VoIP Tech Chat

Recently, Andy Abramson posted an article discussing a proposed tax on SMS texting. Taxes always get my attention and this article really got me thinking.

First, allow me to quote the US Constitution:

Amendment 1 – Freedom of Religion, Press, Expression

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

Before I continue, can you imagine a law or amendment today that could be written in only 45 words? I digress… Read the rest of this entry »

Edward Vielmetti, who you may remember from the Asterisk/Parking piece, writes great blog posts. Whether on his personal site, AnnArbor.com, or numerous other blogs, Ed’s posts certainly capture my attention.

Recently, Ed started writing a FOIA (Freedom of Information Act) Friday series, detailing examples and stories from the world of Public Information. The article mostly deals with the Michigan FOIA, however parallels can be drawn for other states (such as Florida’s Sunshine Laws) and the Federal government.

It’s a great read. This week, Ed discusses how to write a FOIA request. Check out the post at http://www.annarbor.com/news/government/foia-friday-how-to-write/.

Note: There’s an intro, the DDA response, and Fred’s response in this article. Jump to the end to read Fred’s response.

A few months back, we posted a nice little article on using Asterisk to get Parking Space Availability from Ann Arbor garages. The response from the VoIP community was fantastic! We received great comments and feedback from people like Jason Goecke, Dug Song, Dave Michels, Evan Cooke, and more! People not only responded, they even showed different ways of providing access to this information. And everyone shared their work in an open forum — truly a great example of open source coding inspiring innovation (albeit with Parking Spaces).

Even better was the local response in Ann Arbor. Edward Vielmetti and Fred Posner were interviewed in the local papers, appeared on a radio show, and even rode the teeter totter. Everyone loved the idea of being able to check on parking space availability… everyone except for the DDA (insert scary music).

The DDA (Ann Arbor Downtown Development Authority), funded by tax dollars,  “provides a diversity of transportation and parking options to meet downtown’s [Ann Arbor’s] ever-changing needs.” The DDA does not like us making information of parking spaces available to the public via phone. Instead, the DDA wants to control this information. Seriously, they want to control parking space availability information.

Tyler Erickson helped Edward Vielmetti and Fred make this project even more fascinating by tracking parking space availability over time. The plan was to provide predictability of availability. For example, “We’re sorry, the lot at 4th and Washington is currently filled, we predict the parking lot will be available in 7 minutes. Press 1 to be notified…”

Wouldn’t that be neat? We thought so… The DDA’s response was to block Tyler’s access. Of course, since it was using Google Apps, it blocked Google, but that’s another story. We inquired as to why this blockage occurred and… well enter Susan Pollay. Susan Pollay is Executive Director of the DDA. She told us (and remember, this is a tax funded organization): Read the rest of this entry »

The structural faults, many of them legacies of the 1980s, represent once-in-a-lifetime dislocations that will take years to work out. Among them: the job drought, the debt hangover, the defense-industry contraction, the savings and loan collapse, the real estate depression, the health-care cost explosion and the runaway federal deficit. “This is a sick economy that won’t respond to traditional remedies,” said Norman Robertson, chief economist at Pittsburgh’s Mellon Bank. “There’s going to be a lot of trauma before it’s over.”

America’s structural burdens have hit home most profoundly in terms of jobs. The U.S. workplace is “in a profound, historic state of turmoil that for millions of individuals is approaching panic,” according to labor consultant Dan Lacey, publisher of the newsletter Workplace Trends.

The latest recession has hit white-collar workers particularly hard, both in terms of layoffs and slippage in their real wages. “These people can’t believe what is happening to them,” says Illinois opinion pollster Mike McKeon. “They decided they didn’t want to work in factories, so they learned how to use computers. They were rewarded with service-sector jobs[...], but now they’re out on the street and no one wants them.” Open season has been declared on corporate bureaucrats. “The middle manager has gone out of vogue in corporate America,” says Lacey. “Indeed, the word manager is the kiss of death on resumes.” Read the rest of this entry »

Our hero Benjamin Franklin

The University of Florida is in Gainesville — my private information is everywhere.

