Thursday, November 17, 2005
Adventure 41: Covert Special: 17th November 2005
“Ok…so the DR special is gone..damn it…if anyone has it saved somewhere please email it to me….”…Yup this one Is gonna be tricky…gonna try and do at least some of this…at work…da da, dadaaaa….
17th November 2005:
08:30: Just got in…thought “I know I’ll check my orders…”, you know when you get that sinking feeling…I check the Amaskint web page, click the “Where the bloody hell are my orders” button and log in with Mandy’s account details. There are my orders, and there’s the delivery address I clicked on. The mother in law’s address,….before she moved !!!! Buggger!!!!. I check the ParcelDropped (sorry), website to discover that they don’t have telephone numbers to ring under the category “I’ve sent my parcels to the wrong address” caption, so I figure I can blag it by phoning their “any enquiries” “hot line”…nope it’s all automated “press this button”, then we’re off into fantasy voice recognition mode, so I try saying “yes” every way I can only to discover that the “recognition” bit of the system isn’t quite up to scratch. Still I seem to have redirected some video shaped brown paper covered parcels to the pope, ah well, he needs em more than me….
0845: Gave Spitfire Dave a ring, and explained, suffered the almost inevitable abuse, and then he said he’d ring the new owners of his old house and sort it out for me…phew…(well let’s hope it’s a phew)…
09:00: Just checking my email and discover one from the S.O.D. at CounterStrike….no word of a lie this is the actual email;
-----Original Message-----
From: S.O.D [mailto:soc@counterstrike.com]
Sent: 16 November 2005 11:26
To: cre8
Cc: sod@counterstrike.com
Subject: Analyst Alert / Relevant / Ticket ID DC2000001566434 / Sensor 10.8.0.2 / delarue-002 / Aggressive Mode local machine configured not to respond to unknown IP addresses
Greetings,
On 11/16/2005 at 11:00 GMT our monitoring system created Problem Ticket DC2000001566434.
Analysis
-------------
This message reports the rejection of inbound traffic because the local machine configured not to respond to unknown IP addresses and the cause of rejection is IPsec key rejection.
Symptom Name: Aggressive Mode local machine configured not to respond to unknown IP addresses Severity Level: Relevant Number of Events: 1 ….
<snip>…….
Yup so that’s clear and obvious then….I send a reply….which basically says “please can you send the details through to me in plain English, i.e. what do we have to do….”
I then get the following reply…..
From: S.O.D. [mailto:sod@counterstrike.com]
Sent: 16 November 2005 14:29
To: Cre8
Subject: RE: Ticket DC2000001566434
Cre8,
This how to validate this symptom:
The following three claims regarding the Check Point implementation of IKE Aggressive Mode in VPN-1 4.1 have been made; two of these basically document known IKE limitations, and the third is addressed by the publicly available hotfix. 1.> Usernames are passed in cleartext using IKE Aggressive Mode 2.> Usernames are susceptible to brute-force guessing when using IKE Aggressive Mode 3.> VPN-1 4.1 incorrectly responds to IKE Aggressive Mode requests. LEA ( Log Export API ) is an API for accessing Checkpoint binary log files which are usually not in a clear text format.LEA is a pull mechanism by which a client retrieves the logs from the Check Point management station for real-time remote log analysis.
What to do
A hotfix is available at the Check Point software download site for the third item, in which the VPN-1 4.1 gateway would respond to IKE Aggressive Mode requests even when configured not to respond……
<snip>….
Well that’s clear then….after much deciphering I come to the conclusion that they reckon we should install a patch on our firewall…quite why they couldn’t say that is anyone’s guess….ah well, that’s techies for you…
10:45: Just out on a trip (good eh) to the Hopticians. I went for my two year sight test yesterday, with a smidge of an alterior motive. Basically I’ve been thinking about contact lenses for a little while, not for cosmetic reasons at all, but mainly because my ears have decided they don’t like my glasses and have come up in nasty little sores, also because I can’t wear my glasses playing football I tend to get hit in the face by the ball quite a lot..so today I had to go back for my consultation, and fit and trial 5 pairs of lenses…
11:00: Made it through the labyrinth that is the multi storey car park and I’ve arrived at my destination, lucky me forgot that Thursday is pension / pensioner shopping day…and town is full of doddery old people just stopping in front of me, when they dimly recognise someone who they once said hello to at the local post office 30 years ago….ah bless em…still I’m on time so I don’t care too much.
11:30: Ok been here 30 minutes (Clue’s in the company name…Aversion Express) should have guessed the name is ironic, cuh stupid me eh ?
