Frameset hijacking website

Today I heard news about a fake website "company-registry.com/hkma/" spoofing itself as the website of the Hong Kong Monetary Authority (HKMA).  I accessed the URL and found that the website owner used frameset to load HKMA web content into a frame.  That says, the content is real, and it comes from the official website but framed and under other people domain.  The HTML source codes are really simple below (I purposely add an extra space in <  > ):

< html>
< head>
< meta http-equiv="Content-Type" content="text/html; charset=gb2312">
< title>香港金融管理局< /title>
< meta name="Keywords" content="香港金融管理局">
< meta name="description" content="香港金融管理局（金管局）由外汇基金管理局与银行业监理处合并而成。金管局的主要职能由《外汇基金条例》和《银行业条例》规定，并向财政司司长负责,金管局是香港政府架构中负责维持货币及银行体系稳定机构....">
< /head>
< frameset border=0 frameborder=0 frameSpacing=0 rows=4%,96%>
< frame marginHeight=5 marginWidth=10 name=mainsoft src="index_.htm" scrolling="no">
< frame src=" http://www.info.gov.hk/hkma/index.htm" >
< /html>

There are many javascripts that prevent a frame from loading web content. One that I have tested is below:
 < SCRIPT LANGUAGE="JavaScript">
if (window != top) top.location.href = location.href;
< /SCRIPT>

Good luck, HKMA !!!

Knot DNS

I notice the release of Knot DNS version 1.0.0 by the CZ Internet community.  This is a high performance authoritative name server software supporting DNSSEC and NSEC3.  When tested on a 4-core Intel Xeon X3430, 2.40 GHz, 2 GB RAM, running Linux 2.6.38-11, x86_64, Knot DNS can handle 200k queries per second while BIND 9.8 can handle slighty half of Knot DNS.   Knot DNS is a perfect choice of secondary level domains (STD) or even TLDs.  However, there is still a long way to go compared with Nominum Authoritative Name Server (ANS).  This software has a stunng peformance of processing 1 million queries per second if running on same hardware config.  Nominum ANS is the king of name server software !!

iperf speed test

I am tired of  using ftp to test upload and download speed.  Some guys said that FTP has limitation in case the bandwidth of the broadband line is large. I have to explore the use of  iperf to find out if the download and upload speed are accurate.

As my home PC is riding on an internal IP address 192.168.1.104, it can act as a client to perform upload test.  However, for download test, the internal host must act as a server.  Hopefully, I am able to set up a virtual server on my WiFi router and forward connection for port 50001 from the WAN side to the host 192.168.1.104 on the LAN side.

IPv6 subnet prefix

The following sketch might be useful to help determine which position of an IPv6 address to play with in order to set a subnet prefix. I just copy it from a website so the background colour remains.

IPv6 Subnets

2001:0DB8:0400:000e:0000:0000:0000:402b
      ||| |||| |||| |||| |||| |||| ||||
      ||| |||| |||| |||| |||| |||| |||128
      ||| |||| |||| |||| |||| |||| ||124
      ||| |||| |||| |||| |||| |||| |120
      ||| |||| |||| |||| |||| |||| 116
      ||| |||| |||| |||| |||| |||112
      ||| |||| |||| |||| |||| ||108
      ||| |||| |||| |||| |||| |104
      ||| |||| |||| |||| |||| 100
      ||| |||| |||| |||| |||96
      ||| |||| |||| |||| ||92
      ||| |||| |||| |||| |88
      ||| |||| |||| |||| 84
      ||| |||| |||| |||80
      ||| |||| |||| ||76
      ||| |||| |||| |72
      ||| |||| |||| 68
      ||| |||| |||64
      ||| |||| ||60
      ||| |||| |56
      ||| |||| 52
      ||| |||48
      ||| ||44
      ||| |40
      ||| 36
      ||32
      |28
      24

RFC 3901 - DNS IPv6 Transport Operational Guidelines

Some colleagues in the Government want to supplement native IPv6 connection to their serving websites but their ISPs told them that nameservers are not yet equipped with IPv6 transport. My colleagues are quite frustrated worrying that IPv6 only hosts will not be able to access the websites because of an IPv6 brokenness in DNS path.

Actually, the ISPs do not quite understand the issue. IETF has published "RFC 3901 - DNS IPv6 Transport Operational Guidelines". In order to preserve name space continuity in the transition to IPv4, the essential points to note are :

- All recursive name servers should be IPv4 only or dual stack hosts.

- All zones should be served by at least one authoritative IPv4 capable host.

IPv6 only hosts will access a dual-stack resolver to find the nameservers and the nameservers do not need to be served with IPv6 transport. So long as nameserves can return AAAA records to resolvers, IPv6 only client hosts can receive the information and hence there is no brokenness in the name resolution process.

I recall that I have answered the same question at least twice.

