technology:ethernet

Connecting #modbus RTU Smart Energy Meter and Siemens Simatic IoT2040 to #netpie
▻https://hackernoon.com/connecting-modbus-rtu-smart-energy-meter-and-siemens-simatic-iot2040-to-

https://cdn-images-1.medium.com/max/1024/1*PRXLoYI_JqUkNWn-ZPVYkQ.png

This article explains how to read data from Mitsubishi Modbus Energy Meter using industrial gateway Siemens Simatic IoT2040. The Simatic IoT2040 is the most preferred choice for industries to make their production data visualized in the domain of Industrial Internet-of-Things (IIoT).Requirements:Modbus Energy Meter (Mitsubishi SX1-A31E)Siemens Simatic IoT2040Power supply 24V DCSD-card with Yocto LinuxEthernet CableNode-RedNETPIE accountSimatic IoT2040 Specifications:Intel Quark X1020 processor1 GB RAM2 X Ethernet interfaces2 X RS232/422/485 interfaceBattery-buffered real-time clockMitsubishi Modbus Energy Meter Specifications:RS485 2 wires half-duplexRTU ModeBaudRate 1200bpsDistance 1200mResponse time 80ms~200ms (programmable)Preparing Simatic IoT2040:The first step is to boot image onto (...)

#iot #siemens-simatic-iot2040 #technology

Deciding on what to do with a #packet
▻https://hackernoon.com/deciding-on-what-to-do-with-a-packet-d8c47412c61b?source=rss----3a8144ea

https://cdn-images-1.medium.com/max/360/1*IH8VKF3pOImK2rn0HvB0_A.png

When one device wants to send a packet to another, it has two options:If the recipient is on the same subnet, it can send the packet directly to them, it just needs to workout what the recipients MAC address is.If the recipient is on another subnet it will pass the packet onto a device that can forward it to its destination.Option 1The first thing the sending device needs to workout is, is the recipient on the same subnet as me?To do this it uses the IP address and netmask that were defined when the interface was configured to workout the range of addresses that are on the same subnet as it.E.g.eth0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 10.0.0.7 netmask 255.255.255.0 broadcast 10.0.0.255 ether b8:27:eb:28:f5:e0 txqueuelen 1000 (Ethernet)Using one of (...)

#send-a-packet #linux #networking #operations

Gigabyte met un ventirad sur sa carte Ethernet à 4 ports 10 Gbit/s
▻http://www.tomshardware.fr/articles/reseau-gigabyte-10gbit-s,1-66793.html#xtor=RSS-100

http://media.bestofmicro.com/O/U/751278/gallery/Gigabyte-CLN4M34-4-3_rc_120x90.jpg

4 connecteurs SFP28

http://media.bestofmicro.com/O/U/751278/gallery/Gigabyte-CLN4M34-4-3_rc_120x90.jpg

next Vault 7 episode : « Dark Matter »

▻https://wikileaks.org/vault7/darkmatter/releases

Among others, these documents reveal the “Sonic Screwdriver” project which, as explained by the CIA, is a “mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting” allowing an attacker to boot its attack software for example from a USB stick “even when a firmware password is enabled”. The CIA’s “Sonic Screwdriver” infector is stored on the modified firmware of an Apple Thunderbolt-to-Ethernet adapter.

“DarkSeaSkies” is “an implant that persists in the EFI firmware of an Apple MacBook Air computer” and consists of “DarkMatter”, “SeaPea” and “NightSkies”, respectively EFI, kernel-space and user-space implants.

Documents on the “Triton” MacOSX malware, its infector “Dark Mallet” and its EFI-persistent version “DerStarke” are also included in this release. While the DerStarke1.4 manual released today dates to 2013, other Vault 7 documents show that as of 2016 the CIA continues to rely on and update these systems and is working on the production of DerStarke2.0.