11:40: Finally get to go in to the examination room where the same South African Optician proceeds to prod my eyeball and squirt some type of fluorine in my eyes. That all done he gets a pair of contact lenses and tries to fit them to my eyes, which are having none of it…”Try not to blink” he advises…hmmm..I wasn’t trying to blink so the chances of me trying not to blink are fairly slim, given that he’s got hold of my eyelid I’m not of a mind to tell him that blinking isn’t something you think about doing…it’s just something that happens….especially when someone is trying to stick foreign bodies in your eyeballs….Finally they’re fitted and it’s really weird…I can like see without glasses.
12:00: He’s wobbling on about the different sorts of lenses I can buy daily or monthly basically seem to be the options..but he’s only recommending daily’s because…they’re more expensive (big shock there)…he didn’t actually say that he said he thought they’d be better to start with but I know what he meant !!! “Right then” he announces, I’ll just go and see if there’s someone who can “teach” me how to put the lenses in and take them out again…should be fun. He’s gone for about 5 minutes then comes back and asks if It’s possible I can come back a little later on today…hmm…I think for a bout a millisecond and reply “sorry no, I can’t”, “how about tomorrow”, slightly confused I agree to go back at 11am tomorrow…kind of well planned out these people…I think they have shares in the car park since, with tomorrow’s appointment it’ll have cost me £6 in parking….hmmmm…..
12:30 Lunch
13:30 Back to work and I have to break the news to Mary….luckily she’s feeling friendly (which she usually is to be fair) and says that it’s fine…apparently though I owe her “presents” whatever that means…..
14:30: Not much to report now…I’m a bit deflated since I wanted to get everything sorted today…Brenty’s off now, because apparently (though no one can confirm it) he was in at 6am “ensuring” all the servers were up and working following last night’s power failure….hmmm..sounds like an excuse to leave early to me, but hey what do I care, good look to him….
15:30: Nothin’ much doing now…
17:00: Time to bloody go home…it’s been a frustrating day one way and another, so home to some good old fashioned home cooking, some kids screaming at each other, a double bill Eastenders wahay…life couldn’t get any better…
19:00: I’m getting a bit peeved…since there seems to be a bit of a sway away from our New Years Eve party. It might be that it’s only mid November and no one wants to think about New Year just yet or it might be that no one wants to come, despite them all saying how good it was last year and how we just simply had to do it all again this…mind you I remember having the same response last year, except people who said that they’d come are now saying that all of a sudden they can’t, it’s not like they were doing me a favour for Christ sake, but I do have costs to cover and if there aren’t going to be enough takers then we’ll have to cancel before we pay for the hall outright, and that would be really really annoying, for two reasons, 1. because I bought £500 worth of disco equipment and 2. because we’ll be stuck at home again, wishing away the hours until it’s midnight, so we can all go to bed..and how sad would that be…. Time to start pressing people for definitive answers I think…
Friday 18th November 2005
“oh yeah it’s really easy isn’t….not….” Lo all well here we go again…Not only have my attempt at getting some contact lenses finally come to fruition…and it only cost me £6 to park and three days to do it…but I have to go again to get “signed off” Signed up more like by the sounds of it….
08:30: Brenty was in bright and early again today (or so he says) so he’s going early too…oh yeah and it’s Friday…no coincidence there at all….
10:00: 1 hour to go until I go and get fitted up….
10:45: Keith our resident cheery bloke (the blissfully unaware) has expressed an interest in our New Years Eve party, so who knows we might have some more attendees…I’m not holding my breath at the moment though….
Just a quick mention Mandy is being very brave and going to the dentist….I don’t know why she worries but she does, so she’s spent a lovely sleepless night worrying about it…
11:10: Made it…bloody car park…why do all the doddery old f$ckers have to go to town the same time as me…I mean they’ve got arrows on the bloody floor, it’s not difficult to work out which way to go….god…for the second day running I’ve circumvented that by driving straight to the top of the car park…I can’t be bothered searching for a space…but it still took me 15 minutes to get parked…
Anyhow like I said I made it and as organised as ever I’m asked to go and sit on the orange waiting chairs…I don’t know what the chairs are waiting for, but I’m hoping It’s not an eye exam since there are loads of them…A little girl about 3 looks up at me and smiles..I smile back and she runs and hides in her mum’s lap…Well she didn’t have to smile at me…I wasn’t going to do anything mental like try and discuss the origins of the universe with her…15 minutes later I’m called through to have my “teaching” session…This is where they teach you to poke yourself in the eye and vainly try and insert a contact lens in each one, having only dropped them on the floor 3 times…the “teacher” says things like, “you know it’s really really easy once you get used to doing it” as she flicks her wrists and twiddles her fingers taking her lenses in and out each time…that really is showing off….finally we’re done and I can go to lunch…
12:30: Lunch
13:30: Back again…not much to report, Brenty and me moving servers from one room to another…
15:30: Brenty’s off he’s got a week off too lucky bugger…….
