Two Romanians plead guilty to point-of-sale hacking

Sep 17, 2012 04:42 pm | IDG News Service

The two men were part of a conspiracy causing $10 million in losses from customers of Subway restaurants

by Grant Gross

Two Romanian men have pleaded guilty to participating in a US$10 million scheme to hack into the computers of hundreds of Subway restaurants in the U.S. and steal payment card data, the U.S. Department of Justice said.

Iulian Dolan, 28, of Craiova, Romania, pleaded guilty Monday to one count of conspiracy to commit computer fraud and two counts of conspiracy to commit access device fraud, and Cezar Butu, 27, of Ploiesti, Romania, pleaded guilty to one count of conspiracy to commit access device fraud, the DOJ said.

Dolan and Butu were two of four Romanians charged in December in U.S. District Court for the District of New Hampshire with hacking Subway point-of-sale computers.

In his plea agreement, Dolan has agreed to be sentenced to seven years, and Butu has agreed to be sentenced to 21 months in prison. 

The two men, in their guilty pleas, acknowledged participating in a Romanian-based conspiracy, lasting from 2009 to 2011, to hack into hundreds of U.S. point-of-sale (POS) computers, the DOJ said. Co-conspirator Adrian-Tiberiu Oprea is in U.S. custody and awaiting trial in New Hampshire. The group used stolen payment card data to make unauthorized charges or to transfer funds from the cardholders' accounts, the DOJ said.

The scheme involved more than 146,000 compromised payment cards and more than $10 million in losses, the DOJ said.

During the conspiracy, Dolan remotely scanned the Internet to identify vulnerable POS systems in the U.S. with certain remote desktop software applications (RDAs) installed on them, the DOJ said. Using these RDAs, Dolan logged onto the targeted POS systems over the Internet.  The systems were often password-protected and Dolan attempted to crack the passwords to gain administrative access. 

He then installed keystroke logging software onto the POS systems and recorded all of the data that was keyed into or swiped through the POS systems, including customers' payment card data, the DOJ said.

Dolan electronically transferred the payment card data to various electronic storage locations, called dump sites, that Oprea had set up, the DOJ said. Oprea later attempted to use the stolen payment card data to make unauthorized charges on, or transfers of funds from, the accounts, the DOJ alleged, and he attempted to sell the stolen payment card data to other co-conspirators. 

Dolan stole payment card data belonging to approximately 6,000 cardholders, the DOJ said. Dolan received $5,000 to $7,500 in cash and personal property from Oprea for his efforts, the DOJ alleged.

In his plea agreement, Butu said he repeatedly asked Oprea to provide him with stolen payment card data and that Oprea provided him with instructions for how to access the website where Oprea had stored a portion of the stolen payment card data, the DOJ alleged.

Butu later attempted to use the stolen payment card data to make unauthorized charges on, or transfers of funds from, the accounts. He also attempted to sell, or otherwise transfer, the stolen payment card data to other co-conspirators. Butu acquired stolen payment card data from Oprea belonging to approximately 140 cardholders, the DOJ alleged.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Read more »

Smartphones and tablets may be making you sleepless, fat and sick

Sep 17, 2012 04:26 pm | Computerworld

Using back-lit devices and laptops decreases melatonin, researchers find 

by Sharon Gaudin

Having trouble sleeping? Gaining a bit of weight?

Your smartphone or computer might be to blame.

Actually, the problem is more likely about your obsession with your laptop and devices than the devices themselves.

A new study from researchers at the Rensselaer Polytechnic Institute in Troy, N.Y. shows that even a two-hour exposure to any backlit device - smartphone, laptop, tablet - suppresses your body's ability to produce melatonin, which could cause sleeplessness, especially in teens and seniors.

Melatonin is a hormone that helps regulates the body's sleep clock.

The study also showed that exposure to back lighting over the course of "many consecutive" years could also lead to an increased risk for obesity and diabetes, as well as breast cancer.

"Technology developments have led to bigger and brighter televisions, computer screens, and cell phones," said university researcher Brittany Wood, who worked on the study. "This is particularly worrisome in populations such as young adults and adolescents, who already tend to be night owls."

Zeus Kerravala, an analyst with ZK Research, said he's not surprised that devices are affecting health because so many people are obsessive about them, constantly keeping them close by - even when they're sleeping.

"I can see that the obsession with Facebook, Twitter, text messages, e-mail and the other dozen or so ways to communicate is hurting our health," said Kerravala. "People used to disconnect from the outside world when they went to bed. They don't anymore. Almost everyone I know sleeps with their device no more than a few feet from their head so they don't miss out when something happens."

