$words[rand()]

Over the com­ing weeks I will be spend­ing one week each with a num­ber of PC-based router/firewall prod­ucts installed as the pri­mary NAT gate­way at my apart­ment. I will be review­ing them based on over­all per­for­mance, inter­op­er­abil­ity with my SIP-based VoIP ser­vice, QoS capa­bil­i­ties, VPN capa­bil­i­ties, and any extra fea­tures that make them stand out from the crowd.

The test plat­form will be a Dell Pow­erEdge SC430 with a 1.6 GHz Intel Xeon dual core proces­sor and 4GB of RAM. The cur­rent list of soft­ware to test is as follows:

• pfSense 1.2 (Stable)
• pfSense 2.0 (Alpha)
• Untan­gle Open Source 6.1
• Vyatta Com­mu­nity 5

I will also be test­ing “appli­ance” type routers based on what is avail­able to me, which cur­rently is as follows:

• Linksys WRT54GL (Linksys firmware 4.30.12)
• Linksys WRT54GL (Tomato 1.23)
• Linksys WRT54GL (DD-WRT v24 SP1 Mega)
• Linksys WRT54GL (Open­WRT Kamikaze 8.09)
• Cisco 1841 (IOS 12.4(23))
• Watch­guard Fire­box X Edge
• Edge­wa­ter Edge­marc 4500 (VOS 9.1.2)

The Watch­guard is cur­rently unknown due to not hav­ing the pass­word for it and I may cut down the list of Linksys firmwares, but all of the rest will be tested.

Hard­ware or soft­ware sug­ges­tions for fur­ther test­ing are appreciated.

With the Obama admin­is­tra­tion look­ing like they will be rolling back Bush era poli­cies allow­ing doc­tors to refuse to per­form cer­tain pro­ce­dures and/or refuse to pre­scribe or sell cer­tain med­ica­tions (let’s say RU-486 for exam­ple) the Internet’s polit­i­cal debate hotspots have erupted as expected. Over at the Some­thing Awful forums I saw a great post that com­pletely explains my posi­tion on this issue:

It’s a sad reflec­tion on the influ­ence of the reli­gious right that this is even a note­wor­thy issue. If you work at Burger King, and one day you decide that you don’t like the Dou­ble Whop­per and won’t serve it to peo­ple any­more (say, for rea­sons of their health), you get fired. If you’re an net­work admin­is­tra­tor and one day decide that TCP/IP is the devil’s pro­to­col and you won’t use it, you get fired. The list goes on. Giv­ing peo­ple the legal med­ica­tion they need is the job of the phar­ma­cist and doc­tor. Their job is not “Make value judg­ments about my patients and then pre­scribe what med­ica­tions I per­son­ally believe are good”. We have a cen­tral reg­u­la­tory body that deter­mines what med­i­cines and pro­ce­dures are legal to give out and per­form. Doc­tors and phar­ma­cists are expected to adhere to these. A phar­ma­cist who decided that he would no longer give can­cer patients their drugs or a doc­tor who decided he will sub­sti­tute phrenol­ogy for a gen­eral exam would find them­selves out of jobs in short order. The only rea­son this is an issue is because for some rea­son “It’s my reli­gion!” is taken as a valid excuse for not doing your job.

If you are a phar­ma­cist, it is your job to dis­pense med­ica­tions as pre­scribed. Your per­sonal morals have absolutely no legit­i­mate influ­ence on this. If you do not like this fact, find another job. What the right wing wants here would be equiv­a­lent to a paci­fist join­ing the Marines and then com­plain­ing that they were being sent to war.

If you’re still con­vinced that this “reli­gious free­dom” is the right option, pre­tend you live in a small town with one local doc­tor. Now pre­tend that doc­tor is a Jehova’s Wit­ness. Now think about what hap­pens if you or a loved one needs a trans­fu­sion. Your local doc­tor would then be fully able to refuse to give you/your loved one a trans­fu­sion because it goes against their religion.

If you don’t like the job require­ments, find another job. Don’t whine that you chose a job that con­flicts with your beliefs. Put up or shut up, either way your morals don’t have any effect on me.

Sjur Usken and San­dro Gauci have dis­cov­ered a major flaw in the SIP imple­men­ta­tions on a wide range of IP phones. The short expla­na­tion is that the phones do not ver­ify where a proxy authen­ti­ca­tion request is com­ing from and hap­pily return the SIP authen­ti­ca­tion infor­ma­tion. It is hashed and salted, but the salt is cho­sen by the attacker, so a set of rain­bow tables would make crack­ing it triv­ial. For full details, check out Sjur’s blog post (which spread fairly rapidly around the VoIP world) and his lat­est post show­ing the trace as he attacked a Cisco 7940 I set up for this purpose.

Until the phone ven­dors release fixed firmware (if they do) the only way to defend your­self from this is to not have phones exposed on pub­lic IP addresses. If they have to be for some rea­son (we all know SIP and NAT really don’t get along, and proper SIP aware NAT devices cost a fair bit) set fire­wall rules that pre­vent the phones from speak­ing SIP to any IPs that aren’t part of your VoIP sys­tem. Alter­na­tively, in the event that every sin­gle phone on your sys­tem is sta­t­i­cally addressed, the reverse could be done at the reg­is­trar side. It wouldn’t stop the attack­ers from find­ing the pass­word, but it would pre­vent them from using it in any way.

The impli­ca­tions of an attacker gain­ing the SIP authen­ti­ca­tion infor­ma­tion are of course severe, once they have that they can imi­tate the attacked phone and make calls to any num­ber of regions poten­tially cost­ing thou­sands of dol­lars in the course of a sin­gle night.