Certificate – Jupiter Broadcasting

AWS 411: Christophe Limpalair | Jupiter Extras 53

Wes Payne — Fri, 07 Feb 2020 04:00:00 +0000

Show Notes: extras.show/53

The post AWS 411: Christophe Limpalair | Jupiter Extras 53 first appeared on Jupiter Broadcasting.

Starting a Business with Linux | Ask Noah 26

chris — Mon, 18 Sep 2017 20:40:33 +0000

RSS Feeds:

MP3 Feed | HD Video Feed | iTunes Feed

Become a supporter on Patreon:

— Show Notes: —

— The Cliff Notes —

— Stay In Touch —

Find all the resources for this show on the Ask Noah Dashboard

Ask Noah Dashboard

Need more help than a radio show can offer? Altispeed provides commercial IT services and they’re excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show!

Altispeed Technologies

Contact Noah

asknoah [at] jupiterbroadcasting.com

— Twitter —

The post Starting a Business with Linux | Ask Noah 26 first appeared on Jupiter Broadcasting.

rm -rf $ALLTHETHINGS/ | TechSNAP 262

chris — Thu, 14 Apr 2016 18:34:12 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Find out why everyone’s just a little disappointed in Badlock, the bad security that could be connected to the Panama Papers leak & the story of a simple delete command that took out an entire hosting provider.

Plus your batch of networking questions, our answers & a packed round up!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Badlock vulnerability disclosed

The badlock vulnerability was finally disclosed on Tuesday after 3 weeks of hype
It turns out to not have been as big a deal as we were lead to believe
The flaw was not in the SMB protocol itself, but in the related SAM and LSAD protocols
The flaw itself is identified as https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2118
It affects all versions of Samba clear back to 3.0
“Samba 4.4.2, 4.3.8 and 4.2.11 Security Releases are available”
“Please be aware that Samba 4.1 and below are therefore out of support, even for security fixes. There will be no official security releases for Samba 4.1 and below published by the Samba Team or SerNet (for EnterpriseSAMBA). We strongly advise users to upgrade to a supported release.”
See the Samba Release Planning page for more details about support lifetime for each branch
Microsoft releases MS16-047 but rated it only “Important”, not “Critical”
The patch fixes an “elevation of privilege bug in both SAM and LSAD that could be exploited in a man-in-the-middle attack, forcing a downgrade of the authentication level of both channels. An attacker could then impersonate an authenticated user”
Microsoft was also careful to note: “Only applications and products that use the SAM or LSAD remote protocols are affected by this issue. The SMB protocol is not vulnerable.”
It seems most of the “badlock” bugs were actually in Samba itself, rather than the protocol as we were lead to believe
“There are several MITM attacks that can be performed against a variety of protocols used by Samba. These would permit execution of arbitrary Samba network calls using the context of the intercepted user. Impact examples of intercepting administrator network traffic:”
Samba AD server – view or modify secrets within an AD database, including user password hashes, or shutdown critical services.
standard Samba server – modify user permissions on files or directories.
There were also a number of related CVEs that are also fixed:
- CVE-2015-5370 3.6.0 to 4.4.0: Errors in Samba DCE-RPC code can lead to denial of service (crashes and high cpu consumption) and man in the middle attacks. It is unlikely but not impossible to trigger remote code execution, which may result in an impersonation on the client side.
- CVE-2016-2110 3.0.0 to 4.4.0: The feature negotiation of NTLMSSP is not downgrade protected. A man in the middle is able to clear even required flags, especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL. Which has implications on encrypted LDAP traffic.
- CVE-2016-2111 3.0.0 to 4.4.0: When Samba is configured as Domain Controller it allows remote attackers to spoof the computer name of a secure channel’s endpoints, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic.
- CVE-2016-2112 3.0.0 to 4.4.0: A man in the middle is able to downgrade LDAP connections to no integrity protection. It’s possible to attack client and server with this.
- CVE-2016-2113 4.0.0 to 4.4.0: Man in the middle attacks are possible for client triggered LDAP connections (with ldaps://) and ncacn_http connections (with https://).
- CVE-2016-2114 4.0.0 to 4.4.0: Due to a bug Samba doesn’t enforce required smb signing, even if explicitly configured. In addition the default for the active directory domain controller case was wrong.
- CVE-2016-2115 3.0.0 to 4.4.0: The protection of DCERPC communication over ncacn_np (which is the default for most the file server related protocols) is inherited from the underlying SMB connection. Samba doesn’t enforce SMB signing for this kind of SMB connections by default, which makes man in the middle attacks possible.
Additional Coverage: Threadpost – Badlock vulnerability falls flat against its type
“As it turns out, Badlock was hardly the remote code execution monster many anticipated. Instead, it’s a man-in-the-middle and denial-of-service bug, allowing an attacker to elevate privileges or crash a Windows machine running Samba services.”
“Red Hat security strategist Josh Bressers said Badlock could have been much worse, especially if it had turned out to be a memory corruption issue in SMB as some had surmised. Such a scenario would have cleared a path for remote code execution, for example.”
Additional Coverage: sadlock.org