And when text messages or emails come in, devices buzz and light up with alerts. That means even during sleep, we're being bombarded with that electronic light.

To sleep better and head off other health issues, people should avoid using their devices at night -- especially, before bedtime. And they should not keep them beside the bed at the night.

"People need to want to disconnect," said Kerravala. "Plug the phone in another room to charge. Use an alarm clock as an alarm clock instead of your phone, and realize whatever is happening in the social media world can wait until tomorrow."

However, Kerravala noted that this will be a difficult change for a lot of people to make.

"I think we're really hooked," he noted. "The smart phone is like an addictive drug. The more you use it, the more you want it. It's almost like we need SPA (Smart Phone Anonymous) where we need counselors to help us."

University researchers said they're hopeful device manufacturers will be able to use this information to change the lighting in their devices so users won't be so affected by it.

Sharon Gaudin covers the Internet and Web 2.0, emerging technologies, and desktop and laptop chips for Computerworld. Follow Sharon on Twitter at @sgaudin, on Google+ or subscribe to Sharon's RSS feed. Her email address is sgaudin@computerworld.com.

See more by Sharon Gaudin on Computerworld.com.

Read more about smartphones in Computerworld's Smartphones Topic Center.

Read more »

House panel sets Friday hearing on probe of LightSquared deal

Sep 17, 2012 04:07 pm | IDG News Service

The House Energy and Commerce Committee wants to know whether the FCC followed its own rules

by Stephen Lawson

A subcommittee in the U.S. House of Representatives will hear testimony on Friday about whether the FCC followed its own rules when it gave LightSquared conditional approval for an LTE network early last year.

LightSquared wants to build a land-based 4G LTE network to complement its satellite-based mobile data system. In January 2011, the U.S. Federal Communications Commission gave the company the last major break it sought for the plan, but it demanded proof that the network wouldn't lead to interference with GPS receivers. Subsequent tests showed interference with some devices, and on Feb. 15 this year the FCC proposed steps that would kill LightSquared's plan.

Just two weeks later, the House Energy and Commerce Committee asked the relevant federal agencies for all of their communications about LightSquared. The panel questioned why regulators conditionally approved the network in the first place without learning more about the interference issue. In addition to the FCC, other agencies targeted in the probe include the National Telecommunications and Information Administration (NTIA) and the National Executive Committee for Space-Based Positioning, Navigation and Timing.

Friday's hearing, entitled "The LightSquared Network: An Investigation of the FCC's Role," will take place before the committee's Subcommittee on Oversights and Investigations. It will begin at 9:30 a.m. in Washington, D.C., and a link to a webcast will be available at the Energy and Commerce site, according to a notice by the committee.

LightSquared is no stranger to politics. Republicans, who control the House, in the past have accused the Obama administration of giving LightSquared preferential treatment in return for political contributions by Philip Falcone, whose Harbinger Capital Partners investment firm owns most of LightSquared.

After the FCC's negative ruling in February, LightSquared declared bankruptcy. The company is still proposing ways to make its network possible, such as a swapping some of its spectrum for another band. Last Wednesday, LightSquared executives met with an official from the office of FCC Commissioner Mignon Clyburn to discuss its ongoing pursuit of the network.

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Read more »

Android under fire again for poor vulnerability patching

Sep 17, 2012 03:37 pm | CSO

by Antone Gonsalves

Carriers and device managers continue to be slow at patching Android devices, as the number of malware targeting the mobile operating system soars, recent studies show.

Two security vendor reports released last week point to the continuation of a longstanding problem with Android devices. The platform remains the prime target for malware, yet there's no easy way for users to keep the software up to date with the latest patches.

In the latest findings, Duo Security collected results from 20,000 Android devices that users had scanned with the company's X-Ray vulnerability assessment tool, which became generally available a couple of months ago.

Based on the results, Duo estimates that more than half of Android devices worldwide have unpatched vulnerabilities.

"We feel this is actually a fairly conservative estimate based on our preliminary results, the current set of vulnerabilities detected by X-Ray, and the current distribution of Android versions globally," Jon Oberheide, Duo's chief technology officer, said in a blog post.

[In depth: Mobile device security - 5 questions to ask when creating policy (includes video)]

Duo's findings are in line with a Bit9 report released this year. The security vendor found that 56% of Android phones in the marketplace in 2011 were running out of date and insecure versions of the software. Device manufacturers found to be slow in upgrading phones included Samsung, HTC, Motorola, Sanyo, LG and Sony.

