Utilizing a variety of techniques, applications, and tools, Team Forrest remotely examines your network over the public Internet. identified weaknesses and vulnerabilities are assessed for risk and detailed, with recommendations, to the customer.

What is a Vulnerability Scan?

A vulnerability scan assesses computer systems, networks, and applications for weaknesses. Vulnerability Scans are recommended (and may be required) for any business conducting e-commerce, hosting a server with a publicly accessible IP Address, or allowing remote access to company assets. Team Forrest recommends a comprehensive scan, including:

1. Checking for vulnerabilities of remote systems
2. Checking for misconfiguration of remote systems, software, and services
3. Checking commonly used passwords
4. Checking Denial of Service sensitivity
5. Checking for Web Vulnerability (such as SQL Injection)

How does a Vulnerability Assessment Work?

Team Forrest performs the scan remotely, accessing your network over the Public Internet. There is nothing for you to do and no software will need to be installed. Our servers will simply assess your network remotely.

Once the scan completes, Team Forrest provides a detailed assessment including identified risks and vulnerabilities, as well as their severity level. Team Forrest also provides recommendations and assisting in correcting any identified flaws or vulnerabilities.

For more information on a Team Forrest Vulnerability Scan / Assessment, please call 888-295-0025 or contact us for details.

Mozilla.com released details today on a critical JavaScript vulnerability in the latest version of the popular Firefox 3.5 Web Browser. The vulnerability allows execution of code on the client (or target) system simply by visiting a website.

No patch is currently available for the flaw and several organizations (such as Scurnia, The Sans Institute, and the United States Computer Emergency Response Team) are recommending the complete disabling of JavaScript in Firefox (see below). Additionally, The Sans Institute is recommending the use of the NoScript Firefox plugin (that enables javascript only from white-listed sites).

Additional information:

• Mozilla Security Blog Post
• Secunia.com Advisory
• United States Computer Emergency Response Team
• NoScript Plugin

How to Disable the Javascript Engine in Firefox:

1. Enter about:config in the browser’s location bar.
2. Type jit in the Filter box at the top of the config editor.
3. Double-click the line containing javascript.options.jit.content setting the value to false.

Mozilla advises that disabling the JIT will result in decreased JavaScript performance and is only recommended as a temporary security measure.  Once users have been received the security update containing the fix for this issue, they should restore the JIT repeating the process above and setting the javascript.options.jit.content value to true.

Update — 7/16/2009

Firefox has introduced version 3.5.1 to address the security risk, as posted on their developer blog:

Firefox 3.5.1 update is now available for download

As part of the Mozilla Corporation’s ongoing security and stability process, Firefox 3.5.1 is now available for Windows, Mac, and Linux users as a free download from www.firefox.com.

We strongly recommend that all Firefox 3.5 users upgrade to this latest release. If you already have Firefox 3.5, you will receive an automated update notification within 24 to 48 hours. This update can also be applied manually by selecting “Check for Updates…” from the Help menu.

For a list of changes and more information, please see the Firefox 3.5.1 release notes.

Please note: If you’re still using Firefox 2.0.0.x, this version is no longer supported and contains known security vulnerabilities. Please upgrade to Firefox 3.5 by downloading Firefox 3.5.1 from www.firefox.com.

This entry was posted by beltzner on Thursday, July 16th, 2009 at 6:34 pm.

Team Forrest offers Asterisk Consulting Services for a wide variety of VoIP, Call Center, and other Telephony Based needs. From small, family business to large Corporations, Team Forrest’s simple philosophy of “Help the Client” ensures we provide great service to meet your needs.

Asterisk Consulting

From carrier services to traditional PBX services, Team Forrest’s Asterisk Consulting Service provides you the solution you need. Services include:

• IVR Development
• Custom AGI Scripting / Programming
• OpenSER Integration
• Calling Card Systems
• Call Center / Sales Queue Development
• Call Recording (call spying, call barging, whisper, etc.)
• Database Integration (Microsoft SQL MSSQL, MySQL, Oracle, etc.)
• Custom Solutions

Emergency Asterisk Support

When a problem comes along, we provide 24/7 Emergency Support to bring your system back to life. Both new and existing clients benefit from our immediate support response.

For immediate support please contact us or call +1 (212) 937-7844.

Remote and Onsite Support

Team Forrest offers immediate remote assistance across the globe. Local, onsite service is also available, with quick response to Michigan, Florida, and New York locations.

Asterisk? Ask us.

With Team Forrest, you get professional consulting at a great price — increased productivity at a lower cost. To see how Team Forrest can help improve your communication needs, contact us. We enjoy talking with clients and look forward to seeing how we can help you.

Asterisk, developed and released by Digium, Inc., is the world’s leading open source telephony engine and tool kit. Asterisk empowers communication with it’s flexibility. Whether working as a simple office telephone system, a robust Call Center platform, or anything in-between, Asterisk provides advanced features at a very low deployment cost.  Asterisk is released as open source under the GNU General Public License (GPL), and it is available for download free of charge. Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Recently, Fred Posner of Team Forrest, assisted Edward Vielmetti with a simple idea — help make information accessible. In this case, the information was the availability of Parking Spots in Ann Arbor, Michigan.