GAINESVILLE, FLORIDA — For the third time in less than a year, the University of Florida reported a breach exposing personal information. This time, the breach includes the names and social security numbers for more than 90,000 people. In this latest attack, the University announced the hack was executed by an “intruder” and that the University of Florida Police Department was notified.

Ok, at this point, I need to go ahead and just vent. I’m sorry to have a soap box moment… but the Police Department was notified? Yay! Thank God, Buddha, that little idol Bobby found when the Brady’s visited Hawaii, or whatever higher power works for you. I can now sleep soundly knowing that the police department was notified after my information was already out there. Sweet!

If this was the first time this happened, I would be disappointed. I can tell you that without hesitation, because when this actually happened the first time (June 2008), I was disappointed. If this were the second time? Read the rest of this entry »

In the about us page on Nortel’s website, they proudly state “Hundreds of millions of people, Fortune 500 companies, and government institutions around the world trust their networks to Nortel’s reliable and secure solutions.” Today, Nortel defined “reliable” by commencing comprehensive business and financial restructuring.

The full text from their press release follows: Read the rest of this entry »

Microsoft SQL Server

Microsoft announced a new security vulnerability affecting almost the entire Microsoft SQL Server product line. The warning verifies a vulnerability allowing remote code execution on systems running:

• Microsoft SQL Server 2000
• Microsoft SQL Server 2005
• Microsoft SQL Server 2005 Express Edition
• Microsoft SQL Server 2000 Desktop Engine (MSDE 2000)
• Microsoft SQL Server 2000 Desktop Engine (WMSDE)
• and Windows Internal Database (WYukon)

Note: Systems with Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3, and Microsoft SQL Server 2008 are not affected by this vulnerability.
Read the rest of this entry »

Look. Its Kevin Martin of the FCC. Hi Kevin.

The US Congress Committee on Energy and Commerce released a scathing report of the FCC (Federal Communications Commission) under Chairman Kevin Martin. The report, titled “Deception and Distrust: The Federal Communications System Under Chairman Kevin J. Martin” (sounds like a Lifetime movie), harshly criticizes both the FCC and Kevin Martin. Although, from the title alone, you had to have guessed the report wasn’t going to be flattering.

The committee found (among other things):

• FCC Chairman Kevin Martin manipulated, withheld, or suppressed data, reports, and information from other FCC commissioners and Congress.
• Important Commission matters have not been handled in an open and transparent manner; raising suspicions on unfair treatment.
• The Commission has failed to carry out important responsibilities regarding oversight of the Telecommunications Relay Service Fund (allowing customers to be overcharged while companies are overcompensated).
• FCC Chairman Kevin Martin’s “heavy-handed” management style has created distrust, suspicion, and turmoil among the five current Commissioners.
• Commission staff have not been efficiently managed.

The report uses such statements as “classic fleecing of America” (regarding overcharging customers), “undermined the ability of the FCC to accomplish its mission” (describing Martin’s management style), and “Chairman Martin’s manipulation of the Second Report calls into question the reliability of telecommunications information and analysis provided by the FCC to Congress.” Ouch.

The investigation was launched after allegations were received from FCC employees (current and former), other FCC Commissioners, and telecom reps. The Bi-Partisan Congressional committee launched the investigation in January, however did not hold the typically expected hearings “due to the climate of fear that pervades the FCC.” Apparently, witnesses were too scared to publicly testify.

The FCC provides authoritative rule making over VoIP, telecommunications (such as Cable, Wireless Phones, Telephones, POTS, etc.), television, and almost some part of electronic life that we touch daily.

