[00:03.720 --> 00:07.780]  This is HNNCast, with your host, Space Rogue.
[00:08.040 --> 00:11.880]  This is HNNCast for the Weekend Eight, June 5th, 2009.
[00:12.940 --> 00:15.440]  Our top story this week...
[00:16.540 --> 00:22.320]  StrongWebmail.com recently offered a $10,000 prize if anyone could break into its CEO's email account.
[00:22.660 --> 00:29.800]  It didn't take long for the team from Secure Science to submit a claim for the $10,000 after finding several cross-site scripting vulnerabilities.
[00:30.940 --> 00:34.740]  StrongWebmail.com attempted to use two-factor authentication to secure its site.
[00:35.020 --> 00:39.220]  However, they evidently did not take into account the old standby of the man-in-the-middle attack.
[00:40.060 --> 00:43.760]  When will companies learn that hacking challenges such as this don't do anyone any good?
[00:44.100 --> 00:48.580]  If your product fails, you're out the prize money and look like a bunch of buffoons like StrongWebmail.
[00:48.780 --> 00:51.440]  And if your product survives, you end up with a false sense of security.
[00:52.160 --> 00:56.900]  Save your prize money and invest in some real security, like maybe an independent third-party assessment.
[00:57.720 --> 01:04.900]  Last Wednesday, in Chicago's central business district known as The Loop, approximately one-third of the pay-and-display parking payment stations stopped working.
[01:05.240 --> 01:09.580]  The problem was so bad that the city's police were instructed to stop issuing parking tickets.
[01:10.100 --> 01:15.260]  Chicago Mayor Daley attempted to originally explain away the problem as a, quote, computer glitch, unquote.
[01:15.700 --> 01:22.240]  However, some third-party observers have now speculated that this may in fact have been an attack on the so-called smart parking meters.
[01:22.880 --> 01:33.500]  More information from the company that runs the meters for the city, as well as the manufacturer, is expected soon, just in time for the upcoming talk about smart parking meters at DEFCON later this summer.
[01:34.240 --> 01:34.800]  Coincidence?
[01:35.420 --> 01:35.900]  Maybe.
[01:36.780 --> 01:41.040]  Online criminals are digging their way deeper and deeper into Windows-controlled ATM machines.
[01:41.220 --> 01:50.080]  A report recently released by Trustwave details Windows-based malware specifically targeted at ATM machines to gather mag-stripe data and PIN numbers for later retrieval.
[01:50.440 --> 01:54.480]  The malware has been found in several ATMs in the field across Eastern Europe.
[01:54.820 --> 02:02.940]  The coolest thing about this, in my opinion, is that the criminals can retrieve the collected card numbers and PINs via the receipt printer of the ATM machine.
[02:03.680 --> 02:08.320]  Banks really need to stop writing this fraud off as a cost of doing business and start doing something about it.
[02:08.980 --> 02:20.040]  School administrators of Reading High School in Pennsylvania withheld the diplomas of the entire senior class earlier this week and instead handed the students empty folders during the graduation ceremony.
[02:20.440 --> 02:26.560]  This after school officials discovered a computer intrusion that had altered the grades of at least 34 students the night before.
[02:27.120 --> 02:30.920]  Wow, so the grades weren't even tallied until a few hours before graduation?
[02:31.380 --> 02:31.720]  Great.
[02:32.120 --> 02:34.580]  Now the seniors get to pick up their diplomas in the cafeteria.
[02:35.040 --> 02:36.940]  Talk about a graduation day to remember.
[02:37.480 --> 02:40.700]  Hope whoever was in charge of the security on that system gets reamed.
[02:41.760 --> 02:52.060]  Adobe has recently committed to hardening its Reader and Acrobat products, as well as starting a quarterly patch schedule after severe recent criticism from security researchers regarding the company's slow response to vulnerabilities.
[02:52.500 --> 02:54.580]  The first patch is due out next Tuesday.