In the meantime, Sophos reported last week that the number of newly discovered malware for Android hasincreased 41 times this year over 2011, based on samples collected by the vendor's lab.

Almost half of the increase comes from a family of toll fraud malware targeting Eastern European markets. Toll fraud is when a malicious app secretly sends text messages from a hijacked phone to paid services. Cybercriminals typically get a cut of the generated revenue.

Closer to home, the biggest threat in the U.S. is new apps that contain aggressive advertising tactics that cross the privacy line. The more aggressive apps place links for sponsored apps in the phone's launcher area, display advertising even when the app is not running and send the user's personal information to the advertising server. These tactics are often in violation of Google's ad policy for Android.

Overall, the studies reinforce what security experts have known for years: Android fragmentation is an ongoing risk for users.

Unlike iOS, which only Apple controls on the iPhone and iPad, the Android market has many vendors using many versions of the platform. This translates into a mishmash of patching strategies made more complicated by carriers responsible for pushing out updates.

"Some carriers push out patches sooner than others, and some users install patches sooner than others," said Chenxi Wang, an analyst for Forrester Research. "No one should really be surprised that more than half of Android devices have unpatched flaws. Would the situation get better any time soon? I don't see it."

While no easy solution is in sight, Android malware is on the rise, which increases the risk to users with unpatched phones, Wang said. However, mobile malware is not at the level of maturity as malicious apps built to exploit vulnerabilities in PCs, so the danger to Android users is far less.

"You can survive not having updated your phone OS for some time, but you cannot survive if you don't update your [antivirus] or OS patches for your PC," Wang said.

The level of risk to Android users is a longstanding debate in the industry. While antivirus vendors are a steady source of threat research, Google has said they are hyping the risk to sell their products.

Read more about wireless/mobile security in CSOonline's Wireless/Mobile Security section.

Read more »

FCC rules that cable operators can buy local phone carriers

Sep 17, 2012 02:47 pm | IDG News Service

The agency relaxes rules against acquisitions contained in the 1996 Telecom Act at the request of cable operators

by Grant Gross

The U.S. Federal Communications Commission has waived restrictions that prevented cable operators from acquiring local telephone carriers, saying those mergers could lead to stronger competition to large telecom carriers for business customers.

The FCC on Monday approved a request by trade group the National Cable & Telecommunications Association (NCTA) to relax rules in the Telecommunications Act of 1996 that prohibited cable firms from acquiring more than a 10 percent stake in any local exchange carrier within the cable firm's franchise area, with some exceptions.

The '96 Act, as the law is called, attempted to preserve competition between cable providers and telecom carriers, the FCC noted in its ruling. But relaxing the rules for cable firms to acquire some local telecom carriers, called competitive local exchange carriers or CLECs, could create competition for the dominant, incumbent carriers, often called ILECs.

The decision to allow the acquisitions "will likely speed the entry of cable operators into the market for telecommunications services provided to business customers," FCC staff wrote in the ruling. "Alliances between competitive LECs and cable operators can merge these entities' complementary capabilities, resulting in increased facilities-based competition."

The NCTA argued the prohibition does not make competitive sense. The trade group argued that the '96 Act did not prohibit cable operators from acquiring CLECs, but only incumbent telecom providers. The FCC rejected that argument, and denied the NCTA's request for the agency to permanently overturn the rules, but the FCC decided to suspend the rule.

The ruling should lead to more competition, said Robert McDowell, a commissioner at the FCC. "Consumers will benefit from the increased efficiencies springing from strategic combinations between cable companies and competitive local telecom companies," he said in a statement. "This forbearance order promotes good public policy because it should spur competition in the telecommunications marketplace."

The NCTA praised the decision, saying it removed "outdated obstacles that have historically deterred pro-competitive transactions" between cable firms and CLECs. The NCTA's request for the change was prompted by one proposed merger that was rejected by a local cable franchising authority, a spokesman said.

Other groups said they were disappointed in the decision. After the FCC's August approval of a dealallowing Verizon Communications to buy wireless spectrum from a group of cable operators, "it's disappointing to see the commission scaling back these protections, too," said Matt Wood, policy director for Free Press, a digital rights group.

"We need real competition policies to spur the deployment and adoption of affordable broadband services," Wood added in an email. "We hope this so-called streamlining of the agency's review process will not merely transplant the duopolies we already see in the residential broadband market into the business market, which until now has been one of the few places that competitive carriers maintain a foothold and offer an alternative to big phone and cable."

The Independent Telephone and Telecommunications Alliance (ITTA), a trade group representing midsized telecom carriers, also raised concerns about the FCC's action.

