Networking Equipment Manufacturer Exposes Secret Password Recovery Procedures

Networking equipment manufacturer Allied Telesis has accidentally leaked an internal support document describing backdoors into its devices.

The document, which was labeled as "INTERNAL ONLY," was inadvertently made public on its website and subsequently indexed by Google.

The question answered in it was "How do I obtain a backdoor password for my Allied Telesis device" and contained solutions for different types of network switches.

"Depending on the device that you are locked out of, there is either a built in Backdoor function, or a way to generate a password, based on the MAC address of the device," the support entry read.

In addition, it had several files attached, including default password lists, a password generator program and special instructions.

The content was copied and posted on file sharing websites before the company had a chance to remove it from public access.

"The Backdoor Passwords listed here are INTERNAL ONLY. Do not give this information freely to any customer as this can compromise a network," a note on the document reads.

This warning has sparked fears that attackers can use the information to attack network switches, however, these procedures require physical access to the devices.

The manufacturer claims they are industry standard password recovery features and says the use of the term "backdoor" was unfortunate.

"All documentation describing this password recovery process as a proprietary 'backdoor' feature is incorrect, and has been removed from the website," Allied Telesis said, according to threatpost.

"By definition this is not a 'backdoor' feature; it is a standard password recovery process for a person who has physical access to the device," it added.

Nevertheless, security experts have argued that the use of MAC addresses to generate backup administrative passwords is not secure because they can be easily determined.

Chris Wysopal, chief technology officer at Veracode, said that vendors could use cryptographic methods to sign the password reset commands and have the devices verify them.

Allied is now working on removing the information from websites that posted it and they have also informed their support personnel about the leak.

Continue...

DNSSEC Adoption Endangered by Controversial US Anti-Piracy Bill

A group of renowed experts have released a technical paper warning members of the US Senate that DNS-related provisions of a new anti-piracy bill endangers DNSSEC deployment and the security of the Internet infrastructure.

The controversial PROTECT (Preventing Real Online Threats to Economic Creativity and Theft of Intellectual Property Act) IP Act proposes some very aggressive anti-piracy measures, some of which rely on DNS servers to blacklist domains that participate in copyright infringement.

The group of DNS experts, which includes Dan Kaminsky, the researcher who discovered a critical DNS flaw that pushed forward the adoption of DNSSEC, Steve Crocker, vice chair of the board of ICANN, Damballa co-founder David Dagon, VeriSign chief security officer Danny McPherson, and Paul Vixie, chairman, chief scientist and founder of Internet Systems Consortium, claim the PROTECT IP provisions are contrary to the US government's commitment to Internet security.

Domain Name System Security Extensions (DNSSEC) are a suite of specifications meant to secure DNS, one of the critical components of the Internet infrastructure.

With DNSSEC, the requests between DNS resolvers and authoritative servers are signed, which ensures the integrity and authenticity of responses. This prevents DNS cache poisoning and other attacks.

"DNS filters would be evaded easily, and would likely prove ineffective at reducing online infringement. Further, widespread circumvention would threaten the security and stability of the global DNS," the experts write in their paper. [pdf]

"The DNS provisions would undermine the universality of domain names, which has been one of the key enablers of the innovation, economic growth, and improvements in communications and information access unleashed by the global Internet," they add.

Furthermore, the PROTECT IP provisions encourage migration away from ISP-provided DNS servers. This is a problem because many ISPs use DNS data to detect security threats on their networks and improve performance.

The group of experts feel that the goals of the bill can be reached through other means, like international cooperation on prosecutions, without endangering DNS security and stability.

Continue...

Android Market Grows, Downloads Remain Behind

Google's Android Market, the portal through which all users of devices running under the platform can download and install applications, is growing fast, with some of the latest predictions on the area suggesting that it would be able to outpace the Apple App store this summer.

However, while the number of applications available for download from the storefront is on the rise, things are a little different when it comes to users' habits of downloading them.

Out of hundreds of thousands of applications available through the software portal, only 96 of them have been downloaded over 5 million times, a recent report (PDF) from Distimo shows.

Moreover, there is only one application that topped the 50 million downloads mark, the Google Maps, which makes it the most popular software in the storefront.

Further more, things are not looking good at all for around 20 percent of the free applications available through the Android Market, as they were downloaded less than 100 times until now.

The said report also shows that 80 percent of all paid applications were downloaded less than 100 times all around the world as well.

When compared to the Apple App Store, the Android Market clearly poses some more challenges to application developers than Apple's portal does.

“The refresh rate of top application charts is significantly higher in the Apple App Store for iPhone than in the Google Android Market,” Distimo explains.