List of IPv6 home routers

I am preparing a list of IPv6 home/SOHO routers which will be posted in the coming “IPv6 In Action” website, the domain name of which  is not decided yet. The website will be managed by the Internet Society Hong Kong.  It is for general end users in Hong Kong to be aware of IPv4 exhaustion and get prepared for the IPv6 era.

My source of information is mainly from the IPv6 Forum and I do a search for routers that have been awarded the “IPv6 Ready” Logo.  I only sorted out the common brand names such as Linksys, Netgear and D-Link and their products are commonly available in Hong Kong with reasonable price.  I tended not to give products from Japan, New Zealand, China and UK etc as I am not sure whether these products would be sold in Hong Kong.

Just when I thought the list was OK, I mistakenly missed out one important item, Apple Airport Extreme.  I checked IPv6 Forum again and noticed that Apple submitted its Airport Extreme base station as host device for getting IPv6 Ready Logo but not as a router.  What a crazy move. 

After the “IPv6 in Action” website is launched, I intend to update the list on a monthly basis.  Hopefully, the workload is not heavy.

Brainstorming on IPv6 Address Space

I did a bit of googling on the number of times IPv6 address space over IPv4. In simple math, it is :

2^128 divided by 2 ^32 = 2 ^96 which should be 79228162514264337593543950336.

Surprisingly, many websites quote the wrong math calculations like 4 billion times, 40 billion times and 16 trillion times. There are some that say "79 Octillion times the IPv4 address space" which should be correct.

Of course, "79 Octillion times" can not be understood in English and can hardly be translated into Chinese. It seems meaningless to quote how many times IPv6 address space over IPv4. To convey a clear message on huge address space, we can just simply say :

IPv4 can only provide approximately a total of 4 billion addresses while the number of  available addresses of IPv6 is up to 3.403 x 10^38.

M, A and O flags of Router Advertizement

For some time, it has been quite confusing to me about auto config (SLAAC) in IPv6. Windows 7 can support SLAAC but no DNS resolvers can be allocated. Mac OSX Lion and Linux can support SLAAC + RDNSS which assign IPv6 address and resolvers to client hosts via Router Advertisement. In case there is a DHCPv6 and RA Server in a network segment, things will be complicated to understand. How does a host choose whether to use SLAAC or DHCPv6 or both ? Hopefully, I came across some good description in Cricket Liu’s new book “DNS and Bind on IPv6”. In fact, the A, M, and O flags in RA message have something to do with resolvers.

The “M” flag - for “Managed Address Configuration,” tells hosts that DHCPv6 is available for both address assignment and network parameters (including resolver configuration).

The “A” flag - , for “Autonomous Address Configuration,” tells hosts that SLAAC is available for address assignment and network parameters (possibly including resolver configuration).

The “O” flag - for “Other Stateful Configuration,” tells hosts that DHCPv6 is available for network parameters other than address assignment (that is, to be used together with SLAAC in the hybrid method described earlier).

I still think that Microsoft should release patches to Windows 7 such that Windows 7 can support SLAAC + RDNSS. Think it this way, if there needs a DHCPv6 for resolvers assignment working side by side with RA Server, what is the purpose of developing auto config in IPv6.

Migration to Office 2007

We have Office 2003 upgraded to Office 2007. No big surprise at all except some more features in the tool bar.  There is one thing in Words 2007 which I think is most useful.  We can now save files in PDF format and this facilitates posting documents to the Internet.  I don’t thank Microsoft at all.  File saving in PDF should be a standard feature and Microsoft just offers the basic minimum to users.

World IPv6 Launch - 6 June 2012

After waiting for one year, I am happy to see the four biggest content providers in the world, namely, Google, Yahoo, Facebook and Microsoft Bing will enable IPv6 on a permanent basis.  The date of this activation is 6 June 2012 at the World IPv6 Launch event (www.worldipv6launch.org).  After 6 June, I can access facebook by just www.facebook.com instead of www.v6.facebook.com.  I have gogoClient and Hurricane Electric tunnels at home with over 5 Mbps speed for IPv6 connection.  I am sure my IPv6 connection can give me faster speed in surfing Facebook and Google than my IPv4 connection.

One question I have in mind:  Will Google include Youtube for the permanent IPv6 provision ?  If so, that is another great news.  I can have better experience in watching Youtube videos as I can imagine the v6 pipeline of Youtube is not so congested.

Anonymous threatened to blackout the Internet

Anonymous has threatened to blackout the Internet if Stop Online Piracy Act is passed:

http://www.homelandsecuritynewswire.com/dr20111223-anonymous-threatens-internet-blackout-over-controversial-legislation

Some people might ask how can the entire Internet be blackouted.  If the root zone can be taken down, all websites and emails in the world will disappear.  It is not known if Anonymous will attack hundreds of root servers scattered around the globe.

IPv6 address entry keyboard

Just received my IPv6 address entry keyboard. The double colon key (::) is very important !


