan, Martin 28 Jul '05

28 Jul '05

> ..and of course: > > "Cisco Denies Router Vulnerability Claims" > > [snip] Of course. That's how a broken vuln system works. :-) The major flaw is that the vendor decides who gets to know about a vulnerability. This causes an insecurity in "the system" because $vendor is dealing with people usually more qualified than themselves to make a decision on who needs to know and make one independant of revenue<-- . $vendor is probably not the best person to decide who gets on the secret-15 lists et. al. -M<

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

...and Wired News is running this story: "Cisco Security Hole a Whopper" Excerpt: [snip] A bug discovered in an operating system that runs the majority of the world's computer networks would, if exploited, allow an attacker to bring down the nation's critical infrastructure, a computer security researcher said Wednesday against threat of a lawsuit. Michael Lynn, a former research analyst with Internet Security Solutions, quit his job at ISS Tuesday morning before disclosing the flaw at Black Hat Briefings, a conference for computer security professionals held annually here. [snip] http://www.wired.com/news/privacy/0,1848,68328,00.html - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Cisco IOS Exploit Cover Up
by James Baldwin 27 Jul '05

27 Jul '05

For those who like to keep abreast of security issues, there are interesting developments happening at BlackHat with regards to Cisco IOS and its vulnerability to arbitrary code executions. I apologize for the article itself being brief and lean on technical details, but allow me to say that it does represent a real problem (as in practical and confirmed): http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_hole_.html

1 1

RE: Cisco IOS Exploit Cover Up
by Hannigan, Martin 27 Jul '05

27 Jul '05

> > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M<

1 0

Not exactly off-topic, but sooooo not operational.
by Bill Woodcock 27 Jul '05

27 Jul '05

http://www.woodynet.net/Message%20No.%20419.mp3 -Bill

1 0

Extension For E911 "Not as Good As..." Rule
by Fergie (Paul Ferguson) 27 Jul '05

27 Jul '05

Following up from yesterday, Roy Mark writes this in internetnews.com: [snip] Voice over IP providers have another 30 days to inform customers of possible E911 emergency calling limitations -- or pull the plug on their service. After Aug. 30, VoIP providers will have to cut off subscribers who refuse to acknowledge the warning, according to the ruling by the Federal Communications Commission (FCC). The original deadline was Friday, July 29th. [snip] http://www.internetnews.com/infra/article.php/3523236 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Overhaul of U.S. telecom law to be introduced
by Fergie (Paul Ferguson) 27 Jul '05

27 Jul '05

Via the EE Times: [snip] A Republican senator will unveil a rewrite of U.S. telecommunications laws on Wednesday (July 27). Sen. John Ensign, R-Nev., said he will introduce the Broadband Consumer Choice Act of 2005 during a Capitol Hill press conference. "The bill will improve consumers access to communication technology by rewriting outdated telecommunications laws," Ensign's office said in a statement. "One of the bills goals is to reduce government obstacles to technological innovation and expansion." The proposed legislation would replace the Telecommunications Act of 1996. [snip] http://www.eetimes.com/news/latest/showArticle.jhtml?articleID=166402650 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 3

freeserve/wanadoo contact
by Simon Waters 27 Jul '05

27 Jul '05

Anyone with clue at Wanadoo UK, or can put me in touch with someone, will do at this point. Specifically to do with their website hosting arrangements.

1 0