“During the month of April, there were 94 distinct applications with a top 10 (free or paid) position in the Apple App Store for iPhone in the US; there were only 26 distinct applications that reached a top 10 position in the Google Android Market.”

When it comes to games, things are looking bad for Android as well, since only five games in the Market have over 250,000 downloads around the world, while the App Store had ten of them topping that mark in the US alone in the last two months.

Have a look at the graphs attached to this article to see the total downloads of all applications in the Android Market between April 1 – May 19 in the United States.

“The download tiers above show the proportion of applications that were downloaded worldwide between these intervals. The figures reveal that the majority (51.8%) of free applications have been downloaded less than 1,000 times to date,” the report shows.

Continue...

Nokia to Release New Devices Faster than Before

Finnish mobile phone maker Nokia is gearing up for the release of its first handsets powered by Microsoft's Windows Phone operating system, which would bring a change in the frequency at which it brings to the market new devices.

Apparently, along with its Windows Phone handsets, Nokia is also expected to put in place a faster device release schedule, so that more Nokia smartphones are available for purchase, faster.

“We should be launching new devices in a rhythm that might be every couple of months, every three months, something like that,” Nokia's executive vice president of smart devices, Jo Harlow, stated recently.

With Nokia bringing to the market handsets based on Windows Phone, the adoption of the platform is expected to rise among end users.

Apparently, the fact that Nokia adopted Windows phone as its primary OS is of great importance, for the future of both the platform and of the handset vendor.

According to Jo Harlow, while other companies see Windows Phone as their secondary OS, Nokia would mark a change in that, and Microsoft's software would gain more market share.

“We're going to keep coming with new devices in order to have something to talk about,” Harlow reportedly stated.

This year, Nokia should bring to the market a small number of handsets running under Windows Phone Mango, she confirmed, adding that more of them should be released in 2012.

Previous reports also suggested that Nokia might be set to launch its first dual-core Windows Phone device next year, with a ST-Ericsson chip inside.

However, that would happen only towards the end of the next year, and the focus at the moment would be on releasing phones that would prove good options for more users out there.

With Nokia in its team, and newly added partners, Microsoft would be able to make the platform available at more price points, in more markets that before.

Continue...

Personify Mobile App for Android Phones Now Available for Download

Personify Mobile is a powerful business tool and one of the first platform solutions for associations, professional societies, fundraising organizations and other non-profits.

Developed by TMA Resources, a company focusing on providing association management software (AMS), Personify Mobile is fully integrated with the Personify association management software system, allowing staff and authorized members to perform a wide range of information, commerce and self-service functions.

Initially available for Apple's iPhone, the application has now been ported on Android devices to provide rich functionality and access to key features, even when the Internet is not available.

The application is built using CircleBack platform, formally known as Powered by DUB or DubMeNow.

“Many organizations have settled for iPhone only applications or single use applications based on an individual event. Personify Mobile goes further and provides members with much of the functionality that they find on their association’s Web site. Using their phone, members can manage conference schedules, update profiles, donate to worthy causes, and even purchase products,” said George Breeden, TMA Resources senior director, Product Marketing.

According to TMA Resources, support for the Blackberry platform will be available in the near future.

A fully functional demo of Personify Mobile can be downloaded from the Android Market as well as the iPhone App store.

Some of the key features of the Personify Mobile include: Android, BlackBerry and iPhone devices compatibility, staff management of members records, profile management, customer self-service notifications, member directory, contact exchange in-person or using email, featured products and events, searchable event calendar and detailed conference information, industry news feeds, and offline support.

However, the demo seems to be only available for authorized users that want to evaluate the Android version of Personify Mobile.

The application is compatible with all devices running Android OS 2.1 or newer and requires 2.6MB storage space.

Continue...

Hide, Lock, Encrypt, Wipe Folders – Free and Portable App

Secure Folder has been designed with the purpose to keep your files safe from prying eyes. It locks your data using 256-bit AES Rijndael algorithm and can also hide the items from view.

Keeping information safe these days is not quite easy to achieve, despite the plethora of apps promising strong protection. In many case easy workarounds can open the door to your data. There are few programs that can indeed withstand cunning attacks.

But sometimes the easies solutions are the best. Secure Folder is a nifty little freebie geared up with plenty of protective features for your files. Besides encrypting your data it can also hide it from view. Moreover, you can use it to map a folder to a drive for easier access to that location; its functionality also includes a secure deletion component and a system cleaner.

The application comes both as a desktop installation as well as a portable download. If you go with the second there is no need to install, just unzip the contents and use.

Regardless how you decide to bring the program on your system you’ll face one of the simplest interfaces. All the options are condensed in the upper part of the window and most of the space is reserved for the folders you add and want to protect.

