Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-08 Thread andrew.wallace
On Mon, Feb 8, 2010 at 6:37 PM, wrote: > You apparently fail to understand that making other people's research well > known in the community is an important role. Would we be more secure, or > less secure, if somebody did the research, but then nobody told the owners > of all that Cisco gear ab

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-08 Thread Valdis . Kletnieks
On Thu, 04 Feb 2010 15:04:22 PST, "andrew.wallace" said: > On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron wrote: > > "That peer-review is the basic purpose of my Blackhat talk and the > > associated paper. I plan to review Cisco’s architecture for lawful > > intercept > Gadi Evron has absolutely n

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-06 Thread isabel dias
ound for a gd while ... --- On Sat, 2/6/10, Mark Smith wrote: > From: Mark Smith > Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and > recommendations > To: "Jorge Amodio" > Cc: "NANOG" > Date: Saturday, February 6, 2010, 6:45 AM &g

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-05 Thread Mark Smith
On Thu, 4 Feb 2010 16:47:47 -0600 Jorge Amodio wrote: > I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? > I worked with an IPsec VPN product around 10 years ago that used SNMPv3 for automated provisioning of the tunnels. > Regards >

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-05 Thread andrew.wallace
- Original Message From: Brian Keefer To: NANOG list Cc: a.harrow...@gmail.com; andrew.wallace Sent: Fri, 5 February, 2010 1:55:58 Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations >>> Andrew >>> >>> Security consul

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Marcus Reid
On Thu, Feb 04, 2010 at 09:42:24PM -0500, Steven Bellovin wrote: >I can make a very good case that CALEA was not just originally intended > for voice, but was sold to Congress as something that didn't apply to data > networks. The EFF has said it better than I could, though, so look at > ht

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Steven Bellovin
On Feb 4, 2010, at 9:26 PM, Christopher Morrow wrote: > On Thu, Feb 4, 2010 at 5:49 PM, Steven Bellovin wrote: >> >> On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: >> >>> On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark >>> wrote: >>> > this seems like much more work that matt blaze's

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:49 PM, Steven Bellovin wrote: > > On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: > >> On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark >> wrote: >> this seems like much more work that matt blaze's work that said: >>> "Just send more than 10mbps toward what yo

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:47 PM, Jorge Amodio wrote: > I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? sadly, if you are present in the US and you do ip services (public ones) and you deployed a cisco device + calea capabilites, yes you do! :( -chris

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Brian Keefer
>>> Andrew >>> >>> Security consultant >> >> CITATION NEEDED >> > > > You can goto Full-disclosure mailing list > http://www.grok.org.uk/full-disclosure/ ... > Andrew > > Security consultant For "clarity and transparency" you were banned from that list for trolling under the persona "n3td

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Dan White
On 04/02/10 15:58 -0800, andrew.wallace wrote: CITATION NEEDED You can goto Full-disclosure mailing list http://www.grok.org.uk/full-disclosure/ and ask about "Gadi Evron". There will be plenty folks there who will tell you he is involved in plagiarism. Andrew Security consultant That'

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread andrew.wallace
On Thu, Feb 4, 2010 at 11:25 PM, wrote: > -original message- > Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and > recommendations > From: "andrew.wallace" > Date: 04/02/2010 11:09 pm > > On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron wrote: >> &

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread a . harrowell
-original message- Subject: Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations From: "andrew.wallace" Date: 04/02/2010 11:09 pm On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron wrote: > "That peer-review is the basic purpose of my Blackhat talk and the > ass

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread andrew.wallace
On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron wrote: > "That peer-review is the basic purpose of my Blackhat talk and the > associated paper. I plan to review Cisco’s architecture for lawful intercept > and explain the approach a bad guy would take to getting access without > authorization. I’ll iden

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Steven Bellovin
On Feb 4, 2010, at 5:42 PM, Christopher Morrow wrote: > On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark > wrote: > >>> this seems like much more work that matt blaze's work that said: >> "Just >>> send more than 10mbps toward what you want to sneak around... the >>> LEA's pipe is saturated so noth

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Jorge Amodio
I'm totally ignorant (most of the time), is anybody actually using SNMPv3 ? Regards

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 5:26 PM, Crist Clark wrote: >> this seems like much more work that matt blaze's work that said: > "Just >> send more than 10mbps toward what you want to sneak around... the >> LEA's pipe is saturated so nothing of use gets to them" > > The Cross/XForce/IBM talk appears more

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Crist Clark
>>> On 2/4/2010 at 12:27 PM, Christopher Morrow wrote: > On Thu, Feb 4, 2010 at 3:19 PM, Gadi Evron wrote: >> >> "That peer-review is the basic purpose of my Blackhat talk and the associated > paper. I plan to review Cisco’s architecture for lawful intercept and explain > the approach a bad guy

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Tony Varriale
Would you mind passing along a source/link on the 15kpps? I haven't seen that number yet. tv - Original Message - From: "Christopher Morrow" To: "Gadi Evron" Cc: "NANOG" Sent: Thursday, February 04, 2010 2:27 PM Subject: Re: lawful intercep

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
(of course for any LEA that really cares they'll just order a phyiscal tap, and provision things properly)

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Christopher Morrow
On Thu, Feb 4, 2010 at 3:19 PM, Gadi Evron wrote: > > "That peer-review is the basic purpose of my Blackhat talk and the associated > paper. I plan to review Cisco’s architecture for lawful intercept and explain > the approach a bad guy would take to getting access without authorization. > I’ll

lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Gadi Evron
"That peer-review is the basic purpose of my Blackhat talk and the associated paper. I plan to review Cisco’s architecture for lawful intercept and explain the approach a bad guy would take to getting access without authorization. I’ll identify several aspects of the design and implementation o