The Ann Arbor Downtown Development Authority (A2DDA) publishes data regarding parking spot availability on the web, however, when you’re driving to the garage navigating to a web site is the least of your worries. So, an idea was born to make parking information readily accessible — and with that, Team Forrest’s Fred Posner built a quick prototype to demonstrate how Asterisk (by Digium) can help rethink how data can be accessed.

In the prototype, a caller can select which garage to query. The system will then speak to the caller the remaining number of spaces and offer 3 options — select another garage, exit (and hear the local weather), or choose to be notified if there are fewer than 10 spaces remaining. If the caller selects the notification option, the system will automatically check once a minute (for 30 minutes) and initiate a call out to the user. The call will remind the user which garage they selected and inform them of the current number of available spaces.

The prototype for this project can be accessed from the Team Forrest main line, at +1 (212) 937-7844. Then, choose 6 for check local Ann Arbor Parking availability.

About Team Forrest

Team Forrest offers complete Internet Consulting services, specializing in VoIP and Asterisk solutions. Team Forrest has one simple goal: Help the client. Whether you need emergency assistance or if you are planning a deployment, Team Forrest is here to help. With over 15 years experience, our team can quickly assess your needs and help deploy the most appropriate solution.

About Asterisk

Asterisk (by Digium) is the world’s leading open source telephony engine and tool kit. Asterisk empowers communication with it’s flexibility. Asterisk is released as open source under the GNU General Public License (GPL), and it is available for download free of charge. Asterisk is the most popular open source software available, with the Asterisk Community being the top influencer in VoIP.

Related Information:

• Fred’s post on VoIP Tech Chat, “Using Asterisk, Cepstral, and Perl to get Parking and Weather.”

To view the code, download the files, or just see the script, go to VoIP Tech Chat (dot com).

UPDATE April 4, 2009 — Frank (user comment) let us know that AnyWho had changed their website. As a result the code has been updated. Thanks Frank!

UPDATE November 18, 2009 — Robert (user comment) let us know of another change. As a result the code has been updated. Thanks Robert!

#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;
$|=1;

my ($cidnum,$cidname,$npa,$nxx,$station,$name);

#----------------------------------------------------------------
# get asterisk initial info
#----------------------------------------------------------------

while(<STDIN>) {
	chomp;
	last unless length($_);
}

#----------------------------------------------------------------
# check if we have a caller id
#----------------------------------------------------------------

if ($ARGV[0]) {
		$cidnum = $ARGV[0];
	} else {
		print qq(VERBOSE "ERROR: no callerid provided" 2\n);
		exit(0);
}

#----------------------------------------------------------------
# check caller id and split into npa, nxx, and station
#----------------------------------------------------------------

if(substr($cidnum,0,1) eq '1'){
	$cidnum=substr($cidnum,1);
}

if(substr($cidnum,0,2) eq '+1'){
	$cidnum=substr($cidnum,2);
}

if ($cidnum =~ /^(\d{3})(\d{3})(\d{4})$/) {
		$npa = $1;
		$nxx = $2;
		$station = $3;
	} elsif ($cidnum =~/\<(\d{3})(\d{3})(\d{4})\>/) {
		$npa = $1;
		$nxx = $2;
		$station = $3;
	} else {
		print qq(VERBOSE "ERROR: unable to parse caller id" 2\n);
		exit(0);
}

print qq(VERBOSE "STATUS: CID is $npa-$nxx-$station" 2\n);

#----------------------------------------------------------------
# check npa, nxx, and station for cid name
# 1 = check. 0 = skip.
#----------------------------------------------------------------

my $AnyWho = '1' ;
my $Google = '1' ;
my $www411 = '1' ;

if ($AnyWho > '0') {
		print qq(VERBOSE "STATUS: checking AnyWho for name lookup" 2\n);
		if ($name = &anywho_lookup ($npa, $nxx, $station)) {
				$cidname = $name;
				print qq(SET VARIABLE CALLERID\(name\) "$cidname"\n);
				print qq(VERBOSE "STATUS: AnyWho said name was $cidname " 2\n);
				exit(0);
			} else {
				print qq(VERBOSE "STATUS: unable to find name with AnyWho" 2\n);
		}
	} else {
		print qq(VERBOSE "STATUS: AnyWho lookup disabled" 2\n);
}

if ($Google > '0') {
		print qq(VERBOSE "STATUS: checking Google for name lookup" 2\n);
		if ($name = &google_lookup ($npa, $nxx, $station)) {
				$cidname = $name;
				print qq(SET VARIABLE CALLERID\(name\) "$cidname"\n);
				print qq(VERBOSE "STATUS: Google said name was $cidname " 2\n);
				exit(0);
			} else {
				print qq(VERBOSE "STATUS: unable to find name with Google" 2\n);
		}
	} else {
		print qq(VERBOSE "STATUS: Google lookup disabled" 2\n);
}

if ($www411 > '0') {
		print qq(VERBOSE "STATUS: checking www411 for name lookup" 2\n);
		if ($name = &www411_lookup ($npa, $nxx, $station)) {
				$cidname = $name;
				print qq(SET VARIABLE CALLERID\(name\) "$cidname"\n);
				print qq(VERBOSE "STATUS: www411 said name was $cidname " 2\n);
				exit(0);
			} else {
				print qq(VERBOSE "STATUS: unable to find name with www411" 2\n);
		}
	} else {
		print qq(VERBOSE "STATUS: www411 lookup disabled" 2\n);
}