There is no such code as double colon in ASCII standard.  If IPv6 gains popularity, it might be desirable to include :: as special character in ASCII table.

I own the IPv6 address prefix of 2002:ca51:fc74::/48 permanently

I am not an ISP but I own the IPv6 address prefix of 2002:ca51:fc74::/48 permanently. The reverse lookup for this range has been delegated to me by the Number Resource Organization (NRO).

This is just a gimmick. For those who are familiar with IPv6 addressing, they have already recognized that 2002:ca51:fc74::/48 is 6to4 equivalent of IPv4 address 202.81.252.116.  I have previously used this v4 address to access NRO and claim to administer the reverse lookup for the range 2002:ca51:fc74::/48. This is just a gimmick. For those who are familiar with IPv6 addressing, they have already recognized that 2002:ca51:fc74::/48 is the 6to4 equivalent of IPv4 address 202.81.252.116. I have previously used this v4 address to access NRO and claim to administer the reverse lookup for the range 2002:ca51:fc74::/48.

If you do a "dig -x 2002:ca51:fc74::1", my v6 nameserver will give you an answer saying it is v6-mail.com.

DHCPv6 in Lion

In my last blogpost at :

http://warrenkwok.blogspot.com/2011/07/good-and-bad-news-about-mac-osx-107-on.html

I mistakenly wrote that Mac OS 10.7 (Lion) could not support DHCPv6 client configurations. Some friends told me that they have tested Lion and confirmed that DHCPv6 can be fully supported.  With this good news, all the latest common PC OS (OSX, Windows 7 and Linux) can support DHCPv6.  On a further thought, OSX and Linux have better support of IPv6 configurations than Windows 7 as Windows 7 is still lacking RDNSS as of today.  Windows 7 definitely needs to catch up.

Code of ethics for war-driving

I will join the WTIA-PISA war-driving on this Sunday (18 Dec), an activity of the 2011 SafeWiFi Campaign.

Our team note that people are very concerned about privacy issue as a result of Google's unethical capture of WiFi data all over the world. We ask all participants to sign a statement on code of ethics which include no privacy intrusion, no monitoring of payload, no connection to scanned WiFi access points and all data must be destroyed after statistical analysis. As a further step to ensure no network connection, all team members must have TCP/IP protocols in their notebook PC disabled. We will check against each other such settings to ensure a high level of integrity.

The  planned Macao war-driving by WTIA-PISA in September 2011 was banned by the Macao Government due to privacy issue stirred up by Google.

ITVoice 2012

Last Sunday, I casted my votes to 20 members of ITVoice 2012 in the Election Committee election of the IT Sub-sector. They all won their seats with high vote. Well-done, my friends. This was quite an historical moment so I decided to record the voting results in the picture below. I might watch this blogpost again five years later.

As usual, Charles Mok is again the King of the IT Sub-sector. He harvested 1466 votes, 218 votes more than he got in 2006.

IPv6 address input keyboard

I have placed order for an IPv6 address entry keyboard at US$15 from ipv6buddy.com.

The keys of A-F plus colon, double colon and slash keys which are packed together adjacent to numeric keys is very handy for input of IPv6 addresses and prefix lengths.  This keyboard should have been developed some years ago but not until now.

Server no reboot for 805 days

My server placed in a data center had not been rebooted for over 805 days. Frankly, if there is a fault and if I need to go to the data center for repair, I might find the place but can not remember which rack houses the equipment. Then on 7 December 2011, the server lost connection to the outside world. I sought help from the serving ISP and it told me that the port on the Ethernet switch did not detect any connection. The ISP then called a technician in the data center and it was found the power cable did not plug firmly to the power supply unit. After properly tightened the power cord and reboot, everything got back to normal.

Damn it, my goal of no server reboot for 1000 days just crashed.

Hong Kong WiFi Security Index

Today was my second day in Tokyo for the Cybersecurity Forum organized by the Asia-Pacific Telecommunity.  I gave a presentation on “Promoting WiFi Security Awareness in Hong Kong”. This is what I said to 20 countries of the Asia Pacific region  at the end of my presentation :

If there is just one thing you like to learn from Hong Kong’s experience, it will be the Hong Kong WiFi Security Index.

In-flight WiFi service

I flew to Tokyo today by Cathay Pacific CX548.  When the plane elevated to a certain altitude, the Captain announced that electronic devices of passengers could be switched on.  However, any devices that use WiFi or Bluetooth should be switched off in order to avoid interference to aircraft electronic systems.  Hey, Captain, are you kidding.  In-flight WiFi is an essential service for passengers especially for those flying long haul.  Can you imagine losing Facebook or Gmail for 12 - 14 hours while on the sky.  Boeing aircraft are already providing in-flight WiFi service. Of course, usage charge must be imposed. What's wrong with Cathay Pacific.