North America: Wireless Network Carrier Update

Abstract:

Huge and significant changes are occurring in the Telecommunications and Wireless space during the month of July! Significant change in plans for consumers and consolidation of smaller-tier carriers may offer more competitive choice for consumers... but with advancements comes security risks.

On the Mobile User front...

2013-07-10: T-Mobile’s new "Jump" service plan gives customers two upgrades per year

At a press conference in New York City Wednesday, T-Mobile unveiled a new type of mobile service plan that will allow customers to upgrade their phones up to twice a year with no outright financial penalty or waiting period. On the “Jump” plan, customers will still pay to switch phones, but they can get them at new-contract prices. Customers on T-Mobile will have to pay an extra $10 per month for the Jump plan.

2013-07-16: AT&T jumps on the frequent-phone-upgrade bandwagon with “AT&T Next”

Not to be outdone by T-Mobile's "Jump" program and Verizon's rumored "Edge" program, AT&T on Tuesday announced a plan called "AT&T Next" that will allow its customers to upgrade their smartphones and tablets more frequently without having to pay the full, unsubsidized price for the devices. AT&T Next gives customers the option to get a new phone or tablet with no down payment in exchange for an extra charge, equivalent to about five percent of the device's unsubsidized price, on their monthly bill.

2013-07-15: Verizon’s rumored "Edge" plan may ensure you always have a new phone in your hands

It looks like the days of waiting two years for your next handset upgrade might be over. DroidLife is reporting that Verizon may be introducing its own “buy a new phone if you’re sick of your old one” plan later next month. According to the site’s source, the plan is called VZ Edge, and it will enable customers to upgrade their phones more often than once every two years to help them “stay on the leading edge of technology.”

On the Carrier front...

[AT&T storefront, courtesy Business Insider]

2013-07-12: In move for spectrum and prepaid customers, AT&T buys Leap for $1.1 billion

As a way to solidify its spectrum holdings and gain a stronger foothold in the growing prepaid mobile market, AT&T has agreed to acquire Leap Wireless (and its prepaid Cricket brand) for $15 per share, which works out to $1.1 billion, given 79.05 million in outstanding shares. Considering that Leap’s closing stock price on Friday afternoon was $7.98 per share, that’s a hefty premium. ... As of April 15, 2013, Leap had $2.8 billion of net debt. Leap shareholders will also receive a contingent right entitling them to the net proceeds received on the sale of Leap’s 700 MHz ‘A Block’ spectrum in Chicago, which Leap purchased for $204 million in August 2012.”

2013-07-05: FCC clears way for SoftBank to buy Sprint, Sprint to buy Clearwire

The U.S. Federal Communications Commission on Friday announced the removal of the last barrier to a three-company merger that will see Japan's SoftBank take control of Sprint Wireless, which itself is set to take over Clearwire.

2013-07-10: SoftBank priority is beefing up Sprint, not exec changes

SoftBank Corp (9984.T) will move rapidly to use airwaves from Clearwire Corp CLWR.O to bolster Sprint Nextel Corp's (S.N) wireless service, but it does not plan any big personnel changes once it takes over the No. 3 U.S. mobile carrier, a top SoftBank executive told Reuters.

2013-07-11: Sprint wants to become the mobile autobahn, removes all limits for life

Sprint has thrown down its own gauntlet in attracting...(e.g., contract) customers: guaranteed unlimited voice, text, and data, forever. In a press release Thursday, Sprint said that this deal would apply to both new and existing customers who sign up for Sprint’s new Unlimited, My Way, or My All-In plans. The deal will be available starting Friday, July 12, 2013 for just $80 per month.

On the Hardware front...

[image courtesy article on femtocells from gigaom.com]

2013-07-13: Femtocell flaw leaves Verizon subscribers' Wi-Fi and mobile wide open

Security researchers have demonstrated a flaw in femtocells that allows them to be used for eavesdropping on cellphone, email, and internet traffic. The hack was demonstrated on Verizon hardware, and the telco giant has issued an update to patch the vulnerability, but up to 30 other network carriers use systems with software that can be hacked in the same way. Femtocells are used to boost Wi-Fi and mobile signals within a household, but a common form of software that many devices use has a major security flaw that allows all traffic to be recorded and analyzed.

