[00:08.400 --> 00:12.400]  The, uh, European Space Agency, the ISIS team, so, that's you.
[00:39.240 --> 00:42.840]  You're watching HNNCast with Space Rogue on the Hacker News Network.
[00:47.250 --> 00:49.610]  HNNCast is sponsored by...
[00:50.730 --> 00:51.850]  Immunity Incorporated.
[00:52.310 --> 00:53.590]  Knowing you are secure.
[00:54.910 --> 00:56.010]  Become a sponsor.
[00:56.010 --> 01:07.310]  Email sales at hackernews.com This is Space Rogue for the Hacker News Network, and this is HNNCast for the third week of October, 2009.
[01:08.090 --> 01:18.470]  This week, we have stories on the second paid choice breach, Rogue AV tricks 43 million, Time Warner put 65,000 at risk, and Metasploit is sold.
[01:19.030 --> 01:20.810]  But first, our top story.
[01:21.310 --> 01:36.510]  Once featured on America's Most Wanted, Edwin Pena is scheduled to arrive in New Jersey this week after being extradited from Mexico to face charges that he defrauded long-distance telephone companies out of $1.4 million in an elaborate voice-over IP scam.
[01:37.150 --> 01:50.470]  Pena was arrested in 2006 along with his partner in crime, Robert Moore, after the pair would sell wholesale voice-over IP services at extremely discounted rates, and then would route the traffic over compromised telephone company networks.
[01:50.470 --> 01:56.150]  The pair would gain access to the networks, usually by misconfigured Cisco routers with default passwords.
[01:57.190 --> 02:00.070]  Moore once claimed that it was so easy a caveman could do it.
[02:00.750 --> 02:05.610]  Moore was sentenced to 18 months back in 2006 and has already served his time.
[02:06.550 --> 02:10.230]  He claims that Pena paid him only $20,000 to do the break-ins.
[02:10.770 --> 02:17.130]  Pena, on the other hand, used much of his ill-gotten gains in collecting BMWs, including this pimped-out yellow one.
[02:17.590 --> 02:18.110]  Sweet!
[02:19.830 --> 02:24.310]  The telephone companies that were easy to breach were, unfortunately, not named in the complaint.
[02:26.070 --> 02:34.750]  Rapid7, a security services company headquartered in Boston, has bought the open-source project Metasploid, the world's largest database of public-tested exploits.
[02:35.230 --> 02:41.710]  Many people in the community are looking at this as a good thing, with more resources being thrown at the project, it can only get better, right?
[02:42.430 --> 02:50.970]  However, those of us who are a bit more skeptical look at the history of others who have gone before, like Nessus, or Lofcrack, or even the original H&M.
[02:51.610 --> 02:54.790]  Sure, it looks great now, but let's see where we are in a year or so.
[02:55.390 --> 03:00.030]  We will remain cautiously optimistic and wish Metasploit folks all the best.
[03:00.030 --> 03:02.170]  But if this pic of H.D.
[03:02.250 --> 03:06.390]  Moore in a suit is any indication of the future, get ready to spork.
[03:07.410 --> 03:16.810]  For the second time in a month, payroll services provider PayChoice has been breached, forcing them to shut down their online payroll service portal, OnlineEmployer.com.
[03:17.150 --> 03:21.710]  The breach was discovered after some clients noticed fake employees being added to their payrolls.
[03:22.390 --> 03:28.250]  PayChoice's investigation has revealed that the intruders gained access by exploiting the change password function on the website.
[03:28.250 --> 03:35.450]  The breach just happens to coincide with a major conference for the American Payroll Association, leaving many shops understaffed.
[03:35.750 --> 03:41.790]  If the attack was planned to coincide with the conference, it shows an increase in sophistication on the part of the bad guys.
[03:42.290 --> 03:45.130]  Make sure your defenses are in order before you leave your kingdom.
[03:46.930 --> 03:54.210]  A Time Warner cable modem and Wi-Fi router deployed to 65,000 customers have been found to all have the same password.
[03:54.860 --> 03:58.190]  This could allow a remote attacker to intercept all Internet traffic.
[03:58.510 --> 04:04.690]  The vulnerability lies with the Time Warner's SMC8014 series cable modem Wi-Fi router combo.
[04:05.390 --> 04:10.090]  David Chen, who originally discovered the vulnerability, contacted Time Warner four weeks ago.
[04:10.090 --> 04:12.750]  But they told them there was nothing they could do about it.
[04:13.170 --> 04:19.290]  However, shortly after Wired.com reported on the issue, Time Warner suddenly decided that it was something that they could work on.
