tag:blogger.com,1999:blog-69826499500472386122011-10-18T22:48:43.818+02:00Notes to self about networking, programming and flux capacitorsYossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.comBlogger231100tag:blogger.com,1999:blog-6982649950047238612.post-10578452691421607212011-10-18T22:46:00.000+02:002011-10-18T22:48:43.885+02:00Sometimes it may be desirable to clear the warning that appear on the F5 LCD panel from remote.<br />This can be achieved easily by entering the following statement over an SSH session:<br /><br /><div class="MsoNormal"><i>for i in 0 1 2 3 4; do for j in 0 1 2 3 4; do lcdwarn -c"${i}" "${j}"; done; done</i></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-1057845269142160721?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-30334139422161190692011-07-18T21:55:00.010+03:002011-07-28T06:16:27.027+03:00<span class="content">Cisco Unified CM is a Business to Business User Application (B2BUA). Therefore, any SIP to SIP call consists of 2 SIP dialogs. It is often useful to pass information from one dialog to the other during the life of the dialogs. This includes call setup, mid call, and end of call messaging. Using the pass through object described, it is possible to trigger transparent pass through of information on from one SIP dialog (representing 1 of the call legs) to the other.<br /><br />The snippet below is an example of a script I used in order to transparently pass through an arbitrary header ("Subject" in this case) in an INVITE message from the inbound call to the outbound call leg.<br /><br />B = {}<br />function B.inbound_INVITE(msg)<br />local pt = msg:getPassThrough()<br />local Subject = msg:getHeader("Subject")<br />if pt and Subject<br />then<br /> pt:addHeader("X-Subject", Subject)<br />end<br />end<br />function B.outbound_INVITE(msg)<br />local Subject = msg:getHeader("X-Subject")<br />if Subject<br />then<br /> msg:addHeader("Subject", Subject)<br /> msg:removeHeader("X-Subject")<br />end<br />end<br />return B<br /><br /></span><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-3033413942216119069?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-67456135662478149472011-04-10T18:49:00.011+03:002011-07-18T22:14:27.325+03:00<span style="font-size:130%;"><span style="font-weight: bold;">Overview</span></span><br /><br />In case you ever worked with or for a service provider you probably know that <a href="http://en.wikipedia.org/wiki/Call_detail_record">CDR </a>(Call Detail record) integrity is one of the most important issues.<br /><br />The reason why <a href="http://en.wikipedia.org/wiki/Call_detail_record">CDR </a>is so important is because it is the most common way for a provider to meter and record service consumption.<br /><br />Normally, in post-paid billing scheme, when a subscriber places a call, the provider's switch generates a call record.<br />Most often the <a href="http://en.wikipedia.org/wiki/Call_detail_record">CDR </a>file is a <a href="http://en.wikipedia.org/wiki/Comma-separated_values">delimited flat file</a> where each record in the file describes a single call (or call leg) and includes details such as - was the called answered or not, how much time did the call last, who was the calling party, what was the destination and lots of additional information regarding the call.<br /><br />Periodically, the provider's billing system (directly or via a mediation system) parses the CDRs resulting in the charges associated with each record/call .<br /><br />It is not hard to guess that if a call record for a specific call is missing or cannot be properly parsed by the billing system - the consuming entity (subscriber or peering partner) can avoid the charges associated with the call and the provider serving the call potentially loses revenue.<br /><br />As previously mentioned, the CDR holds many details about the call. some of these details are actually taken from the signaling messages used throughout the call.<br />this is where it gets interesting - signaling messages may originate from possibly untrusted entities such as peering partner switches and subscribers. <span style="font-weight: bold;">so it leads to the fact that potentially untrusted entities can affect the content of the most important information of a for-profit provider - the CDR.</span><br />Back in the old PSTN days this was less of a worry, ISDN Q.931 and SS7 ISUP were inherently limited in the information that could be injected into signaling messages. protocols were less extensible and specs were clearer and didn't update so often.<br />Going on to SIP, things are a bit easier for the malicious user - many fields in signaling messages can hold alphanumeric values, protocol specs tend to change frequently and when it comes to header field format validation in SIP stacks and application, well it nothing to write home about.