[02:54.580 --> 02:56.880]  Yes, that's the same day as Microsoft.
[02:57.700 --> 03:03.800]  So if there is a vulnerability to discover the day after the scheduled patch, I now have to wait three months for the next patch before it gets fixed?
[03:04.000 --> 03:05.600]  How is this any faster than before?
[03:06.560 --> 03:09.680]  If you're looking for a job, you could become a hacker for Uncle Sam.
[03:10.160 --> 03:20.800]  Nearly all the largest military defense contractors, including Northrop Grumman, General Dynamics, Lockheed Martin, and Raytheon, are moving quickly to snatch up valuable limited talent in the online security arena.
[03:21.140 --> 03:27.840]  The government contractors are not only hiring, but also looking to buy smaller companies that specialize in both offensive and defensive areas.
[03:28.160 --> 03:34.240]  The companies are preparing for a massive push in new online security contracts expected soon from the Obama administration.
[03:34.860 --> 03:39.280]  The data loss database has announced the winner of its oldest data loss incident contest.
[03:39.280 --> 03:48.760]  The winning entry, submitted by Sortholm, detailed a set of union books stolen in 1953, which included the social security numbers of over 700 union members.
[03:49.440 --> 03:56.420]  My own entry of 20,000 social security numbers sold to West African fraudsters in 1998 earned a measly honorable mention.
[03:56.680 --> 03:59.620]  Which is nice and all, but I doubt I'll be getting the Mac Mini prize.
[04:01.780 --> 04:04.060]  Advertise with us here on Hacker News.
[04:04.460 --> 04:08.740]  Podcast, website, and package combinations available.
[04:09.260 --> 04:18.680]  Email sales@hackernews.com The .org top-level domain will soon be cryptographically signed with DNSSEC.
[04:18.680 --> 04:25.440]  The Public Interest Registry, which oversees the .org management, hopes to have the full domain space using DNSSEC by next year.
[04:25.760 --> 04:32.140]  In addition, NIST and ICANN have announced plans to use DNSSEC to sign the DNS Root Zone by the end of 2009.
[04:33.060 --> 04:41.960]  PADI, a black Labrador retriever, has sniffed out 35,000 illegal DVDs in Malaysian warehouses, many destined for export to Singapore and other countries.
[04:42.240 --> 04:44.980]  PADI was supplied to Malaysian officials by the MPAA.
[04:46.480 --> 04:53.080]  An old domain, once used by the RBN, or Russian Business Network, a known group of malware spreaders, is once again active.
[04:53.700 --> 04:57.980]  Belladen.net is once again spewing forth malware as fast as people can connect to it.
[04:58.260 --> 05:03.700]  The site is receiving redirected visitors from as many as 40,000 compromised websites, according to WebSense.
[05:03.960 --> 05:11.440]  It is thought that the 40,000 sites were compromised with the current trend of SQL injection, a familiar strategy of the old RBN.
[05:12.540 --> 05:17.440]  Remember Mafia Boy, the script kitty who DDOS'd a bunch of high-profile sites back in 2000?
[05:17.800 --> 05:21.260]  Well, he is still around and winning writing awards for non-fiction in Canada.
[05:21.820 --> 05:27.960]  His recent book, Mafia Boy, How I Cracked the Internet and Why It's Still Broken, won the Arthur Ellis Award for non-fiction.
[05:28.520 --> 05:29.980]  Dude, you didn't crack anything.
[05:30.180 --> 05:31.640]  You launched a few DOS attacks.
[05:31.800 --> 05:33.760]  You're nothing more than a glorified script kitty.
[05:35.680 --> 05:40.300]  Remember, if you have any hacker-related news, be sure to send it to us here at the Hacker News Network.
[05:40.660 --> 06:00.680]  As always, you can be reached at contact at hackernews.com or find us online at our website, www.hackernews.com For more information about this week's stories, or to discuss them in depth, be sure to visit www.hackernews.com This is Space Rogue for the Hacker News Network.