Also included in this release is the manual for the CIA’s “NightSkies 1.2” a “beacon/loader/implant tool” for the Apple iPhone. Noteworthy is that NightSkies had reached 1.2 by 2008, and is expressly designed to be physically installed onto factory fresh iPhones. i.e the CIA has been infecting the iPhone supply chain of its targets since at least 2008.

#CIA #firmware
#Vault_7

More on Mirai, and more than Mirai

▻http://www.securityweek.com/mirai-iot-botnet-not-only-contributor-massive-ddos-attack-akamai

Akamai says Mirai was not alone:

While Akamai confirmed that the Mirai botnet was part the attack, the company also said that Mirai was only “a major participant in the attack” and that at least one other botnet might have been involved, though they couldn’t confirm that the attacks were coordinated.

Akamai refers to Mirai as Kaiten and has it documented here:
▻https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/kaiten-std-router-ddos-malware-threat-advisory.pdf

More on the released source code of Mirai which confirms the use of GRE flooding, one of the techniques used on top of DNS Water Torture:

▻http://www.securityweek.com/hacker-releases-source-code-iot-malware-mirai

A copy of the source code files provided to SecurityWeek includes a “read” where the author of Mirai explains his reasons for leaking the code and provides detailed instructions on how to set up a botnet.

[...]

Mirai, believed to have made rounds since May 2016, infects IoT devices protected by weak or default credentials. Once it hijacks a device, the threat abuses it to launch various types of DDoS attacks, including less common UDP floods via Generic Routing Encapsulation (GRE) traffic.

This was proven through reverse-engineering by
▻http://cyberx-labs.com/en/blog/cyberx-reveals-gre-evidence-krebs-iot-based-attack-largest-ddos-interne

It is still GRE is still an uncommon attack vector, but it was already used during the 2016 Rio games
▻http://www.tripwire.com/state-of-security/security-data-protection/cyber-security/how-a-massive-540-gbsec-ddos-attack-failed-to-spoil-the-rio-olympics

For some French, see also here:
▻https://seenthis.net/messages/530903

#Mirai #Kaiten
#Akamai
#DDoS
#Brian_Krebs
#OVH
#GRE
#DNS_Water_Torture

R&D Internet2 still faring well

▻http://www.networkworld.com/article/3037478/lan-wan/internet2-at-20-alive-and-kicking.html?upd=1457257643947
pdf print version: ▻http://docdro.id/RE7sZvO

Nearly 20 years after its launch, Internet2 is quietly humming along on university campuses across the country, doing its R&D work and connecting researchers who might otherwise not be able to share information so readily.

Contrary to any misinterpretations of the Internet2 mission statement, it was not intended to be a replacement or “new” Internet. And because it has been rather quiet lately, some people may have mistakenly figured it was dead.

[...]

“One thing to always remember about Internet2 is it’s a complicated ecosystem that starts with the university network and aggregates into state and regional networks and then a national network and connects to research networks all over the world,” says Dave Lambert, president and CEO of Internet2, the company behind the consortium.

[...]

Many of the technologies that constitute the regular Internet are up to 30 years old, such as TCP/IP, Ethernet and sendmail. Internet2 has been building new high speed network connections using a clean sheet design

[...]

Internet2 has in aggregate 8.8 Terabits of capacity on the network, with 100 gigabit connections to participating universities, all via an OpenFlow/SDN network. Virtualized networking and OpenFlow came out of National Science Foundation projects at Stanford University.

[...]

One of the more interesting non-bandwidth projects to come from Internet2 is Shibboleth, a form of single sign-on where once you log in, the network handles connections to any site requiring a login.

[...]