<br /><br />In part II I'll provide intimate details of a remote vulnerability I've discovered in known class 4 switch that allows a remote SIP peer to place international calls while avoiding termination charges by CDR corruption.<br /><span style="font-size:78%;"><span style="font-style: italic;">Note to blackhats and fraudsters - the vendor had been notified of this specific vulnerability, so don't hold your breath.</span></span><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-6745613566247814947?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-9894609707339712152011-01-29T17:34:00.008+02:002011-01-29T22:17:28.275+02:00<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://farm5.static.flickr.com/4097/5395495035_98541df2ce_b.jpg"><img style="float: left; margin: 0pt 10px 10px 0pt; cursor: pointer; width: 506px; height: 275px;" src="http://farm5.static.flickr.com/4097/5395495035_98541df2ce_b.jpg" alt="" border="0" /></a><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bgpmon.net/blog/wp-content/uploads/2011/01/egypt.png"><img style="float: left; margin: 0pt 10px 10px 0pt; cursor: pointer; width: 517px; height: 310px;" src="http://bgpmon.net/blog/wp-content/uploads/2011/01/egypt.png" alt="" border="0" /></a><br /><br />http://stat.ripe.net/egypt/<br /><br />http://bgpmon.net/blog/?p=450<br /><br />http://extraexploit.blogspot.com/2011/01/egypt-telecom-as-isolation-bgplay-show.html<br /><br />http://asert.arbornetworks.com/2011/01/egypt-loses-the-internet/<br /><br />http://www.renesys.com/blog/2011/01/egypt-leaves-the-internet.shtml<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-989460970733971215?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-29165286509660999602010-06-05T03:22:00.006+03:002010-06-05T03:57:30.605+03:00<div style="text-align: right;">שימו לב שמתבצע נסיון הונאה בפייסבוק, כאשר המטרה היא גנבת סיסמאות לחשבון הפייסבוק.<br /><br />ההונאה עובדת בצורה הבאה:<br />מופיע לינק מאחד החברים המפנה לאתר מחוץ לפייסבוק.<br /><img src="file:///C:/Users/yossi/AppData/Local/Temp/moz-screenshot-4.png" alt="" /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_-kU59jkshkU/TAmgxV_jtTI/AAAAAAAAC_U/VF8Yl5RXIUk/s1600/Capture2.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer; width: 320px; height: 114px;" src="http://4.bp.blogspot.com/_-kU59jkshkU/TAmgxV_jtTI/AAAAAAAAC_U/VF8Yl5RXIUk/s320/Capture2.JPG" alt="" id="BLOGGER_PHOTO_ID_5479087191250679090" border="0" /></a><br />באתר החיצוני מוצגת תמונה. לחיצה על התמונה מוליכה לקישור שנראה כמו דף הכניסה של פייסבוק, אך למעשה מדובר בהעתק זדוני (ראו הדגשה בצהוב).<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_-kU59jkshkU/TAmfJBy-j2I/AAAAAAAAC_E/EjeMo8o0QEQ/s1600/Capture.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer; width: 320px; height: 178px;" src="http://2.bp.blogspot.com/_-kU59jkshkU/TAmfJBy-j2I/AAAAAAAAC_E/EjeMo8o0QEQ/s320/Capture.JPG" alt="" id="BLOGGER_PHOTO_ID_5479085399122808674" border="0" /></a><br />משתמש המבצע כניסה לאתר הזדוני למעשה חושף את שם המשתמש והסיסמא לפייסבוק ולאחר מכן מופנה לדף חיצוני כלשהו.<br /><br />הגורם הזדוני משתמש בזהות של הקורבן ובעזרתו מפרסם את הקישור הזדוני לחברים נוספים.<br /><br /></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-2916528650966099960?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com2tag:blogger.com,1999:blog-6982649950047238612.post-51221453970462820772010-05-31T23:02:00.007+03:002010-06-04T03:04:08.054+03:00<div style="text-align: right;">חברים שימו לב שלאור המצב יש עליה בהתקפות על אתרים בעלי זהות ישראלית מצד גורמים טורקים.<br /><br />אני ממליץ למנהלי רשת / אבט"מ של אתרים המזוהים עם ישראל לשקול ביצוע חסימה זמנית של הגישה מכתובות טורקיות.<br /><br />כמובן שהדבר אינו מספק הגנה מלאה שכן האתר עדיין חשוף להתקפות דרך פרוקסי או בוטנט.<br /><br />לחילופין, בהנחה בהאתר מיועד לקהל ישראלי בלבד, ניתן לאפשר גישה רק לטווחי הרשתות הישראליות. שיטה זו עדיפה בהתמודדות עם התקפות של גורמי חו"ל אך חשוב לשים לב שקיימת אפשרות לטעויות בזיהוי, דהיינו מניעת גישה מישראלים או גורמים מורשים אחרים שהכתובות שלהם אינן מופיעות ברשימה מסיבה זו או אחרת.<br /><br />בכל מקרה, יש לבצע בדיקה בסביבה מבוקרת לפני הפעלה של הגבלת הגישה על המערכת החיה והדבר הוא על אחריות המשתמש בלבד.<br /><br /><span style="color: rgb(255, 0, 0);">* עדכון - קיימים מספר דיווחים על כך שרבות מההתקפות מגיעות <a href="http://www.robtex.com/as/as9121.html#bgp">מהכתובות של טורק טלקום</a>. הכתובות הללו נכללות ברשימה למטה כך שאתרים שכבר ישמו את החסימה המוצעת אינם חשופים להתקפות מספק זה.