Avaya promises near-term support for Nortel gear

Nortel enterprise customers will be able to buy the company's current line of products for 12 to 18 months after Avaya officially takes ownership of Nortel's enterprise division that it won at auction for $900 million. Support for Nortel gear will continue throughout that transition, an Avaya spokesperson says. Slideshow: The rise and fall of Nortel    After that period, Avaya says it will have a migration path laid out that customers can follow to bring themselves into Avaya's official product line. Because the two companies' products overlap, some analysts think the deal was more about customers than it was technology.

Regardless of the migration path, Avaya says it will honor three- to five-year product support for all customers. Task forces from both companies will be tapped to figure out what products make the most sense to keep and which ones need to be merged. The company says the product road map for the expanded Avaya will be ready 30 days after the deal is officially closed. The contracts in question extended to Verizon customers through its services business. Avaya says it will honor all Nortel's service contracts including those that Verizon claimed in a legal filing would be canceled.

Verizon sought last week to get Avaya removed from the auction for Nortel's enterprise division. The customers will receive service," an Avaya spokesperson says. The last-minute appeal claimed Avaya intended to toss out the contracts and that would result in national security issues because some of the gear was supplied to critical governmental agencies. "We intend to fulfill the contract that is the subject of their filing. Long term Avaya says it will rely on its Aura Session Manager platform to unify customers' Session Initiation Protocol-based communications gear into a single system. Because Avaya Aura is compatible with Nortel's open architecture, customers will be able to build multi-vendor environments without requiring a swap-out to all-Avaya equipment.

Aura already supports Nortel gear as well as products from major VoIP vendors Alcatel-Lucent, Cisco, Mitel, NEC, Nortel, ShoreTel and Siemens. As for R&D, Avaya says the Nortel and Avaya resources are complementary enough to help the combined company bring new products to market more quickly.

Microsoft Internet Explorer SSL security hole lingers

Microsoft still does not acknowledge a weakness in its Internet Explorer browser that was pointed out seven weeks ago and enables attackers to hijack what are supposed to be secure Web sessions. If Microsoft doesn't fix the problem, Apple can't fix it on its own, Apple says. The company says it is still evaluating whether the weakness exists, but Apple, which bases its Safari for Windows browser on Microsoft code, says Safari for Windows has the weakness and the Microsoft code is the reason. Apple has fixed the problem for Safari for Macs.

Once our investigation is complete, we will take appropriate action to help protect customers," a Microsoft spokesperson said via e-mail. "We will not have any more to share at this time." The weakness can be exploited by man-in-the-middle attackers who trick the browser into making SSL sessions with malicious servers rather than the legitimate servers users intend to connect to. Black Hat's most notorious incidents: a quiz "Microsoft is currently investigating a possible vulnerability in Microsoft Windows. Current versions of Safari for Mac, Firefox and Opera address the problem, which is linked to how browsers read the x.509 certificates that are used to authenticate machines involved in setting up SSL/TLS sessions. The attacks involve getting certificate authorities to sign certificates for domain names assigned to legitimate domain-name holders and making vulnerable browsers interpret the certificates as being authorized for different domain-name holders. In July two separate talks presented by researchers Dan Kaminski and Moxie Marlinspike at the Black Hat Conference warned about how the vulnerability could be exploited by using what they call null-prefix attacks.

For instance, someone might register www.hacker.com. In that case, the authority would sign a certificate for bestbank.hacker.com, ignoring the sub-domain bestbank and signing based on the root domain hacker.com, Marlinspike says. In many x.509 implementations the certificate authority will sign certificates for any request from the hacker.com root domain, regardless of any sub-domain prefixes that might be appended. At the same time, browsers with the flaw he describes read x.509 certificates until they reach a null character, such as 0. If such a browser reads bestbank.com\0hacker.com, it would stop reading at the 0 and interpret the certificate as authenticating the root domain bestbank.com, the researcher says. An attacker could exploit the weakness by setting up a man-in-the-middle attack and intercepting requests from vulnerable browsers to set up SSL connections. Browsers without the flaw correctly identify the root domain and sign or don't sign based on it.