[04:19.850 --> 04:21.310]  Let's hear it for full disclosure.
[04:22.510 --> 04:25.650]  We'll be right back with more HNNCast right after these messages.
[04:43.820 --> 04:45.660]  Welcome back to HNNCast.
[04:45.660 --> 04:52.440]  A year-long study by Symantec researchers entitled Report on Rogue Security Software was released last Monday.
[04:52.980 --> 05:01.140]  Symantec indicated on the report that they found 250 varieties of scam security software being sold online for between $30 and $100 each.
[05:02.200 --> 05:09.900]  Distribution was handled by an extremely efficient affiliate model that may have tricked as many as 43 million people to download and pay for the fake software.
[05:11.200 --> 05:17.080]  South Korea is blaming North Korea for a cyber raid of its Chemicals Accident Response Information System.
[05:17.560 --> 05:23.980]  Access was apparently gained after the attackers copied the login ID from a compromised personal computer of an army officer.
[05:24.560 --> 05:30.400]  You know, it must be nice to have a boogeyman nearby that you can conveniently blame everything on with no way to verify anything.
[05:30.920 --> 05:36.920]  I have no way to confirm this either, but I seriously doubt that North Korea has any ability to cyber attack anything.
[05:37.920 --> 05:41.300]  And now Courtnee brings us a story about robot security.
[05:41.720 --> 05:42.120]  Courtnee?
[05:43.820 --> 05:44.980]  Thanks, Space Rogue.
[05:45.900 --> 05:50.360]  Research in the area of autonomous robots is fueling some amusing gadgets in the marketplace.
[05:50.860 --> 06:05.660]  The Roomba, for instance, while a very cool device, is rather simple compared to what's actually possible, like the RoboSapien, Rovio, and SpyKey, each of which can be controlled wirelessly and sport a built-in webcam and microphone, and each of which can easily be hacked.
[06:06.680 --> 06:14.260]  Researchers at the University of Washington recently released a study that showed that all three of these robots were vulnerable to very basic remote attacks.
[06:14.700 --> 06:18.300]  Kind of freaky to think that the toy you got for Christmas is spying on you, eh?
[06:19.340 --> 06:22.160]  Well, Asimov's three laws of robotics don't exist yet.
[06:22.480 --> 06:27.420]  If you are developing or building robots, remember they may be just as vulnerable to attack as your desktop.
[06:28.780 --> 06:30.000]  That's it for me this week.
[06:30.220 --> 06:32.140]  This is Courtnee for the Hacker News Network.
[06:32.480 --> 06:33.840]  Back to you, Space Rogue.
[06:36.220 --> 06:37.020]  Thanks, Courtnee.
[06:37.940 --> 06:42.240]  Oh, and speaking of Courtnee, two weeks ago she brought us a report on homebrew intelligence reports.
[06:42.740 --> 06:51.660]  Well, Project Grey Goose, an open-source intelligence initiative, has teamed up with the University of Albany to investigate power grid blackouts caused by cyber attacks.
[06:52.240 --> 06:56.260]  The project hopes to find out just how vulnerable power grid SCADA systems really are.
[06:56.260 --> 06:59.500]  Evidently, private industry, which essentially owns the U.S.
[06:59.600 --> 07:02.200]  power grid, enjoys strong protection from public scrutiny.
[07:02.640 --> 07:10.960]  This new project hopes to publicly disclose its results in an effort to increase pressure on lawmakers to fund cybersecurity initials before a cyber attack.
[07:11.580 --> 07:12.880]  Sounds like a good idea.
[07:14.680 --> 07:16.960]  Last week, we told you about Solo, a.k.a. Gary McKinnon's final, final appeal over his extradition to the U.S. to face charges of breaking into NASA computers.
[07:23.360 --> 07:25.320]  Well, it looks like he gets yet another chance.
[07:26.540 --> 07:34.680]  The U.K. Home Secretary has agreed to temporarily stay the extradition to look at new evidence regarding SOLO's diagnosis of Asperger's syndrome.
[07:35.280 --> 07:40.700]  If the Home Secretary actually cancels his extradition, SOLO would likely still face a trial in the U.K.
[07:41.140 --> 07:48.680]  However, the Office of the Director of Public Prosecutions has said that they do not feel that they have enough sufficient evidence to prosecute him in the United Kingdom.
[07:49.280 --> 07:53.680]  You know, this is the seventh year of this case, and frankly, I'm just getting a little bit tired of it.
[07:54.200 --> 07:59.740]  Before we get to the quickies this week, we here at HNN are proud to announce a major expansion to HackerNews.com.