17:00: The weekend approaches so at least I’ll get a lie in …until 8am…cuh thank heaven for small mercies eh ?
17th November 2005:
08:30: Just got in…thought “I know I’ll check my orders…”, you know when you get that sinking feeling…I check the Amaskint web page, click the “Where the bloody hell are my orders” button and log in with Mandy’s account details. There are my orders, and there’s the delivery address I clicked on. The mother in law’s address,….before she moved !!!! Buggger!!!!. I check the ParcelDropped (sorry), website to discover that they don’t have telephone numbers to ring under the category “I’ve sent my parcels to the wrong address” caption, so I figure I can blag it by phoning their “any enquiries” “hot line”…nope it’s all automated “press this button”, then we’re off into fantasy voice recognition mode, so I try saying “yes” every way I can only to discover that the “recognition” bit of the system isn’t quite up to scratch. Still I seem to have redirected some video shaped brown paper covered parcels to the pope, ah well, he needs em more than me….
0845: Gave Spitfire Dave a ring, and explained, suffered the almost inevitable abuse, and then he said he’d ring the new owners of his old house and sort it out for me…phew…(well let’s hope it’s a phew)…
09:00: Just checking my email and discover one from the S.O.D. at CounterStrike….no word of a lie this is the actual email;
-----Original Message-----
From: S.O.D [mailto:soc@counterstrike.com]
Sent: 16 November 2005 11:26
To: cre8
Cc: sod@counterstrike.com
Subject: Analyst Alert / Relevant / Ticket ID DC2000001566434 / Sensor 10.8.0.2 / delarue-002 / Aggressive Mode local machine configured not to respond to unknown IP addresses
Greetings,
On 11/16/2005 at 11:00 GMT our monitoring system created Problem Ticket DC2000001566434.
Analysis
-------------
This message reports the rejection of inbound traffic because the local machine configured not to respond to unknown IP addresses and the cause of rejection is IPsec key rejection.
Symptom Name: Aggressive Mode local machine configured not to respond to unknown IP addresses Severity Level: Relevant Number of Events: 1 ….
<snip>…….
Yup so that’s clear and obvious then….I send a reply….which basically says “please can you send the details through to me in plain English, i.e. what do we have to do….”
I then get the following reply…..
From: S.O.D. [mailto:sod@counterstrike.com]
Sent: 16 November 2005 14:29
To: Cre8
Subject: RE: Ticket DC2000001566434
Cre8,
This how to validate this symptom:
The following three claims regarding the Check Point implementation of IKE Aggressive Mode in VPN-1 4.1 have been made; two of these basically document known IKE limitations, and the third is addressed by the publicly available hotfix. 1.> Usernames are passed in cleartext using IKE Aggressive Mode 2.> Usernames are susceptible to brute-force guessing when using IKE Aggressive Mode 3.> VPN-1 4.1 incorrectly responds to IKE Aggressive Mode requests. LEA ( Log Export API ) is an API for accessing Checkpoint binary log files which are usually not in a clear text format.LEA is a pull mechanism by which a client retrieves the logs from the Check Point management station for real-time remote log analysis.
What to do
A hotfix is available at the Check Point software download site for the third item, in which the VPN-1 4.1 gateway would respond to IKE Aggressive Mode requests even when configured not to respond……
<snip>….
Well that’s clear then….after much deciphering I come to the conclusion that they reckon we should install a patch on our firewall…quite why they couldn’t say that is anyone’s guess….ah well, that’s techies for you…
10:45: Just out on a trip (good eh) to the Hopticians. I went for my two year sight test yesterday, with a smidge of an alterior motive. Basically I’ve been thinking about contact lenses for a little while, not for cosmetic reasons at all, but mainly because my ears have decided they don’t like my glasses and have come up in nasty little sores, also because I can’t wear my glasses playing football I tend to get hit in the face by the ball quite a lot..so today I had to go back for my consultation, and fit and trial 5 pairs of lenses…
11:00: Made it through the labyrinth that is the multi storey car park and I’ve arrived at my destination, lucky me forgot that Thursday is pension / pensioner shopping day…and town is full of doddery old people just stopping in front of me, when they dimly recognise someone who they once said hello to at the local post office 30 years ago….ah bless em…still I’m on time so I don’t care too much.
11:30: Ok been here 30 minutes (Clue’s in the company name…Aversion Express) should have guessed the name is ironic, cuh stupid me eh ?
11:40: Finally get to go in to the examination room where the same South African Optician proceeds to prod my eyeball and squirt some type of fluorine in my eyes. That all done he gets a pair of contact lenses and tries to fit them to my eyes, which are having none of it…”Try not to blink” he advises…hmmm..I wasn’t trying to blink so the chances of me trying not to blink are fairly slim, given that he’s got hold of my eyelid I’m not of a mind to tell him that blinking isn’t something you think about doing…it’s just something that happens….especially when someone is trying to stick foreign bodies in your eyeballs….Finally they’re fitted and it’s really weird…I can like see without glasses.