If the attacking server picks off a request to bestbank.com, it could respond with an authenticated x.509 certificate from bestbank.com\0hacker.com. The user who has requested a session with bestbank would naturally assume the connection established was to bestbank. The vulnerable browser would interpret the certificate as being authorized for bestbank.com and set up a secure session with the attacking server. Once the link is made, the malicious server can ask for passwords and user identifications that the attackers can exploit to break into users' bestbank accounts and manipulate funds, for example, Marlinspike says. These certificates use an asterisk as the sub-domain followed by a null character followed by a registered root domain. In some cases attackers can create what Marlinspike calls wildcard certificates that will authenticate any domain name.

A vulnerable browser that initiated an SSL session with bestbank.com would interpret a certificate marked *\0hacker.com as coming from bestbank.com because it would automatically accept the * as legitimate for any root domain. Such a wildcard will match any domain, he says. This is due to "an idiosyncrasy in the way Network Security Services (NSS) matches wildcards," Marlinspike says in a paper detailing the attack. The differences between what users see on their screens when they hit the site they are aiming for and when they hit an attacker's mock site can be subtle. A Microsoft spokesperson says Internet Explorer 8 highlights domains to make them more visually obvious, printed in black while the rest of the URL is gray. "Internet Explorer 8's improved address bar helps users more easily ensure that they provide personal information only to sites they trust," a Microsoft spokesperson said in an e-mail.

The URLs in the browser would reveal that the wrong site has been reached, but many users don't check for that, Marlinspike says. Marlinspike says the null character vulnerability is not limited to browsers. "[P]lenty of non-Web browsers are also vulnerable. Outlook, for example, uses SSL to protect your login/password when communicating over SMTP and POP3/IMAP. There are probably countless other Windows-based SSL VPNs, chat clients, etc. that are all vulnerable as well" he said in an e-mail.

IPv6: Not a Security Panacea

With only 10% of reserved IPv4 blocks remaining, the time to migrate to IPv6 will soon be upon us, yet the majority of stakeholders have yet to grasp the true security implications of this next generation protocol. While IPv6 provides enhancements like encryption, it was never designed to natively replace security at the IP layer. Many simply have deemed it an IP security savior without due consideration for its shortcomings.

The old notion that anything encrypted is secure doesn't stand much ground in today's Internet, considering the pace and sophistication in which encryptions are cracked. Unfortunately, IPsec, the IPv6 encryption standard, is viewed as the answer for all things encryption. For example, at the last Black Hat conference hacker Moxie Marlinspike revealed vulnerabilities that breaks SSL encryption and allows one to intercept traffic with a null-termination certificate. But it should be noted that:  IPsec "support" is mandatory in IPv6; usage is optional (reference RFC4301). There is a tremendous lack of IPsec traffic in the current IPv4 space due to scalability, interoperability, and transport issues. Many organizations believe that not deploying IPv6 shields them from IPv6 security vulnerabilities. This will carry into the IPv6 space and the adoption of IPsec will be minimal. IPsec's ability to support multiple encryption algorithms greatly enhances the complexity of deploying it; a fact that is often overlooked.

This is far from the truth and a major misconception. For starters, most new operating systems are being shipped with IPv6 enabled by default (a simple TCP/IP configuration check should reveal this). IPv4 based security appliances and network monitoring tools are not able to inspect nor block IPv6 based traffic. The likelihood that rogue IPv6 traffic is running on your network (from the desktop to the core) is increasingly high. The ability to tunnel IPv6 traffic over an IPv4 network using brokers without natively migrating to IPv6 is a great feature. Which begs the question, why are so many users routing data across unknown and non-trusted IPv6 tunnel brokers? However, this same feature allows hackers to setup rogue IPv6 tunnels on non-IPv6 aware networks and carry malicious attacks at will.

IPv6 tunneling should never be used for any sensitive traffic. By enabling the tunneling feature on the client (e.g. 6to4 on MAC, Teredo on Windows), you are exposing your network to open, non-authenticated, unencrypted, non-registered and remote worldwide IPv6 gateways. Whether it's patient data that transverses a healthcare WAN or Government connectivity to an IPv6 internet, tunneling should be avoided at all costs. The rate at which users are experimenting with this feature and consequently exposing their networks to malicious gateways is alarming. The advanced network discovery feature of IPv6 allows Network Administrators to select the paths they can use to route packets. Is your security conscious head spinning yet?

In theory, this is a great enhancement, however, from a Security perspective it becomes a problem. So where are the vendors that are supposed to protect us against these types of security flaws? In the event that a local IPv6 Network is compromised, this feature will allow the attacker to trace and reach remote networks with little to no effort. The answer is, not very far along. Since there are no urgent mandates to migrate to IPv6, most are developing interoperability and compliance at the industry's pace. Like most of the industry, the vendors are still playing catch-up.