The NCTA's request for the relaxed rules "in order to be able to compete more effectively against the 'big bad' ILECs, is a gross mischaracterization of the current communications marketplace," Genny Morelli, president of ITTA, said in an email. "In many markets, large, nationwide, vertically-integrated cable conglomerates have come to dominate the market for the bundled service packages favored by most consumers today."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Read more »

Zuora launches app suite for subscription businesses

Sep 17, 2012 02:36 pm | IDG News Service

The offering includes a new finance module to go along with Zuora's billing and commerce cloud software

by Chris Kanaracus

Zuora, a cloud application startup focused on products that serve subscription-based businesses, announced Monday that it has added a finance module to its previously released billing and commerce software and is selling the trio as a suite called Z-Business.

There are millions of businesses based on a subscription model, and they go well beyond magazines, wine-of-the-month clubs and digital content, said Zuora CEO Tien Tzuo. He pointed to companies such as Rent the Runway, which allows customers to rent high-end fashions on a subscription basis, as well as Kiwi Crate, which provides regular deliveries of arts and crafts products for kids.

The core point is that these companies are building deeper, ongoing relationships with customers, versus dealing with them transaction by transaction, Tzuo said.

Zuora's billing and commerce software has helped such companies handle two aspects of their businesses, but it turns out that finance presents challenges to subscription businesses as well, according to Tzuo. "Finance hasn't changed since double-entry bookkeeping was invented," he said. "That's worked well for 500 years. It doesn't work anymore."

For one thing, recurring revenue and expenses have to be recorded and tracked differently than one-time sales and costs, according to the company's announcement.

Subscription companies are dealing with these problems, but in a painful and time-consuming manner, according to Tzuo. "What we're finding is more and more of the finance department is seeping out into a phantom accounting system called Microsoft Excel," he said.

Z-Business and the finance module will help these companies crunch their subscription numbers and get them into the general ledger more easily, according to Zuora.

About 20 Zuora customers have been using the new finance component, including a large telco in Singapore, Tzuo said.

Z-Business pricing starts at $30,000 a year for the Growth edition, aimed at smaller companies, and $100,000 for the enterprise version. Existing billing and commerce customers can upgrade when they like to Z-Business, and Zuora will make "a sweet deal for them," Tzuo said.

Zuora made the announcement as it holds its Subscribed 2012 user conference in San Francisco.

Chris Kanaracus covers enterprise software and general technology breaking news for The IDG News Service. Chris' email address is Chris_Kanaracus@idg.com

Read more »

Cisco takes its lumps, keeps developing video meeting tools

Cisco Systems owned up to some miscalculations in its video collaboration strategy but showed off some promising future capabilities in a briefing with media this week.

The company's video meeting business is best known for its TelePresence Meeting Systems, especially the high-profile three-screen meeting rooms that include Cisco-designed furniture and cost hundreds of thousands of dollars. But Cisco is now looking beyond those swanky environments toward mobile devices that can bring video meetings to participants wherever they are.

One platform intended as part of that strategy, the company's Android-based Cius tablet, has been cut from future development plans, said Barry O'Sullivan, senior vice president and general manager of the Collaboration Technology Group, during the briefing at Cisco on Thursday afternoon. Cisco discussed the move in a blog post later on Thursday. The Cius will still be available for companies that specifically want a device issued and tightly controlled by the IT department, but Cisco won't be developing more form factors for the platform, O'Sullivan said.

Cisco now acknowledges most enterprises let employees bring their own tablets to work, citing its own survey that said 95 percent of companies have a BYOD (bring your own device) policy.

"When we talk to them about the Cius tablet, they say, we love the collaboration experience on Cius, but can you please take that software and put it on other devices?" O'Sullivan said.

"Our strategy for the future is all about software," O'Sullivan said.

The next chapter in that push is a new client for Jabber, Cisco's voice, video, instant-messaging and presence platform, coming this summer. Jabber clients are already available for Apple iOS and for Research In Motion's BlackBerry platform, as well as Windows PCs, and will soon come out for general Android tablets, he said.

The new Jabber client will allow users to take video calls on PCs, tablets and Cisco TelePresence systems and transfer the calls from one platform to another. Cisco APIs (application programming interfaces) allow Jabber functions to be integrated into Microsoft Outlook so users can find contacts and start Jabber calls from Outlook, and this integration will be expanded in the new versions.

At the briefing, Cisco demonstrated Jabber sessions being moved among different platforms. It also showed users of third-party videoconferencing systems, including Microsoft Lync and a Polycom HDX system, becoming full participants in a Cisco TelePresence meeting. Cisco's inclusion of industry standards including SIP (Session Initiation Protocol), H.323 and H.264 make this possible, the company said.