Panama Papers: Mossack Fonseca

Eleven million documents were leaked from one of the world’s most secretive companies, Panamanian law firm Mossack Fonseca.
They show how Mossack Fonseca has helped clients launder money, dodge sanctions and avoid tax.
The documents show 12 current or former heads of state and at least 60 people linked to current or former world leaders in the data.
Eleven million documents held by the Panama-based law firm Mossack Fonseca have been passed to German newspaper Sueddeutsche Zeitung, which then shared them with the International Consortium of Investigative Journalists. BBC Panorama is among 107 media organisations – including UK newspaper the Guardian – in 76 countries which have been analysing the documents.
There are many conspiracy theories about the source of the Panama Papers leak. One of the more prominent theories today blames the CIA.
Bradley Birkenfeld is “the most significant financial whistleblower of all time,” and he has opinions about who’s responsible for leaking the Panama Papers rattling financial and political power centers around the world.
Wikileaks is also getting attention today for blaming USAID and George Soros for the leaks.
What little is known about the source of the leak comes from details published by German newspaper Suddeutsche Zeitung. Communicating via encrypted chat in late 2014, the source warned his or her life was “in danger” but that they had data from law firm Mossack Fonseca that they wanted to share. When asked how much data they had, the source replied “more than you have ever seen,” according to the newspaper.
Regardless, the front-end computer systems of Mossack Fonseca are outdated and riddled with security flaws, analysis has revealed.
Mossack Fonseca’s client portal is also vulnerable to the DROWN attack, a security exploit that targets servers supporting the obsolete and insecure SSL v2 protocol. The portal, which runs on the Drupal open source CMS, was last updated in August 2013, according to the site’s changelog.
On its main website Mossack Fonseca claims its Client Information Portal provides a “secure online account” allowing customers to access “corporate information anywhere and everywhere”. The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal’s backend can also be accessed by guessing the URL structure, a security researcher noted.
Mossack Fonseca’s webmail system, which runs on Microsoft’s Outlook Web Access, was last updated in 2009, while its main site runs a version of WordPress that is three months out of date. A further vulnerability makes it possible to easily access files uploaded to the backend of Mossack Fonseca’s site simply by guessing the URL.
Mossack Fonseca’s emails were also not transport encrypted, according to privacy expert Christopher Soghoian who noted the company did not use the TLS security protocol.
Who leaked the Panama Papers? A famous financial whistleblower says: CIA. / Boing Boing
Wikileaks Accuses US Of Funding Panama Papers Putin Expose | The Daily Caller
Panama Papers: The security flaws at the heart of Mossack Fonseca (Wired UK)
Additional Coverage: The Register – Mossack Fonseca website found vulnerable to SQL injection
Additional Coverage: Forbes
Additional Coverage: WordFence
Additional Coverage: Slashdot
In general, it seems there were so many flaws in the website we may never know which one was used to compromise the server

I accidently rm -rf /’d, and destroyed my entire company

“I run a small hosting provider with more or less 1535 customers and I use Ansible to automate some operations to be run on all servers. Last night I accidentally ran, on all servers, a Bash script with a rm -rf {foo}/{bar} with those variables undefined due to a bug in the code above this line.”
“All servers got deleted and the offsite backups too because the remote storage was mounted just before by the same script (that is a backup maintenance script).
How I can recover from a rm -rf / now in a timely manner?”
There is not usually any easy way to recover from something like this
That is why you need backups. Backups are not just a single copy of your files in another location, you need time series data, in case you need to go back more than the most recent backup
It is usually best to not have your backups mounted directly, for exactly this reason
Even if you will never rm -rf /, an attacker might run rm -rf /backup/*
While cleaning up after an attacker attempted to use a Linux kernel exploit against my FreeBSD machine in 2003, I accidently rm -rf /’d in a roundabout way, Trying to remove a symlink to / that had a very funky name (part of the exploit iirc), i used tab complete, and instead of: rm -rf badname, it did rm -rf badname/, which deletes the target of the symlink, which was /.
Obviously this was my fault for using -r for a symlink, since I only wanted to delete one thing
When the command took too long, I got worried, and when I saw ‘can’t delete /sbin/init’, I panicked and aborted it with control+c
Luckily, I had twice daily backups with bacula, to another server. 30 minutes later, everything was restored, and the server didn’t even require a reboot. The 100+ customers on the machine never noticed, since I stopped the rm before it hit /usr/home
There are plenty of other examples of this same problem though
Steam accidently deletes ALL of your files
Bryan Cantrill tells a similiar story from the old SunOS days
Discussion continues and talks about why rm -rf / is blocked by on SunOS and FreeBSD
Additional Coverage: ServerFault
When told to dd the drive to a file, to use testdisk to try to recover files, the user reports accidentally swapping if= and of=, which likely would just error out if the input file didn’t exist, but it might also mean that this entire thing is just a troll. Further evidence: rm -rf / usually doesn’t work on modern linux, without the –no-preserve-root flag

Feedback:

Round Up:

The post rm -rf $ALLTHETHINGS/ | TechSNAP 262 first appeared on Jupiter Broadcasting.

Let’s Encrypt: A New Hope | LAS 396

chris — Sun, 20 Dec 2015 05:11:29 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Inspired by the Let’s Encrypt project, we break down the basics of SSL & how easy it is to set up on your Linux box now.

Plus hacking GRUB by hitting backspace 28 times, the Linux Foundation wants the Blockchain, without the Bitcoin and their bedfellows are concerning, the steady steps towards cross distro application bundles & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: Linux Academy

Linux Academy Apache and SSL Self Signed Certificates

Apache and SSL Self Signed Certificates

This course will detail how to install and configure Apache web services to answer for HTTPS connections. In addition, we will show how to generate a key file to use for obtaining a third party certificate and then use that key to generate a full self-signed certificate. Finally, we will configure our SSL VHOST to use that SSL certificate and verify its availability and content serving from an external location.

Let’s Encrypt

What is encryption

Asymmetric vs Symmetric Antenna

Symmetric encryption uses the identical key to both encrypt and decrypt the data. Symmetric key algorithms are much faster computationally than asymmetric algorithms as the encryption process is less complicated.

Asymmetric encryption uses two related keys (public and private) for data encryption and decryption, and takes away the security risk of key sharing. The private key is never exposed. A message that is encrypted by using the public key can only be decrypted by applying the same algorithm and using the matching private key.

Secure Socket Layer

SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client—typically a web server (website) and a browser; or a mail server and a mail client (e.g., Outlook).

SSL allows sensitive information such as credit card numbers, social security numbers, and login credentials to be transmitted securely. Normally, data sent between browsers and web servers is sent in plain text—leaving you vulnerable to eavesdropping. If an attacker is able to intercept all data being sent between a browser and a web server they can see and use that information.

More specifically, SSL is a security protocol. Protocols describe how algorithms should be used; in this case, the SSL protocol determines variables of the encryption for both the link and the data being transmitted.

Let’s Encrypt

Anyone who has gone through the trouble of setting up a secure website knows what a hassle getting and maintaining a certificate can be. Let’s Encrypt automates away the pain and lets site operators turn on and manage HTTPS with simple commands.
No validation emails, no complicated configuration editing, no expired certificates breaking your website. And of course, because Let’s Encrypt provides certificates for free, no need to arrange payment.