[08:00.160 --> 08:07.940]  The Community Public section is now live and contains all sorts of goodness, from con listings to cool video offerings, and all sorts of other cool stuff.
[08:08.900 --> 08:11.900]  Yes, for those that don't know, Community Public relates to SNMP.
[08:12.820 --> 08:13.620]  Still confused?
[08:14.040 --> 08:14.580]  Try Google.
[08:15.100 --> 08:18.770]  Oh, and you can also find the top entries to the HNN Picture Contest.
[08:19.460 --> 08:20.460]  Yes, finally!
[08:20.880 --> 08:24.840]  The winning entry for the DEFCON 17 Picture Contest goes to...
[08:25.540 --> 08:31.260]  Brian Brown, who took this photo of a huge HNN sticker displayed during Hacker Court at Black Hat.
[08:31.720 --> 08:34.360]  If you've never seen Hacker Court, I highly recommend it.
[08:34.880 --> 08:43.760]  Runner-up photos include a picture of an HnN sticker on the DOD Cybercrime Center Table and the picture of DEFCON organizer Dark Tangent holding a pile of stickers.
[08:44.460 --> 08:49.980]  If the HNN sticker had been stuck to a Hack Me sign and then put on his back, then it might have won.
[08:50.600 --> 08:53.780]  But congratulations to Brian and everyone who helped spread the word.
[08:54.020 --> 08:54.360]  Thanks.
[08:54.600 --> 08:58.720]  You can check out all the top photo entries in the Community Public section on HackerNews.com.
[09:00.080 --> 09:03.000]  We'll be right back with the HNN Quickies right after these messages.
[09:19.440 --> 09:21.180]  Welcome back to HNNCast.
[09:21.420 --> 09:24.380]  And now for a few quick stories we found on the net this week.
[09:26.640 --> 09:34.800]  The Taiwan office of Yahoo has had to issue an apology for its most recent Open Hack Day after Hack Girls were brought in to entertain some of the developers.
[09:56.790 --> 10:00.230]  This caused shouts of sexism to arise from the blogosphere, which is good.
[10:00.710 --> 10:04.930]  But from the looks of it, these guys really wouldn't know what to do with a good lap dance anyway.
[10:06.050 --> 10:15.870]  An ex-Ford employee has been arrested and faces up to 10 years in jail after copying secret company data to a USB stick and providing it to a competing vehicle manufacturer in China.
[10:16.330 --> 10:18.750]  Remember, folks, to secure those USB ports.
[10:19.010 --> 10:21.070]  I find Superglue works really well.
[10:22.150 --> 10:31.250]  Cheers Liquor Mart, the largest liquor retailer in the Colorado Springs, Colorado area, has had their network breached and the debit card details of thousands of customers stolen.
[10:31.250 --> 10:35.890]  Details of how many customers or how the attackers gained access have not been released.
[10:36.410 --> 10:41.090]  People need to stop entering their pin numbers at point-of-sale machines and just hit the cancel button.
[10:41.470 --> 10:42.850]  Credit, not debit.
[10:43.450 --> 10:50.770]  The 2,000 machine-strong Gumbler botnet has awoken after being dormant for five months and is infecting websites with exploit code.
[10:51.150 --> 10:57.290]  The code then inserts an iframe into the RSS feed to infect users via recent Acrobat or Flash vulnerabilities.
[10:58.590 --> 11:01.990]  Z-Bot, or Zeus, is still raking in big dough.
[11:02.390 --> 11:16.330]  The online banking Trojan recently took Gen Labs Corp of Chino, California for $437,000, Plainview Christian Academy in Texas for $42,000, and Pease Development Authority of New Hampshire for $77,000.
[11:17.090 --> 11:18.890]  Someone's getting awfully rich here.
[11:19.510 --> 11:23.350]  Both CanSecWest and Source Boston have announced their call for Paceverse.
[11:23.350 --> 11:27.310]  Both conferences take place this spring in Vancouver and Boston, respectively.
[11:28.450 --> 11:36.090]  One of the most secure operating systems available, OpenBSD, has released version 4.6 with an entirely new install procedure.
[11:36.550 --> 11:43.270]  Despite being available free for download, if you really want to support the project, buy a CD or a t-shirt, or just give them money.
[11:43.430 --> 11:44.150]  They deserve it.
[11:44.850 --> 11:59.110]  A feature-length film on Ada Byron Lovelace, called Byron and Babbage, A Calculating Story, is set to be released on PBS, but the project needs help, specifically in the form of testimonials from people about Ada Lovelace, and in help publicizing the film.