The full-scale TelePresence platform is still marching forward despite the new emphasis on bringing in diverse clients. And real-time translation of telepresence meetings is back on Cisco's roadmap.

In late 2008, Cisco video chief Marthin De Beer said that he expected that feature to go on sale with 20 languages in the second half of 2009. But a year later, Cisco said the system's accuracy wasn't high enough and the company didn't even have a forecast for when it would go on sale.

Cisco is still working on it, said De Beer, now senior vice president of Cisco's Video and Collaboration Group.

"It's coming along. It's not quite real-time yet," De Beer said. "It's a little bit too expensive still to do that and the technology's not ... perfected enough." But De Beer once again expects the feature to be commercially available within a year or two. Cisco does offer translation of a recorded meeting within a few minutes, he said.

The Cisco TelePresence systems already installed in enterprises are being used about six hours per day on average, De Beer said. But new mobile video options may be hurting another business Cisco once promoted as a big potential market, of videoconferencing suites for rent in hotels and airports, he said.

"It is being used. It has not gone pervasive, it has not gone big," De Beer said. "We've sold probably hundreds of units in that space." The Marriott hotel chain has set up suites in multiple of its locations, he said. But the rentals, which in some cases were priced at hundreds of dollars per hour, may not be necessary down the road.

"Now that video becomes pervasive on your iPad, on your smartphone and your PC, maybe that use case will actually diminish," De Beer said.

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Read more »

Rehearsals over, IPv6 hits Broadway June 6

IPv6 will go fully live on June 6. That's the date when 50-plus access networks and more than 2,500 websites -- including Google, YouTube, Facebook and Yahoo -- will turn on support for the long-anticipated upgrade to the Internet's main communications protocol and leave it on for good.

World IPv6 Launch Day is being coordinated by the Internet Society, which is promoting IPv6 as the best strategy for ensuring that the Internet continues to grow as address space becomes increasingly scarce with IPv4, the original version of the Internet Protocol.

Participants in World IPv6 Launch Day are trying to drive home the message to techies worldwide that it's time to start deploying IPv6.

"If you've been waiting to deploy IPv6, there is no reason to continue waiting," says Leslie Daigle, chief Internet technology officer with the Internet Society (ISOC). "There are customers who will view your website over IPv6 now. It isn't experimental. It's out there for real."

BACKGROUND: Leading ISPs, websites commit to June 6 start date for IPv6

Some of the largest ISPs have signed on for World IPv6 Day, including Comcast, AT&T, VerizonWireless and Time Warner here in the United States. Each has agreed to enable IPv6 for 1% of their subscribers by Wednesday.

"One percent was chosen as a metric because it is a big deal," Daigle explains. "It represents a serious commitment by the network operators to provide IPv6. In order to get to 1%, you have to have IPv6 enabled on a considerably larger percentage of your customer base because not everybody has a home router that can do IPv6 or equipment that is configured to use IPv6. To get to 1%, [one ISP executive] estimates that you have to have 10% or more of your network enabled."

Comcast met its goal of IPv6-enabling 1% of its subscribers on May 24. 

"We've launched IPv6 to a third of our network at this point," said John Brzozowski, chief architect for IPv6 and distinguished engineer with Comcast. "We will be deploying it to the rest of our network over the balance of this year and likely beyond 2012. At this point, the momentum is there for IPv6, and we are making significant strides in penetration and the number of people that have IPV6 available to them."

Equally significant is the participation by content delivery networks such as Akamai and Limelight.Akamai carries between 20% and 30% of the Internet's Web traffic on any given day, so its support of IPv6 is a boon for the new protocol. Among Akamai's customers are Apple, Lands' End, Ticketmaster and Travelocity.

World IPv6 Launch Day is designed to "send enough IPv6 traffic toward content providers to give them confidence that the big access providers are serious about IPv6 and that they should leave it on at their front doors," Daigle says.

Thousands of popular websites have agreed to permanently enable IPv6 by Wednesday. Some, including Facebook, have already turned on IPv6 in production mode. Other World IPv6 Launch Day participants include: consumer-oriented websites such as Bing and Netflix; U.S. government agencies including NASA and the Census Bureau; universities such as Indiana University and the University of Pennsylvania; and network vendors such as Cisco and Check Point.

"World IPv6 Launch Day is a lot larger than people understand," says John Curran, president and CEO of the American Registry for Internet Numbers (ARIN), which doles out IPv4 and IPv6 addresses to network operators in North America. "It's not a small decision for the major content providers to turn on IPv6 and leave it on. From now on, everything they roll out will be on IPv4 and IPv6."