This page describes how to carry out the most common certificate management functions using the Let’s Encrypt client. You’re welcome to use any compatible client, but we only provide instructions for using the client that we provide.

The key principles behind Let’s Encrypt are:

Free: Anyone who owns a domain name can use Let’s Encrypt to obtain a trusted certificate
at zero cost.
Automatic: Software running on a web server can interact with Let’s Encrypt to painlessly obtain a certificate, securely configure it for use, and automatically take care of renewal.
Secure: Let’s Encrypt will serve as a platform for advancing TLS security best practices, both on the CA side and by helping site operators properly secure their servers.
Transparent: All certificates issued or revoked will be publicly recorded and available for anyone to inspect.
Open: The automatic issuance and renewal protocol will be published as an open standard that others can adopt.
Cooperative: Much like the underlying Internet protocols themselves, Let’s Encrypt is a joint effort to benefit the community, beyond the control of any one organization.
Welcome to the Let’s Encrypt client documentation! — Let’s Encrypt 0.2.0.dev0 documentation
Caddy 0.8 Released with Let’s Encrypt Integration

Today, I’m very excited to announce Caddy 0.8! It features automatic HTTPS, zero-downtime restarts, and the ability to embed Caddy in your own Go programs.

— PICKS —

Runs Linux

George’s Hacked Acrua, Runs Linux

He’s been keeping the project to himself and is dying to show it off. We pace around the car going over the technology. Hotz fires up the vehicle’s computer, which runs a version of the Linux operating system, and strings of numbers fill the screen. When he turns the wheel or puts the blinker on, a few numbers change, demonstrating that he’s tapped into the Acura’s internal controls.

Desktop App Pick

Nuvola Player

Nuvola Player is a runtime for web-based music streaming services providing more native user experience and integration with Linux desktop environments than usual web browsers can offer. It tries to feel and look like a native application as possible.

Sent in by Rikai

Weekly Spotlight

GDriveFS

GDriveFS is an innovative FUSE wrapper for Google Drive developed under
Python 2.7.

DOUBLE SPOTLIGHT

Block Spoilers for Star Wars

Force Block is safer than ever! Now, in addition to our standard pattern matching logic which requires a critical mass of related keywords to initiate a block, we’ve added a handful of instant-blocking keyphrases, sourced from people who have seen the film via early screenings. One of our engineers took one for the team punching those in! Ironic, he could save others from spoilers… but not himself.

— NEWS —

You Can Break Into a Linux System by Pressing Backspace 28 Times. Here’s How to Fix It

The researchers, Hector Marco and Ismael Ripoll from the Cybersecurity Group at Polytechnic University of Valencia, found that it’s possible to bypass all security of a locked-down Linux machine by exploiting a bug in the Grub2 bootloader. Essentially, hitting backspace 28 times when the machine asks for your username accesses the “Grub rescue shell,” and once there, you can access the computer’s data or install malware. Fortunately, Marco and Ripoll have made an emergency patch to fix the Grub2 vulnerability. Ubuntu, Red Hat, and Debian have all issued patches to fix it as well.

Linux is often thought of as a super secure operating system, but this is a good reminder to take physical security just as seriously as network security (if not more). Take extra care when your machine is around people you don’t know, especially if your system has sensitive data on it.

Description

A vulnerability in Grub2 has been found. Versions from
1.98 (December, 2009) to 2.02 (December, 2015) are affected.
The vulnerability can be exploited under certain circumstances,
allowing local attackers to bypass any kind of authentication
(plain or hashed passwords). And so, the attacker may take
control of the computer.

Grub2 is the bootloader used by most Linux systems including
some embedded systems. This results in an incalculable number
of affected devices.

As shown in the picture, we successfully exploited this
vulnerability in a Debian 7.5 under Qemu getting a Grub
rescue shell.

Am I vulnerable ?

To quickly check if your system is vulnerable, when the Grub
ask you the username, press the Backspace 28 times. If
your machine reboots or you get a rescue shell then your
Grub is affected.

Impact

An attacker which successfully exploits this vulnerability will
obtain a Grub rescue shell. Grub rescue is a very powerful shell
allowing to:

Elevation of privilege: The attacker is authenticated
without knowing a valid username nor the password. The
attacker has full access to the grub’s console (grub
rescue).

Information disclosure: The attacker can load a
customized kernel and initramfs (for example from a USB) and
then from a more comfortable environment, copy the full disk
or install a rootkit.

Denial of service: The attacker is able to destroy
any data including the grub itself. Even in the case that the
disk is ciphered the attacker can overwrite it, causing a
DoS.

Linux Foundation assembles gang to build a better Blockchain

The Linux Foundation has decided the time is right to apply its special brand of collaboration to the Blockchain, the distributed ledger technology behind Bitcoin and other cryptocurrencies.

The Foundation is talking up the blockchain as a supply-chain enhancer and electronic-transaction-speeder-upper, thanks to its provision of a distributed ledger that has no central point of control and therefore allows secure peer-to-peer information exchange.

Big companies desperately hoping for blockchain without Bitcoin is exactly like 1994: Can't we please have online without Internet??

— Marc Andreessen (@pmarca) December 18, 2015

Wall Street’s New Distributed Ledger Blockchain | PYMNTS.com

there’s a big group of backers in the financial, tech and business industries that have taken the next step to making blockchain move forward without ties to bitcoin.

But as Webster pointed out in her column, “if we kill bitcoin that means we will also kill and bury the blockchain since bitcoin is what keeps the blockchain alive.” Because bitcoin is the method of transport used by the blockchain to move data between the miners, there’s a case for why bitcoin’s blockchain has stuck around.

But big banks like JPMorgan, along with the support of IBM and Intel want to bury that vision and resurrect their own vision for what they envision to be a more productive use case for the concept of a distributed ledger. This is like a blockchain, but sans the bitcoin.

The goal of the Open Ledger Project is not to work in the cryptocurrency space, but rather to leverage the technology behind the distributed ledger in order to streamline business tools that enable transactions and documents to move between parties faster. Another goal of the project would be to create open ledgers that can decide who can access that ledger.