Askren says identity management is as important to researchers as connectivity, processing and storage. “In a world where we leverage the cloud for research collaboration, it becomes extremely important that we have effective identity management to validate who we are and security concerns out there. It needs to be effective and unencumbering,”

#Internet2
#Shibboleth

NSA & GCHQ worked together to access Juniper equipment

The Intercept released a document indicating that GCHQ together with NSA had access in 2011 to different models of Juniper equipment.
There is however no direct link with the recently discovered backdoor in Juniper equipment. (see ►http://seenthis.net/messages/442614)

▻https://www.documentcloud.org/documents/2653542-Juniper-Opportunity-Assessment-03FEB11-Redacted.html
backup: ▻http://docdro.id/pdNxs3W

• Juniper NetScreen Firewalls models NS5gt, N25, NS50, NS500, NS204, NS208, NS5200, NS5000, SSG5, SSG20, SSG140, ISG 1000, ISG 2000. Some reverse engineering may be required depending on firmware revisions.
• Juniper Routers: M320 is currently being worked on and we would expect to have full support by the end of the 2010.

The document gives an interesting resume of Juniper, as a company and its technology, form an intelligence point of view.

Juniper as a target

Juniper is viewed as the ablest competitor selling SSL VPN technology.
• Well Established Position in the Carrier Space with high density routers
• Credible competitive alternative to Cisco dominance of core routing
• Carrier Ethernet Growing in Volume and Scope
• IP Traffic Growth Continues Unabated

Juniper as a Threat

Juniper’s leadership in core IP routing and the Enterprise Network Firewall and SSL VPN markets means that the SIGINT community should keep up with Juniper technology to be positioned to maintain CNE access over time. The threat comes from Juniper’s investment and emphasis on being a security leader. If the SIGINT community falls behind, it might take years to regain a Juniper firewall or router access capability if Juniper continues to rapidly increase their security.

The Intercept document

▻https://theintercept.com/2015/12/23/juniper-firewalls-successfully-targeted-by-nsa-and-gchq

Asked about the document [...] Juniper sent a written statement saying the company “operates with the highest of ethical standards, and is committed to maintaining the integrity, security, and quality of our products. As we’ve stated previously … it is against established Juniper policy to intentionally include ‘backdoors’ that would potentially compromise our products or put our customers at risk. Moreover, it is Juniper policy not to work with others to introduce vulnerabilities into our products.”

This so reads like a template. Replace “Juniper” with “Cisco” or “Huawei” and it would work as well...

#Juniper #backdoor
#NSA #SIGINT
#GCHQ

Emperor of the Internet — Shelly Palmer
▻http://www.shellypalmer.com/spb/2015/1/30/emperor-of-the-internet

“I am NoMan, Emperor of the Internet, Online Imperator and Lord of IPv6, Imperial ruler of the web, Grand King of the Ethernet, Keeper of the Royal Encryption Algorithms, Monarch of Virtual World. If I allow you to communicate with me, you will address me as, Your Majesty, the Heavenly Digital Sovereign.”

This had to be a hoax. The message continued...

“I am all powerful. No computer, no mobile phone, no device, nothing with an on/off switch is out of my reach...

When you are chosen, you will pay tribute to me in an amount equal to 2% of every online transaction, every online purchase, every online transfer of funds you make for the rest of your natural life. No transactions may be excluded. Ever.

In honor of your tribute, I grant you immunity from identity theft, cyber-attack, all cyber-weapons and protection against all other cyber-terrorists - for none are more powerful than I. If my conditions are met, I, as the beneficent Emperor that I am, will allow you to live a peaceful, tranquil, profitable digital life.

Should to choose to disobey me, I will give you three warnings. On the day of the third transgression, every aspect of your digital life will be destroyed. I will take 100 percent of your bank balance and leave you with no identity, no home, no transportation, no medical records, no financial records, no insurance, no data and no hope of ever recovering any of it. I will erase you from existence.

These are the rules. Do not test me. I am, NoMan. Pray that I favor you with my greatness.”

Pretty much everyone thought this was bit of technical magic performed by a disgruntled hacker with a sixth-grade sense of humor and delusions of grandeur. But after a few victims, it became clear that – not only was this not a hoax, it was the beginning of the end.

C’est comme ca qu’on vend son beurre quand on est conseiller de #sécurité. Pas mal.