Additionally, four home networking equipment manufacturers -- Cisco, D-Link, NDM Systems and ZyXel Communications -- have agreed to enable IPv6 by default on their home router products by the June 6 deadline.

"There are other home router vendors that are mostly there [with IPv6 support] but for one reason or another haven't gone through the certification process," Daigle says. "We have definitely met our mark in terms of raising awareness with the CPE equipment vendors that IPv6 is real."

Created in 1998 by the Internet Engineering Task Force, IPv6 offers an expanded addressing scheme but is not backward compatible with IPv4. While IPv4 uses 32-bit addresses and can support 4.3 billion devices connected directly to the Internet, IPv6 uses 128-bit addresses and can connect up a virtually unlimited number of devices: 2 to the 128th power.

The Internet needs IPv6 because it is running out of IPv4 address space. The free pool of unassigned IPv4 addresses expired in February 2011, and in April 2011 the Asia-Pacific region ran out of all but a few IPv4 addresses being held in reserve for startups. The European registry is expected to deplete its supply of IPv4 addresses in August, and ARIN next summer.

Network and website operators have two choices when it comes to IPv6: They can either support both protocols in what's called dual-stack mode, or translate between IPv4 and IPv6. Until now, most have been unwilling to make the upgrades required to support IPv6 because IPv6 traffic has been so scarce.

That's expected to change after June 6, when IPv6 traffic is expected to surge. While the most recent estimates are that IPv6 represents less than 0.5% of all Internet traffic, participants in World IPv6 Launch Day are hoping to drive IPv6 up to 1% or more of Internet traffic.

BACKGROUND: Lack of IPv6 traffic stats makes judging progress difficult

"One [college] campus expects that on June 6, 50% percent of its network traffic will be IPv6 because its top four most-visited sites are participating in World IPv6 Launch Day," Daigle says. "It might surprise some enterprises how much IPv6 traffic they will see if their users are going to Google, Facebook or Yahoo."

The anticipated surge of IPv6 traffic after June 6 is expected to bring new security threats along with it.

In February, Arbor Networks reported the first-ever IPv6-based distributed denial-of-service attacks. While IPv6 security incidents remain rare, experts predict that as more Internet traffic flows over IPv6, DDoS attacks, malware and other threats will follow.

Experts say enterprise network managers should upgrade their DDoS detection, intrusion protection and deep packet inspection systems to support IPv6.

"It's time for the enterprise to make sure that their security devices are IPv6-enabled, that they have the ability to look at IPv6 traffic and to create rules for it and do intrusion detection," advises Bob Hinden, one of the creators of IPv6 and a Check Point fellow. "Most host operating systems -- Windows Vista, 7, Mac OS, Linux, IOS and Android -- all have IPv6 in them. Even though they may not think they have IPv6 turned on, there might be tunneled traffic coming from outside their enterprise. It's important that the enterprise know what's going on with IPv6 in their network."

Read more about lan and wan in Network World's LAN & WAN section.

Read more »

Cerf: IPv6 'launch' was 20 years in the making

The official World IPv6 Launch event, which began at 8 p.m. EDT yesterday, passed with little if any attention from the typical Internet user. For some in the Internet engineering community, however, the day marked the culmination of two decades' worth of work.

SLIDESHOW: Why the Internet needs IPv6

"For some of us, it's been 20 years since we began working on next-generation IPNG, which ultimately became IPv6," says Google chief Internet evangelist Vint Cerf, who created a fully dual-stacked IPv4/IPv6 network for the National Science Foundation as long ago as 1995.

Work on the IPv6 project has quickened substantially in recent years, and the success of last year's IPv6 test day proved an encouraging prelude to yesterday's nearly trouble-free endeavor.

Nevertheless, there's still a lot of work to be done, according to Cerf. One of the key advantages of IPv6 is its ability to provide direct point-to-point connectivity, rather than routing everything through central intermediaries.

"A phone call, for example, has the property that when you dial a number, the guy at the other end's phone rings. You don't have to go to a rendezvous point, you don't have to have logged in, you don't have to do any of the things we do today with chat and things like that," he says. "With IPv6, we are going to reinvent the IPv4 system as it was when it was first designed and built, where anybody could initiate a connection to anybody else, as opposed to going through some intermediary or going through a Webserver."

The concept of the "Internet of things," according to Cerf, is another one that IPv6 will enable, and he hasn't been slow to embrace it himself.