<br /><br /></span><span style="font-weight: bold;">להלן רשימת הרשתות הטורקיות</span><br /></div># Total Networks: 319<br /># Total Subnets: 11,228,096<br />62.29.0.0/17<br />62.108.64.0/19<br />62.244.192.0/18<br />62.248.0.0/17<br />77.67.128.0/17<br />77.72.184.0/21<br />77.73.216.0/21<br />77.75.32.0/21<br />77.75.216.0/21<br />77.79.64.0/18<br />77.92.0.0/19<br />77.92.96.0/19<br />77.92.128.0/19<br />77.223.128.0/19<br />77.245.144.0/20<br />78.40.224.0/21<br />78.111.96.0/20<br />78.135.0.0/17<br />78.160.0.0/11<br />79.98.128.0/21<br />79.99.176.0/21<br />79.123.128.0/17<br />79.170.168.0/21<br />79.171.16.0/21<br />80.71.128.0/20<br />80.93.208.0/20<br />80.251.32.0/20<br />80.253.240.0/20<br />81.6.64.0/18<br />81.8.0.0/17<br />81.21.160.0/20<br />81.22.96.0/20<br />81.91.16.0/20<br />81.91.112.0/20<br />81.212.0.0/14<br />82.145.224.0/19<br />82.150.64.0/19<br />82.151.128.0/19<br />82.222.0.0/16<br />83.66.0.0/16<br />84.17.64.0/19<br />84.44.0.0/17<br />84.51.0.0/18<br />85.29.0.0/18<br />85.95.224.0/19<br />85.96.0.0/12<br />85.119.32.0/21<br />85.119.64.0/21<br />85.153.0.0/16<br />85.158.96.0/21<br />85.159.64.0/21<br />85.159.72.0/21<br />85.235.64.0/19<br />86.108.128.0/17<br />87.251.0.0/19<br />88.224.0.0/11<br />89.19.0.0/19<br />89.106.0.0/19<br />89.107.224.0/21<br />89.252.128.0/18<br />90.158.0.0/15<br />91.93.0.0/16<br />91.102.160.0/21<br />91.142.142.0/24<br />91.151.80.0/20<br />91.188.192.0/18<br />91.191.160.0/20<br />91.195.138.0/23<br />91.198.49.0/24<br />91.198.61.0/24<br />91.198.124.0/24<br />91.198.185.0/24<br />91.198.189.0/24<br />91.199.73.0/24<br />91.199.111.0/24<br />91.199.166.0/24<br />91.199.191.0/24<br />91.208.61.0/24<br />91.208.70.0/24<br />91.208.199.0/24<br />91.208.206.0/24<br />91.212.178.0/24<br />91.213.1.0/24<br />91.213.245.0/24<br />91.213.253.0/24<br />91.213.254.0/24<br />91.216.91.0/24<br />91.216.119.0/24<br />92.42.32.0/21<br />92.43.80.0/21<br />92.44.0.0/15<br />92.61.0.0/20<br />92.63.0.0/20<br />93.89.16.0/20<br />93.89.64.0/20<br />93.91.64.0/20<br />93.93.24.0/21<br />93.94.192.0/21<br />93.94.248.0/21<br />93.95.176.0/21<br />93.155.0.0/17<br />93.182.64.0/18<br />93.184.144.0/20<br />93.186.112.0/20<br />93.187.64.0/21<br />93.187.200.0/21<br />93.190.120.0/21<br />93.190.216.0/21<br />94.54.0.0/15<br />94.73.128.0/18<br />94.78.64.0/18<br />94.79.64.0/18<br />94.101.80.0/20<br />94.102.0.0/20<br />94.102.64.0/20<br />94.103.32.0/20<br />94.120.0.0/14<br />94.138.192.0/19<br />94.199.32.0/21<br />94.199.200.0/21<br />95.0.0.0/12<br />95.65.128.0/17<br />95.70.128.0/17<br />95.128.56.0/21<br />95.130.168.0/21<br />95.142.128.0/20<br />95.173.0.0/19<br />95.173.160.0/19<br />95.183.128.0/17<br />109.232.216.0/21<br />109.235.248.0/21<br />178.18.192.0/20<br />178.22.8.0/21<br />178.233.0.0/16<br />178.240.0.0/13<br />188.3.0.0/16<br />188.38.0.0/16<br />188.41.0.0/16<br />188.56.0.0/14<br />188.64.208.0/21<br />188.95.144.0/21<br />188.124.0.0/19<br />188.125.160.0/19<br />188.132.128.0/17<br />193.0.61.0/24<br />193.23.156.0/24<br />193.25.124.0/23<br />193.28.225.0/24<br />193.34.132.0/23<br />193.36.0.0/24<br />193.36.39.0/24<br />193.36.184.0/24<br />193.37.135.0/24<br />193.37.154.0/24<br />193.41.2.0/23<br />193.42.216.0/24<br />193.58.236.0/24<br />193.104.13.0/24<br />193.104.109.0/24<br />193.104.124.0/24<br />193.104.130.0/24<br />193.104.138.0/24<br />193.104.201.0/24<br />193.105.78.0/24<br />193.105.208.0/24<br />193.105.211.0/24<br />193.105.234.0/24<br />193.105.243.0/24<br />193.108.213.0/24<br />193.109.134.0/23<br />193.110.170.0/23<br />193.110.208.0/21<br />193.140.0.0/16<br />193.143.226.0/24<br />193.150.165.0/24<br />193.164.9.0/24<br />193.186.208.0/24<br />193.188.198.0/23<br />193.189.142.0/24<br />193.192.96.0/19<br />193.200.134.0/24<br />193.200.170.0/24<br />193.200.180.0/24<br />193.200.188.0/24<br />193.201.128.0/22<br />193.201.149.192/26<br />193.201.157.0/25<br />193.202.18.0/24<br />193.202.120.0/24<br />193.218.113.0/24<br />193.218.200.0/24<br />193.223.76.0/24<br />193.243.192.0/19<br />193.254.228.0/23<br />193.254.252.0/23<br />193.255.0.0/16<br />194.0.130.0/24<br />194.0.142.0/24<br />194.0.178.0/24<br />194.0.202.0/24<br />194.9.174.0/24<br />194.24.168.0/23<br />194.24.224.0/23<br />194.27.0.0/16<br />194.29.208.0/21<br />194.36.160.0/24<br />194.50.84.0/24<br />194.50.179.0/24<br />194.54.32.0/19<br />194.60.73.0/24<br />194.69.206.0/24<br />194.107.22.0/24<br />194.110.150.0/24<br />194.110.213.0/24<br />194.125.232.0/22<br />194.126.230.0/24<br />194.140.227.0/24<br />194.169.253.0/24<br />194.242.32.0/24<br />195.8.109.0/24<br />195.33.192.0/18<br />195.39.224.0/23<br />195.46.128.0/19<br />195.49.216.0/21<br />195.85.242.0/24<br />195.85.255.0/24<br />195.87.0.0/16<br />195.95.149.0/24<br />195.95.160.0/24<br />195.95.179.0/24<br />195.112.128.0/19<br />195.114.108.0/23<br />195.128.32.0/21<br />195.128.254.0/23<br />195.137.222.0/23<br />195.138.222.0/24<br />195.140.196.0/22<br />195.142.0.0/16<br />195.149.85.0/24<br />195.149.116.0/24<br />195.155.0.0/16<br />195.174.0.0/16<br />195.175.0.0/16<br />195.177.206.0/23<br />195.177.230.0/23<br />195.182.25.0/24<br />195.182.42.0/24<br />195.190.20.0/24<br />195.191.118.0/23<br />195.200.222.0/24<br />195.214.128.0/18<br />195.216.232.0/24<br />195.234.52.0/24<br />195.234.165.0/24<br />195.244.32.0/19<br />195.245.227.0/24<br />212.2.192.0/19<br />212.12.128.0/19<br />212.15.0.0/19<br />212.29.64.0/18<br />212.31.0.0/19<br />212.50.32.0/19<br />212.57.0.0/19<br />212.58.0.0/19<br />212.64.192.0/19<br />212.65.128.0/19<br />212.68.32.0/19<br />212.79.96.0/20<br />212.98.0.0/19<br />212.98.192.0/18<br />212.101.96.0/19<br />212.108.128.0/19<br />212.109.96.0/19<br />212.109.224.0/19<br />212.115.0.0/19<br />212.125.0.0/19<br />212.127.96.0/19<br />212.133.128.0/17<br />212.146.128.0/17<br />212.154.0.0/17<br />212.156.0.0/16<br />212.174.0.0/16<br />212.175.0.0/16<br />212.252.0.0/16<br />212.253.0.0/16<br />213.14.0.0/16<br />213.43.0.0/16<br />213.74.0.0/16<br />213.128.64.0/19<br />213.139.192.0/19<br />213.139.224.0/19<br />213.142.128.0/19<br />213.143.224.0/19<br />213.144.96.0/19<br />213.148.64.0/19<br />213.153.128.0/19<br />213.153.160.0/19<br />213.153.192.0/18<br />213.155.96.0/19<br />213.161.128.0/19<br />213.186.128.0/19<br />213.194.64.0/18<br />213.211.0.0/19<br />213.232.0.0/18<br />213.238.128.0/18<br />213.243.0.0/19<br />213.243.32.0/19<br />213.248.128.0/18<br />213.254.128.0/19<br />217.17.144.0/20<br />217.31.224.0/20<br />217.31.240.0/20<br />217.64.208.0/20<br />217.68.208.0/20<br />217.116.192.0/20<br />217.131.0.0/16<br />217.169.192.0/20<br />217.174.32.0/20<br />217.195.192.0/20<br /><br /><br /><div style="text-align: right; font-weight: bold;">להלן רשימת הרשתות הישראליות<br /></div><br /># Total Networks: 270<br /># Total Subnets: 4,747,712<br />46.116.0.0/15<br />46.120.0.0/15<br />62.0.0.0/16<br />62.56.128.0/17<br />62.90.0.0/16<br />62.122.224.0/21<br />62.128.32.0/19<br />62.219.0.0/16<br />77.124.0.0/14<br />79.176.0.0/13<br />80.70.128.0/20<br />80.74.96.0/20<br />80.74.112.0/20<br />80.178.0.0/15<br />80.230.0.0/16<br />80.244.160.0/20<br />80.246.128.0/20<br />80.250.144.0/20<br />81.5.0.0/18<br />81.199.0.0/16<br />81.218.0.0/16<br />82.80.0.0/15<br />82.102.128.0/18<br />82.166.0.0/16<br />83.130.0.0/16<br />83.143.8.0/21<br />84.94.0.0/15<br />84.108.0.0/14<br />84.228.0.0/15<br />85.64.0.0/15<br />85.130.128.0/17<br />85.159.160.0/21<br />85.250.0.0/16<br />87.68.0.0/14<br />89.138.0.0/15<br />91.90.128.0/20<br />91.135.96.0/20<br />91.143.224.0/20<br />91.193.4.0/22<br />91.193.48.0/22<br />91.194.4.0/23<br />91.194.114.0/23<br />91.195.162.0/23<br />91.196.84.0/22<br />91.197.60.0/22<br />91.197.100.0/22<br />91.198.5.0/24<br />91.198.70.0/24<br />91.198.129.0/24<br />91.198.205.0/24<br />91.198.254.0/24<br />91.199.29.0/24<br />91.199.53.0/24<br />91.199.69.0/24<br />91.199.94.0/24<br />91.199.99.0/24<br />91.199.100.0/24<br />91.199.119.0/24<br />91.199.202.0/24<br />91.199.215.0/24<br />91.200.144.0/22<br />91.202.168.0/22<br />91.203.120.0/22<br />91.205.152.0/22<br />91.206.170.0/23<br />91.207.34.0/23<br />91.207.90.0/23<br />91.207.206.0/23<br />91.207.240.0/23<br />91.208.86.0/24<br />91.208.118.0/24<br />91.208.129.0/24<br />91.208.139.0/24<br />91.208.140.0/24<br />91.208.147.0/24<br />91.208.218.0/24<br />91.209.113.0/24<br />91.209.182.0/24<br />91.212.76.0/24<br />91.212.114.0/24<br />91.212.189.0/24<br />91.213.152.0/24<br />91.213.176.0/24<br />91.214.100.0/22<br />92.61.224.0/20<br />92.240.0.0/19<br />93.157.80.0/21<br />93.172.0.0/15<br />93.175.32.0/19<br />94.127.72.0/21<br />94.159.128.0/17<br />94.188.128.0/17<br />94.230.80.0/20<br />95.35.0.0/16<br />95.86.64.0/18<br />95.129.32.0/21<br />95.142.16.0/20<br />95.175.32.0/19<br />95.215.128.0/22<br />109.64.0.0/14<br />109.95.128.0/21<br />109.160.128.0/17<br />109.186.0.0/16<br />109.226.0.0/18<br />109.234.16.0/21<br />109.253.0.0/16<br />147.237.0.0/16<br />178.249.104.0/21<br />188.64.96.0/21<br />188.64.200.0/21<br />188.120.128.0/19<br />192.114.84.0/22<br />192.114.160.0/19<br />192.116.192.0/18<br />192.117.128.0/18<br />193.16.147.0/24<br />193.17.42.0/24<br />193.17.68.0/24<br />193.17.74.0/24<br />193.22.80.0/24<br />193.27.92.0/23<br />193.28.155.0/24<br />193.30.161.0/24<br />193.33.16.0/23<br />193.33.234.0/23<br />193.34.56.0/22<br />193.36.176.0/24<br />193.37.128.0/23<br />193.37.130.0/24<br />193.39.79.0/24<br />193.41.202.0/24<br />193.41.208.0/23<br />193.43.244.0/22<br />193.46.64.0/24<br />193.47.165.0/24<br />193.47.248.0/24<br />193.93.96.0/22<br />193.104.44.0/24<br />193.104.62.0/24<br />193.104.77.0/24<br />193.104.115.0/24<br />193.104.117.0/24<br />193.104.119.0/24<br />193.104.147.0/24<br />193.105.99.0/24<br />193.105.199.0/24<br />193.106.52.0/22<br />193.106.204.0/22<br />193.108.195.0/24<br />193.108.211.0/24<br />193.109.78.0/23<br />193.109.82.0/24<br />193.110.2.0/23<br />193.138.92.0/24<br />193.142.151.0/24<br />193.169.70.0/23<br />193.169.88.0/23<br />193.169.104.0/23<br />193.169.246.0/23<br />193.178.218.0/24<br />193.178.220.0/24<br />193.186.2.0/24<br />193.186.163.0/24<br />193.200.30.0/24<br />193.200.154.0/24<br />193.201.155.128/25<br />193.222.129.0/24<br />193.238.28.0/22<br />193.238.188.0/22<br />193.238.208.0/22<br />193.239.108.0/22<br />193.243.183.128/26<br />193.254.206.0/23<br />194.1.145.0/24<br />194.8.76.0/23<br />194.8.88.0/23<br />194.11.19.0/24<br />194.29.32.0/20<br />194.50.71.0/24<br />194.50.175.0/24<br />194.54.168.0/22<br />194.56.215.0/24<br />194.88.136.0/23<br />194.90.0.0/19<br />194.90.32.0/19<br />194.90.64.0/18<br />194.90.128.0/17<br />194.110.249.0/24<br />194.116.226.0/23<br />194.116.230.0/23<br />194.150.218.0/23<br />194.153.101.0/24<br />194.177.16.0/22<br />194.187.84.0/22<br />194.213.4.0/24<br />194.242.24.0/23<br />194.247.166.0/23<br />195.2.250.0/23<br />195.10.194.0/24<br />195.10.220.0/24<br />195.10.222.0/24<br />195.22.148.0/23<br />195.28.166.0/23<br />195.28.180.0/23<br />195.35.85.0/24<br />195.60.176.0/23<br />195.60.232.0/22<br />195.62.18.0/23<br />195.62.30.0/23<br />195.66.118.0/24<br />195.69.236.0/22<br />195.72.116.0/21<br />195.82.128.0/23<br />195.88.234.0/23<br />195.93.234.0/23<br />195.95.183.0/24<br />195.110.40.0/23<br />195.128.176.0/23<br />195.137.164.0/24<br />195.160.240.0/22<br />195.177.108.0/22<br />195.182.33.0/24<br />195.189.140.0/23<br />195.189.192.0/23<br />195.190.19.0/24<br />195.190.23.0/24<br />195.191.52.0/23<br />195.200.92.0/23<br />195.200.205.0/24<br />195.200.238.0/23<br />195.211.68.0/22<br />195.216.252.0/24<br />195.225.46.0/23<br />195.225.62.0/23<br />195.234.26.0/23<br />195.242.118.0/23<br />195.242.174.0/24<br />195.244.22.0/23<br />195.245.108.0/23<br />195.250.33.0/24<br />195.250.47.0/24<br />204.52.208.0/24<br />212.25.64.0/19<br />212.25.96.0/19<br />212.29.192.0/19<br />212.29.224.0/19<br />212.48.64.0/19<br />212.68.128.0/19<br />212.76.96.0/19<br />212.116.160.0/19<br />212.117.128.0/19<br />212.143.0.0/16<br />212.150.0.0/16<br />212.179.0.0/17<br />212.179.128.0/17<br />212.199.0.0/17<br />212.199.128.0/17<br />212.235.0.0/18<br />212.235.64.0/18<br />213.8.0.0/16<br />213.57.0.0/16<br />213.137.64.0/19<br />213.151.32.0/19<br />213.173.32.0/19<br />217.21.64.0/20<br />217.21.80.0/20<br />217.22.112.0/20<br />217.65.32.0/20<br />217.132.0.0/16<br />217.194.192.0/20<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-5122145397046282077?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-38781012063887794902009-06-14T07:13:00.004+03:002009-06-14T07:37:45.829+03:00A cross continent toll fraud operation was uncovered by <a href="http://newark.fbi.gov/dojpressrel/2009/nk061209.htm">FBI </a>and national law enforcement agencies in Italy, Philippines and other countries.<br />The investigation has been ongoing since 2006 and relates to conduct ranging from October 2005 through December 2008.<br /><br />The scam financiers, Pakistani nationals residing in Italy hired the services of professional crackers-for-hire and paid the amount of $100 for each PBX they could break into. Those financiers allegedly used the compromised systems to transmit over 12 million minutes of telephone calls valued at more than $55 million over the hacked networks of victim corporations in the United States alone.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-3878101206388779490?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com5tag:blogger.com,1999:blog-6982649950047238612.post-90873911444490252292009-06-13T03:26:00.003+03:002009-06-13T03:37:06.719+03:00SG Magazine bring the same old <a href="http://www.scmagazineuk.com/IT-company-hit-with-52000-bill-after-hacker-used-system/article/123156/">story</a> we've heard before. misconfigured PBX, voice mail system with default or easy to guess PIN codes, unneeded options turned on (dial out via voice mail system TUI) and one or more individuals eager to make calls to Bulgaria on the expense of the unsuspecting <span style="color: rgb(0, 0, 0);"><span style="color: rgb(0, 0, 0);">Winnipeg-based HUB Computer Solutions.</span></span><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-9087391144449025229?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-37011966362007724732009-06-12T04:26:00.003+03:002009-06-13T03:37:47.632+03:00The Hamilton Spectator <a href="http://www.thespec.com/News/Business/article/511976">reports </a>that several small businesses <span id="ctl00_ContentPlaceHolder_article_NavWebPart_Article_ctl00___BodyLineup__" class="articlebody">on the Hamilton Mountain </span>suffer huge loses due to voice mail toll fraud. now these cases are a few month old, but I'll still post it for reference.