So the question becomes: will the delay in IPv6 adoption give the hacker community a major advantage over industry? As we gradually migrate to IPv6, the lack of interoperability and support at the application and appliance levels will expose loopholes. Absolutely! This will create a chaotic and reactive circle of patching, on-the-go updates and application revamp to combat attacks. There is more to IPv6 than just larger IP blocks. Regardless of your expertise in IPv4, treat your migration to IPv6 with the utmost sensitivity.

The learning curve for IPv6 is extensive. Many of the fundamental network principles like routing, DNS, QoS, Multicast and IP addressing will have to be revisited. People can't be patched as easily as Windows applications, thus staff training should start very early. Reliance on given IPv4 security features like spam control and DOS (denial of service) protection will be minimal in the IPv6 space as the Internet 'learns' and 'adjusts' to the newly allocated IP structure. Jaghori is the Chief Network & Security Architect at L-3 Communications EITS. He is a Cisco Internetwork Expert, Adjunct Professor and industry SME in IPv6, Ethical Hacking, Cloud Security and Linux. It's essential that your network security posture is of the utmost priority in the migration to IPv6. Stakeholders should take into account the many security challenges associated with IPv6 before deeming it a cure-all security solution.

Jaghori is presently authoring an IPv6 textbook and actively involved with next generation initiatives at the IEEE, IETF, and NIST. Contact him at ciscoworkz@gmail.com.

Analyst: AT&T likely to keep iPhone exclusive deal

Despite widespread speculation that Apple Inc. will open the iPhone exclusive arrangement with AT&T Inc. to include Verizon Wireless after 2010, one analyst firm is predicting AT&T's exclusive deal as the wireless carrier will be extended beyond then. The main reason Apple is likely to stick with AT&T beyond 2010 is the relatively wide usage and growth expected for the HSPA air standard used by the carrier for 3G data." It appears iSuppli reached it conclusions without any direct knowledge of what Apple will do regarding the exclusive deal. In a report, iSuppli Corp. said that its main reason for expecting an exclusive extension is based on its analysis of a growth in usage of a faster wireless standard at AT&T known as High Speed Packet Access (HSPA). The global growth in HSPA usage will far outstrip growth in usage of EVDO (Evolution Data Optimized), a different standard used by Verizon, iSuppli said. "Speculation is rife that Apple will end its exclusive U.S. iPhone service deal with AT&T when the current contract expires in June 2010, and begin to offer phones that work with the Verizon network," said Francis Dieco, an iSupply analyst, in a statement. "However, iSuppli doesn't believe this will be the case. AT&T and Apple have been mum on the issue for months, and were again today.

Many analysts have speculated that Apple would want to work with more than a single carrier in the U.S. just to expand the opportunities to sell the iPhone. Gartner Inc. analyst Ken Dulaney agreed that AT&T will "definitely extend their deal" for exclusive sales of the iPhone. "AT&T would be crazy not to sell iPhone," he said in an e-mail, but added that Apple will also support Verizon, possibly with a different type of unit. "If you are beholden to stockholders to make money, there is no easier money than in your home turf through a carrier desperate for this type of device," Dulaney added. Today, Jack Gold, an analyst at J. Gold Associates, said that Apple would more likely want to open the exclusive deal for both AT&T and Verizon, the two largest carriers in the U.S. Gold said he didn't agree with iSuppli's conclusions, primarily because there isn't that much incentive for Apple to stay with AT&T "unless AT&T throws a lot of money at Apple." Gold rejected the analysis of growth in HSPA as a sufficient rationale to stay with AT&T, partly because adherence to a wireless standard doesn't fully determine how data throughput occurs. Many AT&T customers using the iPhone have been outraged about service interruptions and slow downloads, which may occur because a tower might not be nearby due to buildings or terrain, Gold and others have noted. "Raw speed with a wireless standard doesn't mean anything." Gold added. "It's important to realize, when three people are on a tower, that's no big deal, but when you have 300 people on a tower in downtown Boston or downtown L.A., that's huge." The analysis from iSuppli predicts that Verizon might get Apple products to sell other than the iPhone. A major factor in what a user experiences is determined by the number of users on a single cell tower, and how many towers are located in dense areas, he noted. Dieco based that prediction on his finding that there's no information indicating that Apple is prohibited from pursuing a relationship with Verizon for non-iPhone products, such as another phone model, tablet computer, netbook or an enhanced iTouch.