"I'm running a v6 network in my house right now that's monitoring the state of temperature, humidity and light levels in every room in the house every five minutes and then storing that data in a server down in the basement. ... That data now gives me very, very good engineering information about how well the heating, ventilation and air-conditioning systems work all year round," he says.

Cerf says that IPv6 usage should grow quickly moving forward.

"I hope over the course of the next six months that we'll get a better sense of how rapidly the capability spreads. Most of the time, the edge devices [routers and switches] already have [IPv6] capability, it's just that the ISPs haven't turned it on," he says.

Email Jon Gold at jgold@nww.com and follow him on Twitter at @NWWJonGold.

Read more »

Top-Level Domain Name Grab: ICANN Reveals Results

From .app to .blog and .google to .windows, corporations are staking their claims on a new set of top-level domain names, which will be issued by the Internet Corporation for Assigned Names and Numbers (ICANN).

On Wednesday, ICANN released the full list of top-level domain names for which it's received applications. On the list of 1930 applications are lots of huge companies, staking claims on domain extensions such as .visa, .toyota, and .mcdonalds.

Companies are also seeking control of generic terms, such as .hotel, .pizza and .football--in some cases with multiple companies vying for the same domain. If these companies can't settle on who gets what, ICANN will ultimately have to decide through a set of string contention procedures.

Not surprisingly, major Internet companies are among the biggest applicants for the new top-level domains. Google, for instance, seeks more than 101 top-level domains including .android, .youtube and .search. Amazon wants to claim 76 domains for its own, including .amazon, .kindle and .video. Apple has only applied for one top-level domain: .apple.

What's the point of having your own top-level domain? As Forbes reports, companies may want to use these extensions for security or promotional purposes. For instance, a bank could tell customers to look for the company's name at the end of a URL to know they're in the right place. A consumer brand such as Nike could host user-generated pages under its own top-level domain, so brand loyalists could have simple, Nike-branded fitness pages to call their own.

But not everyone is convinced this is a good idea. Matt Ingram, writing for GigaOM, calls the process a “train wreck” that will cause unnecessary chaos. He notes that companies will have to spend time and effort (not to mention money, at $185,000 per domain application) just to acquire any name that might be associated with their business. The new domains could also create conflicts if ICANN hands out generic terms to specific companies. For instance, Ingram argues, Amazon could theoretically control who gets to use .book in their URLs.

For average Internet users, though, the real issue might be familiarity. Today, most companies stick with .com, .net or .org. Even the rare exceptions that already exist, such as .biz and .co, cause confusion. (Quick, how many Websites do you know of that use either extension?) Looking at the full list of applied-for names, it's hard not to feel overwhelmed by all the possibilities.

In any case, the expansion of top-level domains is inevitable, as ICANN plans to bring the first batch online in early 2013, The Guardian reports. Ultimately, it will be up to the applicants to use them in useful, memorable ways--not as Internet vanity plates.

Follow Jared on Twitter, Facebook or Google+ for even more tech news and commentary.

Read more »

Oracle buys Xsigo for software-defined networking

Oracle said Monday it has inked a deal to buy software-defined networking vendor Xsigo Systems, in a move that will support Oracle's ongoing foray into cloud computing. Terms of the acquisition, which is expected to close within a few months, were not disclosed.

The announcement comes a week after VMWare said it would buy Xsigo competitor Nicira for US$1.26 billion.

Software-defined networking has become one of the hottest topics in the networking industry of late.

Xsigo's technology can create virtualized pools of networking capacity, allowing resources to be delivered dynamically according to computing needs, and used much more efficiently, according to its website.

Its customers include Verizon, Softbank and British Telecom.

Xsigo's tools will be combined with Oracle's Oracle VM server virtualization technology, according to a statement.

This year, Oracle began moving aggressively into cloud computing with a public cloud service that will deliver on-demand business applications as well as a Java PaaS (platform as a service) and cloud database.

Oracle's approach to cloud computing relies heavily on virtualization. While the Xsigo acquisition seems focused on increasing performance and cost savings within Oracle's data centers, the vendor is also seeking to use virtualization as a point of differentiation.

For example, Oracle CEO Larry Ellison [cq] has criticized the multitenant software architectures used by many cloud vendors, which allow a number of customers to share a single application instance.

On Oracle's cloud, applications get their own virtual machines, both for more flexibility over upgrades and for additional security, Ellison said during an event earlier this year. "Modern virtual technology is how we offer safety."

Chris Kanaracus covers enterprise software and general technology breaking news for The IDG News Service. Chris's e-mail address is Chris_Kanaracus@idg.com

Read more »

HP aims three-part effort at network virtualization

Hewlett-Packard is readying three new software capabilities that are designed to help enterprises pool their computing and storage resources across a network.