XDG-App Continues Maturing For GNOME App Sandboxing

XDG-App has made much progress and is found in a “tech preview” state for GNOME 3.18 but it’s not until GNOME 3.20 and later where things will get more interesting. Alexander Larsson has provided a “Christmas 2015” update concerning the project for GNOME sandboxing.

Google’s killing Chrome support for 32-bit Linux, Ubuntu 12.04, and Debian 7

In an update posted to the Chromium-dev mailing list, Google’s Dirk Pranke wrote:

“To provide the best experience for the most-used Linux versions, we will end support for Google Chrome on 32-bit Linux, Ubuntu Precise (12.04), and Debian 7 (wheezy) in early March, 2016. Chrome will continue to function on these platforms but will no longer receive updates and security fixes.

We intend to continue supporting the 32-bit build configurations on Linux to support building Chromium. If you are usingPrecise, we’d recommend that you to upgrade to Trusty.”

Feedback:

Brought to you by: System76

https://slexy.org/view/s20p9vkcTi
https://slexy.org/view/s21mtiOvGQ
Support Jupiter Broadcasting on Patreon

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

— CHRIS’ STASH —

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

Find us on Twitter

Follow us on Facebook

Catch the show LIVE Friday:

The post Let's Encrypt: A New Hope | LAS 396 first appeared on Jupiter Broadcasting.

Hackers Go Postal | TechSNAP 188

chris — Thu, 13 Nov 2014 18:35:07 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Authentic iOS Apps can be replaced with malware, the US Postal service gets breached & Microsoft has a hot mess of critical patches.

Plus some great feedback, a rocking round-up & much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Masque Attack — authentic iOS apps can be replaced by malware with ease

Last week we talked about new malware for OS X that infected iOS devices with malicious apps
Part of the problem seemed to stem from the fact that if a corporation got a certificate from Apple to sign internally developed apps for use by employees, these apps were innately trusted by all iOS devices, even those not part of the corporation who signed the application
While we suspected this may be a fairly major vulnerability in the architecture of iOS, it turns out was was only the tip of the iceberg
“In July 2014, FireEye mobile security researchers have discovered that an iOS app installed using enterprise/ad-hoc provisioning could replace another genuine app installed through the App Store, as long as both apps used the same bundle identifier. This in-house app may display an arbitrary title (like “New Flappy Bird”) that lures the user to install it, but the app can replace another genuine app after installation. All apps can be replaced except iOS preinstalled apps, such as Mobile Safari. This vulnerability exists because iOS doesn’t enforce matching certificates for apps with the same bundle identifier”
This means that the malicious app, signed by a random corporate certificate issued by Apple (supposedly only for internal use), can replace any application on your phone, except those directly from Apple
“An attacker can leverage this vulnerability both through wireless networks and USB”
If you install ‘new flappy bird’, or, connect your iOS device to an infected computer, a malicious charging port in some public space, or untrusted wifi, the Twitter app on your device could be replaced with one that steals the credentials for your account and tweets spam, or worse
“That means the attacker can steal user’s banking credentials by replacing an authentic banking app with an malware that has identical UI. Surprisingly, the malware can even access the original app’s local data, which wasn’t removed when the original app was replaced. These data may contain cached emails, or even login-tokens which the malware can use to log into the user’s account directly”
FireEye shared this information with Apple in July, but after the news about the WireLurker malware, which uses a very limited form of this attack (the attackers may not have realized the full extend of what they had discovered), FireEye felt it necessary to go public with the information so customers can take steps to protect themselves
“As mentioned in our Virus Bulletin 2014 paper “Apple without a shell – iOS under targeted attack”, apps distributed using enterprise provisioning profiles (which we call “EnPublic apps”) aren’t subjected to Apple’s review process. Therefore, the attacker can leverage iOS private APIs for powerful attacks such as background monitoring (CVE-2014-1276) and mimic iCloud’s UI to steal the user’s Apple ID and password.”
“The attacker can also use Masque Attacks to bypass the normal app sandbox and then get root privileges by attacking known iOS vulnerabilities, such as the ones used by the Pangu team”

USPS computer networks compromised, telecommuting VPN temporarily shutdown

Attackers compromised the internal network of the United States Postal Service
It is not clear how or where the compromise happened, although some information suggestions a call center was compromised, possibly via the VPN
Possibly compromised information includes: Employee names, dates of birth, Social Security numbers, addresses, beginning and end dates of employment, emergency contact information and other information
“The intrusion also compromised call center data for customers who contacted the Postal Service Customer Care Center with an inquiry via telephone or e-mail between Jan. 1, 2014, and Aug. 16, 2014. This compromised data consists of names, addresses, telephone numbers, email addresses and other information for those customers who may have provided this information. At this time, we do not believe that potentially affected customers need to take any action as a result of this incident”
Additional Information
“VPN was identified as vulnerable to this type of intrusion and will remain unavailable as we work to make modifications to this type of remote access to our networks. When VPN is available again users will notice changes in functionality. We will have additional information about VPN in the near future”
I wonder if this might have been related to Heartbleed. We have had stories in the recent past about SSL based VPNs that were compromised before they could be upgraded with the heartbleed fix, and then this access was used later on because passwords were not changed
“Should I change my ACE ID and password, Postal EIN or other postal passwords as a result of this incident?”
“At this time there is no requirement to change your ACE password or other passwords unless prompted to do so by email prompts from IT as part of the normal password change process. You will be notified if other password changes are required.”
Having IT email you to ask you to change your password just seems like a really bad idea. This is a great opening for a phishing campaign. If a password change is required, it should be prompted for from a more trustworthy source than email
After a breach, out of an abundance of caution, all passwords should be changed.

