Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-08 Thread Valdis . Kletnieks
On Thu, 04 Feb 2010 15:04:22 PST, andrew.wallace said: On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept Gadi Evron has

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-08 Thread andrew.wallace
On Mon, Feb 8, 2010 at 6:37 PM, valdis.kletni...@vt.edu wrote: You apparently fail to understand that making other people's research well known in the community is an important role. Would we be more secure, or less secure, if somebody did the research, but then nobody told the owners of

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-05 Thread andrew.wallace
- Original Message From: Brian Keefer ch...@smtps.net To: NANOG list nanog@nanog.org Cc: a.harrow...@gmail.com; andrew.wallace andrew.wall...@rocketmail.com Sent: Fri, 5 February, 2010 1:55:58 Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations Andrew

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-05 Thread Mark Smith
On Thu, 4 Feb 2010 16:47:47 -0600 Jorge Amodio jmamo...@gmail.com wrote: I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? I worked with an IPsec VPN product around 10 years ago that used SNMPv3 for automated provisioning of the tunnels. Regards

lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Gadi Evron
That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and explain the approach a bad guy would take to getting access without authorization. I’ll identify several aspects of the design and implementation

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 3:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and explain the approach a bad guy would take to getting access without

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
(of course for any LEA that really cares they'll just order a phyiscal tap, and provision things properly)

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Tony Varriale
intercept/IOS at BlackHat DC, bypassing and recommendations On Thu, Feb 4, 2010 at 3:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and explain

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Crist Clark
On 2/4/2010 at 12:27 PM, Christopher Morrow morrowc.li...@gmail.com wrote: On Thu, Feb 4, 2010 at 3:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark crist.cl...@globalstar.com wrote: this seems like much more work that matt blaze's work that said: Just send more than 10mbps toward what you want to sneak around... the LEA's pipe is saturated so nothing of use gets to them The Cross/XForce/IBM

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Jorge Amodio
I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? Regards

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Steven Bellovin
On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark crist.cl...@globalstar.com wrote: this seems like much more work that matt blaze's work that said: Just send more than 10mbps toward what you want to sneak around... the LEA's pipe is

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread andrew.wallace
On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and explain the approach a bad guy would take to getting access without

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread a . harrowell
-original message- Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations From: andrew.wallace andrew.wall...@rocketmail.com Date: 04/02/2010 11:09 pm On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron g...@linuxbox.org wrote: That peer-review is the basic purpose of my

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread andrew.wallace
On Thu, Feb 4, 2010 at 11:25 PM, a.harrow...@gmail.com wrote: -original message- Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations From: andrew.wallace andrew.wall...@rocketmail.com Date: 04/02/2010 11:09 pm On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron g

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Dan White
On 04/02/10 15:58 -0800, andrew.wallace wrote: CITATION NEEDED You can goto Full-disclosure mailing list http://www.grok.org.uk/full-disclosure/ and ask about Gadi Evron. There will be plenty folks there who will tell you he is involved in plagiarism. Andrew Security consultant That's

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Brian Keefer
Andrew Security consultant CITATION NEEDED You can goto Full-disclosure mailing list http://www.grok.org.uk/full-disclosure/ ... Andrew Security consultant For clarity and transparency you were banned from that list for trolling under the persona n3td3v. -- bk

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:47 PM, Jorge Amodio jmamo...@gmail.com wrote: I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? sadly, if you are present in the US and you do ip services (public ones) and you deployed a cisco device + calea capabilites, yes you do! :( -chris

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:49 PM, Steven Bellovin s...@cs.columbia.edu wrote: On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark crist.cl...@globalstar.com wrote: this seems like much more work that matt blaze's work that said: Just send more

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Steven Bellovin
On Feb 4, 2010, at 9:26 PM, Christopher Morrow wrote: On Thu, Feb 4, 2010 at 5:49 PM, Steven Bellovin s...@cs.columbia.edu wrote: On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark crist.cl...@globalstar.com wrote: this seems like much

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Marcus Reid
On Thu, Feb 04, 2010 at 09:42:24PM -0500, Steven Bellovin wrote: I can make a very good case that CALEA was not just originally intended for voice, but was sold to Congress as something that didn't apply to data networks. The EFF has said it better than I could, though, so look at