Apache: Hack, Rollback, Recover, and Secure

Apache: Hack, Rollback, Recover, and Secure

Apache: Hack

It was a bad day for the Apache team - apache.org was hacked 2009-08-28 through their CentOS Linux derivative. The CentOS is a Linux distribution bundled with RedHat Package Manager.



Apache: Rollback

When your system has been hacked, what would be your first choice to recover?

Go to an on-line backup? (How do you know it was not also compromised?)
Go to a tape backup? (How do you know it was not also compromised?)
How far back to you go? (Do you only keep 3 backups?)
Do you re-build from scratch?

aurora.apache.org runs Solaris 10, and we were able to restore the box to a known-good configuration by cloning and promoting a ZFS snapshot from a day before the CGI scripts were synced over. Doing so enabled us to bring the EU server back online, and to rapidly restore our main websites.

The Apache team was very fortunate - they implemented Sun SPARC Solaris ZFS. They were able to roll back to a snapshot and recover.

Apache: Recover

It was mentioned that the ZFS snapshot was used to ultimately recover the web site. How does ZFS offer this type of capability?

ZFS is a 128 bit unified file system and volume manager. It offers virtually unlimited volume size... and virtually unlimited snapshots. Any production environment exposed to the internet should use ZFS as a best practice, to be able to quickly resort back to a pre-corrupted stage.

For example, you can schedule a snapshot of your system every day, or every 15 minutes (if you want!), and you can hold these snapshots for a week, with virtually no overhead. At any point in time, you can drop back to a previous release, just as the apache.org foundation decided to do.

What exactly is a "snapshot"? The zfs manual page reads:

A read-only version of a file system or volume at a given point in time. It is specified as filesystem@name or volume@name.

The process of taking an old snapshot and making it writable is called a "clone". The manual page reads:

A clone is a writable volume or file system whose initial contents are the same as another dataset. As with snapshots, creating a clone is nearly instantaneous, and initially consumes no additional space.

This "clone" can be "promoted" so as to become the master version of the file system volume, erasing the old content. This is also described in the zfs manual page:

Clones can only be created from a snapshot. When a snapshot is cloned, it creates an implicit dependency between the parent and child. Even though the clone is created somewhere else in the dataset hierarchy, the original snapshot cannot be destroyed as long as a clone exists. The origin property exposes this dependency, and the destroy command lists any such dependencies, if they exist.
The clone parent-child dependency relationship can be reversed by using the promote subcommand. This causes the “origin” file system to become a clone of the specified file system, which makes it possible to destroy the file system that the clone was created from.

This is basically the process that Apache.org used to recover their Linux web servers.

Apache: Secure

Securing those web servers are a different story. SSH is no magic bullet - this was also compromised. There is no magic bullet in the open-source world. Different open-source communities have different certification processes. A Linux kernel may come up, be slowly accepted into a distribution, with patches made along the way from the original kernel team as well as a separate distribution company.

One of the sections was about positive lessons :

• The use of ZFS snapshots enabled us to restore the EU production web server to a known-good state.
• Redundant services in two locations allowed us to run services from an alternate location while continuing to work on the affected servers and services.
• A non-uniform set of compromised machines (Linux/CentOS i386, FreeBSD-7 amd_64, and Solaris 10 on sparc) made it difficult for the attackers to escalate privileges on multiple machines.

This is the "gold standard".

While your front-end Linux boxes may get hacked, diversifying your infrastructure with an additional (secure) OS, and using a real unified file system & volume management system like ZFS under Solaris makes the hackers struggle while provides options to every-day system administrators.

IBM recently acknowledged Sun Solaris as being best-in-class in security - something to keep in mind.

Be cautious of other vendors like Microsoft with long outstanding security holes in their IIS web serving software or security issues which they refuse to fix. These are not good candidates for customer facing systems - for obvious reasons. Imagine gaining access to the IIS server and just querying the usernames and passwords from the ebedded MSSQL server - oh, the humanity!