Reverse lookup of a /64 prefix

Reverse lookup is necessary for IPv6 address assigned to SMTP Server otherwise the emails sent out will be treated as spam by other SMTP servers.  To this end, I have asked my serving ISP to dedicate the reverse lookup of  the prefix 2401:300:0:1::/64 to me.  The configuration at my side is tested ok and perfect.

[localhost ~]# dig -x 2401:300:0:1::8080

; <<>> DiG 9.5.2-RedHat-9.5.2-1.fc10 <<>> -x 2401:300:0:1::8080

;; global options:  printcmd

;; Got answer:

;; ->>HEADER<<- 36584="36584" font="font" id:="id:" noerror="noerror" opcode:="opcode:" query="query" status:="status:">

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4

;; QUESTION SECTION:

;0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.0.0.0.0.0.0.3.0.1.0.4.2.ip6.arpa. IN PTR

;; ANSWER SECTION:

0.8.0.8.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.0.0.0.0.0.0.3.0.1.0.4.2.ip6.arpa. 86400IN PTR v6-mail.com.

;; AUTHORITY SECTION:

1.0.0.0.0.0.0.0.0.0.3.0.1.0.4.2.ip6.arpa. 86400 IN NS ns2.i3way.net.

1.0.0.0.0.0.0.0.0.0.3.0.1.0.4.2.ip6.arpa. 86400 IN NS ns1.i3way.net.

;; ADDITIONAL SECTION:

ns1.i3way.net.          3600    IN      A       202.81.252.116

ns1.i3way.net.          3600    IN      AAAA    2401:300:0:1::8080

ns2.i3way.net.          3600    IN      A       202.81.252.117

ns2.i3way.net.          3600    IN      AAAA    2001:470:18:16c::2

;; Query time: 1 msec

;; SERVER: 202.81.252.116#53(202.81.252.116)

;; WHEN: Mon Jan 14 09:07:46 2013

;; MSG SIZE  rcvd: 248

Bank's e-statement should not be attached with email

Shame on Citibank.  It violated the security practice promulgated by the banking authority in HK.  Over the past 12 months, I found that Citibank attached a monthly e-statement pdf to me via email though the attached pdf was password protected.  Fraudsters can disguise themselves as a bank and attach malicious code in pdf.  The chance of success is high as e-statements are so important that target recipients will open and read them to see how much they need to pay.  As far as I know, other banks just alert their users that e-statements are ready online without providing any clickable links in the email.  Until today, Citibank notified me about a new arrangement of no more e-statement attachment.  Unfortunately, Citibank did not offer apology to its customers for ignoring this important security matter previously.

Greylisting and dual-stack mail servers

I notice that some network administrators are now using greylisting on their IPv6 mail server as there is no other IPv6 anti-spam solutions in the market.  They should be minded that that greylisting might not work as expected in a dual-stack configuration.  Why not ?  It is because if the v6 channel does not accept the mail, the sending side will fall back immediately to deliver the same mail over v4  channel.  Unless the greylisting is also employed on IPv4, I do not see the effectiveness of greylisting on IPv6 only for a dual-stack configured mail server.   I have no idea whether this is a weakness or not. 

Targeted Geographical Banner Ads

Today I visited BBC UK website and the banner on the right hand corner was an advertisement of CSL LTE service.  Hey, this is really smart.  BBC detected that the IP address was from Hong Kong and it could select an ad banner of Hong Kong clients.  However, this Internet marketing strategy will fail if I access BBC through a proxy server or VPN.

Install Flash on Nexus 7

Just found out that flash is absent from default Chrome browser of Nexus 7 (Android Jelly Bean OS).  Too bad, I need to browse quite a number of websites running flash.

On googling, I got great hints (http://www.howtogeek.com/120277/how-to-install-flash-on-the-nexus-7-and-other-jelly-bean-devices/)

First download the flash apk from XDA developer forum (http://forum.xda-developers.com/attachment.php?attachmentid=1199371&d=1342343609)

Second, download and install Firefox-beta from Google Play.

Third, before installation of the flash apk, set the security of Nexus 7 to allow running app from other untrusted sources other than Google Play.

So that's all.  Afterward, use Firefox to browse flash websites.  One important step is to change back to the original security settings otherwise one will get into trouble of getting malicious applications installed. 

Netgear 802.11ac adapter

802.11ac client devices are still rarely seen in the market as the ac standard has not been ratified by IEEE yet.  However, I recently come across Netgear A6200 which the manufacturer said can support 867 Mbps if operated on 802.11ac.  This sounds quite OK to me as the device can only have 2 built-in antennas.  However, the USB interface works on USB 2.0 which can operate at maximum of 480 Mbps.  In that case, whatever high speeds in the air interface are then capped to 480 Mbps.  Should manufacturers better claim 802.11ac client devices can have a maximum throughput of 480 Mbps instead of 867 Mbps.

IPv6 speedtest engine

My IPv6 speedtest engine at speedtest.warrenkwok.com is now successfully configured.  Again, it runs Ookla licence free speedtest mini.   Actually, if clients connect via IPv6 channel, it will test the speed of IPv6 connection and similar action for IPv4.    The maximum speed that can be tested is 100 Mbps.