[11:59.470 --> 12:05.230]  You can find the link for more information in the comments section for this episode of HNNCast on our website.
[12:06.230 --> 12:09.730]  This would be a great way to help counteract Yahoo's use of Hack Girls.
[12:10.290 --> 12:18.370]  A report released by the GAO indicates that NASA has suffered 1,120 security incidents in 2007 and 2008.
[12:18.850 --> 12:20.910]  Guess they haven't learned much since Solo hit.
[12:21.550 --> 12:24.790]  Maybe after he gets extradited over here, he can point out the flaws for them.
[12:25.310 --> 12:29.650]  The free malware scanner, Microsoft Security Essentials, is being deemed an early success.
[12:29.650 --> 12:36.770]  In its first week of operation, Microsoft says it removed over 4 million pieces of malware on over 500,000 machines.
[12:37.970 --> 12:38.450]  Wow.
[12:38.450 --> 12:40.450]  Malware numbers always surprise me.
[12:40.990 --> 12:48.190]  A large number of people in the security industry, both White Hat and Black Hat, are in Seattle this week for the annual Microsoft event known as Blue Hat.
[12:48.750 --> 12:54.590]  By inviting security luminaries to their campus, Microsoft hopes to inspire its coders to write with security in mind.
[12:55.170 --> 12:59.190]  You know, given recent history, it's hard to say just really how well that's working out.
[12:59.190 --> 13:16.470]  China has decided that the OSVDB, CERT CVE, BugTrack, etc., etc., are not enough and that the world needs yet another vulnerability database and has opened the China National Vulnerability Database, or CNVDB, ABCXYZ.
[13:17.650 --> 13:21.650]  As we mentioned a few weeks ago, October is National Cybersecurity Awareness Month.
[13:21.790 --> 13:29.670]  And since we still don't have a cyber czar, nor do we really need one, President Barack Obama has released a video asking all Americans to remain cyber-vigilant.
[13:30.030 --> 13:37.770]  In this information age, the incredible technologies that we depend on every day present us with both great promise and great peril.
[13:38.470 --> 13:42.830]  That's why I've designated October as National Cybersecurity Awareness Month.
[13:43.250 --> 13:48.050]  Hopefully the politicians will eventually learn user education does not work.
[13:48.930 --> 13:56.210]  Lieutenant General Keith Alexander, former director of the NSA, has been promoted and assigned as commander of the new United States Cyber Command.
[13:56.870 --> 14:00.950]  The Cyber Command will be in charge of cyber warfare and the security of military networks.
[14:01.170 --> 14:05.250]  It will be based in Fort Meade, Maryland, right next to the National Security Agency.
[14:05.590 --> 14:05.890]  Huh.
[14:06.130 --> 14:07.050]  How convenient.
[14:08.450 --> 14:19.110]  The non-profit Air Force Association has gathered 200 teams from the U.S., South Korea, and Japan to participate in the largest high school cyber defense competition called CyberPatriot 2.
[14:19.590 --> 14:24.790]  The competition begins November 7th, with teams consisting mostly of junior ROTC cadets.
[14:25.590 --> 14:27.650]  And now for this week's Stack of Shame.
[14:27.830 --> 14:33.290]  The list of all known open vulnerabilities 30 days old or older as cataloged by the Zero Day Initiative.
[14:33.870 --> 14:37.590]  This list has gotten considerably shorter since first being featured on HNNCast.
[14:38.130 --> 14:40.390]  We here at HNN know that the vendors are watching.
[14:40.590 --> 14:41.910]  We have the logs to prove it.
[14:42.150 --> 14:43.970]  Are we motivating them to fix their holes?
[14:44.150 --> 14:44.910]  We hope so.
[14:45.290 --> 14:49.290]  If you want to reach those same vendors, contact us at sales at hackernews.com.
[15:42.520 --> 15:45.180]  Yep, Hewlett Packard is still at the bottom dweller.
[15:45.180 --> 15:47.200]  We know you're watching, HP.
[15:47.480 --> 15:48.320]  Do you not care?
[15:49.520 --> 15:51.300]  That's it for this week's HNNCast.
[15:51.460 --> 15:54.380]  I've been your host, Space Rogue, and you've been watching the Hacker News Network.
[15:58.440 --> 16:03.320]  Remember, if you have any news you think we should report, send it to news at hackernews.com.
[16:06.880 --> 16:08.900]  You have been watching HNNCast.
[16:09.080 --> 16:11.240]  This is Space Rogue for the Hacker News Network.
[16:16.280 --> 16:18.700]  Find a dude, find a dude, find a dude bad things.