Toward 100Gb/s #Ethernet - improving #Linux #kernel #networking performance
▻https://lwn.net/Articles/629155

#gentoo Wiki Archives - HOWTO_IP_Aliasing
▻http://www.gentoo-wiki.info/HOWTO_IP_Aliasing

Gentoo : need to load #multiple #IP addresses to a single ethernet interface ? These steps will help you do just that. Voir /usr/share/doc/netifrc-0.1/net.example pour la config de plusieurs passerelles en cas d’adresses IP sur des réseaux séparés. (pfff ! point de vue config, gentoo c’est systématiquement la misère !)

#serveur #linux #howto #adresse-ip #migration

Philips introduces power-over-Ethernet connected lighting
▻http://feeds.slashgear.com/~r/slashgear/~3/96mW-ZbVhjs

We’ve seen various connected lighting products over the months, having gotten our hands on the Huli color-changing lamp back in January, for example. Newest among them is a connected LED … Continue reading

#Audiophile #Ethernet cables take the #placebo effect to new heights:
▻http://www.the-ear.net/review-hardware/audioquest-ethernet-cables-pt2-ethernet-cable

Alas not a joke, from a ’network supervisor’, no less !

http://cms.the-ear.net/sites/default/files/AQ-Cinnamon.jpg

Frustrated that #Ethernet bonding using 802.3ad link aggregation doesn’t balance a single #TCP connection across multiple interfaces ? Then you’ll be as excited as I am with #Multipath TCP... A single 52 Gb/s stream accross just six 10 Gb/s links ? Yes !
▻http://multipath-tcp.org/pmwiki.php?n=Main.50Gbps

While I had this on my mind, I created the #Wikipedia article for Multipath TCP: ▻https://en.wikipedia.org/wiki/Multipath_TCP

Happy 40th birthday, #Ethernet !

Why aren’t switches handled like #Linux servers that just happen to have a lot of #Ethernet ports ? Facebook’s Open Compute Project will give the world an “open” top-of-rack switch:
▻http://arstechnica.com/information-technology/2013/05/facebook-aims-to-knock-cisco-down-a-peg-with-open-network-hardware

Social Beer Website ►http://untappd.com

http://untappd.s3.amazonaws.com/site/assets/v2/images/splash.jpg

Untappd is all the rage with beer nerds these days. It’s kinda like a foursquare for beer, where you “check-in” to beers, earn badges, and of course, see what (and where) your friends are drinking. The Untappd devs were kind enough to even put support in for homebrewed beers, allowing brewers to enter their own creations into the system.

... and how nerds deal with it ...

While Untappd has great Android and iOS apps, it always seemed silly to me while at home to have to find my phone every time I pulled a pint off the ole kegerator.

Untappd Kegerator ►http://www.3d0g.net/brewing/untappd-kegerator

http://www.3d0g.net/_/rsrc/1341074262070/brewing/untappd-kegerator/20120624_164204.jpg

While surfing Seeed Studio one day, I noticed some nice hall-effect flow sensors. They were pressure safe, and made of nylon so they could handle carbonated beer with no problems. I also knew I had an extra Arduino Ethernet Shield languishing about and so the germ of an idea began to form... what if my kegerator could check-in my pours automatically?

http://www.3d0g.net/_/rsrc/1341074188224/brewing/untappd-kegerator/20120628_182904.jpg

A little digging around the Untappd website yielded the last piece of the puzzle - an API!

►http://www.3d0g.net/_/rsrc/1341074371150/brewing/untappd-kegerator/20120628_183216.jpg?height=240&width=320

How it works:
An interrupt routine on an Arduino calculates the RPM of flow sensors installed in the tap beer lines. Once it notices a tap flowing, it performs a beer “checkin” API call to api.untappd.com, lights the corresponding LED, and begins a 5 minute “lockout” timer to prevent multiple check-ins (from topping off a pint, etc). ...

The entire howto and build manual is downloadable from the author’s website.