Microsoft releases patch for OLE vulnerability

As part of this months Patch Tuesday, Microsoft has released an official patch for both OLE vulnerability (specially crafted website, and malicious office document) used in the “Sandworm Team” attacks against NATO and other government agencies that we discussed on episode 185
This new patch, MS14-064 replaces the patch from October’s Patch Tuesday MS14-060
Microsoft – November Patch Update Summary
Microsoft Advisory – MS14-064
Microsoft Advisory – MS14-070 – Local user remote code execution via vulnerability in Windows TCP/IP stack
Also included was a cumulative patch for Internet Explorer, however this patch breaks compatibility with EMET (Enhanced Mitigation Experience Toolkit
) 5.0, and customers are instructed to upgrade to EMET 5.1 before upgrading IE
“If you are using Internet Explorer 11, either on Windows 7 or Windows 8.1, and have deployed EMET 5.0, it is particularly important to install EMET 5.1 as compatibility issues were discovered with the November Internet Explorer security update and the EAF+ mitigation”
“Microsoft also patched a remote code execution vulnerability in Microsoft Secure Channel, or Schannel, a Windows encryption security package used for SSL and TLS connections”
“MS14-067 is the final bulletin ranked critical by Microsoft. The vulnerability can be exploited by a malicious website designed to invoke Microsoft XML Core Services through IE. MSXML improperly parses XML content, which can then in turn corrupt the system state and enable remote code execution”
The previous patch for the OLE vulnerability merely marked files that come from the internet as untrusted. However there are a number of ways around this, some of which may already be in use by attackers
McAfee Labs – Bypassing Microsofts Patch for Sandworm Zero Day
In addition, the Microsoft ‘workaround’ for the flaw, by marking the file as untrusted, only applies when you try to ‘execute’ a file. If you right click and file and open it for ‘editing’, or open it from within an application, the untrusted flag is never checked
McAfee also found samples in the wild that ran the untrusted file as administrator, which only pops up the standard ‘run this program as admin?’ prompt (only if UAC is not disabled), and does not show the ‘this file is not trusted’ prompt

OpenZFS Developer Summit – OpenZFS

Feedback:

Instant Answer tutorial
SGID SFTP Uploads
- This only works on some file systems
- On FreeBSD, only set-uid on a directory works (sets owner on all newly created files), only if the file system is UFS, only if the file system is mounted with the MNT_SUIDDIR flag, and only if the Kernel is compiled with support for SUIDDIR (not enabled by default)
- ZFS is working on a feature to force the owner/group on a dataset
caryhartline comments on Apple Approved Malware
FreeBSD ZFS – preferred method of auto snapshot
- ZFSTools
shared root password or sudo?
- SUDO Master

Round Up:

The post Hackers Go Postal | TechSNAP 188 first appeared on Jupiter Broadcasting.

Misconceptions of Linux Security | TechSNAP 155

chris — Thu, 27 Mar 2014 17:01:59 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We explore some common misconceptions about Linux security. Plus the 0-Day hitting Microsoft Office users…

A great big batch of your questions, our answers, and much much more!

On this week’s episode, of TechSNAP.

Thanks to:

Direct Download:

RSS Feeds:

— Show Notes: —

Exploring the misconceptions of Linux Security

“There is a perception out there that Linux systems don\’t need additional security”
As Linux grows more and more mainstream, attacks become more prominent
We have already seen malware with variants targeting Linux desktop users, Flash and Java exploits with Linux payloads
Linux servers have been under attack for more than a decade, but these incidents are rarely publicized
The most common attacks are not 0day exploits against the kernel or some critical service, but compromised web applications, or plain old brute force password cracking
However, it is still important to keep services up to date as well (openssh, openssl, web server, mail server, etc)
Typical ‘best practice’ involves having firewalls, web application firewalls and intrusion detection systems. These systems cannot prevent every type of attack.
Firewalls generally do not help attacks against web applications, because they operate at layer 3 & 4 and can no detect an attempted exploit
Web Application Firewalls operate at layer 7 and inspect HTTP traffic before it is sent to the application and attempt to detect exploit or SQL injection attempts. These are limited by definitions of what is an attack, and are also often limited to providing protection for specific applications, since protecting an application generally means knows exactly what legitimate traffic will look like
Intrusion detection systems again rely on detecting specific patterns and are often unable to detect an attack, or detect so many false positives that the attack is buried in a report full of noise and isn’t recognized
Linux backdoors have become remarkably sophisticated, taking active steps to avoid detection, including falling silent when an administrator logs in, and suspending exfiltration when an interface is placed in promiscuous mode (such as when tcpdump is run)
Linux servers are often out of date, because most distributions do not have something similar to Microsoft’s “Patch Tuesday”. Security updates are often available more frequently, but the irregular cadence can cause operational issues. Most enterprise patch management systems do not include support for Linux, and it is often hard to tell if a Linux server is properly patched
“The main problem is that these system administrators think their [Linux] systems are so secure, when they haven\’t actually done anything to secure them,” David Jacoby, a senior security researcher for the Global Research and Analysis Team at Kaspersky Lab said. For example, the default Linux configuration for most distributions does not restrict login attempts, Jacoby warned. Attackers can attempt to brute-force passwords by running through a list of possibilities without having to worry about locking out the account or getting disconnected from the server. This is something the administrator has to configure manually, and many don\’t, Jacoby said.

0day exploit in MS Word triggered by Outlook preview

Microsoft issued a warning on Monday of a new 0day exploit against MS Word being exploited in the wild
Microsoft has released an emergency Fix-It Solution until a proper patch can be released
This attack is especially bad since it doesn’t not require the victim to open the malicious email, looking at the message in Outlook’s preview mode will trigger the exploit
According to Microsoft’s advisory the flaw is also present in Word 2003, 2007, 2010, 2013, Word Viewer and Office for Mac 2011
The attack uses a malicious RTF (Rich-Text file), Outlook renders RTF files with MS Word by default
The Fix-It solution disables automatically opening emails with RTF content with MS Word
This attack can also be worked around by configuring your email client to view all emails in plain-text only
Instructions for Office 2003, 2007 and 2010
Instructions for Outlook 2013
“The attack is very sophisticated, making use of an ASLR bypass, ROP techniques (bypassing the NX bit and DEP), shellcode, and several layers of tools designed to detect and defeat analysis”
The code attempts to determine if it is running in a sandbox and will fail to execute, to hamper analysis and reverse engineering
The exploit also checks how recently windows updates have been installed on the machine. “The shellcode will not perform any additional malicious action if there are updates installed after April, 8 2014”
Additional Coverage – ThreatPost

Feedback:

Round Up:

The post Misconceptions of Linux Security | TechSNAP 155 first appeared on Jupiter Broadcasting.

