Slashdot Mirror

m2pc writes: Ars Technica reports that Juniper Networks firewalls have been discovered to include "unauthorized code" inserted into their ScreenOS software. Juniper has has published an advisory addressing the matter, with instructions to patch the affected devices.

From the Ars article: "NetScreen firewalls using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are affected and require immediate patching. Release notes published by Juniper suggest the earliest vulnerable versions date back to at least 2012 and possibly earlier. ... The first flaw allows unauthorized remote administrative access to an affected device over SSH or telnet. Exploits can lead to complete compromise. 'The second issue may allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic,' the advisory said." The rogue code was discovered during a recent internal source code review conducted by Juniper.

AlbanX writes: Australian telco Optus has been nabbed passing its customers' mobile phone numbers to third-party websites without the customers' knowledge or consent. The practice, known as HTTP header enrichment, aims to streamline the process of direct billing for customers, but they're not happy. The discovery was made by a user on the telco forum Whirlpool, and Optus confirmed it. They said, "Optus adds our customers' mobile number to the information in select circumstances where we have a commercial relationship with owners of particular websites."

CowboyRobot writes "A pair of reports by Juniper and Bit9 confirm the suspicion that many apps are spying on users. '26 percent of Android apps in Google Play can access personal data, such as contacts and email, and 42 percent, GPS location data... 31 percent of the apps access phone calls or phone numbers, and 9 percent employ permissions that could cost the user money, such as incurring premium SMS text message charges... nearly 7 percent of free apps can access address books, 2.6 percent, can send text messages without the user knowing, 6.4 percent can make calls, and 5.5 percent have access to the device's camera.' The main issue seems to be with poor development practices. Only in a minority of cases is there malicious intent. The Juniper report and the Bit9 report are both available online."

Chris Holland writes "On the heels of Juniper Networks' recent release of its TX Matrix Platform, Om Malik is giving an interesting overview of current and upcoming battles between protagonists of the Router Game, armed with their Terabit toys."

An anonymous reader "Looks like Abilene, the backbone for Internet2 will join Canada's CA*Net3 and Europe's GEANT as one of the fastest research networks on the planet. According to this press release, Internet2 will be deploying 11 of Juniper network's freshly announced T640 platform. These puppies can cram 32 OC-192 (or 128 OC-48) interfaces into a single chassis. All in half a rack, too!" I'm sure those students are very happy with their ping times. Meanwhile in the real world... ;)

An anonymous reader "Looks like Abilene, the backbone for Internet2 will join Canada's CA*Net3 and Europe's GEANT as one of the fastest research networks on the planet. According to this press release, Internet2 will be deploying 11 of Juniper network's freshly announced T640 platform. These puppies can cram 32 OC-192 (or 128 OC-48) interfaces into a single chassis. All in half a rack, too!" I'm sure those students are very happy with their ping times. Meanwhile in the real world... ;)

calc writes "Linux has now been ported to the Cisco 2500/3000/4000 routers. Click here for more details." This seems like a fairly logical (albeit not so useful hack). I mean, one would assume that cisco's have some wacky hardware in them... but then again, using standard tools to config them seems allright by me. And you could use your router as a web server if you were on crack *grin*. [Update by nik]: Not the first time a free operating system is used like this. For example, routers from Juniper run a modified FreeBSD, while Effnet base many of their products on NetBSD.

Jeremy Pruitt asks: "I'm wondering if there is a way for me to do some perl scripting on a handheld device. I know there is no port for WindozeCE yet, but I also know there are a few BSD/Linux ports for handhelds. Can I run Perl on these ported versions of BSD/Linux? If so, does anybody recommend a handheld/OS combo that I can do some scripting on?"