Month: October 2016

A major battle is underway for control over hundreds of millions of network-connected digital video recorders, cameras, and other so-called Internet of Things devices. As Ars has chronicled over the past two weeks, hackers are corralling them into networks that are menacing the security news site KrebsOnSecurity and other Web destinations with some of the biggest distributed denial-of-service attacks ever recorded.

Johannes B. Ullrich, a researcher and chief technology officer for the SANS Internet Storm Center, wanted to know just how vulnerable these devices are to remote takeover, so he connected an older DVR to a cable modem Internet connection. What he saw next—a barrage of telnet connection attempts so dizzying it crashed his device—was depressing.

"The sad part is, that I didn't have to wait long," he wrote in a blog post published Monday. "The IP address is hit by telnet attempts pretty much every minute. Instead of having to wait for a long time to see an attack, my problem was that the DVR was often overwhelmed by the attacks, and the telnet server stopped responding. I had to reboot it every few minutes."

Enlarge / Server administrator kaiju hates user password reset requests. (credit: Bandai Namco Entertainment America (CC))

A couple of decades ago, Microsoft was the kaiju of network computing. First came MS-DOS, and Windows soon followed. Each simply took over business desktops. Before Novell knew what hit it, Windows was then infused with the DNA of OS/2 and became Windows NT and in turn NT Server. Novel had dominated the early PC networking market, but by the end of the 1990s the company was a shadow of its former self.

Like a special breed of kaiju, Microsoft's server platform keeps on mutating, incorporating the DNA of its competitors in sometimes strange ways. All the while, Microsoft's offering has constantly grown in its scope, creating variants of itself in the process. Godzilla often retreats, battered after battle, to regenerate, and the monster has spawned multiple variants (Roland Emmerich's 'Zilla is the Microsoft Bob of Godzillas, right?). Windows Server has done the same, coming back again and again to disrupt another server market with a snap of its 80-percent-functionality-for-20-percent-of-cost teeth.

In 2016, it's happening again. Microsoft Windows Server 2016 picks up where its predecessor (Server 2012 R2) left off three years ago. The last release of Server strove to elevate the status of Microsoft's server platform. It went from being an also-ran in the movement from on-premises servers to an increasingly virtualized, cloud-based enterprise to being integral to business cloud computing itself. With four different versions (Essentials, Hyper-V Server, Standard, and Datacenter), three different deployment schemes ("Desktop experience," Core, and Nano), and an ever-expanding collection of optional features, Server 2016 wants to be everything for everyone. It's a heavyweight virtualization hypervisor! It's a lithe cloud application container! It's a high performance storage platform! It's a hardened security platform!

Tesla Factory in Fremont, California. (credit: https://www.flickr.com/photos/pestoverde/8763130149/)

Tesla Motors sent out a press release late Sunday saying that it had delivered 24,500 vehicles in the company’s third quarter. According to Tesla, that number doesn’t account for 5,500 vehicles which had already come off factory lines but were still in transit to customers.

In Q2, CEO Elon Musk told investors and the press that Tesla would deliver 50,000 vehicles by the end of the year. That goal was a lofty one considering the company had only delivered 14,402 vehicles that quarter. Musk noted that his priority at the time was perfecting Tesla’s factories, or “the machine that makes the machine,” as the company’s executives have taken to calling it.

Tesla’s press release notes that Q3’s deliveries represent a 70-percent increase over last quarter’s deliveries. In total, 15,800 of the deliveries were Model S vehicles, and 8,700 were Model X vehicles.

Enlarge (credit: Mike Mozart)

Verizon’s plan to deploy fiber to 900 homes and fix problems with its DSL network in South New Jersey is “haphazard” and fails to “address the systemic problems” faced by Verizon customers, an independent government agency said Friday.

The New Jersey Division of Rate Counsel, a watchdog agency that advocates on behalf of utility customers, wants state utility regulators to move forward with an investigation into Verizon’s plan to fix service problems. Division of Rate Counsel Director Stefanie Brand made the agency’s position clear in a letter Friday to the New Jersey Board of Public Utilities (BPU).

The BPU has been considering whether to launch an investigation of Verizon as requested by 17 cities and towns who say the company “has, through neglect, abandoned and retired its copper landline infrastructure in most of South Jersey.” Verizon attempted to prevent a formal investigation by submitting a plan to improve service on September 19, but Rate Counsel argued that the BPU should investigate instead of simply taking Verizon’s word that it will fix the problems.

Enlarge / EMC Unisphere apparently had holes as big as the ones in the Unisphere at Flushing Meadows.

Digital Defense announced today that it privately revealed a set of five "zero-day" vulnerabilities in Dell EMC's vApp Manager for Unisphere for VMAX, a Web application used to manage all of EMC's storage platforms. The flaws would allow an attacker with access to the network storage devices to send malicious Adobe Flash Action Message Format (AMF) messages to the Web application server running on the storage system. That means attackers could run arbitrary commands against the storage system and potentially gain complete control of the storage devices or shut them down.

Weaknesses were found in how Unisphere for VMAX, which usually runs on a "virtual appliance" on a VMware server, used the AMF protocol to send messages to five different interfaces on the Unisphere Web application server, sometimes without requiring authentication. The worst of these is a vulnerability that allows "arbitrary command execution with root privileges, complete compromise of the virtual appliance," Digital Defense reported in a post on the vulnerabilities. That includes the capability of creating new user credentials to give attackers unfettered access.

Over 3,300 companies worldwide use Symmetrix VMAX to manage storage systems, including T-Mobile and a number of major financial institutions. While attacks would have likely required access to the data center LANs that the systems run on, that sort of access isn't out of the question. Attackers that managed to exploit a connected Web server or other system in the data center would be able to take advantage. In a worst-case scenario, an attacker could both steal large amounts of corporate data and bring storage systems offline. EMC has released security advisories on the vulnerabilities, but those notices are available only to Dell EMC customers.

Enlarge

Facebook has begun rolling out its “Marketplace” feature to users, allowing people to buy and sell items locally through the app.

Marketplace has existed for some time as part of Facebook Groups. (I've bought and sold some items through a local parents’ group for the last few years, and it works well.) Delivery and payment is handled separately from the app, just like similar ads posted on Craigslist.

The company said in a Monday press release that the feature would be “rolling out to everyone over 18 years old in the US, UK, Australia, and New Zealand on the Facebook app for iPhone and Android.”

Enlarge (credit: Tokyo Institute of Technology)

Today's Nobel Prize in Medicine has been awarded to Japan's Yoshinori Ohsumi for his work in understanding a fundamental biological process in which the cell digests damaged or unneeded components. Termed "autophagy," or self-eating, the process allows cells to survive periods of stress or starvation or to adapt to changing conditions or needs. Failures in autophagy have been linked to both cancer and neurodegenerative diseases.

As with many past winners, Ohsumi seems to have had the right ideas at the right time. In the 1950s, earlier Nobel winner Christian de Duve identified small structures inside cells that carried lots of digestive enzymes. Others recognized that these structures were involved in situations where cells digested parts of their own internal membranes, liberating raw materials to be reused. A decade later, the term autophagy was coined, and people recognized that it was a normal process within cells.

But over the following decades, progress on understanding how it worked was slow, in part because typical complex, eukaryotic cells are filled with small bits of membrane, and partly because the process was transient, rapidly digesting the material it was fed. We knew it was occurring, but we didn't know when or how it was triggered. This left the field open to Ohsumi, who started working on it in the 1990s.