#----------------------------------------------------------------
# return results and exit
#----------------------------------------------------------------

print qq(SET VARIABLE CALLERID\(name\) "$cidnum"\n);
print qq(VERBOSE "STATUS: Unknown name for $cidnum " 2\n);
exit(0);

#----------------------------------------------------------------
# parse anywho
# http://whitepages.anywho.com/results.php?qnpa=$npa&qnpanxx=$npa$nxx&qnxx=$nxx&qp=$nxx$station&qstation=$station
# Find More Information for First Last</a>
#----------------------------------------------------------------

sub anywho_lookup {
	my ($npa, $nxx, $station) = @_;
	my $ua = LWP::UserAgent->new( timeout => 45);
	my $URL = 'http://whitepages.anywho.com/results.php';
	$URL .= qq(?qnpa=$npa&qnpanxx=$npa$nxx&qnxx=$nxx&qp=$nxx$station&qstation=$station);
	$ua->agent('AsteriskAGIQuery/1');
	my $req = new HTTP::Request GET => $URL;
	my $res = $ua->request($req);
	if ($res->is_success()) {
		if ($res->content =~ /Find More Information for (.*)<\/a>/) {
			my $clidname = $1;
			return $clidname;
		}
	}
	return "";
}

#----------------------------------------------------------------
# parse google
# http://www.google.com/search?rls=en&q=phonebook:$npa$nxx$station
# <td>First Name<td>(<b>$npa
#----------------------------------------------------------------

sub google_lookup {
	my ($npa, $nxx, $station) = @_;
	my $ua = LWP::UserAgent->new( timeout => 45);
	my $URL = qq(http://www.google.com/search?rls=en&q=phonebook:$npa$nxx$station&ie=UTF-8&oe=UTF-8);
	$ua->agent('AsteriskAGIQuery/1');
	my $req = new HTTP::Request GET => $URL;
	my $res = $ua->request($req);
	if ($res->is_success()) {
		if ($res->content =~ /<td>(.+)<td>\(<b>$npa/) {
			my $clidname = $1;
			return $clidname;
		}
	}
	return "";
}

#----------------------------------------------------------------
# parse 411
# http://www.411.com/search/Reverse_Phone?phone=$npa$nxx$station
# View map, driving directions, and more">Name</a>
#----------------------------------------------------------------

sub www411_lookup {
	my ($npa, $nxx, $station) = @_;
	my $ua = LWP::UserAgent->new( timeout => 45);
	my $URL = qq(http://www.411.com/search/Reverse_Phone?phone=$npa$nxx$station);
	$ua->agent('AsteriskAGIQuery/1');
	my $req = new HTTP::Request GET => $URL;
	my $res = $ua->request($req);
	if ($res->is_success()) {
		if ($res->content =~ /View map, driving directions, and more\">(.*)<\/a>/) {
			my $clidname = $1;
			if ($clidname eq "Listing Detail") {
				if ($res->content =~ /Type: <strong>(.*)<\/strong>/) {
					$clidname = $1;
					if ($res->content =~ /Location: <strong>(.*)<\/strong>/) {
						$clidname = $clidname . " $1";
					}
				}
			}
			return $clidname;
		}
	}
	return "";
}

This perl script will work well as an AGI script — checking AnyWho, Google, and then 411 for a caller’s name or location. If all else fails, the callerid name is set as the callerid number.

The perl script was designed to only use the Internet with minimal installation; so it will work without a database, Perl Asterisk module, or locally hosted NPA / NXX (phone number to region) file.

Team Forrest recommends using a subroutine context to get the callerid when needed; calling the script with either a GoSub or GosubIf command, such as:

exten => s,n,Gosub(cidname-lookup,s,1)
exten => s,n,dial(${PHONE},30,t)
...

...
[cidname-lookup]
exten => s,1,NoOp(looking up callerid name)
exten => s,n,GotoIf($["foo${CALLERID(NAME)}" = "foo" ]?getname)
exten => s,n,GotoIf($["${CALLERID(NAME)}" = "${CALLERID(NUM)}" ]?getname)
exten => s,n,NoOp(caller id name exists as ${CALLERID(NAME)})
exten => s,n,Return
exten => s,n(getname),AGI(calleridname.pl,${CALLERID(NUM)})
exten => s,n,NoOp(Caller ID Name is now ${CALLERID(NAME)})
exten => s,n,Return

Enjoy the file (download here) and remember, Team Forrest is here to assist you will all of your Asterisk, VoIP, or technical needs.

VoIP Tech Chat posted an opinion piece regarding Level 3′s handling of the outage. And, as with most opinion pieces from VoIP Tech Chat, we like to pass it on.

Enjoy.