In 2009, there were 269 million HSPA subscribers globally, a number expected to soar to 1.4 billion in 2012. For EVDO, there were 145 million subscribers globally in 2009, a number expected to reach 304 million in 2013. Verizon has undertaken a program to move to faster LTE wireless in the 2011 to 2013 timeframe, and some analysts have assumed future iPhones could work over LTE, assuming Apple strikes an agreement with Verizon. Part of the reason iSuppli relied on the growth projections for HSPA versus EVDO to make its predicion is that HSPA growth globally will be so much bigger.

India schedules 3G license auction for December

India's auction of 3G and WiMax licenses is now scheduled to be held in December, according to a notice on the Web site of the country's Department of Telecommunications. Bidding for 3G licenses will start Dec 7, with the WiMax auction scheduled to start two days after the 3G auction is complete, according to the notice. The auction was originally scheduled for January of this year, but was postponed after disagreement within the government on the minimum cost of the licenses.

Both Indian and foreign companies are allowed to bid for the licenses, but foreign companies will have to set up joint ventures with Indian investors to run services in the country. The Ministry of Communications will license four slots for 3G in each of India's 22 service areas, with a fifth slot reserved for two government-run telecommunications companies. A group of ministers, set up to resolve the dispute over pricing the licenses, has named Indian rupees 250 billion (US$5 billion) as the minimum revenue from the auction of the 3G and WiMax licenses in the country, India's Minister of Communications, A. Raja said last month. A telecommunications company bidding for 3G licenses in all 22 circles will have to pay at least Indian rupees 35 billion, according to the new minimum pricing proposed by the Indian government. Two companies, Bharat Sanchar Nigam Ltd. and Mahanagar Telephone Nigam Ltd., were allotted 3G spectrum ahead of the auction, and have started offering services.

By the pricing announced last year, they would have to pay about rupees 20 billion. The government said last year that these companies would have to pay license fees equal to the highest bid in each service area. The final date for applications from bidders is Nov 13.

Gonzalez pleads guilty to TJX, other data heists

The man described by federal authorities as the mastermind of the massive data thefts at TJX Companies Inc., Heartland Payment Systems and other retailers today pleaded guilty to charges in a 19-count indictment that include conspiracy, wire fraud and aggravated identity theft. That case was being prosecuted separately in New York but was merged with the case in Boston under a plea agreement negotiated with prosecutors a few days ago. Albert Gonzalez, 28, of Miami, also pleaded guilty to one count of conspiracy to commit wire fraud related to a data theft at Dave & Buster's restaurant chain. Gonzalez is scheduled to be sentenced Dec. 8 by U.S. District Court Judge Patti Saris in Boston.

Under the plea agreement, Gonzalez will serve between 15 and 25 years for both cases and will be fined as much as $250,000 for each of the charges. He faces a maximum of 25 years in prison for the charges in Boston and 20 years for the case in New York. Gonzalez will also forfeit more than $2.7 million in cash as well as multiple pieces of real estate and personal property, including a condominium in Miami, a BMW and several Rolex watches that he is alleged to have acquired through his ill-gotten gains. Gonzalez was arrested in Miami in 2008 along with 10 other individuals on charges relating to the thefts at TJX, Dave & Busters, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21 and DSW. In August, federal authorities in New Jersey indicted Gonzalez on charges involving breaches at Heartland Payment Systems, Hannaford, 7-Eleven Inc. and two other unnamed retailers. About $1 million of the money being forfeited was recovered from a container buried in Gonzalez' back yard, according to a statement released today by the U.S. Department of Justice.

Prosecutors alleged that Gonzalez, along with two unnamed Russian conspirators, stole more than 130 million credit and debit cards from the five retailers. It is not clear if Gonzalez was the leader of a worldwide criminal gang or merely acting at the behest of powerful crime gangs based in Russia and East Europe. Today's plea brings to an end, for the moment, to the career of a hacker who federal authorities say has been the mastermind of the biggest data thefts in U.S. history. But his actions, which his lawyer has claimed stemmed from a computer addiction , have caused millions of dollars in losses to his victims. In addition, some of the companies that were Gonzalez's victims have had to pay fines to Visa and the other card brands for being noncompliant with the credit card industry's Payment Card Industry Data Security Standard and to spend more money to revamp their security controls.