P.E.F.S. | BSD 29

chris — Thu, 20 Mar 2014 22:58:57 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

We\’re back from AsiaBSDCon! This week we\’ll be chatting with Gleb Kurtsou about some a filesystem-level encryption utility called PEFS. After that, we\’ll give you a step by step guide on how to actually use it. There\’s also the usual round of your questions and we\’ve got a lot of news to catch up on, so stay tuned to BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

AsiaBSDCon wrap-up chat

bhyvecon Tokyo videos and slides

Headlines

Using OpenSSH Certificate Authentication

SSH has a not-so-often-talked-about authentication option in addition to passwords and keys: certificates – you can add certificates to any current authentication method you\’re using
They\’re not really that complex, there just isn\’t a lot of documentation on how to use them – this post tries to solve that
There\’s the benefit of not needing a known_hosts file or authorized_users file anymore
The post goes into a fair amount of detail about the differences, advantages and implications of using certificates for authentication

Back to FreeBSD, a new series

Similar to the \”FreeBSD Challenge\” blog series, one of our listeners will be writing about his switching BACK to FreeBSD journey
\”So, a long time ago, I had a box which was running FreeBSD 4, running on a Pentium. 14 years later, I have decided to get back into FreeBSD, now at FreeBSD 10\”
He\’s starting off with PCBSD since it\’s easy to get working with dual graphics
Should be a fun series to follow!

OpenBSD\’s recent experiments in package building

If you\’ll remember back to our poudriere tutorial, it lets you build FreeBSD binary packages in bulk – OpenBSD\’s version is called dpb
Marc Espie recently got some monster machines in russia to play with to help improve scaling of dpb on high end hardware
This article goes through some of his findings and plans for future versions that increase performance
We\’ll be showing a tutorial of dpb on the show in a few weeks

Securing FreeBSD with 2FA

So maybe you\’ve set up two-factor authentication with gmail or twitter, but have you done it with your BSD box?
This post walks us through the process of locking down an ssh server with 2FA
With just a mobile phone and a few extra tools, you can enable two-factor auth on your BSD box and have just that little extra bit of protections

Interview – Gleb Kurtsou – gleb.kurtsou@gmail.com

PEFS

Tutorial

Filesystem-based encryption with PEFS

News Roundup

BSDCan 2014 registration

Registration is finally open!
The prices are available along with a full list of presentations
Tutorial sessions for various topics as well
You have to go

Big changes for OpenBSD 5.6

Although 5.5 was just frozen and the release process has started, 5.6 is already looking promising
OpenBSD has, for a long time, included a heavily-patched version of Apache based on 1.3
They\’ve also imported nginx into base a few years ago, but now have finally removed Apache
Sendmail is also no longer the default MTA, OpenSMTPD is the new default
Will BIND be removed next? Maybe so
They\’ve also discontinued the hp300, mvme68k and mvme88k ports

Getting to know your portmgr lurkers

The \”getting to know your portmgr\” series makes its return
This time we get to talk with danfe@ (probably most known for being the nVidia driver maintainer, but he does a lot with ports)
How he got into FreeBSD? He \”wanted a unix system that I could understand and that would not get bloated as time goes by\”
Mentions why he\’s still heavily involved with the project and lots more

PCBSD weekly digest

Work has started to port Pulseaudio to PCBSD 10.01 (why?)
There\’s a new \”pc-mixer\” utility being worked on for sound management as well
New PBIs, GNOME/Mate updates, Life Preserver fixes and a lot more
PCBSD 10.0.1 was released too

Feedback/Questions

All the tutorials are posted in their entirety at bsdnow.tv
The pkgng, ZFS, OpenBSD router and FreeBSD desktop tutorials have gotten some updates and fixes
If you were using the automatic errata checking script in the router tutorial, you need to redownload the new, fixed version (they rearranged some stuff on the website and broke it)
A few weeks\’ worth of new tutorials were uploaded ahead of time for the benefit of everyone, no point in holding them hostage – go check \’em all out
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
Watch live Wednesdays at 2:00PM Eastern (18:00 UTC)
Dusko, the winner of our tutorial contest, sent us a picture with his awesome FreeBSD pillow!

The post P.E.F.S. | BSD 29 first appeared on Jupiter Broadcasting.

I Know Your Password | TechSNAP 61

chris — Thu, 07 Jun 2012 17:50:30 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

It’s a simple thing but everyone keeps messing it up, bad password storage practices many popular sites had their password databases leaked online this week, we’ve got the details!

Plus how the Flame malware impersonated Windows Update, and another batch of audience questions!

All that and more, on this week’s TechSNAP.

All that and so much more, in this week’s episode of, TechSNAP.

Thanks to:

GoDaddy.com

Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

Limited time offer:

$1.99/mo economy hosting for 3 months – special offer!
Code: 199tech
Expires: June 30, 2012

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Fill out my Wufoo form!

Flame Took Advantage of Windows Update

Iran has sustained 185 Flame virus infections, followed by 95 in Israel and the Palestinian Territories, 32 in Sudan and 29 in Syria
A Flame module called Gadget possesses man-in-the-middle functionality which enabled it pass crafted update packages to other computers on the same network
One specific package was called WuSetupV.exe and was signed with a certificate issued by the “Microsoft Enforced Licensing Registration Authority CA”, a sub-CA of Microsoft’s root authority
The malware, which is 20 megabytes when all of its modules are installed, contains multiple libraries, SQLite3 databases, various levels of encryption — some strong, some weak — and 20 plug-ins that can be swapped in and out to provide various functionality for the attackers. It even contains some code that is written in the LUA programming language
Most victims were running 32-bit editions of Windows 7, with a sizeable 45 per cent running XP. Flame does not work on the 64-bit edition of Windows 7
The Flame malware used a cryptographic collision attack in combination with the terminal server licensing service certificates to sign code as if it came from Microsoft
Microsoft still uses MD5 fingerprints on its certificates, according to the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates | TechSNAP 37 MD5 was Deprecated for Root and Subordinate CAs in Dec 2010, SHA256 or better is required for all certificates issued after Dec 31, 2013. SHA1 is only allowed until more browsers support SHA256 or better
Microsoft has already confirmed that Flame developers were able to issue valid Microsoft certificates
Flame’s operators used a number of fake identities to register their domains. According to Kaspersky, server locations included Germany, the Netherlands, the UK, Switzerland, Hong Kong and Turkey
Although the Flame toolkit does not appear to have been written by the same programmers who wrote Stuxnet and DuQu, it does share a few interesting things with Stuxnet
Stuxnet is believed to have been written through a partnership between Israel and the United States, and was first launched in June 2009
Researchers say the compilation date of modules in Flame appear to have been manipulated by the attackers, perhaps in an attempt to thwart researchers from determining when they were created

