<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI Light";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">We have been using COBRAS for years, it works fine backing up messages and restoring if necessary, although we rarely ever have to restore a mailbox. We run
it on one of our windows 2008 servers that’s used to run a bunch of random applications/task. The guy from Cisco who developed COBRAS is also very involved and helpful when problems arise.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The only caveat I see is, if you have very large, or many message stores, using it may be cumbersome since I think it can only backup 15 gig at a time.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ed<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> cisco-voip [mailto:cisco-voip-bounces@puck.nether.net]
<b>On Behalf Of </b>Anthony Holloway<br>
<b>Sent:</b> Monday, April 18, 2016 10:14 AM<br>
<b>To:</b> Pete Brown<br>
<b>Cc:</b> cisco-voip@puck.nether.net<br>
<b>Subject:</b> Re: [cisco-voip] DRS Backup Decrypter - Decrypt Failure After Patching<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">As an alternative to DRS, when it comes to restoring messages in Unity Connection, would COBRAS export/import work?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">COBRAS export has a schedule feature, where you can run it as often as you like, and for only certain mailboxes (E.g., Executive leadership, department mailboxes, etc.).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Read a little more about COBRAS export schedule here:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://www.ciscounitytools.com/Applications/General/COBRAS/Help/COBRAS_Briefcase/COBRAS_Briefcase.htm#_Toc383446513">http://www.ciscounitytools.com/Applications/General/COBRAS/Help/COBRAS_Briefcase/COBRAS_Briefcase.htm#_Toc383446513</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I haven't seen anyone doing this, I just know that it's out there. Does anyone have any experience with setting up COBRAS to run on a schedule, exporting all or specific mailboxes, and then restoring messages?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Fri, Apr 15, 2016 at 5:25 PM, Pete Brown <<a href="mailto:jpb@chykn.com" target="_blank">jpb@chykn.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">They're definitely covering the bases on this one. There are a total of 6 Cisco Bug IDs directly related to this. Looks like one for each file on each product that would
have contained the plaintext random key. I guess it was only a matter of time. As much as I hate to see this particular door closed, I understand and agree with the logic behind it.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><a href="http://www.securityfocus.com/bid/83103/discuss" target="_blank" title="http://www.securityfocus.com/bid/83103/discuss
Ctrl+Click or tap to follow the link">http://www.securityfocus.com/bid/83103/discuss</a><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">To those in the DRS group, I apologize for any headache this has caused. But please do not put any additional restrictions in place to unlocking backup data. As customers, we
have a legitimate need to access data from backups without having to perform a full restore. Some customers do not have the resources necessary to stand up sandbox environments for restores. Even if they do, an engineer should not have to spend an entire
day restoring a system in order to fulfill a voicemail extraction request from legal. That's the reason this program was written to begin with. DRS Message Fisher wasn't updated with an option to open encrypted backup sets by inputting the cluster security
password.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Thanks,<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Pete<o:p></o:p></span></p>
<div style="margin-bottom:15.0pt;overflow:auto">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="90%" style="width:90.0%;background:white;border-top:dotted #C8C8C8 1.0pt;border-left:none;border-bottom:dotted #C8C8C8 1.0pt;border-right:none">
<tbody>
<tr>
<td valign="top" style="border:none;padding:0in 0in 0in 0in">
<div>
<p class="MsoNormal" style="margin-top:15.0pt;mso-line-height-alt:15.75pt"><span style="font-size:16.0pt;font-family:"Segoe UI Light","sans-serif";color:#0078D7"><a href="http://www.securityfocus.com/bid/83103/discuss" target="_blank"><span style="text-decoration:none">Multiple
Cisco Unified Products CVE-2016-1319 Information Disclosure Vulnerability</span></a><o:p></o:p></span></p>
</div>
<div style="margin-top:7.5pt;margin-bottom:12.0pt">
<p class="MsoNormal" style="margin-top:15.0pt;line-height:10.5pt"><span style="font-size:10.5pt;font-family:"Segoe UI","sans-serif";color:#666666"><a href="http://www.securityfocus.com" target="_blank">www.securityfocus.com</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-top:15.0pt;line-height:15.0pt"><span style="font-size:10.5pt;font-family:"Segoe UI","sans-serif";color:#666666">SecurityFocus is designed to facilitate discussion on computer security related topics, create computer security
awareness, and to provide the Internet's largest and most comprehensive database of computer security knowledge and resources to the public. It also hosts the BUGTRAQ mailing list.<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div>
<p class="MsoNormal" style="background:white"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> Pete Brown <<a href="mailto:jpb@chykn.com" target="_blank">jpb@chykn.com</a>><br>
<b>Sent:</b> Friday, April 15, 2016 3:42 PM<br>
<b>To:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> DRS Backup Decrypter - Decrypt Failure After Patching</span><span style="font-family:"Calibri","sans-serif";color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<div>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Looks like the party is going to be over for decrypting backup sets without requiring the cluster security password...<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><a href="https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv85926" target="_blank" title="https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv85926
Ctrl+Click or tap to follow the link">https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv8592</a><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">All encrypted DRS backup sets until now have contained a plaintext copy of the randomly generated backup key. It lists the known affected releases as 10.5(2.12901.1),
but this goes all the way from 8.0 to 11.5 and affects CUCM, UCON and UCCX. This is how the decrypter has been able to decrypt backup sets without the cluster security password.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Once this is patched, you may no longer be able to decrypt backups even if you type in the correct password. If you run into this, please let me know and I'll work on
an update.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Thanks,<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri","sans-serif";color:black">Pete<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>