Learning SEO: Gleaning Knowledge

As an aspiring SEO Technician, I have inevitably been asking a lot of questions over the last year. It occurred to me that this would be a great thing to blog about. I will be discussing the different techniques that I am using to learn the SEO trade and will talk about the different resources [...]

Reciprocal Links … again

As they mentioned over on SE Round Table – the discussion regarding reciprocal links has been had hundreds – and maybe even thousands of times.  At least once per week I get asked about them either whether they’re part of what we do or if te person on the phone should do them, etc. etc. [...]

Mayday Mayday

Google’s latest update is known among SEO’s lovingly as the “Mayday update”.   The update ended about a week ago and as with any update, there are winners and there are losers.  We known that the update was algorithmic and not index-based.  Basically, it has to do with the rankings of your site not the pages [...]

New Microsoft, ARM licensing agreement; Could a Windows Phone tablet be coming?

Microsoft and ARM announced on July 23 that the two have signed a new licensing agreement for the ARM architecture, extending the relationship between the two companies. The pair aren’t sharing any details, but I can’t but wonder if this could signal Microsoftand its PC partners delivering Windows and/or Windows Phone OS available on ARM-based slates and tablets.

Where did Microsoft spend its money last quarter?

Microsoft reported a better-than-expected fourth quarter and ended its fiscal 2010 with a bang, according to numbers the company released on July 22. Where did the Softies end up spending?

I confess: I bought an iPad (and so far I love it)

I bought an iPad. Big deal, you say… So did 3.3 million other people so far this year. Well, for me it is a big deal. But here’s why I did the deed.

Efficiently Getting Delicious Save Count of Your Posts

Dell Warns of Malware on Small Number of PowerEdge Motherboards

Computerworld reports that Dell is warning customers that a small amount of its PowerEdge R410 server motherboards may contain malware.



A post on a Dell support forum, “The potential issue involves a small number of PowerEdge server motherboards sent out through service dispatches that may contain malware. This malware code has been detected on the embedded server management firmware.”



Permalink | Recent Headlines | News Feeds

AT&T Continues Massive Increases in Wi-Fi Sessions

The telecom behemoth is also gigantic in giving away Wi-Fi to customers: AT&T’s quarterly report on Wi-Fi usage finds the firm serving 121m sessions in the first six months of 2010; that compares to 86m sessions in all of 2009. Second quarter 2010 saw 68m sessions used, compared with 15m in the year-ago second quarter. Second quarter was also a 30-percent increase over first quarter.

That’s great, but you’ll note that the names McDonald’s and Starbucks aren’t mentioned anywhere in the press release. McDonald’s and Starbucks represent about 19,000 of AT&T’s “more than 20,000″ locations.

In January, McDonald’s opened its Wi-Fi network to everyone at no cost; previously, AT&T customers (wired, DSL, fiber, remote business, and laptop 3G) got access at no cost, and so did roaming network partners. One expects that McDonald’s drove part (but not all) of the increase.

Likewise, on 1 July 2010, Starbucks shifted from its modestly complicated free two hours’ offer, where you needed a Starbucks stored-value card, to unlimited free service for everyone. I expect we’ll see a big jolt as a response, because it removes friction for short, casual use, as opposed to longer use in which anyone who figured it out would already have been using Starbucks’ Wi-Fi at no cost.

You can’t disregard other factors, however. AT&T continues to add wireless, laptop 3G, and fiber customers (although I believe DSL and landline markets are static or shrinking). Those users gain free service on subscribing. And existing users rely more on using free service as available.

The couple of million iPads that AT&T sold as part of the 3m+ worldwide totally likely are part of that jump in usage. A single iPad user could consume dozens of sessions a day, either on the AT&T free locations (with a Wi-Fi only unit or a 3G iPad without an active 3G subscription), or across AT&T’s network with a 3G iPad and an active 3G data plan. (The active data plan gives you access to hotels, airports, and other otherwise for-fee locations, and some roaming locations on reciprocal networks.)

Finally, AT&T switch a few weeks ago from unlimited service plans to cheaper, limited plans for new customers or those that opt to switch away from unlimited will likely mean bargain hunters like yours truly will work harder to find free Wi-Fi instead of consuming expensive 3G juice.

Copyright ©2010 Glenn Fleishman. All rights reserved. Please notify us if you find this content anywhere but at wifinetnews.com or wimaxnetnews.com. Reproduction of full articles from RSS feeds is prohibited without permission.

Researcher Hints 802.1X WPA2 Flaw

AirTight Networks’ researcher Md Sohail Ahmad will present a WPA2/802.1X weakness at DEFCON18 next week: The press release from AirTight doesn’t give away too many details, but I can read the tea leaves to figure out where the problem lies. There’s just enough of a hint.

The problem appears restricted to WPA Enterprise (802.1X with TKIP/AES-CCMP) in practical terms, because a malicious user must have legitimate credentials to gain access to the network to exploit the flaw. With WPA/WPA2 Personal (preshared key), everyone on the network ostensibly can sniff for other users’ data.

But with the 802.1X mechanism used in WPA/WPA2 Enterprise, each user after authentication receives unique keying material that renders his or her data opaque. Or does it?

AirTight said in its press release that the problem Ahmad identified is found in the name it gave the exploit “Hole 196″: that refers to the last line of page 196 of the revised IEEE 802.11-2007 specification.

I digitally flipped through my copy of the spec, and found a note at the bottom of the page in question, in a section on Robust Security Network Association (RSNA) used for the 4-way handshake for authentication dealing with the group temporal key (used to protect broadcast and multicast data). It reads:

“NOTE—Pairwise key support with TKIP or CCMP allows a receiving STA to detect MAC address spoofing and data forgery. The RSNA architecture binds the transmit and receive addresses to the pairwise key. If an attacker creates an MPDU with the spoofed TA, then the decapsulation procedure at the receiver will generate an error. GTKs do not have this property.”

Reading that with the notion in mind that there’s an exploit around it points strongly to a way in which a malicious client could exploit this and create spoofed broadcast or multicast packets appearing to come from the TA (transmitting address) of the access point that other clients would receive. Those spoofed packets would have the advantage of coming across the same trusted network, and could contain malicious payloads and attacks.

This could be a serious exploit for corporations, government, and academic institutions that use 802.1X, and rely on the intra-network security of having one user unable to sniff the traffic of any other user. No key cracking appears involved at all; it’s entirely about the position of the offending client within the network.

It seems like the fix for this would require an AP somehow sign a GTK packet so that a station (client and adapter) wouldn’t accept GTKs on a network from another station. That seems like more infrastructure and a major change, although it could be incorporated into an EAP method that relies on AP/server-side certificates.

I’m sure Cisco, Juniper, and others will be all over this, because it affects their core client base. The risk isn’t from outside attack, so it’s not an immediate concern that script kiddies will drive up to corporate networks to attack them. Rather, it’s part of ongoing mitigation of risks from employees inside a company misusing or stealing data or causing grief.

In the short run, using a VPN tunnel within an 802.1X session might allow malicious disruption but not data interception. Unless, perhaps, DNS poisoning and SSL/TLS certificate authority spoofing were involved

Copyright ©2010 Glenn Fleishman. All rights reserved. Please notify us if you find this content anywhere but at wifinetnews.com or wimaxnetnews.com. Reproduction of full articles from RSS feeds is prohibited without permission.