“Whoever created it was careful to mess up the compilation dates in every single module,” Gostev said. “The modules appear to have been compiled in 1994 and 1995, but they’re using code that was only released in 2010.”
+ Iran’s Computer Emergency Response Team announced on Monday that it had developed a detector to uncover what it calls the “Flamer” malware on infected machines and delivered it to select organizations at the beginning of May

Links

LinkedIn leaks 6.4 million password hashes

A list of 6.4 million SHA–1 hashes, proported to be passwords from the popular business social networking site Linkedin.com was posted on a Russian password cracking forum
The list is deduplicated, meaning each hash is listed only once, meaning more than 6.4 million passwords were compromised
The list that I managed to download had a lot of the hashes prefixed with 5 or 6 0s, apparently marking them as already having been brute forced
An analysis of a number of permutations of the word linkedin, shows that almost every obfuscation was present on the list
Research has shown that the name of the site is one of the most common passwords, so this suggests that the list is actually from LinkedIn
A number of users at hackernews found their obscure/random passwords on the list of hashes, further suggesting that the list is legitimate
Using plain SHA–1 hashes to store passwords is extremely insecure, a cryptographic hashing algorithm with a salt should be used
I managed to download a 10GB rainbow table of SHA1 hashes, and check every 1–7 character mixed case alpha numeric password using my nVidia GTX 560 Ti, in only 220 seconds
A rainbow table for longer passwords is impractical due to the amount of storage required
Salted hashes cannot be attacked by rainbow tables because the salt basically extends the length of the password, and because crypt() based hashing algorithms run the hash multiple times
MD5-crypt uses an 8 character salt and loops 100 times, SHA256/SHA512-crypt uses a 16 character salt and by default loops 5000 times (adjustable between 1000 and 100 million), and Bcrypt uses a 22 character salt and 16 loops (adjustable as powers of two between 4 and 31)
Consider the following key spaces, and assume you had access to the cracking power of the ENTIRE bitcoin mining network (10 Terahashes per second) (Disclaimer: these numbers are probably wrong, just an example for reference)
- 8 character password, mixed case alpha numberic: (26+26+10)^8 = 218,340,105,584,896 = 21.8 seconds to try every possible password
- 8 character password, all 7-bit ascii characters: 127^8 = 67,675,234,241,018,881 = 6767 seconds to try every possible password (less than 2 hours)
- 8–12 character password, alphabetical only: 26^8 + 26^9 + 26^10 + 26^11 + 26^12 = 99,246,106,575,066,880 = 9924 seconds (less than 3 hours)
- 8 character mixed case alpha numberic password, with 8 character salt, 100 rounds = 62^16 * 100 = 4,767,240,170,682,353,345,026,333,081,600 = 15,116,819,414 years
Official LinkedIn Response
LinkedIn claims that they now salt passwords, so if you change your password, it will be updated and stored more securely
LinkedIn would be able to update to the stronger hashing algorithm without requiring users to change their password, by computing the new hash the next time each user logs in
LastPass – LinkedIn Password Checker

Cloudflare hacked via its voicemail

Cloudflare is a cloud based WAF (Web Application Firewall) and Global Load Balancer
An Attacker found four separate security vulnerabilities and chained them together in order to take over the account of a single Cloudflare user
The attacker was basically in control of the entire cloudflair infrastructure approximately 30 minutes
The attacker first exploited weak security at AT&T to redirect voicemail from the Cloudflare CEO to a mailbox setup by the attacker
The attacker next took over the CEOs personal Gmail account by tricking Google’s password reset system in to leaving the pin number in the voicemail box by a specially crafted voicemail greeting
A flaw (since fixed) in Google’s Enterprise Apps system, allowed the attacker to by-pass the two-factor authentication system when resetting the password for the CEOs Corporate Gmail, having the password send to the CEOs Personal Gmail compromised earlier.
An internal policy at Cloudflare had all password reset emails BCCed to administrators (ironically, this was done for debugging and to watch for suspicious password reset requests)
Once the attacker had compromised a Google Enterprise Apps admin account, he reset the passwords for the other admins, and initiated a Cloudflare password reset for the targetted customer
A copy of the password reset was sent to the administrator email, which the attacker now controlled, giving them access to the target users Cloudflare account
The attacker redirected all traffic to the target site to twitter
Official Incident Report w/ Updates
Official Followup

MD5-Crypt no longer considered secure

Poul-Henning Kamp (also known as PHK), who wrote the MD5-crypt implementation used in most all devices since 1995, says that it should no longer be considered secure
Commercial off-the-shelf video cards can crack MD5 hashes are rates in excess of 1 million hashes per second
PHK says he will not write a new password hashing algorithm, because he is not a cryptographer
His recommendation is to actually mix a number of algorithms, rather than using just a single algorithm
He also recommends that each site implement their own variation of the algorithm, to ensure against ‘class breaks’
FreeBSD 9 already supports Bcrypt, and SHA256/512 based password hashing
Arch Linux and a few others uses SHA256 by default now

Feedback:

ProjectMorris writes in disapointed with LinkedIn
Matthias writes… SID Cloning is Not a Problem
David writes in with… Another idea on local passwords
Slight correction to Thursday’s great episode over Firefox password saving

Round up:

The post I Know Your Password | TechSNAP 61 first appeared on Jupiter Broadcasting.

Smarter Google DNS | TechSNAP 21

chris — Thu, 01 Sep 2011 22:42:23 +0000

Google and openDNS join forces to improve the speed of your downloads, find out what they are doing and how it works!