<br /><br />The phreaker exploited weak/default PIN codes protecting the voice mail system and were able to dial in to the voice mail system and originate an outgoing international call, in similar to DISA or call forward exploits. it is also a reminder that toll fraud was here long before IPT.<br /><br />These cases really sums up the recipe for a good toll fraud:<br /><ol><li>PBX and added value components configured in an insecure manner</li><li>Unneeded services and options are left on by default</li><li>Weak authentication meathods, default or easy to guess PIN codes</li><li>No monitoring of system utilization, call logs, abnormal events</li><li>And finally one or more indeviduals with the passion to call some exotic far away place or simply to make money on an unsuspecting PBX owner expense.</li></ol><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-3701196636200772473?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-28893652932078653572009-06-12T04:03:00.002+03:002009-06-12T04:15:07.813+03:00Sipera Systems which specializes in security solutions for IPT released a mini <a href="http://www.sipera.com/index.php?action=company,press_release&amp;id=660">report</a> with the conclusion that even with the <span style="font-size:100%;"><span style="color: black; font-family: Arial;">growing awareness of VoIP and UC vulnerabilities not much is actually being done to mitigate these threates.<br /></span></span><span style="font-size:100%;"><span style="font-family: Arial;">Sipera's Adam Boone</span></span> highlights <span style="color: black; font-family: Arial;"><span style="font-size:100%;">the primary security architecture shortcomings leading to toll fraud:<br /></span></span><ol><li><span style="font-weight: bold;">Telecom Connectivity Vulnerabilities:</span> Many enterprises have moved to SIP trunking for low-cost telecommunications connectivity. Unfortunately, these enterprises often rely on Session Border Controllers for security of real-time VoIP and UC traffic, making them highly vulnerable to toll fraud. In production security architecture analysis, Sipera has identified nine common configuration errors, vulnerabilities and functional limitations that leave enterprises using SBCs for VoIP security exposed to toll fraud risk.</li><li><span style="font-weight: bold;">Application-Level Vulnerabilities:</span> In many cases, application servers, voicemail systems, and other communication systems can be easily exploited by fraudsters because of weak passwords and authentication schemes. Furthermore, security policy enforcement mechanisms in such systems are often inadequate to stop fraudsters from using them to gain access to toll calling facilities.</li><li><span style="font-weight: bold;">End-Point Vulnerabilities:</span> Weak security on user devices and inadequate authentication schemes enable fraudsters to exploit these devices to pose as authorized users and gain access to toll calling facilities.<br /></li></ol><span style="color: black; font-family: Arial;"><span style="font-size:100%;"> </span></span><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-2889365293207865357?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com3tag:blogger.com,1999:blog-6982649950047238612.post-47208225138661072782009-04-20T19:56:00.006+03:002009-04-20T20:35:30.373+03:00<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_-kU59jkshkU/Seyt_3X3cfI/AAAAAAAACyY/T_jlGzhJ86E/s1600-h/networkmonitoring.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer; width: 246px; height: 320px;" src="http://1.bp.blogspot.com/_-kU59jkshkU/Seyt_3X3cfI/AAAAAAAACyY/T_jlGzhJ86E/s320/networkmonitoring.jpg" alt="" id="BLOGGER_PHOTO_ID_5326823771979870706" border="0" /></a><br />MIT Tech reported that the IS&amp;T, the institute central IT department has been monitoring and recording all ingress and ingress network traffic on campus without an official policy or user notification. the monitoring practice was implemented on 1999 for security and network anomaly detection .<br /><br />While there are some valid privacy issues here, I'm not going to address it here, you can find the gory details <a href="http://tech.mit.edu/V129/N20/networkmonitoring.html">here</a>.<br />There is something totally different that worries me - the graph showing the network traffic entering IS&amp;T’s network security monitoring system, its a 1Gb interface and guess what...its fully utilized most of the time. Not so great for IDS and legal type applications.<br /><br /><br /><br /><img src="file:///C:/DOCUME%7E1/joss/LOCALS%7E1/Temp/moz-screenshot.jpg" alt="" /><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-4720822513866107278?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com1tag:blogger.com,1999:blog-6982649950047238612.post-54104924930476167952009-02-15T23:22:00.002+02:002009-02-15T23:33:08.262+02:00According to "<a href="http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/">The register</a>" NSA is willing to pay billions of dollars to anyone that can offer an eavesdropping solution that will allow the agency to listen on P2P voice calls and IM messages.