TJX has publicly estimated that costs to the company from the data breach will touch $200 million . Heartland has already spent or set aside more than $12 million and is facing numerous lawsuits from affected institutions.

Larry Augustin: Open source fueling enterprise software shift

Open source is giving a mighty boost to the enterprise software industry, changing the support equation for users and signaling to Microsoft and other proprietary vendors that it's time to catch on or be left out, according to Larry Augustin, an open source visionary and the current SugarCRM CEO.

Augustin, who took over SugarCRM about three months ago, built his reputation on his early work in the open source community and during a stint as a venture capitalist. He thinks the maturing software industry is showing signs of changes that will redefine the customer/vendor relationship, alter current business and distribution models, and eventually fuel cloud computing.

"It wasn't long ago that software was this mysterious magical stuff," says Augustin, who is credited with helping coin the term "open source."

"Now people understand software and they understand that many applications have matured. I think we'll see over time the software industry reach a point where it is not proprietary vs. open source, but the shade of how much control you want, how much do you want to do yourself, and how much do you want the vendor to do," Augustin says.

Those control issues, fostered by having source code for applications, will help balance the customer/vendor relationship, Augustin says. In essence, users won't get locked into applications that vendors no longer push forward even while they continue to collect support fees.

All those factors, Augustin says, put pressure on vendors such as Microsoft and others to consider their future business models.

"Over time you will see Microsoft adopt more open source principals as they strive to continue to make Windows relevant," he says. "They have put a toe in the water with their Shared Source program. I don't think it gets them there, but you can see them thinking about it."

Augustin's SugarCRM has built a relationship with Microsoft that began in 2006 with an interoperability deal on the back of a license that is part of Microsoft's Shared Source Initiative, a program through which Microsoft shares source code with customers, partners and governments worldwide.

Microsoft's recent actions also back up Augustin's words. Over the past year or so, Microsoft has donated code to PHP, offered support to the Apache Foundation, and just last month made its first code submission to the Linux kernel (even though it happened under a cloud of duress).  Augustin says these moves show signs that the software industry has matured.

"It is why you see so many open source applications and why Microsoft is really struggling," he says. "They are in a mature market now and trying to figure out how to make changes. IBM went through similar change in the 1990s and almost went out of business."

Augustin says Microsoft has to figure out how to emerge in an industry where the company cannot simply define things on its own. Customers want more flexibility and openness because they have that understanding of software, he says.

One big influence on changes currently taking place, Augustin says, was brought to light during his 2002-2004 tenure as a venture capitalist at Azure Capital Partners. He says it is clear that a shift in software distribution models gave open source a lift.

"There was this recent period in time where it was difficult to get an enterprise software company funded," he says. "The problem was not that people weren't creating interesting new technology, the problem was that it was hard to distribute and sell. All the money would go into sales and marketing."

But enterprise software is back, he says, "and the reason why is open source. It has given people a way to get their software out there and get it distributed and make its way into companies at a fraction of the cost that it used to take to sell and market enterprise software."

Successful open source companies such as MySQL (now owned by Sun/Oracle), Red Hat, SpringSource and Hyperic (both  now owned by VMware) started life as venture funded companies, he notes.

Augustin is now eyeing a revolution in cloud computing that is borrowing some of open source's principals. He says cloud computing introduces an element of flexibility that original application service providers (ASP) and pure hosted applications could not offer.

"Now customers may make different decisions on levels of service they want out of an application and apply that where it makes sense for them," he says.

With SugarCRM today, users have a back-end database they can move from internal clouds, to external clouds, to hosting environments.

"It's all the same database and all you have to do is move it between providers, onto your own internal provider infrastructure or out to the cloud," he says.

Augustin says the goal is to provide a one-touch or instant ability to move the database, a process that would eliminates manual steps.

"You can imagine that you could run [the database] on internal IT infrastructure and have a provider with a warm standby or vice versa depending on what makes sense for the end user," he says.

Augustin says cloud computing is getting to the point where infrastructure is going to become commoditized, which will enable even more flexibility and choice for running applications.

"As a CRM vendor I would rather invest in the software than the infrastructure," he says.Follow John on Twitter: twitter.com/johnfontana