Plus gmail suffered another man in the middle attack, and Kernel.org gets some egg on their face!

All that and more, on this week’s episode of TechSNAP!

Direct Download Links:

Subscribe via RSS and iTunes:

[ad#shownotes]

Show Notes:

Another SSL Certificate Authority Compromised, MitM Attack on Gmail

Sometime before July 10th, the Dutch Certificate Authority DigiNotar was compromised and the attackers we able to issue a number (apparently as many as 200) of fraudulent certificates, including a wildcard certificate for *.google.com. The attack was only detected by DigiNotar on July 19th. DigiNotar revoked the certificates, and an external security audit determined that all invalid certificates had been revoked. However, it seemed that probably the most important certificate, *.google.com was in fact not revoked. This raises serious questions and seems to point to a coverup by DigiNotar. Detailed Article Additional Article
Newer versions of Chrome were not effected, because Google specifically listed a small subset of CAs who would ever be allowed to issue a certificate for gmail. This also prevents self-signed certificates, which some users fall for regardless of the giant scary browser warning. Chrome Security Notes for June
Mozilla and the other browsers have taken more direct action disabled than they did with the Comodo compromise. All major browsers have entirely removed the the DigiNotar root certificate from their trust list. With the Comodo compromise, the effected certificates were blacklisted, but the rest of the Comodo CA was left untouched. One wonders if this was done as strong signal to all CAs that that must take security more seriously, or if DigiNotar was in fact cooperating with the Iranian government in its efforts to launch MitM attacks on its citizens. Mozilla Security Blog
Part of the issue is that some of the certificates issued were for the browser manufacturers them selves, such as Mozilla.org. With a fake certificate from Mozilla, it is possible that the MitM attack could block updates to your browser, or worse, feed you a spyware laden version of the browser.
Press Release from Parent Company VASCO
Pastebin of the fraudulent Certificate
Allan’s blog post about the previous CA compromise, and more detail than can fit even in an episode of TechSNAP
*

GoogleDNS and OpenDNS launch ‘A Faster Internet’
The site promoted a DNS protocol extension called edns-client-subnet that would have the recursive DNS server pass along the IP Subnet (not the full IP, for privacy) of the requesting client, to allow the authoritative DNS server to make a better Geo Targetting Decision.
A number of large content distributors and CDNs rely on GeoIP technology at DNS time to direct users to the nearest (and as such, usually fastest) server. However this approach is often defeated when a large portion of users are using GoogleDNS and OpenDNS and all of those requests come from a specific IP range. As this technology takes hold, it should make it possible for the Authoritative DNS servers to target the user rather than the Recursive DNS Server, resulting in more accurate results.
Internet Engineering Task Force Draft Specification
This change has already started effecting users, many users of services such as iTunes had complained of much slower download speeds when using Google or Open DNS. This was a result of being sent to a far-away node, and that node getting a disproportionate amount of the total load. Now that this DNS extension has started to come online and is backed by a number of major CDNs, it should alleviate the problem.
ScaleEngine is in the process of implementing this, and already has some test edns enabled authoritative name servers online.
*

Kernel.org Compromised
Attackers were able to compromise a number of Kernel.org machines
Attackers appear to have compromised a single user account, and then through unknown means, gained root access.
Attackers replaced the running OpenSSH server with a trojaned version, likely leaking the credentials of users who authenticated against it.
Kernel.org is working with the 448 people who have accounts there, to replace their passwords and SSH keys.
The attack was only discovered due to an extraneous error message about /dev/mem
Additional Article

Feedback:

Q: (DreamsVoid) I have a server setup, and I am wondering what it would take to setup a backup server, that would automatically take over if the first server were to go down. What are some of the ways I could accomplish this?

A: This is a rather lengthy answer, so I will actually break it apart, and have given one possible answer each week, for the last few weeks. This weeks solution is Anycast. This is by far the most complicated and resource intensive solution, but it is also the most scalable. Standard connections on the Internet are Unicast, meaning they go from a single point to another single point (typically, from a client to a specific server). The are also Broadcast (send to all nodes in the broadcast domain, such as your local LAN), and Multicast (send to a group of subscribed peers, used extensively by routers to distribute routing table updates, but does not work on the Internet). Anycast is different than a Unicast, instead of sending the packet to a specific host, the packet is sent to the nearest host (in network terms, hops, not necessarily geographic terms). The way Anycast works is your BGP enabled routers broadcast a route to your subnet to the Internet from each of the different locations, and the other routers on the Internet update their routing tables with the route to the location that is the fewest hops away. In this way, your traffic is diverted to the nearest location. If one of your locations goes down, when the other routers do not get an update from the downed router, they automatically change their route to the next nearest location. If you want only fail over, and not to distribute traffic geographically, you can have your routers prefix their routes with their own AS number a sufficient number of times to make the backup location always more hops than the main location, so it is only used if the main is down. There are some caveats with this solution, the first being that TCP packets were never meant to randomly redirect to another location, if a route change happens in the middle of an active session, that session will not exist at the second location, and the connection will be dropped. This makes Anycast unsuitable for long-lived connections, as routes on the Internet change constantly, routing around faults and congestion. Connections also cannot be made outbound from an Anycast IP, as the route back may end up going to a different server, and so a response will never be received, so servers would require a regular Unicast address, plus the Anycast address. A common solution to overcome the limitations of Anycast, is to do DNS (which is primarily UDP) via Anycast, and have each location serve a different version of the authoritative zone, which the local IP address of the web server, this way the users are routed to the nearest DNS server, which then returns the regular IP of the web server at the same location (this solution suffers from the same problems mentioned above in the Google DNS story). Another limitation is that due to the size of the address space on the Internet, most provides will not accept a route for a subnet smaller than a /24, meaning than an entire 256 ip address subnet must be dedicated to Anycast, and your servers will each require a regular address in a normal subnet. Broadcasting routes to the Internet also requires your own Autonomous System number, which are only granted to largish providers, or an ISP willing to announce your subnet on their AS number, but this requires a Letter of Authorization from the owner of the IP block.
*

ROUND-UP:

Bitcoin-Blaster:

The post Smarter Google DNS | TechSNAP 21 first appeared on Jupiter Broadcasting.