<br />Now since Skype isn't making big bucks for parent company eBay, selling a key escrow that will allow NSA to use less computational resources to decrpyt the information might be an easy to generate extra revenue.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-5410492493047616795?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-85357585388869815822009-01-25T21:52:00.004+02:002009-01-25T21:57:39.393+02:00Wishing gung hei faat choih 恭喜發財<br />Good luck, success and prosperity in the new Chinese year of the Ox<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-8535758538886981582?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-66463915354535643672008-12-31T23:31:00.000+02:002008-12-31T23:32:49.960+02:00<i><span style="font-size:130%;">I would like to wish you happy new year,<br />May this New Year bring newly found prosperity, love, happiness and delight in your life.</span></i><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-6646391535453564367?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-88194885061535998352008-12-06T15:08:00.005+02:002008-12-06T15:33:33.660+02:00Recent vishing attacks have been conducted by criminal taking advantage of a known bug in older <a href="http://www.asterisk.org/">Asterisk </a>PBX systems. According to an <a href="http://www.fbi.gov/">FBI </a>advisory <a href="http://www.ic3.gov/media/2008/081205-2.aspx">published </a>on <a href="http://www.ic3.gov/default.aspx">The Internet Crime Complaint Center</a> the attackers exploited the known bug to gain unauthorized access to numerous Asterisk PBX systems and later used these systems as mass auto-dialers. The attackers generated thousends of calls to victims in which they attempted to extract sensitive information from the victims.<br /><a href="http://www.pcworld.com/businesscenter/article/155074/fbi_criminals_autodialing_with_hacked_voip_systems.html">PCWorld has more information</a><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-8819488506153599835?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-20521526398552987322008-08-23T13:36:00.003+03:002008-08-23T14:09:08.467+03:00According to <a href="http://ap.google.com/article/ALeqM5goW0z-9WpWqoWdbcc7-Sz5HWd2dQD92MA5400">EILEEN SULLIVAN with AP</a>, unauthorized calls to the middle east were placed over the <a href="http://www.fema.gov/">FEMA </a>phone system causing an estimated damage of $12,000 in call charges to organization - A part of homeland security Dept.<br />The organization is blaming the undisclosed contractor/integrator of the newly installed voicemail system for not securing the system.<br />I'm just guessing here, but it sounds like someone left an unprotected DISA access or didn't enforce user PIN codes policy allowing the phreaker to user default vendor PIN codes to configure call forward to the middle eastern destination number.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-2052152639855298732?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-91373309059503111252008-07-13T11:27:00.004+03:002008-07-13T11:39:41.297+03:00Recently some blogs and minor websites embed pictures from the following source: http://i7san.jeeran.com/dsc[x].jpg where x is a varying number. the picture contains malicious vbs code. it is recommended not to stop the browser from downloading the picture, not to allow unknown vbs code to run and notify the site owner.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-9137330905950311125?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-36196198012368372132008-07-06T17:39:00.004+03:002008-07-06T21:53:25.154+03:00If you have received an instant message from one of your contact with a link to x.<span style="font-weight: bold;">imagecrisp.inf</span>o or x.<span style="font-weight: bold;">imagecroco.info</span> with x being your contact name, kindly disregard this message and most importantly <span style="font-weight: bold;">do not enter your password and windows live credentials</span> on that web site!<br /><br />Most likely that your contact's account has been compromised and those messages are sent without his knowledge.<br /><br />If you have already entered your credentials in the rouge web site, <span style="font-weight: bold;">change your Windows Live password as soon as possible</span>. Although not tested, the logic is that bad agent will no longer have your password and won't be able to send messages on your behalf.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-3619619801236837213?