The advances should make it easier for IT departments to link data centers spread around the world, shield multiple tenants' virtual machines from each other and control storage from virtualized appliances.

HP is adding the features to its HP Converged Infrastructure arsenal, which is part of the company's SDN (software-defined networking) strategy, according to Kash Shaikh, director of marketing for HP Networking. In at least one case, it's positioning the technology directly against products from Cisco Systems, which is its main rival as SDN takes shape.

To combine geographically dispersed data centers into a virtual whole so data and virtual machines can be moved among them, HP plans to introduce later this year its HP EVI (Ethernet Virtual Interconnect) software. EVI will take what has been a complex, months-long project and reduce it to a "single touch" task that takes just minutes, Shaikh said. EVI is a feature coming to HP's 12500 Switch Series that will ship on future switches and be available free to current customers. It can link as many as eight data centers.

Moving VMs across a data center requires switched Layer 2 networking, but most wide-area networks use Layer 3 routing. To overcome this barrier, EVI creates a tunnel through the Layer 3 network by encapsulating the packets traveling between the data centers, Shaikh said. Rival Cisco already has software that can do this, called OTV (Overlay Transport Virtualization), but it charges extra for that software, Shaikh said.

Another software enhancement to the 12500 switch, called MDC (Multitenant Device Context), allows for segregating the resources of multiple tenants in a virtualized environment without buying separate switches. This secures the data and applications of one department or cloud service customer from other tenants.

It's possible to do this now, but it typically requires a separate physical switch for each tenant, Shaikh said. Other methods, such as multiple virtual LANs, don't guarantee the security that's needed, he said.

MDC can create separate logical switches within a 12500 switch, each dedicated to one tenant. The switches are completely isolated from each other, according to Shaikh. This has the same effect as setting up separate switches but reduces hardware cost and complexity, he said. MDC also works with EVI, so multiple tenants can take advantage of resources across many data centers, he said.

HP is also set to release a new product next month, called StoreVirtual VSA, for virtualizing storage management. The software is based on VSA (virtual storage appliance) technology from LeftHand Networks, which HP acquired in 2008.

VSA puts the functions of a physical storage appliance into a VM, allowing users to manage storage volumes without dedicated hardware that takes up space and power. The virtual appliance and the volume it manages appear to an administrator like a physical storage node. StoreVirtual VSA can run on any x86-based server platform and work with a mix of VMware and Hyper-V hypervisors. That cross-vendor capability sets it apart from other products on the market, said Dale Degen, SAN marketing manager for HP Storage.

The idea behind the StoreVirtual software is to bring the benefits of virtualization, including flexibility and cost and power savings, to storage management. It includes features for resiliency and can work with information-protection tools, according to HP. Virtualizing these capabilities can cut costs and power consumption significantly, the company says. LeftHand originally aimed this technology at remote offices and small and medium-sized businesses, but it's becoming attractive to larger organizations too, according to Degen.

At this point, StoreVirtual VSA is intended mainly for direct-attached storage, Degen said. But he sees the launch of the product, which is due to ship in September starting at US$700 per license, as a coming-of-age moment for the LeftHand technology. HP will continue to invest in the product and is working on additional features for higher capacity and performance, he said.

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Read more »

AT&T suffers DNS outage

Some AT&T customers are being affected by a failure in the carrier's DNS (Domain Name System) servers that began Wednesday morning.

Initial reports indicate the failure is hitting companies across the U.S., but few details are immediately available.

"We are currently experiencing DNS issues which could affect DMS (Digital Media Solutions) clients who also host their DNS with ATT," the carrier said in a short message posted to a service status on its Managed Services website. "Our Network Operations team is aware of the problem and is working the issue."

"Our highest level of technical support personnel have been engaged and are working to mitigate the issue," AT&T said.

The status message said there is "no estimated time" for restoring the service.

AT&T did not respond to several requests for comment.

DNS is responsible for converting human-friendly domain names into the numeric IP (Internet protocol) addresses that computers use to route data. When it fails, computers are unable to route data to its intended destination, even though the destination server remains online and accessible.

"We got our first report of problems at 6:31am Pacific time," said Daniel Blackmon, director of software development, at Worldwide Environmental Products. The company tests vehicle emissions and has remote units deployed that report back to central servers.

"The problems mean none of the equipment we have in the field can contact our servers, and there is a limit to the amount of information they can hold offline."

(More to come)

Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news forThe IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address ismartyn_williams@idg.com

Read more »