Secure Folder is protected by a countersign (“password”) from the very first moment you launch it. You are advised to change it for better protection, as this is the only key that can remove the security measures you enforce upon your data.

Support for drag and drop makes it easy to load up the directories you want to protect. A set of three options is at your disposal: lock the item, hide it or encrypt it. Of course, you can choose all of them to ensure maximum protection.

However, if locking and encrypting the folder work like a charm, hiding it does not really throw the invisibility cloak on them. We were able to bring it to surface by simply instructing Windows Explorer to display protected operating system files. Also, we noticed that the hiding occurs regardless of the security measure you impose in the software.

On the other hand locking and encrypting really did the job. The folder affected by these security measures showed zero size and we could not breach them.

An important aspect is that you always know which folders are protected and the protection measures enforced just by simply taking a gander at the main application window. Right near the secured folder you will see the protection modes currently on keeping it safe: “L” stands for Lock,” H” stands for Hide and “E” stands for Encrypt.

Continue...

Drag & Drop to Upload to Box.net

It is getting easier by the day to upload date into an online storage account. With SimpleShare from Box.net this procedure reaches the utmost simplicity level as dragging and dropping the data into its interface is all it takes to get them into your upload folder of your Box account.

The application is not exactly a desktop client for the online service, but rather an upload manager, designed to facilitate uploading data to your account to the maximum.

SimpleShare is a 10.2MB download and it does not take great computer skills to put on your system. Installation procedure is actually a click-through process, which can be handled by beginner users as well, with no effort at all.

The freebie obviously addresses Box.net users, but if you want to benefit from its advantages creating an account takes less than a minute. If you opt for the free, personal plan you get 5GB of web storage, easy sharing of data and access to your account from a mobile device. On the downside, you cannot upload files larger than 25MB.

There isn’t much investment in the looks of the application as these are plain and simple, with the application window composed of two tabs: one is for viewing the basic details of your Box.net account and access the online upload folder while the other offers the configuration options.

As far as details about your account are concerned, you will be provided only with the current quota state of the web storage. This is presented in percent but you also have the cold numbers.

All the data you upload in your online account is stored in a specific folder which is created the moment your account becomes active. With SimpleShare you can easily access the contents of this directory, but, more importantly you can upload files there by simply dragging and dropping the items in its interface.

On the downside, there is no obvious hint to betray the fact that an upload job is in progress. Only if you look closely at the system tray icon you will notice it filling up; also, when the task completes a message pops up informing you that the file has been uploaded. But apart from this, which is quite difficult to spot, there isn’t any other indication.

A progress bar in the interface of the program would have been a neat solution, or at least display the progress in percentage upon moving the mouse over the icon.

Uploading items when dropping them in the interface is not the only trick SimpleShare has been conferred. The app also gives you the possibility to take screenshots of specific areas of your desktop or the entire screen and automatically upload them.

A more important screen recording solution, though, is capturing video of your work on the computer. Video recording job is triggered by a keyboard shortcut, Shift+Alt+5, which you can change to something more convenient. Just select the region you want to capture and everything will be caught on “tape”. The “stop” button is present in the lower right corner of the captured region. Once you click it, SimpleShare automatically starts uploading the newly created FLV file.

The configuration screen of the application is nothing complicated and all the options are shown in a clear manner, with no room for confusion. The list of settings includes the possibility to delete data once it is uploaded, disable automatic uploads or enable SimpleShare to start with Windows.

A very useful option is copying the URL of the uploaded when it is online. Since Box.net can be used for sharing data and collaborative tasks, this feature comes in very handy as it allows you to securely send the link to anyone you want.

“Preferences” screen is also the place to change the default shortcuts for taking a snapshot of the desktop, a specific area or defining the section for the screencast.

The same options available in the application window of SimpleShare are also available in the context menu of the app’s tray icon. Here you can even see a list of the data that has already been uploaded and access it online.

The Good

Getting data from your desktop to your Box.net account was already an easy job, but SimpleShare made it even easier. You just have to drop it in the interface and the upload process begins in an instant.

At the end of the transfer the link to the file is automatically placed in Windows Clipboard, so you can share it with others. You can take screenshots of your desktop and even video clips and get them online.

The Bad

Though the application is simple, it still lacks several features that would make its usage more comfortable. Making the transfer progress more visible and displaying the details of the job would be most welcomed in a future version of the product. A warning in the case of files exceeding the supported limit of a free account before starting the upload would also work well.

The Truth

All the problems SimpleShare seems to have are related to the lack of the proper features. It is the easiest upload managers we’ve seen. Further development should include at least minor adjustments to view the transfer progress.

Continue...