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com2tag:blogger.com,1999:blog-6982649950047238612.post-72358067715160497662008-04-28T20:59:00.002+03:002008-04-28T21:11:00.895+03:00As I'm starting to see some of my <span class="blsp-spelling-error" id="SPELLING_ERROR_0">MSN</span> contacts getting affected by a new scam, I would like to warn all readers not to submit any details to <a href="http://www.deletefinder.com/">www.deletefinder.com</a> web site.<br />This site claims to "...easily find out who deleted you from <span class="blsp-spelling-error" id="SPELLING_ERROR_1">MSN</span> Messenger..." if you just submit your <span class="blsp-spelling-error" id="SPELLING_ERROR_2">MSN</span> user and password. I think it goes without saying that you should not reveal your credentials to untrusted parties with invalidated identity.<br />You may also get promotion messages for this service from a "trusted" MSN contact, disregard it as this contact has been hijacked.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-7235806771516049766?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com1tag:blogger.com,1999:blog-6982649950047238612.post-78546287539706279272008-04-21T22:03:00.003+03:002008-05-30T19:33:27.670+03:00<a href="http://www.pc.co.il/Index.asp?CategoryID=72&amp;VolID=531#art16565">http://www.pc.co.il/Index.asp?CategoryID=72&amp;VolID=531#art16565</a><br /><br /><a href="http://quotes.walla.co.il/?w=/134/1193411">http://quotes.walla.co.il/?w=/134/1193411</a><br /><br /><a href="http://www.wallatrade.co.il/ts.cgi?tsscript=item&amp;path=124&amp;id=1193411&amp;page=info">http://www.wallatrade.co.il/ts.cgi?tsscript=item&amp;path=124&amp;id=1193411&amp;page=info</a><br /><br /><a href="http://career.themarker.com/tmc/article.jhtml?ElementId=is20071111_200020&amp;layer=career&amp;layer2=coupon&amp;layer3=misc">http://career.themarker.com/tmc/article.jhtml?ElementId=is20071111_200020&amp;layer=career&amp;layer2=coupon&amp;layer3=misc</a><br /><br /><a href="http://www.thecom.co.il/article.php?id=4738">http://www.thecom.co.il/article.php?id=4738</a><br /><br /><a href="http://www.cfb.co.il/SmarTrade/Ext/Section/Articles/ExtSecArticle_Print/1,1733,,00.html?articleId=590929">http://www.cfb.co.il/SmarTrade/Ext/Section/Articles/ExtSecArticle_Print/1,1733,,00.html?articleId=590929</a><br /><br /><a href="http://www.thecom.co.il/article.php?id=4738&amp;prt=1">http://www.thecom.co.il/article.php?id=4738&amp;prt=1</a><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-7854628753970627927?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-84137721395581399652007-09-01T16:55:00.000+03:002008-12-09T01:31:00.308+02:00<a href="http://1.bp.blogspot.com/_-kU59jkshkU/RtlyxuYH_yI/AAAAAAAABfw/J4q7Iozj-EY/s1600-h/P8290027.JPG"><img id="BLOGGER_PHOTO_ID_5105237851189542690" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://1.bp.blogspot.com/_-kU59jkshkU/RtlyxuYH_yI/AAAAAAAABfw/J4q7Iozj-EY/s320/P8290027.JPG" border="0" /></a><br /><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div> </div><div>I've had a nice time in Hong Kong, but it's always good to be back home. My schedule was very tight so haven't had the chance to take some photos of the city, so on the last day i took a picture of the office view - showing what i believe to be the 'Kowloon' island and the old runway. </div><div><br /></div><div><a href="http://3.bp.blogspot.com/_-kU59jkshkU/RtlxhOYH_xI/AAAAAAAABfo/DCxOgWbzj-o/s1600-h/P8290026.JPG"><img id="BLOGGER_PHOTO_ID_5105236468210073362" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://3.bp.blogspot.com/_-kU59jkshkU/RtlxhOYH_xI/AAAAAAAABfo/DCxOgWbzj-o/s320/P8290026.JPG" border="0" /></a></div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-8413772139558139965?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-21803687952436316602007-08-26T18:57:00.000+03:002007-08-26T19:03:39.075+03:00I've landed at <span class="blsp-spelling-error" id="SPELLING_ERROR_0">Hong</span> Kong airport a few hours ago. I'm here on a short term business trip but i'll try to find the time to take some picture and notes of this unique country.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-2180368795243631660?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com0tag:blogger.com,1999:blog-6982649950047238612.post-28816780738018202792007-08-09T07:15:00.000+03:002007-08-09T07:20:30.085+03:00I <span class="blsp-spelling-corrected" id="SPELLING_ERROR_0">Finally</span> gave in and created a <span class="blsp-spelling-error" id="SPELLING_ERROR_1"><span class="blsp-spelling-error" id="SPELLING_ERROR_0">LinkedIn</span></span> account.<br />It's available on: <a href="http://www.linkedin.com/in/yossibenhagai">http://www.linkedin.com/in/yossibenhagai</a><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/6982649950047238612-2881678073801820279?l=yossibh.blogspot.com' alt='' /></div>Yossi Ben Hagaihttp://www.blogger.com/profile/04333294185376322010noreply@blogger.com1