Reviving Huawei SANEX9510: Expired Certificates, Zero-Byte Keystore and Lost '@' Symbol Fixed Without Database Restart
A telecom OSS platform based on Huawei SANEX9510 (version V200R003C10SPC110) was restored after ten months of downtime caused by a cascade of seven distinct failures across four independent TLS contours.
The system collects and analyzes signaling traffic (MAP, ISUP, SCCP, TCAP) on two main servers and four DSS collectors. Data flows through four separate encrypted paths: WAS-DAS over Thrift (port 29301), DAS-DSS over FTPS, WAS-DSS over SGDSS (port 6688), and Store-Sybase IQ (port 2988). Each contour uses its own keystore and truststore, producing generic error messages that masked the real causes.
Layer 1: DAS identity certificate replacement
The first certificates to expire belonged to the DAS FTPS identity (CN=GENEX CN Nastar, expired 2025-10-18). A new serverkeystore_das.p12 containing the chain mae.huawei.com → Huawei Wireless Network Product CA → Huawei Equipment CA was deployed to both nodes, allowing DAS to start.
Layer 2: Zero-byte WAS keystore
WAS still failed to start because its identity PKCS#12 file was exactly 0 bytes. The empty file produced only indirect TLS errors instead of a clear fatal message. A new keystore was built from server_final.pem and SI.cer, verified as a valid PrivateKeyEntry with CN=mae.huawei.com valid until 2030.
Layer 3: Single missing '@' in encrypted password
TrustStorePass in ThriftClient.properties had lost its leading '@' during copy-paste through a PTY session. Restoring the character allowed the encrypted password to decrypt correctly and the truststore to open.
Layer 4: Separate FTPS keystore
DAS uses serverkeystore_das.p12 for Thrift but serverkeystore.p12 for FTPS (configured in ftpsCer.properties). A mapping of all property files to their actual keystores prevented accidental breakage of the newly restored WAS-DAS link while the FTPS certificate was replaced.
Layer 5: DSS private-key format incompatibility
New certificates had been loaded on the server in May 2026 but not applied to the DSS collectors. After loading via OMU and LOD CERT, the FTP service still refused to start. The private key had been generated with modern OpenSSL using PBKDF2 with HMAC-SHA512, which the product's legacy OpenSSL (0.9.8/1.0.x) could not process. Re-encrypting the key with matching parameters on a current Ubuntu system resolved the issue.
Layer 6: WAS-DSS SGDSS contour on port 6688
After FTPS was fixed, the GUI still showed Connection Interrupted Between WAS and Device. Manual OpenSSL and Java TLS handshakes confirmed mutual authentication worked. Re-establishing the links between WAS and the DSS collectors brought all four DSS instances online without further configuration changes.
Layer 7: Store connection leak to Sybase IQ
Store reported login errors while Sybase IQ showed 204 established connections against a -gm 300 limit. Restarting only the Store process reduced connections to 113 and restored database writes. No password changes or ALTER USER commands were executed.
An unrelated month-old alarm (Failed to import DAS data to database, Alarm ID 20) was traced to a missing PB_DAS_DIRSIZE table. The table was created manually from the installation DDL; subsequent import cycles succeeded immediately.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.