30th anniversary of TCP/IP

On 1 January 1983, TCP/IP was successfully launched to  replace NCP. The advantage of TCP/IP is its versatility. It can switch packets of all shapes and sizes, and work across a varieties of networks.  This set of open network communications protocols has changed the world dramatically.  Special thanks must be conveyed to Vint Cerf, Robert Kahn and Jon Postel.

GovWiFi IPv6 again

I went to Central Library today to experience GovWiFi IPv6 service.  Everything is transparent to users and they even do not know they are accessing Facebook, Google, Yahoo and Youtube over IPv6 channel.  It should be faster than IPv4 connections.  I had two screen captures to verify my IPv6 connection.

GovWiFi now supports IPv6

I am supposed to track all major IPv6 development in HK but I regret that I only noticed a bit late the next generation GovWiFi which supports IPv6 on 802.11n.  Here it is:

http://www.info.gov.hk/gia/general/201212/21/P201212210311.htm

This is a major development of IPv6 in HK.

wrong hole

Wrong hole, this is the most interesting song and lyrics I have ever encountered.

http://www.youtube.com/watch?v=Fm_dlpB0Wmc&feature=rellist&playnext=1&list=PL35EA36D0A5F4367F

The video got 1.9 million hit rates.  Woo, to be honest, if the environment is dark and the two holes are so close, it is not unusual to stick in the wrong hole.

Taobao is on IPv6

Taobao.com is the equivalent of ebay in mainland China.  It has announced that a large scale trial of IPv6 is taking place at :

ipv6.taobao.com

I have tracked the path.   Interestingly, it is going through HK6IX  and CERNET2 as follows:

Netfront (my IPv6 ISP) <-> HK6IX <-> CERNET2 <-> Alibaba <-> IPv6 at Taobao

Thanks to HK6IX and CERNET2 which help to make the connection fast.

HSBC pays little attention to the prevention of email phishing.

I received an email from HSBC about annual service fee.  Usually, if I receive an email from a bank, I will open the email header to identify if it is really coming from a bank or it is just a phishing email.  For the HSBC's email, the sender domain is checked ok.  However, there is no DKIM messages in the email header.  To probe further on email protection, I tried to dig the SPF records of hsbc.com.hk.  Oh no, its SPF is based on "soft fail".  That is a poor setting.   Without the proper use of SPF and DKIM, I can conclude that HSBC pays little attention to the prevention of email phishing.

BlueScreenView

I hate Windows Blue Screen of Death (BSOD).   Just yesterday, one Windows 7 experienced BSOD three times a day.  After reboot, I decided to use BlueScreenView to look at the dump file.  It was shown that the driver athurx.sys caused the hang up.  The driver was used by TP-LINK wireless adaptor and the remedy was to re-install the latest driver from TP-LINK website.  Seems resolved now but have to wait for some more days to verify the stability.

Resources Public Key Infrastructure (RPKI)

My colleagues in HKSAR Government have successfully signed the routing prefixes with RPKI and the results could be checked over Hurricane Electric's BGP portal.

I guess the HKSAR Government is the first entity in Hong Kong to adopt RPKI signing to secure the global routing infrastructure.  RPKI signing is just one part.  For routers to be able to validate RPKI, the routers must be able to support RPKI and there is a need to establish an RPKI-validating cache server with trust anchors of the five RIRs configured.  Again,  I have no doubt that the Government will be the first entity in Hong Kong to adopt the full set of RPKI configurations.

Hotmail and Yahoo email service

A female boss (Miss Erica Yuen) is recruiting an assistant in Facebook.  One statement she made is that " If you are using Hotmail or Yahoo Mail, sorry that you will not be considered. If you can tolerate such poor email service, you are not the kind of person I am looking for."

I have to report this to senior people in Yahoo in US. 

multiple servers for a website

I find the following announcement in a popular website very crazy:

"Dear members,

We have added more servers to deal with traffic increase.  Please remember to access the domain names vip.abc.com, www2.abc.com, www3.abc.com and www4.abc.com. "

It is absolutely not necessary to ask members to memorize the additional domain names. Users will be confused about which one to use at a particular time.  Just a single domain name "www.abc.com" will be fine and with the use of DNS round robin pointing to several IP addresses, the loading of the servers can be evenly distributed.

Just take a look at www.cnn.com:

[localhost~]# dig www.cnn.com +short
www.cnn.com.vgtf.net.
cnn-lax.gslb.vgtf.net.
157.166.241.11
157.166.240.11
157.166.240.13
157.166.241.10

[localhost~]#

Can't stop myself from laughing....

The first three IPv6 websites in HK

Here is the screen shot of the first three IPv6 websites in HK registered with sixy.ch dated back about 1000 days ago.

My managed website bya.org.hk came as the second.  Great work.

US Government IPv6 Deadline

The US Government previously imposed a deadline that by 30 Sept 2012, all Federal agencies must have their public-facing servers running on IPv6.  The deadline has passed already.  Less than 30 % of Federal websites are operating with IPv6.  The situation of mail and DNS servers are even worse. This is the statistics provided by NIST one week ago.

A question remains.  How to push these Federal agencies to quickly deploy IPv6?

CPEs

I have gained 146 CPEs in the past three years through attending security conferences, offering training courses and writing security-related articles.  For renewal of my CISSP credential,  I only need 120 CPEs. 10 CPEs can be carried forward to the next 3-year term.  Counting back, I am wasting 16 CPEs.