12:00: He’s wobbling on about the different sorts of lenses I can buy daily or monthly basically seem to be the options..but he’s only recommending daily’s because…they’re more expensive (big shock there)…he didn’t actually say that he said he thought they’d be better to start with but I know what he meant !!! “Right then” he announces, I’ll just go and see if there’s someone who can “teach” me how to put the lenses in and take them out again…should be fun. He’s gone for about 5 minutes then comes back and asks if It’s possible I can come back a little later on today…hmm…I think for a bout a millisecond and reply “sorry no, I can’t”, “how about tomorrow”, slightly confused I agree to go back at 11am tomorrow…kind of well planned out these people…I think they have shares in the car park since, with tomorrow’s appointment it’ll have cost me £6 in parking….hmmmm…..
12:30 Lunch
13:30 Back to work and I have to break the news to Mary….luckily she’s feeling friendly (which she usually is to be fair) and says that it’s fine…apparently though I owe her “presents” whatever that means…..
14:30: Not much to report now…I’m a bit deflated since I wanted to get everything sorted today…Brenty’s off now, because apparently (though no one can confirm it) he was in at 6am “ensuring” all the servers were up and working following last night’s power failure….hmmm..sounds like an excuse to leave early to me, but hey what do I care, good look to him….
15:30: Nothin’ much doing now…
17:00: Time to bloody go home…it’s been a frustrating day one way and another, so home to some good old fashioned home cooking, some kids screaming at each other, a double bill Eastenders wahay…life couldn’t get any better…
19:00: I’m getting a bit peeved…since there seems to be a bit of a sway away from our New Years Eve party. It might be that it’s only mid November and no one wants to think about New Year just yet or it might be that no one wants to come, despite them all saying how good it was last year and how we just simply had to do it all again this…mind you I remember having the same response last year, except people who said that they’d come are now saying that all of a sudden they can’t, it’s not like they were doing me a favour for Christ sake, but I do have costs to cover and if there aren’t going to be enough takers then we’ll have to cancel before we pay for the hall outright, and that would be really really annoying, for two reasons, 1. because I bought £500 worth of disco equipment and 2. because we’ll be stuck at home again, wishing away the hours until it’s midnight, so we can all go to bed..and how sad would that be…. Time to start pressing people for definitive answers I think…
Friday 18th November 2005
“oh yeah it’s really easy isn’t….not….” Lo all well here we go again…Not only have my attempt at getting some contact lenses finally come to fruition…and it only cost me £6 to park and three days to do it…but I have to go again to get “signed off” Signed up more like by the sounds of it….
08:30: Brenty was in bright and early again today (or so he says) so he’s going early too…oh yeah and it’s Friday…no coincidence there at all….
10:00: 1 hour to go until I go and get fitted up….
10:45: Keith our resident cheery bloke (the blissfully unaware) has expressed an interest in our New Years Eve party, so who knows we might have some more attendees…I’m not holding my breath at the moment though….
Just a quick mention Mandy is being very brave and going to the dentist….I don’t know why she worries but she does, so she’s spent a lovely sleepless night worrying about it…
11:10: Made it…bloody car park…why do all the doddery old f$ckers have to go to town the same time as me…I mean they’ve got arrows on the bloody floor, it’s not difficult to work out which way to go….god…for the second day running I’ve circumvented that by driving straight to the top of the car park…I can’t be bothered searching for a space…but it still took me 15 minutes to get parked…
Anyhow like I said I made it and as organised as ever I’m asked to go and sit on the orange waiting chairs…I don’t know what the chairs are waiting for, but I’m hoping It’s not an eye exam since there are loads of them…A little girl about 3 looks up at me and smiles..I smile back and she runs and hides in her mum’s lap…Well she didn’t have to smile at me…I wasn’t going to do anything mental like try and discuss the origins of the universe with her…15 minutes later I’m called through to have my “teaching” session…This is where they teach you to poke yourself in the eye and vainly try and insert a contact lens in each one, having only dropped them on the floor 3 times…the “teacher” says things like, “you know it’s really really easy once you get used to doing it” as she flicks her wrists and twiddles her fingers taking her lenses in and out each time…that really is showing off….finally we’re done and I can go to lunch…
12:30: Lunch
13:30: Back again…not much to report, Brenty and me moving servers from one room to another…
15:30: Brenty’s off he’s got a week off too lucky bugger…….
17:00: The weekend approaches so at least I’ll get a lie in …until 8am…cuh thank heaven for small mercies eh ?
# posted by cre8 @ 7:16 AM 