More reading:

• Download the Report (PDF)
• CNET.com: Congressional report: FCC chair abused power
• Associated Press: House report finds leadership breakdown at FCC

Our hero Benjamin Franklin

Recently, the FBI issued a security warning against Asterisk stating that an Asterisk vulnerability can be exploited for vishing purposes. And that’s pretty much the entirety of the security warning. Noticeably lacking from this warning are any details regarding methods, software version, or prevention. The warning does mention that Asterisk users should upgrade to the latest version of the software and that the vulnerability allows cyber criminals to use an Asterisk system with an autodialer to make thousands of vishing phone calls within an hour.

We work with Asterisk, and can tell you that Digium (the makers of Asterisk) always recommends that you upgrade software to the latest version. Also, it seems that the FBI did not notify Digium of this flaw and provided them the same cryptic public release. John Todd (of Digium) has stated he believes the vulnerability mentioned by the FBI deals with a bug previously fixed by Digium in March of 2008. Unlike the FBI, Digium was not cryptic with their information and publicly detailed the bug and it’s fix.

Which brings us to this week’s edition of “We’re here from the government and we’re here to help.”

Don’t get us wrong, we believe the government should help it’s citizens and provide warnings about security issues. But when these warnings are made, they should be clear, detailed, and professionally handled. At minimum, the FBI should have documented the alert to Digium, so that Digium could provide a complete and authoritative response. If the FBI had uncovered a method so that a Ford could be unlocked remotely (and it was an issue with the design of the vehicle), we’d expect the FBI to pick up the phone and go “Hey Ford, lookie at what we done did.” Ford would then issue a recall, and problem solved. In any case, the manufacturer (or developer) can certainly (if nothing else) verify the veracity of the claim and immediately implement a fix.

But then again, the FBI and technology don’t exactly have a great track record, do they? In 2000, the FBI attempted to upgrade the computer system at a cost of $380 million dollars. By 2004, the upgrade had not been completed and had already cost more than $600 million. And to top it off, CBS news advised their new system would be useless in fighting terrorism.

Also in 2004, the FBI briefed Director Robert Mueller about a notorious evil millionaire (Don Emilio Fulci) who had formed a terrorist group to plan chemical attacks against London and Washington, DC. It took a White House staffer to notify the FBI that Don Emilio Fulci was a fictional character from the video game Headhunter.

Remember the Madrid bombings? A week earlier, the Spanish authorities contacted the FBI for assistance with detecting a fingerprint. The FBI arrested an Oregon lawyer based on a digital match and were so certain of their findings, that they never requested the original fingerprint. Spanish Investigators continued their investigation and matched the fingerprint to the correct individual. The FBI stated it followed industry guidelines, but also dismissed requests from Spain to double check the findings.

The government of the United States maintains an incredible array of power. And the FBI, as enforcement arm of the United States should act in a manner that not only provides confidence, but also serves as a role model to others. After all, even Spider-man knows that with Great Power comes Great Responsibility.

So, bottom line… update your Asterisk version (if you haven’t already). And for the current time, we’re going to rate Digium higher than the FBI when heading security tech concerns.

Additional Readings:

• Graves on SOHO VoIP — Always smart to read this blog
• FEMA Hacked Old School
• Digium responds with SIP Security and Asterisk — well written and discusses the FBI report

Our hero Benjamin Franklin

In yet another demonstration of “open” government, the State of Florida Agency for Workforce Innovation accidentally provided access to 250,000 social security numbers. The social security numbers remained available for 19 days.

“We are committed to serving the people of Florida and to maintaining the public trust at its highest level,” said Monesia T. Brown, Director of the Agency for Workforce Innovation.  “We are thoroughly investigating this matter and are making every effort to enhance the security of our computer systems.”

The security breach occurred on an Agency test server for 19 days in October 2008 and resulted in the exposure of the names and Social Security Numbers of approximately 250,000 customers who received services through Florida’s One-Stop Career Centers between January 2002 and November 2007.

If you want to check to see if your information was included in the affected data, you should visit: https://www.floridajobs.org/security/security.htm. However to add insult to injury, you will need to provide your name, email, phone number, and last 4 digits of your social security number.

The State will be notifying those affected by mail. Perhaps the workers involved received their training from the University of Florida…